Rights regarding automated decision-making, representation and compensation

In this video, we have discussed three rights in relation to automated decision-making, representation and compensation.

Currently, various decisions are taken by the systems in an automatic manner. Article 22 GDPR establishes the right not to be subjected to a decision that is based only on an automated processing, including profiling. This right is applicable when such a decision has legal consequences for an individual or in a similar manner significantly affects him or her. If a company, such as Google, automatically collects and processes personal data on the Internet users, engages in profiling and some decisions creating legal effects with regard to them are taken, data subjects can exercise their right not to be subjected to such decision-making.

This right is not applicable when an automated individual decision is needed for entering into a contract or performing a contract between the data subject and a data controller, is authorised by the EU or Member State law to which a controller is subjected and which provides certain safeguards or is based on the explicit consent of the data subject. These decisions may not be based on the special categories of personal data unless it is done with the consent of involved individuals or for reasons of substantial public interest. Also, measures must be introduced safeguarding data subjects’ rights, freedoms and legitimate interests.

Using another right found in Article 80 GDPR, data subjects can allow not-for-profit bodies, organisations or associations to act on their behalf by lodging complaints, receiving compensation and exercising some rights with regard to complaints and judicial remedies. These entities can also have the right to act independently of a data subjects’ mandate if the Member States provide for this possibility.

Finally, if individuals have suffered material or non-material damage as a result of an infringement of the GDPR they entitled to the right to receive compensation from the controller or processor, as stressed in Article 82 GDPR. Controllers involved in the processing are liable for this damage; processors are only liable when they have not complied with their GDPR obligations or acted outside lawful instructions of controllers or contrary to them. Bodies, organisations and associations can also invoke this right on behalf of data subjects. The right to compensation can be exercised before competent courts of EU Member States.