Profiling and automated decision-making
Profiling and automated decision-making

The following Life Sciences guidance note provides comprehensive and up to date legal information covering:

  • Profiling and automated decision-making
  • What is profiling and automated decision-making?
  • How the GDPR regulates profiling and automated decision-making
  • What is solely automated decision-making, as restricted under Article 22 of the GDPR?
  • Exceptions to the Article 22 restriction
  • Data subject’s specific rights
  • Safeguards
  • Children
  • DPIAs
  • Good practice recommendations

BREXIT: On 31 January 2020, the UK ceased to be an EU Member State and entered an implementation period, during which it continues to be subject to EU law. During this period, the General Data Protection Regulation, Regulation (EU) 2016/679 applies in the UK and the UK generally continues to be treated as an EU (and EEA) state for EEA and UK data protection law purposes. Any references to EEA or EU states in this Practice Note should therefore be read to also include the UK until the end of the implementation period. For further guidance on that period, its duration and the data protection laws that are anticipated to apply after the end of it, see Practice Note: Brexit—implications for data protection.

This Practice Note provides guidance on profiling and automated decision-making and sets out how these are regulated under the General Data Protection Regulation, Regulation (EU) 2016/679 (the GDPR), including consideration of solely automated decision-making as restricted by Article 22(1). It explains the concepts of profiling and automated decision-making, including solely automated decision-making, and sets out how to lawfully undertake processing of this sort, including through the use of safeguards. It also explains special considerations that apply in relation to profiling and making automated decisions about children.

This Practice Note covers:

  1. What is profiling and automated decision-making?

  2. How the GDPR