GDPR Article 22: the right not to be subject to a solely automated decision
Article 22 of Regulation (EU) 2016/679 gives a data subject the right not to be subject to a decision based solely on automated processing which produces legal or similarly significant effects, and, where such processing is permitted, safeguards including the right to obtain human intervention, to express a view and to contest the decision. It is satisfied by a human's intervention; it does not require that the human verified anything.
When this decides something for you
A compliance officer, a privacy counsel or a reader comparing regimes asks whether the right that data-protection law already gives against automated decisions is the same as the litigant's entitlement this library defines. It is the nearest existing right and it is not the same, and the difference is what the definition turns on.
What the provision is
Article 22 of the General Data Protection Regulation, in force across the European Union since 25 May 2018 and copied in substance into several later regimes. Article 22(1) provides that the data subject "shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her". Article 22(2) permits such decisions where necessary for a contract, authorised by law with safeguards, or based on explicit consent. Article 22(3) requires the controller, in the contract and consent cases, to implement suitable safeguards "which should include at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision".
What it gives
A right against decisions in which no human takes part, and, where automation is allowed, a right to bring a human in. The subject is the data subject; the duty-bearer is the controller; the remedy is intervention, expression and contest. The provision is the origin of the "human in the loop" vocabulary that most AI governance instruments now use.
What it does not give
It does not reach a decision that a human made on machine material the human did not check. A decision in which an official read a machine's summary, adopted it, and signed is not "based solely on automated processing"; a human was in the loop. The safeguard of human intervention is met by the human's presence, and nothing in the Article asks what the human did.
That is the gap between this provision and the litigant's entitlement in the canon. The failures in the Indian record were all decisions with a human in the loop: a trial judge who signed an order with four non-existent authorities in it; a tribunal that relied on precedents no counsel had cited; an adjudicating officer whose order cited cases that did not hold what he attributed to them. Article 22 would have been satisfied in each. Cognitive sovereignty, as this library defines it, is breached in each, because it is indexed to verification and ownership by the human, not to the human's presence.
Why the distinction matters beyond Europe
The Supreme Court of India's draft Regulations for Use of Artificial Intelligence in Courts, 2026 adopt the loop vocabulary ("mandatory Human-in-the-Loop", Regulation 20(1)(c)) and then go one step past Article 22: Regulation 8(3) makes AI output advisory and requires reasonable care to verify it before use, and Regulation 8(1) makes the officer exclusively accountable. The step from presence to verification is the step from Article 22 to the entitlement, and it is the step every instrument written after the fabricated-authority cases has had to take.
Where it stands in the record
The quoted text was read from the EUR-Lex consolidated page on the date above. Before the page is cited in any filed document the words are checked against the archived Regulation, and the Article is cited with its Official Journal reference.
Provenance and method.
Where this was published
- Regulation (EU) 2016/679 (General Data Protection Regulation)
- Article 22 (EUR-Lex text
- read 25 September 2026; quotation to be confirmed against the archived Regulation)
Changelog
- 2026-09-25, version 1. First published.