EveryAILaw.com

Requirements at a glance

This regulation imposes 7 specific requirements for Human Oversight across 1 provision:

• ADM definition — Art. 22A(1): a decision is based solely on automated processing where there is no meaningful human involvement; it is a significant decision where it produces a legal effect or a similarly significant effect for the data subject
• Role of profiling — Art. 22A(2): when assessing whether human involvement is meaningful, the extent to which the decision is reached by profiling must be considered — profiling is a factor in the test, not part of the definition
• Special category restriction — Art. 22B(1)-(3): a significant decision based wholly or partly on Article 9(1) special category data may not be taken solely automatically unless the data subject gave explicit consent, or the decision is necessary for a contract or required by law and Article 9(2)(g) applies
• Recognised legitimate interests bar — Art. 22B(4): a significant decision may not be taken solely automatically where the processing relies wholly or partly on Article 6(1)(ea)
• Required safeguards — Art. 22C(1)-(2): where a significant decision is based on personal data and taken solely automatically, the controller must have safeguards that provide information about the decision, enable representations, enable human intervention on the controller's part, and enable the decision to be contested
• Secretary of State powers — Art. 22D: regulations may define when human involvement is or is not meaningful, what counts as a similarly significant effect, and may add to the Art. 22C safeguards, but may not amend Art. 22C; subject to the affirmative resolution procedure
• Law-enforcement analogue out of scope — The lettered ADM sections in the DPA 2018 itself — ss. 50A-50D (Part 3, law-enforcement processing) and s. 96 (Part 4, intelligence services) — are separate regimes and do not apply to the deployers covered here; s. 14 remains the Part 2 safeguard provision for decisions required or authorised by law