Increasingly, algorithms regulate our lives. Personal data is routinely processed on an unprecedented scale in both private and public sectors. This shift from more subjective and less structured human decision-making processes to automated ones has provoked numerous concerns with regard to the rights and freedoms of natural persons affected. In particular, those attached to profiling that can lead to discrimination influencing crucial opportunities of individuals, such as the ability to obtain credit, insurance, education, a job or even medical treatment. To the extent that automated individual decision-making is based on personal data, in the European Union it is subject to the General Data Protection Regulation.
The author examines whether this legislative act affords sufficient protection of natural persons with regard to such processing, identifying the loopholes that hinder or prevent its efficacy and the de lege lata rules and de lege ferenda postulates that could provide individuals with effective protection in relation to automated individual decision-making. She provides an in-depth analysis of such aspects as the following:
- the GDPR's background, terminology and material and territorial scope of application;
- key concerns regarding automated individual decision-making;
- specific and general provisions of the GDPR relevant to protection of natural persons with regard to automated individual decision-making;
- special and general rights of the data subject relevant to automated individual decision-making provided for in the GDPR;
- key limitations to algorithmic transparency;
- how profiling can create special categories of personal data by inference from 'ordinary' personal data; and
- how the version of reality derived from personal data is often at least partially inaccurate.
To interpret the rules of the GDPR, the analysis draws on the travaux préparatoires, case law of the Court of Justice of the European Union and national courts that concerns the previous Data Protection Directive, guidelines and opinions of the Article 29 Working Party and the European Data Protection Board, various reports and recommendations and numerous academic writings.
In its consideration of some of the most controversial issues in the realm of personal data protection - issues whose role in the information society will grow rapidly - this book represents a major contribution to research and legal guidance at the confluence of law and new technologies concerning algorithmic accountability. Policymakers, regulators and lawyers active in the ongoing development of personal data protection law will become knowledgeable about interpretations and guidelines formulated by European data protection authorities, as well as examples and best practices in the field. Moreover practitioners will find the implementation of automated individual decision-making systems in accordance with the GDPR greatly facilitated. The analysis will assist data protection authorities and judicature in assessing such systems and interpreting the GDPR framework with regard to protection of natural persons in the years to come.
