Skip main navigation

Rights regarding automated decision-making, representation and compensation

Rights not to be subjected to automated individual decision-making, to be represented and to compensation as addressed by Evgeni Moyakine.

In this video, we have discussed three rights in relation to automated decision-making, representation and compensation.

Currently, various decisions are taken by the systems in an automatic manner. Article 22 GDPR establishes the right not to be subjected to a decision that is based only on an automated processing, including profiling. This right is applicable when such a decision has legal consequences for an individual or in a similar manner significantly affects him or her. If a company, such as Google, automatically collects and processes personal data on the Internet users, engages in profiling and some decisions creating legal effects with regard to them are taken, data subjects can exercise their right not to be subjected to such decision-making.

This right is not applicable when an automated individual decision is needed for entering into a contract or performing a contract between the data subject and a data controller, is authorised by the EU or Member State law to which a controller is subjected and which provides certain safeguards or is based on the explicit consent of the data subject. These decisions may not be based on the special categories of personal data unless it is done with the consent of involved individuals or for reasons of substantial public interest. Also, measures must be introduced safeguarding data subjects’ rights, freedoms and legitimate interests.

Using another right found in Article 80 GDPR, data subjects can allow not-for-profit bodies, organisations or associations to act on their behalf by lodging complaints, receiving compensation and exercising some rights with regard to complaints and judicial remedies. These entities can also have the right to act independently of a data subjects’ mandate if the Member States provide for this possibility.

Finally, if individuals have suffered material or non-material damage as a result of an infringement of the GDPR they entitled to the right to receive compensation from the controller or processor, as stressed in Article 82 GDPR. Controllers involved in the processing are liable for this damage; processors are only liable when they have not complied with their GDPR obligations or acted outside lawful instructions of controllers or contrary to them. Bodies, organisations and associations can also invoke this right on behalf of data subjects. The right to compensation can be exercised before competent courts of EU Member States.

This article is from the free online

Understanding the GDPR

Created by
FutureLearn - Learning For Life

Reach your personal and professional goals

Unlock access to hundreds of expert online courses and degrees from top universities and educators to gain accredited qualifications and professional CV-building certificates.

Join over 18 million learners to launch, switch or build upon your career, all at your own pace, across a wide range of topic areas.

Start Learning now