Recommendation 52

The regulation-making powers in the UK GDPR should be used to ensure that there are robust protections against misuse of automated decision-making. The regulations should say that the mere presence of a ‘human in the loop’ is not enough to constitute meaningful human involvement or intervention. It should be necessary to show that the person is sufficiently informed and independent to be able to reach an objective view that has not been improperly influenced by the automated decision. The regulations should also say that safeguards include a requirement to provide information relating to the data subject’s individual circumstances rather than the general operation of the system, and that data subjects must be given enough information to allow them to mount an effective challenge against the decision. (Recommendation, Paragraph 218) 81