Art.22 Automated individual decision-making, including profiling
Do not subject a data subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, unless the decision is necessar
5
artefacts
0
held by a system
2
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- An inventory of automated decisions with the assessment of whether each produces legal or similarly significant effects · Policy repository / GRC workspace
- Records of contested decisions and the outcome of each review · Document repository
governing documentDocuments that govern the control
- The exception relied on for each in scope decision, and for contract based ones the necessity reasoning rather than a convenience argument · Vendor register / contract repository
- The human intervention process, showing the reviewer has the authority and the information to change the outcome · Document repository
- Confirmation of whether special category data, including proxies for it, enters the model, and the safeguards applied where it does · Document repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- A rubber stamp reviewer treated as human involvement, which leaves the decision solely automated in substance
- Necessity for a contract asserted where a manual or hybrid process would work and is merely more expensive
- Special category data entering the model through proxies such as postcode, name or purchase history with no assessment
- No route for the data subject to contest the decision, only a route to complain about service
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetArt.21 Right to object · Art.24 Responsibility of the controller