Clare Daly (Dublin Fingal, Independent) | Oireachtas source

I move amendment No. 67:

In page 44, to delete lines 5 and 6 and substitute the following:“him or her to—

(I) make representations to the controller in relation to the decision,

(II) request human intervention in the decision-making process,

(III) request to appeal the decision.(2) In the case of requests made under subsection (1)(b)(ii)(II) or (III) the controller shall—(a) comply with the request, and

(b) notify the data subject in writing of—

(i) the steps taken to comply with the request, and

(ii) in the case of an appeal under subsection (1)(b)(ii)(III), the outcome of the appeal.”.

The GDPR puts several protections in place for people in circumstances where they might be subjected to automated decision-making. Article 22 states that decision-making based on automated processing is prohibited except if a decision made in this way is necessary for entering into a contract between a person and a controller or if it is based on the person’s explicit consent. If these bases are used, then the controller has to implement safeguards, including the right to obtain human intervention and the right to appeal. Article 22 also states decisions can be made on the basis of automated processing if they are authorised by Union or member state law which also lays down suitable measure to safeguard the data subject’s rights, freedoms and legitimate interests.

It is clear that the type of safeguards the GDPR had in mind when public authorities are using automated processing are matters like the right to obtain a human intervention and the right to make an appeal. The Bill, however, does not include those rights. It simply states people can make a representation. We do not believe that is good enough. Article 29 Working Party, the God of guidance on the GDPR, stated on automated processing per Article 22 and recital 71, minimum safeguards must provide an explanation of the decision reached to the data subject, a way for the data subject to obtain human intervention, express their point of view and contest the decision.

In the Bill people have a right to make representations if they are not happy. That is not really much use. It is no guarantee that they will get a human intervention if they want it. There is no obligation, even on a controller, for example, the Department of Employment Affairs and Social Protection processing welfare claims, to respond or deal with representations it gets. As the Bill is currently constituted, it can just ignore them.

That is way too serious. We know for example that in the United States where automated benefit systems operate, it has resulted in millions of benefit applicants being denied over a period of years. Those people at least had the right to an appeal and a human intervention. Another example was the Garda roll-out of the automatic number plate recognition system. When introduced, it was misreading number plates and showing everybody as having no car insurance. Fortunately, at the time it was so broad, the system was stopped and corrected. However, one can easily imagine another case where not everybody was caught up in the loop and somebody was tied up in having to make an appeal and require human intervention. It is not guaranteed now. It is quite an important amendment. It is not onerous, it will actually defend citizens’ rights and make us much more compliant.

See this speech in context