Is That Your Final Decision? Multi-Stage Profiling, Selective Effects, and Article 22 of the GDPR

By Dr Reuben Binns (Associate Professor, Department of Computer Science at the University of Oxford) and Dr Michael Veale (Associate Professor, UCL Laws)

A yellow padlock and grey chain secured around a black railing

20 October 2021

Publication details

Binns, Reuben and Veale, Michael. (2021) 'Is that your final decision? Multi-stage profiling, selective effects, and Article 22 of the GDPR', International Data Privacy Law, Volume 11, Issue 4, November 2021, Pages 319–332, https://doi.org/10.1093/idpl/ipab020

Summary

Provisions in many data protection laws require a legal basis, or at the very least safeguards, for significant, solely automated decisions; Article 22 of the GDPR is the most notable.
Little attention has been paid to Article 22 in light of decision-making processes with multiple stages, potentially both manual and automated, and which together might impact upon decision subjects in different ways.
Using stylised examples grounded in real-world systems, we raise five distinct complications relating to interpreting Article 22 in the context of such multi-stage profiling systems.