The right of access in automated decision-making: the scope of article 15 (1)(h) GDPR in theory and practice

Custers, B., & Heijne, A. S. (2022). The right of access in automated decision-making: the scope of article 15 (1)(h) GDPR in theory and practice. Computer Law & Security Review, 46, 105727.

Abstract

The right of access in Article 15 of the EU General Data Protection Regulation (GDPR) is essential for empowering data subjects when exercising other data subject rights. In the context of automated decision-making, including profiling, Article 15(1)(h) provides a right to meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. In this research, the notions of ‘meaningful information’, ‘the logic involved’, and ‘the significance and the envisaged consequences’ are analysed. Apart from a legal analysis, empirical research was carried out in 30 countries (27 EU and 3 EFTA EEA Member States), consisting of a survey amongst all Data Protection Authorities (DPAs) and interviews with experts of privacy organisations. Several types of potentially meaningful information that could be in scope of right of access requests were assessed, as well as several types of information on the consequences for data subjects. Even though respondents indicate that most of these types of information should be provided upon access requests, the findings show that most of these types of information are rarely or not at all provided in practice. Providing such information strongly depends on the willingness of data controllers to cooperate, as they may balance this against rights and freedoms of others, including intellectual property and trade secrets. Particularly trade secrets are invoked in practice to block or restrict access requests, despite the GDPR stating that these considerations should not lead to a refusal of the request to provide all information to the data subject.