Point of law

Automated individual decisions under Art. 22 GDPR

Pre-selection is not a preliminary stage of the decision where the selection follows it to a significant degree. The Court of Justice said so for a probability value produced by a credit agency, and the reasoning applies just as well where software scores applications and HR follows the result.

The software sorts, a human confirms

Software screens incoming applications and assigns each one a score. HR invites the top twenty per cent to interview. Everyone below gets a rejection. A human makes the selection, it is said, because the department sends the invitations.

Pre-selection is the decision where the selection follows it

Whether automated pre-selection is already a decision within the meaning of Art. 22(1) GDPR was answered by the Court of Justice on 7 December 2023 on different facts, and the reasoning reaches further. The case concerned a probability value produced by a credit agency.

The real test follows from this. It is not whether a human is involved but whether the person involved can review the result in substance and actually does so.

Two forms of human involvement

Takes the decision out of Art. 22 GDPR	Merkmal	Does not take it out
Sees the documentsThe reviewing person knows the application and not just the score.	Knowledge of the basis	Sees only the resultA ranking without access to the underlying material.
Can deviateWithout having to justify it to the system or to management.	Authority	Can deviate formallyBut practically never does, because deviation costs effort or justification.
Enough for a reviewThe number of cases per person allows substantive engagement.	Time	Enough for a confirmationHundreds of cases a day produce a sign-off and not a review.
Deviations can be shownIt can be demonstrated that review actually takes place.	Documentation	No deviation on recordThen practice speaks against the review that is claimed.

Rows two and four decide it. An authority to deviate that nobody exercises is a note in the handbook and not human involvement.

Of the three exceptions, two remain in recruitment

Which exception carries the use in recruitment is decided by Art. 22(2) GDPR. The provision names three, and in the employment context they carry different weight.

The three exceptions and how far they carry here

Necessary for the contract, point (a)
Entering into a contract is expressly named. Automation is necessary only where individual review would not be feasible, and that turns on the number of applications, not on convenience.
Authorised by law, point (b)
German law contains no such provision for personnel selection. This exception is regularly unavailable in recruitment.
Explicit consent, point (c)
Possible, but subject to particular scrutiny under section 26(2) BDSG. An applicant stands in a relationship of dependence, and consent without which the process does not continue is not freely given.

3 von 3

Where an exception applies, only the first step is done. Art. 22(3) GDPR requires suitable measures in the cases of points (a) and (c), and it names three rights as the minimum.

The three rights under Art. 22(3) GDPR

To obtain human intervention on the part of the controller, from a person who can deviate
To express one’s own point of view, so to be heard before the final decision
To contest the decision, with a unit that reviews the case afresh

Meaningful information about the logic is more than a vendor name

What has to be said about the scoring follows from Art. 15(1)(h) GDPR and from the parallel provision in Art. 13(2)(f) GDPR. What is required is meaningful information about the logic involved as well as the significance and the envisaged consequences.

What meaningful means and what does not suffice

Which features feed in

The categories of information taken into account, so for instance degree, professional experience, place of residence, gaps in the CV. Disclosure of the model is not required. What is required is that the inputs can be followed.

How they are weighted

How the features relate to one another, at least in order of magnitude. A reference to the vendor’s trade secret does not discharge the duty, because it falls on the controller and not on the vendor.

What the result triggers

Which consequence attaches to which score, so the thresholds for invitation, hold and rejection. That is the significance within the meaning of the provision and the part vendors are most likely to supply.

Scoring that cannot be described at this depth is also not reviewable. The human involvement from the first section then falls away, and the exception in Art. 22(2) GDPR stands without the measures of paragraph 3.

How we support you with automated decisions

An impact assessment under Art. 35(3)(a) GDPR belongs before the roll-out, because the provision names systematic evaluation of personal aspects as a standard case. It settles at the same time whether the human involvement holds up, and it supplies the information needed for the access reply.

Two requirements sit alongside and outside data protection law. A system for selecting applicants is a high-risk system under Annex III no. 4(a) AI Act, and Art. 26(7) AI Act requires workers’ representatives and the affected employees to be informed before use. Co-determination under section 87(1) no. 6 BetrVG applies on top. The conformity assessment, the duties as provider or deployer and enforcement under employment law run through the affiliated law firm.

Frequently asked questions

When is a decision based solely on automated processing?

Where no human reviews it in substance. Involvement that merely confirms the result without being able to review it does not remove that character. The Court of Justice held for an automatically generated probability value that it suffices if the later decision draws on it to a significant degree.

Does Art. 22 GDPR apply before a contract is concluded?

Yes. The provision covers decisions producing legal effects or similarly significant effects, and exclusion from a recruitment process is such an effect. Art. 22(2)(a) GDPR expressly names entering into a contract.

What measures does Art. 22(3) GDPR require?

At least the right to obtain human intervention on the part of the controller, to express one's point of view and to contest the decision. These three rights have to be made available and not merely mentioned.

May special categories feed into it?

Under Art. 22(4) GDPR only where Art. 9(2)(a) or (g) GDPR applies and suitable measures are in place. It also has to be borne in mind that such data can feed in indirectly, for instance through gaps in a CV or through a place of residence.

Get in touch!

Have we sparked your interest? Do you have questions? Would you like a quote without obligation? We look forward to hearing from you!

Alternatively you can request a call back.