Automated Decision Making and Profiling

Automated decision making and profiling are regulated by the General Data Protection Regulation (GDPR). How GDPR affects these practices is important to understand.

Automated Decision Making:

Automated decision-making refers to the process of using algorithms and computer programs to make decisions without human intervention. GDPR requires that automated decision-making should not lead to discrimination or unfair treatment of individuals. People also have the right to object to automated decision-making. They can insist that human intervention be introduced in the decision-making process. Here are some examples of automated decision-making under GDPR:

• An online loan company uses an algorithm to decide whether to approve or reject loan applications. Under GDPR, the company must inform applicants if the decision was entirely automated and provide a way for them to appeal the decision.

• A healthcare provider uses a computer program to analyse patient data and determine the best course of treatment. GDPR requires that patients are informed if automated decision-making was used in their treatment. The patients must be given the opportunity to seek a second opinion from a human healthcare professional.

Profiling

Profiling involves the use of personal data to analyse or predict a person’s behaviour, interests, or preferences. GDPR imposes restrictions on profiling and also says people must be informed about the use of their personal data in profiling. Here are some examples of profiling under GDPR:

• A social media company analyses users’ online activity to create personalised advertising. Under GDPR, the company must obtain the user’s explicit consent to use their personal data for profiling, and users have the right to object to profiling practices.

• An online retailer analyses customers’ purchase history to recommend products they may be interested in. GDPR requires that customers are also informed about the use of their data in profiling. This is because they have the right to request that their data be erased in some circumstances, or rectified if it is inaccurate or incomplete.

Automated decision-making and profiling: a Summary

Both of these methods of processing personal data must be carried out in a transparent, fair, and accountable manner. People have the right to be informed about the use of their personal data for both the purposes of automated decision making and profiling. They also have the rights to object, access, and rectify their personal data too.