Dpia Automated Decisions

DPIA for Automated Decision-Making Systems

Purpose

Conduct a DPIA specifically tailored to automated decision-making (ADM) and profiling systems that produce legal or similarly significant effects on individuals, as required by GDPR Article 35(3)(a).

Prerequisites

• System documentation for the ADM/profiling system (algorithm design, training data, decision logic)
• Art. 35(3)(a) threshold confirmed: systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions are based that produce legal effects or similarly significantly affect natural persons
• Data categories processed identified, including any Art. 9 special categories
• Existing Art. 22 safeguards documentation if available

Workflow

Step 1: System Description and Scope

Document the ADM system under assessment:

1. System purpose: Business objective and processing purpose
2. Decision types: What decisions the system makes or supports (credit scoring, insurance pricing, recruitment screening, fraud detection, content moderation)
3. Processing scope: Data categories used as inputs, volume of data subjects affected, geographic scope
4. Automation level: Fully automated (no human in loop), semi-automated (human in loop), or automated with human override capability
5. Legal basis: Art. 6(1) basis for the processing, and if Art. 22 applies, the Art. 22(2) exception relied upon (contract, EU/Member State law, explicit consent)

Step 2: Necessity and Proportionality Assessment

Evaluate whether the automated processing is necessary and proportionate:

1. Purpose limitation: Confirm processing purpose is specific, explicit, and legitimate per Art. 5(1)(b)
2. Data minimization: Verify only data strictly necessary for the decision is processed per Art. 5(1)(c)
3. Accuracy: Assess input data quality and its impact on decision accuracy per Art. 5(1)(d)
4. Less intrusive alternatives: Document whether the decision could be made through less automated means
5. Proportionality: Balance the organizational benefit against the impact on individuals' rights and freedoms

Step 3: Risk Identification

Identify risks specific to ADM systems:

1. Discrimination risk: Assess whether the system could produce discriminatory outcomes based on Art. 9 characteristics (race, ethnicity, political opinions, religion, health, sexual orientation)
2. Opacity risk: Evaluate whether the decision logic is explainable to affected individuals per Art. 13(2)(f) and Art. 14(2)(g)
3. Accuracy risk: Assess false positive and false negative rates and their consequences
4. Data quality risk: Evaluate whether training data reflects real-world populations without bias
5. Feedback loop risk: Assess whether the system creates self-reinforcing biases
6. Scope creep risk: Evaluate whether the system could be applied beyond its intended purpose
7. Security risk: Assess adversarial manipulation vectors (data poisoning, model extraction)

Step 4: Art. 22 Compliance Assessment

If the system makes solely automated decisions with legal or similarly significant effects:

1. Art. 22(1) prohibition check: Confirm whether the default prohibition applies
2. Art. 22(2) exception: Document which exception permits the processing:
   • (a) Necessary for entering into or performance of a contract
   • (b) Authorized by EU or Member State law with suitable safeguards
   • (c) Based on explicit consent
3. Art. 22(3) safeguards: Verify implementation of mandatory safeguards:
   • Right to obtain human intervention from the controller
   • Right to express the data subject's point of view
   • Right to contest the decision
4. Art. 22(4) special categories: If Art. 9 data is processed, confirm explicit consent under Art. 9(2)(a) or substantial public interest under Art. 9(2)(g) with suitable safeguards