[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFB725AXAV3D72PDRMZ6BD":3,"skill-same:01M6AFB725AXAV3D72PDRMZ6BD":88},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":34,"linkOnly":35,"markdownContent":36,"markdownBody":37,"frontMatter":38,"refName":43,"commitSha":44,"skillDirectory":45,"forksCount":46,"repositoryHtmlUrl":47,"repositoryHomepageUrl":6,"ownerHtmlUrl":48,"ownerBlogUrl":49,"ownerDescription":50,"updatedAt":51,"install":52,"resources":65},"01M6AFB725AXAV3D72PDRMZ6BD","ai-automated-decisions",null,"Implements GDPR Art. 22 automated decision-making and AI Act Art. 14 human oversight requirements for AI systems. Covers identification of solely automated decisions, meaningful human intervention design, logic explanation mechanisms, and contestation procedures. Keywords: Art. 22, automated decision, human oversight, AI Act, profiling, contestation.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",336,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fai-automated-decisions\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000032","设计师","PROFESSION","适用职业",[29,30,31,32,33],"ai automated decisions","design","governance","gdpr","privacy","2026-11-10 10:12:30",false,"---\nname: ai-automated-decisions\ndescription: >-\n  Implements GDPR Art. 22 automated decision-making and AI Act Art. 14 human\n  oversight requirements for AI systems. Covers identification of solely\n  automated decisions, meaningful human intervention design, logic explanation\n  mechanisms, and contestation procedures. Keywords: Art. 22, automated\n  decision, human oversight, AI Act, profiling, contestation.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: ai-privacy-governance\n  tags: \"automated-decisions, art-22, human-oversight, ai-act, profiling, contestation\"\n---\n\n# AI Automated Decision-Making and Human Oversight\n\n## Overview\n\nGDPR Article 22 grants data subjects the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal or similarly significant effects. The EU AI Act Art. 14 supplements this with specific human oversight design requirements for high-risk AI systems. Together, these provisions require organisations to identify when AI systems make consequential decisions, ensure meaningful human intervention where required, provide explainable decision logic, and offer effective contestation mechanisms. This skill provides the complete framework for Art. 22 compliance and AI Act human oversight implementation.\n\n## Art. 22 Scope and Applicability\n\n### Three Cumulative Conditions\n\nArt. 22(1) is triggered only when all three conditions are met:\n\n| Condition | Requirement | AI Application |\n|-----------|-------------|----------------|\n| 1. Decision | A decision is made (not merely a recommendation or input) | The AI output directly determines an outcome — no genuine human decision-making step between AI output and action |\n| 2. Solely automated | Based solely on automated processing including profiling | No meaningful human intervention in the decision chain; rubber-stamping does not constitute human intervention |\n| 3. Legal\u002Fsignificant effects | Produces legal effects or similarly significantly affects the data subject | Affects legal rights, contractual status, access to services, financial outcomes, or other significant life impacts |\n\n### \"Solely Automated\" — EDPB Interpretation\n\nThe EDPB Guidelines 06\u002F2020 on automated decision-making clarify:\n\n- **Solely automated** means no meaningful human involvement in the decision process\n- A human who merely confirms an AI recommendation without genuine assessment is not providing meaningful intervention\n- **Meaningful human intervention** requires:\n  - The reviewer has authority and competence to change the decision\n  - The reviewer has access to all relevant information\n  - Sufficient time is allocated for genuine consideration\n  - The reviewer routinely exercises independent judgment (not just confirming AI output)\n  - Override capability is actually used in practice\n\n- **Not solely automated** when:\n  - A qualified human genuinely reviews the AI output as one input among several\n  - The human applies independent judgment and makes the final decision\n  - The human has the capability and actually exercises discretion to deviate from AI recommendations\n\n### \"Legal or Similarly Significant Effects\"\n\n| Category | Examples | Significance |\n|----------|----------|-------------|\n| Legal effects | Contract formation\u002Ftermination, legal obligation imposition, legal status determination | Directly affects legal rights |\n| Access to services | Denial of credit, insurance, housing, education, employment | Significantly affects life circumstances |\n| Financial impact | Pricing discrimination, benefit calculation, payment terms | Material financial consequences |\n| Health and safety | Medical diagnosis prioritisation, emergency response triage | Potential physical harm |\n| Freedom and autonomy | Surveillance scoring, movement restriction, content blocking | Affects fundamental freedoms |\n\nEffects that are **not** similarly significant (per EDPB):\n- Personalised advertising (unless it reinforces prejudices about vulnerable groups)\n- Generic recommendation systems (unless they determine access to information)\n- Spam filtering (unless it systematically blocks important communications)\n\n## Art. 22 Exceptions and Safeguards\n\n### Art. 22(2) — Permitted Automated Decisions\n\n| Exception | Condition | Required Safeguards |\n|-----------|-----------|-------------------|\n| Art. 22(2)(a) — Contract necessity | Decision is necessary for entering into or performance of a contract | Art. 22(3) safeguards required |\n| Art. 22(2)(b) — Law authorisation | Authorised by Union or Member State law with suitable measures | Law must provide suitable safeguards |\n| Art. 22(2)(c) — Explicit consent | Based on explicit consent | Art. 22(3) safeguards required |\n\n### Art. 22(3) — Mandatory Safeguards\n\nWhen an Art. 22(2) exception is relied upon, the controller must implement at least:\n\n1. **Right to obtain human intervention**: A qualified person reviews the automated decision\n2. **Right to express point of view**: Data subject can present additional information or context\n3. **Right to contest**: Formal mechanism to challenge the automated decision with review by a different decision-maker\n\n### Art. 22(4) — Special Category Data Restriction\n\nAutomated decisions based on Art. 9 special category data are only permitted under:\n- Art. 9(2)(a) — Explicit consent, OR\n- Art. 9(2)(g) — Substantial public interest based on Union or Member State law\n\nIn both cases, suitable measures to safeguard data subject rights must be in place.\n\n## Human Oversight Design — AI Act Art. 14\n\n### Art. 14 Requirements for High-Risk AI\n\nHigh-risk AI systems must be designed and developed so that they can be effectively overseen by natural persons during use:\n\n| Requirement | Implementation |\n|-------------|---------------|\n| Understand capabilities and limitations | Documentation, training, model cards |\n| Monitor operation | Real-time monitoring dashboards, alert systems |\n| Detect anomalies and dysfunction | Drift detection, performance monitoring |\n| Interpret outputs correctly | Confidence indicators, explanation tools |\n| Override or reverse decisions | Override mechanism with authority chain |\n| Intervene or stop the system | Emergency stop capability |\n| Be aware of automation bias | Training on automation bias, countermeasures |\n\n### Human Oversight Levels\n\n| Level | Description | Art. 22 Compliance | Appropriate When |\n|-------|-------------|-------------------|------------------|\n| Human-in-the-loop (HITL) | Human reviews every AI recommendation before decision | Fully compliant if review is meaningful | High-stakes individual decisions (hiring, credit, medical) |\n| Human-on-the-loop (HOTL) | Human monitors AI decisions and can intervene | Compliant if intervention capability is genuine and exercised | Medium-risk decisions with effective monitoring |\n| Human-in-command (HIC) | Human sets parameters and reviews outcomes periodically | May not satisfy Art. 22 — decision is solely automated | Low-risk bulk decisions with periodic audit |\n| Fully autonomous | No human oversight of individual decisions | Art. 22 applies fully — exception needed | Only where Art. 22(2) exception applies with Art. 22(3) safeguards |\n\n### Meaningful Human Intervention Criteria\n\nA human review qualifies as \"meaningful intervention\" when all criteria are met:\n\n| Criterion | Test | Red Flag |\n|-----------|------|----------|\n| **Authority** | Reviewer has formal authority to override AI | Reviewer can only escalate, not decide |\n| **Competence** | Reviewer has domain expertise to evaluate the decision | Reviewer is a junior staff member without training |\n| **Information** | Reviewer has access to all inputs, the AI output, and explanation | Reviewer sees only AI score with no context |\n| **Time** | Sufficient time allocated for genuine consideration | Reviewer processes 200+ decisions per hour |\n| **Independence** | Reviewer exercises genuine judgment | Override rate is \u003C 1% suggesting rubber-stamping |\n| **Accountability** | Reviewer is accountable for the decision | Accountability rests with the AI system owner, not reviewer |\n\n## Contestation and Appeal Mechanism\n\n### Design Requirements\n\n| Element | Requirement |\n|---------|-------------|\n| Accessibility | Contestation mechanism is easy to find, access, and use |\n| Timeliness | Defined response timeframe (e.g., 30 days) |\n| Qualified reviewer | Different from the original decision context; has authority to overturn |\n| Information provision | Data subject receives explanation of decision factors and how to contest |\n| Evidence consideration | Data subject can submit additional evidence and context |\n| Written outcome | Decision on contestation is documented and communicated |\n| Further appeal | If contestation is denied, path to DPA complaint or judicial remedy is indicated |\n\n### Contestation Workflow\n\n1. Data subject notified of automated decision with explanation\n2. Data subject submits contestation with reasons and any supporting evidence\n3. Contestation assigned to qualified human reviewer (different from original oversight)\n4. Reviewer assesses: AI inputs, AI output, explanation, data subject's arguments\n5. Reviewer makes independent decision: uphold, modify, or overturn\n6. Outcome communicated to data subject with reasons\n7. If upheld: data subject informed of further options (DPA complaint, judicial remedy)\n8. Record maintained in rights exercise register\n\n## AI-Specific Decision Categories\n\n### Credit and Financial Decisions\n\n- **AI application**: Credit scoring, loan approval, insurance pricing, fraud detection\n- **Art. 22 trigger**: Yes — determines access to financial services\n- **Required**: Meaningful human review before denial; explanation of key scoring factors; contestation with independent review\n- **Enforcement**: AEPD fined CaixaBank EUR 6M for automated credit decisions without adequate safeguards\n\n### Employment Decisions\n\n- **AI application**: CV screening, candidate ranking, performance scoring, termination prediction\n- **Art. 22 trigger**: Yes — significantly affects employment and livelihood\n- **Required**: Human hiring manager makes final decision with genuine authority to deviate from AI ranking; applicants informed of AI use; rejected candidates can request explanation\n- **Enforcement**: Italian DPA fined Deliveroo EUR 2.5M for algorithmic worker management without Art. 22 safeguards\n\n### Healthcare Decisions\n\n- **AI application**: Diagnosis assistance, treatment recommendations, triage, risk scoring\n- **Art. 22 trigger**: Yes if AI determines care pathway — usually mitigated by physician oversight\n- **Required**: Physician makes final clinical decision; AI functions as decision support; patient informed of AI role\n- **Special category**: Health data — Art. 22(4) applies\n\n### Public Administration\n\n- **AI application**: Benefit eligibility, fraud detection, risk assessment, resource allocation\n- **Art. 22 trigger**: Yes — determines access to public services and benefits\n- **Required**: Art. 22(2)(b) legal basis required; suitable measures mandated by law; transparency about algorithmic criteria\n- **Enforcement**: Dutch court struck down SyRI fraud detection system for lack of transparency and proportionality\n\n## Profiling Assessment\n\n### GDPR Definition of Profiling (Art. 4(4))\n\nAny form of automated processing to evaluate personal aspects relating to a natural person, in particular to analyse or predict:\n- Work performance\n- Economic situation\n- Health\n- Personal preferences\n- Interests\n- Reliability\n- Behaviour\n- Location\n- Movements\n\n### AI Profiling Risk Assessment\n\n| Profiling Type | Risk Level | Art. 22 Trigger | Mitigation |\n|---------------|-----------|-----------------|------------|\n| Behavioural prediction (purchasing, browsing) | Medium | Only if decision with legal\u002Fsignificant effect | Opt-out, transparency |\n| Credit scoring \u002F financial risk | High | Yes — access to financial services | Human review, explanation, contestation |\n| Health risk prediction | Very High | Yes — Art. 22(4) applies | Explicit consent, physician oversight |\n| Criminal risk assessment | Very High | Yes — liberty and legal effects | Legal basis required, judicial oversight |\n| Employment performance scoring | High | Yes — employment effects | HR human review, employee notification |\n| Social scoring | Prohibited | N\u002FA — AI Act Art. 5 prohibition | Do not implement |\n\n## Enforcement Precedents\n\n- **AEPD v. CaixaBank (PS\u002F00421\u002F2020, 2021)**: EUR 6M fine for automated credit decision-making without adequate Art. 22 safeguards, explanation, or contestation mechanism.\n- **Italian DPA v. Deliveroo (2021)**: EUR 2.5M fine for algorithmic management of delivery riders — Art. 22 applied to automated work allocation and performance scoring.\n- **Dutch Court v. SyRI (2020)**: Algorithmic fraud detection system struck down — automated profiling of citizens without proportionality, transparency, or adequate safeguards.\n- **Hungarian DPA v. Bank (2019)**: Fine for automated credit denial without providing meaningful information about decision logic or contestation mechanism.\n- **French Conseil d'Etat v. Parcoursup (2019)**: Court upheld use of algorithm for university admissions only because meaningful human review was genuinely conducted for each application.\n- **Austrian DPA v. CRIF (2023)**: Credit scoring company — violation of Art. 15(1)(h) for failing to provide meaningful information about automated scoring logic.\n\n## Integration Points\n\n- **ai-transparency-reqs**: Explanation requirements feed into transparency framework\n- **ai-dpia**: Human oversight assessment is DPIA Phase 5 component\n- **ai-data-subject-rights**: Right to explanation and contestation are rights exercise procedures\n- **ai-deployment-checklist**: Art. 22 compliance is pre-deployment validation item\n- **ai-bias-special-category**: Bias in automated decisions creates Art. 22 harm\n","# AI Automated Decision-Making and Human Oversight\n\n## Overview\n\nGDPR Article 22 grants data subjects the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal or similarly significant effects. The EU AI Act Art. 14 supplements this with specific human oversight design requirements for high-risk AI systems. Together, these provisions require organisations to identify when AI systems make consequential decisions, ensure meaningful human intervention where required, provide explainable decision logic, and offer effective contestation mechanisms. This skill provides the complete framework for Art. 22 compliance and AI Act human oversight implementation.\n\n## Art. 22 Scope and Applicability\n\n### Three Cumulative Conditions\n\nArt. 22(1) is triggered only when all three conditions are met:\n\n| Condition | Requirement | AI Application |\n|-----------|-------------|----------------|\n| 1. Decision | A decision is made (not merely a recommendation or input) | The AI output directly determines an outcome — no genuine human decision-making step between AI output and action |\n| 2. Solely automated | Based solely on automated processing including profiling | No meaningful human intervention in the decision chain; rubber-stamping does not constitute human intervention |\n| 3. Legal\u002Fsignificant effects | Produces legal effects or similarly significantly affects the data subject | Affects legal rights, contractual status, access to services, financial outcomes, or other significant life impacts |\n\n### \"Solely Automated\" — EDPB Interpretation\n\nThe EDPB Guidelines 06\u002F2020 on automated decision-making clarify:\n\n- **Solely automated** means no meaningful human involvement in the decision process\n- A human who merely confirms an AI recommendation without genuine assessment is not providing meaningful intervention\n- **Meaningful human intervention** requires:\n  - The reviewer has authority and competence to change the decision\n  - The reviewer has access to all relevant information\n  - Sufficient time is allocated for genuine consideration\n  - The reviewer routinely exercises independent judgment (not just confirming AI output)\n  - Override capability is actually used in practice\n\n- **Not solely automated** when:\n  - A qualified human genuinely reviews the AI output as one input among several\n  - The human applies independent judgment and makes the final decision\n  - The human has the capability and actually exercises discretion to deviate from AI recommendations\n\n### \"Legal or Similarly Significant Effects\"\n\n| Category | Examples | Significance |\n|----------|----------|-------------|\n| Legal effects | Contract formation\u002Ftermination, legal obligation imposition, legal status determination | Directly affects legal rights |\n| Access to services | Denial of credit, insurance, housing, education, employment | Significantly affects life circumstances |\n| Financial impact | Pricing discrimination, benefit calculation, payment terms | Material financial consequences |\n| Health and safety | Medical diagnosis prioritisation, emergency response triage | Potential physical harm |\n| Freedom and autonomy | Surveillance scoring, movement restriction, content blocking | Affects fundamental freedoms |\n\nEffects that are **not** similarly significant (per EDPB):\n- Personalised advertising (unless it reinforces prejudices about vulnerable groups)\n- Generic recommendation systems (unless they determine access to information)\n- Spam filtering (unless it systematically blocks important communications)\n\n## Art. 22 Exceptions and Safeguards\n\n### Art. 22(2) — Permitted Automated Decisions\n\n| Exception | Condition | Required Safeguards |\n|-----------|-----------|-------------------|\n| Art. 22(2)(a) — Contract necessity | Decision is necessary for entering into or performance of a contract | Art. 22(3) safeguards required |\n| Art. 22(2)(b) — Law authorisation | Authorised by Union or Member State law with suitable measures | Law must provide suitable safeguards |\n| Art. 22(2)(c) — Explicit consent | Based on explicit consent | Art. 22(3) safeguards required |\n\n### Art. 22(3) — Mandatory Safeguards\n\nWhen an Art. 22(2) exception is relied upon, the controller must implement at least:\n\n1. **Right to obtain human intervention**: A qualified person reviews the automated decision\n2. **Right to express point of view**: Data subject can present additional information or context\n3. **Right to contest**: Formal mechanism to challenge the automated decision with review by a different decision-maker\n\n### Art. 22(4) — Special Category Data Restriction\n\nAutomated decisions based on Art. 9 special category data are only permitted under:\n- Art. 9(2)(a) — Explicit consent, OR\n- Art. 9(2)(g) — Substantial public interest based on Union or Member State law\n\nIn both cases, suitable measures to safeguard data subject rights must be in place.\n\n## Human Oversight Design — AI Act Art. 14\n\n### Art. 14 Requirements for High-Risk AI\n\nHigh-risk AI systems must be designed and developed so that they can be effectively overseen by natural persons during use:\n\n| Requirement | Implementation |\n|-------------|---------------|\n| Understand capabilities and limitations | Documentation, training, model cards |\n| Monitor operation | Real-time monitoring dashboards, alert systems |\n| Detect anomalies and dysfunction | Drift detection, performance monitoring |\n| Interpret outputs correctly | Confidence indicators, explanation tools |\n| Override or reverse decisions | Override mechanism with authority chain |\n| Intervene or stop the system | Emergency stop capability |\n| Be aware of automation bias | Training on automation bias, countermeasures |\n\n### Human Oversight Levels\n\n| Level | Description | Art. 22 Compliance | Appropriate When |\n|-------|-------------|-------------------|------------------|\n| Human-in-the-loop (HITL) | Human reviews every AI recommendation before decision | Fully compliant if review is meaningful | High-stakes individual decisions (hiring, credit, medical) |\n| Human-on-the-loop (HOTL) | Human monitors AI decisions and can intervene | Compliant if intervention capability is genuine and exercised | Medium-risk decisions with effective monitoring |\n| Human-in-command (HIC) | Human sets parameters and reviews outcomes periodically | May not satisfy Art. 22 — decision is solely automated | Low-risk bulk decisions with periodic audit |\n| Fully autonomous | No human oversight of individual decisions | Art. 22 applies fully — exception needed | Only where Art. 22(2) exception applies with Art. 22(3) safeguards |\n\n### Meaningful Human Intervention Criteria\n\nA human review qualifies as \"meaningful intervention\" when all criteria are met:\n\n| Criterion | Test | Red Flag |\n|-----------|------|----------|\n| **Authority** | Reviewer has formal authority to override AI | Reviewer can only escalate, not decide |\n| **Competence** | Reviewer has domain expertise to evaluate the decision | Reviewer is a junior staff member without training |\n| **Information** | Reviewer has access to all inputs, the AI output, and explanation | Reviewer sees only AI score with no context |\n| **Time** | Sufficient time allocated for genuine consideration | Reviewer processes 200+ decisions per hour |\n| **Independence** | Reviewer exercises genuine judgment | Override rate is \u003C 1% suggesting rubber-stamping |\n| **Accountability** | Reviewer is accountable for the decision | Accountability rests with the AI system owner, not reviewer |\n\n## Contestation and Appeal Mechanism\n\n### Design Requirements\n\n| Element | Requirement |\n|---------|-------------|\n| Accessibility | Contestation mechanism is easy to find, access, and use |\n| Timeliness | Defined response timeframe (e.g., 30 days) |\n| Qualified reviewer | Different from the original decision context; has authority to overturn |\n| Information provision | Data subject receives explanation of decision factors and how to contest |\n| Evidence consideration | Data subject can submit additional evidence and context |\n| Written outcome | Decision on contestation is documented and communicated |\n| Further appeal | If contestation is denied, path to DPA complaint or judicial remedy is indicated |\n\n### Contestation Workflow\n\n1. Data subject notified of automated decision with explanation\n2. Data subject submits contestation with reasons and any supporting evidence\n3. Contestation assigned to qualified human reviewer (different from original oversight)\n4. Reviewer assesses: AI inputs, AI output, explanation, data subject's arguments\n5. Reviewer makes independent decision: uphold, modify, or overturn\n6. Outcome communicated to data subject with reasons\n7. If upheld: data subject informed of further options (DPA complaint, judicial remedy)\n8. Record maintained in rights exercise register\n\n## AI-Specific Decision Categories\n\n### Credit and Financial Decisions\n\n- **AI application**: Credit scoring, loan approval, insurance pricing, fraud detection\n- **Art. 22 trigger**: Yes — determines access to financial services\n- **Required**: Meaningful human review before denial; explanation of key scoring factors; contestation with independent review\n- **Enforcement**: AEPD fined CaixaBank EUR 6M for automated credit decisions without adequate safeguards\n\n### Employment Decisions\n\n- **AI application**: CV screening, candidate ranking, performance scoring, termination prediction\n- **Art. 22 trigger**: Yes — significantly affects employment and livelihood\n- **Required**: Human hiring manager makes final decision with genuine authority to deviate from AI ranking; applicants informed of AI use; rejected candidates can request explanation\n- **Enforcement**: Italian DPA fined Deliveroo EUR 2.5M for algorithmic worker management without Art. 22 safeguards\n\n### Healthcare Decisions\n\n- **AI application**: Diagnosis assistance, treatment recommendations, triage, risk scoring\n- **Art. 22 trigger**: Yes if AI determines care pathway — usually mitigated by physician oversight\n- **Required**: Physician makes final clinical decision; AI functions as decision support; patient informed of AI role\n- **Special category**: Health data — Art. 22(4) applies\n\n### Public Administration\n\n- **AI application**: Benefit eligibility, fraud detection, risk assessment, resource allocation\n- **Art. 22 trigger**: Yes — determines access to public services and benefits\n- **Required**: Art. 22(2)(b) legal basis required; suitable measures mandated by law; transparency about algorithmic criteria\n- **Enforcement**: Dutch court struck down SyRI fraud detection system for lack of transparency and proportionality\n\n## Profiling Assessment\n\n### GDPR Definition of Profiling (Art. 4(4))\n\nAny form of automated processing to evaluate personal aspects relating to a natural person, in particular to analyse or predict:\n- Work performance\n- Economic situation\n- Health\n- Personal preferences\n- Interests\n- Reliability\n- Behaviour\n- Location\n- Movements\n\n### AI Profiling Risk Assessment\n\n| Profiling Type | Risk Level | Art. 22 Trigger | Mitigation |\n|---------------|-----------|-----------------|------------|\n| Behavioural prediction (purchasing, browsing) | Medium | Only if decision with legal\u002Fsignificant effect | Opt-out, transparency |\n| Credit scoring \u002F financial risk | High | Yes — access to financial services | Human review, explanation, contestation |\n| Health risk prediction | Very High | Yes — Art. 22(4) applies | Explicit consent, physician oversight |\n| Criminal risk assessment | Very High | Yes — liberty and legal effects | Legal basis required, judicial oversight |\n| Employment performance scoring | High | Yes — employment effects | HR human review, employee notification |\n| Social scoring | Prohibited | N\u002FA — AI Act Art. 5 prohibition | Do not implement |\n\n## Enforcement Precedents\n\n- **AEPD v. CaixaBank (PS\u002F00421\u002F2020, 2021)**: EUR 6M fine for automated credit decision-making without adequate Art. 22 safeguards, explanation, or contestation mechanism.\n- **Italian DPA v. Deliveroo (2021)**: EUR 2.5M fine for algorithmic management of delivery riders — Art. 22 applied to automated work allocation and performance scoring.\n- **Dutch Court v. SyRI (2020)**: Algorithmic fraud detection system struck down — automated profiling of citizens without proportionality, transparency, or adequate safeguards.\n- **Hungarian DPA v. Bank (2019)**: Fine for automated credit denial without providing meaningful information about decision logic or contestation mechanism.\n- **French Conseil d'Etat v. Parcoursup (2019)**: Court upheld use of algorithm for university admissions only because meaningful human review was genuinely conducted for each application.\n- **Austrian DPA v. CRIF (2023)**: Credit scoring company — violation of Art. 15(1)(h) for failing to provide meaningful information about automated scoring logic.\n\n## Integration Points\n\n- **ai-transparency-reqs**: Explanation requirements feed into transparency framework\n- **ai-dpia**: Human oversight assessment is DPIA Phase 5 component\n- **ai-data-subject-rights**: Right to explanation and contestation are rights exercise procedures\n- **ai-deployment-checklist**: Art. 22 compliance is pre-deployment validation item\n- **ai-bias-special-category**: Bias in automated decisions creates Art. 22 harm\n",{"name":5,"license":15,"metadata":39,"description":7},{"tags":40,"author":9,"domain":33,"version":41,"subdomain":42},"automated-decisions, art-22, human-oversight, ai-act, profiling, contestation","1.0","ai-privacy-governance","main","9b2ef9eae161c00a17241d42a388571321b33e9f","skills\u002Fprivacy\u002Fai-automated-decisions",67,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":53,"prompt":63,"zipAvailable":64},[54,57,60],{"tool":55,"command":56},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill ai-automated-decisions",{"tool":58,"command":59},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill ai-automated-decisions",{"tool":61,"command":62},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill ai-automated-decisions","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fai-automated-decisions\u002FSKILL.md",true,[66,72,78,82],{"path":67,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":70,"sourceHtmlUrl":71},"assets\u002Ftemplate.md","ASSET","资产文件",4214,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fai-automated-decisions\u002Fassets\u002Ftemplate.md",{"path":73,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"references\u002Fstandards.md","REFERENCE","参考文档",6264,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fai-automated-decisions\u002Freferences\u002Fstandards.md",{"path":79,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":80,"sourceHtmlUrl":81},"references\u002Fworkflows.md",10762,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fai-automated-decisions\u002Freferences\u002Fworkflows.md",{"path":83,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"scripts\u002Fprocess.py","SCRIPT","脚本",15391,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fai-automated-decisions\u002Fscripts\u002Fprocess.py",[89,114,130,143,160,173],{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":104,"publishedAt":34},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[95,98,101],{"categoryNo":96,"categoryName":97,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":99,"categoryName":100,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":102,"categoryName":103,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000037","律师与法务",[105,106,33,107,108,109,110,111,112,113],"email","workplace email privacy","compliance","content","data","policy","testing","monitoring","metadata",{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":124,"publishedAt":34},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[120,123],{"categoryNo":121,"categoryName":122,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000033","数据分析师",{"categoryNo":102,"categoryName":103,"taxonomyType":26,"taxonomyTypeDesc":27},[109,125,126,127,107,128,32,33,129],"whistleblower data","identity","reporting","data protection","prevention",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":137,"publishedAt":34},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[136],{"categoryNo":121,"categoryName":122,"taxonomyType":26,"taxonomyTypeDesc":27},[109,138,139,140,141,32,33,142],"vendor termination data","planning","verification","extraction","certification",{"skillNo":144,"name":145,"nameZh":6,"description":146,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":150,"publishedAt":34},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[149],{"categoryNo":121,"categoryName":122,"taxonomyType":26,"taxonomyTypeDesc":27},[151,152,153,154,155,156,157,158,33,109,159],"vendor risk scoring","risk","risk scoring","methodology","risk-scoring","assessment","transfer","certifications","processor",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":167,"publishedAt":34},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[166],{"categoryNo":102,"categoryName":103,"taxonomyType":26,"taxonomyTypeDesc":27},[33,168,32,169,156,170,171,109,159,152,142,172],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":186,"publishedAt":34},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[179,182,185],{"categoryNo":180,"categoryName":181,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":183,"categoryName":184,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":102,"categoryName":103,"taxonomyType":26,"taxonomyTypeDesc":27},[187,188,33,189,140,190,107,32,191,159,192,193,194,139],"vendor privacy audit","audit","report","audit report","remediation","collection","remediation-tracking","classification"]