- The Article 29 Working Party interprets Art. 22 GDPR strictly: AEFE with legal or comparable effects generally prohibited, exceptions narrow.
- Permitted exceptions according to Art. 22 para. 2 only in case of contractual necessity, legal authorization or express consent.
- Those responsible must inform those affected and grant them the right to escalate to a human decision.
- Swiss E‑DSG is more liberal: AEFE not prohibited; only obligation to provide information and right of escalation required.
The Article 29 Working Group has issued an invitation dated October 3, 2017 Guidance on automated individual (case) decisions (AEFE) published in draft form. Interested parties can comment on the draft until November 27, 2017.
AEFE requirements
In addition to explanations of the terms used, e.g. profiling, the guide contains explanations of Art. 22 GDPR. The Working Party interprets Art. 22(1) GDPR as prohibiting AEFE if they have legal or other comparable effects on the data subject. A justification of such AEFE is only possible in the context of Art. 22(2) GDPR, i.e., in the strict interpretation of the Working Party,
- in the event of strict necessity for the conclusion or fulfillment of a Contract with the data subject (e.g.: credit assessment);
- at legal Authorization or obligation (whereby only the law of the EU or of a member state is likely to be in question);
- with express Consent.
The other grounds for justification are excluded in this reading, in particular the legitimate interests of the controller.
Even if the AEFE is admissible, the responsible party is obliged to inform the data subject about the AEFE and to grant him or her a right of escalation. In other words, the data subject has the right to make the AEFE a human decision again.
Because of these strict requirements, the question of when an AEFE has legal or comparable effects comes into focus. Here, too, the working group takes a strict stance. As Examples of legal effects calls them
- Restrictions on fundamental rights, such as freedom of assembly;
- a change in a legal position or in contractual rights;
- deciding on statutory entitlements, e.g. housing allowances (mentioning also the granting of such entitlements);
- the refusal of entry;
- the decision on investigative or supervisory measures by authorities;
- the interruption of telecommunications services due to a delay in payment.
Comparable other effects (positive or negative) if they have the potential to influence the Circumstances, significantly affect a person’s behavior or choices. However, it is difficult to apply this threshold. For example, not every denial of a benefit has “substantial” effects. For example, refusing to rent a bicycle during the vacations does not have a significant impact; refusing a mortgage would be different.
Another interesting and potentially far-reaching example is that, under certain circumstances, the targeted advertising (“targeted advertising”) have significant effects. The circumstances of the individual case are decisive for this, for example the following:
- the scope of profiling;
- the expectations and wishes of the person concerned;
- the way of advertising;
- any particular vulnerability of the persons concerned.
As an example of advertising with a significant impact, the working group cites advertising for online sweepstakes that is repeatedly shown to a person in debt.
The application of differentiated prices could also potentially have a significant impact, namely if someone is unable to use certain services due to prohibitively high prices.
Profiling requirements
Profiling is not included as an independent element. Art. 22 GDPR only mentions it as a possible – but not mandatory – element of AEFE. However, Recital 71 states that profiling outside of AEFE must also comply with requirements based on general principles:
[…] the data controller should suitable mathematical or statistical methods use for profiling, take technical and organizational measures to ensure in an appropriate manner, in particular, that factors leading to inaccurate personal data are corrected and the risk of errors is minimized, and […] prevent any discrimination against natural persons on grounds of racial or ethnic origin, political opinion, religion or belief, trade union membership, genetic makeup or health status, and sexual orientation. discriminatory effects […] comes […].
Regulation in Switzerland (E‑DSG)
The regulation proposed in Switzerland is substantially liberal. AEFE with legal or comparable effects are not prohibited; the data subject must only be informed – before or after the AEFE – and has the right to escalate the AEFE to a human being. Consequently, the connection with a contract or the explicit consent are also not noteworthy as justification; they only omit – unlike under the GDPR – the special requirements (information and escalation).