Regulating automated decision-making in the European Union : Article 22 GDPR and the internal market

Abstract

The General Data Protection Regulation (GDPR) regulates certain instances of ‘automated individual decision-making, including profiling’. ‘Automated decision-making’ refers to the making of a decision solely by automated means without any human involvement, while ‘profiling’ refers to automated processing of personal data to evaluate certain personal aspects relating to an individual ‘such as automatic refusal of an online credit application or e-recruiting practices without any human intervention’. The internal market relies on the free movement of personal data between Member States, which is essential for economic and social integration and the development of the digital economy. Therefore, the GDPR furthers the harmonisation of rules regarding the protection of personal data in order to ensure the free flow of such data within the internal market. In its regulation of automated decision-making processes, the European Union aims to balance the rights of individuals and the interests of the business and government sectors, all within the ambit of the digital economy.