# DPIA for Automated Decisions - Regulatory Standards ## GDPR References ### Article 22 - Automated Individual Decision-Making, Including Profiling **Art. 22(1)**: The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. **Art. 22(2) Exceptions**: Paragraph 1 shall not apply if the decision: - (a) is necessary for entering into, or performance of, a contract between the data subject and a data controller; - (b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or - (c) is based on the data subject's explicit consent. **Art. 22(3) Safeguards**: In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision. **Art. 22(4)**: Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place. ### Article 35(3)(a) - Mandatory DPIA Trigger A data protection impact assessment shall in particular be required in the case of: a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person. ### Article 13(2)(f) and Article 14(2)(g) - Transparency The controller shall provide the data subject with information necessary to ensure fair and transparent processing, including the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. ### Recital 71 - Right to Explanation The data subject should have the right not to be subject to a decision, which may include a measure, evaluating personal aspects relating to him or her which is based solely on automated processing and which produces legal effects concerning him or her or similarly significantly affects him or her, such as automatic refusal of an online credit application or e-recruiting practices without any human intervention. Such processing includes profiling... The data subject should have the right to obtain... an explanation of the decision reached after such assessment and to challenge the decision. ## EDPB/WP29 Guidelines ### WP29 Guidelines on Automated Individual Decision-Making and Profiling (WP251rev.01) **Definition of profiling (Section II.A)**: Any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements. **Similarly significant effects (Section III.B)**: Effects that are equivalent to legal effects in terms of significance, e.g., decisions affecting access to health services, denial of employment opportunity, access to education. **Meaningful information about logic (Section IV)**: Controllers should find simple ways to tell the data subject about the rationale behind or the criteria relied on in reaching the decision. The GDPR requires the controller to provide meaningful information about the logic involved, not necessarily a complex explanation of the algorithms used or disclosure of the full algorithm. **Suitable safeguards (Section V)**: Include regular checks on the accuracy and relevance of automated decisions, algorithmic auditing, independent oversight, and the right for the data subject to request human intervention. ### EDPB Guidelines 06/2020 on the Interplay Between Art. 22 GDPR and Chapter III AI Act Section 4.2 establishes that high-risk AI systems under EU AI Act Annex III that also fall within Art. 22 GDPR scope require both a DPIA under GDPR Art. 35 and a conformity assessment under AI Act Art. 43. The DPIA should reference the conformity assessment findings where available. ## EU AI Act References ### Article 6 - Classification Rules for High-Risk AI Systems AI systems referred to in Annex III shall be considered high-risk. Annex III includes systems used for: - Biometric identification and categorisation of natural persons - Management and operation of critical infrastructure - Education and vocational training (access, assessment) - Employment, workers management, and access to self-employment - Access to and enjoyment of essential private services and public services and benefits (creditworthiness, insurance pricing) - Law enforcement, migration, administration of justice ### Article 14 - Human Oversight High-risk AI systems shall be designed and developed in such a way that they can be effectively overseen by natural persons during the period in which the AI system is in use. Human oversight shall aim to prevent or minimise the risks to health, safety, or fundamental rights that may emerge when a high-risk AI system is used. ## NIST AI Risk Management Framework ### MAP 1.6 Impacts to people in how the AI solution interfaces with or augments human decisions. DPIA should document how the ADM system interfaces with human decision-makers and what override mechanisms exist. ### MEASURE 2.6 Measure or assess the AI system's bias using a variety of measures including statistical tests and demographic analysis. The DPIA bias assessment should reference specific bias metrics applied.