Part 3: Law enforcement processing Chapter 3: Rights of the data subject Sections 49 and 50: Automated individual decision-making
Section 49 prohibits the controller from making a "significant decision" based solely on automated processing unless the decision is required or authorised by law. A "significant decision" is one which result in adverse legal effects concerning the data subject or significantly affects the data subject. Where the controller is required or authorised by law to make a significant decision, section 50 sets out the safeguards that will apply to such a decision (which is defined as a "qualifying significant decision"). Such safeguards include a duty on the controller to inform the data subject of an automated decision and his or her right to request (within a month of being notified) that the controller reconsider the decision or take a new decision on the basis of human intervention. These provisions are in relation to fully automated decision-making and not to automated processing. Automated processing (including profiling) is when an operation is carried out on data without the need for human intervention. It is regularly used in law enforcement to filter down large data sets to manageable amounts for a human operator to then use. Automated decision-making is a form of automated processing and requires the final decision to be made without human interference.
	The Article 29 working party guidelines on automated decision-making for the purposes of the GDPR (but equally applicable here) suggests that a decision will be "based solely on automated processing" unless the level of human intervention "is meaningful, rather than just a token gesture. It should be carried out by someone who has the authority and competence to change the decision."
	In practice, currently automated decision-making that leads to an adverse outcome is rarely used in the law enforcement context and is unlikely to have any operational implications.