# Standards and Regulatory References

## Primary Legislation

### GDPR (Regulation (EU) 2016/679)
- **Article 22** — Automated individual decision-making, including profiling
- **Article 4(4)** — Definition of profiling
- **Article 15(1)(h)** — Right to meaningful information about automated decision logic
- **Article 13(2)(f)** — Information about automated decisions at point of collection
- **Article 14(2)(g)** — Information about automated decisions for indirect collection
- **Article 9(1)** — Special categories of personal data (restrictions under Art. 22(4))
- **Article 35(3)(a)** — DPIA required for systematic and extensive evaluation of personal aspects based on automated processing, including profiling
- **Recital 71** — Automated decision-making: right to human intervention, to express point of view, to obtain explanation, and to contest
- **Recital 72** — Profiling subject to GDPR rules and appropriate safeguards

### UK Data Protection Act 2018
- **Section 14** — Automated decision-making (supplementary provisions)
- **Section 49** — Automated decision-making (law enforcement processing)

## Regulatory Guidance

### European Data Protection Board (EDPB) / Article 29 Working Party
- **Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679 (WP251 rev.01)** (adopted 6 February 2018): Definitive guidance on the scope of Art. 22, distinguishing types of profiling, defining "solely automated," interpreting "legal effects" and "similarly significant effects," and specifying the standard for meaningful human intervention.
- **Guidelines on Transparency under Regulation 2016/679 (WP260 rev.01)** (adopted 11 April 2018): Guidance on providing meaningful information about automated decision logic in a comprehensible way.

### Information Commissioner's Office (ICO) — United Kingdom
- **Guidance on AI and data protection** (updated 2024): Comprehensive framework for using AI systems in compliance with data protection law, including fairness in algorithmic decision-making.
- **Guidance on automated decision-making and profiling** (updated 2024): Practical implementation guidance for Art. 22 compliance including human intervention standards.

## Technical Standards

### ISO/IEC 27701:2019 — Privacy Information Management
- **Section A.7.4** — Automated decision-making: controls for managing automated decisions within a PIMS framework.

### IEEE 7010-2020 — Recommended Practice for Assessing the Impact of Autonomous and Intelligent Systems on Human Well-Being
- Provides a framework for assessing the societal impact of AI systems, relevant to evaluating the significance of automated decisions.

### NIST AI Risk Management Framework (AI RMF 1.0) — January 2023
- Provides guidance on managing risks in AI systems including transparency, explainability, and human oversight requirements aligned with Art. 22 obligations.