Article 22

Article 22 of the General Data Protection Regulation (Regulation (EU) 2016/679, in force since 25 May 2018) establishes, in paragraph 1, the data subject's right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning him or her or similarly significantly affects him or her. Combined with Article 15(1)(h), it constitutes the European regime of protection against automated decisions, predating the AI Act and partially overlapping with it. Opening the Black Box treats it through the CJEU's case law in SCHUFA (Case C-634/21, December 2023) and Dun & Bradstreet (Case C-203/22, February 2025).