The Right To Object to Automated Individual Decisions: Resolving the Ambiguity of Article 22(1) of the General Data Protection Regulation

Abstract

This article provides a critical analysis of Article 22(1) of the European Union’s General Data Protection Regulation (‘GDPR’). In particular, the article examines whether, as a matter of lex lata, the enigmatic ‘right not to be subject to a decision based solely on automated processing’ provided for in Article 22(1) should be interpreted as a general prohibition or as a right to be exercised by the data subject. These two possible interpretations offer very different protection to the interests of data subjects and controllers: if the basic rule in Article 22(1) were interpreted as a prohibition, controllers would basically not be allowed to make individual decisions solely based on automated processing, unless one of the specific exceptions specified in Article 22(2) applies; conversely, if that in Article 22(1) were interpreted as a right to be actively exercised, the use of automated individual decisions would normally be restricted under the GDPR only where the data subject has expressly objected to it. Thus, resolving the ambiguity of Article 22(1) is critical to understand what is the scope left for automated decision-making under EU data protection law. Based on a textual, contextual, systematic and teleological interpretation of Article 22(1), the article concludes that such a provision is better characterized as conferring upon data subjects a right that they may exercise at their discretion, rather than establishing a general ban on individual decisions based solely on automated processing.