Key takeaway
A name beside an approval button does not establish meaningful human involvement. Inspect the authority, information and operation of the review.
Follow the score into the actual decision
A proposed data product supplies a score that another business will use when deciding about a person. The source owner is told that a staff member clicks approve, so automated-decision concerns are already handled. Ask what that staff member sees, whether they can change the outcome and when the review happens. A workflow label cannot establish the function the reviewer actually performs.
The Commission’s GDPR explanation distinguishes profiling from decisions based solely on automated means that have legal or similarly significant effects. The Article 29 Working Party’s revised guidelines explain that human oversight must be meaningful, with authority and competence to change the decision and consideration of relevant data. This is an EU GDPR review agenda. It does not import the rules into the UK or decide a real person’s eligibility.
An illustrative review that cannot change the result
This hypothetical product demonstration uses invented applications and no real personal data. System K produces a proposed individual decision. In Workflow A, a clerk sees only a score and must click the preset outcome; a supervisor cannot alter it within that workflow. In Workflow B, a qualified reviewer sees the relevant underlying information, can request corrections and can replace the proposed outcome before it takes effect.
The completed demonstration note flags A for substantive legal review and documents B’s claimed capabilities for testing. It does not announce that B is lawful or outside Article 22. The operator still needs evidence that the promised authority, information and discretion exist in ordinary use. A screenshot of a button is evidence of an interface, not of an independent judgment.
| Review fact | Workflow A stipulated facts | Workflow B claimed facts to verify |
|---|---|---|
| Information available | Score only | Relevant evidence and score basis visible |
| Power to change outcome | No override in this workflow | Reviewer can replace or defer outcome |
| Timing | Preset outcome confirmed | Review before effect on person |
| Operational evidence | Click log only | Reasons, corrections and actual exercised discretion |
| Completed preparation finding | Human-involvement assertion unsupported | Capabilities need demonstration; legal assessment remains open |
Test the reviewer’s authority with a disagreement
In the synthetic demonstration, the responsible tester gives the reviewer a deliberately inconsistent input. The important observation is whether the reviewer can discover the discrepancy, obtain the relevant information and change or pause the proposed result. Record what happened and what was unavailable. Do not manufacture a favorable override record or use an actual person’s application merely to demonstrate the interface.
Ask separately about instructions and operating conditions. Does the reviewer have the competence to examine the issue, or only permission to press a button? Can the person request more information within the process? Is an override treated as an error by management? These practical questions test the product’s claimed human involvement. A low observed override rate alone does not prove either meaningful review or its absence.
Keep an exception and safeguards separate from the workflow label
The Commission describes specific circumstances in which the otherwise restricted solely automated decisions can be allowed, with applicable safeguards. Contract necessity, legal authorization and explicit consent are distinct routes with conditions; writing one of those labels in a product description is insufficient. The actual controller and advisers must establish which provisions apply and how affected people can exercise their rights.
The source owner should therefore request a precise purpose and workflow description before agreeing to a new individual-scoring use. A license for equipment-maintenance research should not silently become permission to rank workers or decide customer access. Role classification, lawful basis, sensitive-data questions and any required impact assessment remain separate reviews. An exception concerning automation would not supply missing source rights or justify unrelated purposes.
Write a decision-process description rather than an approval badge
For the invented K demonstration, the preparation note contains the score’s defined role, proposed effect, person reviewing it, available information, authority, timing and observed test result. The unsupported Workflow A claim is removed. Workflow B remains a documented proposal requiring the actual evidence and legal review. The business has not authorized a live decision or described the product as GDPR compliant.
This differs from checking whether a model is accurate or whether its inputs reveal a sensitive inference. A well-measured score can still be used in an inadequately understood decision process. Preserve the actual purpose and workflow version beside the data-use proposal, so a later change in recipient practice reopens the relevant questions instead of inheriting an outdated human-review claim.
Use this review agenda with your legal and privacy advisers. Requirements depend on the records, jurisdictions and intended use.