What rights do I have over automated decision-making?

What the Law Says

Under Irish law, your rights regarding automated decision-making are set out in the Data Protection Act 2018, which gives effect to the EU General Data Protection Regulation (GDPR). Section 57 specifically addresses decisions made solely by automated means.

The law protects you from decisions that are made entirely by machines—such as algorithms or AI systems—when those decisions have legal effects on you (e.g., denial of credit, rejection of a job application) or similarly significant effects (e.g., exclusion from services, scoring that impacts opportunities).

This right does not apply if the decision is necessary for entering into or performing a contract with you, is authorised by law (and includes suitable safeguards), or is based on your explicit consent. Even then, you must be given meaningful human intervention, the right to express your view, and the right to contest the decision.

You also have the right to obtain human involvement, to express your point of view, and to challenge a fully automated decision. Controllers must respond to such requests without undue delay—and within one month (extendable by two further months where necessary, with explanation).

Statutory Text

A data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

— Data Protection Act 2018, s. 57 — Rights in relation to automated decision-making

What to Do

Sources