What Counts as a “Solely Automated Decision” Under GDPR

Article 22 engages only where there is a decision, it is based solely on automated processing, and it has legal or similarly significant effect. Each limb is narrower than it sounds and one of them turned out to be much wider — the Court of Justice has held that a score handed to somebody else can itself be the decision.

The two limbs of Article 22(1)

Article 22(1) of Regulation (EU) 2016/679 gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. Unpacked, three conditions must all hold:

• There is a decision. Not merely an analysis, a score or a classification — though see the next section, because that distinction is less clean than it reads.
• It is based solely on automated processing. Whether an interposed human takes it out of “solely” is the subject of the meaningful human involvement threshold.
• It produces legal effects or similarly significantly affects the person. This is the limb that keeps most machine-learning systems outside the article.

One framing point that matters procedurally: the Court of Justice treated Article 22(1) in SCHUFA not as a right the data subject must invoke but as a general prohibition on such decision-making, subject to the Article 22(2) exceptions. On that reading a controller cannot wait to be objected to; it needs a route into 22(2) before it starts.

SCHUFA: a score can be the decision

In Case C-634/21, SCHUFA Holding, decided on 7 December 2023 and available from the Court of Justice’s case register, the Court considered a German credit reference agency that calculated a probability value representing a person’s ability to service a debt and supplied it to lenders. The agency’s position was straightforward: it does not decide anything, the lender does.

The Court held that the automated establishment of such a probability value constitutes automated individual decision-making within Article 22(1) where a third party to whom the value is transmitted draws strongly on it in deciding whether to establish, implement or terminate a contractual relationship with the data subject. In other words the upstream scorer, not only the downstream decider, can be caught.

This is the most consequential piece of Article 22 case law for AI products, and the reason is structural rather than doctrinal. A very large share of commercial machine learning is sold as “decision support”: the vendor produces a number and disclaims responsibility for what the customer does with it. SCHUFA says that disclaimer does not automatically hold. A tenant-screening score, a fraud propensity, a candidate ranking or an insurance risk band supplied to a customer who follows it can be the Article 22 decision, sitting with the vendor.

The determining-role test

What the Court asked was whether the score plays a determining role in the third party’s decision. That is a factual question about how the recipient behaves, not a legal question about how the contract is drafted, and it produces some uncomfortable consequences for a vendor:

• Your customer’s follow rate is evidence about you. If recipients override the score in a small minority of cases, the score is determining in substance.
• A contractual statement that the output is advisory does not settle it. It is relevant, and it is not dispositive against observed practice.
• The clearer and more actionable the output, the stronger the argument against you. A binary decline is a harder position than a set of factors a human has to weigh — which is a genuine tension with the transparency instinct to make outputs unambiguous.

For controllers deploying somebody else’s model, the corollary is that both parties may be in scope, and the allocation of roles between them is not a matter of preference. Whether you are controller, processor or joint controller for a given operation is analysed separately on joint controllership with an AI vendor, and the AI Act draws its own, different line between provider and deployer that does not map onto the GDPR’s.

Legal effects, or similarly significant

A legal effect is the easy category: something that changes a person’s legal rights or status. Refusal of a benefit, termination of a contract, denial of entry, an immigration outcome.

“Similarly significantly affects” carries the weight. The WP251 guidance describes it as requiring effects sufficiently great or important to be worthy of attention — capable of significantly affecting the circumstances, behaviour or choices of the individual, of having a prolonged or permanent impact, or at its extreme of leading to exclusion or discrimination. The guidance gives credit refusal, e-recruiting without human intervention, and access to health services as examples, and treats most online advertising as outside — while explicitly allowing that targeted advertising can cross the line depending on the intrusiveness of the profiling, the expectations of the person, the way it is delivered, and the vulnerability of the person targeted.

Applied to typical AI features, this limb does most of the exclusion work. A model that reorders a feed, drafts a reply, summarises a document or routes a support ticket to a queue is not producing an Article 22 decision. A model that prices an individual’s insurance, screens them out of a recruitment process, flags them for account closure or determines their eligibility for a service is squarely arguable, and the relevant sectoral pages — AI hiring law among them — assume it is.

Profiling is not automatically in scope

Profiling is defined in Article 4(4) and is much broader than Article 22: any automated processing to evaluate personal aspects, in particular to analyse or predict performance at work, economic situation, health, preferences, interests, reliability, behaviour, location or movements. Almost every personalisation feature is profiling. Almost none of it is an Article 22 decision, because the effect limb is not met.

The mistake this causes runs in both directions. Teams conclude that because they profile, Article 22 applies, and build an expensive human-review layer for a recommendation engine. Or they conclude that because Article 22 does not apply, profiling is unregulated — which is wrong in a more dangerous way, because profiling still needs a lawful basis, still triggers the Article 13(2)(f) and 14(2)(g) transparency duties where Article 22 does apply, may trigger a DPIA under the Article 35 criteria, and always carries the Article 21 right to object where the basis is legitimate interests or public task.

What remains open

Several questions are genuinely unresolved and it is better to say so than to pick a side. How far the SCHUFA determining-role reasoning extends beyond credit scoring to other score-and-supply products has not been tested. Whether a decision assembled from several models, none individually determining, is caught is unaddressed. And the interaction between Article 22(3)’s right to contest and the Article 15(1)(h) right to meaningful information about the logic involved is only partially mapped — the Court gave substance to the latter in Case C-203/22, Dun & Bradstreet Austria, decided 27 February 2025, holding among other things that a claim of trade secrecy does not justify a blanket refusal, but that the information owed is an intelligible account of the procedure and principles actually applied rather than the algorithm itself. What that means in practice for a deep network, as opposed to a scorecard, is not answered by that judgment and is discussed on the Recital 71 explanation question.