Page - 44 - in Austrian Law Journal, Volume 1/2019

ALJ 2019 Peter Egger et al 44 entering into, or performance of, a contract between the data subject and the controller.42 On the other hand, such decisions may be permissible if authorized by EU or Member State law. Finally, an automated individual decision is also allowed if the data subject has given its explicit consent.43 In all of these cases, protective measures for the data subjects must be provided. If a (national or European) legal provision outside the GDPR permits automated individual decision-making, it must lay down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests.44 In the other two cases, similar suitable measures shall be implemented by the data controller, including at least the right to obtain human intervention on the part of the controller, to express one’s point of view and to contest the decision.45 As a result, the data subject must never be subjected to a final automated individual decision against his or her will. As already mentioned, Art. 22 does not bar a human decision-maker from relying predominantly on an automated decision preparation.46 This can be questionable as people who make such final decisions will only rarely contradict the recommendations given by algorithms, since these systems give the appearance of a sophisticated objectivity.47 As an additional protection against automated decisions, Articles 13 and 14 of the GDPR contain specific information obligations for the controller.48 Under these provisions, the data subject must be informed where personal data relating to him or her are collected, explicitly revealing the existence of automated decision-making, including profiling, referred to in Art. 22 GDPR. This also has to include meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.49 Nevertheless, this information does not include the disclosure of the used algorithm50 or the training data51 of a machine learning process,52 so that even experts could generally neither evaluate these models nor be able to assess their harmful potential (as we already pointed out in section 2.1.). While it can be assumed that the obligation to provide information includes the disclosure of relevant criteria, the benefit of this disclosure for data subjects might be limited without information on how the algorithm has been 42 According to Art. 22 para 4 GDPR, this exception does not apply where special categories of personal data (Art. 9 GDPR) are concerned; the stated “necessity” refers to the automated decision (reasons could lie, for example, in the speed of the decision to be taken). Cf. von Lewinski, supra note 41, at para 43. 43 In this context, the general conditions for a consent according to Art. 7 GDPR must be observed. 44 Art. 22 para. 2 b) GDPR. 45 Art. 22 para. 3 GDPR. 46 In practice, it will hardly be possible to verify if the actual decision-maker even has the demanded personal flexibility to do so. 47 This supposed objectivity, however, will be hard to verify, since these systems often resort to huge amounts of data in the decision-making process and carry out unknown balancing of interests. 48 Notably, this is not the case regarding automated decision preparations. Martini, Algorithmen als Herausforderung für die Rechtsordnung, 72 JURISTENZEITUNG 1020 (2017). 49 Cf. Art. 13 para. 2 f) and Art. 14 para. 2 g) GDPR. 50 The disclosure of algorithms could at best reveal trade secrets. 51 The publication of the training data could be problematic due to the frequently occurring personal reference. 52 The wording of the rule also does not allow a claim to an exact explanatory statement of the individual decision. Cf. Martini, supra note 48.