DATA PROTECTION
EU: AG issues opinion on legal basis and automatic decision-making under the GDPR.
Advocate General ('AG') Priit Pikamäe issued the opinion in case C‑634/21 OQ v Land Hessen concerning a reference for a preliminary ruling on the lawfulness of processing under Article 6(1) of General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') and on automated decision-making under Article 22 of the GDPR.
In particular, the AG took the view that Article 22(1) of the GDPR must be interpreted as meaning that the automated calculation of a probability rate relating to the ability of a data subject to repay a debt in the future already constitutes a 'decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her', where that rate, calculated on the basis of personal data relating to the data subject, is transmitted by the controller to a third party and the latter mostly bases its decision on the conclusion or termination of a contract with the data subject on that rate.
Moreover, the AG considered that Article 6(1) and Article 22 of the GDPR are to be interpreted as meaning that they do not preclude national legislation on profiling where it concerns profiling other than that provided for in Article 22(1) of the GDPR. However, the AG continued, in such instances, the national court must comply with the conditions laid down in Article 6 of the GDPR; specifically, it must rely on an appropriate legal basis, which it is for the national court to verify.
You can read the opinion, available in various languages, here.
In particular, the AG took the view that Article 22(1) of the GDPR must be interpreted as meaning that the automated calculation of a probability rate relating to the ability of a data subject to repay a debt in the future already constitutes a 'decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her', where that rate, calculated on the basis of personal data relating to the data subject, is transmitted by the controller to a third party and the latter mostly bases its decision on the conclusion or termination of a contract with the data subject on that rate.
Moreover, the AG considered that Article 6(1) and Article 22 of the GDPR are to be interpreted as meaning that they do not preclude national legislation on profiling where it concerns profiling other than that provided for in Article 22(1) of the GDPR. However, the AG continued, in such instances, the national court must comply with the conditions laid down in Article 6 of the GDPR; specifically, it must rely on an appropriate legal basis, which it is for the national court to verify.
You can read the opinion, available in various languages, here.
