Minding the Machine v2.0: The EU General Data Protection Regulation and Automated Decision-Making | Algorithmic Regulation | Oxford Academic
Work on this chapter has been conducted under the aegis of the research project ‘Security in Internet Governance and Networks: Analysing the Law’ (SIGNAL), funded by the Norwegian Research Council and UNINETT Norid AS. Thanks go to these institutions and the SIGNAL research team—particularly Luca Tosoni, Worku Gedefa Urgessa, and Tobias Mahler—for support. Thanks go also to the friendly hospitality of the 3A Institute at the Australian National University where the chapter was finalized. The usual disclaimer nonetheless applies. References to legal instruments are to their amended state as of 1 June 2019. This chapter focuses on Articles 22 and 25 of the EU’s General Data Protection Regulation (Regulation 2016/679). It examines how these provisions will impact automated decisional systems. Article 22 gives a person a qualified right ‘not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly