Your rights when a decision about you is automated

This module changes the point of view. Every other module in this course looks at AI from the side of the organisation deploying it. This one looks at it from the side of the person it is used on, which is a position everyone in the course occupies several times a week.

The Swiss position

Article 21 of the revised Federal Act on Data Protection covers automated individual decision-making. It engages when a decision is based exclusively on automated processing and has a legal consequence for the person or affects them significantly.

Three duties follow, and they are worth learning as a sequence because they describe a process rather than a list.

Inform. The controller must tell the data subject that the decision is automated. Not on request. As a matter of course.

Allow a position to be stated. On request, the person must be able to state their point of view. This is the duty organisations design out without noticing, because a decision pipeline with no inbox does not have anywhere for a point of view to arrive.

Human review. The person may request that the decision be reviewed by a natural person.

Separately, Article 25(2) provides that the right of access extends to information about the logic on which the decision is based. That is a narrower thing than it sounds and a broader thing than organisations concede. It is not the training data and it is not the model. It is an account of how the decision was reached that a person can understand and argue with.

Penalties under the Swiss regime fall on responsible natural persons, with fines up to CHF 250,000 for wilful breaches, and breach of the Article 21 information duty is expressly among them.

The word that decides everything: exclusively

Article 21 engages when the decision is based exclusively on automated processing. Organisations respond by inserting a person, and the question then becomes what that person has to be doing.

A reviewer who sees a score and a button, has no authority to depart from the recommendation, has no time allocated, and has no information beyond what the model produced is not making the decision. The system is, and the person is providing a signature. Whether a particular arrangement is genuinely non-automated is a question of substance, and the honest test is whether the reviewer ever reaches a different answer, and what happens when they do.

This is the same idea that appears in the AI Act's human oversight provisions. Article 14 requires the overseer to be able to understand the system's capacities and limitations, remain aware of automation bias, interpret output correctly, decide not to use the output, and disregard, override or reverse it. An oversight arrangement that does not permit override is not oversight.

The EU position

GDPR Article 22 addresses the same subject in EU law: decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect a person. Article 35 requires a data protection impact assessment for high-risk processing, and the EDPB adopted Opinion 28/2024 on 17 December 2024 dealing with personal data in AI models.

The AI Act adds a deployer duty that runs alongside these. Article 26(11) requires a deployer to inform natural persons that they are subject to the use of a high-risk AI system when it is used to make or assist in making decisions relating to them under Annex III. Article 26(9) requires a deployer to use the Article 13 information provided by the provider to carry out a GDPR data protection impact assessment where one is required, which is the Act quietly acknowledging that these two regimes have to be worked together rather than sequentially.

Why these rights exist in this form

The rights are not aimed at making automated decisions rare. They are aimed at the specific thing automation removes, which is the possibility of saying "but my situation is different".

A human decision-maker who is wrong can be told they are wrong, and there is a moment in the process where that can happen. An automated pipeline has no such moment unless one is built. The duty to inform creates the knowledge that a decision was made this way. The duty to allow a position to be stated creates the moment. The duty of human review creates a person with the authority to act on it. Remove any one and the other two stop working.

As of 24 September 2026.