Automated Decision-Making

Automated decision-making means making decisions about a person without human involvement, based on automated analysis of their personal data. Rejecting a loan application through a scoring system, screening out candidates with software, setting insurance premiums by algorithm and automatically closing an account due to suspicious activity are typical examples. Automated decisions are often based on profiling.

The Right to Object under the KVKK

Article 11 of the KVKK gives data subjects the right to object to an outcome against them resulting from analysis of processed data exclusively by automated systems. This right is one of the data subject rights and is exercised by applying to the controller like other requests; the controller must respond within thirty days.

The GDPR Prohibition

Article 22 of the GDPR is stricter: it generally prohibits decisions producing legal effects concerning a person, or similarly significantly affecting them, from being based solely on automated processing. Such decisions are permitted only where necessary for entering into or performing a contract, authorised by law or based on explicit consent. Even then, the person must be given the right to obtain human intervention, express their view and contest the decision.

Practical Points

• For decisions significantly affecting individuals (credit, recruitment, pricing, account closure), genuine human review should be available.
• The data and logic underlying the decision should be explained intelligibly in the privacy notice.
• Algorithms should be tested regularly for discriminatory outcomes.
• AI-based decision systems may also be high-risk under the EU AI Act.