The General Data Protection Regulation introduces in Article 22 a new provision on automated individual decision-making, including profiling. In October 2017 Europe’s data protection authorities organized in the Article 29 Working Party (WP29), published draft guidelines on the interpretation of automated individual decision-making including profiling and asked stakeholders to submit comments on this draft guidelines.
Bitkom welcomes the opportunity to comment on the Art. 29 Working Group’s (WP29) draft opinion on the interpretation of automated individual decision-making including profiling (WP 251). We believe that more cooperation and exchange between data protection authorities and practitioners is needed to translate the legal text of the GDPR into practice and reduce legal uncertainty. In addition to many other provisions of the GDPR, Article 22 must be implemented until May 2018 not only by the digital economy but also by all other sectors. This should not pose a major challenge to companies as the provision does not constitute a fundamental change to current data protection law. Therefore, current legal commentary on Directive 95/46/EC (Directive) as well as jurisprudence (case law), which draw a clear distinction between ‘profiling’ on the one hand and ‘automated decision-making’ (decisions) on the other hand, can be taken into account as reference points for interpretation.