Rights on Profiling and Automated Decision Making

Art. 22 GDPR Automated individual decision-making, including profiling; The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

Subject to certain exemptions, you have the right not to be subject to decisions being made about you solely by ‘automated processing’ if the processing produces a legal effect, or similarly significantly affect you.

Where this is occurring, you have the right to request human intervention, to express your concerns and to obtain an explanation as to how the system reached such decisions.

The right does not apply when processing decisions do not have a significant effect on you.

Definitions

‘Automated decisions‘(AD) occur when systems use personal data to make a decisions without any human intervention:

The student attendance system compares your attendance against the requirements for your programme.

If you miss a set amount of lectures, this triggers an automated email reminding you of expected attendance levels.

Profiling is automated processing intended to evaluate, analyse, or predict someone’s:

Performance at work	Economic situation	Health	Personal Preferences
Reliability	Behaviour	Location	Movements

Learning analytics tracks your learning activity (attendance, ELP usage) to feed back to you how you can improve your learning experience and grades.

Marketing systems may use information about you to target campaigns relevant to you and you can therefore object to this under ‘the right to object’.

What are exemptions?

This right does not prohibit ‘Automated Decision Making’ (ADM) or ‘Profiling’, where the processing is based on:

Your explicit consent to process – e.g where we have explained the processing to you and you have confirmed that you have consent for us to process in that way.

A lawful processing– where the processing is authorised by UK or European law.

Contract performance – where the processing is necessary for entering into, or performance of, a contract between you and the University

Where processing is required under any of the above, this will be communicated to you and the University shall implement suitable measures to safeguard your rights and freedoms and legitimate interests.

How do I make a complaint and what will happen?

You least the right to obtain human intervention on the part of the University, to express his or her point of view and to contest the decision - This means that you can ask a member of staff to review the decision and make their own judgement.

If you believe that the University is using Automated Decision Making’ (ADM) or ‘Profiling in a manner that adversely affects you, you may complain to the University either directly to the department involved in the processing or, to the University Data Protection Officer dp.officer@northumbria.ac.uk.

How long does the University have to comply?

We must respond to requests without any undue delay.

What must the University do

The University will review the conditions of processing and, where it is not under one of the exemptions, ask for a member of staff to review the decision.

Where the processing is subject to an exemption, you will be informed that this is the case.

What if the University does not comply?

If the University fails to provide a response to your satisfaction, you should raise complaint with the University Data Protection Officer dp.officer@northumbria.ac.uk

If you remain dissatisfied, you may request the ICO to undertake the judicial review: