Lawfulness and transparency

Assess profiling and automated decisions

Determine whether profiling or solely automated decision making occurs, whether it produces legal or similarly significant effects, and record the safeguards and the information owed.

A lender scoring loan applications with an algorithm and no human sign off is exercising Article 22 territory, whether or not anyone in the business calls it that. The activity record has to surface this deliberately, because the consequences for the individual, and for the organisation, are heavier than for ordinary processing.

This is worked through on the activity's Assessment tab, where the automated decision question sits, and flows into both a required assessment and the wording owed to individuals in the notice.

The proof is that a significant automated decision cannot be approved without the assessment, and that the notice explains the logic in terms a person could act on.

Regulation

Articles 13 to 15 and 22

Registers

Processing activity · DPIA · Privacy notice · Risk · Measure

The steps

1. 01Open the activity's Assessment tab and answer the automated decision question.
2. 02Where the answer is yes, answer the follow up question on legal or similarly significant effect.
3. 03Complete the assessment fields, recording the human intervention offered to challenge the decision.
4. 04Open the linked privacy notice and state the logic involved in the field provided.
5. 05Open the Linked records band and use "Link a record" to attach any measure introduced as a safeguard.