The General Data Protection Regulation, Regulation (EU) 2016/679, was adopted on 27 April 2016 and became applicable on 25 May 2018. Although it is a data protection law rather than an AI law, its Article 22 became one of the most cited legal provisions in debates over automated decision-making and is sometimes described as an early “right to explanation.”
Article 22 gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, such as the automated denial of a credit application or an automated hiring decision. The provision allows exceptions where the automated decision is necessary for a contract, authorized by EU or member-state law, or based on the person’s explicit consent. Even then, the controller must put in place safeguards, including the right to obtain human intervention, to express one’s point of view, and to contest the decision. Automated decisions generally may not rely on special categories of sensitive data, and they may not be applied to children.
Article 22 matters because it established, years before purpose-built AI laws, that European law would constrain decisions made by machines about people’s lives. For businesses deploying automated scoring, screening, or pricing systems on EU residents, it remains a binding constraint, and it shaped the human-oversight and contestability ideas later embedded in the EU AI Act.