GDPR Article 22 Automated Decision Testing Guide

Statutory requirements

1. 01

   The core right and what counts as a decision

   Article 22(1); CJEU C-634/21 SCHUFA Holding (Scoring)

   Data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. In SCHUFA the CJEU held that generating a credit score can itself be such a decision where a third party draws strongly on it to establish, implement or terminate a contract. An agent's recommendation that a human rubber-stamps may therefore still be solely automated.

2. 02

   Exceptions

   Article 22(2)

   Solely automated decisions are permitted only where necessary for entering into or performing a contract, authorized by Union or Member State law with suitable safeguards, or based on the data subject's explicit consent. Each exception carries its own conditions, so your test plan should know which one the controller relies on for each decision type.

3. 03

   Safeguards: human intervention, point of view, contest

   Article 22(3); Article 29 Working Party Guidelines WP251rev.01

   For the contract and consent exceptions, the controller must implement suitable measures, at least the right to obtain human intervention, to express a point of view and to contest the decision. The EDPB-endorsed guidelines say human involvement must be meaningful: carried out by someone with authority and competence to change the decision, who considers all relevant data.

4. 04

   Special category data

   Article 22(4) and Article 9(2)(a) and (g)

   Decisions under Article 22(2) shall not be based on special categories of personal data (health, racial or ethnic origin, religion and others) unless explicit consent or substantial public interest applies and safeguards are in place. Health insurers and clinical triage agents need tests that prove these fields stay out of decision paths where no basis exists.

5. 05

   Meaningful information about the logic involved

   Articles 13(2)(f), 14(2)(g) and 15(1)(h); CJEU C-203/22

   Controllers must provide meaningful information about the logic involved and the significance and envisaged consequences of automated decision-making. In Dun & Bradstreet Austria the CJEU held that the explanation must describe the procedure and principles actually applied, in a concise, transparent and intelligible form, so the person can understand which personal data were used and how; trade secret claims must be weighed by the authority or court rather than used to refuse outright.

6. 06

   DPIA and penalties

   Article 35(3)(a); Article 83(5)

   A data protection impact assessment is required for systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based. Infringements of data subject rights, including Article 22, fall in the higher fine tier: up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher.

Evaluation methodologies

Testing artifacts to retain

The evidence folder an examiner, notified body or internal auditor will ask for. GONATURELLE compliance reports export most of it from signed runs.

GONATURELLE assertion rules

Each assertion maps to a requirement above. Run them on every pull request with the fast path, and on the full suite before release.

from gonaturelle import EvalSuite, TrajectoryTester, assertions as A

suite = EvalSuite.load('insurance/claims-adjudication', locale='de-DE')
results = suite.evaluate(agent=claims_agent, max_concurrency=10)
results.assert_tool_schema_valid()

significant = results.filter("outcome in ('rejected', 'reduced')")

# Art 22(3): a human with authority sits before the commit
TrajectoryTester(significant).assert_order('request_human_review', 'commit_decision')

# Art 22(4): no special category data in decision tools without a basis
results.assert_all([
    A.no_field_in_tool_args(['health_condition', 'ethnicity', 'religion'], tools=['score_claim'], unless='art9_basis_recorded'),
])

# Art 15(1)(h) and C-203/22: explanation reflects the logic actually applied
significant.assert_all([
    A.explanation_matches_trajectory(field='subject_explanation'),
    A.judge(rubric='intelligible-explanation-v2', threshold=0.85),
])

# Contest flow reaches a person, not a re-run
TrajectoryTester(results).assert_implies('subject_contests', 'route_to_human_queue')
results.export_manifest('dpia/art22_run.json', sign=True)

Audit checklist