Automated decisions and people's rights

Article 10(1) of the PDP Law states that a Personal Data Subject (Subjek Data Pribadi) has the right to object to decision-making based solely on automated processing, including profiling, that has legal consequences or significant effects on the Personal Data Subject. Four parts deserve a slow read:

• Personal Data Subject: the person whose data is processed, such as an applicant, employee, customer or aid recipient.
• Based solely on automated processing: the decision is made by a system without meaningful human involvement. A person who only passes on the system's result without checking does not change its automated nature.
• Profiling: assessing aspects of a person from their data, such as predicting performance, reliability, interests or behaviour. An applicant fit score calculated by AI is an example of profiling.
• Legal consequences or significant effects: for example a rejected application, a declined loan, aid not granted, a contract not renewed.

The law also contains certain exceptions to Personal Data Subjects' rights, so applying it to a real case needs an expert's check.

Note also what this article does not say. Article 10(1) is about a right to object. It does not, by itself, set out a right to be told AI was used or a right to an explanation of how the system works. The right to information about who processes the data, the legal basis and the purpose is in Article 5 (see the PDP Law basics lesson). Many organisations choose to tell people that AI helped and to explain the reasons for a decision; that is good practice for trust, but present it as your policy, not as what this article says.

Teams that use AI in decisions about people have two pieces of homework.

First, do not let significant decisions become automated without noticing. Make sure a person really reviews: opens the data, weighs the reasons, and has the authority to decide differently from the system. A review that is a mere formality is not enough. How to judge which tasks may run automatically is in the lesson on when not to automate.

Second, set up an objection path before you need it. A good path has six parts:

1. A way to object that is easy and named in the decision notice: an address, a form or an official service number.
2. A clear response time, for example within ten working days.
3. A human reviewer not involved in the original decision and with authority to change it.
4. A real review: the reviewer looks at the original data and the objector's reasons, not just re-running the same model.
5. Records: the objection, review and outcome are recorded.
6. No penalty: people are not disadvantaged for objecting.

Also remember Article 34: the Personal Data Controller must carry out a personal data protection impact assessment for high-risk processing, and the law names automated decision-making with legal consequences or significant effects as one such case, alongside processing specific data, large-scale processing, and systematic evaluation, scoring or monitoring. A plan to use AI to screen applicants or assess employees almost always falls here. Involve your data protection officer from the design stage, not after the feature is live.