Automated Decision-Making (ADM)

Article 22(1) UK GDPR provides: "The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her." The ICO's guidance explains that "Article 22 of the UK GDPR has additional rules to protect individuals if you are carrying out solely automated decision-making that has legal or similarly significant effects on them." For a decision to be 'solely' automated there must be no genuine human involvement in the decision-making process — human involvement that is merely token, or that does not actually influence the outcome, will not take a decision outside Article 22.

The restriction is not absolute: solely automated decision-making with legal or similarly significant effects is only permitted where it is necessary for entering into or performing a contract with the individual, authorised by law, or based on the individual's explicit consent — and, where special category data is involved, additional conditions apply. Organisations relying on one of these grounds must still put safeguards in place, including telling individuals about the processing, giving them a simple way to request human intervention or challenge the decision, and carrying out regular checks that automated systems are working as intended.