Automated decision-making

GDPR Art. 22 gives individuals the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, such as automatic refusal of credit or e-recruiting without human review. Such decisions are allowed only when necessary for a contract, authorised by law or based on explicit consent, and then with safeguards: at least the right to obtain human intervention, to express one's view and to contest the decision. Individuals must also receive meaningful information about the logic involved and its consequences.

The LGPD (Art. 20) gives the right to request review of decisions taken solely on automated processing that affect the data subject's interests, and the controller must provide clear information about the criteria and procedures used, subject to trade secrets; the ANPD may audit discriminatory aspects.

Human involvement must be real: a reviewer who rubber-stamps every output does not make a decision non-automated. This connects ADM with human oversight and explainability in AI governance.