Right to human intervention in decision-making processes

Automated decision

Some organisations take decisions about people based on automatically processed data. In that case, it is not person that takes the decision, but the computer. Often, organisations use algorithms for this purpose.

We call this an automated decision. For example, the automated assessment of a credit application submitted online. Or the processing of job applications through the Internet without human intervention.

Human intervention

The privacy law GDPR gives people the right to human intervention in automated decision-making processes that concern them and that have consequences for them. For example, that they are denied a loan or not invited to a job interview. This means that the organisation has to take a new decision for which their data were assessed by a human being.

Requirements for automated decision

Automated decision-making is usually prohibited. An organisation is only allowed to take an automated decision about someone in one of the following cases:

• it is necessary for the conclusion or the performance of a contract with this person;
• a law says that it is allowed;
• the person whom it concerns has given explicit consent.

Organisations that take automated decisions have to audit and test their systems on a regular basis. To ensure that the systems work as they are intended to and do not give incorrect outcomes.

Finding out if a decision was made by automated means

Do you find out if an automated decision has been taken about you? Then carefully read the decision you received. Sometimes you can see by the decision that it concerns an automated decision. For example:

• The document says that it was generated automatically.
• The decision has been formulated in general terms.
• The organisation has used profiling.

You can also take a look at the privacy statement of the organisation. If the organisation takes automated decisions, this should be in the privacy statement, including how the organisation makes those decisions.

Do you want to be sure if an automated decision has been taken about you? And based on which logic and which personal data of you this has happened? Then you can make a request for access to the organisation.

Asking for a new decision

Do you disagree with an automated decision which was taken about you by an organisation? And which has major consequences for you, for example, that you cannot take out a loan or insurance? Then you can ask the organisation to take a new decision for which your data are assessed by a human being. You can use our new decision example letter for this purpose.

At Using your privacy rights, you can read about what to do if you want to ask for rectification. And what you can expect from the organisation then. For example: the organisation has to verify your identity first.

Response to a request

The organisation has to give a response to your request within 1 month. Does the organisation decide to take a new decision about you? Then the organisation will have to do this as soon as possible. That is within 1 month at the latest.

• Does the organisation refuse your request? Then the organisation will have to let you know why. Read here what you can do if you do not agree with the refusal.
• Does the organisation not respond within 1 month? Read here what you can do if the organisation does not respond.