Taming the algorithm

The right not to be subject to an automated decision
in the General Data Protection Regulation

Dissertation
der Rechtswissenschaftlichen Fakultät
der Universität Zürich
zur Erlangung der Würde eines Doktors der Rechtswissenschaft

vorgelegt von

Paweł Kuch
aus Polen

genehmigt auf Antrag von
Prof. Dr. Florent Thouvenin
und
Prof. Dr. Felix Uhlmann

Taming the algorithm by Paweł Kuch is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License, except where otherwise noted.

© 2022 – CC BY-NC-ND (Werk), CC BY-SA (Text)

Author: Paweł Kuch
Publisher: EIZ Publishing (eizpublishing.ch)
Production, Set & Distribution: buch & netz (buchundnetz.com)
ISBN:
978-3-03805-509-9 (Print – Softcover)
978-3-03805-510-5 (PDF)
978-3-03805-511-2 (ePub)
DOI: https://doi.org/10.36862/eiz-509
Version: 1.00 – 20220826

The dissertation was submitted by Paweł Kuch and adopted by the Faculty of Law of the University of Zurich, represented by Dean Prof. Dr. Thomas Gächter, on 6 April 2022.
It was supervised by Prof. Dr. Florent Thouvenin and Prof. Dr. Felix Uhlmann.

The open access publication of this book has been published with the support of the Swiss National Science Foundation (SNF).

This work is available in print and various digital formats in OpenAccess. Additional information is available at: https://eizpublishing.com/publikationen/taming-the-algorithm/.

The publication is also available on the website of the Zurich Central Library:
https://www.zb.uzh.ch/de/

1

Acknowledgements

For a practicing Attorney-at-Law, coming back to academia is an exciting experience. After years of immediate and decisive actions regarding a variety of legal topics and numerous different laws and regulations, a time of peaceful research and thorough analysis of one particular subject is an intriguing change.

I want to take this opportunity to thank the people who enabled and aided this fantastic adventure.

I would like to extend my immense appreciation to my supervisor, Professor Florent Thouvenin, who encouraged me to write a doctoral dissertation on automated decision-making. Thank you very much for your open-minded approach and challenging but valuable counsel. Our discussions were always very inspirational and gave me a great sense of intellectual enjoyment.

Great thanks to Professor Marcin Moskalewicz, whose example and advice helped me decide to take a scholar and researcher path.

I would also like to thank Mrs. Ana-María Llorente for her support and sharing inside views on cooperation with the data protection supervising authorities regarding my dissertation topic. Your interesting observations and thorough analysis helped me to obtain a better perspective on the subject matter.

Also, I owe many thanks to my brother, Karol Kuch. Without your example and support, I would not be a lawyer in the first place.

This project would not have been possible without my fantastic family’s help and support, especially my wonderful wife. Anna, I am forever thankful for all your unselfish love and kindness. Nadia and Lena, thank you for your patience and understanding – you are the best daughters in the world!

And finally, separate words of appreciation to the Law Faculty and Zurich University for the excellent opportunity to do my Ph.D. here. It is a remarkable and vibrant place. Your beautiful library and its hard seats will stay in my memory forever.

Zurich, 12 January 2022 Paweł Kuch

2

Table of Contents

Acknowledgments

Table of contents

Abbreviations

Bibliography

Materials

Table of figures

Chapter 1 Setting the goals

Background

Research focus

Research objectives

Adopted methodology

Aim of the research

Value of the research

Chapter 2 Genesis of the European personal data protection laws and
automated decision-making provisions

Common roots of privacy and data protection

Concepts of privacy and data protection

Emancipation of data protection from privacy right

Evolution and ever-growing fundamentalism of the data
protection rights

Evolution of data protection rights

Data protection as a fundamental right in the EU legal
framework

Non-prohibitive character of EU data protection laws

Empowerment of the supervisory authorities

Rationale for including automated decision-making provisions in
data protection laws

Roots of automated decision-making provisions

Historical views

Data Protection Directive’s travaux préparatoires perspective

Anthropocentric perspective

Chapter 3 Main interpretational rules, methods and principles
concerning European Union legislation

Independent legal system

Main interpretational methods, and principles concerning
European Union legislation

Grammatical method.

Systematic or contextual interpretation; the principle of
effectiveness (effet utile)

Teleological interpretation

Subjective or historical interpretation; travaux préparatoires

Summary

Chapter 4 Role of recitals

Non-binding effect of a preamble; the purpose of recitals

Recitals in the GDPR

Recitals referring to Art. 22 GDPR

Chapter 5 Guidelines on Automated individual decision-making
and Profiling for the purposes of the GDPR

Guidelines on Art. 22 GDPR

Position of guidelines in the EU legal framework

Controversial genesis of the A29WP Guidelines

Controversial content of Guidelines; sophistries of the A29WP

Chapter 6 Current state of research

“General prohibition of automated decision-making”

Confusions regarding Art. 22 GDPR

Scholarly authors

Dreyer and Schulz

Mendoza and Bygrave

Kaminski

Wachter, Mittelstadt, Floridi

Tosoni

Commentary authors

Esser, Kramer, Lewinski

Gola

Martini

Chapter 7 Automated individual decision-making, including
profiling, and its legal meaning; Art. 22(1) GDPR

Definition of automated individual decision-making

Insignificant disparities of automated decision-making
definitions under Art. 15(1) DPD and Art. 22(1) GDPR

Components of Art. 22(1) GDPR explained

Profiling

Distinguishing profiling in the GDPR

Risks regarding profiling

Automated form of processing

Personal data

Evaluating the personal aspects of a natural person

Chapter 8 Employing the CJEU canon for interpretation of Art. 22 GDPR

Grammatical interpretation of Art. 22 GDPR

Contextual interpretation of Art. 22 GDPR

Teleological interpretation of Art. 22 GDPR

Historical interpretation of Art. 22 GDPR

Chapter 9 Provisions influencing automated individual decision-making

The decision – a focal point of derogation under Art. 22(2);
the GDPR principles perspective

Lawfulness of processing; relation between Art. 6(1) and
Art. 22(2) GDPR

Principle of lawfulness

Relation between Art. 6(1) and Art. 22(2) GDPR

Minimum requirements to safeguard personal data – Art. 22(3) GDPR

The right to human intervention

The A29WP views on the right to human intervention

Human intervention – a requirement to maintain
anthropocentric legal consensus

The right to express the individual’s point of view

The right to contest the decision

General prohibition of using an individual’s sensitive personal data
for automated decision-making purposes – Art. 22(4) GDPR

Obligation to inform individuals about the existence of
automated decision-making (Article 13, 14 and 15 of the GDPR) and
“the right to explanation”

Principle of transparency

Individualized transparency

Systemic transparency

Supportive role of the right to be informed and the right
to explanation in keeping the algorithmic decision-making
accountable

Chapter 10 Summary and conclusions

Research objectives – introduction

Research objectives – findings

Research objectives – conclusions

Primary objectives

Secondary objectives

Recommendations

Contribution to knowledge

Abstract

Curriculum Vitae

3

Abbreviations

A29WP

Article 29 Working Party – Working Party on the Protection of Individuals with regard to the Processing of Personal Data (Art. 29 of the Data Protection Directive)

ADM

automated decision-making

AG

Advocate General

AI

artificial intelligence

cf.

conferre; compare

Charter

Charter of Fundamental Rights of the European Union

CJEU

Court of Justice of the European Union

CoE

Council of Europe

Convention 108

Convention for the protection of individuals with regard to the automatic processing of personal data

Council

The Council of Europe

DPD

Data Protection Directive – Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data OJ L 281, 23/11/1995 p. 31-50.

DPIA

Data Protection Impact Assessment

e.g.

exempli gratia; for example

ECHR

European Convention on Human Rights

ECtHR

European Court of Human Rights

EDPB

European Data Protection Board

eds.

Editors

EU

European Union

GDPR

General Data Protection Regulation

Guidelines

Guidelines on Automated Individual Decision-Making and Profiling for the Purposes of Regulation 2016/679 adopted by Article 29 Working Party

i.a.

inter alia; among others

i.e.

id est; that is

Lisbon Treaty

Treaty on European Union & Treaty on the Functioning of the European Union

No.

Number

OECD

Organisation for Economic Cooperation and Development

p./pp.

Page/pages

para.

Paragraph

Recitals

Recitals of the GDPR

SSRN

Social Science Research Network

TEU

Treaty on European Union

TFEU

Treaty on the Functioning of the European Union

UDHR

Universal Declaration of Human Rights (1948)

v.

Versus

Vol.

Volume

4

Bibliography

Literature

Almada, M., ‘Human Intervention in Automated Decision-Making: Toward the Construction of Contestable Systems,’ (June 2019), ICAIL ’19: Proceedings of the Seventeenth International Conference on Artificial Intelligence and Law.

Ananny, M., Crawford, K., ‘Seeing without Knowing: Limitations of the Transparency Ideal and its Application to Algorithmic Accountability,’ (2018), New Media & Society, v. 20(3): 973-989.

Andenas, M., Zleptnig, S., ‘Surveillance and Data Protection: Regulatory in the EU and the Member States,’ (2003), European Business Law Review,14(6):765-813.

Arnull, A., ‘The European Union and Its Court of Justice,’ (2006), Oxford University Press.

Asimov, I., ‘Runaround,’ (March 1942), in Astounding Science Fiction, John W. Campbell, Jr. (ed), Street & Smith Publications, Inc.

Bailey, D., ‘The role of Guidelines in EU competition law,’ (2013), Brick Court Chambers King’s College London.

Beveridge, F., Nott, S., ‘A Hard Look at Soft Law,’ (1998), in Paul Craig and Carol Harlow (eds.), ‘Lawmaking in the European Union,’ Kluwer Law International.

Bignami, F.E., ‘Protecting Privacy Against the Police in the European Union: The Data Retention Directive,’ (2006), GWU Legal Studies Paper No 2013–43.

Bigus, J.P., ‘Data Mining with Neural Networks: Solving Business Problems from Application Development to Decision Support,’ (1996), McGraw-Hill, New York.

Bird & Bird, ‘Profiling and Automated Decision-Taking,’ (n.d.), available at:
https://www.twobirds.com/~/media/pdfs/gdpr-pdfs/35–guide-to-the-gdpr–profiling-and-automated-decisiontaking.pdf

Blumenstock, J., Cadamuro, G., On, R., ‘Predicting Poverty and Wealth from Mobile Phone Metadata,’ (November 27, 2015), Science 350, no. 6264: 1073–76.

Bosco, F., D’Angelo, E., Vermeersch, E., ‘National Data Protection Authorities’ views on profiling,’ in ‘Profiling Technologies in Practice. Applications and Impact on Fundamental Rights and Values,’ (2015), Wolf Legal Publishers.

Brennan-Marquez, K., Henderson, S.E., ‘Artificial intelligence and role-reversible judgment,’ (2019), Journal of Criminal Law and Criminology, v. 109(2).

Breyer, P., ‘Telecommunications Data Retention and Human Rights: The Compatibility of Blanket Traffic Data Retention with ECHR,’ (2005), 11(3) European Law Journal 365.

Brkan, M., ‘Do Algorithms Rule the World? Algorithmic Decision-Making in the Framework of the GDPR and Beyond,’ (August 1, 2017), a revised version of this paper has been published in International Journal of Law and Information Technology, (11 January 2019).

Brown, L., Kennedy, T., ‘The Court of Justice of the European Communities,’ (1994), Sweet & Maxwell as in Holland, J., Julian, W., ‘Learning Legal Rules – A Student’s Guide to Legal Method and Reasoning,’ (2010), Oxford University Press.

Brugger, W., ‘Legal Interpretation, Schools of Jurisprudence, and Anthropology: Some Remarks From a German Point of View,’(1994), The American Journal of Comparative Law, Volume 42, Issue 2, Pages 395–421.

Bygrave, L.A., ‘Automated Profiling: Minding the Machine: Article 15 of the EC Data Protection Directive and Automated Profiling,’ (2001), Computer Law & Security Review 17.

Bygrave, L.A., ‘Data protection law, approaching its rationale, logic and limits,’ (2002), Kluwer Law International.

Bygrave, L.A., Berg, P., ‘Reflections on the Rationale for Data Protection Laws,’ (1995), in Bing and Torvund (eds.), 25 Years Anniversary Anthology in Computers and Law Oslo.

Cannataci, J.A., Mifsud-Bonnici, J.P., ‘Data Protection Comes of Age: The Data Protection Clauses in the European Consitıtutional Treaty,’ (2005), Information and Communications Technology Law, 14(1):5-15.

Carey, P., ‘Data Protection: A Practical Guide to UK and EU law,’ (2015), 4th edn, Oxford University Press.

Chasalow, I., ‘The First National Law and Electronics Conference,’ (March 1, 1961), v. 4(7), 31-34, available at:
https://journals.sagepub.com/doi/abs/10.1177/000276426100400709

Clarke, A.C., ‘Profiles of the Future: An Inquiry into the Limits of the Possible,’ (revised edition, 1973), Popular Library.

Crawford, K., Schultz, J., ‘Big Data and Due Process: Toward a Framework to Redress Predictive Privacy Harms,’ (2014), Boston College Law Review, v. 55(1).

David, R., Brierley, J., ‘Major Legal Systems in the World Today,’ (1985), Stevens&Sons Ltd, as in Holland, J., Julian, W., ‘Learning Legal Rules – A Student’s Guide to Legal Method and Reasoning,’ (2010), Oxford University Press.

De Hert, P., Gutwirth, S., ‘Data protection in the case law of Strasbourg and Luxemburg: Constitutionalisation in action,’ (2009), in De Hert, P., Gutwirth, S.and others (eds.), ‘Reinventing data protection?’ Springer.

de Montjoye, Y.A., et al., ‘Predicting Personality Using Novel Mobile Phone-Based Metrics,’ (2013), in ‘Social Computing, Behavioral-Cultural Modeling and Prediction,’ ed. Greenberg, A.M., Kennedy, W.G., Bos, N.D., Springer-Verlag Berlin Heidelberg, vol. 7812, 48–55.

Desai, D.R., Kroll, J.A., ‘Trust But Verify: A Guide to Algorithms and the Law,’ (2017), Harvard Journal of Law & Technology, v. 31(1).

Dreyer, S., Schulz, W., ‘The GDPR and Automated Decision-Making: Will It Deliver?: Potentials and Limitations in Ensuring the Rights and Freedoms of Individuals, Groups and Society as a Whole,’ (2019), Discussion Paper Ethics of Algorithms, Bertelsmann Stiftung.

Düwell, M., Bos, G., ‘Human rights and future people — Possibilities of argumentation,’ (2016), Journal of Human Rights, 15:2, 231-250.

Dworkin, G., ‘The Theory and Practice of Autonomy,’ (1988), Cambridge University Press.

Epp, C., Lippold, M., Mandryk, R.L., ‘Identifying Emotional States Using Keystroke Dynamics,’ (2011), in ‘Proceedings of the 2011 Annual Conference on Human Factors in Computing Systems – CHI ’11,’ the 2011 annual conference, Vancouver, BC, Canada, ACM Press.

Esser, M., Kramer, P., von Lewinski, K., ‘Datenschutz-Grundverordnung Bundesdatenschutzgesetz und Nebengesetze, Kommentar. Heymanns Kommentare,’ (2017), Carl Heymanns Verlag.

EU Parliament, Counsel & Commission, ‘Joint Practical Guide of the European Parliament, the Council and the Commission for Persons Involved in the Drafting of European Union Legislation’, (2015), Publications Office of the European Union.

Fabbrini, F., ‘Human Rights in the Digital Age, The European Court of Justice Ruling in the Data Retention Case and its Lessons for Privacy and Surveillance in the us,’ (2015), Harvard Human Rights Journal.

Faiden, R., Beauchamps, T., ‘A History and Theory of Informed Consent,’ (1996), Oxford University Press.

Fayyad, U., Uthurusamy, R., ‘Data Mining and Knowledge Discovery in Databases,’ (1996), 39 Communications of the ACM, no 11.

Fennelly, N., ‘Legal Interpretation at the European Court of Justice,’ (1996), 20 Fordham International Law Journal, at 664.

Flemming, J.E., ‘Securing Deliberative Autonomy,’ (1995), Stanford Law Review, Vol. 48, N.1.

Flemming, J.E., ‘Securing Deliberative Democracy,’ (2004), Fordham Law Review, Vol. 72.

Froomkin, A.M., ‘Flood Control on the Information Ocean: Living with Anonymity, Digital Cash, and Distributed Databases,’ (1996), 15 University of Pittsburgh Journal of Law and Commerce, 395, Pt IV.

Galetta, U.D., Hofmann, H.C.H., Puigpelat, O.M., Ziller, J., ‘The general principles of EU administrative procedural law, European Parliament,’ (2015), Government of the Republic of Slovenia: Public Administration development Strategy 2015-2020.

Gellert, R., Gutwirth, S., ‘The Legal Construction of Privacy and Data Protection,’ (2013), Computer Law & Security Review (CSLR), Vol. 29, 522–530.

General Secretariat of the Council, ‘Manual of Precedents for Acts Established within the Council of the European Union,’ (2015), no. SN 1250/6/10 REV 6 (n.d.).

Gola, P., ‘Datenschutz-Grundverordnung VO (EU) 2016/679, Kommentar,’ (2017), C.H.Beck.

Gonzalez Fuster, G., Gellert, R., ‘The fundamental right of data protection in the European Union: in search of an uncharted right,’ (2012), International Review of Law, Computers & Technology 26.

González, E.G., ‘Understanding the Legal Provisions That Allow Processing and Profiling of Personal Data—an Analysis of GDPR Provisions and Principles,’ (2019), Springer, Europäische Rechtsakademie ERA Forum  19:597–621.

Grabenwarter, C., ‘The European Convention for the Protection of Human Rights and Fundamental Freedoms: A Commentary,’ (2014), Beck/Hart Publishing.

Gutwirth, S., Friedewald, M., Wright, D., Mordenite, E., et al., ‘Legal, social, economic and ethical conceptualisations of privacy and data protection,’ (2010), Deliverable D1 of the Prescient project, ‘Privacy and emerging fields of science and technology: Towards a common framework for privacy and ethical assessment,’ access:
https://zenodo.org/record/1182961#.YFoJ7GPdj-Y

Habermas, J., ‘Between Facts and Norms,’ (1996), MIT Press.

Helberger, N., Zuiderveen Borgesius, F., Reyna, A., ‘The Perfect Match? A Closer Look at The Relationship Between EU Consumer Law and Data Protection Law,’ (2017), 54 Common Market Law Review 1427.

Helios, J., Jedlecka, W., ‘The Derivative Concept of Legal Interpretation in Eu Law,’ (2018), Acta Universitatis Wratislaviensis No 3867, Przegląd Prawa i Administracji 115.

Herman, S., ‘Quot Judices Tot Sententiae: A Study of English Reaction to Continental Interpretative Techniques,’ (1981), Legal Studies, 165.

Hildebrandt, M., ‘Privacy as protection of the incomputable self: from agnostic to agonistic machine learning,’ (2019), Theoretical Inquiries in Law (TIL), 20(1), 83-121.

Hildebrandt, M., ‘The Dawn of a Critical Transparency Right for the Profiling Era,’ (2012), Bus, J. (ed.), Digital Enlightenment Yearbook 41.

Holland, J., Webb, J., ‘Learning Legal Rules – A Student’s Guide to Legal Method and Reasoning,’ (2010), Oxford University Press.

Hubick, K.T., ‘Artificial Neural Networks in Australia,’ (1992), Dept. of Industry, Technology & Commerce, Canberra.

Itzcovich, G., ‘The Interpretation of Community Law by the European Court of Justice,’ (2009), 10 German Law Journal 537, at 552.

Jones, P., ‘Group Rights,’ (Summer 2016 Edition), The Stanford Encyclopedia of Philosophy Edward N. Zalta (ed.).

Kaltheuner, F., Bietti, E., ‘Data Is Power: Towards Additional Guidance on Profiling and Automated Decision-Making in the GDPR,’ (March 14, 2018), Journal of Information Rights, Policy and Practice 2, no. 2.

Kamarinou, D., Millard, C., Singh, J., ‘Machine Learning with Personal Data,’ (2016), Queen Mary School of Law Legal Studies Research Paper 247.

Kaminski, M.E., ‘The Right to Explanation, Explained,’ (2018), University of Colorado Law Legal Studies Research Paper No. 18‐24.

Keats Citron, D., ‘Technological Due Process,’ (2008), Washington University Law Review, v. 85(6).

Keats Citron, D., Pasquale, F.A., ‘The Scored Society: Due Process for Automated Predictions,’ (2014), Washington Law Review, v. 89(1).

Kennedy, R., ‘Algorithms and the Rule of Law,’ (April/May 2017), Cambridge University Press, Legal Information Management, 17(3), 170-172.

Kim, P. T., ‘Auditing Algorithms for Discrimination,’ (2017), University of Pennsylvania Law Review Online, v. 166(1).

Klimas, T., Valiciukaite, J., ‘the Law of Recitals in European Community Legislation,’ (2008), Vol. 15:1, ILSA Journal of International & Comperative Law.

Koops, B.J., ‘The Trouble with European Data Protection Law,’ (2014), 4 International Data Privacy Law 250.

Korff, D., ‘New Challenges to Data Protection Study – Working Paper No. 2: Data Protection Laws in the EU: The Difficulties in Meeting the Challenges Posed by Global Social and Technical Developments’, (2010), European Commission DG Justice, Freedom and Security.

Kosta, E., ‘Consent in European Data Protection Law,’ (2013), Brill, Nijhoff Studies in European Union Law, Volume: 3.

Kroll, J.A., Huey, J., Barocas, S., Felten, E.W., Reidenberg, J.R., Robinson, D.G., Yu, H., ‘Accountable Algorithms,’ (2017), University of Pennsylvania Law Review, v. 165(3).

Lasser, M., ‘Judicial Deliberations: A Comparative Analysis of Judicial Transparency and Legitimacy,’ (2005), Oxford University Press.

Lenaerts, K., ‘The Rule of Law and the Coherence of the Judicial System of the European Union,’ (2007), 44 Common Market Law Review 1625.

Lenaerts, K., Gutiérrez-Fons, J.A., ‘To Say What the Law of the EU Is: Methods of Interpretation and the European Court of Justice,’ (2013), Working Paper, access:
http://cadmus.eui.eu//handle/1814/28339.

Lenaerts, K., Gutiérrez-Fons, J.A., ‘The Constitutional Allocation of Powers and General Principles of EU law,’ (2010), 47 Common Market Law Review 1629.

Liccardi, I., Abdul-Rahman, A., Chen, M., ‘I Know Where You Live: Inferring Details of People’s Lives by Visualizing Publicly Shared Location Data,’ (2016), in ‘Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems – CHI ’16,’ the 2016 CHI Conference, Santa Clara, California, USA, ACM Press.

Linderfalk, U., ‘On the Interpretation of Treaties,’ (2007), Springer Netherlands.

Llorens, A.A., ‘The European Court of Justice, More than a Teleological Court,’ (1999), Cambridge Yearbook of European Legal Studies 2: 373–98.

Lord Justice Leveson, ‘An Inquiry into the Culture, Practices and Ethics of the Press,’ (2012), London.

Lynskey, O., ‘Deconstructing Data Protection: The “Added-Value” of a Right to Data Protection in the EU Legal Order,’ (2014), 63 ICLQ, 585.

Lynskey, O., ‘The “Europeanisation” of Data Protection Law,’ (2017), Cambridge Yearbook of European Legal Studies.

Malgieri, G., ‘Automated Decision-Making in the EU Member States: The Right to Explanation and Other suitable Safeguards in the National Legislations,’ (October 2019), Computer Law & Security Review, v. 35(5).

Malgieri, G., Comandé, G., ‘Why a Right to Legibility of Automated Decision-Making Exists in the GDPR,’ (November 1, 2017), International Data Privacy Law 7, no. 4: 243–65.

Martini, M., ‘DS-GVO Art. 22 Automatisierte Entscheidungen im Einzelfall einschliesslich Profiling,’ in Paal, B.P., Pauly, D., ‘Datenschutz-Grundverordunung,’ (2017), C.H.Beck.

Mendoza, I. & Bygrave, L.A., ‘The Right Not to Be Subject to Automated Decisions Based on Profiling,’ (2017), SSRN Scholarly Paper, Rochester, NY: Social Science Research Network.

Micheler, E., Whaley, A., ‘Regulatory Technology: Replacing Law with Computer Code,’ (2020), Eur Bus Org Law Rev, v. 21, 349–377

Monroe, R., ‘Thing Explainer: Complicated Stuff In Simple Words,’ (2015), Houghton Mifflin Harcourt.

Mortier, R., Haddadi, H., Henderson, T., McAuley, D., Crowcrof, J., ‘Human Data Interaction: The Human Face of the Data-Driven Society,’ (2014), MIT Technology Review.

Murphy, C., ‘EU Counter-Terrorism Law: Pre-Emption and the Rule of Law,’ (2012), Hart Publishing, Oxford.

Novek, E., Sinha, N., Gandy, O., ‘The value of your name,’ (1990), 12 Media, Culture and Society.

O’Neill, O., ‘Autonomy and Trust in Bioethics,’ (2002), Gifford Lectures, Cambridge University Press.

Oana Andreea, S., ‘European Competition Soft Law in European Courts: A Matter of Hard Principles?,’ (2008), European Law Journal, Vol. 14, No. 6, 753-772.

Orla, L., ‘Deconstructing Data Protection: The “Added-Value” of a Right to Data Protection in the EU Legal Order,’ (2014), 63 ICLQ, 585.

Pasquale, F., ‘The Black Box Society: The Secret Algorithms That Control Money and Information,’ (2015), Harvard University Press.

Pescatore, P., ‘Les objectifs de la Communauté européenne comme principes d’interprétation dans la jurisprudence de la Cour de justice,’ (1972), in Miscellanea W.J. Ganshof van der Meersch, vol. 2, at 325-363;

Pipe, P., ‘The Data Mart: A New Approach to Data Warehousing,’ (1997), 11 International Review of Law Computers & Technology 251-261.

Poiares Maduro, M., ‘Interpreting European Law: Judicial Adjudication in the Context of Constitutional Pluralism,’ (2007), 1 European Journal of Legal Studies 1.

Prakash Sinha, S., ‘The Anthropocentric Theory of International Law as a Basis for Human Rights,’ (1978), Case Western Reserve Journal of International Law (JIL), v. 10 (469).

Preschal, S., De Leeuw, M. E., ‘Transparency: A General Principle of EU Law?’ in: Bernitz U., Nergelius, J., Cardner, C., (eds), ‘General Principles of EC Law in a Process of Development,’ (2008), Kluwer Law International.

Proust, O., ‘Unravelling the Mysteries of the GDPR Trilogues,’ (2015), Privacy, Security and Information Law.

Rasmussen, H., ‘Towards a Normative Theory of Interpretation of Community Law,’ (1993), University of Chicago Press.

Raz, J., ‘The Morality of Freedom,’ (1986), Oxford: Clarendon Press.

Reich, N., ‘Understanding EU Law,’ (2005), Intersentia Publishers.

Rouvroy, A., ‘Privacy, Data Protection, and the Unprecedented Challenges of Ambient Intelligence,’ (2008), Studies in Ethics, Law, and Technology 2, no. 1.

Rustici, C., ‘GDPR Profiling and Business Practice,’ (April 1, 2018), Computer Law Review International 19, no. 2, 34–43.

Salachová, B., Vítek, B., ‘Interpretation of European law, selected issues,’ (2013), Acta Universitatis Agriculturae et Silviculturae Mendelianae Brunensis, Mendel University Press, vol. 61(7), pages 2717-2720.

Schermers, H., Waelbroeck, D., ‘Judicial Protection in the European Union,’ (2001), Kluwer Law International.

Schønberg, S., Frick, K., ‘Finishing, Refining, Polishing: On the Use of travaux preparatoires as an Aid to the Interpretation of Community Legislation,’ (2003), 28 European Law Review at 155.

Schwartz, P.M., Reidenberg, J.R., ‘Data Privacy Law: A Study of United States Data Protection,’ (1996), MICHIE Law Publishers 102.

Schwartz, P.M., Treanor, W.M., ‘The New Privacy,’ (2003) Michigan Law Review, 101.

Selbst, A.D., Barocas, S., ‘The Intuitive Appeal of Explainable Machines,’ (2018), 87 Fordham Law Review 1085.

Shapiro, M., ‘The problems of independent agencies in the United States and the European Union,’ (1997), 4(2) Journal of European Public Policy 276.

Skitka, L.J., Mosier, K., Burdick, M.D., ‘Accountability and Automation Bias,’ (2000), International Journal of Human-Computer Studies 52, no. 4,701–17.

Sloot, B., ‘Legal fundamentalism: is data protection really a fundamental right,’ (2017), in Ronald Leenes et al., (eds.), ‘Data Protection and Privacy: (In)Visibilities and Infrastructures,’ Issues in Privacy and Data Protection, Springer International Publishing.

Snyder, F. ‘The Effectiveness of European Community Law: Institutions, Processes, Tools and Techniques,’ (1993), Modern Law Review 56.

Snyder, F., ‘Soft Law and Institutional Practice in the European Community: Institutions, Processes, Tools and Techniques,’ (1993), EUI Working Papers (Law), No. 93/5.

Solove, D.J., ‘“I’ve Got Nothing to Hide” and Other Misunderstandings of Privacy,’ (2007), 44 SanDiegoLRev 745, 771.

Spaho, E., ‘Data Protection: When Others Know What You Want Before You Do,’ (2019), n.d, access:
https://www.academia.edu/39917165/Data_Protection_When_Others_​Know_​What_You_Want_Before_You_Do

Stefan, O.A., ‘European Competition Soft Law in European Courts: A Matter of Hard Principles?’ (2008), European Law Journal, Vol. 14, No. 6, 753-772.

Tallberg, J., ‘Paths to Compliance: Enforcement, Management, and the European Union,’ (2002), International Organization, Vol. 56, Issue 3, 609–643.

Tichý, L., et al., ‘Evropské Právo, 4.Vydání,’ (2010), C.H.Beck.

Tosoni, L., ‘The Right to Object to Automated Individual Decisions: Resolving the Ambiguity of Article 22(1) of the General Data Protection Regulation,’ (May 14, 2021), 11 International Data Privacy Law (2021) (Forthcoming), University of Oslo Faculty of Law Research Paper No. 2021-07, available at:
https://ssrn.com/abstract=3845913

van der Sloot, B., ‘Legal fundamentalism: Is data protection really a fundamental right,’ (2017), in R. Leenes, R. van Brakel, S. Gutwirth, & P. De Hert (eds.), Data protection and privacy: (In)visibilities and infrastructure (pp. 3-30). (Law, Governance and Technology Series; Vol. 36), (Issues in Privacy and Data Protection).

Veale, M., Edwards, L., ‘Clarity, Surprises, and Further Questions in the Article 29 Working Party Draft Guidance on Automated Decision-Making and Profiling,’ (2018), Computer Law & Security Review: The International Journal of Technology Law and Practice 34, no. 2, 398–404.

Veale, M., Edwards, L., ‘Slave to the Algorithm? Why a “Right to an Explanation” is Probably Not the Remedy You Are Looking For,’ (2017), 16 Duke Law and Technology Review 18.

Wachter, S., Mittelstadt, B., and Floridi, L., ‘Why a Right to Explanation of Automated Decision-Making Does Not Exist in the GDPR,’ (2016), SSRN Scholarly Paper (Rochester, NY: Social Science Research Network.

Wachter, S., Mittelstadt, B., Russell, C., ‘Counterfactual Explanations without Opening the Black Box: Automated Decisionmaking and the GDPR,’ (2018), Harvard Journal of Law & Technology, v. 31(2).

Wacks, R., ‘Privacy – A very short introduction,’ (2010), Oxford University Press.

Wagner, W.E., ‘Administrative Law, Filter Failure, and Information Capture,’ (2010), 59 Duke Law Journal.

Walzer, M., ‘Interpretation and Social Criticism,’ (1987), Cambridge, Mass., Harvard.

Warren, S., Brandeis, L., ‘The Right to Privacy,’ (Dec. 15, 1890), Harvard Law Review, Vol. 4, No.5.

Wihlborg, E., Larsson, H., Hedström, K., ‘“The Computer Says No!”: A Case Study on Automated Decision-making in Public Authorities,’ (2016), 49th Hawaii International Conference on System Sciences (pp. 2903-2912).

Woolridge, M., Jennings, N.R., ‘Intelligent Agents: Theory and Practice,’ (1995), The Knowledge Engineering Review, Volume 10, no 2.

Youyou, W., Kosinski, M., Stillwell, D., ‘Computer-Based Personality Judgments Are More Accurate than Those Made by Humans,’ (January 27, 2015), Proceedings of the National Academy of Sciences 112, no. 4: 1036–40.

Zarsky, T.Z., ‘Transparent Predictions,’ (2013), University of Illinois Law Review, v. 2013(4).

Zuiderveen Borgesius, F., Poort, J., ‘Online Price Discrimination and EU Data Privacy Law,’ (2017), 40 Journal of Consumer Policy 3, 347–366.

Articles and Blogs

Adams, D., ‘8 bold biohacks that blur the line between human and machine,’ (May 20, 2017), digital trends:
https://www.digitaltrends.com/cool-tech/coolest-biohacking-implants/

Andrews, E., ‘Who invented the internet?’, 2013, available at:
https://www.history.com/news/who-invented-the-internet

Bogost, I., ‘My Cow Game Extracted Your Facebook Data,’ (March 22, 2018), The Atlantic, available at:
https://www.theatlantic.com/technology/archive/2018/03/my-cow-game-extracted-your-facebook-data/556214/

Cisco Annual Internet Report, N/D, available at:
https://www.cisco.com/c/en/us/solutions/collateral/service-provider/visual-networking-index-vni/vni-hyperconnectivity-wp.html

Darabi, A., ‘New Zealand explores machine-readable laws to transform government,’ (11 May 2018), Apolitical, available at:
https://apolitical.co/solution_article/new-zealand-explores-machine-readable-laws-to-transform-government/

Gardner, B., ‘Making the law machine-readable,’ (16 October 2018), available at:
https://www.wavelength.law/blog/makingthelawmachinereadablepart1#_ftn6

Gobry, P.E., ‘The Internet Is 20% Of Economic Growth,’ (May 24, 2011), Business Insider, available at:
http://www.businessinsider.com/mckinsey-report-internet-economy-2011-5?IR=T

Google ‘2019 research review: Insights we uncovered in 2019 that will take you into 2020,’ available at:
https://www.thinkwithgoogle.com/data-collections/2019-consumer-insights/

Heimes, R., ‘Top 10 Operational Impacts of the GDPR: Part 5 – Profiling,’ iapp.org, accessed 10 November 2019:
https://iapp.org/news/a/top-10-operational-impacts-of-the-gdpr-part-5-profiling/

Huawei and Oxford Economics, ‘Digital Spillover: Measuring the True Impact of the Digital Economy,’ (2017), Huawei and Oxford Economics, available at:
https://www.huawei.com/minisite/gci/en/digital-spillover/files/gci_digital_spillover.pdf

Internet Association, ‘New Report Calculates the Size of the Internet Economy,’ (December 10, 2015), Internet Association, available at:
https://internetassociation.org/121015econreport/

Kleinman, Z., ‘Facebook denies “listening” to conversations,’ (28 October 2017), BBC News, available at:
https://www.bbc.com/news/technology-41776215

Knight, D., ‘Personal computer history: 1975-1984,’ 2014, available at:
https://lowendmac.com/2014/personal-computer-history-the-first-25-years/

Multistakeholder Expert Group, ‘Contribution from the Multistakeholder Expert Group to the Stock-Taking Exercise of June 2019 on One Year of GDPR Application,’ (June 13, 2019), Multistakeholder Expert Group, available at:
https://ec.europa.eu/info/sites/info/files/report_from_multistakeholder_expert_group_on_gdpr_application.pdf

Nielsen, N., ‘EU Data Retention Law Said to Breach Privacy Rights’, (13 Dec. 2013), EU Observer, access:
https://euobserver.com/justice/122459

Posey, B., ‘Digital implants are the future — but are they a good idea?,’ (May 13, 2019), techgenix:
http://techgenix.com/digital-implants/

Sahin, G., ‘Privacy and Data Protection in EU,’ (2010), available at:
https://www.academia.edu/11755258/Privacy_and_Data_Protection_in_EU

Schumaker, E., ‘Elon Musk unveils brain chip implant: “It’s like a Fitbit in your skull,”’ (August 30, 2020), abc News:
https://abcnews.go.com/Health/elon-musk-unveils-brain-chip-implant-fitbit-skull/story?id=72703840

Su, J., ‘Why Amazon Alexa Is Always Listening To Your Conversations: Analysis’, (May 16, 2019), Forbes, available at:
https://www.forbes.com/sites/jeanbaptiste/2019/05/16/why-amazon-alexa-is-always-listening-to-your-conversations-analysis/?sh=309331f22378

United Nations, ‘Gender Equality and Women’s Empowerment,’ United Nations Sustainable Development (blog), accessed May 24, 2019 at:
https://www.un.org/sustainabledevelopment/gender-equality/

5

Materials

EU Treaties

Treaty of Lisbon amending the Treaty on European Union (TEU) and the Treaty establishing the European Community (TEEC), signed at Lisbon, 13 December 2007, Official Journal C306/1, 17.12.2007 (cited: Lisbon Treaty)

Treaty on European Union (consolidated version as amended by the Treaty of Lisbon) 9 May 2008, Official Journal C115/3, 9.5.2008 (cited: TEU)

Treaty on the Functioning of the European Union (consolidated version as amended by the Treaty of Lisbon) Official Journal 115/47, 9.5.2008 (cited: TFEU)

Charters and Conventions

Charter of Fundamental Rights of the European Union, (2000/C364/01), Official Journal (OJ) C 326, 26/10/2012, (cited: Charter)

UN General Assembly, Universal Declaration of Human Rights, 10 December 1948, 217 A(III)

Council of Europe, European Convention for the Protection of Human Rights and Fundamental Freedoms, as amended by Protocols Nos. 11 and 14, 4 November 1950, ETS 5 (cited: ECHR)

 ―  Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, ETS. No. 108, Strasbourg, 18 January 1981 (cited: Convention 108)

 ―  Draft modernized Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, ETS. No. 108, drawn up by the Council of Europe’s Ad hoc Committee on Data Protection (version of September 2016, document GR-J(2016)14)

 ―  Additional Protocol to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, regarding Supervisory Authorities and Transborder Data Flows, ETS No. 181, open for signature 8 November 2001, in force 1 July 2004

 ―  Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108), CM(2018)2-final, adopted on 17-18 May 2018

 ―  Resolution (73) 22 on the Protection of the Privacy of Individuals vis-à-vis Electronic Data Banks in the Private Sector, September 26, 1973, published in: Forward in Europe, Legal Supplement No. 10, Information Bulletin of the Directorate of Legal Affairs, April 1974

 ―  Resolution (74) 29 on the Protection of the Privacy of Individuals vis-à-vis Electronic Data Banks in the Public Sector, September 20, 1974, published in: Forward in Europe, Legal Supplement No. 11, Information Bulletin of the Directorate of Legal Affairs, October 1974

Vienna Convention on the Law of Treaties (United Nations [UN]), 1155 UNTS 331, 8 ILM 679 (1969), 63 AJIL 875 (1969) (cited: Vienna Convention)

EU Regulations

Regulation (EC) No 1907/2006 of the European Parliament and of the Council of 18 December 2006 concerning the Registration, Evaluation, Authorisation and Restriction of Chemicals (REACH), establishing a European Chemicals Agency, amending Directive 1999/45/EC and repealing Council Regulation (EEC) No 793/93 and Commission Regulation (EC) No 1488/94 as well as Council Directive 76/769/EEC and Commission Directives 91/155/EEC, 93/67/EEC, 93/105/EC and 2000/21/EC (Regulation 1907/2006/EC)

Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance), OJ L 119, 4.5.2016 (cited: GDPR)

EU Directives

Council Directive 2004/113/EC of 13 December 2004 implementing the principle of equal treatment between men and women in the access to and supply of goods and services OJ L 373, 21.12.2004 (cited: Directive 2004/113)

Directive 1995/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, (Data Protection Directive) Official Journal (OJ) L 281, 23/11/1995, (cited: DPD)

Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC [2006] OJ2006 L105/54 (cited: Directive 2006/24).

National Legislation

Belgian data protection legislation (Wet tot omzetting van de Richtlijn 95/46/EG van 24 oktober 1995 van het Europees Parlement en de Raad betreffende de Bescherming van Natuurlijke Personen in verband met de Verwerkung van Persoonsgegevens en betreffende de Vrij Verkeer van die Gegegevens, van 11 december 1998)

Lesotho’s Data Protection Act No. 5 of 2012

South Africa’s Protection of Personal Information Act No. 4 of 2013

Hesse Data Protection Act of 7 October 1970, originally published in Gesetz- und Verordnungsblatt I S. 625-627 i.d.F. des Hess. Gesetztes zur Anpassung des Landesrechts an das Einführungsgesetz zum Strafgesetzbuch vom 4. September 1974 (GVBl. I S. 361) Gesetz- und Verordnungsblatt II 300-10 (unofficial English translation by OECD, Informatics Studies No. 2, 1971, pp. 47 et seqq.) (cited: Hesse Data Protection Act)

Portuguese data protection law (Lei no 10/91 de 12. de Abril 1991, da Proteccão de Dados Pessoais face à Informática); replaced and repealed by Law no 67/98 of 26.10.1998)

Spanish data protection law (Ley organica 5/1992 de 29 de octubre 1992, de Regulación del Tratamiento Automatizado de los Datos de Carácter Personal; replaced and repealed by Law 15/1999 of 13.12.1999)

German Federal Data Protection Act of 14 January 2003, published in Federal Law Gazette I, (in German called: Bundesdatenschutzgesetz (BDSG))

The Macao Special Administrative Region, Act 8/2005 on Personal Data Protection

Senegal’s Data Protection Act of 2008 – Loi n° 2008-12 sur la Protection des données à caractère personnel

Angola’s Law No. 22/11 on Data Protection of 2011

Resolutions, Communications, Decisions and Guidelines

Commission Decision 2000/520/EC of 26 July 2000 on the adequacy of the protection provided by the safe harbour privacy principles and related frequently asked questions issued by the US Department of Commerce, OJ L 215/7

Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 on the adequacy of the protection provided by the EU-U.S. Privacy Shield, OJ L 207/1

Commission of the European Communities – Proposal for Council Directive concerning the protection of individuals in relation to the processing of personal data, COM(90) 314 final – SYN 287, 13.9.1990

 ―  Amended proposal for Council Directive on the protection of individuals with regard to the processing of personal data and on the free movement of such data, COM(92) 422 final – SYN 287, 15.10.1992

European Commission – Report SURVANT Research Project. Fast Track to Innovation, (2017).

European Data Protection Board – Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects, Adopted on 9 April 2019 (version for public consultation)

European Parliament – ‘Guidelines on Gender-neutral Language in the European Parliament,’ (2018)

 ―  (2013) Report on the proposal for a regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (GDPR) (COM(2012)0011 – C7-0025/2012 – 2012/0011(COD))(A7- 0402/2013; PE501.927v05-00),

European Union and Council of Europe, eds., ‘Handbook on European Data Protection Law,’ 2018 edition.

Ontario Information and Privacy Commissioner, Data Mining: Staking a Claim on Your Privacy, January 1998.

The Council of Europe’s Guidelines on the Protection of Individuals with Regard to the Processing of Personal Data in the World of Big Data (adopted 23 January 2017; T-PD(2017)01)

UN General Assembly, Resolution Adopted by the General Assembly, (22 March 2017), Human Rights Council, A/HRC/34/L.7/Rev.1

Opinions of Data Protection Authorities

Article 29 Working Party – Guidelines on Automated Individual Decision-Making and Profiling for the Purposes of Regulation 2016/679 (Wp251rev.01) – European Commission (cited: Guidelines)

 ―  Transfers of personal data to third countries: Applying Articles 25 and 26 of the EU data protection directive, (Wp 12, 1998), DG XV D/5025/98 – European Commission

 ―  Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679, WP248 rev. 01, (17/EN), 4 October 2017 (cited: DPIA Guidelines)

Case Law

Court of Justice of the European Union

CJEU, 113/80 Commission v. Italy [1981]

CJEU, 148/78 Pubblico Ministero v. Ratti [1979]

CJEU, 15/74 Centrafarm v. Sterling Drug [1974]

CJEU, 152/84 Marshall v. Southampton and South West Area Health Authority [1986]

CJEU, 187/87 Land de Sarre and others [1988]

CJEU, 24/62 Germany v. Commission [1963]

CJEU, 26/62 Van Gend en Loos v. Nederlandse Administratie der Belastingen [1963]

CJEU, 267/83 Diatta [1985]

CJEU, 27/72 Aimer v. Einfuhr-und Vorratsstelle Getreide [1972]

CJEU, 29/69 Stauder [1969]

CJEU, 31/70 Getreide-und Futtermittel Handelsgesellschaft v. Hza Hamburg-Altona [1970]

CJEU, 314/85 Foto-Frost v. Hza Lübeck-Ost [1987]

CJEU, 41/74 Van Duyn v. Home Office [1974]

CJEU, 43/75 Defrenne v. Sabena [1976]

CJEU, 46/76 Bauhuis [1977]

CJEU, 6/64 Costa v. ENEL [1964]

CJEU, 6/77 Schouten v. Hoofdprodukstchap voor Akkerbouwprodkten [1977]

CJEU, 78/70 Deustche Gramophon v. Metro [1971]

CJEU, C-105/03 Pupino [2005]

CJEU, C-115/08 ČEZ [2009]

CJEU, C-116/02 Gasser [2003]

CJEU, C-12/11 McDonagh [2013]

CJEU, C-127/08 Metock and others [2008]

CJEU, C-134/08 Hauptzollamt Bremen v. Tyson Parketthandel [2009]

CJEU, C-136/04 Deutsches Milch-Kontor [2005]

CJEU, C-139/01 Österreichischer Rundfunk and Others [2003]

CJEU, C-149/10 Chatzi [2010]

CJEU, C-149/17, Bastei Lübbe [2018]

CJEU, C-156/98 Germany v. Commission [2000]

CJEU, C-162/09 Lassal [2010]

CJEU, C-162/97 Nilsson and others [1998]

CJEU, C-167/04 JCB Service v. Commission [2006]

CJEU, C-17/96 Badische Erfrischungs-Getränke v. Land Baden-Württemberg [1997]

CJEU, C-18/18 Glawischnig-Piesczek v. Facebook Ireland Limited [2019]

CJEU, C-220/03 BCE v. Germany [2005]

CJEU, C-226/11 Expedia [2012]

CJEU, C-263/06 Carboni e derivati [2008]

CJEU, C-27/72 Aimer v. Einfuhr-und Vorratsstelle Getreide [1972]

CJEU, C-275/96 Kuusijärvi [1998]

CJEU, C-28/08 European Commission v. Bavarian Lager [2010]

CJEU, C-29/99 Commission v. Council [2002]

CJEU, C-291/05 Eind [2007]

CJEU, C-292/97 Karlsson and others [2000]

CJEU, C-301/04 Commission v. SGL Carbon [2006]

CJEU, C-302/87 Parliament v. Council [1988]

CJEU, C-306/05 SGAE [2006]

CJEU, C-308/97 Manfredi [1998]

CJEU, C-31/70 Getreide-und Futtermittel Handelsgesellschaft v. Hza Hamburg-Altona [1970]

CJEU, C-310/08 Ibrahim and Secretary of State for the Home Department [2010]

CJEU, C-314/12 UPC Telekabel Wien [2014]

CJEU, C-316/95 Generics BV v. Smith Kline & French Laboratories Ltd [1997]

CJEU, C-337/06 Bayerischer Rundfunk and others [2007]

CJEU, C-346/08 Commission v. United Kingdom [2010]

CJEU, C-361/06 Feinchemie Schwebda and Bayer CropScience [2008]

CJEU, C-362/14, Maximillian Schrems v. Data Protection Commissioner [2015]

CJEU, C-403/99 Italy v. Commission [2001]

CJEU, C-410/09 Polska Telefonia [2011]

CJEU, C-434/97 Commission v. France [2000]

CJEU, C-439/11P Ziegler [2013]

CJEU, C-443/03 Leffler [2005]

CJEU, C-459/99 MRAX [2002]

CJEU, C-47/02 Anker [2003]

CJEU, C-476/01 Kapper [2004]

CJEU, C-48/07 Les Vergers du Vieux Tauves [2008]

CJEU, C-480/08 Teixeira [2010]

CJEU, C-501/11P Schindler [2013]

CJEU, C-507/17 Google Inc v. Commision nationale de l’informatique et des libertés (CNIL) [2019]

CJEU, C-518/07 European Commission v. Federal Republic of Germany [2010]

CJEU, C-52/09 TeliaSonera [2011]

CJEU, C-582/08 Commission v. United Kingdom [2010]

CJEU, C-6/77 Schouten v. Hoofdprodukstchap voor Akkerbouwprodkten [1977]

CJEU, C-635/11 Commission v. Netherlands [2013]

CJEU, C-68/94 France and Others v. Commission [1998]

CJEU, C-70/88 Parliament v. Council [1990]

CJEU, C‑131/12 Google Spain v. Agencia Española de Protección de Datos (AEPD) [2014]

CJEU, C‑311/18 Maximillian Schrems v. Data Protection Commissioner [2020]

CJEU, C‑507/17 Conseil d’État v. Google [2019]

CJEU, Joined cases 56 and 58/64 Consten and Grundig v. Commission [1966]

CJEU, Joined cases C-189, 202, 205, 208 and 213/02, Dansk Rørindustri and others v. Commission [2005]

CJEU, Joined cases C-293/12 and C-594/12 Rights Ireland Ltd v. Minister for Communications, Marine and Natural Resources and Others and Kärntner Landesregierung and Others [2014]

CJEU, Joined cases C-402/07 and C-432/07 Sturgeon and Others and Böck v. Air France [2009]

CJEU, Joined cases C-46/93 and C–48/93 Brasserie du Pêcheur v. Germany and The Queen v. HM Treasury, ex parte Factortame [1996]

CJEU, Joined cases C-468/10 and C-469/10, Asociación Nacional de Establecimientos Financieros de Crédito (ASNEF) and Federación de Comercio Electrónico y Marketing Directo (FECEMD) v. Administración del Estado [2011]

CJEU, Joined cases C-6/90 and C–9/90 Francovich and Bonifaci v. Italy [1991]

CJEU, Joined cases C-92/09 and C-93/09 Volker und Markus Schecke and Hartmut Eifert [2010]

CJEU, T-111/08 MasterCard [2012]

CJEU, T-148/89 Tréfilunion v. Commission [1995]

CJEU, T-16/91 Rendo NV (NL) v. Comm’n of the E.C. [1996]

CJEU, T-283/15 Esso Raffinage v. ECHA [2018]

Opinion of AG Jääskinen in case C-582/08 Commission v. United Kingdom [2010]

Opinion of AG Mayras in case 67/79 Fellinger [1980]

Opinion of AG Ruiz-Jarabo Colomer in case C-110/03 Belgium v. Commission [2005]

Opinion of AG Szpunar in case C-149/17 Bastei Lübbe [2018]

Opinion of AG Szpunar in case C-18/18 Glawischnig-Piesczek v. Facebook Ireland Limited [2019]

Opinion of AG Szpunar in case C-610/15 Stichting Brein [2017]

Opinion of AG Szpunar in case C‑507/17 Conseil d’État v. Google [2019]

Opinion of AG Villalón in case C-314/12 UPC Telekabel Wien [2013]

Opinion of AG Villalón in joined cases C-293/12 and 594/12 Digital Rights Ireland Ltd v. Minister for Communication et al and Kärtner Landesregierung et al. [2014]

Other Courts and National Decision

ECtHR, case Satakunnan Markkinapörssi Oy and Satamedia Oy v. Finland, No. 931/13, [2017]

German Federal Court of Justice in Karlsruhe – so-called SCHUFA case concerning the use of automated credit-scoring systems: VI ZR 156/13 [2014]

UK Court of Appeal, Magor and St.Mellors v. Newport Corporation [1950]

6

Table of figures

Fig. 3.1
Methods of interpretation, source: Brugger, p. 403

Fig. 6.1
Decision tree on the scope of application of Art. 22(1) GDPR,
source: Dreyer/Schulz, p. 20

Fig. 7.1
Comparison of wording of Art. 22(1) GDPR and Art. 15(1) DPD
(own graphic)

Fig. 9.1
Internal structure of Art. 22 GDPR (own graphic)

Fig. 9.2
Relation between Art. 6(1) and Art. 22(2) GDPR (own graphic)

Fig. 9.3
Decision tree on the scope of application of Art. 22(1) GDPR,
source: own graphic based on Dreyer/Schulz, p. 20

1

Setting the goals

Background

In the last century, data protection rights, initially originating from privacy rights, evolved and became an independent and burgeoning separate field of law. Internet development brought a considerable change to the business but also significantly influenced the legal environment. Considering the immense amount of data, including personal data, being processed, the more complicated and more sophisticated software and hardware tools being used, the more detailed and accurate the predictions and evaluations of customers – natural persons – the more data protection rights are needed.

Whether the data protection rights are treated only as an ordinary consumer right as wished by some[1] or as a fundamental right as the European Union sees them,[2] the fact remains that the data protection rights developed and progressed remarkably. From literal nonexistence, with its roots ingrained in the concept of privacy, the idea of personal data protection rights slowly started to build its significance and recognizability. What began as a few articles of the Council of Europe Resolutions,[3] through Convention 108,[4] evolved into the EU directive,[5] later recognized by the Charter[6] and by the so-called Lisbon Treaty[7] as one of the fundamental rights of the EU, this important subject is now governed by the General Data Protection Regulation.[8]

With the GDPR, the EU introduced the “state of the art” concept of legislation that not only through its provisions but, in fact, through its goals and objectives deals with the subject matter. This small but significant shift from provision-oriented to goal-oriented law also indicates the development in the drafting of legal acts. Like a computer that started as a simple machine used to solve simple tasks, deals now with very complex and complicated issues, and can make automated or even autonomous decisions with real-life legal consequences, the legal act like the GDPR, to a much greater extent than previous legislative attempts, is self-explanatory and self-interpretative.

The GDPR brings a refreshed set of rules concerning the processing of personal data of natural persons – residents of the European Union. The regulation revitalizes the existing rights by clarifying and extending them and introducing new rights.[9] Among the refreshed ones is “one of the most enigmatic, intriguing and forward-looking rights provided by the European Union”[10] – the right not to be subject to automated decision-making, including profiling, governed now by Art. 22 GDPR.

Research focus

However, many authors, scholars and authorities regard this right not as a ‘right’ of the data subject – an identified or identifiable natural person[11] – but as a prohibition of automated decision-making directed to controllers[12] and processors;[13] a general prohibition repealed only if one of three situations enumerated in paragraph (2) of Art. 22 GDPR occurs – so-called legal grounds, which allow automated decision-making.

A passage from the “Guidelines on Automated Individual Decision-Making and Profiling for the Purposes of Regulation 2016/679” adopted by Article 29 Working Party, illustrates the mindset of the working party, shared[14] also by the official GDPR supervising authority that replaced the A29WP – the European Data Protection Board:

“Interpreting Art. 22 GDPR as a prohibition rather than a right to be invoked means that individuals are automatically protected from the potential effects this type of processing may have.”[15]

But even before the A29WP adopted its Guidelines, some scholars expressed similar beliefs:

“…if Art. 22(1) is treated as a prohibition (…) decisional processes not falling within the paragraph two derogations are prohibited regardless of the action or inaction of the data subject, effectively allowing only those decisional processes specified in paragraph two (subject to the qualifications in the third and fourth paragraphs). Such a result conforms better than the former result [if Art. 22(1) is treated as a right] to the overarching aim of Art. 22 – and, indeed, of the Regulation more generally – to safeguard privacy and data protection as fundamental human rights in the face of technological and other developments,”[16] or:

“(…) interpreting Art. 22 as a prohibition grants greater protections by default to data subject’s interests, at least in the cases in which Art. 22(3) would apply. As a prohibition, data controllers would be legally obliged to limit automated decision-making meeting the definition in Art. 22(1) GDPR to the three cases identified in Art. 22(2) GDPR (contract, Union or Member State law, consent).”[17]

Notably, the misunderstanding of the automated decision-making provisions has existed since the DPD came into force in 1995.[18] Although the wording of Art. 15 DPD[19] was clearly granting the data subject the right not to be subject to automated decision-making, the margin of appreciation principle allowed the Member States to interpret the provisions either as a prohibition or a right to object.[20] The broad discretion in adapting directives led the Member States to implement this right and associated protections differently.[21]

Article 15 DPD was implemented by Austria, Belgium, Germany, Finland, the Netherlands, Portugal, Sweden, and Ireland as a general prohibition.[22] The UK had a different model: data subjects were entitled to request that no automated decision was made about them but not in the case of so-called “exempt decisions.” In cases where data subjects had not lodged such a request, controllers had to inform[23] them that an automated decision had been made and about the outcome.[24]

In contrast, understanding Art. 22(1) GDPR as a right to object to a decision,[25] would not pre-emptively restrict the types of automated decision-making undertaken by controllers to the three cases defined in Art. 22(2) GDPR. Instead, these restrictions would only apply when a data subject objects against a specific instance of automated decision-making or automated decision itself. At that point, processes not meeting the requirement of Art. 22(2) GDPR would need to stop, and the safeguards specified in Art. 22(2)(b) or Art. 22(3) GDPR would never be triggered.[26] The controller is still able to make the decision; however, such a decision can no longer be made automatically, meaning that the controller is required to perform a manual evaluation of gathered personal data, devoting extra time and resources, and is forced to introduce a human in the process of decision-making. Such interpretation much better captures the regulation’s spirit, is consistent with other rights of the data subject and obligations of the controller, is coherent with the regulation’s goals and objectives and respects the rule of law.

Research objectives

The main objective of this dissertation is to examine the argumentation regarding the interpretation of Art. 22(1) GDPR and to establish whether it is a right of the data subject to oppose results of automated decision-making or a general prohibition aimed at the controllers to perform automatic decision-making.

From the very beginning of the research, an overwhelmingly common belief about the prohibitive nature of Art. 22 GDPR and the simultaneous absence of in-depth analysis and poor argumentation supporting this claim were striking. The CJEU methodology adopted in this dissertation sets the legal interpretation angle and helps to approach the topic from a fresh perspective and assures the same results of the logical inference.

The secondary objective is to evaluate and assess the remaining parts of Art. 22 GDPR but also other provisions linked to automated decision-making: the relation between Art. 22(2) GDPR and Art. 6(1) GDPR, which defines the legal basis for the processing of personal data, safeguards envisaged by Art. 22(3) GDPR, the explicit prohibition of automated decision-making based on special categories of personal data and the exceptions to that – Art. 22(4) GDPR, controllers notification duties – ‘the right to explanation’ (Art. 13 and 14 GDPR) and ‘the right to access’ (Art. 15 GDPR), in the context of automated decision-making.

To achieve the primary goal, there is a need to clarify the fundamental right to data protection and its origin first. How the non-existing right evolved from the right to privacy only to emancipate a few decades later to a position of the separate fundamental right, no more relying on the right to privacy? What are the legal instruments of data protection, and why is the right not to be subject to automated decision-making included in the data protection legislation and what are the implications of this fact?

Understanding that the objectives and motivations of the right to privacy and the right to data protection differ from each other is crucial to recognize that the right referred to in Art. 22(1) GDPR does not aim to limit automated decision-making but grants the data subject the final word whether or not he/she agrees to be subjected to the evaluation made by a machine and not a person. The requirement, which only allows for maintaining the anthropocentric legal consensus that the human is the supreme entity and should decide for him/her self. Rejection of the anthropocentric approach could lead to a situation where machines and their algorithms are perceived as superior to humans and their decisions.[27]

In this realization, it also helps to note that the fundamental right to data protection in general and the right not to be subject to automated decision-making, in particular, are not absolute rights[28] and that they have to be balanced with other fundamental rights,[29] like the freedom of information[30] or the freedom to conduct a business.[31]

Adopted methodology

To accurately interpret a law, it is critical to adopt the correct interpretation method, as there are usually negative consequences of misinterpretation. And the penalties for infringements of the GDPR are particularly grievous.[32] As its own interpretative rules govern the EU law, a strong emphasis has to be laid on recognizing the methodology and its application in legal research. This dissertation refers to and implements the legal interpretation methodology of the CJEU, the court that oversees the application of the European Union law and based on Art. 19(3)(b) TEU constitutes the supreme judicial authority when it comes to interpreting the union law. The CJEU’s interpretative canon was inspired by the Vienna Convention on the Law of Treaties[33] and consist of four methods: grammatical, contextual, teleological and historical, with the last one being used only scarcely.

Additionally, the CJEU is obliged to guard one of the basic principles on which the European Union is built – the rule of law,[34] a principle the European Commission defines as “a prerequisite for the protection of all the other fundamental values of the Union, including for fundamental rights and democracy. Respect for the rule of law is essential for the very functioning of the EU: for the effective application of EU law, for the proper functioning of the internal market, for maintaining an investment-friendly environment and for mutual trust. The core of the rule of law is effective judicial protection, which requires the independence, quality and efficiency of national justice systems.”[35]

Aim of the research

The general aim of the research is to explore and examine the legal frames in which the provisions regarding automated decision-making are contained, to analyze different legal and paralegal instruments at the disposal of the EU authorities, to evaluate accessible literature and to establish why so many authors believe that the right not to be subject to automated decision-making should be considered a prohibition of automated decision-making.

To everyone that takes in their hands the text of the GDPR for the first time, the number of Recitals that precede the essence of the regulation – the law itself, is surprising. Although not legally binding and almost twice the size of the binding legal provisions, the extensive preamble plays an important supportive role, explaining the reason for a particular provision. The CJEU recognizes this supportive function and quotes recitals to aid the teleological perception of an enacting term.

The Guidelines, a very influential tool used by the supervising authority established by the GDPR – the EDPB – bring even more confusion than Recitals. Adopted first by the A29WP only to be endorsed by the EDPB on its first session, based on the prerogative conferred by Art. 70(1)(e) and (f) GDPR, the Guidelines are considered the so-called ‘soft law’.[36] The use of soft-law instruments has increased in the activity of political and administrative bodies. Therefore the European courts have been called to assess the legitimization of soft-law instruments and their legal effects.[37] The case law reflects that there has been an increase in references to non-legally binding provisions. The CJEU resorts to a recital or guideline when deciding the case or refers to it to strengthen a particular argument.[38]

So far, the CJEU has not been challenged with questions directly related to the Guidelines or the right not to be subject to automated decision-making itself. Still, this dissertation often relies on the court’s preliminary rulings to support the findings with the heretofore judgments that can help predict the most probable outcome in such a case and demonstrate how the CJEU applies its methodology.

Alongside the analysis of preliminary rulings of the CJEU, I refer to existing literature and academic articles. Among many compelling and valuable papers, the most influential ones try to explain the ambiguities related to the subject matter:

Isak Mendoza and Lee A. Bygrave, “The Right Not to Be Subject to Automated Decisions Based on Profiling,” (2017), SSRN Scholarly Paper, Rochester, NY: Social Science Research Network. The authors present a critical analysis of the provisions of Art. 22 GDPR, with lines of comparison drawn to these provisions’ predecessor – namely Art. 15 DPD. Their basic argument is that Art. 22 GDPR on its face provides persons with stronger protections from automated decision-making than Art. 15 DPD did. However, doubts are raised as to whether Art. 22 GDPR will have a significant practical impact on automated profiling.

Stephan Dreyer and Wolfgang Schulz, “The GDPR and Automated Decision-Making: Will It Deliver?: Potentials and Limitations in Ensuring the Rights and Freedoms of Individuals, Groups and Society as a Whole,” (2019), Discussion Paper Ethics of Algorithms, Bertelsmann Stiftung. The authors recognize the risks of automated decision-making and profiling yet conclude that the GDPR can help create an environment in which interaction with automated decision-making systems will remain an everyday occurrence through narrowing the definition of automated decision and providing rather far-reaching exceptions.

Michael Veale and Lilian Edwards, “Clarity, Surprises, and Further Questions in the Article 29 Working Party Draft Guidance on Automated Decision-Making and Profiling,” (2018), Computer Law & Security Review: The International Journal of Technology Law and Practice 34, no. 2. The authors analyze the A29WP Guidelines in the context of scholarly debates and technological concerns. They notice that the A29WP forays into the less-trodden areas of bias and non-discrimination, the significance of advertising, the nature of “solely” automated decisions, impacts upon groups and the inference of special categories of data – at times, appearing more to be making or extending rules than to be interpreting them.

Sandra Wachter, Brent Mittelstadt and Luciano Floridi, “Why a Right to Explanation of Automated Decision-Making Does Not Exist in the GDPR,” (2017), International Data Privacy Law. The authors claim that the ambiguity and limited scope of the ‘right not to be subject to automated decision-making’ contained in Art. 22 GDPR (from which the alleged ‘right to explanation’ stems) raises questions over the protection actually afforded to data subjects. These problems show that the GDPR lacks precise language as well as explicit and well-defined rights and safeguards against automated decision-making, and therefore runs the risk of being toothless.

Luca Tosoni, ‘The Right to Object to Automated Individual Decisions: Resolving the Ambiguity of Article 22(1) of the General Data Protection Regulation’, (May 14, 2021), 11 International Data Privacy Law (2021) (Forthcoming), University of Oslo Faculty of Law Research Paper No. 2021-07. Recognizing automated decision-making provisions as ambiguous, the author adopts the interpretation methodology of the CJEU and concludes that Art. 22 GDPR does not constitute a prohibition of automated decision-making.

Margot E. Kaminski, “The Right to Explanation, Explained,” (2019), Berkeley Technology Law Journal, Vol. 34, No. 1. The author responds to the authoritative Guidelines of the A29WP and debates over the right to explanation (a right to information about individual decisions made by algorithms) that has obscured the significant algorithmic accountability regime established by the GDPR. She also recognizes that the GDPR’s provisions on algorithmic accountability, which include a right to explanation, have the potential to be broader, stronger and deeper than the preceding requirements of the DPD.

Value of the research

Even though the right not to be subject to automated decision-making is present on the legal scene for some time now, well established in Art. 15 DPD and now in the refreshed form in Art. 22 GDPR, the academic study on this topic lacks critical investigation. Most of the authors focus on parts of the subject only, often building on an advanced established premise and unclear methodology, which prevents the readers and other researchers from performing the same reasoning.

My research should help determine the logical inference by introducing and applying the conclusive interpretative tools already adopted by the most important court in the European Union legal framework – the CJEU. The well-recognized and commonly practiced methodology enables everybody to reach similar conclusions.

Furthermore, looking at the topic from a different angle also brings added value to the research on data protection law as it allows to find new arguments and new connections between the legal provisions within the GDPR.

Recognizing the regulation’s teleological structure helps filter the particular provisions through the lenses of the goals and objectives of the GDPR and the fundamental right to personal data protection in general

van der Sloot, p. 21: “(…) it seems that it would be wise for courts and national legislators not to replicate the terminology of the European Union but instead treat data protection as an ordinary consumer right.” ↵

Art. 8 of the Charter and Art. 16 TFEU. ↵

Council of Europe, Resolution (73) 22, ‘On the protection of the privacy of individuals vis-à-vis electronic data banks in the private sector, Committee of Ministers 224th meeting 26 September 1973’; Council of Europe, Resolution (74) 29, On the protection of the privacy of individuals vis-à-vis electronic data banks in the public sector, Committee of Minsters 236th meeting 20 September 1974. ↵

Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, Strasbourg, 28 January 1981, ETS 108. ↵

Data Protection Directive - “Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data”. ↵

Charter of Fundamental Rights of The European Union (2000/C 364/01). ↵

Consolidated versions of the Treaty on European Union and the Treaty on the Functioning of the European Union, OJ C202/1. ↵

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR), OJ L 119, 4.5.2016. ↵

Most notably, the GDPR creates three new rights: Art. 17 - the “right to be forgotten”, Art. 18 – the “right to restriction of processing” and Art. 20 – the “right to data portability”. ↵

Mendoza/Bygrave, p. 1. ↵

Art. 4(1) GDPR – definition of ‘personal data’, which also incorporates the definition of ‘data subject’. ↵

Art. 4(7) GDPR – definition of ‘controller’. ↵

Art. 4(8) GDPR – definition of ‘processor’. ↵

During its first plenary meeting, the European Data Protection Board endorsed the GDPR related A29WP Guidelines, Positions and Recommendations including the ‘Guidelines on Automated Individual Decision-Making and Profiling for the Purposes of Regulation 2016/679’. ↵

Article 29 Working Party - Guidelines on Automated Individual Decision-Making and Profiling for the Purposes of Regulation 2016/679 (Wp251rev.01) - European Commission, p. 20. ↵

Mendoza/Bygrave, p. 10. ↵

Wachter/Mittelstadt/Floridi, p. 40. ↵

Bird & Bird, unpaginated, explains how different countries either have prohibitions or rights to object: “This could either be read as a prohibition on such processing or that the processing may take place but that individuals have a right to object to it. This ambiguity is also present in the Data Protection Directive and Member States differ in their approaches to the point.” ↵

Martini, p. 255. The author explains how the Germans made use of the margin of appreciation of Article 15 DPD and phrased it like a prohibition. ↵

Hildebrandt, p. 50, hints towards but does not make it explicit: “it may be that if I don’t exercise the right, the automated decision is not a violation of the directive.” Additionally, “the draft Regulation, however, stipulates that a person may only be subjected to automated decisions under specified conditions, implying that this right is not merely a right to object.” She further explains how the same can be true for the original draft Art. 20 GDPR proposal of 25th January 2012; cf. also Bygrave, p. 3, who sees Art. 15 DPD as sufficiently ambiguous to be interpreted as both a prohibition and a right to object. ↵

Wachter/Mittelstadt/Floridi p. 38. ↵

Cf. Korff, p. 84. Cf. also p. 84 ff for further details on how the other Member States implemented the DPD. ↵

Ibid. p. 37 ff. ↵

Wachter/Mittelstadt/Floridi, p. 39. ↵

Not confusing ‘objecting a decision’ with the ‘right to object to the processing of personal data’, defined by Art. 21(1) GDPR. ↵

Wachter/Mittelstadt/Floridi, p. 40. ↵

Cf. Chapters 2.3.4. and 9.3.3. ↵

Recital (4) GDPR. ↵

See e.g.: Case C‑507/17, Conseil d’État v. Google, para. 60 or Case C-18/18, Glawischnig-Piesczek v. Facebook Ireland Limited, opinion of AG para. 102. ↵

Art. 11 of the Charter. ↵

Ibid., Art. 16. ↵

Cf. Art. 83 GDPR: in paragraph (5) foresees administrative fines up to 20’000’000 Euro or in the case of an undertaking, up to 4% of the total worldwide turnover of the preceding financial year, whichever is higher. ↵

Vienna Convention on the Law of Treaties (United Nations [UN]), 1155 UNTS 331, 8 ILM 679 (1969), 63 AJIL 875 (1969). ↵

Art. 2 TEU. ↵

Cf. European Commission official website: https://ec.europa.eu/info/policies/justice-and-fundamental-rights/upholding-rule-law_en ↵

See e.g.: Tallberg, p. 615. ↵

Oana Andreea, p. 754. ↵

Ibid. ↵

2

Genesis of the European personal data protection laws and automated decision-making provisions

Common roots of privacy and data protection

Showing respect for and providing the conditions necessary for developing individual autonomy[1] and democracy[2] has become the most fundamental ethical and legal imperatives in contemporary western societies. These imperatives are perceived as a precondition to the legality and legitimacy of the law, from which stem the rights and liberties that allow individuals to live a self-determined, self-authored or self-created life.[3]

Among those fundamental rights and freedoms, the right to individual privacy (understood not merely as a right to be left alone but also as a right to self-determination disallowing paternalism from the state), and the right to data protection empowering individuals with means to control the collection, use and disclosure of personal information (on the assumption that lacking such control would subject those individuals to the unbalanced power of others – public authorities or private agents), function as the closest legal “proxies” to the moral concept of autonomy. As such, privacy and data protection laws are thus often perceived as the most efficient and direct legal instruments to protect individual autonomy[4] in the digital age.

Data protection laws grant people rights to oversee the use of their personal data, and they restrict the ways different actors may process them.[5] For centuries, people’s information and data have been collected, used and exchanged within the public domain. There have been debates pointing out that personal data protection did not aim at the citizen’s protection of personal privacy but rather the advancements of a legal framework undertaking the demands that technological evolution had brought about,[6] which was stimulated through the centralization of personal information in governmental and large organizations data banks.[7]

The idea behind data protection does not lie in the fact that data processing should not occur. On the contrary, such a pragmatic approach considers society’s needs and reasons, where public and private actors use personal information to have adequate functional systems. Consequently, data protection entails the protection against arbitrary or disproportionate data processing,[8] with privacy being one of the primary fundamental rights in direct line with data protection.[9] Together, privacy and data protection laws create an important fundamental tool against authoritative inclinations.

Art. 1 and Recital (4) GDPR only confirm the non-prohibitive concept of the UE data protection legal framework.

Concepts of privacy and data protection

The changes in society have transformed our perception of privacy.[10] The ancient Greeks regarded a life spent in the privacy of ‘one’s own’ – idion, as by definition, ‘idiotic’. Similarly, the Romans perceived privacy as merely a temporary refuge from the life of the res publica. Only in the late Roman Empire can one discern the initial stages of the recognition of privacy as a zone of intimacy.[11]

The 16th and 17th centuries were milestones for the ‘distinctly public realm’ generation because of the emergence of nation-states and theories of sovereignty.[12] The identification of a private domain free from authorities meddling emerged as a response to the claims of monarchs and later parliaments for unrestricted powers to make law.[13]

Since the last century, this change has had a remarkable significance in societies with the introduction of technology into everybody’s life. It is not a coincidence that perceiving privacy as a right of an individual had become popular in the late 19th century. In this period, the printed media had become accessible to most of society, and in this era, the first portable and inexpensive cameras invaded ordinary people’s lives.

Two lawyers, Warren and Brandeis, in their article published in 1890, concluded that the right to privacy has to be perceived under the common law.[14] Their definition of privacy as ‘the right to be left alone’[15] was based on the rapid diffusion of photography and press publications.[16]

However, initial concepts aimed at regulating data protection as separate from privacy began to formulate in some European countries only in the 1960s. And it was then the data protection laws started their autonomous existence.

The word ‘data’ derives from the Latin datum, which means ‘given’ – information in a visible form. Hence, data is something that is shared, given to others. Contrarily, privacy requires information to be kept secret and confidential. The split was inevitable.

Yet, data ‘protection’ reverses the pure free flow of information by constraining the amount and scope of processing the personal data, otherwise wild and potentially detrimental or even dangerous. In line with this principle – not everybody has to know everything about us, even though we have nothing to hide. The ‘burden of proof’ to whom the personal data belongs shifted from the people to organizations, which benefit from personal data processing.

The first data-protection law was enacted in the German Land of Hesse in 1970, followed by national legislations in Sweden (1973), Germany (1977) and France (1978).[17]

For many scholars,[18] Convention 108[19] is accepted as the first legally binding document for data protection. However, despite its legally binding nature and its influence on the European data protection regime, in establishing a common core of principles, the Council of Europe’s legal framework was deemed insufficient for data protection in the European Union.[20] The EU decided to introduce its own legal instrument: the Data Protection Directive. At that time, only the right to privacy and not the right to data protection was recognized as a fundamental right, so the DPD rested on the right to privacy as a point of reference for data protection and mentioned privacy many times.[21]

Since the entry into force of the Treaty of Lisbon[22] and the Charter of Fundamental Rights of the European Union,[23] the right to protection of personal data emerged as separate and independent from the right to privacy, a new fundamental right. The GDPR refers to it directly,[24] not mentioning the right to privacy once.

In the classical understanding, privacy is usually defined as an individual’s ability to be left alone, out of public view, free from surveillance or interference from others (individuals, organizations or the state) and in control of information about oneself. However, while privacy sets prohibitive limits that shield the individual against the state, public authorities and other actors and powers, data protection controls legitimate use of such forces, imposing a certain level of transparency and accountability. In other words, data protection controls and channels the legitimate processing of personal data[25] and safeguards the rights of the data subject.

Hence, privacy and data protection are not equivalents. There is a substantive difference between these two. On the one hand, privacy is broader than data protection; the latter is just a tool to protect the former. On the other hand, while both fundamental rights – to privacy and data protection – participate in protecting the private sphere, this is done in different ways.[26]

Privacy is protected by Art. 8.1 of the Council of Europe’s European Convention for Human Rights and when it comes to EU law, by Art. 7 of the Charter. Both instruments protect everyone’s “right to respect for his private and family life, his home and his correspondence” / “communications” – in the case of the Charter. This protection is not absolute according to the ECHR. Art. 8.2 states the conditions under which interferences with this right are allowed – three criteria of validity:[27] the law must foresee the interference, it must be necessary for a democratic society (and proportionate), and it must pursue a legitimate aim.[28]

Regarding the right to data protection, there is a broad range of instruments at the EU level, with the most important one preserved in Art. 16(1) TFEU[29] and in Art. 8 of the Charter.[30]

Emancipation of data protection from privacy right

The right to privacy – referred to in European law as the right to respect for private life – emerged in international human rights law in the Universal Declaration of Human Rights, adopted in 1948, as one of the protected human rights. Soon after the adoption of the UDHR, Europe too affirmed this right – in the European Convention on Human Rights, a legally binding treaty drafted in 1950. The UDHR and the ECHR were adopted well before the development of personal computers and the internet and before the rise of the information society.

Technological progress and digitalization have brought considerable advantages to individuals and society, improving quality of life, efficiency and productivity. At the same time, they present new risks to the right to respect private life. In response to the need for specific rules governing the collection and use of personal information, a new concept of privacy emerged, known in some jurisdictions as ‘informational privacy’ and in others as the ‘right to informational self-determination.’[31] This concept led to the development of special legal regulations that provide personal data protection.[32]

The right to respect private life and the right to the protection of personal data, although distinct, are closely related. Both strive to protect similar values, i.e. the autonomy and human dignity of individuals, by granting them an intimate sphere in which they can freely develop their personalities, think and shape their opinions. Thus, they are an essential prerequisite for exercising other fundamental freedoms, such as the freedom of expression, the freedom of peaceful assembly and association, and the freedom of religion.[33]

Article 8 of the Charter affirms the right to personal data protection and spells out the core values associated with this right. It provides that the processing of personal data must be fair, for specified purposes, and based on either the person’s consent or a legitimate basis laid down by law. The data subjects must have the right to access their personal data and to have it rectified. Compliance with this right must be subject to control by an independent authority.

The DPD reflected the data protection principles already contained in national laws and Convention 108 while often expanding them. It drew on the possibility provided for in Art. 11 of Convention 108, adding on instruments of protection. In particular, the introduction in the DPD of independent supervision as an instrument for improving compliance with data protection rules proved to be an essential contribution to European data protection law’s effective functioning. Consequently, the supervision mechanism was incorporated into Council of Europe law in 2001 by the Additional Protocol to Convention 108. The above illustrates the close interaction and positive influence of the two instruments over the years.[34]

The DPD established a detailed and comprehensive data protection order. However, in the EU legal system, directives (despite their misleading name) do not apply directly and must be transposed into the Member States’ national laws. Inevitably, Member States have a margin of discretion in transposing the directive’s provisions. Even though the directive was meant to provide complete harmonization[35] and a high level of protection, in practice, it was transposed differently in the Member States. That resulted in establishing diverse data protection rules across the EU, with definitions and rules interpreted differently in national laws. The levels of enforcement and the severity of sanctions also varied. Finally, there were significant changes in information technology since the drafting of the DPD in the mid-1990s. These reasons prompted the reform of EU data protection legislation.[36]

The reform led to the adoption of the GDPR in April 2016, after years of intense discussion. After adoption, the GDPR provided for a two-year transitional period. It became fully applicable on 25th May 2018, when the DPD was repealed.

The adoption of the GDPR modernized the EU data protection legislation, making it fit for protecting fundamental rights in the context of the digital age’s economic and social challenges. The GDPR preserves and develops the core principles and rights of the data subject provided for in the DPD. Additionally, the regulation introduced new obligations requiring organizations to implement data protection by design and by default, appoint a Data Protection Officer in certain circumstances, comply with the data subject’s new right to data portability, and with the principle of accountability.

More importantly, under the EU law, regulations are directly applicable; there is no need for national implementation. Thus, the GDPR provides a single set of data protection rules across the EU, which creates consistent data protection rules, establishing an environment of legal certainty from which economic operators and individuals as “data subjects” may benefit. However, even though the GDPR is directly applicable, the Member States are expected to update their existing national data protection laws to align with the regulation fully, yet are still able to apply a margin of discretion for specific provisions as stated in Recital (10).[37] Additionally, Recital (10), although not binding, stipulates one of the fundamental goals of the GDPR – harmonization.

The GDPR would not be able to play its role without the binding force of Art. 8(1) of the Charter, which together with Art. 16(1) of TFEU, as the primary law of the EU, established the right to the protection of personal data as a fundamental right and provided the legal legitimation for regulating the subject.

Evolution and ever-growing fundamentalism of the data protection rights

Evolution of data protection rights

Since the first recognition of data protection rights, not only the material scope but also the provisions in the legal instruments have extended quite significantly. Introduced by the Council of Europe, the two Resolutions from 1973[38] and 1974[39] contained 10 and 8 articles respectively and the Convention 108 from 1981 – 27 provisions. In the EU legal regime, the DPD from 1995 consisted of 34 articles and the GDPR from 2016 of 99. While the two Resolutions were literally one-pagers, the GDPR consists of almost 100 pages, including Recitals. Expansion in volume is caused, i.a., because the number of data subjects’ rights increased. However, the most crucial cause of the explosive growth of data protection provisions can be found in the widened rules on compliance and enforcement.[40]

The DPD was enacted when the internet was nascent and the so-called digital revolution was just beginning. The DPD, as contemporary legislation at the time, had the potential to shape the emerging digital society and, in particular, ensure that the exponential increase in personal data processing did not come at the expense of fundamental rights. Despite this potential, data protection law has, until recently, been viewed as ‘marginal and technical’ by legal practitioners, policy-makers, academics and industry.[41] This perception is changing as data protection has been thrust into the spotlight for several reasons. First, the drastic increase in personal data processing scale has drawn attention to its legal regime. Secondly, the legal framework itself has changed: the entry into force of the Lisbon Treaty in 2009 bolstered data protection status within the EU legal order by providing an explicit legal basis for data protection legislation. Thirdly, the CJEU embraced data protection’s recognition as a fundamental right and has set out to enhance this right’s strength despite the mounting practical challenges to its effectiveness.[42] Indeed, the right to data protection has been instrumental in seminal judgments such as Volker und Markus Scheke and Digital Rights Ireland, leading respectively to the partial annulment and annulment in the entirety of secondary legislation incompatible with this right.[43]

The evolution of privacy and data protection throughout the centuries is remarkable: from being considered idiotic by ancient Greeks and immoral by the Romans to separate and independent fundamental rights of an individual, strongly protected by the European and increasingly by different legislations. Data protection evolved into a completely new branch of law, with parts dedicated only to assuring its application guardians – supervisory authorities – equipped with rigorous and powerful tools.[44] Hence, positioning the GDPR within the range of administrative law additionally strengthened its impact on undertakings.

Compared to other fundamental rights, the scope and way the right to data protection is being shielded seem somewhat exaggerated. In the longer perspective, however, when the improved algorithms start to have an authentic influence on reality and more and more decisions based on personal data will be performed by the machines instead of humans, the tools and rights established in the GDPR may show their real potential. After all, the idea of personal data protection laws was also ahead of its time; before computers became affordable and way before the internet and e-economy.

The GDPR is not the final answer for sure, as its predecessors were also not. But the privacy and data protection laws evolution demonstrate the necessity of forward-thinking.

Data protection as a fundamental right in the EU legal framework

With the GDPR in force, the right to data protection is regulated in detail on the highest level possible within the EU legal framework and backed by the primary law as the fundamental right.

Surprisingly, the CJEU retrospectively interpreted the DPD from 1995 through the lenses of Article 8 of the Charter from 2009.[45] The court felt that the DPD implemented the duties laid down in the Charter and Lisbon Treaty. For example, in the case of Schrems,[46] the court held that “Article 25(6) DPD implements the express obligation laid down in Article 8(1) of the Charter to protect personal data and (…) is intended to ensure that the high level of that protection continues where personal data is transferred to a third country.”

Although a quite peculiar choice from a strict legalistic perspective, in the Schrems case, the court argued that very fundamental data protection issues were at stake and that in such cases, the data protection rules must be seen as an implementation of the fundamental right to data protection. However, the CJEU has adopted the same reasoning in other cases, which, at first sight, seem to regard less fundamental issues, such as having a reference to an old newspaper article deleted from the indexing system of a search engine.[47] Still, in Google Spain,[48] the court held: “Article 7 of the Charter guarantees the right to respect for private life, whilst Article 8 of the Charter expressly proclaims the right to the protection of personal data.”

Certain aspects of the right to data protection can be seen as fundamental, but these are already protected under the realm of human and fundamental rights, namely by the right to privacy. Most aspects of data protection do not seem to fit the underlying idea of human or fundamental rights, even the elements contained in Art. 8 of the Charter. For example, the scope of the concept ‘personal data’ is not based on whether significant personal interests are at stake but simply on the objective criterion of whether someone can be identified or individualized based on their data. Thus, even processing a name or an address would qualify as falling under a fundamental right. The character of data protection rules is to provide legal frames for the data processing activities and ensure that they are conducted fairly and adequately, while the principal objective of human rights is to stop or curtail the infringements on human rights. Finally, it seems that the DPD then and the GDPR now are more akin to market regulation than traditional human rights instruments, which also holds true for the position of data protection supervisory authorities.[49]

How profound, however, the consequences of upgrading the data protection rights to the rank of the fundamental right are, shows the case of EU Directive 2006/24,[50] the so-called Data Retention Directive, which obliged telephone and Internet service providers to collect and retain metadata, including that of emails and phone calls, for up to two years.[51] In doing so, the Directive ‘treated everyone as a suspect’, ‘monitored everyone’ and ‘put everyone under surveillance’.[52] For this reason, the CJEU, in a landmark judgment, held that the Data Retention Directive “constitutes a particularly serious interference” with the fundamental right of citizens to privacy. Consequently, the CJEU declared Directive 2006/24/EC invalid since it violated the right to privacy – Art. 7 of the Charter, and the right to protection of personal data – Art. 8 of the Charter, read in light of Art. 52 of the Charter. Additionally, the court pointed out that by adopting Directive 2006/24, the EU legislature exceeded the limits imposed by the principle of proportionality.[53]

The idea of ascribing a binding character to personal data protection through a legal instrument, namely the Charter, shows how the CJEU can delineate between the right to privacy and the right to data protection. And yet, the court seems to mingle them continuously.[54] A good example is the Rundfunk case,[55] in which the court noted how the provisions of the DPD have to be interpreted in light of fundamental rights, specifically the right to privacy.[56] The court regarded the right to data protection as a subset of privacy alternating secondary legislation with the EU Law general principle.[57] Meaning that a breach of the right to privacy implies unlawful processing in the sense of the DPD, and no breach of privacy implies no breach of the DPD.[58] Consequently, the court did not separate the rights into two different categories but considered data protection as a consequence[59] of the right to privacy.[60]

The final added value of data protection regards how it can be used to diminish information and power asymmetries.[61] Thus, a data subject would have more control over data processing because controllers would have to be limited by the principles under data protection law and would need to accommodate the balance of power to fulfill fundamental rights requirements, removing the helpless feelings the data subjects experienced.[62] Control over people’s data and its processing that leads to power asymmetries and probable harm to one’s informational self-determination stems from the fact that obtaining access to such data requires the data subject’s consent. Under the GDPR, this concept is entrenched in stricter requirements to establish better safeguards for individuals’ autonomous decisions.[63]

Non-prohibitive character of EU data protection laws

With the GDPR replacing the DPD, there is another change worth mentioning. The legal basis of the DPD was to regulate the internal market, namely Art. 100a of the Treaty Establishing the European Community, which specified that measures should be adopted to approximate the provisions laid down by law, regulation or administrative action in the Member States which have as their object the establishment and functioning of the internal market.[64] That is why the DPD had two explicit aims: the protection of personal data, and the free flow of information.

This duality is maintained in the GDPR. However, the legal basis is no longer found in the regulation of the internal market but the guardianship of the right to data protection, as specified in Article 16 TFEU:

“1. Everyone has the right to the protection of personal data concerning them.

 2. The European Parliament and the Council, acting in accordance with the ordinary legislative procedure, shall lay down the rules relating to the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies, and by the Member States when carrying out activities which fall within the scope of Union law, and the rules relating to the free movement of such data. Compliance with these rules shall be subject to the control of independent authorities. The rules adopted on the basis of this Article shall be without prejudice to the specific rules laid down in Article 39 of the Treaty on European Union.”[65]

Consequently, the EU has an explicit mandate to regulate the field, which is unique compared to other fundamental rights.[66]

Worth noting is that although data protection laws tend to be only stricter with every ‘upgrade,’ from the very beginning, the idea behind guarding personal data was never prohibitive. On the contrary, from the first draft, it was clear that processing of personal data should be free and shall be neither restricted nor prohibited,[67] yet with reservation and premise that everyone has the right to the protection of personal data concerning them, indicating that such personal data can be processed only based on lawful grounds. That initial presumption stays behind the idea of the natural person’s right to have control and often final saying whether the processing can occur or if to object to automated decision-making.

Empowerment of the supervisory authorities

The GDPR departs significantly from the DPD’s decentralized data protection enforcement regime. It complements the increased substantive harmonization of data protection law with a new system of governance designed to achieve the uniform application of these rules. The GDPR affirms that each supervisory authority shall be competent for the performance of its tasks and the exercise of its powers on the territory of its own Member State.[68] However, the GDPR provides that each supervisory authority shall contribute to the regulation’s consistent application throughout the Union and shall thus “cooperate with each other and with the Commission” in accordance with Chapter VII[69] governing cooperation and consistency.[70]

Under the GDPR, the consistency mechanism is dealt with by endeavoring to reach consensus between the various relevant supervisory authorities and where consensus is wanted, by a binding decision of the EDPB that is subsequently notified by the lead authority or another competent authority where appropriate. Thus, one could conclude that the interpretation and application of the law have become centralized and harmonized to a large extent.

Where the relevant supervisory authority indicates to the EDPB that it does not intend to follow its opinion, in whole or in part, the dispute resolution mechanism is engaged, and the EDPB can issue a decision that binds the supervisory authority.[71] It would therefore appear that, unlike other EU agencies, the decision-making powers of the EDPB include but are not limited to individual decision-making (i.e., applying general rules to specific cases) and extend to any matter of general application, being therefore regulatory in nature. Moreover, the EDPB can also act as a quasi rule-maker as it has the power to adopt soft law measures (guidelines, recommendations and best practices) of its own initiative or at the request of an EDPB member or the Commission on “any question covering the application of the Regulation.”[72]

While data protection was initially enacted as a regulatory, internal market policy, its legal basis has now been disengaged from the internal market, and it is recognized as a fundamental right in the EU legal order. Supervisory authorities are therefore the ‘guardians’ of the fundamental right protected by the EU data protection law, and thus the existence of supervisory authorities is an essential component of fundamental rights protection.[73] Accordingly, when the EDPB issues its own administrative decision, it too will be acting as a part of this fundamental rights architecture.[74]

Rationale for including automated decision-making provisions in data protection laws.

Roots of automated decision-making provisions

One of the most intriguing rights provided by the EU law on the protection of personal data is the right of an individual not to be subject to a decision based solely on automated processing of personal data, including profiling.[75]

First enacted in Art. 15 DPD, the right is now governed by Art. 22 GDPR. Its construction is perceived as a rather complex one by many or even as second-class data protection right.[76] It has been “rarely enforced, poorly understood and easily circumvented,”[77] and considering that algorithmic decision-making is so routine today, its marginality is mystifying. However, the right not to be subject to an automated decision is crucial as it provides the data subject – a human – with a tool to refuse submission to a machine/algorithm that uses this individual’s personal data or its profile to make a decision, which produces legal effects or similarly significantly affects this person.

These provisions’ roots reach back to France’s 1978 Act on data processing, files and individual liberties,[78] but Art. 15 DPD was the first pan-European legislative norm to regulate purely machine-based decisions in a data protection context. The lawmakers’ attempt to anticipate technological and organizational developments, still nascent in the late 1980s and early 1990s,[79] is praiseworthy.

Notwithstanding its particular profile, it is only fair to mention that Art. 15 DPD played an extremely modest role while legally binding. It has not been the subject of litigation before the CJEU or national courts, except for one case in Germany,[80] and it rarely came up in enforcement procedures,[81] or national data protection supervising authorities’ assessments.[82]

Whether Art. 22 GDPR, which inherited the main premise of Art. 15 DPD, will play a more relevant role remains to be seen.

Historical views

The concept of writing data protection laws to safeguard people’s rights in general and shield them from the consequences of automated decision-making, in particular, required many predictions and imagination. It is especially true if we consider that the first personal computers emerged on the market in the late 1970s, started to be useful only in the mid-1980s,[83] and that the internet introduced in the 1980s began to take its shape and influence on economies and social life only in the mid-1990s.[84]

Although the earliest legislators had probably no idea what kind of outcome can arise from collecting an enormous amount of data,[85] they anticipated a possible negative impact of automated processing of personal data and included automated decision-making provisions in data protection laws.

Historically, provisions along the lines of Art. 15 DPD and of Art. 22 GDPR have been rare among data protection instruments at both national and international levels. Only a few countries incorporated such provisions in their data protection laws before the adoption of the DPD.[86] The inclusion of the right not to be subject to an automated decision in the DPD reflected the EU’s ambition, articulated in the DPD’s preamble, to provide a high level of data protection across the Member States.[87] Art. 15 DPD was also rather distinctive as it included aspects of automated profiling.[88]

Most importantly, Art. 15(1) DPD did not take the form of a direct prohibition on decision-making, including profile application.[89] Instead, it directed each Member State to confer on persons a right to prevent them from being subjected to such decision-making. Hence, legally adequate implementation of Art. 15(1) DPD materialized when national legislators provided persons with the opportunity to exercise this right. Regardless, the Member States were not prevented from implementing Art. 15(1) DPD as a qualified prohibition of automated decision-making.[90] A qualified prohibition as the prohibition could not be absolute considering certain exceptions to the right in Art. 15(1) DPD were envisaged in Art. 15(2) and Art. 9 DPD.[91]

Data Protection Directive’s travaux préparatoires perspective

Information and explanation why the legislator included automated decision-making provisions in the DPD can be found in the preparatory works (travaux préparatoires):

“Art. 15 DPD derives from several concerns. The central concern is rooted in the perceived growth of automatisation of organisational decisions about individual persons. The drafters of the Directive appear to have viewed as particularly problematic the potential for such automatisation to diminish the role played by persons in shaping important decision-making processes that affect them.”[92]

Preparing the draft of the provision, the legislator worried about an individual’s capacity to influence decision-making processes when an automated decision was to be taken on the sole basis of a person’s profile and expressed concern that automated decision-making might grant human standing behind the organization an excuse to abandon investigatory and decisional responsibilities. Also, the misleading nature of profiling threatens to usurp the constitutive authority of the physical self.[93]

A further concern was that it brings the threat of alienation and a threat to human dignity.[94] Additionally, the legislator feared that profiling and an automated decision based on it might lead to a situation when a decision was based not on data delivered by a data subject but on pre-collected databases;[95] when an organization acts independently of any input from an individual depriving the latter of any chance to influence a decision.

Drafting Art. 15 DPD, the legislator recognized ongoing growth in the ‘frequency, intensity and ambit’ of organizational profiling practices and saw profiling not only as an emergent industry[96] but also anticipated the growing sophistication of the techniques such as data mining and the use of algorithms and artificial intelligence.[97]

To sum up – the main reasons to accommodate automated decision-making provisions into data protection laws were and still are:

the fact that an automated decision is based on personal data,

based on aggregated both personal and non-personal data, a profile of a natural person can be created and used against the interest of the data subject,

lack of possibility to influence an automated decision based either on personal data of a natural person or his/her profile, if a right not to be subject to such a decision is not envisaged in law,

automated decisions can be entrusted with too much weight, shifting the responsibility from human to machine, dehumanizing the whole process and contradicting the anthropocentric legal consensus,

automated decision-making provisions share the same values as the data protection law – the free movement of personal data requires non-prohibitive solutions to safeguard the data subject rights.

Anthropocentric perspective

Art. 22 GDPR and formerly Art. 15 DPD added the legal perspective to the ongoing discourse on how to preserve the advantages of the quickly developing digital technologies and avoid their negative consequences and potentially harmful effects on the general prosperity of humankind.

As the industrial revolution reshaped the world by technological advancement, looking at it from the hardware perspective, digitalization does the same but even faster and more substantively, utilizing the older and the newest innovations by creating and improving software – programs and algorithms – rolling out the digital revolution in full.

The primary purpose of digital development remains the same as for development itself – a rise in the population’s level and quality of life. However, to some, today’s newest innovations do not differ from supernatural powers, thereby confirming the validity of Arthur C. Clarke’s third law: “Any sufficiently advanced technology is indistinguishable from magic.”[98]

Together with the unknown, digitalization brings a different, possibly dangerous challenge – technological singularity – able to outgrow humans.

An answer to this threat can be found in the imprinted in the automated decision-making provisions anthropocentric legal consensus that the human – a data subject – shall preserve the final saying about subjecting to a machine. The term ‘anthropocentrism’, mainly used to define the relationship between humans and nature, seems crucial to establish the relation between humans and AI.

Recognizing AI and automated decision-making based on its algorithms as a product of human invention and ingenuity should help draw the red line. Science defines humans as Homo sapiens – the thinking man, a bipedal primate mammal – and AI as artificial intelligence, where artificial means “man-made”, and intelligence means the ability to learn, understand and deal with new situations. And yet, the most distinctive part of being human is not just the biological body, DNA, reason and mind, but consciousness.

However, AI is designed to perform unconscious processes, to follow algorithms blindly. On this fundamental level, the so-called black box of AI is just electricity, statistics, math, and a lot of data. There is no real thinking. Machine learning is nothing more than a self-improving algorithm – the more data, the better results. Possessing great calculation powers, the AI can see patterns quicker and better than humans, but it remains and should remain a tool in their hands, and understood as such, should never be considered superior to any man or woman.

The DPD initially and the GDPR now developed an idea of how to tame negative aspects of digitalization while preserving incentives for further advancement – both legal acts aimed not only to safeguard humankind primacy over its inventions like AI but also to do it in a way that does not endanger or impair them. As the industrial revolution taught us the necessity of taking care of our planet while setting the boundaries to anthropocentrism, the GDPR also protects the digital world.[99] At least with regard to personal data protection.

Although the algorithms have already taken over some industries, the liability regime for digital technologies and AI is still not defined. The Internet of Things and self-driving cars are one thing. However, development and the merge between man and machine, the so-called Internet of Bodies, progress in biotechnology and bionics, the quantum computers, blockchain technology and other innovative ideas raise many important interdisciplinary questions – legal, ethical, economic, sociological, to name a few, which need to be considered both on a national and international level. Moreover, the fuzing of a human with the machine, if only with ID chips or hearing implants, has already begun;[100] it will bring colossal change in how we interact with other people, companies or authorities, with many positive and negative consequences.

The GDPR efforts focus not on restricting automated decision-making but on setting frames and boundaries and expecting the algorithms’ creators to implement data protection by design and by default;[101] and as the fundamental right in this regard, on allowing people to decide whether they want to agree with a decision made by a machine or not.

See Rouvroy, p. 8: “Respect for the individual autonomy of persons implies the absence of either physical, mental or economic coercion. Legal interference with lawful, fully conscious and uncoerced choices of capable individuals is considered unacceptable, even if interference arises for the sake of the subject’s own good, in which case one speaks of unacceptable legal paternalism.” ↵

Cf. Schwartz/Treanor, p.216. ↵

Cf. O’Neill; Dworkin; Faiden/Beauchamps. ↵

Rouvroy, p. 8. ↵

Cf. Carey, p. 1. ↵

Spaho, p. 4. ↵

Kosta, p. 107. ↵

Cf. De Hert/Gutwirth, pp. 3-4. ↵

Spaho, p. 4. ↵

Sahin, unpaginated. ↵

Wacks, p. 32. ↵

Ibid, p. 33. ↵

Ibid. ↵

Warren/Brandeis, p. 195: “Recent inventions and business methods call attention to the next step which must be taken for the protection of the person, and for securing to the individual what Judge Cooley calls the right ‘to be let alone’”. “The common law has always recognized a man’s house as his castle, impregnable, often, even to its own officers engaged in the execution of its command. Shall the court thus close the front entrance to constituted authority, and open wide the back door to idle or prurient curiosity?” ↵

Ibid., p. 193. ↵

Sahin, unpaginated. ↵

Wacks, p. 111. ↵

Cf. Andenas/Zleptnig; Cannataci/Mifsud-Bonnici. ↵

Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, Strasbourg, 28 January 1981, ETS. No 108. ↵

Sahin, unpaginated. ↵

See DPD: Recitals (2), (7), (9), (10), (11), (33), (34), (68), and Articles 1.1, 9 and 13.2. ↵

The common name for the Treaty on European Union and the Treaty on the Functioning of the European Union. ↵

Charter of Fundamental Rights of The European Union (2000/C 364/01); although proclaimed on December 7th, 2000, became legally binding together with TEU and TFEU on December 1st 2009. The Charter is sometimes confused with the European Convention on Human Rights. Although containing overlapping human rights provisions, the two operate within separate legal frameworks: the Charter of Fundamental Rights of the European Union was drafted by the EU and is interpreted by the Court of Justice of the European Union, the European Convention on Human Rights, on the other hand, was drafted by the Council of Europe in Strasbourg and is interpreted by the European Court of Human Rights. ↵

See example Art. 1(2) GDPR: “This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.” or Recital (1) GDPR. ↵

European Commission, ‘Report - SURVANT Research Project. Fast Track to Innovation,’ (2017). ↵

Gutwirth/Friedewald/Wright/Mordenite, et al., p. 8 and p. 8ff. ↵

Article 8.2 ECHR states that “There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others”. Article 52.1 of the Charter provides for a similar limitation: “Any limitation on the exercise of the rights and freedoms recognised by this Charter must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others.” ↵

Gellert/Gutwirth, p. 2. ↵

Art. 16 TFEU: “Everyone has the right to the protection of their personal data”. ↵

Art. 8 of the Charter not only provides that “Everyone has the right to the protection of personal data concerning him or her” but also that “Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.” Finally, it also says that: “Compliance with these rules shall be subject to control by an independent authority.” ↵

The German Federal Constitutional Court affirmed a right to informational self-determination in a 1983 judgment in Volkszählungsurteil, BVerfGE Bd. 65, S. 1ff. The court considered informational self-determination to derive from the fundamental right to respect for personality, protected in the German Constitution. The ECtHR recognized in a 2017 judgment that Art. 8 of the ECHR “provides for the right to a form of informational self-determination.” See ECtHR, Satakunnan Markkinapörssi Oy and Satamedia Oy v. Finland, No. 931/13, 27 June 2017, para. 137. ↵

European Union and Council of Europe, eds., ‘Handbook on European Data Protection Law,’ (2018), p. 18. ↵

Ibid., p. 19. ↵

Ibid., p. 29. ↵

CJEU, Joined cases C-468/10 and C-469/10, Asociación Nacional de Establecimientos Financieros de Crédito (ASNEF) and Federación de Comercio Electrónico y Marketing Directo (FECEMD) v. Administración del Estado, 24 November 2011, para. 29. ↵

Op. cit. EU/Council of Europe, Handbook on European Data Protection Law, p. 30. ↵

Ibid, pp. 30-31. ↵

Council of Europe, Resolution (73) 22, On the protection of the privacy of individuals vis-à-vis electronic data banks in the private sector, Committee of Minsters 224th meeting 26 September 1973. ↵

Council of Europe, Resolution (74) 29, On the protection of the privacy of individuals vis-à-vis electronic data banks in the public sector, Committee of Minsters 236th meeting 20 September 1974. ↵

Sloot, p. 5. ↵

Lord Justice Leveson, An Inquiry into the Culture, Practices and Ethics of the Press (London, 2012), p. 999. ↵

Cf. Koops, p. 251. ↵

See e.g.: Joined cases C-92/09 and C-93/09 Volker und Markus Schecke and Hartmut Eifert [2010]; Joined cases C-293/12 and C-594/12 Rights Ireland Ltd v. Minister for Communications, Marine and Natural Resources and Others and Kärntner Landesregierung and Others [2014] ↵

Art. 51 to 84 GDPR; 1/3 of the total volume of the regulation is dedicated to provisions governing the independent authorities, their cooperation and consistency, remedies, liabilities and penalties in case of breach or infringement of the regulation. ↵

Cf. Gonzalez Fuster/Gellert, pp. 73-82. ↵

Case C-362/14, Schrems v. Data Protection Commissioner, CJEU 6 October 2015. ↵

Sloot, p. 8. ↵

Case C‑131/12, Google Spain v. Agencia Española de Protección de Datos (AEPD), ECJ 13 May 2014, ↵

Sloot, p. 8. ↵

Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC [2006] OJ2006 L105/54 (Directive 2006/24/EC). ↵

Cf. Breyer; Bignami; Murphy. ↵

Cf. Nielsen. ↵

Joined Cases C-293/12 and 594/12 Digital Rights Ireland Ltd v. Minister for Communication et al and Kärtner Landesregierung et al (CJEU, 8 April 2014). See also Joined Cases C-293/12 and 594/12 Digital Rights Ireland Ltd v. Minister for Communication et al and Kärtner Landesregierung et al (CJEU, 8 April 2014), Opinion of AG Villalón; F Fabbrini, ‘Human Rights in the Digital Age, The European Court of Justice Ruling in the Data Retention Case and its Lessons for Privacy and Surveillance in the us’ (2015) 28(1) Harvard Human Rights Journal. ↵

Cf. Lynskey, Deconstructing Data Protection, pp. 579-581. ↵

Case C-139/01 Österreichischer Rundfunk and Others [2003] ECR I-4989. ↵

Ibid; the CJEU refers to the right to privacy under Article 8 ECHR only and not to Article 8 of the Charter as the Charter came into force on 1st December 2009 with the adoption of the Lisbon Treaty. ↵

Spaho, p. 7. ↵

Cf. De Hert/Gutwirth; case C-28/08 European Commission v. Bavarian Lager [2010] ECR I-6055, paras 91. ↵

Case C-28/08 European Commission v. Bavarian Lager [2010] ECR I-6055, paras 58-61. ↵

Spaho, p. 7. ↵

See Lynskey, Deconstructing Data Protection, p. 592: “Power asymmetries are present when one party in a relationship is in a position of strength relative to the other while information asymmetries are present when one party in a relationship is in possession of more information than another.” ↵

Cf. Solove, p. 757. ↵

Spaho, p. 9. ↵

Art. 100a of the Treaty Establishing the European Community, 2002/C 325/01. ↵

It should be noted that Art. 16 is limited to data processing that falls under Union law; hence this is not the legal basis for all regulation of data processing. ↵

Sloot, p. 7. ↵

Cf. Art. 1(3) GDPR. ↵

Art. 52 GDPR ↵

Ibid. Art 51(2). ↵

Lynskey, The ‘Europeanisation’ of Data Protection Law, p. 20. ↵

Ibid, p. 21; cf. also Art 64(8) and Art 65(1)(c) GDPR. ↵

Ibid. See also Art 70(1)(e) GDPR. ↵

European Commission v. Federal Republic of Germany, C-518/07, EU:C:2010:125., para 23; Cf. Shapiro. ↵

Lynskey, p. 31. ↵

Mendoza/Bygrave, p. 1. ↵

Cf. Mendoza/Bygrave; Dreyer. ↵

Mendoza/Bygrave, p. 2. ↵

Art. 2 and 3 of the French data protection law (1978). ↵

Mendoza/Bygrave, p. 3. ↵

In 2014, the German Federal Court of Justice (Bundesgerichtshof) handed down an appeal judgment that touches briefly on the scope of the German rules that transpose DPD Art. 15. More about the ruling in Chapter 7.1.1. – definition of automated decision-making, see footnote. ↵

The view of the A29WP has been that the principle established by Art. 15 DPD does not qualify as a ‘basic’ principle but as an ‘additional principle to be applied to specific types of processing,’ at least for the purposes of determining adequacy assessments of third countries under DPD Art. 25: see A29WP, ‘Transfers of personal data to third countries: Applying Articles 25 and 26 of the EU data protection directive,’ (1998), pp. 6–7. Nonetheless, Art. 15 DPD is sometimes taken into consideration in the context of approving Binding Corporate Rules (BCRs) for cross-border data transfer: see, e.g., approval by the Spanish Data Protection Authority (Agencia Española Protección de Datos) of the BCRs for Latham & Watkins (file number TI/00030/2017), (cit. per Mendoza/Bygrave, note 14). ↵

Mendoza/Bygrave, p. 4. ↵

Knight, unpaginated. ↵

Andrews, unpaginated. ↵

For example see: Google ‘2019 research review: Insights we uncovered in 2019 that will take you into 2020’ available at: https://www.thinkwithgoogle.com/data-collections/2019-consumer-insights/. ↵

Art. 2 and 3 of the French data protection law (1978), Art. 12 of the Spanish data protection law (1992), Art. 16 of the Portuguese data protection law (1991). ↵

Bygrave, Minding the Machine, unpaginated. ↵

Cf. Art. 12(a) DPD. ↵

This view of Bygrave on automated decision-making as defined in Art. 15 DPD, changes dramatically when it comes to Art. 22(1) GDPR, which is suddenly regarded by Bygrave as a general prohibition, in spite of almost identical wording of these two provisions. More on current state of research in Chapter 6. ↵

See example: Art. 12bis of the Belgian data protection law (1998). ↵

Bygrave, Minding the Machine, unpaginated. ↵

COM(90) 314 final — SYN 287, 13.9.1990, p. 29. ↵

COM(92) 422 final — SYN 287, 15.10.1992, p. 26. ↵

See also Bygrave/Berg, p. 32: “the interest in non-automated decision making is founded not simply on the possibility of machines making mistaken judgements; penultimately, the interest embodies a concern for personal integrity, and ultimately a concern for human dignity.” Cf. Recital (2) DPD: “Whereas data-processing systems are designed to serve man; whereas they must, whatever the nationality or residence of natural persons, respect their fundamental rights and freedoms … and contribute to … the well-being of individuals.” ↵

Bygrave, Minding the Machine, unpaginated. ↵

For examples, see papers from this era: Der Spiegel, 5.7.1999, pp. 112 and following; Novek, Sinha and Gandy, ‘The value of your name’ (1990) 12 Media, Culture and Society pp. 526 and following; and Froomkin, ‘Flood Control on the Information Ocean: Living with Anonymity, Digital Cash, and Distributed Databases’ (1996) 15 University of Pittsburgh Journal of Law and Commerce, 395, Pt IV, (cit. per Bygrave, Minding the Machine, note 18). ↵

Bygrave, Minding the Machine, unpaginated. ↵

Clarke, note. ↵

Cf. Recital (63) GDPR ↵

See e.g.: Adams; Schumaker; Posey. ↵

Cf. Art. 25 GDPR. ↵

3

Main interpretational rules, methods and principles concerning European Union legislation

Independent legal system

The starting point to correctly interpret the GDPR and the EU laws in general is to recognize the EU law as an independent and peculiar legal system, different from Member States’ national orders and their traditions. This supranational organization has its own autonomous concept of a legal framework with a dedicated interpretation methodology.

Another peculiarity regarding the EU legal system is its dualism: primary law – the treaties based on international law principles, regulate the cooperation between the Member States and EU institutions; and arising from the treaties secondary law – legal acts adopted by the EU institutions.

The primary law consists of two treaties: the Treaty on European Union, and the Treaty on the Functioning of the European Union, commonly known as the ‘Lisbon Treaty,’ signed on 13 December 2007, in force since 1 December 2009. Art. 1 TEU and Art. 1 TFEU both state that “those two Treaties shall have the same legal values.” Art. 16 TFEU formed the legal grounds to adopt the GDPR.

One more legal act currently in force is essential from the GDPR’s perspective: the Charter of Fundamental Rights of the European Union – a supplement to the Treaties. The Charter is not a treaty between the EU Member States, but it is a legal act enacted together by all three elementary institutions of the EU: the European Parliament, the Council of the European Union and the European Commission, and is one of the grounds from which the GDPR arises.[1]

Art. 288 TFEU introduces five forms of EU legal acts – the secondary law: regulations, directives, decisions, recommendations, and opinions. A regulation being the strongest EU legal act “shall have general application. It shall be binding in its entirety and directly applicable in all Member States”.

Thus, the GDPR as regulation has the highest possible rank foreseen by the Lisbon Treaty for the secondary law.

Main interpretational methods, and principles concerning European Union legislation

The European secondary law interpretation is based on its own interpretative rules, often different from Member States’ national legal interpretative standards. The rules were established by the practice of the EU institutions and mainly by judgments of the CJEU.[2] European law interpretation consists of three specific measures regarding also its implementation:

the application itself including the elimination of ambiguous and contrary provisions;

the development of law – represents supplementing imperfect texts of the legal regulations, mainly of gaps existing in legislation. It requires an understanding of the sense and objectives of a legal act; to achieve this goal, the teleological method of interpretation and comprehensive legal context are required;

a judge-made law – the CJEU creates legal rules if necessary, for the European Union’s capacity for action.[3]

All these practices, however, share the same methodology of legal interpretation: grammatical, contextual, teleological, and historical.

Grammatical method

The grammatical interpretation is defined as an explanation of what a normative text conveys by looking at the usual meaning of the provision’s words. The literal interpretation of a clear and precise provision is the method of interpretation that best reflects the principle of legal certainty, as it guarantees a high degree of predictability in the judgments of the CJEU.[4]

The EU law is interpreted in light of its normative context or by its objectives, mainly where there are some ambiguities regarding how that provision was drafted. However, per settled case-law,[5] where the wording of a provision is clear and precise, its contextual or teleological interpretation may not call into question the literal meaning of that provision, as this would counter the principle of legal certainty and the principle of inter-institutional balance enshrined in Art. 13(2) TEU.[6] Stated clearly, the CJEU will never ignore the clear and precise wording of an EU law provision.[7]

Quoting the Latin maxim interpretatio cessat in claris,[8] only an obscure text may be interpreted in a way that departs from the usual meaning of the words contained therein. Logically, the question is then under which circumstances a legal provision is considered to be clear and precise. As noted by AG Jääskinen, “the literal interpretation and the clear meaning may not be synonymous as the literal meaning of a provision may be ambiguous.”[9]

Paraphrasing the bona fides – good faith – requirement used in the interpretation of treaties under the Vienna Convention, a legal interpreter should act in bona fides, meaning that he acts honestly, not knowing nor having reason to believe his claim is unjustified. Bona fides ends when the interpreter becomes aware or should have become aware of facts that indicate the lack of legal justification for his claim. Translated to the context of the EU secondary law interpretation and the legal regime laid down in the European Union law, the idea of good faith can be expressed as understanding the secondary law by the first-order rule of interpretation that is the grammatical method, as long as the application of that rule does not leave the meaning of the secondary law unclear.[10]

Systematic or contextual interpretation; the principle of effectiveness (effet utile)

Understood broadly, contextual interpretation may be examined from two different, albeit complementary, perspectives. Internally, contextual interpretation focuses on the purely normative context in which the EU law provision in question is placed. The CJEU looks at the functional relationship between the EU law provision in question and the normative system to which it belongs. Externally, contextual interpretation examines the legislative decision-making process that led to the adoption of the EU law provision in question. Thus, it makes use, in particular, of travaux préparatoires.[11]

Systematic interpretation is based on the premise that the legislator is a rational actor; the authors of the Treaties are assumed to have established a legal order that is consistent and complete.[12] Compliance with the principle of consistency requires that there should be a consistent interpretation among all the provisions of the Treaties and that the EU legislator should consciously take account of that principle. This means that each provision of EU law must be interpreted in such a way as to guarantee that there is no conflict between it and the general scheme of which it is part. As a token of rationality, the EU legislator must also avoid useless duplications. Accordingly, no provision of EU law should be redundant. Instead, each and every provision of that law must be interpreted in light of its ‘effet utile.’ For example, an EU law provision should never be given the same meaning as another provision belonging to the same normative text. Legal arguments ‘a contrario’, ‘ad absurdum,’ ‘a fortiori,’ by analogy or based on comparative law are also examples of systematic interpretation.[13]

Following the premise that the EU legislator is a rational actor, the CJEU would seek to preserve the validity of the EU acts over their annulment: “according to a general principle of interpretation, a provision must be interpreted, as far as possible, in such a way as not to detract from its validity.”[14]

Likewise, where a provision of EU law is open to several interpretations, preference must be given to the one that ensures that the provision retains its effectiveness.[15] The general principle of interpretation must not trespass on the limit of contra legem.[16]

Besides, where an EU law provision may be subject to several interpretations, the CJEU must prioritize the one which guarantees compliance with primary EU law.[17] The ruling of the CJEU in Sturgeon and Others illustrates these points while strengthening protection for air passengers.[18]

Teleological interpretation

Writing extrajudicially, former AG Fennelly noted that “the characteristic element in the CJEU’s interpretative method is […] the so-called ‘teleological’ approach”.[19] Since the Treaties provisions consist primarily of goals and objectives, when interpreting primary EU law, the CJEU has given priority to that method of interpretation.[20] Indeed, unlike ordinary international treaties, which aim to lay down rules for cooperation, the Treaties are entirely grounded in the idea that there are objectives of paramount constitutional importance that the EU must attain.[21]

The Treaties are drafted in broad terms and entrust the EU institutions with the implementation of the objectives set out therein. They contain very few specific rules and often general notions. Where litigation arises, the CJEU must exercise its judicial review powers despite the level of generality of the EU law provision in question. Otherwise, it would be committing a denial of justice. Thus, the CJEU is obliged to address too general notions and ‘fill out’ Treaty provisions with incomplete meaning.[22]

Furthermore, while the Treaties may contain notions drafted in broader terms, secondary EU legislation is often highly technical and complex. Thus, to fill the gap between those two extremes – the generality of primary EU law and the high degree of precision of secondary EU law – the CJEU has no choice but to consider the objectives pursued by the Treaties.[23]

Teleological interpretation and systematic interpretation are often interlinked since it is by virtue of the latter that the CJEU may identify the objective pursued by the EU law provision in question. It is the Treaties’ general scheme or the act of secondary EU law in question, enabling the CJEU to clarify the objectives pursued by them.[24]

Additionally, if the EU legal act attempts to achieve more than one objective of equal importance yet contradictory in the relevant context, the CJEU applies the principle of proportionality to decide which objectives should prevail.[25]

The provision in question may be subjected to a strict or broad interpretation regarding the objectives which the EU law pursues. When the EU law provision in question constitutes a derogation from the objectives pursued by the Treaties (or is contained in secondary EU law), the CJEU will interpret such provision strictly.[26] It follows from both the teleological and systematic interpretation that “exceptions are to be interpreted strictly, so that general rules are not negated”.[27] On the contrary, if the objectives pursued by an EU act containing the provision in question cannot be achieved unless such provision is interpreted broadly, the CJEU will follow that interpretation.[28] The same applies to the EU law provisions, which express a principle of constitutional importance for the objectives set out in the Treaties.[29]

The CJEU also follows a ‘meta-teleological’ approach when referring to a systemic understanding of the EU legal order required to interpret all its rules.[30] The ‘meta-teleological’ means help to identify the ‘constitutional telos’[31] of the EU,[32] which may provide a more substantiated understanding of the law beyond the decision in a given case.[33] The constitutional aim of the EU refers to universal principles which fulfill two purposes: first, when the political compromise passes on the CJEU resolution of outstanding issues, and second, those same principles enable the CJEU to cope with changing times[34] and respond to the dynamic character of the integration process envisaged by the Lisbon Treaty, notably by creating ‘an ever-closer union’.[35]

Subjective or historical interpretation; travaux préparatoires

The historical interpretation is a legislative interpretation method that considers circumstances occurring before enacting the legal act in question. The historical approach clarifies present texts through the light of events that led to adopting the law, simultaneously considering the legislator’s intentions.[36]

In EU law, historical interpretation relies on the archival background, the content of travaux préparatoires or similar materials, which record the legislators’ motives and the purpose of the provisions.[37]

As travaux préparatoires are not published for the EU treaties, the CJEU does not apply the historical approach when interpreting primary law. In the case France v. Commission, it appears, however, that the court attempted to apply historical interpretation to a treaty before finding that the draft’s intention was not clearly expressed within the travaux préparatoires. Although not ultimately used in this case, this shows that the historical interpretation remains a potential option for the CJEU despite criticisms of its usefulness.[38]

In the case of secondary legislation, however, it is observed that the CJEU can use the preparatory documents, including debates in the European Parliament or discussions in a given committee.[39] Under such an approach, a wide variety of archived records may be considered, including proposals and opinions of the Commission and other documents that link to the legislative procedure, e.g., documents considered by the European Parliament and records of its debates, amendments, and reasoning.

There is some justified hostility towards historical interpretation due to the lengthy and complicated processes of adopting EU legal acts. The drafted law may see considerable changes in the meaning throughout the negotiation period and the potential for anomalies arising from the court’s reliance on any one document in the context of many diverse national legal traditions informing the enactment of EU law.[40]

That being said, the CJEU has, in recent years, paid more attention to travaux préparatoires when interpreting acts of secondary EU legislation.[41] The CJEU has made use of travaux préparatoires in different ways:[42] as a supplementary[43] or primary means of interpretation,[44] but also as an exceptional recourse to the drafting history of the EU act in question when the CJEU tries to ‘correct’ meaning of a particular provision, i.e., to render it compatible with the primary EU law.[45] The ruling of the CJEU in Stauder illustrates this point.[46] In that case, the travaux préparatoires enabled the CJEU to interpret the Commission’s decision in compliance with fundamental rights understood as general principles of the EU law and now enshrined in the Charter.[47]

The historical interpretation looks at a provision through the light of the legislator’s intentions on the one hand and its historical context on the other. Unlike in the teleological interpretation, where the interpreter examines the purpose of the provision, the historical method considers the legislator’s goals and intentions that preceded and justified the adoption of a law in the first place, rejecting the influence of any subsequent factors and future perspective. It looks at the original environment of the provision rather than at the provision itself. Additionally, as if the provision was frozen in time, it considers only the popular ideas at that time. It rejects recognition of the views’ evolution, perceptions, and needs, focusing instead on the legislator’s often vague intentions, divergent opinions and agendas, and reasons explaining the law’s adoption.

Although it seems that historical interpretation plays a limited role compared with other interpretation methods,[48] its position is far from being marginal – the CJEU resorts to it increasingly often.[49]

Summary

Fig. 3.1 below concisely and transparently presents all four primary interpretation methods adopted by the CJEU, their variations, and the jurisprudence schools they represent. It sums up how the main interpretation tools interact with the legal text and clarifies that they do not necessarily compete against each other. After all, even the CJEU often uses all of them to make a point:

Fig. 3.1 Methods of interpretation, source: Brugger, p. 403.

The interpretation of a legal act or specific provision depends on several settings that affect the context and content of the opinion. For example, an interpreter’s cultural and linguistic background will outline the bounds of how he/she understands a legal provision.[50] The institutional setting, like jurisdiction, principles of a given legal system, case or standing, influences what and how the interpretation is being performed. Regarding the court’s adjudications, the judges’ background, integrity and competence, function as a check on judicial decision-making.

Concerning the use of interpretive methods, some conclusions can be drawn: a judgment not based on the relevant legal text and context is not a legal interpretation but a political decision; a judgment that makes sense only in the world of the law, but not in the real world, is unsound; also an unjust verdict will not carry the full force of law to an unwilling population.[51]

As a recommendation for the ordering of legal interpretative methods, the premise that any interpretation should take both the law and the real world seriously, should be taken into consideration. To correctly understand a law, every sensible method available should be employed, and the CJEU legal interpretation methodology set, when it comes to the interpretation of EU law, seems to be an obvious choice.

In the context of automated decision-making provisions of the GDPR, the above review of the legal interpretation methodology helps immensely to perceive the text of the regulation in a way the CJEU routinely implements. Such an approach allows for adequate interpretation and provides the guidance to help correctly apply the law.

Although many authors and scholars conclude oppositely,[52] interestingly enough, neither grammatical, contextual, teleological nor historical interpretations seem to validate the understanding of paragraph (1) of Art. 22 GDPR as a general prohibition of automated decision-making or support claims that paragraph (2) purportedly enumerates exceptions from the ban. On the contrary, all of them lead to the unanimous conclusion that the data subject is provided with the right to refuse being subjected to algorithmic decision and only exceptionally he or she can be deprived of this right. The following chapters explain the reasoning in more detail.

Art. 8(1) of the Charter: “Everyone has the right to the protection of personal data concerning him or her.” ↵

Salachová/Vítek, p. 2718. ↵

Cf. Tichý, p. 238. ↵

Salachová/Vítek, p. 2718; cf. Rasmussen and his critical views on CJEU, e.g. pp. 167-171. ↵

See, e.g., Case C-220/03 BCE v. Germany [2005] ECR I-10595, para. 31, and Case C-263/06 Carboni e derivati [2008] ECR I-1077, para. 48, and Case C-48/07 Les Vergers du Vieux Tauves [2008] ECR I-10627, para. 44. ↵

See, e.g., Case C-582/08 Commission v. United Kingdom [201] ECR I-07195. ↵

Lenaerts/Gutiérrez-Fons, To say what the Law of the EU Is…, p. 7. ↵

Latin - Interpretation stops when a text is clear. ↵

See Opinion of AG Jääskinen in Case C-582/08 Commission v. United Kingdom, above n 37, para. 27 (referring to Opinion of Advocate General Mayras in Case 67/79 Fellinger [1980] ECR 535, at 550). ↵

Linderfalk, On the Interpretation of Treaties, p. 68. ↵

Lenaerts/Gutiérrez-Fons, To say what the Law of the EU Is…, p. 13. ↵

Ibid. Article 7 TFEU states that ‘[t]he Union shall ensure consistency between its policies and activities, taking all of its objectives into account and in accordance with the principle of conferral of powers.’ See also Lenaerts, K., The Rule of Law…, p. 1625. ↵

Lenaerts/Gutiérrez-Fons, To say what the Law of the EU Is…, p. 14; cf. Itzcovich, p. 552. ↵

See Case C-403/99 Italy v. Commission [2001] ECR I-6897, para. 37; Case C-361/06 Feinchemie Schwebda and Bayer CropScience [2008] ECR I-3865, para. 49; Case C-149/10 Chatzi [2010] ECR I-8489, para. 43, and Case C-12/11 McDonagh, Judgment of 31 January 2013, not yet reported, para. 44. ↵

See Case 187/87 Land de Sarre and Others [1988] ECR 5013, para. 19, and Case C-434/97 Commission v. France [2000] ECR I-1129, para. 21. ↵

Lenaerts/Gutiérrez-Fons, To say what the Law of the EU Is…, p. 16. ↵

Joined Cases C-402/07 and C-432/07 Sturgeon and Others and Böck v. Air France [2009] ECR I-10923, para. 48. ↵

Ibid, para. 47. ↵

Fennelly, p. 664. ↵

Cf. Pescatore, p. 325; Arnull, p. 612. ↵

Cf. Pescatore, p. 327. ↵

Ibid., p. 328. ↵

Ibid., p. 329. ↵

Lenaerts/Gutiérrez-Fons, To say what the Law of the EU Is…, pp. 24-25. ↵

Lenaerts/Gutiérrez-Fons, The Constitutional Allocation of Powers…, p. 1649 et seq. ↵

See, e.g., Case 46/76 Bauhuis [1977] ECR 5, p. 5; Case 113/80 Commission v. Italy [1981] ECR 01625, para. 7: “holding that, ‘Article 36 [TFEU] constitutes a derogation from the basic rule that all obstacles to the free movement of goods between the Member States shall be eliminated and must be interpreted strictly’”; Case C-47/02 Anker [2003] ECR I-10447, para. 60: noting that “it is also clear from the CJEU’s case-law that, as a derogation from the fundamental principle that workers in the EU should enjoy the freedom of movement and not suffer discrimination, Article 45(4) TFEU must be construed in such a way as to limit its scope to what is strictly necessary for safeguarding the interests which that provision allows the Member States to protect”, and Case C-337/06 Bayerischer Rundfunk and Others [2007] ECR I-11173, para. 64: “the provision in question being an exception to the principal objective of the EU rules on the awarding of public contracts, […] namely freedom of movement of services and a market open to the competition which is as wide as possible, it must be interpreted strictly.” ↵

Case C-346/08 Commission v. United Kingdom [2010] ECR I-03491, para. 39 and Case C-476/01 Kapper [2004] ECR I-5205, para. 72. ↵

See e.g.: Case C-29/99 Commission v. Council [2002] ECR I-11221, para. 78: “in order to give practical effect to the provisions in Title II, Chapter 3, of the Euratom Treaty, the CJEU has interpreted them broadly on several occasions”; Case C-116/02 Gasser [2003] ECR I-14693, para. 41: “in order to achieve the aims [set out in the 1968 Brussels Convention], Article 21 [thereof] must be interpreted broadly so as to cover, in principle, all situations of lis pendens before courts in the Contracting States, irrespective of the parties’ domicile.”  ↵

See, e.g, Case 267/83 Diatta [1985] ECR 567, paras 16 and 17; Baumbast and R, above 158, para. 74; Case C-291/05 Eind [2007] ECR I-10719, para. 43; Case C-127/08 Metock and Others [2008] ECR I-6241, para. 84, Lassal, above n 154, para. 31.; Case C-459/99 MRAX [2002] ECR I-6591, para. 101; Case C-105/03 Pupino [2005] ECR I-5285, para. 42; Case C-115/08 ČEZ [2009] ECR I-10265, para. 90.  ↵

Cf. Poiares Maduro, p. 5; Lasser, p. 359. ↵

telos – from Greek, an ultimate object of aim, purpose, goal. ↵

Poiares Maduro, p. 5; ↵

Ibid., p. 9. ↵

Lenaerts/Gutiérrez-Fons, To say what the Law of the EU Is…, p. 26. ↵

Poiares Maduro, p. 11. ↵

David/Brierley as in Holland, J., Julian, W., p. 371.  ↵

Ibid.; cf. Brown/Kennedy. ↵

See Case C-68/94, France and Others v. Commission, 31 March 1998, para. 167. ↵

Schermers/Waelbroeck, p. 16. ↵

Reich, p. 26.  ↵

Schønberg/Frick, p. 155. ↵

Ibid, p. 168. ↵

See, e.g., Case C-275/96 Kuusijärvi [1998] ECR I-3419, and Case C-162/09 Lassal [2010] ECR I-9217; Case C-310/08 Ibrahim and Secretary of State for the Home Department [2010] ECR I-1065 and Case C-480/08 Teixeira [2010] ECR I-1107. See also Case C-635/11 Commission v. Netherlands, the judgment of 20 June 2013, para. 35 et seq. ↵

See, e.g., Case C-316/95 Generics BV v. Smith Kline & French Laboratories Ltd [1997] ECR I-3929; C-17/96 Badische Erfrischungs-Getränke v. Land Baden-Württemberg [1997] ECR I-4617. ↵

Schønberg/Frick, p. 169. ↵

Case 29/69 Stauder [1969] ECR 419, para. 7. ↵

Lenaerts/Gutiérrez-Fons, To say what the Law of the EU Is…, p. 24. ↵

In this regard, the CJEU has held that “the alleged drafting history [of a Regulation described by a commentator] cannot be relied upon to contest an autonomous interpretation of the Regulation which seeks to give practical effect to the provisions it contains, with a view to its uniform application in the [EU], in compliance with its objective” - see Case C-443/03 Leffler [2005] ECR I-9611, para. 48. ↵

Lenaerts/Gutiérrez-Fons, To say what the Law of the EU Is…, p. 24. ↵

Walzer, p. 21. ↵

Brugger, p. 408. ↵

Cf. Chapter 6. ↵

4

Role of recitals

Non-binding effect of a preamble; the purpose of recitals

The preamble to the GDPR and the vast amount of recitals preceding its enacting terms require an explanation.

Two basic definitions from “Joint Practical Guide of the European Parliament, the Council and the Commission for Persons Involved in the Drafting of European Union Legislation,” authored by the EU Parliament, Counsel & Commission, are noteworthy:

the ‘preamble,’ which means everything between the title and the enacting terms of the act, namely the citations, the recitals and the solemn forms which precede and follow them, and

the ‘enacting terms,’ defined as the legislative part of the act. They are composed of articles, which may be grouped into parts, titles, chapters and sections and may be accompanied by annexes.[1]

Critical remarks about the binding effect of a preamble in the EU legal acts have been presented in case C-136/04, Deutsches Milch-Kontor GmbH, and C-134/08, Hauptzollamt Bremen. According to these judgments: “the preamble to a Community act has no binding legal force and cannot be relied on either as a ground for derogating from the actual provisions of the act in question or for interpreting those provisions in a manner clearly contrary to their wording.”[2]

The requirement for legislators to provide recitals comes from Art. 296 TFEU, which says that “legal acts shall state the reasons on which they are based and shall refer to any proposals, initiatives, recommendations, requests or opinions required by the Treaties.” The obligation to present reasoning for a legal act is then creatively developed by the Counsel in point 3.1 of its “Manual of precedents for acts established within the Council of the European Union”:

“The recitals should state concisely the reasons for the main provisions of the act. The obligation to state reasons is set down in Article 296 TFEU.”[3]

“The Manual…” transforms the text of Art. 296 TFEU – “the reasons on which the legal acts are based” into “the reasons for the main provisions of the act.” It can only be assumed that the growing number of recitals, e.g., in the GDPR among others, is a direct effect of the “Manual…” and its peculiar understanding of Art. 296 TFEU, as there is no real need for this growth.

Not concluding whether such interpretation is correct or not, it is worth stressing that recitals are intended to provide reasoning for the legal acts and their main provisions. The reasoning is understood as presenting a cause, explanation, or justification for a legal act under Art. 296 TFEU or for the main provisions of an act under point 3.1 of the “Manual of precedents.”

The requirement that the EU legislation must contain recitals is imperative in nature. If the recitals are defective, the legislation is, in theory, invalid. The leading case is Federal Republic of Germany v. Commission,[4] in which the CJEU declared void the Commission’s decision. The CJEU also criticized the Commission in that the recitals, instead of giving reasons for, actually contradicted the operative part of the act in question.[5]

There is also a requirement for recitals to be initially sufficient.[6] As the court stated, “persons concerned […] may always be expected to make a certain effort to interpret the reasons if the meaning of the text is not immediately clear.” Nevertheless, “the legal act must be self-sufficient and […] the reasons on which it is based may not be stated in written or oral explanations given subsequently.”[7]

To summarize the CJEU’s approach to recitals: where both the recital and the legal provision are clear but inconsistent, the legal provision will control. In conclusion, the recitals have no legal meaning of their own. However, an apparent recital will help clarify an ambiguous enacting term, meaning that the legal provision will be interpreted in light of the recital.

It is worth stressing that recitals, although not legally binding, belong to the culture and tradition of the EU law, and they serve, if not for anything else, to present some explanation and motivation behind a legal act or a particular provision. Although the CJEU acknowledges recitals’ supportive nature, at the same time, it unequivocally rejects them as a potential source of law.

Recitals in the GDPR

In the context of the GDPR, Recitals play many functions:

as a customary preamble to new legislation, indicating the principal legal grounds for its adoption, which in this case is a reference to Art. 16 TFEU and to the right to the protection of personal data specified therein;

as an acknowledgment of and reference to the ordinary legislative procedure and the regard of the proposals from the Commission and opinions of the European Economic and Social Committee and the Committee of the Regions;

as a justification for and supportive explanation to the legally binding provisions;

as a historical and political backbone of the authors’ intentions, who are willing to maintain influence on implementing the regulation and preserving their legacy.

According to some authors, recitals have a legal purpose of interpreting the norms and have a “citizen-friendly” informative purpose. Thus, one of the recitals’ principles is to present the reasoning for enacting terms so that a non-expert could comprehend them.[8]

The first claim that recitals have a legal purpose of interpreting the norms and provisions of the same regulation they precede is an exaggeration as, according to the CJEU, recitals have “no binding legal force and cannot be relied on as a ground for derogating from the actual provisions of the act in question”[9] and serve only purposes designated by Art. 296 TFEU and point 3.1. of the “Manual…”. There is no legal ground in any EU primary law to grant recitals a role other than present reasoning. The suggestion that the introduction to the legislation (in the form of preamble and recitals) interprets the subsequent legislation is thus unsupported.

The second claim that the recitals should have a “citizen-friendly” informative purpose is much more defendable, especially in the context of point 3.1. of the “Manual…”. However, as stated above, the recitals cannot supersede the binding provisions of the law; their role in the EU legal order is non-binding and should only provide the “reasons for the main provisions.”[10]

In the case of the GDPR, however, the Recitals are something more than just “reasons for the main provisions”; they are dripping with teleology. They not only provide the reasons for relevant legal provisions but for the most part, they express the regulation’s goals and intentions. Just a few examples of that:

Recital (2): “(…) This Regulation is intended to contribute to the accomplishment of an area of freedom, security, and justice and of an economic union, to economic and social progress, to the strengthening and the convergence of the economies within the internal market, and to the well-being of natural persons.”

Recital (4): “The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. (…).”

Recital (23): “The processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union should also be subject to this regulation when it is related to the monitoring of the behaviour of such data subjects in so far as their behaviour takes place within the Union. (…).”

Recital (72): “Profiling is subject to the rules of this regulation governing the processing of personal data, such as the legal grounds for processing or data protection principles.”

The case of the GDPR shows that the role of recitals in EU law seems to be continuously growing. Though they remain non-binding, together with binding provisions that define the legislation’s objectives, the recitals are being designed to play a supportive role in the interpretation of the goal-oriented legislation.

The GDPR’s Recitals thus, in addition to their primary purpose, give some clues to the method of interpretation of the enacting terms and that such interpretation should take into consideration the goals of the regulation.

Recitals referring to Art. 22 GDPR

In the context of Art. 22 GDPR, Recitals (71) and (72) GDPR refer directly:[11] the first to the decision based on automated processing, including profiling and the second to the profiling. However, on the grounds of Art. 4(4) GDPR and Art. 22(1) GDPR, which presents the definitions of profiling and automated processing, which includes profiling respectively, it is apparent that Recital (72) GDPR refers to automated processing as well, as the GDPR uses the terms somehow interchangeably – in Art. 4(4) GDPR “profiling” is defined as “any form of automated processing” and in Art. 22 GDPR one combines with the other – “automated processing, including profiling.” Still a bit confusing, the justification for this obvious tautology stresses recognition of “profiling” in Art. 22 GDPR as a matter that requires additional attention.

The fact that profiling is singled out in Art. 22(1) GDPR represents concerns of the legislator regarding this particular form of automated processing, which “evaluate(s) certain personal aspects relating to a natural person.”[12] Recital (71) GDPR also devotes a small passage to profiling, providing examples of data subject’s assessment although only in reference to legal or similarly significant effects such profiling produces,[13] adding to the confusion rather than explaining the enacting term: Art. 22 GDPR clearly defines that the legal or similarly significant effect refers to a decision if such decision is based on automated processing, including profiling. Recital (71) GDPR wording seems to mix profiling as a form of automated processing with the definition of a decision based solely on automated processing, including profiling and attributes profiling causative powers as it was a decision. This claim, however, is not further elaborated.

As automated processing correlates more with the definition of “processing” (vide definition in Art. 4(2) GDPR), so is more related to the physical collection, storage and movement of the personal data inter alia, profiling relates to the automated evaluation of individual aspects of a data subject. This distinction between matters of personal data and issues affecting the natural person directly through evaluation of this natural person is critical as it broadens the scope of the provision and thus, increases the right granted in Art. 22(1) GDPR.

Recital (71) GDPR gives some examples of automated processing: automatic refusal of an online credit application or e-recruiting practices without any human intervention. One would expect the Recital (71) authors would have provided examples of automated decision-making that also fulfill other criteria required by Art. 22(1) GDPR – “a decision needs to produce a legal effect or similarly significantly affects the data subject” and different examples of such decisions based on profiling. Whether it would be the rejection of some services based on the data subject’s profile, like money transactions or internet activity, an automated screening before granting access to a company’s premises or services or purchase of internet products, or simply expelling somebody from the public platform of social media for vaguely defined ‘hate speech’ or for violation of the ever-changing community standards, such examples have been more likely to happen and more likely to meet all criteria of Art. 22 GDPR automated decision definition.

In one place, Recital (71) GDPR reads: “however, decision-making based on such processing, including profiling, should be allowed…”. By implication, only in three situations, the same as enumerated in Art. 22(2) GDPR that derogate the right of the data subject expressed in both Art. 22(1) GDPR and at the beginning of Recital (71). This part is by many understood as proof for the alleged prohibitive nature of Art. 22(1) GDPR. The A29WP, for example: “This implies that processing under Art. 22(1) GDPR is not allowed generally.”[14] Such an understanding is justified in out-of-context interpretation only. When reading Recital (71), it is evident that the wording “should be allowed” stands in opposition to the data subject’s very right not to be subject to a decision based solely on automated processing, including profiling. So, in other words, when the data subject exercises his/her right, or rather when the data subject would be willing to exercise his/her right, in these three situations, the right should be ignored[15] and automated processing resulting in a decision, allowed. The wording of Art. 22(2) GDPR directly reflects that: “paragraph (1) shall not apply”. The language of Art. 15(2) DPD could provide some more clues.[16]

By the same logic, if taking some phrases out of context, the following wording from Recital (71) GDPR should prove precisely the opposite of what the authors claim: “in any case, such processing should be subject to suitable safeguards,” so generally allowed “in any case.” Meanwhile, the part “in any case” refers to the three situations mentioned before this phrase, also enumerated in Art. 22(2) GDPR.

In the context of Recital (72) GDPR, understanding Recital (71) GDPR as a general prohibition of automated decision-making does not stand the test – “profiling is subject to the rules of this Regulation (…), such as the legal grounds for processing”. And the GDPR does not prohibit processing, profiling, nor automated decision-making. Additionally, it is worth reminding that the legal grounds for processing are enumerated in Art. 6(1) GDPR and not in Art. 22(2) GDPR. The last only defines the three situations when the right from Art. 22(1) GDPR “shall not apply.”

Recital (72) GDPR, explaining that profiling is subjected to the same rules of data protection principles and legal grounds as the rest of the GDPR, is very significant. It is also worth noticing the exemplification of precisely “legal grounds” in this case, as by many Art. 22(2) GDPR is erroneously interpreted as separate legal grounds for automated processing, including profiling.[17]

Recital (72) GDPR also signals a possibility of the EDPB “to issue guidance in that context.” The legal ground for such guidance is put under Art. 70(1)(f) GDPR.[18] However, the powers granted to the EDPB by the GDPR were used by the A29WP operating on the DPD grounds months before the GDPR came into force, with EDPB endorsing unlawfully issued guidelines afterward. Additionally, the A29WP’s Guidelines exceeded Art. 70(1)(f) GDPR relatively narrow scope of interest and covered much broader issues not limited to situations presented in Art. 22(2) GDPR.[19]

Not presenting any reasoning or explanations and providing unsubstantiated claims is, however, the main objection to Recital (71) GDPR; it merely rephrases Art. 22 GDPR. Recital (71) GDPR looks more like an instruction, design brief, or a recipe for what should be written in the enacting terms but by no means presents a reason why this provision should be written or what purpose it shall serve.

The recitals are meant to state reasons for the acts and their main provisions as required by the Treaties. As Recital (71) GDPR lacks these qualities, what is the point of considering its content? A vital clue what to do with a recital that does not serve its purpose provides point 10.7. of the “Joint Practical Guide of the European Parliament, the Council and the Commission for Persons Involved in the Drafting of European Union Legislation”: “any recital not serving to give the reasons for the enacting terms should be omitted.”[20]

EU Parliament, Counsel & Commission, Joint Practical Guide, p. 24. ↵

See Case C-136/04 - Deutsches Milch-Kontor: “As regards the ninth recital in the preamble to Regulation No 1706/89, it is sufficient to recall that the preamble to a Community act has no binding legal force and cannot be relied on either as a ground for derogating from the actual provisions of the act in question or for interpreting those provisions in a manner clearly contrary to their wording (Case C-162/97 Nilsson and Others [1998] ECR I-7477, paragraph 54, and Case C-308/97 Manfredi [1998] ECR I-7685, paragraph 30).”; see also case C-134/08 - Hauptzollamt Bremen v. Tyson Parketthandel. ↵

General Secretariat of the Council, Manual of Precedents, p. 81. ↵

Case 24/62 Germany v. Commission (1963) ECR 63. “Recitals are necessary for courts to perform supervision; therefore, the converse must be true-without recitals, judicial supervision is not possible in EC law.” ↵

Klimas, p. 77. ↵

Case T-16/91, Rendo NV (NL) v. Comm’n of the E.C., 1996 E.C.R. II-01827, at 45. ↵

Ibid., at 46. ↵

See e.g.: Galetta et al., p. 26. ↵

See e.g.: Case C-162/97, Nilsson and Others [1998] ECR I-7477, at 54. ↵

General Secretariat of the Council, Manual of Precedents, p. 81. ↵

Recitals (71) and (72) GDPR. ↵

Art. 4(4) GDPR. ↵

Recital (71) GDPR: “Such processing includes ‘profiling’ that consists of any form of automated processing of personal data evaluating the personal aspects relating to a natural person, in particular to analyse or predict aspects concerning the data subject’s performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements, where it produces legal effects concerning him or her or similarly significantly affects him or her.” ↵

Guidelines, p. 20. ↵

Whether or not the data subject’s ‘right not to be subject to a decision based on automated processing, including profiling,’ is in fact ignored in situations when the data subject gives his/her explicit consent for automated processing or willingly enters into a contract based on automated processing, is another matter. It can be argued that by deciding to give explicit consent for a decision based on automated processing or entering into a contract resulting in a decision based on automated processing, the data subject willingly decides not to exercise his/her right granted by Art. 22(1) GDPR, hence, making the right granted by Art. 22(1) inapplicable, thereby irrelevant, making the wording of Art. 22(2) GDPR “paragraph (1) shall not apply”, even more justified. ↵

Cf. Chapter 8.4. ↵

Cf. Chapter 9.2. ↵

Art. 70(1)(f) GDPR: “The Board shall ensure the consistent application of this Regulation. To that end [for that reason, with that goal], the Board shall (…), in particular: (…) issue guidelines, recommendations and best practices (…) for further specifying the criteria and conditions for decisions based on profiling pursuant to Art. 22(2).” ↵

Cf. Chapter 5.3. ↵

EU Parliament, Counsel & Commission, ‘Joint Practical Guide’, point 10.7., p. 32. ↵

5

Guidelines on Automated individual decision-making and Profiling for the purposes of the GDPR

Guidelines on Art. 22 GDPR

The current academic research on the automated decision-making subject is based mainly on historical reflections regarding previously in-force Art. 15 DPD and opinions of the supervisory authorities.

However, the discussion on automated decision-making issues encounters some unexpected obstacles: both the authorities[1] and many authors[2] ignore the necessity to present valid arguments supporting their claims or even neglect to present any argumentation at all. Some start with a false premise or jump directly to conclusions. Others tend to bow to the authorities’ opinions or are simply more influenced by them. The authorities being the EDPB and the A29WP and their ‘Guidelines on automated individual decision-making and profiling.’[3]

In the Guidelines, the A29WP claims, contrary to the wording of Art. 22(1) GDPR, that the right granted to the data subject signifies, in fact, the prohibition of automated decision-making. Moreover, while presenting its argumentation, the A29WP falls into sophistries.

To fully understand struggles and other controversies regarding the influence the Guidelines have on the interpretation of Art. 22 GDPR, the Guidelines’ role as so-called soft law needs to be clarified, and the arguments of the A29WP opinion endorsed later by the EDPB, presented.

Position of guidelines in the EU legal framework

Another unusual feature of the EU legal culture demonstrates itself through distinguishing between ‘formal’ and ‘informal’ legislation. The formal law comprises regulations, directives, and decisions, whereby recommendations, opinions, and other methods of developing policy, e.g., guidelines, are considered the soft law.[4]

Soft law instruments are referred to as rules of conduct which, in principle, have no legally binding force but which nevertheless may have practical effects.[5] The use of soft law instruments has increased in the activity of political and administrative bodies. Therefore, the European courts have been called to assess the justifiability and the validity of soft law instruments and their legal effects.[6] The case-law of the CJEU reflects that there has been an increase in references to non-legally binding provisions; the court sometimes quotes a specific guideline in the description of the legal framework that is taken into account when deciding the case or refers to it in order to reinforce a particular argument.[7]

Concerning the legal status of guidelines, there is a need to look closer at the terminology: “guidelines (…) are not rules of law that the administration is always bound to apply but rules of practice.”[8] They are, however, part of the broader normative framework. The European courts take guidelines under consideration when judging cases submitted to their jurisdiction.[9] Although not legally binding, they may constitute a point of reference and thus produce legal effects and may have certain hard law characteristics if they impose some obligations.

Nevertheless, it must be pointed out that the judicial transformation of soft law into hard law would affect the EU legal system and create a lack of procedural legitimacy.

A growing number of cases challenge the status and the application of guidelines.[10] The CJEU recognizes the legal effects of non-binding documents while acknowledging their status as a specific and important part of the European normative framework.[11]

The primary purpose of guidelines is to present in a transparent and accountable manner clarification of the law. Regarding the goal of the EDPB to ensure the consistent application of the GDPR, the guidelines of the Board should create frames incorporating practical mechanisms, legitimate expectations, and most of all, legal certainty of issues covered therein. These frames should be anchored in the provisions of the GDPR and fully backed by them. Any doubts concerning adequate legally binding provisions should be explained both in a legal and practical manner, however always according to the GDPR. Has this been achieved regarding automated decision-making provisions?

Controversial genesis of the A29WP Guidelines

On 3 October 2017 (few months before the day of application of the GDPR, which based on Art. 99(2) GDPR was on 25 May 2018), the A29WP adopted the “Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679.” During its first plenary meeting on 25 May 2018, the EDPB endorsed the GDPR related A29WP guidelines.[12]

However, no legal provision allowed the A29WP to adopt any guidelines, neither under the GDPR nor based on the DPD provisions. Likewise, there was no legal ground for the EDPB to endorse guidelines adopted by a working party. That raises questions: Were the Guidelines issued lawfully? Do they fulfill the requirements of guidelines as envisaged in the GDPR? Are they in any way binding or useful?

Quite obviously, considering the attributes of directives, the DPD did not envisage any need for delegating powers. Based on Art. 29 and Art. 30, however, the DPD set up a working party – Working Party on the Protection of Individuals with regard to the Processing of Personal Data, better known as the Article 29 Working Party. The A29WP had few prerogatives, and its status was only advisory. Its opinions and recommendations were to be forwarded to the Commission and the committee composed of the Member States representatives and chaired by the Commission’s representative.

In contrast to the DPD, Art. 68(1) GDPR established the EDPB “as a body of the Union,” which “shall have legal personality.” The GDPR assigned the EDPB many tasks and equipped it with powers and tools to fulfill them. Art. 69 GDPR granted the EDPB independence and directly commanded it to “neither seek nor take instructions from anybody” while performing its tasks or exercising its powers.

Interestingly, the Guidelines’ dubious genesis seems not to raise any controversies, not even among the scholars. It appears that every interested party conveniently ignores the fallout – the infringement of legitimacy.

Controversial content of Guidelines; sophistries of the A29WP

The inception of the Guidelines is one thing, but its content is also very controversial. It goes far beyond the frames of guidelines and scope of interests established in Art. 70(1)(f) GDPR, limited to “further specifying the criteria and conditions for decisions based on profiling pursuant to Art. 22(2) GDPR”.

The A29WP in its Guidelines clearly and often refers to a natural person’s right not to be subject to a decision based solely on automated processing as a prohibition of such processing. The logic is backed by the following statement:

“Interpreting Art. 22 GDPR as a prohibition rather than a right to be invoked means that individuals are automatically protected from the potential effects this type of processing may have. The wording of the Article suggests that this is the intention and is supported by Recital (71), which says: ‘However, decision-making based on such processing, including profiling, should be allowed where expressly authorized by Union or Member State law…, or necessary for the entering or performance of a contract…., or when the data subject has given his or her explicit consent.’ This implies that processing under Art. 22(1) GDPR is not allowed generally.”[13]

The A29WP adds to the confusion of scholars and authors who, based mostly on the Guidelines, understand paragraph (2) of Art. 22 GDPR as exceptions from the general prohibition of fully automated decision-making:

“The term ‘right’ in the provision does not mean that Art. 22(1) GDPR applies only when actively invoked by the data subject. Art. 22(1) GDPR establishes a general prohibition for decision-making based solely on automated processing. This prohibition applies whether or not the data subject takes an action regarding the processing of their personal data. In summary, Art. 22 GDPR provides that: (i) as a rule, there is a general prohibition on fully automated individual decision-making, including profiling that has a legal or similarly significant effect; (ii) there are exceptions to the rule; (iii) where one of these exceptions applies, there must be measures in place to safeguard the data subject’s rights and freedoms and legitimate interest.”[14]

The above quote in points (i) and (ii) presents an unsupported and false statement – there is no prohibition of automated decision-making in the GDPR and Art. 22(2) GDPR does not comprise exceptions to the alleged prohibition. Only point (iii) is partially true (apart from the use of the phrase “exceptions” in the sense of exceptions to the alleged general prohibition) as based on the provisions of Art. 22(3) GDPR – “in the cases referred to in point (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject’s rights (…)”.

Further on, the A29WP refers to Annex 2 of the Guidelines:

“In addition to the explanation provided in the main body of the guidelines, the following points expand on the rationale for reading Art. 22 GDPR as a prohibition:

Although Chapter III is about the rights of the data subject, the provisions in Articles 12 – 22 are not exclusively concerned with the active exercise of rights. Some of the rights are passive; they do not all relate to situations where the data subject takes an action i.e. makes a request or a complaint or a demand of some sort. Articles 15-18 and Articles 20-21 are about the data subject actively exercising their rights, but Articles 13 & 14 concern duties which the data controller has to fulfill, without any active involvement from the data subject. So the inclusion of Art. 22 GDPR in that chapter does not in itself mean that it is a right to object.”[15]

In the above passage, the A29WP tends to mix the addressee of Art. 13 and 14 GDPR directly indicated as ‘the controller’ with the addressee of Art. 22(1) GDPR – ‘the data subject.’ The claim of the A29WP that the right under Art. 22 GDPR is a passive right because some of the Articles from 12 to 22 are obligations of the controller is unsupported and not further elaborated. Additionally, the A29WP disregards Art. 12(2) GDPR, which does not refer to Art. 13 and 14 GDPR but only Art. 15 to 22 GDPR:

“Art. 12(2) GDPR talks about the exercise of ‘data subject rights under Art. 15 to 22’; but this does not mean that Art. 22(1) GDPR itself has to be interpreted as a right. There is an active right in Art. 22, but it is part of the safeguards which have to be applied in those cases where automated decision making is allowed (Articles 22(2)(a) to (c) GDPR) – the right to obtain human intervention, express his or her point of view and to contest the decision. It only applies in those cases, because carrying out the processing described in Art. 22(1) GDPR on other bases is prohibited.”[16]

The A29WP itself evokes Art. 12(2) GDPR, which clearly indicates that “the controller shall facilitate the exercise of data subject rights under Art. 15 to 22”, only to contravene Art. 12(2) in the second part of the first sentence. The word ‘exercise’ is defined as ‘the use of something,’ so obviously marks the active role of the right’s owner. The data subject right under Art. 22(1) GDPR, without any doubt, requires activity from the data subject to apply. The right needs to be triggered and only by the data subject him/herself. The others (in this case the controller) are enforced but under other provisions of the law (in this case directly by Art. 6, 12, 13(2f), 14(2g), 15(1h) GDPR and the principles of the GDPR in general) to facilitate the exercise of the data subject rights under Art. 15 to 22 GDPR.

Moreover, the A29WP claims that the provisions of Art. 22(2)(a) to (c) GDPR enumerate cases when automated decision-making is allowed under the GDRP “because carrying out the processing described in Art. 22(1) GDPR on other bases is prohibited.”[17] Yet, Art. 22(2) GDPR states merely cases when paragraph (1) of Art. 22 “shall not apply” and refers only to ‘the decision’ and not processing itself. It is Art. 6(1) GDPR that provides legitimate grounds for lawful processing of personal data, including automated decision-making and profiling.[18]

“Art. 22 GDPR is found in a section of the GDPR called ‘Right to object and (highlighted by the A29WP) automated individual decision-making’, implying that Art. 22 GDPR is not (highlighted by the A29WP) a right to object like Article 21. This is further emphasized by the lack in Art. 22 GDPR of an equivalently explicit information duty as that found in Article 21(4). If Art. 22 GDPR were to be interpreted as a right to object, the exception in Art. 22(2)(c) GDPR would not make much sense. The exception states that automated decision-making can still take place if the data subject has given explicit consent. This would be contradictory as a data subject cannot object and consent to the same processing.”[19]

Although in general, there is no need to argue with the A29WP that the data subject right granted by Art. 22(1) GDPR is not the right to object under Art. 21 GDPR, there is, however, the necessity to explain and to object to the same false premise made by the A29WP because it leads the A29WP to incorrect conclusions:

Situations listed in Art. 22(2) GDPR are not exceptions to the alleged prohibition of automated processing, but they are situations when revoking the data subject right under paragraph (1) of Art. 22 GDPR is allowed, and remains only in regard to the decision and only if such decision (not any automated processing): (a) is necessary for entering into, or performance of, a contract, (b) is authorized by Union or Member State law and (c) is based on the data subject’s explicit consent.

There is no contradiction in a data subject’s right to object to processing, including profiling under Art. 21 GDPR, as the data subject in case of application of Art. 22(2) GDPR (which applies only if Art. 22(1) ‘shall not apply’) is deprived of the right otherwise granted by Art. 22(1) GDPR. In other words, the data subject can (on the grounds of Art. 21 GDPR) object to processing, including profiling but in the case of application of Art. 22(2) GDPR is unable to “object” to the decision. Under Art. 21(1) GDPR the data subject can object to processing and not the decision, and under Art. 22(1) GDPR, the data subject can object to the decision but not to processing. It is hard to imagine, however, a real-life situation when the data subject grants his/her explicit consent to an automated decision or when the decision is necessary for a contract the data subject willingly enters and simultaneously objects to the processing, including profiling, preceding such a decision. Nonetheless, it is logical to grant the data subject the right to object to processing, including profiling under Art. 21 GDPR, in the case described in Art. 22(2)(b) GDPR when the data subject is not allowed to exercise the right under Art. 22(1) GDPR.

“An objection would mean that human intervention must take place. Art. 22(2)(a) and (c) GDPR exceptions override the main rule in Art. 22(1) GDPR, but only as long as human intervention is available to the data subject, as specified in Art. 22(3) GDPR. Since the data subject (by objecting) has already requested human intervention, Art. 22(2)(a) and (c) GDPR would automatically be circumvented in every case, thus rendering them meaningless in effect.”[20]

The A29WP again uses the term ‘exceptions’ in reference to Art. 22(2)(a), (b) and (c) GDPR that allegedly “override the main rule in Art. 22(1) GDPR,” which, according to the A29WP, constitute a general prohibition of automated decision-making. If accepting such a claim indeed, the following Art. 22(1) paragraphs (2), (3) and (4) GDPR do not make much sense. However, it was not the legislator’s intention to understand the data subject’s right under Art. 22(1) GDPR as a “general prohibition.” If that were the intention, the legislator would have to apply the rule of law and clearly and precisely indicated the controller as an addressee of this provision and the controller’s conduct. Meanwhile, the legislator’s actual intention is quite clearly and precisely presented, not just in Art. 22 but throughout the entire GDPR – “The free movement of personal data within the Union shall be neither restricted nor prohibited.”[21]

The Guidelines false premise only provokes the A29WP to an even more peculiar and unrealistic understanding of Art. 22 GDPR provisions. To the extent that questions the sense and existence of some of the GDPR provisions if they contradict the A29WP point of view.[22]

“This interpretation [general prohibition of automated decision-making] reinforces the idea of the data subject having control over their personal data, which is in line with the fundamental principles of the GDPR.”

Again, only an empty statement with reverse logic: if there were a prohibition of fully automated processing, the data subject would have no control over his/her data as there would not be any processing allowed in the first place. And most of all, understanding Art. 22 GDPR as a prohibition of automated decision-making and not the right of a data subject would mean that the data subject has no right, so no legal ground to refuse subjection to the decision made by a machine. A situation that makes a human subordinate to a thing or rather to an immaterial collection of bytes – an algorithm – contradicting thus anthropocentric legal consensus[23] that human is and should always remain superior to any of its inventions.

Going backward, yet still using the logic of the A29WP, it would be true to state that nobody is forcing the data subject to participate in the digital economy – data subjects do it for their own convenience and benefits. It is also true that companies recognize the value of personal data and want to monetize on them. However, that is the whole idea behind the GDPR – to provide the framework for this symbiosis. It is not to prohibit anything but to recognize the need to protect the data subject – the weaker party.

But even in the most favorable of interpretations to the A29WP stance, Art. 22(1) GDPR says nothing about prohibiting the fully automated form of decision-making and profiling. It only grants the data subject the right to decide whether or not to agree with an automated decision, which may have legal consequences.

Such an arbitrary approach of the A29WP is also surprising considering a much more balanced proposal expressed in Annex 1 to the Guidelines – ‘Good practice recommendation,’[24] which does not mention any form of prohibition of automated decision-making.

The A29WP interpretation ideas of Art. 22 GDPR are full of fallacies that disqualify the Guidelines as a valid and helpful source of support in the demanding and challenging implementation of the delicate matter of the automated decision-making provisions. It may also have a negative impact on the correct understanding of the GDPR, as there surfaces an easily observed reluctance among scholars and authors to take the risk of presenting more adequate interpretation findings but also among controllers who fear possible administrative fines only by not following the views of the A29WP, now fully backed by the authority of the EDBP. Such damage can be a considerable burden and have long-lasting consequences, mainly for the controllers but also for the data subjects whose right not to be subject to a decision based solely on automated processing is being denied and for the data subject’s own good.[25]

The A29WP performs ‘interpretive acrobatics’ and comes into a slippery slope of philosophical theories of rights. Bowing to the A29WP opinions makes a data subject only more vulnerable and dependent upon authorities and not on the data subject’s own free will. They are turning the whole GDPR and not only Art. 22 GDPR, upside down. Not acknowledging the data subject’s right under Art. 22 GDPR only deprives him/her of the possibility to exercise the powers granted there and limits the data subject’s other rights like the right to receive compensation indicated in Art. 82 GDPR.

The worries of the A29WP that the data subject was not protected by the direct prohibition of automated decision-making, as an opinion and possible advice under Art. 29 and 30 DPD would have been meaningful or maybe even reasonable. However, the opinions disguised as guidelines to issue which the A29WP was not authorized exhibit power-grabbing rather than good intentions.

The tangled opinions presented by the A29WP about Art. 22 GDPR, if rejected, make the provisions of the GDPR much clearer and more obvious as the structure of the GDPR is very articulate and precise.

Combining the controller’s obligations with the data subject’s rights, the GDPR expects both parties to cooperate in order to ensure lawfulness, fairness, and transparency as required by Art. 5(1)(a) GDPR. Giving the data subject information (in the form of imposing obligations on the controller to inform) about the fact of processing of his/her personal data and rights to actively participate in the processing or to some extent object the processing itself, allow the data subject to protect and control his/her personal data, thus fulfilling the obligations imposed by Art. 16(1) TFEU, Art. 8 of the Charter and Recital (7) GDPR.

Refusing to recognize the data subject as an active participant of the personal data exchange in an internet-based economy would lead to a situation when the data subject is subordinated to algorithms and his/her rights are enforceable only with the help of the authorities. Furthermore, ‘prohibiting’ innovative solutions on the extraterritorial platform the internet has become would be counterproductive and probably impossible, additionally making the EU undertakings less competitive.

Meanwhile, understanding the GDPR through its objectives and accepting data subject active participation as a requirement to protect the data subject’s personal data effectively seems much more logical and beneficial.

Cf. Chapter 5.4. ↵

Cf. Chapter 6.2. ↵

A29WP, ‘Guidelines on Automated Individual Decision-Making and Profiling for the Purposes of Regulation 2016/679,’ (2017), European Commission: Article29 Newsroom, Wp251 rev.01. ↵

Cf. Beveridge/Nott, p. 289. ↵

Synder, The Effectiveness of European Community Law, p. 32. ↵

Stefan, p. 756: “the case-law of the Courts reflects the distinction between legally binding force and legal effects. Thus, it recognises legal effects to non-binding documents such as the notices and guidelines of the Commission, only when this serves the enforcement of certain superior principles of law, common to the European legal order and the national legal orders. Taking soft law instruments into consideration is, ultimately, a matter of hard principles.” ↵

Ibid., p. 763. See also Case C-301/04, Commission v. SGL Carbon [2006] ECR I-5915 on the Guidelines on fines. ↵

Ibid. See also Joined Cases C-189, 202, 205, 208 and 213/02, Dansk Rørindustri and others v. Commission [2005] ECR I-05425, at 209; Case C-167/04, JCB Service v. Commission [2006] ECR I-8935, at 207. ↵

Ibid., p. 765. ↵

Bailey, unpaginated. See also examples: Case C-52/09 TeliaSonera (2011), Case C-226/11 Expedia (2012), Case T-111/08 MasterCard (2012), Case C-439/11P Ziegler (2013), Case C-501/11P Schindler (2013), Cases T-148/89 Tréfilunion v. Commission (1995), Case C-410/09 Polska Telefonia (2011). ↵

Stefan, p. 772. ↵

European Data Protection Board, Source – official website:https://edpb.europa.eu/our-work-tools/general-guidance/gdpr-guidelines-recommendations-best-practices_en. ↵

Guidelines, p. 20. ↵

Ibid., p. 19. ↵

Guidelines, Annex 2, p. 34. ↵

Ibid., p. 34. ↵

Ibid., p. 34. ↵

Cf. Chapter 8.2. ↵

Guidelines, Annex 2, pp.34-35. ↵

Ibid., pp. 34-35. ↵

Art. 1(3) GDPR. ↵

Guidelines, Annex 2, pp. 34-35: “if Art. 22 GDPR were to be interpreted as a right to object, the exception in Art. 22 GDPR(2)(c) would not make much sense.” ↵

Cf. Chapter 2.3.4. and 9.3.3. ↵

Guidelines, Annex 1 – Good practice recommendation, pp. 31-32. ↵

See e.g. Guidelines, p. 20: “interpreting Art. 22 GDPR as a prohibition rather than a right to be invoked means that individuals are automatically protected from the potential effects this type of processing may have.” ↵

6

Current state of research

“General prohibition of automated decision-making”

Just like the A29WP, many scholarly and commentary authors see in Art. 22(1) GDPR a general prohibition of automated decision-making and in Art. 22(2) GDPR exceptions for such or hesitate between understanding the provisions as a right or a prohibition:

Mendoza/Bygrave – “The last paragraph introduces a further qualification to all of the exceptions laid down in paragraph (2), this qualification taking the form of a prohibition on automated decisions based on special categories of data – a prohibition not contained in Art. 15 DPD”; or “The ‘right’ most likely functions as a (qualified) prohibition with which the decision maker has to comply regardless of whether the ‘right holder’ invokes it or not.”;[1]

Martini – Art. 22(1) GDPR states a prohibition of automated decision-making, however its placement in the ‘rights section of the data subjects’ causes confusion. The argument is based on the German implementation of the 1995 Data Protection Directive into national law, which was in fact phrased as a prohibition. However, the author also states that the legal status (right to object or prohibition) of Art. 15 DPD and art. 22 GDPR is disputed. “Grundsätzliches Verbot – Ihnen allen ist das Ziel gemein, den Bürger durch ein Verbot zu schützen.[2] Art. 22 GDPR verbietet auf einer automatisierten Datenverarbeitung basierende Einzelentscheidung nicht vorbehaltlos. Abs. 2 enthalt zahlreiche Ausnahmen.”[3]

Kaminski – “The Art. 22 GDPR right/prohibition applies only when the decision is ‘based solely’ on algorithmic decision-making.”;[4]

Wachter, et al. – “ambiguity of language (…) allows (…) Article 22 GDPR to be interpreted either as a prohibition, or right to object.”;[5]

Dreyer/Schulz – “paragraph (1) [of Art. 22 GDPR] describes the principle, paragraph (2) the exceptions (…) – it [paragraph (1) of Art. 22 GDPR] seems to be a prohibition.”;[6]

Gola – the author, like the A29WP, sees the right from Art. 22(1) GDPR as at least indirect prohibition of automated decision-making and claims no need for the data subject to actively trigger the right: “Ob Abs. 1 ein grds. Verbot automatisierter Entscheidungen im Einzelfall statuiert oder alternativ der betroffenen Person ein subjektives Recht einräumt (letzteres wird schon der systematischen Stellung der Norm wegen zutreffend sein), ist für die praktische Anwendung letztlich unbedeutend, da jedenfalls davon auszugehen ist, dass der Betroffene das ihm zustehende Recht nicht aktiv ausüben muss und der Norm damit zumindest mittelbar Verbotscharakter zukommt. Das in Abs. 1 normierte grundsätzliche Verbot einer automatisierten Entscheidung im Einzelfall kann nur bei Vorliegen einer der in Abs. 2 enumerative abschliessend aufgezählten Fallkonstellationen durchbrochen werden.”;[7]

Esser/Kramer/von Lewinski – the authors claim that despite the formal disguise as a subjective right of the person concerned, Art. 22(1) GDPR constitutes a general prohibition of automated decision-making: “Art. 22 Abs. 1 normiert – trotz der formalen Einkleidung in ein subjektives Recht der betroffenen Person – ein grundsätzliches Verbot von Entscheidungen, die ausschliesslich auf einer automatisierten Verarbeitung beruhen und gegenüber der betroffenen Person rechtliche Wirkung entfalten oder sie erheblich beeinträchtigen; Abs. 2 regelt dann Ausnahmen von diesem Verbot.”[8]

Tosoni – application of the CJEU methodology of interpretation helps the author reach a conclusion that rejects the prohibitive understanding of Art. 22 GDPR: “Based on a textual, contextual, systematic and teleological interpretation [Art. 22(1) GDPR] is better characterized as conferring upon data subjects a right that they may exercise at their discretion, rather than establishing a general ban on individual decisions based solely on automated processing.”[9]

Confusions regarding Art. 22 GDPR

In the following discussion, the views of Dreyer and Schulz, and most of all of Mendoza and Bygrave, stand out as excellent examples of the current state of academic research on the automated decision-making topic. Unlike many of the below-presented opinions, these authors provide a satisfying amount of detailed and interesting argumentation while painting a picture of growing confusion and misunderstanding regarding the objectives and provisions of the GDPR. One author, however, adopts the CJEU interpretative methodology and concludes that Art. 22 GDPR does not constitute a prohibition of automated decision-making. Still, Tosoni perceives Art. 22 GDPR as ambiguous and seems a bit intimidated by his findings.

Scholarly authors

Dreyer and Schulz

“If automated decisions were generally inadmissible, the risks of algorithmic decision-making systems could not (…) materialize in the area covered by the GDPR. In fact, the GDPR lays down the principle that a person has ‘the right not to be subject to a decision based solely on automated processing’.”[10]

To this point, Dreyer and Schulz, but also many other authors and commentators, agree that the wording of Art. 22(1) GDPR refers to the data subject’s right not to be subject to a decision based solely on automated processing, including profiling. But after initially admitting the aforementioned, something alters their perception, and suddenly, usually without much of an explanation, they start to read the provisions of Art. 22(1) GDPR as a general prohibition of automated decision-making. This “something” is, in most cases, a misunderstanding of Art. 22(2) GDPR and disregard for other provisions and objectives of the GDPR.

“The wording of the regulation defines this principle as the right of the individual to permit the data controller to make use of systems of this kind.”[11]

Dreyer and Schulz start with acknowledging the right under Art. 22(1) GDPR only to present the right a moment later as a ‘permission’ of a data subject addressed to a controller to make a decision based solely on automated processing, including profiling. However, the right under Art. 22(1) GDPR is not a permission to allow the controller for automated decision-making but a right to avoid potentially negative consequences of a decision based on such automated processing. And it would be almost always the negative consequences that trigger the data subject to use the right, as the positive results only rarely and under very abstract circumstances would cause such reaction.

A little further in their paper, Dreyer and Schulz articulate their hesitation:

“however, in light of the subsequent structure of the regulation – paragraph (1) [of Art. 22 GDPR] describes the principle, paragraph (2) the exceptions, paragraph (3) the special requirements for systems not covered by paragraph (1) – it seems to be a prohibition. Basically, the use of such automated decision-making systems is not permissible.”[12]

The idea that Art. 22(2) GDPR describes exceptions of automated decision-making contradicts their primary observation that the data subject has the right to avoid the automated decision. It is also unsupported and negates not only the provision of Art. 22(2) GDPR itself but all principles of the GDPR and its Art. 6(1) in particular.

The above-mentioned and following sophistries, even though they consist of plausible arguments and sound convincing in general, distort the quite appealing concept behind the GDPR. A concept forged in lengthy and complex negotiations, including political agendas, which among the other principles states that “the right to the protection of personal data is not an absolute right”[13] that “the processing of personal data should be designed to serve mankind”[14] or that “the free movement of personal data within the Union shall be neither restricted nor prohibited.”[15] Principles, the CJEU confirmed in case C‑507/17, Conseil d’État v. Google and in case C-18/18, Glawischnig-Piesczek v. Facebook Ireland Limited.

It seems that the misinterpretation of Art. 22 GDPR and its paragraph (2) primarily stem from not using the correct interpretation tools. Instead of focusing on the grammatical, contextual, historical and teleological methods, the authors tend to interpret one paragraph through the lenses of the second. By doing so, the authors commit a factual error in their premise. They do not see that Art. 22 GDPR is divided into two parts: the first one consisting of paragraph (1) only, and the second part containing the rest – paragraph (2), (3) and (4). The first part defines the data subject’s right and the decision to which the data subject has the right not to be subjected. The second part enumerates the situations when the first part does not apply because of specified circumstances surrounding the decision itself. Paragraphs (3) and (4) of Art. 22 GDPR refer only to paragraph (2), so their execution is only possible if the circumstances described in paragraph (2) materialize.

Yet, the authors disregard the existence of Art. 6(1) GDPR, lawful grounds for the processing, and persist in perceiving Art. 22(2) GDPR as the legal basis for allegedly otherwise prohibited automated decision-making:

“The principle of the prohibition of pure automated decision-making systems is being softened in practice, not only through the restrictive scope of application of the prohibition as specified in Art. 22(1) GDPR, but also by the far-reaching exceptions specified in Art. 22(2) GDPR.”[16]

The authors then discuss and present their justification for understanding the three situations defined in Art. 22(2) GDPR as the three exemptions from the alleged general prohibition of automated decision-making.[17]

“Exemption” 1 – Automated decision-making is necessary for entering into or performance of a contract: the authors’ opinion pretermits the wording of Art. 22(2) GDPR, which in reference to entering into or performing a contract, unambiguously determines that the decision and its necessity is a pivotal point in this paragraph and not the contract or contract’s necessity and that at the same time, the right granted under Art. 22(1) GDPR does not apply. The decision’s necessity applies to all three situations enumerated in Art. 22(2) GDPR.

“Exemption” 2 – National opening clauses authorizing automated decision-making systems: the authors provide examples of systems that allegedly permit automated decision-making based on the EU or its Member States laws. “In practice this can include national regulations which permit the use of automated decision-making systems that are designed for surveillance purposes or to prevent tax evasion and fraud, or are supposed to safeguard the security and reliability of a specific service provider.”[18] The real-life example is, however, more mundane – the Germany’s Federal Data Protection Law (BDSG), in §37(1) BDSG, states that the data subject can be denied the right under Art. 22(1) GDPR in cases in which the decision has been made within the context of an insurance contract, where the data subject requested an insurance benefit and the data controller has fully granted the request or partly granted it where the decision is based on the application of binding remuneration agreements for medical treatments. In the latter case §37(1) no. 2 BDSG confers on the data subject specific rights to express his/her views and object, comparable to those specified in Art. 22(3) GDPR.[19] Interestingly enough, Germany’s BDSG uses the expression ‘exceptions’ clearly not as exceptions to the alleged prohibition of automated decision-making but as exceptions that justify the repeal of the right granted in Art. 22(1) GDPR.

“Exemption” 3 – Explicit consent of the data subject regarding an automated decision: “This exemption (…) practically turns the basic prohibition of automated decision-making systems as specified in Art. 22 (1) GDPR into a ban with consent-based permit reservation.”[20]

The above sentence sums up the most misleading presumption of the authors regarding Art. 22(2) GDPR and its point (c) in particular: the data subject can consent to automated decision-making and thus lift the alleged ban on automated decision-making.

This presumption contradicts the content of the provisions of Art. 22(1) and (2) GDPR, which reads something opposite: Art. 22(1) GDPR establishes the right and Art. 22(2) GDPR excludes the application of this right in three defined situations, including the data subject’s consent.

“However, it is not entirely clear to what exactly the consent is supposed to be referring. Consent under data protection law is centrally framed by Art. 7 GDPR and refers to the data subject’s declaration of consent to the processing of his personal data. However, the wording of Art. 22(2)(c) GDPR seems to refer the required consent to the automated decision itself. This is another instance where Art. 22 GDPR fails to differentiate between data processing on the one hand and the decision resulting from this processing on the other hand. Thus, in this case, consent should refer expressly not only to the data processing by the automated decision-making system, but also to the circumstance of the automated decision-making. Consent as specified in Art. 22(2)(c) GDPR, when compared with the ‘normal’ kind of consent stipulated in Art. 7 GDPR, is a specifically extended declaration. This can have systematic consequences for the information on the basis of which the data subject gives his informed consent.”[21]

In the above passage, the authors recognize that the data subject’s explicit consent concerns the decision based on automated processing. However, they forget that the definition of the decision in Art. 22(1) GDPR contains the expression “based solely on,” making it clear that the decision takes place after automated processing, thus invalidating the authors’ claim that “Art. 22 fails to differentiate between data processing (…) and the decision.”

“The principal prohibition of automated decision-making specified in Art. 22 GDPR does not only have a restricted area of application. Beyond that, the regulation provides for numerous exceptions.”[22]

Dreyer and Schulz fail to recognize that the lawfulness of processing specified in Art. 6(1) GDPR and the situations enumerated in Art. 22(2) GDPR are not contradictory, and that there is no part in Art. 22 GDPR that repeals Art. 6 GDPR.

The Fig. 6.1 below visualizes the opinions of Dreyer and Schulz:

Fig. 6.1 Decision tree on the scope of application of Art. 22(1) GDPR, source: Dreyer/Schulz, p. 20.

Although correct in part, the lower section of the diagram shows the authors’ incorrect presumption of the prohibitive nature of Art. 22(1) GDPR, thus displaying erroneous conclusions.

The relation between Art. 6(1) GDPR and Art. 22(2) GDPR is discussed more broadly in Chapter 9.2., and the improved version of the above diagram presented.

Mendoza and Bygrave

In their collaborative paper,[23] Mendoza and Bygrave, present an in-depth analysis of both Art. 15 DPD and Art. 22 GDPR, offering and including the historical background of drafting the data protection legislation. However, despite gathering many compelling arguments in favor of the non-prohibitive nature of Art. 22 GDPR, based only on an irrelevant lack of expression ‘right’ in the title of Art. 22 and use of negation in the automated decision definition, the authors endorse the opposite stance that also contradicts the former views of Bygrave:[24]

“(…) So far GDPR Art. 22(1) has been characterized as laying down a particular right. This characterization is not entirely accurate, insofar as it connotes a right that shall be exercised at the discretion of the right holder. Whereas several other rights in the Regulation obviously require the data subject as right holder to exercise them (…) Art. 22(1) is different as the data subject here does not have the right to something but the right not to be subject to a particular type of decision. This distinction, combined with the consent derogation in Art. 22(2), suggests that Art. 22(1) is intended as a prohibition and not a right that the data subject has to exploit. Yet, Art. 22(1) invokes the language of ‘right’. Art. 22(4) GDPR, by contrast, states that automated decisions ‘shall not’ be based on special categories of data. It could be argued that the lawmakers would have formulated Art. 22(1) more like Art. 22(4) if the right was not to be exercised by the data subject. Moreover, Art. 22 is placed in the chapter of the GDPR that is termed ‘rights of the data subject’, and other provisions (e.g., Art. 12(2)) refer to ‘the exercise of data subject rights under Art. 22 GDPR’. On the other hand, the title of Art. 22 is not expressed as a ‘right’, unlike the titles of Arts. 15–18, 20–21.[25]

(…) Thus, from both a logical point of view and a more teleological perspective rooted in concern for privacy and data protection as fundamental rights it makes most sense to conclude that the apparent right provided by Art. 22(1) does not have to be exercised by the data subject. The ‘right’ most likely functions as a (qualified) prohibition with which the decision maker has to comply regardless of whether the ‘right holder’ invokes it or not.[26]

(…) Art. 22 GDPR operates with three categories of derogation from the right/prohibition laid down in its first paragraph: (i) contract (Art. 22(2)(a) and 22(3)); (ii) authorization by EU or member state law (Art. 22(2)(b)); and (iii) data subject consent (Art. 22(2)(c) and 22(3)).”[27]

Mendoza & Bygrave begin with a grammatical interpretation with a clear conclusion that Art. 22(1) GDPR ‘lays down a right.’ However, the next thing, they traverse to the contextual interpretation although still hanging on to the grammatical meaning, even guessing the intention of the provision. At that moment, as if suddenly surprised and confused by Art. 22(1) GDPR wording ‘not to be,’ ‘the right’ becomes ‘a prohibition,’ and now the fully rolled out contextual argumentation makes them stumble over their own feet. Despite their arguments: (i) that Art. 22(1) GDPR “invokes the language of right,” (ii) “is placed in the chapter of the GDPR that is termed ‘rights of the data subject,’” (iii) the authors’ evocation of Art. 12(2) GDPR defies their claim that the right under Art. 22(1) GDPR is different from other rights of the GDPR’s Chapter III as it is “not a right that the data subject has to exploit,” (iv) they agree that “the lawmakers would have formulated Art. 22(1) GDPR more like Art. 22(4) GDPR if the right was not to be exercised by the data subject,” yet they conclude, based only on the irrelevant lack of expression ‘right’ in the title of Art. 22 that Art. 22(1) GDPR is not a ‘right’ but a ‘prohibition.’

Relying on a provision’s title or title of a contract or title of any legal act instead of on their content and enacting terms is not supported by the CJEU rulings.[28] Additionally, according to the “Joint Practical Guide of the European Parliament, the Council and the Commission for Persons Involved in the Drafting of European Union Legislation,” an article, as a basic unit of law, may or may not have a title.[29] Hence, the title is void, irrelevant.

The very insignificant detail challenges the authors’ otherwise excellent and justified interpretation: the not even legally binding title of Art. 22 GDPR. By doing so, Mendoza & Bygrave ignore the clear and unambiguous enacting term – the provision of Art. 22(1) itself: “the data subject shall have the right …”, rejecting the clara non sunt interpretanda rule of interpretation,[30] and are throwing away perfectly fine and substantiated analysis. Their confusion over wording ‘not to be subject…’ is unfortunately left unexplored and unexplained. Their opinion that such ‘distinction’ together with ‘derogation’ under Art. 22(2) GDPR ‘suggests … an intention’ of a prohibition is useless as a legal argument as it is not substantiated and just asserted.

In the other part of their paper, Mendoza & Bygrave appeal to logic and the teleological perspective[31] to support their claim. But the logic is not explained, and the teleological evocation equates data protection to privacy, which Article 16(1) TFEU and Article 8(1) of the Charter already separated.[32] Instead, the authors again confirm that “the right provided by Art. 22(1)” is “apparent,” yet they claim that the right “does not have to be exercised by the data subject.”[33] This assertion led them to a conclusion that the ‘right’ (put by the authors in apostrophes to accent their doubts) is, in fact, a prohibition of automated decision-making and that a controller is forbidden to make an automated decision “regardless of whether the ‘right holder’ invokes [the right] or not.”[34]

Mendoza & Bygrave try to soften their claim by adding the word “(qualified)” before “prohibition,” which they do in an odd manner by putting the phrase in brackets. Yet, later in their paper, the authors present situations enlisted in Art. 22(2) GDPR as qualifications or conditions that lift the alleged prohibition. They see Art. 22(2) GDPR as “three categories of derogation from the right/prohibition.”[35]

Despite many compelling arguments proving the exact opposite, Mendoza & Bygrave strive to validate a false claim of the alleged prohibitive character of Art. 22 GDPR.

Kaminski

“Interpreting Art. 22 GDPR as establishing a right to object would make the right narrower; in practice, it would allow companies to regularly use algorithms in significant decision-making, adjusting their behavior only if individuals actually invoke their rights. Interpreting Art. 22 GDPR instead as a prohibition on algorithmic decision-making would require all companies using algorithmic decision-making to assess which exception they fall under, and implement safeguards to protect individual rights.”[36]

The author seemingly presents the arguments for both interpretations, calling Art. 22 GDPR “right/prohibition.”[37] However, later in the paper, while raising doubts for the clarity of the GDPR’s text, she entirely agrees with the “important ways” the Recitals and the A29WP Guidelines clarify the regulation, not providing any arguments for understanding Art. 22 GDPR as a right.[38]

Kaminski explains the role of recitals and guidelines and points out that, backed by the authority of the EDPB, the A29WP Guidelines “have additional teeth” as the local DPAs would “even more likely adhere to the guidelines than under the DPD when they were already followed fairly strictly.”[39] The author perceives the Recitals and Guidelines as “fundamentally collaborative” and rejects distinguishing the hard law and soft legal instruments perceiving it as a “technicality.”[40]

The author builds her views based on the idea that “the text of the GDPR will be given specific substance over time through ongoing dialogue between regulators and companies, backed eventually by courts.”[41] According to Kaminski, the provisions of Art. 22 GDPR are somehow fluid and evolving, so disputing the A29WP Guidelines or Recitals would “remove important sources of clarity for companies as the law develops.”[42]

Such perception of the GDPR and automated decision-making provisions could lead to disregard of their substance. If we agree that the law is evolving without changing its content and mainly through non-legally binding, soft law instruments, why bother with interpreting the legal provisions at all? Also, viewing the DPAs and EDPB as equal with companies partners for discussing the meaning of the law behind the back of the legislator negates the principles of the legitimate legislative process. Such an approach to implementing GDPR is at best naive and at worse contra existing legal order, with potentially negative consequences to a data subject excluded from this circle.

The author does not challenge nor discuss the ‘important clarifications’ provided by the A29WP Guidelines, relying on the Guidelines’ content rather than on the wording of Art. 22 GDPR.[43] That shifts the discourse somewhat away from the legally binding automated decision-making provisions and diverts the potential discussion from the author to the A29WP.[44]

Wachter, Mittelstadt, Floridi

“The ambiguity and limited scope of the ‘right not to be subject to automated decision-making’ contained in Art. 22 GDPR (…) raises questions over the protection actually afforded to data subjects. The GDPR lacks precise language as well as explicit and well-defined rights and safeguards against automated decision-making, and therefore runs the risk of being toothless.”[45]

The authors proceed on the premise of ambiguity and vagueness of Art. 22 GDPR and the whole regulation’s wording. However, such a statement does not necessarily have to be derived from the actual text of the regulation. Uncertainties about the content of the regulation and Art. 22 GDPR in particular stem instead from disregarding the interpretation methodology adopted by the CJEU to clarify all EU legal acts but is also applied for the regulation’s drafting process and imprinted in its text.[46] Such a disregard proves only the need for more awareness regarding these interpretative tools when discussing EU law.

The focus of the authors’ paper is on the right to an explanation of all decisions made by automated or artificially intelligent algorithmic systems. Thereupon, they conclude that “as it stands, transparent and accountable automated decision-making is not yet guaranteed by the GDPR; nor is a right to an explanation of specific decisions forthcoming. At best, data subjects will be granted a ‘right to be informed about the existence of automated decision-making and system functionality.’”[47] The authors see it as shortcomings and advocate for addressing them. However, they ignore the goals of the GDPR, mainly to provide the data subject with the right not to be subject to an automated decision but also the regulation’s self-restraining objective specified in Recital (4) to seek balance with other fundamental rights.

Regarding Art. 22(2)(a) and (c) GDPR, the authors have an interesting observation: the GDPR does not define when automated decision-making is “necessary” for entering or performing a contract, leaving the issue to the controller to approach. The authors seem to perceive the controller’s sole discretion in this matter as a legislator’s lapse. Art. 22(2)(a) GDPR envisions a situation where the controller makes automated decisions necessary for a contract, but without seeking the data subject’s explicit consent first. The controller is therefore allowed to decide that an automated decision is necessary for contractual obligations, while the data subject is unable to trigger his/her right as Art. 22(1) GDPR does not apply. In this case, under Article 22(3) GDPR, the data subject retains the right to contest, express views, or obtain human intervention for a decision reached.[48] However, the controller’s sole discretion whether an automated decision is necessary for entering into or performance of a contract seems to be softened by the very fact that the contract represents the will of both parties – the data subject’s and the controller’s alike – and as such the controller is free to decide if his will is declared by automated means, thus making the authors’ claim unfounded.

“Due to the similarities of language and content between Art.15 DPD and Art. 22 GDPR, the varying implementation of Art. 15 DPD as a prohibition or right to object by Member states supports the interpretation that Art. 22 is ambiguous and can be read as a prohibition or right to object.”[49]

The authors refer to Art. 15 DPD, which clear language left no doubts that it provided data subjects with the right not to be subject to automated decision-making.[50] Still, based on the fact that some Member States implemented Art. 15 DPD as a prohibition while applying the margin of appreciation principle, the authors justify their perception of the wording of Art. 22 GDPR as ambiguous, thus validating their belief in two possible interpretations of Art. 22 GDPR: the right to object or the prohibition. However, the opposite conclusion seems much more logical: if the previously in force Art. 15 DPD provided the right, but some Member States opted for the prohibition than Art. 22 GDPR, with almost the exact wording,[51] regarding the regulation’s goal for consistency and harmonization through its direct application,[52] would lead to a conclusion that Art. 22 GDPR is explicit, not ambiguous. Thus, only one interpretation – the right, not the prohibition – is apparent.

“Critically, if Art. 22 GDPR grants a right to object automated decision-making is legally unchallenged by default, even if it does not meet any of the requirements set out in Art. 22(2) GDPR, so long as the data subject does not enter an objection. This limitation increases the burden on data subjects to protect actively their interests relating to profiling and automated decision-making by monitoring and objecting to automated decision-making.

With this comparison in mind, interpreting Art. 22 GDPR as a prohibition grants greater protections by default to data subject’s interests, at least in the cases in which Art. 22(3) GDPR would apply. As a prohibition, controllers would be legally obliged to limit automated decision-making meeting the definition in Art. 22(1) GDPR to the three cases identified in Art. 22(2) GDPR (contract, Union or Member State law, consent).

In contrast, a right to object would not pre-emptively restrict the types of automated decision-making undertaken by controllers to the three cases defined in Article 22(2).”[53]

In the first and the last paragraphs of the above passage, the authors rightly notice that if interpreting Art. 22(1) GDPR as the right, the data subject is indeed required to actively seek protection against an automated decision as the controller is not prohibited from making one. However, it is consistent with other data subject rights, which also require action to exercise them. What is, therefore, the benefit of differentiating the rights? The second paragraph explains why the authors advocate for understanding the right of Art. 22(1) GDPR as a prohibition of automated decision-making; they see the prohibition as greater protection for the data subject and, more importantly so, by default. Except in the long term, such an approach could backfire and, e.g., limit the development of Member States undertakings against competition from outside of the UE, equally worsening the situation of data subjects devoid of access to new or cheaper services.[54]

Tosoni

“Based on a textual, contextual, systematic and teleological interpretation [Art. 22(1) GDPR] is better characterized as conferring upon data subjects a right that they may exercise at their discretion, rather than establishing a general ban on individual decisions based solely on automated processing.”[55]

To support his argumentation, Tosoni applies the interpretation methodology of the CJEU.[56]

Applying grammatical analysis, Tosoni claims that the wording of Article 22(1) GDPR is ambiguous and shows some slight variations across language versions.[57] Referring to the textual arguments offered by the A29WP Guidelines, the author regards them as “Brather weak.”[58]

When discussing the context of Art. 22 GDPR, Tosoni points out that if embracing the prohibitive interpretation, the controller’s obligation to inform the data subject about automated decision-making, envisaged in Art. 13 to 15 GDPR, “Bwould likely be absurd”[59] as it would mean an obligation to inform about an activity that the GDPR prohibits.

The author also presents a broader context of Art. 22(1) GDPR,[60] mainly corresponding provisions of the Protocol amending Convention 108[61] and the Council of Europe’s Recommendation on Profiling,[62] which grant each person the right to be able to object to an automated decision.

Tosoni traces back to the GDPR’s travaux préparatoires and provides historical explanation through Art. 15 DPD supporting rejection of prohibitive interpretation of Art. 22 GDPR.[63]

The author recognizes the critical objective of Art. 22 GDPR as similar to postulated in Recital (10) GDPR – to ensure ‘high level of protection of natural persons’ – and to Art. 15 DPD, which “was intended to empower data subjects to decide not to be bound by automated decisions, and not to ban automated decision-making in general.”[64]

In his paper, Tosoni does not assume the meaning of the provisions of Art. 22 GDPR but provides logical argumentation, also backed by the CJEU’s jurisprudence. The author observes that his conclusion – rejection of the prohibitive interpretation of Art. 22 GDPR – contradicts the current majority opinion and clashes with the A29WP Guidelines. In this regard, Tosoni is somewhat skeptical but does not exclude that the EDPB will change its view on Art. 22 GDPR.[65]

Commentary authors

As their voices and opinions often reach a broader audience than scholarly papers, the commentary authors deserve special attention:

Esser, Kramer, Lewinski

“Art. 22(1) GDPR constitutes – despite the formal disguise as the right of the data subject – a general prohibition of automated decision-making including profiling; Art. 22(2) GDPR constitutes exceptions to this prohibition.”[66]

Esser/Kramer/von Lewinski do not provide any arguments to support their views, expressed in a rather authoritative tone. Lack of effort in presenting their reasoning hinders the debate. Nonetheless, the above passage provides a clear postulate to recognize Art. 22(1) GDPR as a prohibition of automated decision-making with exceptions enumerated in Art. 22(2) GDPR. The authors perceive the provisions as “veiled” only as the right but, in fact, not being one. Why the authors advocate for such an interpretation is, however, not explained.

Gola

“Whether Art. 22(1) GDPR stipulates a general prohibition of automated decisions in individual cases or alternatively grants the person concerned a subjective right (the latter will be applicable due to the systematic position of the norm) is ultimately irrelevant for practical application since it can be assumed in any case, that the person concerned does not have to actively exercise the right to which he/she is entitled and that the norm forms thus at least indirect prohibition.

The general prohibition of automated decision-making in individual cases as constituted in Art. 22(1) GDPR can only be broken if one of the enumerative and conclusive cases listed in Art. 22(2) GDPR is present.”[67]

In the first paragraph of the above passage, Gola dismisses both interpretations of Art. 22 GDPR – the right or the prohibition – as unimportant in practice. Without any explanation or reasoning, the author assumes that the data subject does not have to actively exercise his/her right, which should lead to a conclusion that Art. 22(1) GDPR constitutes at least an indirect prohibition of automated decision-making. However, Gola seems to ignore Art. 12(2) GDPR, which refers to exercising the data subject rights under Art. 15 to 22. Also, his conclusion that if the data subject does not have to trigger his/her right to reject an automated decision, it must mean that the controller is prohibited from making one, disregarding the general principles of transparency, clarity and consistency of administrative law, especially regarding any obligations of the addressees.[68]

In the second paragraph, the author fully embraces the prohibitive interpretation of Art. 22(1) GDPR. Justification for such an interpretation can be found in his general remarks only, where Gola points to high risks and potential danger of automated decision-making for the data subject.[69] Unfortunately, more detailed argumentation is not provided.

Martini

“[Art. 22 GDPR constitutes] general prohibition – the common goal is to protect the data subject through the prohibition [of automated decision-making].[70]

Art. 22 GDPR does not unconditionally prohibit individual decisions based on automated data processing. Paragraph (2) contains numerous exceptions.”[71]

Martini, like Gola, also points toward risks related to automated decision-making for the data subject’s right to the protection of personal data[72] as a justification for the prohibitive interpretation of Art. 22 GDPR.

The author refers to formerly in force Art. 15 DPD and recognizes it as the right of the data subject. However, he indicates on German implementation of the DPD, mainly §6(a) of the valid till 25th May 2018, Federal Data Protection Act (Bundesdatenschutzgesetzes), which directly prohibited automated decision-making with three exemptions. Martini sees Art. 22 GDPR similarly to §6(a) of the German Federal Data Protection Act.[73] He views Art. 22 GDPR as a provision providing the data subject with the possibility to self-determine how his/her personal data is being processed – through consent.[74]

Martini’s interpretation is based on a false premise that the right not to be subject to an automated decision can be achieved by the data subject consent only. And yet, the right granted in Art. 22(1) GDPR rests on the data subject’s refusal to be subjected to an automated decision and not on consent for such. The author’s views are further contradicted by Art. 22(2) GDPR, which according to Martini, constitutes three “exceptions” of the alleged general prohibition of automated decision-making, and only there the consent of the data subject appears as one of the “exceptions.” But paragraph (2)(c) of Art. 22 GDPR only excludes the application of the right provided in paragraph (1); the data subject’s explicit consent for an automated decision means that the data subject right not to be subjected to an automated decision is no longer applicable and not that the alleged prohibition of automated decision-making is lifted.

Martini infers from his own presumptions and from German implementation of the DPD but does not provide substantiated interpretation de lege lata – based on the text of the GDPR.

Mendoza/Bygrave, pp. 8-9, 10. ↵

Martini, p. 255. ↵

Martini, p. 260. ↵

Kaminski, pp. 4-5. ↵

Wachter, pp. 5-6. ↵

Dreyer/Schulz, p. 18. ↵

Gola, p. 412. ↵

Esser/Kramer/von Lewinski, pp. 266-267. ↵

Tosoni, p. 1 and 25. ↵

Dreyer/Schulz, p. 18. ↵

Ibid. ↵

Ibid. ↵

Recital (4) GDPR ↵

Ibid. ↵

Ibid., Art. 1(3) GDPR. ↵

Dreyer/Schulz, p. 19 ↵

Ibid.: “Automated decision-making systems are thus ‘exceptionally’ permissible if: (a) the decision is necessary for entering into, or for the performance of, a contract between the data subject and a data controller; (b) the automated decision-making decision is authorized by the laws of the controller’s country; or (c) the decision is based on the data subject’s explicit consent. Lastly, in cases of the exceptional permissibility of automated decision-making systems, Art. 22 (3) GDPR makes specific demands.” ↵

Ibid., p. 21. ↵

Ibid. ↵

Ibid. ↵

Ibid. ↵

Ibid., p. 22. ↵

Mendoza/Bygrave, “The Right Not to Be Subject to Automated Decisions Based on Profiling,” (2017). ↵

Bygrave, Minding the Machine, unpaginated: “Article 15(1) does not take the form of a direct prohibition on a particular type of decision-making (profile application)”. ↵

Mendoza/Bygrave, p. 9. ↵

Ibid., p. 10. ↵

Ibid., p. 14. ↵

See e.g. Case T-283/15 - Esso Raffinage v. ECHA [2018] in which the CJEU decided that letter from ECHA - European Chemicals Agency to the French government is a legal act capable of judicial review. In its judgment, the Court decided that the letter was in fact a decision, as despite the title it met all the criteria of such. ECHA’s letter provided an analysis of the new information presented by Esso and conclusions as to why it was, in part, unacceptable. Therefore, the letter constituted a decision under Article 42(1) of Regulation 1907/2006/EC (REACH), which requires ECHA to check the information submitted in response to a decision on non-compliance and issue any new decisions necessary. Therefore, the Court considered that the letter produced binding effects for both Esso and the French Republic and, as a result, was reviewable by the General Court under Article 263 TFEU. ↵

EU Parliament, Counsel & Commission, Joint Practical Guide, p. 45. ↵

See e.g. Helios/Jedlecka, p. 137. ↵

Mendoza/Bygrave, p. 10. ↵

Cf. Chapter 2.1. and 2.2. ↵

Mendoza/Bygrave, p. 10. ↵

Ibid. ↵

Ibid. ↵

Kaminski, p. 4. ↵

Ibid. ↵

Ibid, p. 10. ↵

Ibid, p. 9. ↵

Ibid. ↵

Ibid. ↵

Ibid. ↵

Ibid, pp. 10-15. ↵

For the discussion regarding the A29WP Guidelines cf. Chapter 5.4. ↵

Wachter/Mittelstadt/Floridi, p. 1. ↵

Cf. Chapter 3.2. and Chapter 8. ↵

Wachter/Mittelstadt/Floridi, p. 47. ↵

Ibid, p. 37. ↵

Ibid, p. 39. ↵

Cf. above discussion with Mendoza/Bygrave; see e.g.: Bygrave, Minding the Machine, unpaginated: “Article 15(1) does not take the form of a direct prohibition on a particular type of decision-making (profile application)”. ↵

Cf. Chapter 7.1.1. and Figure 7.1. ↵

See e.g.: Recital (3) and Art. 63 GDPR. ↵

Wachter/Mittelstadt/Floridi, pp. 39-40. ↵

Cf. Chapter 8.3. ↵

Tosoni, p. 1 and 25. ↵

Ibid, pp. 11-25. ↵

Ibid, p. 11: For example, several language versions of Article 22(1) use terms that tend to connote a process whereby a decision would have an effect on a data subject subjected to it. In that vein, the English version refers to a ‘right not to be subject to a decision’; the Italian version mentions a ‘diritto di non essere sottoposto a una decisione’; the Portuguese version uses the terms ‘direito de não ficar sujeito a nenhuma decisão’; the German version refers to ‘das Recht, nicht einer … Entscheidung unterworfen zu werden’ (emphasis added). Other language versions instead use terms, which refer to the data subject merely as the object of the decision: the French version uses the terms ‘droit de ne pas faire l’objet d’une décision’; the Spanish version mentions a ‘derecho a no ser objeto de una decisión’; the Romanian version refers to a ‘dreptul de a nu face obiectul unei decizii’; the Swedish version states ‘rätt att inte bli föremål för ett beslut’ (emphasis added). In principle, these terminological differences are not linguistically equivalent, as saying that a person may not be the object of a decision is not equivalent to saying that a person may not be subjected to a decision—the scope of the former rule is arguably broader than the latter. However, given that a comparative analysis of the different linguistic versions of Art. 22(1) does not show a clear prevalence of a certain terminological choice, the terminological differences identified above are unlikely to have any bearing on the interpretation of Art. 22(1). (cit. per Tosoni, note 57) ↵

Ibid, p. 14. ↵

Ibid, p. 17. ↵

Ibid, pp. 19-23. ↵

Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108), CM(2018)2-final, adopted on 17-18 May 2018. ↵

Explanatory Memorandum to the Proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), COM(2012) 11 final 9, noting that: ‘Article 20 [i.e., the provision which become Article 22 in the final text of the Regulation] concerns the data subject’s right not to be subject to a measure based on profiling. It builds on, with modifications and additional safeguards, Article 15(1) of Directive 95/46 on automated individual decisions, and takes account of the Council of Europe’s recommendation on profiling.’ (cit. per Tosoni, note 27 and 119) ↵

Tosoni, pp. 5-11. ↵

Ibid, p. 24. ↵

Ibid, p. 25. ↵

Esser/Kramer/von Lewinski, pp. 266-267 – own translation from German. ↵

Gola, p. 412 – own translation from German. ↵

See e.g.: Preschal/De Leeuw, pp. 204 and 229. See also Opinion of AG Ruiz-Jarabo Colomer in case C-110/03 Belgium v. Commission, [2005], ECR I-2801, point 44. ↵

Gola, p. 411. ↵

Martini, p. 255 – own translation from German. ↵

Ibid, p. 260 – own translation from German. ↵

Ibid, p. 253. ↵

Cf. ibid, pp. 255-261. ↵

Ibid, pp. 255 and 264-265. ↵

7

Automated individual decision-making, including profiling, and its legal meaning; Art. 22(1) GDPR

Definition of automated individual decision-making

Insignificant disparities of automated decision-making definitions under Art. 15(1) DPD and Art. 22(1) GDPR

Coming in force in 2018, the GDPR introduced a refreshed version of provisions regarding the right not to be subject to an automated decision. Previously in force Art. 15(1) DPD articulated not only automated decision-making but also the definition of profiling. Art. 22(1) GDPR essentially mirrors the provisions of Art. 15(1) DPD. However, indicating the prominent role of regulation Art. 22(1) GDPR grants the right directly and disposes of the profiling definition now specified in Art. 4(4) GDPR, yet emphasizing its particular meaning and differentiating profiling from automated processing.

Fig. 7.1 Comparison of wording of Art. 22(1) GDPR and Art. 15(1) DPD (own graphic)

The above graphical visualization of automated decision-making definitions proves that the basic language and concept have not changed under the provisions of the GDPR. The minor changes like “Member States shall grant [the right] to every person” and “the data subject shall have [the right]” result from the upgrade from the directive, where the Member States were responsible for granting rights, to regulation which grants these rights directly. The use of personal pronouns “concerning him or her,” “affects him or her” in the GDPR’s definition and only “concerning him,” “affects him” in the DPD, indicates only the EU’s more serious approach to gender equality[1] and do not change nor influence the definition itself.

One crucial difference can be found in the added word “similarly,” which narrows down the definition and requires that the decision has either legal effect on the data subject or “similarly” significantly affects the data subject, indicating the important characteristic of the decision. Apart from the above, it is reasonable to observe that from the legal perspective, it is practically the same definition.

Worth noticing at this point is that Art. 15 DPD played a marginal role – the occasions in which it was invoked appear to be remarkably rare;[2] it was not the subject of litigation before the CJEU nor any national courts, except one case in Germany.[3]

A very similar observation regarding Art. 22 GDPR presents the Multi-stakeholder Expert Group, whose members have registered no court actions or no significant increase in the number of court cases.[4]

The right provided by Art. 15(1) DPD was not incorporated in the former ‘Safe Harbour’ agreement between the USA and EU[5] or incorporated in the successor ‘Privacy Shield’ agreement.[6] While it has inspired a proposal for a similar right to be incorporated in a modernized version of the Council of Europe’s 1981 Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data,[7] and also influenced various provisions of the 1997 Code of Practice on Protection of Workers’ Data drafted by the International Labour Office (ILO),[8] it has not been widely replicated in the legal regimes of non-European countries.[9] All this experience suggests that also in the future, controllers may rather tend to deviate from subordination to Art. 22 GDPR to avoid its controversy.

Additionally, several features of Art. 22 GDPR undermine its usability. Its application depends on multiple conditions being satisfied simultaneously: a decision must be made; the decision must have legal or otherwise similarly significant effects on the targeted person; the decision must be based solely on automated data processing or profiling.[10] If one of these conditions is not met, the right defined in Art. 22(1) GDPR will not materialize. For this reason, the right has been aptly characterized as resembling a house of cards.[11] And even if all of the conditions are met, the right is subject to broad derogations laid down in Art. 22(2) GDPR.

Components of Art. 22(1) GDPR explained

To fully understand the definition of the right not to be subject to an automated decision, some clarification of its components is required:

– ‘the data subject’ is defined in Art. 4(1) GDPR and in short, means an “identified or identifiable natural person.” In Art. 22(1) GDPR, the data subject is the solely and directly evoked addressee and recipient of the right;

– ‘shall have the right not to be subject to a decision’ – in this part, the GDPR equips a natural person with the right. The phrase, however, requires a little more perspective as together with Art. 22(2) GDPR accounts for contradictory interpretations. Many see both provisions (Art. 22(1) and (2) GDPR) as a general prohibition of automated decision-making and exception of such.

Nonetheless, in Art. 22(1) GDPR other addressees than the data subject cannot be identified as they are not summoned.

Applying the rule of law, one of the European Union’s main principles and its administrative law in particular, any right or obligation must be precisely and directly textualized. The law cannot leave any doubts about the provision’s addressee and what kind of right or conduct is granted or required. And Art. 22(1) GDPR clearly and undoubtedly refers solely to the data subject and the data subject’s right.

The phrase ‘not to be subject to a decision’ seems to generate significant controversy as it includes a negation. For example, Mendoza and Bygrave claim that “Art. 22(1) is different as a data subject here does not have the right to something but the right not to be subject to a particular type of decision.”[12] However, such distinction is irrelevant as a right to and a right not to remains a right. Whether the right is granted to or not to something does not define the right itself, it defines the purpose and scope of the right, but such purpose and scope do not influence the crux, essence and nature of the right – legal entitlement.

The last part of the phrase ‘not to be subject to a decision’ is also often misunderstood, omitted or presented only in regard to the words ‘based solely on automated processing, including profiling.’ It is, however, essential to emphasize that Art. 22(1) GDPR refers to a decision – a conclusion or resolution reached after consideration and not to the automated form of processing. The last is covered by Art. 21(1) GDPR: “the data subject shall have the right to object (…) to processing (…) including profiling (…)”.

– ‘based solely on automated processing’ – the definition of the right under Art. 22(1) GDPR is valid only if the decision is preceded and based solely on automated processing. The definition of processing can be found in Art. 4(2) GDPR, which stipulates the processing as “any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, (…).” In the case of Art. 22(1) GDPR the definition mentioned above, which says ‘whether or not by automated means,’ is disregarded as the wording ‘automated’ indicates only this form of processing. Thus, solely automated processing shall be understood as processing without any human intervention. That means that automated processing requires the active and sole involvement of software, which algorithms enable the result. The opposite would not fall within the automated decision-making definition.[13]

The use of the word ‘solely’ in Art. 22(1) GDPR is crucial to the practical extent of the right afforded to a data subject. However, if any human involvement is allowed, the literal interpretation excludes such a system from the ambit of Art. 22 GDPR.[14]

The A29WP’s Guidelines provide two interesting statements here. They note that “the controller cannot avoid Art. 22 GDPR provisions by fabricating human involvement. (…) If someone routinely applies automatically generated profiles to individuals without any influence on the result, this would still be a decision based solely on automated processing.”[15]

The above quote implies that when considering if ‘solely’ applies to an automated system, data protection authorities should consider how often the system operator disagrees with the system outputs and changes or otherwise augments them. Looking forward, this would have interesting consequences. If the machine is claimed to outperform humans and treated as such, any human involvement in the process designed to avoid the application of Art. 22 GDPR should necessarily be expected to be effectively nominal. That would mean the system should be regarded as ‘solely’ automated, and where the significance criterion is also met will require a human system to exist in parallel.

The A29WP also adds that “meaningful human input” is required rather than a “token gesture” for the system to be categorized as not ‘solely’ automated. This second perspective focuses on ensuring the human has the “authority and competence” to change the decision.[16]

How will ‘solely’ be assessed? A Data Protection Impact Assessment seems the obvious choice, yet Annex 2 of the A29WP DPIA guidance providing “Criteria for an acceptable DPIA” omits any mention of Art. 22 GDPR rights and obligations.[17]

– ‘including profiling’ – the distinction and highlighting of profiling help to fully cover different scopes of operations that can be performed on personal data. Simultaneously, it does not leave any doubts about whether or not a decision the data subject has the right not to be subject to can be based on profiling. It is also reflected in the title of Art. 22 GDPR – though not legally binding, indicates the importance of such emphasis.

– ‘which produces legal effects concerning him or her or similarly significantly affects him or her’ – the second restraint on user rights over automated decision-making and profiling is whether a decision has legal effects or is ‘similarly significant.’ While legal effects are restricted to cases where legal status is altered or legal duties created, significant effects are much vaguer.[18] Even more so ‘similarly’ significant.

The A29WP suggests that “significant” decisions include those with the potential to significantly influence the circumstances, behavior or choices of the individuals concerned, as well as those that may lead to individuals’ “exclusion or discrimination.”[19] Automated systems generating differential pricing according to the profiled characteristics of a data subject (“price discrimination”[20]) would also be considered significant “if, for example, prohibitively high prices effectively bar someone from certain goods or services.” According to the A29WP, significant effects can be positive or negative.[21] Yet, under Art. 22(1) GDPR, the significance is even more restricted by additional wording ‘similarly’ referring to the decision generating ‘legal effects.’ In this context, price discrimination does not necessarily have to fall under the definition of automated decision-making expressed in Art. 22(1) GDPR. At least not in the initial part of the process understood as an invitation to enter into negotiations or agreement.

An interesting question is whether automated targeting of adverts can be ‘significant.’[22] On the one hand, this is one of the most ubiquitous experiences of ‘solely’ automated profiling. The mismatch of targeted adverts with user expectations is a prime source of distrust of profiling in general.[23] On the other hand, adverts are not binding – they are not even ‘decisions’ and can be easily ignored or blocked, even though they may shape individual experiences. The A29WP takes a middle line, suggesting that adverts targeted on simple demographics such as gender, age or city, do not have a “significant effect” on the recipient. However, according to the A29WP, some adverts may have such a significant effect, depending on the profiling process’s intrusiveness, the individuals’ expectations and wishes, how the advert is delivered, or the particular vulnerabilities of the targeted data subject.[24]

There is a strong consensus that some forms of profiling (e.g., targeting anorexics with emetics or profiling using recorded overheard conversations) utilize unsavory practices. However, whether it makes the decision from Art. 22 GDPR more significant or unpleasant does not matter. By drawing such conclusions, the A29WP’s Guidelines builds on consumer protection principles rather than the underlying text of Art. 22 GDPR.[25]

Whether the effects must be “significant” to individuals or a group, the data subject is a member of, is another issue raised by the Guidelines.[26]

In this context, it is crucial to observe that the term ‘targeted advert’ is a part of the broader term ‘direct marketing,’ which is recognizes by the GDPR as simple ‘processing’ even when including profiling, and not ‘automated decision-making.’ Thus, it is governed by Art. 21 GDPR and its paragraphs (2) and (3) directly and not even mentioned in Art. 22 GDPR. As such, processing does not create a decision defined in Art. 22(1) GDPR.

The A29WP gives confusing signals in this respect. On the one hand, the Guidelines highlight that “processing that might have little impact on individuals may, in fact, have a significant effect on certain groups of society, such as minority groups or vulnerable adults.”[27] Yet, the example they then cite of the vulnerable person in financial difficulties targeted with invites to online gambling re-individualizes the problem again to a person rather than a group. Someone’s identity as a gambling addict is defined primarily by his/her gambling behavior, which is an entirely different notion from someone whose group is defined by membership of a minority. Thus, the Guidelines’ characterization regarding the relation of protected characteristics to “significant” decisions remains unclear.[28] Nonetheless, from the wording of the automated decision-making provisions[29] and the whole text of the GDPR,[30] it is safe to conclude that the data subject as an individual is the sole holder of the right granted by Art. 22(1) GDPR, not a group of such natural persons. It may happen that such ‘significant’ decisions are issued simultaneously to the whole group of people profiled alike. However, such decisions are always individual, and each group member is entitled to exercise his/her right separately, not the group as a whole. Similarly, the provision of Art. 12(2) GDPR is formulated to suggest only individual exercising the data subject rights under Article 15 to 22 GDPR.

Additionally, the reading of Art. 12(6) GDPR, which lacks reference to Art. 22 GDPR (only to the requests referred to in Art. 15 to 21 GDPR) and states that if the controller has reasonable doubt concerning the natural person’s identity and may ask for additional information to confirm the data subject’s identity, suggests that under Art. 22(1) GDPR the controller already knows who the natural person is and to whom the decision is addressed. Another understanding would mean that the controller breaches one of the main principles of the GDPR and reveals to other group members that the data subject is indeed affected by the decision.

Art. 79(1) GDPR alike refers to the data subject’s right to lodge a complaint with a supervisory authority and seek a judicial remedy but again as an individual only – “each data subject.”

The Guidelines assert that the group’s characteristics may lead to bad algorithmic decisions in that significant effects “may also be triggered by the actions of individuals other than the one to which the automated decision relates.”[31] An example is given of how postcodes of economically disenfranchised areas might contribute to low credit scoring for an otherwise creditworthy individual who lives there. There is no reason why such decisions should not fall within Art. 22 GDPR – it is the decision that concerns the data subject that triggers it, even if the data used to make the decision comes partly or wholly from elsewhere. In fact, such “peer-related” factors are the norm rather than the exception in machine learning. These are the cases where transparency and associated opportunities for challenge under Art. 22 GDPR would be of the most effective use.[32]

The passages mentioned above indicate one particular error – the use of the terms ‘processing’ and ‘algorithmic or automated decision-making’ as synonyms and not as separate and independent terms – one defined by Art. 4(2) GDPR and the other by Art. 22(1) GDPR. The first defines ‘processing’, and the second defines the ‘decision’ based solely on automated processing, including profiling, which must have a legal or similarly significant effect. The same as it comes to the data subject’s rights: one introduced by Art. 21 GDPR – ‘the data subject shall have the right to object (…) to processing (…) including profiling (…)’, and the other by Art. 22(1) GDPR – the data subject ‘shall have the right not to be subject to a decision.’ This common misuse of well-defined terms contributes to the general misunderstanding of the automated decision-making provisions, leading to controversial claims contrary to the wording and objectives of the GDPR.

Profiling

Distinguishing profiling in the GDPR

The legislator reasonably decided to distinguish in the GDPR ‘profiling’ as a peculiar form of automated processing and granted it a separate definition. According to Art. 4(4) GDPR ‘profiling’ “means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular, to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.”

The definition consists thus of three essential elements:

the form of processing must be automated;

carried out on personal data; and

the purpose of profiling should concern the evaluation of personal aspects of a natural person.

Profiling refers to both the creation and the use of profiles. By deriving, inferring or predicting information, profiling generates personal and sensitive data[33] itself.

Part of the definition of profiling can be found first in the content of Art. 15 DPD regarding the automated decision-making: “data intended to evaluate certain personal aspects relating to him [natural person], such as his performance at work, creditworthiness, reliability, conduct, etc.”

Recital (30) GDPR gives additional information and specific, real-life examples of identifiers, which can help to build a person’s profile: “natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.”

Risks regarding profiling

Profiling is listed among those types of data processing that present a “risk to the rights and freedoms of natural persons, of varying likelihood and severity”[34] and which has the potential to lead to physical, material or non-material damage. The full array of these types of processing is offered by Recital (75) GDPR, and profiling is not in good company.

By including profiling in the same list as racial discrimination or identity theft, the EU legislator is sending the starkest possible message: the controller should monitor the potential risks of profiling as seriously as any discriminatory or special category personal data.[35]

Through profiling, highly sensitive details can be inferred or predicted from seemingly uninteresting data, leading to detailed and comprehensive profiles that may or may not be accurate or fair. Increasingly, profiles are being used to make or inform consequential decisions, from credit scoring, to hiring, policing and national security. As a result, data about an individual’s behavior can be used to generate a piece of separate information about someone’s likely identity, attributes, behavior, interests, or personality.[36]

Personality traits like extraversion, diligence or neuroticism can be predicted from standard mobile phone data such as call logs and contacts.[37] Publicly accessible data points like tweets or photos can be used to infer people’s location. That, in turn, can be used to estimate someone’s average income based on one’s neighborhood, average housing cost and other demographic information, such as political views.[38] Researchers were able to extract from mobile phone historical data like call logs, contact details or location, and predict the owner’s socioeconomic status.[39] Emotional states, such as confidence, nervousness, sadness, and tiredness, can also be predicted from typing patterns on a computer keyboard.[40]

Furthermore, social network profiles can predict traits such as impulsivity, depression, sensationalist interest, life satisfaction, emotional stability, drug use, sexual orientation, and political views.[41] Such profiles can be based on someone’s predicted vulnerability to persuasion or inferred purchasing power and used to personalize experiences and information exposure.

Profiling poses few closely related risks – generating new or unknown information, profiling is often highly privacy-invasive. It challenges common views about informed consent and raises issues around control, not just over personal data but also one’s identity. Profiles may be inaccurate or otherwise systematically biased. Profiling may also lead to individuals being misidentified, misclassified or misjudged. When profiling is used to inform or feed into a decision that affects individuals, such inaccuracies may result in damage.[42]

The United Nations Human Rights Council shares a very similar view: “automated processing of personal data for individual profiling may lead to discrimination or decisions that have the potential to affect the enjoyment of human rights, including economic, social and cultural rights.”[43] At the same time, the Human Rights Council observes that metadata may provide benefits. However, when aggregated, certain types of metadata can reveal personal information that can be no less sensitive than the actual content of communications giving an insight into an individual’s behavior, social relationships, private preferences and identity.[44] The Human Rights Council also emphasizes that unlawful or arbitrary surveillance or interception of communications and the unlawful or arbitrary collection of personal data are highly intrusive acts. They violate the right to privacy, interfere with other human rights, including the right to freedom of expression and hold opinions without interference, and the right to freedom of peaceful assembly and association, and may contradict the tenets of a democratic society on a mass scale.[45]

The profiling process can be highly opaque when based on advanced processing, such as machine learning. It can be difficult, even for the algorithms’ designers, to understand how an individual has been profiled or why a system has made a particular decision. However, even in the absence of machine learning, profiling can often be dynamic and evolving. In the morning, a data subject can be classified differently than in the evening.[46]

Both profiling and automated decision-making may lead to unfair, discriminatory or biased outcomes. The most apparent harm in this regard is the ability of profiling to create personal insights, which may be used to the detriment of the data subject. For example, without explicitly identifying a data subject’s race, profiling may identify attributes that would nonetheless lead to discriminatory outcomes.[47]

The risks of profiling are visibly one of the EU data protection framework’s central concerns, which led to grant profiling a particular place within the GDPR and the data subject the right to reject automated decisions based on profiling.

Automated form of processing

The definition of processing from Art. 4(2) GDPR emphasizes that an operation or a set of operations can be performed on personal data “whether or not by automated means.” The long list of such operations pointed out in this definition is interesting per se. It indicates diversity and multifariousness of possible activities that can be performed on personal data and an open approach of the legislator, who also foresees other forms of such operations. However, regarding the wording of Art. 22(1) GDPR processing is limited to solely automated means.

Meanwhile, the GDPR in the definition of profiling emphasizes the automated form of personal data processing. And not just solely automated processing but “any form of automated processing,” which can also mean “some” form of automated processing. So, it does not necessarily take human involvement out of the definition. Not taking a stand on whether such an understanding of profiling is correct regarding ‘solely’ automated processing referred to in Art. 22 GDPR, this broader interpretation would supposedly distinguish ‘profiling’ even more and provide an additional protective layer if a controller decides to manually intervene in a profile, later used to make a solely automated decision.

Personal data

In the last few decades, personal data has become a valuable commodity usually obtained for free or modest payments. Personal data are being gathered in exchange for “free” products or services, to participate in a lottery or get a discount. They can be extracted from a personality or IQ quiz, a horoscope or a sports community website. The methods and ideas are endless and some entirely unexpected, even for the gatherer himself.[48] The story of Dr. Bogost and his app shows how easy it was and, to some degree, still is to collect the “basic” data like name, gender and profile picture or even “extended” user information about someone’s location, likes, posts or relationship status. Yet, in most cases, people share their data for free and willingly, mostly via different social media or social network platforms.

However, the personal data are no longer being gathered; they are harvested. “Data harvesting” or “data mining” emerged from scientific information management in the late 90s and soon became a fashionable phrase. The analogy to agriculture and industry is evident. It indicates the large-scale and commercial use of personal data, and as long as people continue to share everything about themselves, the harvest will be fruitful.

The GDPR mentions gathering data as a part of “processing” – “any operation on personal data, including collecting and storing personal data.”[49] In the Recitals, the legislator recognized new challenges for protecting personal data brought by rapid technological developments and globalization, particularly a significant increase in the scale of the collection and sharing of personal data.[50]

The digital economy created a whole new branch – the personal data economy, and the GDPR itself opened up entirely new business opportunities by boosting the security and e-identity sectors.

When looking at the numbers of total internet traffic and its exponential growth emerges the scale of the internet-based economy development: in 1992, global internet networks carried approximately 100 GB of traffic per day, in 2002, it was 100 GB, but per second (GBps), in 2016 it was more than 26’000 GBps, and it is estimated to reach about 106’000 GBps in 2021.[51] The numbers of the internet economy growing share in the global GDP, from 3% in 2011,[52] 6% in 2014[53] to 15,5% in 2016, with estimation to reach 25% soon,[54] show the market’s irruptive expansion. With increased internet traffic, exponentially more personal data is processed in every way possible.

Recital (30) GDPR[55] acknowledges different means by which a natural person may be identified. It presents contemporary possibilities of using pieces of information that are not necessarily personal data per se but combined may result in the creation of such.

To help the data subject regain some control over his/her personal data, Art. 5(1)(a) and Recital (39) GDPR introduce the “principle of transparency” – a rule, which generally speaking declares that any action concerning personal data should be transparent to the data subject, starting with the fact of collecting the data. This particular standard is visible across the regulation and is one of the core principles of the GDPR. In provisions regarding automated individual decision-making even more, to the extent that natural persons have the right not to be subject to such decision.

Bearing in mind that personal data form the basis for potentially damaging profiling, it is essential to identify what they are clearly. Recital (26) and (30) GDPR provides an interesting supplement to Art. 4 GDPR definitions of profiling and personal data. They state that any data that can be used to identify an individual either directly or indirectly (whether on its own or together with other information) is considered personal data.

Evaluating the personal aspects of a natural person

The definition of profiling in Art. 4(4) GDPR focuses its attention on the use of personal data to evaluate personal aspects relating to a natural person. It gives an open list of personal aspects such as performance at work, economic situation, health, personal preferences and interests, reliability, behavior, location, and movement, which uses analysis or prediction methods and algorithms to appraise and assess a natural person. The list is not closed and suggests a large scope of possible aspects that can be personal and related to a natural person. In paragraphs (13) and (14) Art. 4 GDPR defines genetic[56] and biometric data.[57] These are also the personal aspects and attributes that characterize a natural person.

Art. 3(2)(b) and Recital (24) GDPR subordinate any action concerned with monitoring a data subjects’ behavior under the authority of the GDPR as far as their behavior takes place within the Union. As a monitoring, often used in profiling, represents a kind of surveillance of a data subject, it is one of the reasons why profiling is perceived as privacy-intrusive.

Evaluation of the data subject’s personal aspects is one of the forms of processing, especially in the automated individual decision-making context – the automated decision is based mainly on such an individual evaluation. The GDPR recognizes the growing practice and provides tools to safeguard personal data but, most importantly, grants the data subject the right not to be subject to an automated decision, including profiling.

Cf. as example guidelines on ‘Gender-neutral Language in the European Parliament,’ (2018), available at: https://www.europarl.europa.eu/cmsdata/151780/GNL_Guidelines_​EN.pdf. ↵

C.f. Bosco/D’Angelo/Vermeersch, pp. 39, 42. ↵

In 2014, the German Federal Court of Justice (Bundesgerichtshof) handed down an appeal judgment that touches briefly on the scope of the German rules that transpose DPD Art. 15. See also COM (92) 422 final – SYN 287, p. 26: ‘what is prohibited is the strict application by the user [data controller] of the results produced by the system. Data processing may provide an aid to decision-making, but it cannot be the end of the matter; human judgement must have its place. It would be contrary to this principle, for example, for an employer to reject an application from a job-seeker on the sole basis of his results in a computerized psychological evaluation, or to use such assessment software to produce lists giving marks and classing job applicants in order of preference on the sole basis of a test of personality’. See also the judgment of the German Federal Court of Justice in the so-called SCHUFA case concerning the use of automated credit-scoring systems: judgment of 28 January 2014, VI ZR 156/13. Here, the court held, on appeal that the credit-scoring system fell outside the ambit of the German rules that transpose DPD Art. 15. (the relevant provisions are found in §6a of Germany’s Federal Data Protection Act 1990 (Bundesdatenschutzgesetz – Gesetz zum Fortentwicklung der Datenverarbeitung und des Datenschutzes vom 20 Dezember 1990)), as amended) because the automated elements of the decisional process pertained to the preparation of evidence; the actual decision to provide credit was made by a person. In the words of the court: ‘Von einer automatisierten Einzelentscheidung kann im Falle des Scorings nur dann ausgegangen werden, wenn die für die Entscheidung verantwortliche Stelle eine rechtliche Folgen für den Betroffenen nach sich ziehende oder ihn erhebliche beeinträchtigende Entscheidung ausschließlich aufgrund eines Score-Ergebnisses ohne weitere inhaltliche Prüfung trifft, nicht aber, wenn die mittels automatisierter Datenverarbeitung gewonnenen Erkenntnisse lediglich Grundlage für eine von einem Menschen noch zu treffende abschließende Entscheidung sind’: para. 34 (cit. per Mendoza/Bygrave, note 12 and 36). ↵

Multistakeholder Expert Group, p. 11. ↵

Commission Decision 2000/520/EC of 26 July 2000 on the adequacy of the protection provided by the safe harbour privacy principles and related frequently asked questions issued by the US Department of Commerce, OJ L 215/7. The CJEU invalidated the decision in Maximillian Schrems v. Data Protection Commissioner, Case C-362/14, Judgment of 6 October 2015. ↵

Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 on the adequacy of the protection provided by the EU-U.S. Privacy Shield, OJ L 207/1. The CJEU invalidated the decision in Maximillian Schrems v. Data Protection Commissioner, Case C‑311/18, Judgment of 16 July 2020. ↵

See Draft Modernised Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data [ETS 108], drawn up by the Council of Europe’s Ad hoc Committee on Data Protection (version of September 2016). According to Art. 8(1) of the draft, ‘[e]very individual shall have a right: (a) not to be subject to a decision significantly affecting him or her based solely on an automated processing of data without having his or her views taken into consideration; […] (d) to object at any time, on grounds relating to his or her situation, to the processing of personal data concerning him or her unless the controller demonstrates compelling legitimate grounds for the processing which override his or her interests or rights and fundamental freedoms’. See also the Council of Europe’s Guidelines on the Protection of Individuals with Regard to the Processing of Personal Data in the World of Big Data (adopted 23 January 2017; T- PD(2017)01), especially principles: 7.1 ‘The use of Big Data should preserve the autonomy of human intervention in the decision-making process,’ 7.3 ‘Where decisions based on Big Data might affect individual rights significantly or produce legal effects, a human decision-maker should, upon request of the data subject, provide her or him with the reasoning underlying the processing, including the consequences for the data subject of this reasoning’ and 7.4: ‘On the basis of reasonable arguments, the human decision-maker should be allowed the freedom not to rely on the result of the recommendations provided using Big Data’ (cit. per Mendoza/Bygrave, note 17). ↵

See particularly principles: 5.5 ‘Decisions concerning a worker should not be based solely on the automated processing of that worker’s personal data,’ 5.6 ‘Personal data collected by electronic monitoring should not be the only factors in evaluating worker performance,’ 6.10 ‘Polygraphs, truth-verification equipment or any other similar testing procedure should not be used,’ and 6.11 ‘Personality tests or similar testing procedures should be consistent with the provisions of this code, provided that the worker may object to the processing’ (cit. per Mendoza/Bygrave, note 18) ↵

Its replication outside Europe has occurred principally in a handful of African jurisdictions: see Senegal’s Data Protection Act of 2008 s. 48; Angola’s Law No. 22/11 on Data Protection of 2011 Art. 29; Lesotho’s Data Protection Act of 2012 s. 51; and South Africa’s Protection of Personal Information Act of 2013 s. 71. By contrast, the only jurisdiction in the Asia-Pacific region with an equivalent to DPD Art. 15 is the Macao Special Administrative Region: see its Act 8/2005 on Personal Data Protection Art. 13 (cit. per Mendoza/Bygrave, note 19). ↵

Mendoza/Bygrave, pp. 4-5. ↵

Bygrave, Minding the Machine, p. 21; Bygrave, Data protection law, p. 364. ↵

Mendoza/Bygrave, p. 9. ↵

Ibid., cf. p. 11: “An automated process may fall clear of Art. 22 when it remains a decisional support tool for a human being and the latter considers the merits of the results of that process prior to reaching his or her decision, rather than being blindly or automatically steered by the process. At the same time, the fact that a large or even predominant part of the decisional process is automated will not attract the application of Art. 22.” ↵

Veale/Edwards, Clarity, Surprises, and Further Questions, p. 400. ↵

Guidelines, p. 21. ↵

Veale/Edwards, Clarity, Surprises, and Further Questions, p. 401. ↵

Cf. A29WP - DPIA Guidelines. ↵

Veale/Edwards, Clarity, Surprises, and Further Questions, p. 401. ↵

Guidelines, p. 21. ↵

Zuiderveen Borgesius/Poort, p. 348 and following. ↵

Cf. Bygrave, ‘Minding the Machine’, p 17. ↵

Mendoza/Bygrave, p. 12. ↵

For example, refer to the persistent speculation that Facebook “listens” to mobile users through their smartphone microphone and uses this to send ads related to conversations; Facebook denies this, and it indeed seems unlikely it is necessary given the volume of other data and metadata they can draw on: see Kleinman. When it comes to Amazon’s Alexa, however, there is no denial: see Su. ↵

Guidelines, p. 22. ↵

Cf. Helberger, et al., p. 1460. ↵

Guidelines, p. 22; cf. Veale/Edwards, Clarity, Surprises, and Further Quetions, p. 402. ↵

Guidelines, p. 22. ↵

Veale/Edwards, Clarity, Surprises, and Further Questions, p. 402. ↵

Although non-binding, the title of Art. 22 GDPR refers directly to an individual - “Automated individual decision-making, including profiling,” but also the wording of para. (1) decisively refers to a single data subject and legal effects that concern “him or her.” ↵

Cf. e.g., Art. 4(1) GDPR definitions of ‘personal data’ and ‘data subject’ refer only to a natural person as an individual and not a member of any group. ↵

Guidelines, p. 22. ↵

Veale/Edwards, Clarity, Surprises, and Further Questions, p. 402. ↵

Cf. Kaltheuner/Bietti, p. 9. ↵

Recital (75) GDPR. ↵

Rustici, p. 35. ↵

Kaltheuner/Bietti, p. 1. ↵

Cf. de Montjoye, et al., pp. 49-50. ↵

Cf. Liccardi/Abdul-Rahman/Chen., unpaginated. ↵

Cf. Blumenstock/Cadamuro,/On, p. 1073. ↵

Cf. Epp/Lippold/Mandryk, p. 723. ↵

Cf. Youyou/Kosinski/Stillwell, p. 3. ↵

Kaltheuner/Bietti, pp. 8-9. ↵

UN General Assembly, Resolution Adopted by the General Assembly, (22 March 2017), Human Rights Council, A/HRC/34/L.7/Rev.1, p. 3. ↵

Ibid. ↵

Ibid. ↵

Kaltheuner/Bietti, p. 8. ↵

Ibid. ↵

See Bogost. In 2010, Ian Bogost from the Georgia Institute of Technology created a game for the Facebook platform called “Cow Clicker” as a satire and playable theory of social games. The dull game was a hit, played by over 180’000 people. The rules were simple: You got a cow. You could click on it. In six hours, you could click it again. Clicking earned you clicks. You could buy custom premium cows and timer overrides through micropayments. It was the game of clicking, mirroring the famous Facebook ‘like’ button clicking. In those years, Facebook shared the users’ true Facebook IDs, which could be correlated against other information from data collected from Facebook, fashioned by the app, or acquired elsewhere. Nowadays, Facebook generates a unique, app-specific ID for each user to prevent an app from connecting someone directly to Facebook Profiles, and after the scandal with Cambridge Analytica, Facebook restricted access to personal data further. ↵

Art. 4(2) GDPR. ↵

Example: Recital (6) GDPR. ↵

Cisco Annual Internet Report, unpaginated. ↵

Gobry, unpaginated. ↵

Internet Association, unpaginated. ↵

Huawei and Oxford Economics, p. 6. ↵

Recital (30) GDPR: “natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.” ↵

Art. 4(13) GDPR: ‘genetic data’ means personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question. ↵

Art. 4(14) GDPR: ‘biometric data’ means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data. ↵

8

Employing the CJEU canon for interpretation of Art. 22 GDPR

Chapter 3 introduced the four methods of interpretation of EU legal acts employed by the CJEU. The following part performs an analysis of Art. 22 GDPR provisions, utilizing and implementing the CJEU methodology.

Grammatical interpretation of Art. 22 GDPR

The grammatical method rooted in the rulings of the CJEU as a primary means of interpretation leaves no doubt that under Art. 22(1) GDPR a person has a right, a right no different in value than the rights arising from Art. 13 to Art. 21 GDPR.

The provision of Art. 22(1) GDPR is in no way unclear or imprecise about that, nor is Art. 22(2) GDPR enumerating the three situations when “paragraph (1) shall not apply”. The one difficulty Art. 22(1) GDPR may cause, is the use of negation after introducing the right: ‘the right not to be subject.’ Which again, by itself, is not unclear nor imprecise. It is merely the opposite meaning of the verb ‘to be.’

The grammatical understanding of the verb ‘to be’ or its opposite meaning ‘not to be’ signifies no difference between them, simply inverse meaning. The negation of the word ‘right’ is not an ‘obligation’ but ‘no right’ or ‘absence of right.’ The negation of the ‘data subject’ is not ‘controller’ but ‘no data subject’ or ‘absence of data subject.’ It is worth reminding that the GDPR does not introduce any form of opposition between the data subject and the controller; they are not two sides of the same coin. They are merely linked by the definition of ‘personal data’ specified in Art. 4(1) GDPR where one – the data subject – is the main ‘source and cause’ of the personal ‘data existence’ and the other – the controller – “determines the purposes and means of the processing of personal data.”

Under Art. 22(1) GDPR, the data subject has the right not to be subject to a decision based solely on automated processing. The provision is misinterpreted by many as a simultaneous prohibition aimed at the controller to make such a decision. Or an obligation of the controller to refrain from making such a decision. But by the very same logic, what if the data subject had the right ‘to be’ subject to a decision based solely on automated processing? Would it mean that the controller has a legal obligation to make such a decision?

To construe that because the data subject has the right not to be subject to a decision based solely on automated processing simultaneously means that the controller is prohibited from making such a decision is an abuse of logic and grammar and thus unsubstantiated. The right under Art. 22(1) GDPR is not an idiom, which meaning could not be concluded from the standard definition of the words that comprise it, or from the rules of grammar of the language, nor is it a metaphor, where one idea or action would be conveyed by a word or phrase that usually indicates a different idea or action. The terms ‘data subject’ and ‘controller’ are also not antonyms – words, which meaning is opposite of the other word or phrase, but terms defined in Art. 4(1) and (7) GDPR.

From another perspective, with regard to the grammatical method of interpretation, the lack of any indication of a controller and his potential obligations in Art. 22(1) GDPR implicates that the controller is not an addressee of this provision; Art. 22(1) GDPR evokes only conduct of the data subject. In comparison, in Art. 22(3) GDPR only the controller’s conduct is specified, and only in reference to Art. 22(2a) and (2c) GDPR, in which situations only the controller is designated as a party obliged to implement safeguards when the right under Art. 22(1) GDPR is revoked from the data subject. The controller has no additional obligations other than the ones required by Art. 22(3) GDPR. Nor is the controller prohibited from making a decision based solely on automated processing. Without prejudice to Art. 22(4) GDPR, no prohibition is mentioned in any part of Art. 22 GDPR.

Furthermore, the only lawful grounds for processing are enumerated in Art. 6(1) GDPR. It means that a controller is allowed to, as there is no prohibition, to make a decision based solely on automated processing in any situations envisaged by Art. 6(1) GDPR plus, only when Art. 22(2)(a) or (c) GDPR applies the controller is required to provide suitable measures to safeguard the data subject’s rights.

And accordingly, the data subject always has the right not to be subject to a decision based solely on automated processing except in three situations specified in Art. 22(2) GDPR, when the data subject has no such right, yet in two cases (contract and consent), the controller is obliged to ‘support’ the data subject by implementing suitable measures to safeguard the data subject’s rights, somewhat on the data subject’s behalf, as the data subject’s right under Art. 22(1) GDPR is revoked on the grounds of Art. 22(2) GDPR.

However, a lot of authors,[1] as well as authors of the Guidelines,[2] share a somewhat patronizing approach toward the data subjects and demand even broader limitations for both the data subject right not to be subject to automated decision-making and the controller’s freedom to automatize the decision-making processing, all in the name of the data subject’s own good. They ignore the grammatical interpretation of Art. 22 GDPR and force through the false paradigm of the prohibition of automated decision-making. By doing so, they turn upside down the delicate consensus and balance between the protection of personal data and the freedom of conducting business, worked out in a long and arduous political process of enacting the GDPR.

Contextual interpretation of Art. 22 GDPR

The context of Art. 22 GDPR, although recognized by many authors who write on the subject,[3] seems to be underrated, and implementation of the systematic interpretation method is avoided. And yet, in its ruling in Sturgeon and Others, the CJEU acknowledged the necessity to consider not only the wording of legal provisions but also the context in which they occur or are part of.[4]

Placement of Art. 22 in Chapter III of the GDPR – “Rights of the data subject” – that is, among other data subject rights, provides an evident context through which its provisions should also be interpreted.

Negligence of such obvious contextual interpretation – the relation to other rights and provisions plus the wording of Art. 22(1) GDPR – demonstrates the lack of trust in the fundamental and primary methods of legal interpretation. Such disregard consciously looks away from other provisions of the GDPR like Art. 12(2) GDPR, which states that “the controller shall facilitate the exercise of data subject rights under Articles 15 to 22,” or Art. 1(3) GDPR, and from the whole context of personal data protection envisaged in Art. 16(1) TFEU and Art. 8(1) of the Charter.

Based on the premise that the EU legislator is a rational actor, which avoids drafting conflicting or incoherent rules,[5] also Art. 13(2)(f), 14(2)(g) and 15(1)(h) GDPR provide significant context: that data subjects must be informed of ‘the existence of automated decision-making, including profiling, referred to in Article 22(1)’ GDPR. Such an obligation would be considered irrational if automated decision-making would not be allowed under Article 22(1) GDPR, as it would mean an obligation to inform data subjects about an activity that is prohibited by the regulation.[6]

Meanwhile, the context provides essential indications of the purpose Art. 22 GDPR serves – to provide the data subject with the right to refuse subjection to automated decision-making.

Teleological interpretation of Art. 22 GDPR

To predict what the ruling of the CJEU would be if the court decides to use the teleological method of interpretation of Art. 22 GDPR is relatively easy as the CJEU will have to follow the goals and objectives of the GDPR. And they are pretty clear, e.g., “the free movement of personal data (…) shall be neither restricted nor prohibited.”[7]

Applying the teleological method of interpretation, the CJEU construes a provision in the light of its purpose.[8] On many occasions, the CJEU has chosen this method to preclude undesirable consequences,[9] to fill gaps in the system,[10] to prevent the violation of the Member States obligations,[11] or to avoid the collapse of the EU legal system.[12] This approach has had the effect of enhancing the scope and effectiveness of EU law.[13]

Many cases showed the CJEU is following an interpretative sequence. The court looks first at the wording of the provision in question, and secondly, at its context. Where the court construes in a teleological manner, it frequently chooses amongst several possible interpretations. The solution which is least burdensome to economic operators[14] and least far-reaching[15] will commonly be selected, provided that the general objectives of the system can still be achieved.[16]

If, for some reason, the CJEU still finds the provision of Art. 22 GDPR ambiguous after performing first the grammatical than the contextual method of interpretation, it will reach for the teleological interpretation and focus on the goal and purpose of the provision.

The most general goal of Art. 22 GDPR is to provide the data subject with the right to refuse subjection to an automated decision. Notwithstanding, this goal remains in proximity to the goals of the whole regulation, which are stated in Art. 1 GDPR and Recitals from (1) to (13). Art. 1(1) GDPR reads that the regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and their free movement. Art. 1(2) GDPR refers to the fundamental rights and freedoms and, in particular, the right of natural persons to the protection of personal data. And Art. 1(3) GDPR, the most significant in the teleological interpretation of Art. 22 GDPR, directly rules out any attempt to restrict or prohibit the free movement of personal data.[17] Furthermore, this opinion can also be derived from Recital (72), which states that “profiling is subject to the rules of this Regulation.”

Thus, the goal of Art. 22 GDPR cannot be detached from the regulation’s objectives, as the law seems to work only as a whole and not as separated and individual provisions taken out of context and purpose.

In the context of teleological interpretation, Art. 1(3) GDPR can be used as an argumentum a fortiori: if the free movement of personal data shall be neither restricted nor prohibited, also preceding this free movement, collection and processing of personal data shall not be restricted nor prohibited. And regarding Art. 1(1) and (2) GDPR, the regulation only lays down the personal data protection rules. It acknowledges the natural persons right to the protection of their personal data, never mentioning that to achieve that goal, the processing of personal data should be prohibited.[18]

Therefore, as a general rule, the collection, processing and free movement of personal data are not restricted nor prohibited if performed lawfully and according to the regulation.

Additionally, Recital (4) et seq. states some critical issues – “the processing of personal data should be designed to serve mankind” and that “the right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality.”

The first statement indicates a much more lofty goal – processing should serve humankind and not just individuals. The second statement that the right to the protection of personal data is not absolute and should be proportionate and balanced with other fundamental rights and functions in society, together with the first one, indicates the regulation’s real ambition. This ambition, beside the recognition of the right to the protection of personal data, identifies the need to put this right in the context of the personal data purpose in modern societies: economic and social integration, development of the digital economy, need for legal and practical certainty, but also the reality of growing online activity of natural persons, pursuit and right of private companies to fulfill their goals (most often revenues and profits) as well as their inventiveness and ingeniousness to provide new ideas, goods and services for the convenience of natural persons. The initiatory Recitals acknowledge that there are also other rights and principles equal to the right to protection of personal data, e.g., the right to freedom of information or the right to conduct a business.

In an interesting ruling regarding the GDPR in case Conseil d’État v. Google,[19] the CJEU confirmed the recommendations of Recital (4) GDPR entirely.[20] Additionally, the ruling was based on the Opinion of AG Szpunar, who recognized the argument taken from the judgment in Google Spain and Google[21] that “the fundamental rights must be weighed against the information relating to those rights. In that case, the court placed great importance on the weighing of, on the one hand, the right to data protection and privacy and, on the other, the legitimate interest of the public in having access to the information sought.”[22]

In another case, Glawischnig-Piesczek v. Facebook Ireland,[23] AG Szpunar also confirmed that “the protection of private life and of personality rights need not necessarily be ensured in absolute terms but must be weighed against the protection of other fundamental rights.[24] It is thus necessary to avoid excessive measures that would disregard the need to strike a fair balance between the different fundamental rights.”[25] So, regarding the GDPR, the right of a natural person to the protection of personal data is equal to the other fundamental rights and needs to be interpreted in fair balance with them. That indicates that the right provided by Art. 22 GDPR also needs to be balanced with the rights of others – in this case, with the controller’s rights to collect and process personal data in order to implement automation of decision-making.

The teleological interpretation method also helps to understand the purpose of Art. 22 GDPR in the light of explanations presented in Recitals (71) and (72) GDPR, which directly refer to Art. 22 GDPR.

The Recital (71) GDPR echoes Art. 22 GDPR when stating at the very beginning that “the data subject should have the right not to be subject to a [an automated] decision” and when exemplifying attributes of an automated decision, similar to the definition of ‘processing’ and ‘profiling’ from Art. 4 GDPR. The Recital (71) clarifies that “however, decision-making based on such processing, including profiling, should be allowed,” meaning that the data subject’s right not to be subject to an automated decision can be disregarded.

Furthermore, Recital (72) explains that profiling is subordinated to the same legal grounds as data processing and should respect all principles of the GDPR,[26] which only supports the mentioned above interpretation of Art. 1(3) GDPR even more.

To summarize the teleological method of interpretation of Art. 22 GDPR, its intent requires emphasis – Art. 22 GDPR:

enacts the right for the data subject [Art. 22(1) GDPR],

defines the automated decision as a pivotal point of the whole Art. 22 GDPR,

defines the automated processing [Art. 22(1) GDPR],

specifies situations when the right shall not apply [Art. 22(2) GDPR],

establishes a responsible entity (a controller) to implement suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests when the right of the data subject under Art. 22(1) GDPR cannot be exercised [Art. 22(3) GDPR with regard to Art. 22(2a) and (2b)] GDPR,

defines the minimum safeguards when the right of the data subject under Art. 22(1) GDPR cannot be exercised [Art. 22(3) GDPR],

additionally, it protects the data subject from an automated decision, which is made when the right of the data subject under Art. 22(1) GDPR cannot be exercised based on cases of application of Art. 22(2) GDPR and if the decision is based on special categories of personal data [Art. 22(4) GDPR with regard to Art. 22(2) GDPR and in relation to Art. 9(1) GDPR with regard to Art. 9(2)(a) and (2)(g) GDPR].

As demonstrated above, such a broader understanding of the GDPR is substantiated by the regulation’s provisions and Recitals. The narrower interpretation, so overall seeing the objectives of the GDPR, and Art. 22 in particular, as merely a general prohibition of personal data processing as the best way of protecting the data subject, would be untrue and contradictory to the provisions of the GDPR.

To justify and argue that Art. 22(1) GDPR does not constitute data subject right, but a prohibition aimed at the controller to prevent the controller from making a decision based solely on automated processing would require a lot of effort. An effort, which would stand against the CJEU’s interpretation principles – to seek effectiveness and validity of the provision and rejection of interpretation, leading to its annulment.

The above mentioned, for the most part, teleological rulings of the CJEU in case Conseil d’État v. Google and in case Glawischnig-Piesczek v. Facebook Ireland, offer thus a logical presumption that the CJEU’s probable future judgment on the automated decision-making, based on grammatical, contextual and teleological interpretation, and its jurisprudence, would instead reject opinions about the prohibitive nature of Art. 22 GDPR and confirm that Art. 22(1) constitutes the right of the data subject.

Historical interpretation of Art. 22 GDPR

For the historical context of the adoption of the GDPR, and Art. 22 therein, the Recitals (9) and (10) GDPR should be the primary source: “although the objectives and principles of the DPD are recognized and remain sound, the differences in the level of protection of the rights and freedoms of natural persons in the Member States, require more consistency. […] Consistent and homogenous application of the rules for the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data should be ensured throughout the Union.” Thus, it has to be emphasized that the legislator followed the rhetoric of the DPD and its Art. 15.

The travaux préparatoires to the GDPR provide little explanation of the rationale for the automated decision-making provisions. Nonetheless, as discussed in Chapter 2.3., it is safe to assume that the motivation is partly rooted in the concerns that gave rise to Art. 15 DPD.[27]

While the final wording of Art. 22 GDPR does not exactly mirror any one of the proposals from the Commission, Parliament, or the Council, all of the proposals targeted profiling, along with automated decisions. The Parliament’s Committee on Civil Liberties, Justice and Home Affairs went the furthest here in that it wanted to give individuals a right to object to all profiling and not just particular types of decisions that might arise from profiling.[28] Yet, all three institutions believed that some decisions based on profiling should be subject to relatively stringent regulation, namely the decisions based on sensitive data specified in Art. 9 GDPR.[29]

The historical approach can be convenient if there is a need to compare presently binding provisions with those preceding them. Comparing the provisions of Art. 22 GDPR with Art. 15 DPD repealed by the GDPR, regarding the alleged prohibitive nature of the first, one more thing is worth noting: paragraph (2) of Art. 15 DPD specified that:

“Subject to the other Articles of this Directive, Member States shall provide that a person may be subjected to a decision of the kind referred to in paragraph (1) if that decision:

(a) is taken in the course of the entering into or performance of a contract, provided the request for the entering into or the performance of the contract, lodged by the data subject, has been satisfied or that there are suitable measures to safeguard his legitimate interests, such as arrangements allowing him to put his point of view; or

(b) is authorized by a law which also lays down measures to safeguard the data subject’s legitimate interests.”

In other words, the DPD laid down the legal grounds for enforcing the data subject to fall under the decision – “a person may be subjected to a decision” – in case a decision is taken in the course of entering into or performance of a contract and if a law authorizes a decision. In the context of automated decision-making, Art. 22(2) GDPR corresponds with Art. 15(2) DPD. And although Art. 15(2) DPD reads that “a person may be subjected to a decision if that decision” and Art. 22(2) GDPR states that “paragraph (1) shall not apply if the decision” both these phrases mean the same:

in the case of the DPD, the wording “a person may be subjected to a decision” aims to allow situations when the person who has the right referred to in paragraph Art. 15(1) DPD can be deprived of this right and forced to be subjected to a decision; and

in the case of the GDPR, the wording “paragraph (1) shall not apply” clearly deprives of the right not to be subject to a decision referred to in paragraph (1) of Art. 22 GDPR in mostly the same situations as Art. 15(2) DPD plus a new one: if the decision is based on explicit consent. The GDPR does not state separately that a data subject “may be subjected to a decision.” However, the phrase “paragraph (1) shall not apply” means that in cases specified in Art. 22(2) GDPR, there is no right of the data subject not to be subject to a decision – there is nothing to refer to as there is no right. If there is no right, there is no need to additionally stipulate that the data subject may be subjected to a decision while it is evident that there is no legal ground for the data subject to refuse to be subjected to such decision.

When it comes to discourse among scholars, commentary authors[30] and the A29WP Guidelines[31] regarding the understanding of automated decision-making provisions, the historical method of interpretation helps clarify the present legislation through the past perception of preceding provisions. The historical interpretation aids in finding arguments that Art. 22 GDPR signifies a right to object to automated decisions and not a prohibition of automated decision-making as many see it.

Cf. Chapter 6. ↵

Cf. Chapter 5.4. ↵

See e.g. Mendoza/Bygrave, p. 9. ↵

Joined Cases C-402/07 and C-432/07 Sturgeon and Others and Böck v. Air France [2009] ECR I-10923, para. 41. See, inter alia, also Case C-156/98 Germany v. Commission [2000] ECR I-6857, para. 50, and Case C-306/05 SGAE [2006] ECR I-11519, para. 34. ↵

Lenaerts/Gutiérrez-Fons, ‘To Say What the Law of the EU Is,’ pp. 13-14. ↵

Cf. Tosoni, p. 17. ↵

Art. 1(3) GDPR. ↵

The common law tradition only reluctantly accepts this method of interpretation, mainly because it is viewed as dangerous and undemocratic. See e.g.: Herman, pp. 10 and 170; UK Court of Appeal, Magor and St.Mellors v. Newport Corporation [1950], at 841. ↵

See Case 43/75 Defrenne v. Sabena [1976] ECR 455. ↵

See amongst others, Joined Cases 56 and 58/64 Consten and Grundig v. Commission [1966] ECR 299; Case 78/70 Deustche Gramophon v. Metro [1971] ECR 487 and Case 15/74 Centrafarm v. Sterling Drug [1974] ECR 1147; Case C–302/87 Parliament v. Council [1988] ECR 5615 and Case C–70/88 Parliament v. Council [1990] ECR I–204. ↵

See amongst others, Case 41/74 Van Duyn v. Home Office [1974] ECR 1337; Case 148/78 Pubblico Ministero v. Ratti [1979] ECR 1629 and Case 152/84 Marshall v. Southampton and South West Area Health Authority [1986] ECR 723; Joined Cases C–6/90 and C–9/90 Francovich and Bonifaci v. Italy [1991] ECR I–5357 and Cases C–46/93 and C–48/93 Brasserie du Pêcheur v. Germany and The Queen v. HM Treasury, ex parte Factortame [1996] ECR I–1029, amongst others. ↵

See Case 26/62 Van Gend en Loos v. Nederlandse Administratie der Belastingen [1963] ECR 1; Case 6/64 Costa v. ENEL [1964] ECR 585; Case 314/85 Foto-Frost v. Hza Lübeck-Ost [1987] ECR 4199. ↵

Llorens, p. 382. ↵

See Case 27/72 Aimer v. Einfuhr-und Vorratsstelle Getreide [1972] ECR 1091. ↵

See the judgment of the Court in Case 31/70 Getreide-und Futtermittel Handelsgesellschaft v. Hza Hamburg-Altona [1970] ECR 1055 and compare with the opinion of the Advocate General at 1072. ↵

Llorens, p. 394; see also Case 6/77 Schouten v. Hoofdprodukstchap voor Akkerbouwprodkten [1977] ECR 1291. ↵

Art. 1(3) GDPR: “The free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.” ↵

Without prejudice to Art. 9(1) GDPR, which directly prohibits the processing of special categories of personal data, yet with many exceptions. ↵

Case C‑507/17, Conseil d’État v. Google. ↵

Ibid., para. 60: “The right to the protection of personal data is not an absolute right, but must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality.” ↵

Case C‑131/12, Google Spain and Google. ↵

Opinion of AG Szpunar to Case C‑507/17, Conseil d’État v. Google, para. 58. ↵

Case C-18/18 Glawischnig-Piesczek v. Facebook Ireland Limited. ↵

See, by analogy, as regards the balance to be struck between intellectual property law and the right to respect for private and family life, guaranteed in Article 7 of the Charter, the judgment of 18 October 2018, Bastei Lübbe (C-149/17, EU:C:2018:841, paragraphs 44 to 47). See also opinion of AG Szpunar in Bastei Lübbe (C-149/17, EU:C:2018:400, points 37 to 39). ↵

See Opinion of AG Szpunar in Case C-18/18, Glawischnig-Piesczek v. Facebook Ireland Limited, para. 102. See also to that effect regarding the protection of intellectual property, the judgment of 27 March 2014, UPC Telekabel Wien (C-314/12, EU:C:2014:192, paragraphs 58 to 63). See also Opinion of AG Villalón in UPC Telekabel Wien (C-314/12, EU:C:2013:781, points 99 to 101), and also Opinion of AG Szpunar in Stichting Brein (C-610/15, EU:C:2017:99, points 69 to 72). ↵

Recital (72) GDPR: “Profiling is subject to the rules of this Regulation governing the processing of personal data, such as the legal grounds for processing or data protection principles.” ↵

Mendoza/Bygrav, p. 6. Cf. also Chapter 2.3. ↵

European Parliament (2013) Report on the proposal for a regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (GDPR) (COM(2012)0011 – C7-0025/2012 – 2012/0011(COD))(A7- 0402/2013; PE501.927v05-00), p. 93 (outlining proposed Art. 20(1) GDPR). However, two other committees in the Parliament, namely the Committee on Internal Market and Consumer Protection (IMCO) and the Committee on Industry, Research and Energy (ITRE), were more friendly to profiling than the Committee on Civil Liberties, Justice and Home Affairs (which had the lead role in negotiating the GDPR). See further European Parliament (2013), p. 308, 309, 471, 472 (cit. per Mendoza/Bygrave, note 28). ↵

Mendoza/Bygrave, p. 8. ↵

Cf. Chapter 6.2. ↵

Cf. Chapter 5.4. See also Guidelines, p. 12: “Explicit consent is one of the exceptions from the prohibition on automated decision-making and profiling defined in Art. 22(1)”; p. 23: “The term ‘right’ in the provision does not mean that Art. 22 GDPR(1) applies only when actively invoked by the data subject. Art. 22 GDPR(1) establishes a general prohibition for decision-making based solely on automated processing. This prohibition applies whether or not the data subject takes an action regarding the processing of their personal data.”, at 19; “Art. 22 GDPR(1) sets out a general prohibition on solely automated individual decision-making with legal or similarly significant effects, as described above.” ↵

9

Provisions influencing automated individual decision-making

The decision – a focal point of derogation under Art. 22(2); the GDPR principles perspective

As paragraph (1) of Art. 22 GDPR grants the data subject the right not to be subject to a decision based solely on automated processing, including profiling, paragraph (2) limits the application of this right by stating straightforwardly that “paragraph (1) shall not apply if the decision:” after which it enumerates three situations when such derogation takes place.

A fundamental issue, not only in reference to Art. 22(2) GDPR but to the entire Art. 22, is to recognize that the accent is on the ‘decision’ based on automated processing, including profiling and not on automated processing itself. This recognition is vital to understand whether to apply Art. 22 or Art. 21 GDPR.

Bearing that in mind, the derogative character of Art. 22(2) GDPR can materialize only when the decision:

is necessary for entering into, or performance of, a contract between the data subject and a controller;

is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or

is based on the data subject’s explicit consent.

One of these conditions has to occur to trigger the application of Art. 22(2) GDPR, which simultaneously deprives the data subject of the right granted under Art. 22(1) GDPR and detaches the data subject from the possibility to exercise that right.

Why these particular situations? Two of them are circumstances when the data subject has agreed to an automated decision either directly – by explicitly consenting to such decision (Art. 22(2)(c) GDPR) or indirectly – to be able to enter into or perform a contract (Art. 22(2)(a) GDPR). It is based on a reasonable presumption that the data subject knows what he/she is doing when consenting one way or another to a decision based solely on automated processing. Leaving the data subject a possibility to exercise the right not to be subject to an automated decision while at the same time the data subject consented to such decision would leave the controller in limbo and paralyze the controller’s decision-making process; a process that the parties agreed to for convenience of them both.

The third condition is based on the provision of law that allows or obliges the controller to make an automated decision – the decision has to be authorized by EU or Member State law (Art. 22(2)(b) GDPR). Unlike in Art. 22(3) GDPR, here the law that authorizes the automated decision itself is intended to provide the safeguards.

As the focus of the GDPR lies on data protection as stipulated in Art. 16(1) TFEU and Art. 8 of the Charter, it would be too much to expect the regulation to protect other rights and values. In some instances, these other rights and values can protect interests that even run counter to data protection, like freedom of information, as an example.[1] And yet, the GDPR itself sees the potential conflict and via its Recitals (1) to (13), with Recital (4) in particular, suggests the data protection rights are not better than other fundamental rights. The CJEU recognized the need to find a balance between all the fundamental rights in the Google[2] and Facebook[3] cases.

This acknowledgment is probably the essential aspect of the contemporary data protection law of the EU – it does not foresee the protection of a natural person in relation to the processing of personal data as a prohibition of processing of personal data, or automated decision making, or even processing of special categories of personal data (although generally prohibited by Art. 9(1) GDPR in many cases allowed by Art. 9(2) GDPR). In this regard, the GDPR’s primary goal is to establish healthy rules for personal data processing, so the processing is performed in a civilized manner. The Recital’s (4) first sentences are very particular in this sense: “the processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right.”

In this context, it is apparent that the GDPR envisages situations when the right not to be subject to an automated decision can be denied to a data subject. It also confirms that there are rights of others and circumstances that justify such limitations and that the whole regulation is meant to protect the personal data of natural persons but not always the natural persons themselves.

The legislator aimed instead to grant protection against the adverse effects of decisions based on automated data processing. This shift of the focus of protection from data processing to decision-making consequences is noteworthy because the classical regulatory tools of data protection are utilized to achieve different results. Interestingly enough, this change of paradigm lacks so far any systematic examination. Too often, the two terms – automated processing and automated decision-making – are used interchangeably. In the context of data protection goals, understanding the distinction between automated processing and the decision itself is vital.

Fig. 9.1 below visualizes the relation between four paragraphs of Art. 22 GDPR: paragraph (1) defining the right not to be subject to automated decision-making, paragraph (2) enumerating situations that derogate the right specified in paragraph (1), and paragraphs (3) and (4) triggered only in case of application of paragraph (2). Additionally, the graphical illustration helps to recognize that the focal point in Art. 22 GDPR is on automated decision and not on processing – a significant difference that confuses many.

Fig. 9.1 Internal structure of Art. 22 GDPR (own graphic)

Lawfulness of processing; relation between Art. 6(1) and Art. 22(2) GDPR

Principle of lawfulness

To fully understand the relationship between the legal grounds for processing established in Art. 6(1) GDPR and the role of Art. 22(2) GDPR, it is essential to present first one of the basic principles of the GDPR – the principle of lawfulness.

The principle specified in Art. 5(1)(a) GDPR, supported by Recital (39) GDPR, determines the requirement of legitimate grounds and purpose for the processing.

As defined in detail in Art. 6 GDPR, the lawfulness of processing requires that any processing must be based on one of six specified conditions.

No single basis is better than others, and there is no hierarchy among them. However, selecting a lawful ground needs to be done with care, as different bases give rise to different rights under the GDPR. The controller must determine the lawful basis before processing starts and document it. This step is essential, as it will be difficult to swap between different grounds at a later point and doing so may involve a breach of the GDPR.[4]

The EDPB, in its guidelines,[5] recognizes that “identifying the appropriate legal basis is of essential importance. Controllers must take into account the impact on data subjects’ rights when identifying the appropriate lawful basis so as to fully respect the principle of fairness.”[6]

The literal meaning of Art. 6 GDPR reveals that except for its point (a) (consent), all other legal grounds require processing to be ‘necessary.’ To assess the notion of necessity, the controller has to clarify whether the same purpose can be reasonably achieved without such processing or by a less intrusive means and has to ensure proportionality between the processing and the purpose.[7]

Although consent may seem to be the only legal ground that does not require necessity, Art. 5(1)(c) GDPR and its principle of data minimization demand that personal data are “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.”[8]

Additionally supported by Recital (40) GDPR, the above shows that the concept of necessity is pivotal in Art. 6 GDPR and constitutes a requirement for lawful personal data processing.

Relation between Art. 6(1) and Art. 22(2) GDPR

Art. 22(2) GDPR provides three conditions which only with regard to the decision defined in Art. 22(1) can derogate paragraph (1). These three conditions bear resemblance yet do not correspond with three of six legitimate grounds for processing specified in Art. 6(1) GDPR:

Fig. 9.2 Relation between Art. 6(1) and Art. 22(2) GDPR (own graphic)

It is essential to point out the differences in wording and meaning of those two articles. These differences between parallel provisions arise from different reference points: Art. 6(1) GDPR refers to the processing and gives the legal grounds for processing and Art. 22(2) GDPR refers exclusively to a decision based on automated processing and gives legal grounds for derogation of the right under Art. 22(1) GDPR but only with regard to this decision.

In a closer look, the differences are even more evident:

Art. 6(1)(a): Processing shall be lawful only if and to the extent that at least one of the following applies: the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
Art. 22(2)(c): Paragraph 1 shall not apply if the decision is based on the data subject’s explicit consent.
Art. 6(1)(a) GDPR in its common part establishes legal grounds for lawful processing, a provision directed to whoever performs the processing (in case of the GDPR a controller or data processor), which means that the processing can be performed only (“if and to the extent”) when one of six basis applies, in this case when the data subject consents to the processing of his/her personal data. Additionally, the processing can be performed only for at least one specific purpose.
Art. 22(2)(c) GDPR in its common part derogates the paragraph (1) but under one of three conditions and in this case only if the data subject agreed first to a decision defined in Art. 22(1) GDPR and only if such consent is explicit, which means not only standard consent defined in Art. 4(11) GDPR and in Art. 7 GDPR but consent that is separately, unambiguously and specifically given for such decision and is not alleged from consent for other forms of processing.

Art. 6(1)(b): Processing shall be lawful only if and to the extent that at least one of the following applies: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
Art. 22(2)(a): Paragraph 1 shall not apply if the decision is necessary for entering into, or performance of, a contract between the data subject and a controller.
Art. 6(1)(b) GDPR gives a legal basis for processing if such processing is necessary for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract.
Art. 22(2)(a) GDPR in this case derogates paragraph (1) but requires the necessity of a decision, not processing, and only for entering or performing a contract, and not for proceedings prior to entering into a contract.

Art. 6(1)(c): Processing shall be lawful only if and to the extent that at least one of the following applies: processing is necessary for compliance with a legal obligation to which the controller is subject.
Art. 22(2)(b): Paragraph 1 shall not apply if the decision is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests.
Art. 6(1)(c) GDPR gives a legal basis for processing if such processing is necessary to fulfill the controller’s responsibility arising from a legal obligation.
Art. 22(2)(a) GDPR in this case for derogation of paragraph (1) requires that the decision is authorized, has a mandate based on Union or Member State law, which dictates the controller’s conduct to make a decision based on automated processing. Additionally, it requires that such law also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests.

It is thus apparent that Art. 6(1) GDPR and Art. 22(2) GDPR govern two different matters: the first provides legal grounds for lawful processing of personal data, and the second enumerates situations when the right granted by Art. 22(1) GDPR is derogated.

In a closer look at the structure of the GDPR, it is evident that the different legal grounds trigger different possibilities of conduct both of the data subject and of the controller, or even different rights, like in the case of the right to data portability – Art. 20 GDPR or Art. 18 GDPR. The last one grants the data subject the right to obtain from the controller restrictions of processing when the data subject has objected to processing pursuant to Article 21(1) GDPR pending the verification of whether the controller’s legitimate grounds override those of the data subject. This example also indicates the goal of the GDPR to weigh the legitimate grounds of the controllers and the data subjects alike. The GDPR draws attention here to the fact that as the controller’s conduct is clearly demanded, the conduct of the data subject is also restricted and conditioned.

In the case of the right to erasure (‘right to be forgotten’), defined in Art. 17(1) GDPR, the occurrence of one of the grounds enumerated there is required to allow the data subject to exercise the right.

In all the cases mentioned above, the GDPR demands some amount of effort also from the data subject. The GDPR expects active participation of the data subject to trigger his/her rights and requires that such execution is based only on limited legal grounds. If not, the controller has no obligation to respect the data subject’s particular right. It is consistent with Art. 12(2) GDPR, which requires from the controller to ‘only’ facilitate the exercise of data subject rights. Whether the data subject exercises his/her rights is thus up to the data subject.

The example of the right to be forgotten shows similarities to the provisions of Art. 22 paragraph (1) and (2) GDPR, although in a rather opposite manner. In case of the right to be forgotten, Art. 17(1) GDPR not only defines the right but simultaneously enumerates legal grounds when the data subject can exercise the right. In the case of automated individual decision-making, the provision of Art. 22(1) defines the right, yet Art. 22(2) derogates the right and enumerates legal grounds for such derogation. In both these articles, some of the legal grounds show similarities to the legal grounds for processing: Art. 22(2) (c), (a) and (b) GDPR look similar to Art. 6(1) (a), (b) and (c) GDPR respectively and Art. 17(1) (b) and (e) GDPR to Art. 6(1) (a) and (c) GDPR respectively.

Yet, the resemblance is only accidental and is visible in other rights established in Chapter III of the GDPR as well. However, separate legal grounds for triggering these rights by the data subject can also be recognized.

In case of the right to be forgotten, Art. 17(1) GDPR presents only two similar to the legal basis for processing legal grounds that trigger the exercising of that right. The other four are different.

The same approach is visible in Art. 18 GDPR – the right to restriction of processing, in Art. 20 GDPR – the right to data portability, in Art. 21 GDPR – the right to object and Art. 22 GDPR – automated individual decision-making, including profiling. While establishing the rights, all those articles also specify the legal basis for claiming the rights or present situations when exercising the right is not permitted.

The teleological interpretation, backed by the grammatical, historical and contextual understanding, provides a vital observation: the provisions of Art. 6 GDPR are the only legal grounds in the whole GDPR for processing related to a decision based solely on automated processing, including profiling and Art. 22(2) GDPR provides the legal grounds but for derogation of the right granted under Art. 22(1) GDPR.

Some authors try to twist the provisions of Art. 22(2) GDPR and claim that instead of being the legal basis for derogating the right defined in Art. 22(1) GDPR, Art. 22(2) GDPR constitutes legal grounds for automated decision-making. However, such understating is unjustified and based on a false presumption that because the GDPR says nothing about permitting automated decision-making, it must mean that it prohibits such decisions. Such views contradict the GDPR’s goals and objectives and would be justified only if the wording of Art. 22(2) GDPR did not refer to paragraph (1) but focus only on the decision. In such a case, however, the wording of Art. 22(2) GDPR would have to be different, for example: “the decision defined in paragraph (1) shall be allowed only if one of the following applies,” so similarly to formerly in force Art. 15(2) DPD.[9]

However, the GDPR neither permits nor prohibits automated decision-making; it does something different – allows the controller to follow the general legal principle quod lege non prohibitum, licitum est,[10] backed by Art. 52 of the Charter,[11] and grants the data subject the right not to be subject to a decision based solely on automated processing, including profiling.

Although Art. 6(1) GDPR provides an exact list of the lawful legal grounds for processing directed to whoever performs processing, the fact that the GDPR lays down rules of conduct also for the data subject is often omitted or forgotten. It is thus vital to understand the different roles Art. 6(1) and Art. 22(2) play within the GDPR.

Fig. 9.3 Decision tree on the scope of application of Art. 22(1) GDPR, source: own graphic based on Dreyer/Schulz, p. 20.

Fig. 9.3 above presents the decision tree of the application of Art. 22(1) GDPR. However, unlike in Dreyer’s diagram introduced in Chapter 6.2., exhibiting the authors’ conclusion that Art. 22(2) GDPR provides legal grounds for automated decision-making, which in their opinion means simultaneously a general prohibition of automated decision-making, the above visualization presents the meaning of paragraph (2) based on a grammatical and teleological interpretation. The above diagram helps to clarify that Art. 22(2) GDPR provides legal grounds only for derogation of the right defined and granted in Art. 22(1) GDPR and that the general legal basis for processing defined in Art. 6(1) GDPR, apply in full also in case of Art. 22 GDPR.

Minimum requirements to safeguard personal data – Art. 22(3) GDPR

Regarding the automated decision-making provisions, the GDPR in Art. 22(3) requires the controller to safeguard the data subject’s personal data. However, application of Art. 22(3) GDPR is possible only in two situations envisaged in Art. 22(2) GDPR. Its use is thus limited to the two following circumstances:

Art. 22(2)(a) GDPR – if the decision is necessary for entering into, or performance of, a contract between the data subject and a controller; or

Art. 22(2)(c) GDPR – if the decision is based on the data subject’s explicit consent.

The occurrence of one of these situations determines two things: first, it repeals the right of the data subject granted by Art. 22(1) GDPR, and second, imposes additional obligations on the controller to safeguard data subject’s rights, freedoms, and legitimate interests.

The data subject’s rights usually correspond with a duty on the side of the controller.[12] However, the conduct of both these parties has to be established beforehand. What duties must be met or what rights are granted should be introduced clearly, explicitly and beyond doubt. Doing otherwise would conflict with the fair trial principle guaranteed by Art. 47 of the Charter and the rule of law. Moreover, a particular emphasis is put on the precision of administrative procedure provisions.[13]

The Art. 22(3) GDPR meets the requirements – the controller of an automated decision-making system is summoned directly, and expectations regarding his conduct precisely stated – the controller is obliged to adopt appropriate measures “to safeguard the data subject’s rights and freedoms and legitimate interests.” Additionally, it presents methods the controller is obliged to implement in order to fulfill its obligations. The shortlist represents only the minimum requirements and includes the right of the data subject to obtain human intervention on the part of the controller, the right to explain his or her view, and the right to contest the decision. All three measures equip the data subject with tools that aim to refocus the controller’s attention to the decision and possibly alter it. However, these measures do not challenge the lawfulness or binding effect of the decision. They are rather means of appeal that require a reevaluation of all aspects of the case forcing the controller to approach the data subject in a non-automated manner.

The answer to the question of why should data subjects have an unrestricted right to contest decisions based on automated processing is more or less the same as the general reasons for the accommodation of automated decision-making provisions into data protection laws: to uphold human dignity by ensuring that humans (and not their ‘data shadows’) maintain the primary role in ‘constituting’ themselves[14] and are very anthropocentric in this matter.[15]

But such an answer leads to a follow-up question: how can automated decision-making diminish human dignity? Some authors[16] responded by claiming aspects of human personality that are incomputable, not merely due to inadequate modeling but rather as a necessary consequence of the human condition. Since computer models — and, therefore, intelligent systems as currently understood – cannot, by definition, process those incomputable aspects, any decision made by them would necessarily be based on an incomplete portrait of the natural persons affected by the outputs of the processing algorithm. Thus, a right to contest algorithmic decisions enables humans to retain control over the ways their lives are presented and shaped by those algorithms.

Such a reading can be validated through a broad interpretation of the GDPR[17] and seen in the light of the more general commitments to human rights and human dignity the data protection laws aim to preserve.[18]

Looking at previous drafts of the GDPR and commentary from the trilogue negotiations,[19] the legislators had stricter safeguards in mind, but these were eventually dropped, including a legally binding right to an explanation of specific decisions.[20] The reminiscence of this is still visible in the GDPR’s Recitals.

Recital (71) additionally to the safeguards from Art. 22(3) GDPR suggests the right to obtain information regarding automated decision-making. This right, not included in the body of Art. 22 GDPR, is comprised by Art. 15(1)(h) GDPR, which requires the controller to provide the data subject with meaningful information about the logic involved in the automated decision-making and the significance and envisaged consequences of such processing for the data subject.

Not present in Art. 22(3) GDPR but mentioned in Recital (71) GDPR remark regarding safeguards, refers to an underage data subject: “such measure should not concern a child.” To what exactly Recital (71) GDPR pertains to is not clear. However, explained by Recital (38) GDPR and based on Art. 8, the GDPR finds the processing of the personal data of a child lawful where the child is at least 16 years old or, in the case of even younger kids, when the consent for processing is authorized by the holder of parental responsibility for the child. Art. 8 GDPR refers mostly to the child’s consent but in its paragraph (3) also to contracts, leaving the matter to “the general contract law of the Member States such as the rule on the validity, formation or effects of a contract in relation to a child.”

Recital (71) GDPR also suggests that the suitable safeguards should include specific information to the data subject, but this proposition is carried out by the controller’s obligations governed by Art. 13 and 14 GDPR and data subject’s rights based on Art. 15 GDPR.

Recital (71) points out other dangers related to automated decisions based on profiling, in particular at “factors which result in inaccuracies in personal data.” Solving such problems, the controller should consider the rights and freedoms and legitimate interests of the data subject but also the controller’s vital interest in processing only correct and accurate personal and other data. At this point, Recital (71) addresses the very interesting goal of the GDPR expressed in Recital (4), that personal data processing should be designed to serve mankind. In other words, the GDPR recognizes that the processing of personal data may be used for the common good and be beneficial not only for controllers but also for data subjects.

Art. 22(3) GDPR stresses the importance of safeguarding the data subject’s rights, freedoms and legitimate interests and in this context of building trust between the controller and data subject; to not discourage the latter from sharing his/her personal data. Simultaneously, making the controller responsible for the vital interests the data subject has but is unable to protect due to derogation of his/her right based on Art. 22(2), the GDPR enforces reliance between them and expects the controller to be mindful about and accountable for the data subjects’ rights, freedoms and legitimate interests. But it is important to note that the GDPR builds this reliance only when the relationship between the controller and the data subject is already established, either by entering into or performing a contract or by the data subject’s explicit consent. Thus, only when the basic trust is already there.

The right to human intervention

The right to human intervention as one of the measures established in Art. 22(3) GDPR to safeguard the data subject’s “rights and freedoms and legitimate interests” stands out compared to the other two. It requires the controller to step in and provide human assistance in reviewing the decision.

The right to human intervention means that the data subject can request, and the controller has to provide a physical person capable of changing the fully automated decision.

The data subject can exercise the right to human intervention only in case of application of Art. 22(2)(a) or (c) GDPR, and it seems rather only ex-post as no provision in the GDPR forces the controller to inform the data subject about this right before making the decision. Art. 13, 14 and 15 GDPR require the controller to provide information only about “the existence” of automated decision-making, including profiling, referred to in Art. 22(1) and (4) GDPR. The provisions of Art. 22(3) GDPR require merely to “implement suitable measures,” in other words, to carry out, enable and provide methods to oppose and dispute the decision. Additionally, the meaning of the word ‘intervention’ suggests post-decision action.

The grammatical interpretation of Art. 22(3) GDPR leads to a conclusion that to fulfill the requirement to implement appropriate safeguards through enabling activation of the right to human intervention, the controller shall put at the disposal of the data subject a physical person. However, not just any physical person but one that can take action against the automated decision in order to improve the situation of the data subject regarding consequences of the automated decision; and surely, not to make a decision that worsens the data subject’s position.

Some authors[21] claim that the provision of Art. 22(3) GDPR regarding the right to human intervention is a requirement to provide ‘substantial’ human involvement to avoid rubber-stamping the automated decision. They express their concerns that human’s only theoretical participation in a revision process would deny the data subject’s right to human intervention or lead to potentially discriminatory practices.

However, sticking to the grammatical interpretation, the wording of Art. 22(3) GDPR, as mentioned above, requires the controller to enable ‘intervention’ in the decision-making process. This one word seems to satisfy and fulfill the authors postulate as the intervention demands action taken to become involved intentionally. The term ‘intervention’ includes the word ‘action,’ therefore an ability to change the decision. Hence, the desire for ‘substantial’ human intervention has been envisaged by the legislator.

The concerns about the discriminatory character of automated decision-making based on profiling require a little more explanation. Regarding requirements for triggering Art. 22(3) GDPR, so mainly application of Art. 22(2)(a) – contract, or (c) – explicit consent, it is clear that the data subject manifests his/her awareness, willingness and acceptance for the anticipated decision based solely on automated processing, including profiling. It is hard to imagine another outcome or change of the decision if the automated system is fed with the same information the controller’s human representative is.

In this context, the right to human intervention fulfills only the necessity of having a verification procedure to eliminate incidents or errors in the automated system on the one hand and answers to the data subject’s psychological needs. Such a conclusion is justified due to the lack of requirement to perform the human intervention according to due process rules. The data subject has only the right to present the case to a human as he/she disagrees with the machine’s judgment. However, there is no obligation that the human must decide differently or that the human decision is based on rules that fulfill due process requirements. The obligation arising from Art. 22(3) GDPR, at its minimum, requires the controller to provide a human at the disposal of the data subject, empowered to change the decision.

While utilizing the contextual and teleological interpretation methods, the understanding of Art. 22(3) GDPR does not change. The right to human intervention fulfills the goal of providing safeguards on behalf of the data subject and securing the data subject’s position, even if not guaranteeing the change of the controller’s decision.

It is worth stressing that it is not the goal of Art. 22(3) GDPR to force the controller to change the decision. The goal is to enable the revision of the decision by a human as a higher authority. And higher, not necessarily in the context of knowing more or being able to process more data than a machine but higher in hierarchy regarding the anthropocentric legal perception of human beings, and meaning that a human, unlike the machine or algorithm, is empathetic and understands the different and sometimes very unclear and hard to verbalize nuances of why the decision is being taken. A human understands the reasoning for bothering with a decision in the first place.

In this regard, the right to human intervention may be perceived as the right to appeal – automated decision and an algorithm being the first instance decision-maker while the human revising the automated decision, the second instance. Additionally, Art. 77, 79 and 82 GDPR envisages an extra layer of human arbitration – the right to lodge a complaint with a supervisory authority, the right to an effective judicial remedy against a controller or processor and the right to compensation and liability. And although human intervention does not implement the due process rules, judicial control does.

The A29WP views on the right to human intervention

The A29WP has its own views on the subject of human intervention: “human intervention is a key element. Any review must be carried out by someone who has the appropriate authority and capability to change the decision. The reviewer should undertake a thorough assessment of all the relevant data, including any additional information provided by the data subject. Recital (71) highlights that in any case suitable safeguards should also include: (…) specific information to the data subject and the right (…) to obtain an explanation of the decision reached after such assessment and to challenge the decision. The controller must provide a simple way for the data subject to exercise these rights.”[22]

In the above-quoted excerpt, the A29WP refers to the postulate that aside from the three safeguards envisaged by Art. 22(3) GDPR as a minimum, additionally the “specific information to the data subject and the right (…) to obtain an explanation of the decision reached after such assessment and to challenge the decision” should be provided by the controller. But the A29WP forgets that these additional safeguards – the right to information, explanation and challenging the decision, can be inferred from other provisions of the GDPR.[23] Art. 13, 14 and 15 GDPR require the controller to provide or grant the data subject the right to information and explanation, and Art. 22(3) GDPR allows for challenging the decision to the extent of its contestation.

If the premise of the A29WP Guidelines would be correct that Art. 22(1) GDPR signifies a “general prohibition”[24] of automated decision-making and that Art. 22(2) GDPR provides “exceptions from the prohibition,”[25] then the safeguards enumerated in Art. 22(3) GDPR must have been of utmost importance, and their presence would be a requirement for lawful processing. And yet, the A29WP dedicates this topic only a few lines, barely mentioning the other safeguards.

In the recommendations attached to the Guidelines, the A29WP issues also some good practice suggestion for a controller: “a mechanism for human intervention in defined cases, for example providing a link to an appeals process at the point the automated decision is delivered to the data subject, with agreed time scales for the review and a named contact point for any queries.”[26] However, Art. 12 GDPR provides communication means with the data subject. Art. 12(1) GDPR requires that such communication takes place “in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child.”[27] Art. 12(2) GDPR in reference to Art. 11(2) GDPR regarding identification of the data subject, requires that “the controller shall not refuse to act on the request of the data subject for exercising his or her rights under Article 15 to 22.”[28] And Art. 12(3) GDPR demands that the controller provide information on actions taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request.[29]

Human intervention – a requirement to maintain anthropocentric legal consensus

Motives to allow human intervention in automated decision-making are very anthropocentric.[30] Anthropocentrism regards humans as separate from and superior to nature and holds that human life has intrinsic value. At the same time, it perceives other entities (including animals, plants, rare elements and so on) as resources that may justifiably be exploited for the benefit of humankind. Thus, no human should be judged or be subjected to a decision of an inferior being or its own creation.[31]

Some authors highlight the possibility of feeding the algorithms with biased data or warn against algorithmic profiling, suggesting that human intervention be the best remedy.[32] On the other hand, there are voices that the human intervention itself might introduce biases and limitations that result in undesirable outcomes.[33] All these views, partially justified, ignore the possibility that the decision does not have to be in favor of the data subject. And it does not matter if the decision is made by a human or is based solely on automated processing. The legal rule that the data subject may demand human intervention does not mean that the human that intervenes must change the decision.

The GDPR is quite precise – it does not require a physical person’s simple presence; it requires the controller to implement suitable measures, so the right to obtain human intervention is assured. Simultaneously, such human intervention should constantly be subjected to investigation whether it complies with the goals of the GDPR, which in this specific case is to provide suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests. And in more general meaning to ensure the protection of natural persons with regard to the processing of personal data and keep the will and interest of a human before the will and interest of an algorithm.

The right to express the individual’s point of view

The data subject, based on Art. 22(3) GDPR has the right to express his or her point of view; to state an opinion about a decision.

Some authors struggle with this right: “it is not entirely clear what the legal consequence should be if such an opinion is expressed.”[34] The grammatical and contextual interpretations indeed do not contribute much. Based on them, this right should be understood as nothing more than a simple possibility for the data subject to come forward with his/her opinion about the automated decision.

According to Brkan, “the most appropriate interpretation of this right is that the controller should take the opinion of the data subject into account when assessing the automated decision and should have an obligation to respond to the data subject’s point of view.”[35]

If the controller could ignore the data subject’s opinion by not replying, it would render this right ineffective in practice. And yet, the GDPR demands the controller’s response. The legal grounds are not in Art. 22(3) GDPR, however, but in Art. 12(3) GDPR, which instructs the controller to “provide information on action taken on a request under Articles 15 to 22 GDPR to the data subject without undue delay and in any event within one month of receipt of the request”. Based on the teleological interpretation, the controller here is obliged to consider the data subject’s point of view and either agree with it in full or in part or reject it. So indeed, react to the data subject’s motion.

The right is also expected to be exercised rather together with the right to human intervention and the right to contest the decision then separately.[36] However, this right should not open the possibility to the data subject to endlessly delay the decision’s adoption. Hence, a balance has to be struck between this right and the necessity to adopt the decision.[37] Yet, in case of adhesion contracts concluded on a large scale, each action undertaken by the data subject to undermine an automated decision necessary to enter into such agreement can result in unnecessary additional effort on the controller’s side and potentially backfire in more expensive or limited services.

The right to contest the decision

Ultimately, the data subject has the right to contest the decision. From all the three sub-rights granted in Art. 22(3) GDPR, the right to contest the decision seems to be the strongest, especially in the light of legal grounds required for triggering them. The only two situations, which must precede these rights’ execution, are based on the prior knowledge (based on Art. 13, 14 or 15 GDPR) and consent of the data subject – consent and willingness to conclude a contract or explicit consent to the decision (Art. 22(2)(a) and (2)(c) GDPR). Thus, allowing the data subject to retreat from prior commitments gives an impression of the data subject’s overly favorable treatment.

The term ‘contest’ connotes more than ‘object to’ or ‘oppose’; in other words, a right to contest is not merely a matter of being able to say ‘stop’ but is akin to a right of appeal. According to Brkan, if such a right is to be meaningful, it must set in certain obligations for the decision-maker, including (at the very least) an obligation to hear and consider the merits of the appeal. If the appeal process is to be considered genuinely fair, it should also carry a qualified obligation to provide the appellant with reasons for the decision.[38] The need to give reasons is backed by the general principle of lawfulness, fairness and transparency in Art. 5(1)(a) GDPR, which animates the regulation’s most basic norms. It is not to say, however, that providing reasons is an absolute requirement. The stringency of the obligation will depend on the weighing up of various factors – the seriousness of the effects of the decision or the extent to which the giving of reasons would unduly prejudice the legitimate interests and rights of the decision-maker (for example, concerning the protection of intellectual property rights).[39]

Contesting an automated decision raises a legitimate question of who should decide in case of such a challenge.[40] The GDPR does not give any guidance in this regard, which leads to a reasonable assumption that it is the controller’s responsibility to oversight the automated decision. In any event, if after the controller’s assessment of the contested decision, the data subject considers that his/her rights under the GDPR have been infringed, similarly to the right to human intervention,[41] he/she remains free to lodge a complaint with a supervisory authority[42] or to institute judicial proceedings against the controller.[43] Thus, in the broader perspective, the GDPR envisages the right to appeal and provides legal tools for overseeing an automated decision and taming an algorithm.

General prohibition of using an individual’s sensitive personal data for automated decision-making purposes – Art. 22(4) GDPR

Art. 22(4) GDPR provides a special kind of limit to the admissibility of automated decision-making – it may not be based on special categories of personal data specified in Art. 9(1) GDPR. These data include information about racial and ethnic origins, political opinions, religious and ideological convictions, genetic or biometric data, health, sex life and sexual orientation. However, this restriction is once again undermined by the GDPR exemptions themselves. Special categories of personal data can be used for automated decision-making if the data subject has given his consent or if the EU or Member States law permits such decision.[44]

It is noteworthy to observe that Art. 22(4) GDPR lays down the prohibition of decisions referred to only in paragraph (2) of Art. 22 GDPR – in cases when the right under Art. 22(1) GDPR does not apply. So merely when the data subject is in a vulnerable situation and cannot trigger his/her right autonomously.

If the processing of such data were necessary to make a decision based solely on automated processing, including profiling, it would mean that such a decision was based on potentially discriminative factors. In effect, such a decision could lead to illegal, discriminatory practices.

The reference to paragraph (2) in the text of Art. 22(4) GDPR and its fragment stating that “suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests are in place” suggest that such suitable measures as defined in Art. 22(2)(b) and in Art. 22(3) GDPR must be incorporated unequivocally.

Obligation to inform individuals about the existence of automated decision-making (Article 13, 14 and 15 of the GDPR) and “the right to explanation”

Principle of transparency

Articles 13, 14, and 15 GDPR contain transparency rights with regard to automated decision-making and profiling.

The right to explanation finds its roots in Art. 5(1)(a) GDPR and arise from the principle of transparency of processing personal data, which together with the principle of fairness, form an element of accountability required for establishing whether the automated decision-making systems are impartial.

The principle of transparency regarding automated decision-making confuses many. Some scholars undervalue[45] the GDPR’s requirements, and some tend to attach too much weight to this issue.[46]

Many authors have called for transparency in algorithmic decision-making, including transparency in the form of notice towards data subjects and transparency in the form of audits that enable expert third-party oversight.[47] Some of these calls have been ambitiously deep and broad, suggesting that both algorithmic source code and data sets should be subjected to public scrutiny.[48] Others have responded by enumerating the harms this level of transparency could cause,[49] or argue[50] that transparency directed at data subjects would be relatively useless since individuals lack the expertise to do much with such algorithmic source code or data sets.[51]

Individualized transparency

The A29WP Guidelines remind that individuals have a “right to be informed” about algorithmic decision-making.[52] That right arises from the “meaningful information about the logic involved” provisions of Art. 13 and 14 GDPR and from Art. 22(3) GDPR.[53] Simultaneously, the Guidelines suggest that the data subject does not need to be provided with a source code or a complex mathematical explanation.[54] But that is because expert oversight is not the purpose those individual transparency provisions are meant to serve.[55]

The Guidelines clarify that the individual transparency provisions are intended to empower data subject to invoke his/her rights under the GDPR.[56] Thus while the data subjects do not need to be provided with a source code, they still need to be supplied with explanations and enough information to be able to understand the decision,[57] to contest it,[58] and to detect and be able to correct erroneous data,[59] including inferred one based on profiling.[60]

The data subjects have to be able to act based on the information they receive. The right to be informed aims, in this regard, to prevent flooding data subjects with useless information.[61] And in-depth[62] detailed information can still be communicated clearly.[63]

Providing information about algorithmic decision-making should be understandable (or “legible”[64]) and avoid complicated jargon.[65] But it must also be meaningful; the Guidelines note that “complexity is no excuse for failing to provide information.”[66]

The GDPR structure requires considering its whole text and not just individual provisions – the relationship between all the rights and the individualized transparency is palpable. The substance of other rights often determines the substance of transparency. Here, the legislator decided to regulate the issue by requiring explanation.[67]

The Guidelines provide examples of what kind of information and how it should be provided to the data subject. The controller shall clarify the “factors taken into account for the decision-making process, and (…) their respective ‘weight’ in an aggregate level.”[68] The controller shall explain the categories of data used in an algorithmic decision-making process and why these categories are considered relevant. He shall explain how a profile used in automated decision-making is constructed, “including any statistics used in the analysis,” provide the data sources for profiling and clarify the use of a profile in the decision-making process and its necessity for a decision.[69]

The Guidelines also expect the controller to utilize “visualization and interactive techniques;”[70] not only is it the controller’s duty to communicate a particular depth of information, but the controller should also incorporate techniques that ensure the data subject understands the information and can invoke his/her rights.[71]

Systemic transparency

This individualized transparency regime is accompanied by forms of systemic transparency.

Although data subjects might not need access to source codes or data sets, the GDPR envisages systemic transparency addressed to the regulatory authorities and the controller himself. The requirement manifests itself more clearly in general provisions regarding data protection impact assessments for automated processing and oversight powers granted to supervisory authorities.[72]

The supervisory authority can require access to information[73] and perform audits.[74] The controllers deploying algorithmic decision-making must set up internal accountability and disclosure regimes through the DPIA’s and data protection officer.[75] Additionally, the Guidelines[76] suggest that controllers performing decision-making with a “high impact on individuals” should use independent third-party auditing and provide that auditor all necessary information about how the algorithm or machine learning system works.[77]

The requirement of transparency affects not just the depth of information revealed but also the timing of transparency.[78] Individual transparency is connected in the GDPR to separate events: when data is obtained,[79] when a decision is made,[80] when an individual’s consent is obtained,[81] or when a data subject requests information.[82] Such structure connects individualized transparency with the data subject’s rights but limits the efficacy of individualized transparency at creating oversight over an algorithm.[83] By contrast, the systemic accountability measures are envisioned as ongoing and continuous[84] and, if implemented early on in an algorithm’s development, should better serve the right to information and execute the principle of transparency.[85]

Supportive role of the right to be informed and the right to explanation in keeping the algorithmic decision-making accountable

The GDPR grants the data subject an array of rights that may counter any processing of personal data. Regarding automated decision-making, two are often confused with each other: Art. 21 GDPR, the right to object to the processing – covering every stage of automated decision-making other than a decision – and Art. 22 GDPR, the right not to be subject to an automated decision. Also, the conduct of the controller and data subject is often misinterpreted. However, the GDPR is rather very precise in this matter and provides clear instructions for both: if the controller holds a lawful ground for the processing and fulfills all other requirements, he may process personal data and make an automated decision. At the same time, the data subject has the right to:

object to the processing leading to an automated decision, under Art. 21(1) GDPR if such processing is based on Art. 6(1)(e) GDPR (a task in public interest or authority vested in the controller) or on (f) (legitimate interest); or

reject the decision based on Art. 22(1) GDPR; or

in case of application of Art. 22(2) GDPR, which deprives the data subject of the right under Art. 22(1) GDPR, based on Art. 22(3) GDPR, obtain human intervention, express his/her point of view and contest the decision.

based on Art. 15(1)(h) GDPR request information on the existence of automated decision-making, including profiling, referred to in Art. 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved and the significance and envisaged consequences of such processing.

Although the GDPR does not provide any right to pre-emptively restrict automated decision-making, based on Art. 22 GDPR, the data subject has the right not to be subject to an automated decision, and based on Art. 21 GDPR, a right to object to a specific instance of decision-making. To facilitate exercising data subject’s rights, the GDPR obligates the controller to provide information about the existence of automated decision-making based on Art. 13(2)(f) and 14(2)(g) GDPR and grants the data subject the right to obtain information about automated decision-making based on Art. 15(1)(h) GDPR.

The right to be informed and the right to explanation is thus crucial for the data subject:

to have the basic knowledge about the processing of his/her personal data;

to have access to his/her personal data, which allows the data subject to exercise other rights like the right to rectification, the right to erasure or the right to restriction of processing, if the conditions of these rights allow;

to have information about the existence of automated decision-making, including profiling;

to obtain meaningful information about the logic involved and the significance and envisaged consequences of such processing for the data subject.

The right to be informed and the right to explanation arise from the basic principles of the GDPR. But even according to the GDPR itself, these rights are only the possibility to obtain information that should clarify the basic idea standing behind the particular automated decision-making process and the controller’s assumptions about the consequences of such processing. Additionally, Recital (63) GDPR provides a clear perception that the “right should not adversely affect the rights or freedoms of others, including trade secrets or intellectual property and, in particular, the copyright protecting the software.” Such understanding is compliant with the other similar confirmation made by the GDPR, expressed in Recital (4) that “the right to the protection of personal data is not an absolute right.” Nonetheless, the right to be informed, together with the right to explanation, provide the data subject with an essential and valuable tool allowing for a conscious assessment of the consequences of automated decision-making and, if necessary, benefit from the right granted by Art. 22 GDPR.

Dreyer/Schulz, p. 17. ↵

Case C‑507/17, Conseil d’État v. Google. ↵

Case C-18/18, Glawischnig-Piesczek v. Facebook Ireland Limited. ↵

Cf. González, p. 599. ↵

European Data Protection Board, ‘Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects’, Adopted on 9 April 2019, version for public consultation. ↵

Specifically, the controller should take into consideration that the application of certain data subject rights under the GDPR may vary depending on which legal basis the processing is based on. For example, processing under Article 6(1)(b) may give rise to the right to data portability under Article 20 but would not give rise to the right to object to the processing under Article 21(1) GDPR. To avoid any confusion, the EDBP observes that “this is particularly relevant where the appropriate legal basis is Article 6(1)(b) and a contract regarding online services is entered into by data subjects. Depending on the circumstances, data subjects may erroneously get the impression that they are giving their consent in line with Article 6(1)(a) when signing a contract or accepting terms of service. At the same time, a controller might erroneously assume that the signature of a contract corresponds to a consent in the sense of article 6(1)(a). It is important to distinguish between entering into a contract and giving consent within the meaning of Article 6(1)(a), as these concepts are not the same and have different implications for data subjects’ rights and expectations.” ↵

González, p. 600. ↵

Art. 5(1)(c) GDPR – ‘data minimization.’ Cf. also Hildebrandt, Privacy as protection of the incomputable self, p. 112. ↵

Cf. Chapter 8.4. ↵

Latin - everything that isn’t forbidden by the law is allowed. ↵

The Charter’s reference to general interests recognized by the EU covers both the objectives mentioned in Art. 3 TEU and other interests protected by specific provisions of the Treaties such as Art. 4(1) TEU and Articles 35(3), 36 and 346 TFEU. See also Case C-292/97, para. 45. ↵

Cf. Jones, Group Rights, unpaginated; see also Raz, p. 208. ↵

Cf. Grabenwarter; see also Wachter/Mittelstadt/Floridi, p. 11. ↵

Mendoza/Bygrave, p. 7; see also: Brennan-Marquez/Henderson, pp. 138-142. The authors claim that some sorts of decisions, such as legal judgment, can only be seen as democratically valid if the decision-making process is role-reversible, that is, if the decision-maker can, at least in principle, be subject to the effects of a decision. This idea, related to the notion that nobody is above the law in a democratic society, establishes an explicit condition for the automation of democratic processes: the use of an AI would only be valid if an intelligent system can be subject to the sort of decisions that one intends to automate. On the other hand, attributing legal — or even moral — patiency to artificial intelligence systems intensifies the tensions between the instrumental role attributed. ↵

Cf. Chapter 2.3.4. and Chapter 9.3.3. ↵

See e.g.: Hildebrandt, p. 120. ↵

Cf. Kamarinou/Millard/Singh, pp. 1-2. ↵

Almada, unpaginated. ↵

The ‘trilogue negotiations’ describe a series of meetings between the European Commission, Council and Parliament to adopt a final text for the GDPR. For an introduction and discussion of the legal basis of trilogue, see: Proust, unpaginated. ↵

Cf. Heimes, unpaginated: “A hotly contested provision of the GDPR, the ‘profiling’ restrictions ultimately adopted were narrower than initially proposed.” ↵

See e.g.: Keats Citron/Pasquale, pp. 19-20; Malgieri/Comandé, p. 252. ↵

Guidelines, p. 27. ↵

Malgieri, p. 4. ↵

Guidelines, pp. 9, 12, 19, 20, 23, Annex 2 pp. 34, 35; cf. also Chapter 5.4. ↵

Ibid., p. 23. ↵

Guidelines, Annex 1 ‘Good practice recommendation’, p. 32. ↵

Art. 12(1) GDPR. ↵

Art. 12(2) GDPR. ↵

Art. 12(3) GDPR. ↵

Cf. Chapter 2.3.4. ↵

See e.g.: Düwell/Bos pp. 235-237; Prakash Sinha, p. 476. ↵

See e.g.: Veale/Edwards, Clarity, Surprises, and Further Questions, p. 399; Wachter/Mittelstadt/Floridi, p. 31. ↵

See e.g.: Bygrave, unpaginated; Malgieri/Comandé, pp. 247-248. ↵

See e.g.: Brkan, p. 18. ↵

Ibid. ↵

Ibid. ↵

Ibid. ↵

Mendoza/Bygrave, pp. 16-17. ↵

Ibid, p. 17. ↵

Brkan, p. 18. ↵

Cf. Chapter 9.3.1. ↵

Art. 77 GDPR ↵

Art. 79 GDPR; Art. 82 GDPR. ↵

Dreyer/Schulz, pp. 21-22. ↵

See e.g.: Wachter/Mittelstadt/Russell, pp. 32-35; Wachter/Mittelstadt/Floridi, pp. 31-32; Veale/Edwards, p. 400. ↵

See e.g.: Kaminski, pp. 17-24. ↵

See e.g.: Keats Citron, p. 1304; Keats Citron/Pasquale, p. 20; Pasquale, p. 217; Crawford/Schultz, p. 119; Hildebrandt, The Dawn of a Critical Transparency Right for the Profiling Era, p. 47; Kim, p. 190; Kaminski, p. 24. ↵

See e.g.: Keats Citron/Pasquale, p. 26: the “logics of predictive scoring systems should be open to public inspection”; Zarsky, p. 1523: “disclosures generate limited social risks, which might arise when specific secretive governmental datasets are applied.” ↵

See e.g.: Kroll, et al., p. 639; Zarsky, pp. 1553-1563; Ananny/Crawford, p. 6: “full transparency can do great harm.” ↵

See e.g.: Kroll, et al., p. 638: “The source code of computer systems is illegible to nonexperts”; Veale/Edwards, Slave to the Algorithm, p. 67: “Individuals are mostly too time-poor, resource-poor, and lacking in the necessary expertise to meaningfully make use of these individual rights.” ↵

Kaminski, p. 18. ↵

Guidelines, p. 20. ↵

Ibid., p. 20, 25: “Providing this information will also help controllers ensure they are meeting some of the required safeguards referred to in Art. 22(3) GDPR and Recital (71).” ↵

Ibid., p. 25: “not necessarily a complex explanation of the algorithms used or disclosure of the full algorithm”; p. 31: “Instead of providing a complex mathematical explanation about how algorithms or machine-learning work, the controller should consider using clear and comprehensive ways to deliver the information to the data subject.” ↵

Kaminski, pp. 19-20. ↵

Guidelines, p. 27: “general information…which is also useful for him or her to challenge the decision;” “The data subject will only be able to challenge a decision or express their view if they fully understand how it has been made and on what basis.” ↵

Ibid., p. 13: “Controllers seeking to rely upon consent as a basis for profiling will need to show that data subjects understand exactly what they are consenting to.” ↵

Ibid., p. 27. ↵

Ibid., pp. 17-18: “Individuals may wish to challenge the accuracy of the data used and any grouping or category that has been applied to them. This right to rectification and the right to erasure apply to both the personal data used in creating a profile, and to the inferences made (the ‘output data’ (the profile itself or ‘score’ assigned to the person))”; p. 31: “Controllers providing data subjects with access to their profile in connection with their Article 15 rights should allow them the opportunity to update or amend any inaccuracies in the data or profile.” ↵

Kaminski, p. 20. ↵

See e.g.: Ananny/Crawford, p. 7: “transparency can intentionally occlude”; Zarsky, p. 1508: “The process of merely flooding the public with facts and figures does not effectively promote transparency. It might even backfire”; see also Wagner, pp. 1321, 1324–25; see also Guidelines, p. 31: “Instead of providing a complex mathematical explanation… controller should consider using clear and comprehensive ways to deliver the information to the data subject.” ↵

See, e.g., Monroe: Monroe “used line drawings and only the thousand (or, rather, ‘ten hundred’) most common words to provide simple explanations for some of the most interesting stuff there is” – book description. ↵

Kaminski, p. 21. ↵

Malgieri/Comandé, p. 3-4: “legibility is concerned with making data and analytics algorithms both transparent and comprehensible,” quoting Mortier et al. See also Zarsky discussing the related concept of interpretability, p. 1520.  ↵

Guidelines, p. 31: “clear and comprehensive.” ↵

Ibid., p. 25, note 40. ↵

Selbst/Barocas, p. 1138. ↵

Guidelines, p. 27: “which is also useful for him or her to challenge the decision.” ↵

Ibid., p. 31. ↵

Ibid.: “Controllers may want to consider implementing a mechanism for data subjects to check their profile, including details of the information and sources used to develop it.” See also p. 32: “Controllers could consider introducing online preference management tools such as a privacy dashboard.” See also Hildebrandt: transparency- enhancing technologies; Keats Citron/Pasquale suggesting interactive modeling, p. 29. ↵

Kaminski, p. 22. ↵

Ibid. ↵

Art. 58(1)(e) GDPR. ↵

Art. 58(1)(b) GDPR. ↵

Art. 38(2) GDPR; Guidelines, pp. 29-30. ↵

Guidelines, p. 32. ↵

Kaminski, p. 14. ↵

Ananny/Crawford, p. 10. ↵

Arts. 13, 14 GDPR. ↵

Art. 22, Recital (71) GDPR. ↵

Guidelines, p. 12. ↵

Art. 15 GDPR. ↵

Cf. Kroll, et al., pp. 659, 662; Desai/Kroll, pp. 39-42. ↵

See, e.g., Guidelines, p. 28; see, e.g., Ananny/Crawford, p. 4.  ↵

Cf. Kaminski, p. 24. ↵

10

Summary and conclusions

Research objectives – introduction

This dissertation aimed to explore and examine automated decision-making provisions with regard to refreshed legal frames for data protection governed by the GDPR. Through analysis of the legal provisions, Recitals and the Guidelines on automated decision-making, judicial decisions of the CJEU and evaluation of accessible literature, the subject matter has been studied from different angles. The application of the court’s legal interpretation methodology clarified the understanding of Art. 22 GDPR and allowed to reach the primary and secondary objectives of this dissertation.

The research starts with the historical background of the data protection rights and their origin. It recognizes the common roots with privacy rights and emancipation of the data protection rights up to becoming a distinct fundamental right of the European Union. It explains why provisions regarding automated decision-making were included in the data protection framework helping to put the main problem, i.e., whether Art. 22 GDPR should be interpreted as a right or prohibition of automated decision-making, in the proper context of generally unprohibited ‘free movement’[1] of personal data within the European Union.

A review of the CJEU’s conclusive methodology allowed to establish a good set of tools to perform a legal interpretation of the studied provisions. Additionally, an analysis of legitimacy and validity of the non-binding part of the GDPR – Recitals and the Guidelines adopted by supervising authorities perceived as so-called ‘soft law’ – helped to understand their influence on the implementation of the regulation’s provisions.

One of the most intriguing findings of the research is the fact that so many authors perceive the right not to be subject to automated decision-making as a prohibition of automated decision-making aimed at the controllers; a belief that only works against the best interest of the data subjects but is commonly shared also by the supervising authorities.[2]

Research objectives – findings

The prevalent view of the prohibitive character of Art. 22 GDPR seems to stem not from the currently legally binding provision of the GDPR but formerly applicable national laws, mainly German[3] but also Belgian, Austrian or Dutch legislation[4] that implemented Art. 15 DPD not as a right as the directive phrased it but, by exploiting the margin of appreciation, as a direct prohibition of automated decision-making. Additionally, the wording of Art. 22(1) GDPR based on negation and similarities of Art. 22(2) GDPR to the legal grounds for processing enumerated in Art. 6(1) GDPR seem to add to the confusion.

The absence of convincing argumentation, not to mention any legal interpretation method that would support such claims, indicates, even more, the need for the application of the coherent and precise interpretative canon used by the CJEU to clarify the meaning of Art. 22 GDPR.

The research also recognized the teleological structure imprinted into the GDPR that for correct understanding and implementation of individual provisions, requires the prism of the regulation’s goals and objectives.

The GDPR’s structure enabled business entities to rewrite the legislation as a logical chain of rules sufficient for the computer to understand and design it into software aiming to help the GDPR’s implementation. As the business entities use only more automation, algorithms and in the future artificial intelligence to provide their goods and services, the need for transparency of personal data processing and clarity of law only increases.

The future will show whether the EU legislators’ teleological direction in protecting personal data was sufficient. However, the signals from around the world, Singapore, South Korea, Australia or California, to name a few, demonstrate a considerable impact the GDPR has already had on similar legislation and the renewed focus on data protection.

Research objectives – conclusions

Primary objectives

After applying the CJEU interpretative methodology and considering the court’s existing rulings, a clear conclusion can be drawn that there is no ambiguity in provisions regarding the right not to be subject to a decision based solely on automated processing, including profiling. The right foresaw in Art. 22(1) GDPR is not a prohibition of such decision-making directed to a controller or a processor.

The basic interpretation method – the grammatical one, rooted in the court’s rulings as a primary means of interpretation, leaves no doubt: under Art. 22(1) GDPR, the data subject is endowed with the right, no different from the rights arising from Articles 15 to 21 GDPR. While interpreting a clear and precise provision, the literal method reflects the principle of legal certainty the best. It guarantees a high degree of predictability of the CJEU judgments.[5] In accordance with settled case law,[6] the contextual or teleological interpretation of a clear and precise provision may not question its literal meaning. It would run counter to legal certainty and the principle of inter-institutional balance enshrined in Art. 13(2) TEU.[7] In other words, the CJEU should not ignore the clear and precise wording of a legal provision.[8] And indeed Art. 22(1) GDPR is not unclear or imprecise, nor is Art. 22(2) GDPR enumerating three situations when “paragraph (1) shall not apply.”

From a different angle, the contextual interpretation concentrates on the purely normative context the provision in question is placed in. The CJEU looks at the functional relationship between the EU law provision in question and the normative system to which it belongs.

Placing Art. 22 GDPR in Chapter III – “Rights of the data subject,” the GDPR provides an evident context through which the provisions of Art. 22 should be interpreted. Neglecting such obvious contextual interpretation leads to a situation when other provisions are being ignored, like Art. 12(2) GDPR, which requires the controller to “facilitate the exercise of data subject rights under Articles 15 to 22” and ultimately the whole context of personal data protection envisaged in Art. 8(1) of the Charter and in Art. 16(1) TFEU, which delegates onto the European Parliament and the Council, the power to provide legislation of, among others, the rules relating to the “free movement of personal data.”

As it comes to the historical interpretation of Art. 22 GDPR, it has to be emphasized that the legislator followed the rhetoric of Art. 15 DPD providing the same motives and concerns.[9] In short: (i) the potential weakening of the ability of persons to exercise influence over decision-making processes that significantly affect them, in light of the growth of automated profiling practices, (ii) anxieties over the quality of fully automated decision-making processes, more specifically a fear that such processes will cause humans to take for granted the validity of the decisions reached and thereby reduce their own responsibilities to investigate and determine the matters involved, (iii) a concern to support human dignity by empowering humans (and not their ‘data shadows’) to remain solely responsible for ‘constituting’ themselves.[10]

The historical method of interpretation helps to clarify the present legislation through the past understanding of preceding provisions; it aids in finding arguments that Art. 22 GDPR signifies a right to refuse subjection to automated decisions and not a prohibition of automated decision-making. Historically, Art. 15(1) DPD did not take the form of a prohibition of automated decision-making but directed each EU Member State to grant the data subject a right to prevent them from being subjected to such decision-making. Also, the wording of Art. 15(2) DPD helps to understand the misinterpreted text of Art. 22(2) GDPR.[11]

Many cases prove that the CJEU follows a precise interpretative sequence: the court looks first at the wording of the provision in question, and secondly, at the context where the provision was found. Where the court construes in a teleological manner, it frequently chooses amongst several possible interpretations. The solution which is least burdensome[12] and least far-reaching[13] will commonly be selected, provided that the system’s general objectives[14] can still be achieved.[15] If, for some reason, after applying first the grammatical than the contextual method of interpretation, the CJEU finds the provisions of Art. 22 GDPR ambiguous, it will reach for the teleological interpretation and focus on the goal and purpose of the provision itself and the regulation’s and Union law’s objectives.

The reason behind Art. 22 GDPR is to provide the data subject with the right to refuse subjection to an automated decision. This goal should not be detached from the regulation’s objectives, as the regulation seems to work only as a whole and not as separate provisions taken out of context and their purpose.

To justify and argue that Art. 22(1) GDPR is not a data subject’s right, but a prohibition aimed at the controllers to prevent them from making a decision based solely on automated processing would require a lot of effort before the CJEU, as all four interpretation methods employed by the court consistently confirm its non-prohibitive character.

For the most part teleological rulings in cases regarding the GDPR,[16] the CJEU confirmed recommendations of Recital(4) GDPR entirely that “the right to the protection of personal data is not an absolute right, but must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality.”[17]

The legislator reasonably decided to distinguish profiling as a peculiar form of automated processing[18] and granted it a separate definition.[19] Increasingly, profiles are being used to support consequential decisions, e.g., credit scoring, job hiring, policing or national security. As a result, data about an individual’s behavior can be used to generate otherwise unknown information about someone’s likely identity, attributes, behavior, interests, or personality.[20]

Profiling poses a few closely related risks: by virtue of generating new or unknown information, profiling is often highly privacy-invasive. It challenges common views about informed consent and raises issues around control, not just over personal data but also one’s identity. Since derived, inferred, or predicted profiles might be inaccurate or otherwise systematically biased. Profiling may also lead to a situation when an individual is misidentified, misclassified, or misjudged.

The inaccuracy of data the profiling is based on and later used in affecting individuals’ decision-making processing may result in material or immaterial damage.[21]

Furthermore, a separate recital dedicated to profiling confirms its significance. Recital (72) GDPR subjects profiling “to the rules of [the GDPR] governing the processing of personal data, such as the legal grounds for processing or data protection principles.” Recital (72) explains that profiling does not require any separate legal grounds to be performed and that it shares the legal grounds with processing, including solely automated processing, additionally supporting the conclusion regarding secondary objectives of this dissertation that paragraph (2) of Art. 22 GDPR does not constitute a legal ground for the processing of personal data leading to automated decision, as those are gathered by Art. 6(1) GDPR.

The definition of automated decision-making in Art. 22(1) GDPR requires simultaneous satisfaction of multiple conditions so the right not to be subject to an automated decision could materialized:

a decision must be made;

the decision must create legal effects or similarly significantly affect the targeted person;

the decision must be based solely on automated processing or on profiling.

For this reason, the right has been characterized as resembling a “house of cards.”[22]

Based on the applied methodology and rulings of the CJEU, it can be concluded that the right not to be subject to automated decision-making, including profiling, does not exist in a vacuum. It should be read together with other rights of the data subject but also viewed through the fundamental rights of others and obligations of the controller. Thus, the controller making an automated decision, while deriving his right to collect and process personal data from his fundamental rights, e.g., freedom to conduct business,[23] at the same time has to fulfill all the requirements of the GDPR. Among them Art. 5(1) GDPR, which presents principles relating to the processing of personal data. The controller, based on Art. 5(2) GDPR is solely accountable for and has to be able to demonstrate compliance with these principles, which means that the personal data processing shall meet the conditions of lawfulness, fairness, transparency, purpose and storage limitation, data minimization, accuracy, integrity and confidentiality. The controller can only justify the processing if one of six legal grounds enumerated in Art. 6(1) GDPR can be applied.

Based on Art. 12(1) GDPR, the controller shall provide any information referred to in Art. 13 and 14 GDPR and any communication under Articles 15 to 22 and 34 GDPR (communication of personal data breach). Art. 12(2) GDPR imposes on the controller an obligation to facilitate the exercise of the data subject rights under Articles 15 to 22 GDPR. Art. 25 GDPR require the controller to implement appropriate technical and organizational measures to ensure the application of all the above requirements by design and by default. And with regard to Art. 35(3)(a) GDPR, Art. 35(1) GDPR requires the controller to “carry out an assessment of the impact of the envisaged processing operation on the protection of personal data.”

All of the above constitute only a prerequisite for making an automated decision the data subject has the right not to be subjected to.

Secondary objectives

Regarding the secondary objectives, the main conclusion recognizes that the controllers are free to make a decision based solely on automated processing in any lawful situations envisaged in Art. 6(1) GDPR, and in cases other than enumerated in Art. 22(2)(a) and (c) GDPR, in reference to Art. 22(3) GDPR, the controller does not have to implement suitable measures to safeguard the data subject’s rights. Yet, the data subject can exercise the right not to be subject to a decision based solely on automated processing and avoid consequences of such an automated decision.

It must be observed that the legal grounds for derogation of the right not to be subject to a decision based solely on automated processing enumerated in Art. 22(2) GDPR, resemble the legal grounds for processing in Art. 6(1) from (a) to (c) GDPR. However, this resemblance is only accidental. This affinity is also visible in other rights established in Chapter III GDPR, however legal grounds for triggering these rights other than gathered by Art. 6(1) GDPR can also be recognized.

The CJEU interpretation methodology did not provide any argument to support claims of the A29WP and other authors that Art. 22(1) GDPR establishes a general prohibition of automated decision-making and Art. 22(2) GDPR provides a list of exceptions. However, based on the legal interpretation methodology of the CJEU, it is clear that Art. 22(2) GDPR provides exceptions but only for derogation of the right defined and granted in Art. 22(1) GDPR, and exclusively in reference to the automated decision as defined there. That means that the general legal basis for processing enumerated in Art. 6(1) GDPR applies in full also in solely automated processing, including profiling, which forms the basis for a decision defined in Art. 22(1) GDPR, to which the data subject has the right not to be subjected to.

The application of Art. 22(3) GDPR is possible only in two out of three situations, which on the grounds of Art. 22(2) GDPR derogate the data subject’s right from Art. 22(1) GDPR. Its use is thus limited to the two following cases:

Art. 22(2)(a) GDPR – if the decision is necessary for entering into, or performance of, a contract between the data subject and a controller; or

Art. 22(2)(c) GDPR – if the decision is based on the data subject’s explicit consent.

The occurrence of one of these situations determines two things: first, it derogates the right of the data subject granted by Art. 22(1) GDPR, and second, imposes additional obligations on the controller to “implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least”:

the right to obtain human intervention on the part of the controller;

the right to express the data subject point of view;

the right to contest the decision or ‘challenge’ it, as referred to in Recital (71) GDPR.

A special kind of limit to the general admissibility of automated decision-making is provided by Art. 22(4) GDPR: automated decisions may not be based on special categories of personal data specified in Art. 9(1) GDPR. These data include information about racial and ethnic origins, political opinions, religious and ideological convictions, genetic or biometric data, and information about health, sex life and sexual orientation.

In the debate about algorithms’ transparency and the so-called “right to explanation” anchored in Art. 5(1)(a) GDPR and Articles 13 to 15 GDPR, many authors postulate full access to and complete explanation of the logic involved, including access to databases and source codes. However, the GDPR foresees a more balanced approach. As Recital (4) GDPR explains that the right to the protection of personal data is not absolute, the GDPR enacting terms also follow this objective and require the controller to provide information in an accessible form and by design and default enable the data subject to be aware of and be able to comprehend the automated decision-making process. Recital (63) GDPR reminds that this right of access should not adversely affect others’ rights or freedoms, including trade secrets or intellectual property and, in particular, the copyright protecting of the software.

Worth noticing is also the GDPR consistency in granting the data subject the final saying whether to trigger the right. In this matter, the GDPR demonstrates a balanced approach to its regulatory role directed to the controllers and its respect to the data subject’s autonomy. The first provides the legal framework for lawful processing of personal data by the controller, and the second equips the data subject with tools to guard their personal data independently.

Next to this individualized transparency regime, the GDPR envisages more systemic checks and balances, including internal audits (DPIA’s) and the requirement to employ an impartial data protection officer.[24] Additionally, the supervisory authority can require access to information[25] and perform audits.[26]

Understanding the right granted by Art. 22(1) GDPR as a prohibition of automated decision-making reverses the optics and would be counterproductive. Suddenly, the law that is self-explanatory becomes unclear and vague. As there are no clear rules of interpretation, nothing is predictable anymore. The data subject deprived of his/her right, consequently, is unable to react against an automated decision, facing its immediate, likely adverse impact, and forced to rely on the supervising authorities acting as a law enforcement agency chasing a controller for a breach of the regulation. Such an approach would suggest that the data subjects lack the capabilities to assess what is beneficial to them. It would also mean that the authorities start to perceive the controllers as potential culprits, as the consequences of infringement of the alleged prohibition do not exclude criminal prosecution (the GDPR encourages the Member States to implement “other penalties,” including criminal liability[27]).

The reality, which perceives the algorithms as a helpful tool, questions the Guidelines narrative that the prohibition of automated decision-making protects the data subject from its potentially negative effects.[28]

Furthermore, the GDPR, and not the Guidelines or academics’ opinions, is the binding law, and the proper interpretation of its provisions can help to restore trust in the regulation and replace the fear of both the data subjects and the controllers imposed on them by confusing beliefs.

Additionally, we do not live in a dystopia of a computer-controlled world, where one’s fate is entirely pre-determined by unchallengeable calculations. Digital technology also offers transparency and empowerment opportunities, and properly designed systems may reduce bias and prejudice. After all, humans are still responsible for developing decision-making algorithms. There remains a significant opportunity to influence and manage computer technology development to ensure that ethics and law are part of the software developers’ and analysts’ curricula and to regulate the issues as necessary.

However, the development of AI and computer-assisted decision-making present significant challenges to the rule of law, equality, and justice in general, issues that require serious attention from those who research, teach, and practice law.[29]

Recommendations

The analysis of available literature revealed that perception of legal provisions regarding the right not to be subject to automated decision-making is not based on any particular interpretative method (with a few exceptions)[30] but instead on beliefs and presumptions. The main recommendation would be to put more emphasis on the methods of interpretation of EU law in general and of the GDPR in particular as a precondition to any further discussion.

Although the rules of interpretation may differ from one Member State to the other, the EU law, as a separate legal system, employs its own set of standards and puts the CJEU to guard them and be a supreme interpreter, with the final say of what the law means. Thus, recognizing the CJEU’s four interpretation methods is vital to implement not only the regulation but any EU law correctly.

Another finding uncovered the teleological structure of the GDPR. The recognition of the teleological paradigm used in drafting the GDPR may be the most critical shift in perception of this law. Furthermore, it connects the regulation’s objectives with individual provisions, improving the comprehension of automated decision-making and other vital issues. Teleology may also help implement into future legal acts provisions resembling Asimov’s three laws of robotics,[31] which are themselves very teleological in nature, and thus restore ethics and trust into machine learning and automated decision-making practices.

Thus, the suggestion would be to advise more on the teleological method of drafting and interpreting legal acts to utilize the beneficial features this mechanism offers, mainly the reference to particular legal, social or economic values that are deemed essential from the perspective of justice or public good. Features that allow for approaching and responding a priori to the quickly changing digital environment, to which the standard process of lawmaking cannot respond.

An important recommendation concerns the anthropocentric legal consensus. The status quo where the human and humankind is the superior entity must be maintained. The law, after all, is made for man, not man for the law, and never should foreclose or prevent a human from standing for him/herself. The right of the data subject granted by Art. 22(1) GDPR provides a perfect example of such an approach: it gives the human final saying whether or not to allow for subjection to a machine’s decision. Also in the future, artificial intelligence should remain recognized only as a product of human ingenuity, and despite its remarkable ability to compute or to learn in a way that exceeds human capabilities, subordinated to human will.

In reference to the main objective of this dissertation, looking at the right provided for by Art. 22(1) GDPR as a chance rather than an obstacle is an excellent opportunity for both the controller and the data subject to develop and utilize new services demanded by the data subjects and not available so far because of the erroneous interpretation of Art. 22 GDPR.

In the example of the insurance industry, it would mean a possibility of taking out an insurance policy automatically with a significant likelihood of a lower premium. The premium can be automatically adjusted to the more accurate data and allow the extra discounts based on the person’s profile and personalized history of incidents, not on statistical categorizations like, e.g., age, gender or domicile factors, as is the case now.

For a more practical recommendation, to correctly read the provisions regarding automated decision-making, a few simple steps can be suggested. As such, the same measure can also be helpful in the application of other GDPR’s provisions:

recognizing the legal grounds for the processing; a starting point that determines future obligations and conducts for both the controller and the data subject;

fulfilling the obligation to provide information and notifications, which shape the data subject’s awareness; proof of this action is later to be provided by the controller in case of supervising authority audit;

incorporating the data protection principles;

scrutinizing the right not to be subject to an automated decision and facilitating the exercise of data subject rights;

awareness regarding the GDPR provisions interaction with its goals and objectives.

Above all, it is recommended to look at the GDPR as an example of legislation that responds to the growing need for data protection in a very contemporary way. Its objectives and goal-oriented structure are now a benchmark for similar laws worldwide, laws that try to tame and constrain the practices of monetizing the personal data at the expense of their owners – the data subjects.

Contribution to knowledge

Despite the fact that the GDPR came into force in 2018, the provisions regarding the right not to be subject to automated processing were present before in the preceding EU legal act – in the Data Protection Directive. Although many authors performed legal research on this topic, the new law must be researched and interpreted separately. Also, the change of rank of the legislation from directive to regulation demands a new approach. Finally, the provisions have also changed, even if only slightly, and just this simple fact needs to be addressed.

An important part of this dissertation was devoted to presenting and implementing the interpretation methodology of the CJEU and introducing the EU supreme interpretation voice to the discussion. Establishing the basic interpretation tools was lacking in most of the researched papers. The majority of authors have not presented any objective criteria based on which they formed their claims. The lack of critical investigation of the subject matter forced them to rest on their presumptions instead of findings, which led to the discourse being based on often invalid argumentation. Bringing to the discussion a recognized and commonly practiced methodology that enables everybody to reach similar conclusions or at least to follow the logical inference contributes to the exchange of academic opinion.

Recognizing that the structure of the regulation is based on objectives and principles rather than simple reliance on individual enacting terms adds to the ability of others to find the intended patterns and goals of the regulation as a whole and the provisions regarding automated decision-making in particular.

Finally, the research and analysis presented above allow to reject unsubstantiated claims about the alleged prohibition of automated decision-making in the GDPR and replace beliefs with verifiable evidence that Art. 22(1) GDPR constitutes the right of the data subject not to be subject to automated decision-making, including profiling, to the mutual benefit of the data subjects and the controllers.

Art. 1(3) GDPR. ↵

See Guidelines, e.g.: p. 20. ↵

See e.g.: Martini, p. 256, who explains how the Germans made use of the margin of appreciation of Art.15 DPD and phrased it like a prohibition. ↵

See Korff, p. 84. ↵

Rasmussen, p. 33. ↵

See, e.g., Case C-220/03 BCE v. Germany [2005] ECR I-10595, para. 31; Case C-263/06 Carboni e derivati [2008] ECR I-1077, para. 48; Case C-48/07 Les Vergers du Vieux Tauves [2008] ECR I-10627, para. 44. ↵

See, e.g., Case C-582/08 Commission v. United Kingdom [2010] ECR I-07195. ↵

Cf. Lenaerts/Gutiérrez-Fons, p. 46. ↵

Mendoza/Bygrave, pp. 6-7. Cf. also Chapter 2.3. ↵

Ibid., p. 7. ↵

Cf. Chapter 8.4. ↵

See Case 27/72 Aimer v. Einfuhr-und Vorratsstelle Getreide [1972] ECR 1091. ↵

See Case 31/70 Getreide-und Futtermittel Handelsgesellschaft v. Hza Hamburg-Altona [1970] ECR 1055 and compare with the more adventurous “Opinion” of the Advocate General at 1072. ↵

In some cases of legislative silence, the CJEU followed a teleological interpretation and then ensured that the interpretation did not run contrary to the wording of the provision in question; see Case 6/77 Schouten v. Hoofdprodukstchap voor Akkerbouwprodkten [1977] ECR 1291. ↵

See Llorens, p. 394. ↵

Case C‑507/17, Conseil d’État v. Google and case C-18/18, Glawischnig-Piesczek v. Facebook Ireland Limited. ↵

Case C‑507/17, Conseil d’État v. Google, para. 60. ↵

Art. 4(2) GDPR – definition of ‘processing’: “‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.” ↵

Art. 4(4) GDPR – definition of ‘profiling’: “‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.” ↵

Kaltheuner/Bietti, p. 4. ↵

Cf. Ibid, pp. 7-8. ↵

See Mendoza/Bygrave, p. 19; Bygrave, unpaginated. ↵

Art. 16 of the Charter. ↵

Art. 35 GDPR. ↵

Art. 58(1)(e) GDPR. ↵

Art. 58(1)(b) GDPR. ↵

Art. 84 and Recitals (149) and (152) GDPR. ↵

Guidelines, p. 20: “interpreting Art. 22 GDPR as a prohibition rather than a right to be invoked means that individuals are automatically protected from the potential effects this type of processing may have.” ↵

Cf. Kennedy, p. 172. ↵

See e.g.: Tosoni. ↵

See: Asimow. In the March 1942 issue of Astounding Science Fiction, a science fiction author Isaac Asimov introduced The Three Laws of Robotics in his short story “Runaround.” The Three Laws are:1. A robot may not injure a human being or, through inaction, allow a human being to come to harm.2. A robot must obey the orders given to it by human beings, except where such orders would conflict with the First Law.3. A robot must protect its own existence as long as such protection does not conflict with the First or Second Law. ↵

Abstract

The right not to be subject to a decision based solely on automated processing of personal data, including profiling, is one of the most enigmatic, intriguing, and forward-looking rights provided by the European Union General Data Protection Regulation. Misinterpreted by many, including supervisory authorities, as a general prohibition of automated decision-making, this right requires a thorough and deep analysis to fully develop its power and not waste its potential.

Adopting a correct method of interpretation is thus very essential. It seems that the best methodology offers the supreme interpreter of the European Union law – the Court of Justice of the European Union. The court uses four methods of interpretation: grammatical, contextual, teleological, and seldom historical. Based on the court’s practice and implementing logical inference, there should be little doubt as to the rightful character of the subject matter provisions with a clear conclusion that the GDPR provides the natural person with the right to refuse being subjected to a solely automated decision and does not generally prohibit controllers from performing such automated decision-making.

Additionally, recognizing the regulation’s teleological structure can help understand and implement its provisions better but allows optimistic insight into the future when the role of algorithms and maybe real artificial intelligence will be even more significant. If only strained to preserve the fundamental anthropocentric doctrine, the teleological approach to drafting and interpreting legislation can be an answer to the ethical and trust questions raised rightly by many.

1

Curriculum Vitae

Paweł Kuch, LL.M., M.Ec., Attorney at Law, member of the Polish Attorneys at Law Bar and Ph.D. alumni of the Faculty of Law at Zurich University. A legal practitioner concentrating on civil, commercial and data protection laws. Interest in tech law and legal ethics of IoT, IoB and AI.