UK GDPR AI and Automated Decisions

Map the actual decision, not merely the model or score. A decision is significant if it produces a legal effect or a similarly significant effect for the person. It is solely automated where there is no meaningful human involvement. Record who reviews the output, what information they receive, whether they can depart from it, and whether they have time and authority to do so.

Article 22B prohibits a significant solely automated decision based wholly or partly on special-category processing unless the decision is based entirely on personal data to which the person explicitly consented, or the decision is necessary for a contract or required or authorised by law and Article 9(2)(g) substantial public interest applies. It also prohibits a significant solely automated decision when the processing used for it relies wholly or partly on Article 6(1)(ea), the recognised legitimate interests basis.

Where Article 22C applies, the controller must provide information about the decision and enable representations, human intervention, and contesting the decision. Separately document Article 6 lawfulness, any Article 9 or 10 condition, fairness, transparency, accuracy, security, DPIA risk, retention, and processor controls.

The controller that determines the decision's purpose and essential means owns the Articles 22A-22C analysis. Product and decision owners define the decision and effect; data science documents inputs, performance, and limitations; operations designs genuine human review; privacy or legal checks lawful basis, special-category conditions, notices, rights, and DPIA; procurement controls processor instructions and evidence.

Evidence should include the decision map, effect assessment, lawful basis, Article 9 or 10 condition, profiling analysis, human-review design and override records, Article 22C information and request routes, DPIA, model and outcome tests, monitoring thresholds, processor terms, and change history.

Profiling or an AI recommendation is not automatically a significant solely automated decision. Article 22C is triggered only when the controller takes a significant decision based entirely or partly on personal data and solely on automated processing. Human involvement that merely rubber-stamps an output may not be meaningful.

Article 22B adds restrictions where special-category processing contributes to the significant solely automated decision and where the processing used for that decision relies entirely or partly on Article 6(1)(ea), the recognised legitimate interests basis. A decision can fall outside Articles 22B and 22C because a human genuinely decides it or because its effect is not significant, but the ordinary UK GDPR principles, lawful-basis, transparency, rights, security and accountability duties still apply.

At design time, classify the decision and effect, identify the data and lawful basis, test Article 22B, complete any required DPIA, and build Article 22C safeguards. Before launch, test that a person can obtain understandable information, make representations, obtain human intervention, and contest the result.

During operation, log automated outcomes, human overrides, challenges, corrections, performance by relevant groups, data drift, and material changes. Reassess when the decision purpose, input data, model, effect, reviewer authority, or lawful basis changes.