The Right To Object to Automated Individual Decisions: Resolving the Ambiguity of Article 22(1) of the General Data Protection Regulation

11 International Data Privacy Law (2021) (Forthcoming)

University of Oslo Faculty of Law Research Paper No. 2021-07

26 Pages Posted: 14 May 2021 Last revised: 15 Jun 2021

See all articles by Luca Tosoni

Luca Tosoni

University of Oslo (UiO) - Norwegian Research Center for Computers and Law

Date Written: May 14, 2021

Abstract

This article provides a critical analysis of Article 22(1) of the European Union’s General Data Protection Regulation (‘GDPR’). In particular, the article examines whether, as a matter of lex lata, the enigmatic ‘right not to be subject to a decision based solely on automated processing’ provided for in Article 22(1) should be interpreted as a general prohibition or as a right to be exercised by the data subject. These two possible interpretations offer very different protection to the interests of data subjects and controllers: if the basic rule in Article 22(1) were interpreted as a prohibition, controllers would basically not be allowed to make individual decisions solely based on automated processing, unless one of the specific exceptions specified in Article 22(2) applies; conversely, if that in Article 22(1) were interpreted as a right to be actively exercised, the use of automated individual decisions would normally be restricted under the GDPR only where the data subject has expressly objected to it. Thus, resolving the ambiguity of Article 22(1) is critical to understand what is the scope left for automated decision-making under EU data protection law. Based on a textual, contextual, systematic and teleological interpretation of Article 22(1), the article concludes that such a provision is better characterized as conferring upon data subjects a right that they may exercise at their discretion, rather than establishing a general ban on individual decisions based solely on automated processing.

Suggested Citation

Tosoni, Luca, The Right To Object to Automated Individual Decisions: Resolving the Ambiguity of Article 22(1) of the General Data Protection Regulation (May 14, 2021). 11 International Data Privacy Law (2021) (Forthcoming), University of Oslo Faculty of Law Research Paper No. 2021-07, Available at SSRN: https://ssrn.com/abstract=3845913

Luca Tosoni (Contact Author)

University of Oslo (UiO) - Norwegian Research Center for Computers and Law ( email )

PO Box 6706 St Olavsplass
Oslo, 0130
Norway

Do you have a job opening that you would like to promote on SSRN?

Paper statistics

Downloads
703
Abstract Views
1,965
rank
54,662
PlumX Metrics