Legislation – Data Protection Act 2018

Data Protection Act 2018, Cross Heading: Automated individual decision-making is up to date with all changes known to be in force on or before 13 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.

Changes to Legislation

Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.

PART 3Law enforcement processing

CHAPTER 3Rights of the data subject

Automated individual decision-making

F149Right not to be subject to automated decision-making

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F150Automated decision-making authorised by law: safeguards

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F150AAutomated processing and significant decisions

(1)

For the purposes of sections 50B and 50C—

(a)

a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision, and

(b)

a decision is a significant decision, in relation to a data subject, if—

(i)

it produces an adverse legal effect for the data subject, or

(ii)

it has a similarly significant adverse effect for the data subject.

(2)

When considering whether there is meaningful human involvement in the taking of a decision, a person must consider, among other things, the extent to which the decision is reached by means of profiling.

50BRestrictions on automated decision-making based on sensitive processing

(1)

A significant decision based entirely or partly on sensitive processing may not be taken based solely on automated processing, unless one of the following conditions is met.

(2)

The first condition is that the decision is based entirely on processing of personal data to which the data subject has given explicit consent.

(3)

The second condition is that the decision is required or authorised by law.

50CSafeguards for automated decision-making

(1)

Subject to subsection (3), where a significant decision taken by or on behalf of a controller in relation to a data subject is—

(a)

based entirely or partly on personal data, and

(b)

based solely on automated processing,

the controller must ensure that safeguards for the data subject’s rights, freedoms and legitimate interests are in place which comply with subsection (2) and any regulations under section 50D(4).

(2)

The safeguards must consist of or include measures which—

(a)

provide the data subject with information about decisions described in subsection (1) taken in relation to the data subject;

(b)

enable the data subject to make representations about such decisions;

(c)

enable the data subject to obtain human intervention on the part of the controller in relation to such decisions;

(d)

enable the data subject to contest such decisions.

(3)

Subsections (1) and (2) do not apply in relation to a significant decision if—

(a)

exemption from those provisions is required for a reason listed in subsection (4),

(b)

the controller reconsiders the decision as soon as reasonably practicable, and

(c)

there is meaningful human involvement in the reconsideration of the decision.

(4)

Those reasons are—

(a)

to avoid obstructing an official or legal inquiry, investigation or procedure;

(b)

to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

(c)

to protect public security;

(d)

to safeguard national security;

(e)

to protect the rights and freedoms of others.

(5)

When considering whether there is meaningful human involvement in the reconsideration of a decision, a person must consider, among other things, the extent to which the conclusion reached on reconsideration is reached by means of profiling.

50DFurther provision about automated decision-making

(1)

The Secretary of State may by regulations provide that, for the purposes of sections 50A(1)(a) and 50C(3)(c), there is, or is not, to be taken to be meaningful human involvement in the taking or reconsideration of a decision in cases described in the regulations.

(2)

The Secretary of State may by regulations provide that, for the purposes of section 50A(1)(b)(ii), a description of decision is, or is not, to be taken to have a similarly significant adverse effect for the data subject.

(3)

Regulations under subsection (1) or (2) may amend section 50A.

(4)

The Secretary of State may by regulations make the following types of provision about the safeguards required under section 50C(1)—

(a)

provision requiring the safeguards to include measures in addition to those described in section 50C(2),

(b)

provision imposing requirements which supplement what section 50C(2) requires the safeguards to consist of or include (including, for example, provision about how and when things described in section 50C(2) must be done or be capable of being done), and

(c)

provision about measures which are not to be taken to satisfy one or more of paragraphs (a) to (d) of section 50C(2).

(5)

Regulations under this section are subject to the affirmative resolution procedure.