• RMIGO home
• Records Management
• Freedom of Information
• Data Protection
  • What is personal data?
  • Principles
  • Privacy by design
  • Data Privacy Impact Assessments
  • Your information
  • Individuals' rights
    • Right of access
    • Right to rectification
    • Right to erasure
    • Right to restriction of processing
    • Right to data portability
    • Right to object
    • Rights related to automated decision making
  • Data security
  • Data breaches
  • Guidance
  • Training
  • Glossary
  • External resources
• ePrivacy
• Copyright
• University Archive
• Contact us

Rights related to automated decision making (including profiling) 

Under the GDPR, individuals have the right not to be subject to a decision based purely on automated processing, including profiling, which produces legal effects concerning him/ her or similarly significantly affects him/ her. This right does not apply if the automated decision making:

1. is necessary for entering into or performing a contract between the data subject and controller (e.g. the use of automated decision making to assign student college accommodation);
2. is authorised by Union or Member State Law applicable to the controller;  
3. is based on the data subject’s explicit consent.

For any non-exempt automated decision making, the University will:

• provide individuals with information about the processing;
• introduce a simple process for individuals to request human intervention and/or challenge a decision;
• regularly review the process and system to ensure it works as intended.

For questions and concerns please email dataprotection@york.ac.uk