What is ADM under GDPR?
Automated Decision-Making (ADM) covers decisions about individuals made solely by automated means: including profiling: without meaningful human involvement (GDPR Article 22). Article 22 grants data subjects the right not to be subject to such decisions when they produce “legal effects” or “similarly significantly” affect them. Common ADM examples: automated credit scoring, automated CV screening, dynamic pricing, automated fraud blocks.
Article 22 prohibition and exceptions
- Prohibition default: data subjects have a right not to be subject to solely automated decisions with legal/significant effects.
- Exceptions: (a) necessary for performance of a contract; (b) authorised by Union or Member State law with safeguards; (c) based on explicit consent.
- Safeguards for the contract and consent exceptions (Art. 22(3)): at least the right to obtain human intervention, express the data subject’s point of view and contest the decision; under the legal-authorisation exception, the authorising law itself must lay down suitable safeguards.
ADM and AI Act overlap
The EU AI Act overlays additional duties on high-risk ADM (e.g., recruitment scoring, creditworthiness): risk management, data governance, transparency, human oversight (Article 14). For ADM systems classified as high-risk AI, both GDPR Article 22 and AI Act Articles 9-15 apply concurrently.
ADM under KVKK
KVKK Article 11(1)(g) gives the data subject the right to object to a result to their detriment arising from the analysis of processed data exclusively through automated systems: the counterpart of GDPR Article 22. In Turkish practice, explainability and human-intervention mechanisms are increasingly used, particularly in banking (credit scoring), insurance (premium calculation) and employment (pre-screening algorithms).
Do: document the legal basis (contract necessity / consent / law); build human review pathways into the UX; explain logic and consequences in privacy notices.
Don’t: rely on “we have a human somewhere reviewing edge cases”: GDPR requires meaningful intervention by someone authorised to change the outcome.
Sources. Regulation (EU) 2016/679 (GDPR), Regulation (EU) 2024/1689 (AI Act) and Law No. 6698 on the Protection of Personal Data (KVKK). Statute links open the official consolidated Turkish texts on mevzuat.gov.tr.