With the advent of new technologies and their increasing complexity, the GDPR has included a specific regulatory framework in Article 22 to govern automated decision-making processes, which include artificial intelligence (AI). AI is, in fact, a broad term covering a variety of management and automation systems. These processes use algorithms to analyze large volumes of personal data to make decisions or predictions without human intervention, forming the core of AI and automated decision-making processes as envisaged and regulated by Article 22 of the GDPR.

Paragraph 3 of Article 22 imposes safeguard obligations for the data subject whose data is subjected to automated decision-making processes. In such cases, the employer must adopt appropriate measures to protect the rights, freedoms, and legitimate interests of the data subject. These measures include at least the right to obtain human intervention, to express their opinion, and to contest the decision. In the context of employment relationships, the most relevant exception is that provided by letter (a), as it is recognized that consent does not constitute an adequate legal basis in such relationships due to the power imbalance between the parties involved.

The distinction between fully automated and semi-automated processes, in relation to Article 22 of the GDPR, raises interesting points for discussion regarding the protections offered ...