As has been said, Article 22 of the general data protection regulation provides that a person has
“the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.”
It also provides that there is an exemption to this if the automated decision-making is explicitly provided in law. Section 14 of the Data Protection Act 2018 provides, as has been said, some safeguards based on Article 22 for cases where the law allows automated decision-making on things that may have a significant effect on a person. It provides that where a significant decision is made by automated means, the subject may request that the decision is retaken with human oversight. The section currently provides protections for a decision taken, as has once again been said, “solely” by automated means. The amendment would extend this provision to decisions taken solely “or significantly” by automated means.
The issue of automated decision-making will become, and indeed is becoming, increasingly prevalent in our lives—a point made by all sides during the passage of the 2018 Act, when we tried to add far stronger safeguards to the then Bill to prevent decisions that engaged an individual’s human rights being decided by automated means. On that basis, I am certainly interested in the points raised to extend the right of appeal to decisions that are based “significantly” on automated processing.
Finally, it is potentially concerning that the Government are currently consulting on removing Article 22 of the GDPR and the associated protections from UK law altogether. I believe that consultation closed last week. Can the Government give an indication of when we can expect their response?