Another View on Article 22 GDPR : The Future of Automated Decision-Making

Abstract

Artificial intelligence (AI) increasingly underpins automated decision-making (ADM) in high-stakes contexts such as credit scoring, workforce management, and public service allocation, raising acute concerns about transparency, accountability, and the limits of algorithmic secrecy. This paper examines how Article 22 GDPR should be understood following the Court of Justice of the European Union’s SCHUFA ruling, which resolved the prior doctrinal debate by confirming that Article 22(1) operates as a prohibition in principle, qualified by exceptions under Article 22(2) and safeguards under Article 22(3). Through doctrinal analysis of SCHUFA alongside EU national court and data protection authority decisions spanning multiple sectors, including Uber/Ola, Deliveroo/Foodinho, Buona Scuola, AMAS, Caixabank, and Grindr, the paper delineates operational criteria for when ADM is solely automated, when it reaches the significant effects threshold, and what meaningful information must substantively provide. The analysis demonstrates that intermediate algorithmic outputs can constitute ADM where they materially shape subsequent outcomes, and that nominal human review fails to satisfy Article 22 where it amounts to rubber-stamping without interpretive criteria or authority to deviate. The paper further develops a cumulative ADM doctrine: sequential or continuous automated steps may collectively trigger Article 22 where they produce aggregate effects on livelihood, credit, services, or public benefits. A key doctrinal contribution is the distinction between transactional non-selection, which does not cross the significance threshold, and positional assessment, where algorithmic flagging, downranking, or sanctioning alters an individual’s standing within a system and determines future access to opportunities. The paper concludes that explainable AI is a legally necessary instrument for making disclosures contestation-enabling under Article 22(3), but is insufficient without institutional safeguards, including genuine human oversight, rights to challenge, data protection impact assessments, and coordination with the AI Act’s risk-based framework.