Law note · European Union
GDPR Articles 12-22, Data Subject Rights
Articles 12-22 give a data subject access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), portability (Article 20) and objection (Article 21) rights against the controller, ordinarily to be honored within one month, and a right under Article 22 not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, absent a qualifying exception and safeguards including meaningful human review.
The Court of Justice held in SCHUFA (Case C-634/21, 7 December 2023) that an automated credit score a third party relies on to make its own decision falls within Article 22 even though the scoring entity is not the final decision maker.
What it asks of an app
- Honor a data subject's request to access, rectify, erase, restrict, port, or object to processing of their personal data within one month of receipt.
- Provide a meaningful human review before finalizing any decision based solely on automated processing that produces legal or similarly significant effects for a person in the EU.
When LexLint raises it
Declared activities: crawls_web, trains_models, generates_content, deploys_chatbot, automated_outreach, high_risk_decisions
Primary source: Official Journal text, EUR-Lex, Regulation (EU) 2016/679
CJEU Case C-634/21 (SCHUFA)