Automated Decision-Making and Employees: GDPR Article 22 Explained for Irish Employers

Article 22 of the GDPR gives people a right not to be subject to a decision based solely on automated processing where it has legal effects or similarly significantly affects them. For employers, that matters wherever software screens applicants, allocates work, scores performance or triggers a disciplinary or pay outcome without a person genuinely deciding. This guide sets out what the Data Protection Commission (DPC) says about Article 22, what the Court of Justice decided in the SCHUFA case, and a practical way for Irish employers to check their own processes. It is general information, not legal advice. Before relying on any automated process, first confirm your lawful basis for processing employee data, because, in our view, Article 22 sits on top of that analysis rather than replacing it.

What the DPC says about Article 22

The DPC's page "Your rights in relation to automated decision making, including profiling (Article 22 of the GDPR)" states that an individual has the right not to be subject to a decision based solely on automated processing. The page explains that processing is automated in this sense where no human is involved in the decision and the decision has legal effects on the person or significantly affects them. It adds that automated processing includes profiling. The page does not show a last-updated date, so check it for the current wording.

Three points follow from that description:

• "Solely" matters. The right is about decisions made without a human involved. A tool that supports a person who then decides is a different situation, although the DPC page does not say how much human involvement is enough, so we cannot give you a threshold.
• Effect matters. The decision must have legal effects or significantly affect the person. The DPC page does not list workplace examples, so each employer has to assess its own decisions.
• Profiling is included. Automated profiling that feeds a decision is within the scope the page describes.

When automated decisions are permitted

According to the DPC, automated processing of this kind is allowed in three situations: the individual has given express consent, it is necessary for the performance of a contract, or Union or Member State law authorises it. Where one of these applies, the DPC says suitable measures must be in place to safeguard the person's rights, freedoms and legitimate interests. The examples it gives are the right to obtain human intervention on the controller's part, the right to present a point of view, and the right to challenge the decision.

In an employment setting, consent deserves care. We have not read DPC or EDPB wording on consent in the employment relationship on the pages for this post, so we do not rely on it here. Our suggestion: do not assume that a signed form from an employee or applicant settles the question, and take advice before basing an automated process on consent.

Special category data

The DPC page says automated processing involving special category data is lawful only where the person has given express consent or where it is necessary for reasons of substantial public interest. The page refers readers to its definitions of special categories, which did not appear in the content we could read. If your automated process draws on health, trade union membership or similar data, take specific advice.

What the Court of Justice decided in the SCHUFA case

In Case C-634/21, SCHUFA Holding (Scoring), the Court of Justice gave judgment on 7 December 2023. The Court's own press release (No 186/23) says the Court treats the automated establishment of a credit score as an "automated individual decision" prohibited in principle by the GDPR where the score is given a determining role by the company's clients, such as banks, in granting credit. It left it to the referring court, the Administrative Court of Wiesbaden, to decide whether German law contains a valid exception and whether the GDPR's general conditions for processing are met. The press release notes it is an unofficial document for media use.

The case concerned credit scoring, not employment. But the reasoning, as summarised in the press release, matters for employers because it looks at what role an automated output plays in the final decision, not only at who formally signs it. Our reading, which is not a statement from the Court: where a person technically makes the decision but in practice follows an automated score or ranking, an employer should ask whether that is really a human decision. We recommend reading the judgment itself with your adviser before applying it to HR processes.

Where employee decisions may be automated

A practical approach is to map where your organisation's workplace decisions rely on software output. Candidates include:

• automated filtering or ranking of job applications;
• systems that allocate shifts or tasks;
• performance scores or flags that feed into pay, promotion or discipline;
• systems that trigger the end of a contract or access without human review.

For each, ask: who actually makes the decision? Could that person depart from the system's output, and do they have the information, time and authority to do so? Is the effect on the individual significant? Record the answers, and decide whether the process needs redesign, a safeguard, or a clear human decision point.

How the AI Act adds to the picture

If the software is an AI system, the EU AI Act may apply as well. According to the Commission's AI Act Service Desk, Annex III point 4 lists AI systems intended for recruitment or selection of natural persons and systems used to make decisions affecting terms of work-related relationships, promotion or termination, to allocate tasks based on individual behaviour or personal traits, or to monitor and evaluate performance and behaviour. The Service Desk's page on Article 6 says an Annex III system that performs profiling of natural persons is always considered high-risk. The Service Desk's Article 6 page describes its text as the EUR-Lex consolidated version as at 27 July 2026 and marks passages added or amended by the Digital Omnibus on AI, so check the current position and the application dates.

The Service Desk summary of Article 26 adds that deployers of high-risk systems must assign human oversight to people with the necessary competence, training and authority, and that deployers using Annex III systems that make or help make decisions about natural persons must inform those people that they are subject to the high-risk system. The AI Act and the GDPR are separate regimes with different tests. Meeting one does not by itself satisfy the other. Our guide to AI in recruitment and HR under the EU AI Act covers the hiring side in more detail.

What to do when a worker questions an automated outcome

The DPC describes the right to human intervention, to present a point of view and to challenge a decision as safeguards. Our suggestion: set up a simple route for staff and applicants to ask for a person to review an outcome, name who handles it, and keep a record. A worker who is unhappy with an automated outcome may also ask for their personal data, so make sure your team knows how to handle requests; see our guide to data subject access requests in HR.

What we could not confirm

The European Data Protection Board's page of endorsed WP29 guidelines lists the Article 29 Working Party's Guidelines on Automated individual decision-making and Profiling (WP251rev.01) as endorsed at its first plenary meeting; the Commission's newsroom page for the document shows the date 22 August 2018. The guideline text itself was not readable in the format available to us, so this post does not describe its contents. Employers should read the guidelines directly. We also could not read the text of Article 22 itself on EUR-Lex, so we have relied on the DPC's description.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Does Article 22 ban all automated decisions about employees?

The DPC describes a right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects. It also lists situations where such processing is permitted, subject to safeguards. It does not say every use of software in HR is covered.

Is a decision automated if a manager clicks approve?

The DPC page describes automated decisions as ones where no human is involved. It does not say how much involvement is enough, so we cannot give a definite answer. Our suggestion is to test whether the reviewer genuinely has the information and authority to change the outcome.

What safeguards does the DPC mention?

The DPC gives as examples the right to obtain human intervention, to present a point of view and to challenge the decision.

Does the SCHUFA decision apply to employers?

The case was about credit scoring. The Court's press release says a score that plays a determining role in a decision can itself be an automated decision. Whether and how that applies to employment processes is something to take advice on.

Automated tools can save time, but accountability for decisions about people stays with the employer. Mapping where software drives outcomes, and building in a real human decision point, is a sensible first step.