An EU marketing company is planning to make use of personal data captured to make...

Under the GDPR, individuals have the right not to be subject to a decision based solely on automated processing, including profiling, if it produces legal effects concerning them or significantly affects them. This right applies particularly when there is no human intervention in the decision-making process. The GDPR Article 22 specifies that individuals can object to automated decisions that have significant consequences unless the decision is necessary for entering into a contract, authorized by law, or based on explicit consent with appropriate safeguards. Therefore, the company's systems making automated decisions without human involvement must accommodate individuals' rights to opt out to ensure compliance. This interpretation is aligned with GDPR regulations as explained in IAPP's Information Privacy Technologist materials.