What are the ADM safeguards?

In detail

• What are the safeguards in the ADM provisions?
• What ‘information about decisions’ do we have to provide?
• How do we enable people to make representations?
• What is ‘human intervention’?
• How do we enable people to contest decisions?
• What do we do if someone exercises their rights under the ADM provisions?

What are the safeguards in the ADM provisions?

Article 22C of the UK GDPR says that for ADM, you must:

“…ensure that safeguards for the data subject’s rights, freedoms and legitimate interests are in place which comply with paragraph 2 and any regulations under Article 22D(3)”

“The safeguards must consist of or include measures which—

(a) provide the data subject with information about decisions described in paragraph 1 taken in relation to the data subject;

(b) enable the data subject to make representations about such decisions;

(c) enable the data subject to obtain human intervention on the part of the controller in relation to such decisions;

(d) enable the data subject to contest such decisions.”

These safeguards work to ensure that your ADM processes are fair, lawful and transparent. This also enables people to have the necessary context to decide whether they want to request human intervention or challenge the decision. You must apply the safeguards consistently rather than on an ad hoc discretionary basis. 

What ‘information about decisions’ do we have to provide?

You must provide the person with information about all ADM you carry out about them. 

This means you must explain all ADM to give people an understanding of how you reached the decision. This is decision-specific information about the actual outcome, rather than simply repeating information you provide in your privacy notice about how the system arrives at its decisions and its potential consequences.

This safeguard is distinct from the right to be informed. Its main objective is to empower the person who has been affected by the ADM to meaningfully understand the decision and the specific aspects of their case that influenced it. This understanding is fundamental to them making an informed decision about whether they want to exercise their other rights under the safeguards, such as contesting the decision or obtaining human intervention.

What ‘information about decisions’ looks like – its format, detail and scope - depends on the context. This context may include the: 

• nature of the decisions you make;
• circumstances in which you make them;
• systems you use to do so; and
• specific person affected by them. 

For example, for ADM about a loan, a person might need details about what data was processed, what timeframe it covered, what the system decided, what risk factors the system identified. Only then would they be in a position to challenge the decision.

If the information you provide is incomplete or unclear, people may feel they need to exercise those rights unnecessarily, which can create additional work for you. Clear, transparent explanations help people make informed choices and reduce avoidable burdens on your organisation.

You must ensure your information: 

• is clear and accessible;
• helps people understand the decision you made;
• explains how you reached it; and
• tells them what its actual impact is.

You should include in your information aspects such as:

• which factors contributed to the decision;
• whether profiling was involved;
• whether data from a third-party controller influenced the decision.

If someone is unhappy with the ADM you’ve carried out about them, they have the right to make representations about that decision, obtain human intervention, or contest that decision. You must explain how they can do this. You should do this at the point you provide the decision. 

You should include an explanation of how and why you reached the decision about the specific person, and the impact on them. You must understand the underlying rules that apply to your ADM or factors that have influenced it, so you are able to explain these to people. 

You must provide a concise explanation for the rationale behind the decision about the specific person. You should also be able to verify the ADM results to assist with this. 

You should use a system that is able to deliver an audit trail showing the key decision points that formed the basis for the decision or the factors that were considered at those decision points. If your system considered any alternatives, you should understand why these were not preferred. These details help you demonstrate accountability and allow people to understand and, if necessary, challenge the decision.

How do we enable people to make representations?

Under the ADM provisions, you must enable people to make representations about the decisions you made about them. This means you must give them the opportunity to put forward their point of view about the decision you made. This includes giving them the chance to produce any additional information you may have missed. 

You must make it clear to people that they have this right. 

You should focus on helping people make representations about decisions easily and quickly. If you provide the right information upfront, it increases the chances that any representations they make will be relevant and targeted. This ultimately helps you operate the other safeguards more efficiently. 

How you do this depends on your particular context, including:

• who you are and the nature of your organisation;
• what you do, including the types of services or functions you provide;
• your relationship with the person you are carrying out ADM on;
• the types of decisions involved and their complexity;
• the impact of those decisions on the person;
• what extent people will be able to effectively reverse or mitigate the impacts of your decisions within a certain timeframe; and
• the characteristics and needs of the people you make such decisions about.

What is ‘human intervention’?

The right to obtain human intervention is a key safeguard in the ADM provisions. It means you enable people to have their decision looked at by a human. You must ensure this involves a review of the decision, with the possibility that you could change it.

You should not confuse the concept of ‘human intervention’ with that of ‘human involvement’. These differ in the following ways:

• Human intervention refers to the safeguard that applies after you make a solely automated significant decision about a person. It applies only when what you’re doing is in the scope of the ADM provisions. Human intervention means people can ask for a human to review the decision on a case‑by‑case basis.
• Human involvement refers to the role humans have during the decision-making process. It is one of the key factors in deciding whether the ADM provisions apply in the first place. If a decision includes meaningful human involvement, it is not solely automated. This is the case even if the decision has significant effects on someone.

Like human involvement, human intervention cannot be tokenistic. Human reviewers should:

• assess and review any reconsideration of the decision before it is applied;
• have the ability to influence the outcome;
• have discretion and authority to alter the decision;
• be suitably trained and qualified to understand the system’s outputs, limitations, and risks; and
• take into account the relevant data and factors that the decision was based on.

You should keep a record of how the human reviewed the decision.

To ensure your human intervention process is effective, you should:

• arrange for someone suitably qualified to carry out the review;
• provide the human reviewer with access to all relevant data and original facts that your ADM system used to reach the decision;
• require the reviewer to consider both the relevant data the system used, as well as any additional information or evidence the person affected provides to support their challenge; and
• put in place appropriate training so that your human reviewers understand things like the capabilities and limitations of your ADM systems, relevant technological developments and risks (including bias and discrimination). 

You should also monitor and analyse the outcomes of the human reviews following requests for a human intervention. If human reviewers are regularly changing decisions when people challenge them, it may indicate issues with the performance of your ADM systems that you may need to resolve.  

Spot checking an ADM process doesn’t meet the requirements of this safeguard. This is because the right to obtain human intervention is something that a person actively exercises after you’ve provided them with information about the decision. Spot checking isn’t something that the person instigates themselves. 

How do we enable people to contest decisions?

The provisions also say people have the right to contest the ADM you carry out.

To ensure you facilitate people’s rights appropriately, you must put measures in place for people to challenge or appeal the ADM you carry out. This doesn’t have to be complicated for you to establish or operate.

You must make it clear to people that they have the right to contest your decision and what process they can follow to exercise this right.

What do we do if someone exercises their rights under the ADM provisions?

The ability to make representations, obtain human intervention, and contest decisions, all form part of how people can exercise their data protection rights. In practice, people may essentially exercise all three of these at the same time whenever they challenge a decision. 

In all cases, you must act on the person’s request without undue delay and at the latest within one month of receipt.

You can extend the time to respond by a further two months if the request is complex or if the person makes a number of requests to you. You must: 

• let the person know you are applying an extension without undue delay (and at the latest within one month of receiving their request); and
• explain why the extension is necessary.

You should take these timeframes into account when designing any policy or process for people to contest your decisions.