Data Protection and the Platform Work Directive: The Right to a Human Decision

European data protection law said that a person should not be judged by a machine alone long before the AI Act existed. This chapter sets out what that right means when the machine manages people: GDPR Article 22 as the Court of Justice read it in SCHUFA and Dun & Bradstreet, the right to meaningful information about the logic involved, the room Article 88 leaves for national rules and collective agreements, the Working Party guidance the European Data Protection Board endorsed, and Chapter III of the Platform Work Directive, to be transposed by 2 December 2026. It then shows how the data protection impact assessment and the AI Act's fundamental rights impact assessment fit together, and how the rights become design requirements for every employer. The chapter concerns M2 Evaluation, where scores and rankings are produced, and M3 Consequence, where they meet a person's pay, job or access to work; it touches M1 Direction where allocating work shades into access to work.

The right to a human decision: a system output is tested for legal or similarly significant effect and for meaningful human involvement; where the output is determining, GDPR Article 22 applies with its exceptions and safeguards; where a person decides, the decision is recorded in a Management Decision Record; both paths lead to an explanation service under GDPR Article 15(1)(h) and AI Act Article 86; in platform work, Directive Article 10(5) reserves restriction, suspension and termination to a human being and Article 11 adds written reasons and review within two weeks; the DPIA records the degree of human involvement and the FRIA cross-refers to it

Figure 22.1: The right to a human decision along a management decision path, showing where GDPR Article 22, the explanation duties and the Platform Work Directive each apply.

Four instruments, one question

Four bodies of law ask the same question: when a system takes part in a decision about a worker, what must the employer show about the person who decided and about the logic the system applied. The GDPR, Regulation (EU) 2016/679, answers through the data subject: Article 22 limits solely automated decisions, Articles 13 to 15 require information about the logic, and Article 35 requires a data protection impact assessment (DPIA) (5, European Union, 2016). It applies to every employer now. Its Article 88 lets member states and collective agreements add more specific rules for employee data. The Platform Work Directive, Directive (EU) 2024/2831, answers through the working relationship, but only for digital labour platforms (47, European Union, 2024). The AI Act answers through the system: Chapter 21 showed that Article 86 gives a right to an explanation of a decision based on a high-risk Annex III system, but Article 86(3) limits it to cases where Union law does not already provide it, and Article 2(11) leaves member states and collective agreements free to be more favourable to workers (1, European Union, 2024). The AI Act therefore sits on top of the GDPR, not in its place. The statements below describe organisational and architectural implications, not legal advice.

Solely automated decisions

Article 22(1) gives the data subject "the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her" (5, European Union, 2016). In SCHUFA the Court split it into three cumulative conditions: a decision, based solely on automated processing, with legal or similarly significant effects (63, CJEU, 2023).

The concept of a decision is broad. The Court relied on recital 71, under which a decision "may include a measure" and covers "e-recruiting practices without any human intervention"; the same recital names the prediction of a person's "performance at work" as profiling. Rejections, shortlists, pay bands, warnings and deactivations are all candidates, and in some circumstances so are rankings and scores.

Whether a decision is solely automated is where employment cases are fought. The Working Party's guidelines, endorsed by the European Data Protection Board, state that a controller "cannot avoid the Article 22 provisions by fabricating human involvement"; that someone who "routinely applies automatically generated profiles to individuals without any actual influence on the result" leaves the decision solely automated; and that oversight must be "meaningful, rather than just a token gesture", by "someone who has the authority and competence to change the decision", who should "consider all the relevant data" (61, Article 29 Data Protection Working Party, 2018). The controller should record in its DPIA the degree of human involvement and the stage at which it occurs. That sentence is the origin of this chapter's worked examples.

On effects, the guidelines list "decisions that deny someone an employment opportunity or put them at a serious disadvantage". Dismissal, discipline, pay and deactivation meet the threshold. A single task allocation usually does not; a pattern of allocation that sets someone's hours or earnings may.

The guidelines read Article 22(1) as a general prohibition. Article 22(2) allows a solely automated decision where it is necessary for a contract, authorised by Union or member-state law with suitable safeguards, or based on explicit consent. In employment each route is narrow. Consent "is highly unlikely to be a legal basis for data processing at work, unless employees can refuse without adverse consequence" (60, Article 29 Data Protection Working Party, 2017). Contractual necessity requires showing that no less intrusive method would do; the guidelines' own example is an employer with tens of thousands of applications that cannot practically find candidates without an automated first sift. Few employment statutes authorise automated decisions by name. Where the contract or consent route is used, Article 22(3) requires at least the right to human intervention, to express a point of view and to contest the decision.

The text may change. On 19 November 2025 the Commission proposed, in its Digital Omnibus, to rewrite Article 22(1) and (2) so that contractual necessity applies "regardless of whether the decision could be taken otherwise than by solely automated means" (232, European Commission, 2025). The Legislative Observatory recorded the procedure as awaiting committee decision in the European Parliament, with amendments tabled in July 2026 (235, European Parliament, 2026). Its outcome is expected but not yet known. The proposal would widen one exception, not remove the safeguards of Article 22(3) or the other instruments in this chapter; a design built on a named human decider does not depend on it.

Scores that decide

Chapter 8 introduced SCHUFA for performance scores. The Court held that an automated probability value is itself an automated decision "where a third party, to which that probability value is transmitted, draws strongly on that probability value", and that where it "plays a determining role" its establishment is a decision with significant effects; otherwise the person would face a lacuna in protection (63, CJEU, 2023). Inside an employer, score-maker and decider are usually one controller, so the lacuna differs, but the test transfers: a score that plays a determining role is part of the decision whatever the procedure calls it. Whether it does is a fact about use, and use can be measured.

Four measurements answer it. The departure rate shows how often the decider reaches a different result from the one the score implies; near zero over many decisions is evidence that the score determines. Reading below the line shows whether deciders look at cases the system placed outside the shortlist, which Chapter 7 built into DLG-HM-REC-01. The Management Decision Record shows what information the decider used besides the score. And time per decision shows whether all relevant data could have been weighed; AI Governance, Chapter 21, recorded as F21 that approvals given in seconds signal rubber-stamping (41, Nordqvist, 2026). None is a legal threshold, and a low departure rate can mean the score is good. Recorded together over time, they are the evidence a data protection officer, a works council or a court will ask for.

What a human decision must mean to count

Chapter 4 listed six capacities of the named human decider. The law adds evidence to them. The Amsterdam Court of Appeal accepted human involvement for the one Uber driver with whom the company had a personal conversation before deactivation, rejected it where files showed only notes, and placed a heightened burden of proof on the party holding the evidence (67, Gerechtshof Amsterdam, 2023). The Platform Work Directive requires overseers with "the competence, training and authority necessary to exercise that function, including for overriding automated decisions", in sufficient numbers and protected from dismissal and other adverse treatment when they act (Article 10(2)) (47, European Union, 2024).

Read together, a human decision counts when the record shows five things: authority to decide otherwise, with departure no more costly than agreement; competence to judge the case, not only to operate the system; access to the relevant data, including what the person affected said; time in proportion to the consequence, measured; and evidence that the decider's judgement sometimes changes outcomes. A signature given to every proposal in the same few seconds is the "token gesture" of the guidelines, and an approval queue no one could read is the moral crumple zone of Chapter 8. Chapter 26 designs oversight that meets these conditions.

An employer can also fall into Article 22 by success. A system that works well, whose recommendations managers stop questioning, drifts from Level 1 Assisted to a de facto Level 4 Autonomous without any change of configuration. The degree of delegation that matters in law is the one shown by use, which is why the measurements belong in routine reporting.

Explaining the logic

Articles 13(2)(f) and 14(2)(g) require the controller to tell the person about automated decision-making under Article 22 and, "at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences"; Article 15(1)(h) gives the same on request (5, European Union, 2016). Whether this created a right to an explanation of an individual decision was disputed: Wachter, Mittelstadt and Floridi argued that the text does not establish one (160, Wachter et al., 2017), and Wachter, Mittelstadt and Russell proposed counterfactual explanations, which describe the smallest change to the facts that would have produced a different result (162, Wachter et al., 2018).

Dun & Bradstreet narrowed the dispute. The person may require the controller to explain, "in a concise, transparent, intelligible and easily accessible form, the procedure and principles actually applied" to their data (65, CJEU, 2025). A formula or a description of every step does not suffice (paragraph 59); the complexity of the operations does not excuse the controller (paragraph 61); and informing the person of "the extent to which a variation in the personal data taken into account would have led to a different result" may be sufficient (paragraph 62). Information claimed as a trade secret goes to the supervisory authority or court for case-by-case balancing; a national rule excluding access wherever a secret is at stake is precluded.

Three design requirements follow. The employer must log inputs, version and parameters at the time of the decision, the record F38 asks of AI Decision Records (AI Platform and Security, Chapter 5) (42, Nordqvist, 2026). The explanation must be written in indicators the worker recognises, such as hours, preferences and competences for a roster. And a supplier's trade secret does not end the employer's duty as controller, so procurement must secure the information before go-live; Nordvik paused its recruitment-screening pilot in September 2026 when the supplier could not show how the ranking was made (AIDR-0601). The AI Act's Article 86 adds the system's role and the main elements of the decision. One explanation service, drawing on the Management Decision Record of Chapter 25, can answer both; Chapter 27 builds the appeal path on it.

Employment data: Article 88 and national rules

Article 88(1) lets member states, "by law or by collective agreements", set more specific rules for employee data, including for recruitment, "management, planning and organisation of work" and termination; Article 88(2) requires "suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights", with particular regard to transparency, transfers within a group and "monitoring systems at the work place" (5, European Union, 2016).

Two judgments set the limits. In 2023 the Court held that such rules must have "a normative content specific to the area regulated", "cannot be limited to reiterating the provisions" of the GDPR, and must be disregarded if they fail Article 88(2), unless they are a valid legal basis under Article 6(3) (64, CJEU, 2023). The Hessian provision at issue was worded like § 26(1) of the federal Bundesdatenschutzgesetz, which remains in force together with § 26(4), permitting processing on the basis of collective agreements, works agreements included, provided the parties observe Article 88(2) (234, Germany, 2017). In December 2024 the Court turned to a works agreement under which an employer had moved employee data into a group cloud HR system. It held that rules under Article 88 must also satisfy Articles 5, 6(1) and 9, and that the parties' margin of discretion on necessity does not prevent full judicial review (233, CJEU, 2024). A works agreement is the right instrument for governing an HR system, but not a safe harbour.

The Working Party's opinion on data processing at work supplies the content: proportionality and subsidiarity, transparency about monitoring, less intrusive means first, a DPIA for high-risk technology, and a warning that monitoring communications can have "a chilling effect" on employees' rights to organise (60, Article 29 Data Protection Working Party, 2017). An agreement governing a scoring or allocation system should therefore state the purposes, data used and excluded, who sees individual figures, which decisions they may and may not feed, and the explanation a worker receives, and it should be versioned with the system, a problem Chapter 23 takes up. Nordic member states rely more on collective agreements than on statute; the same reasoning applies to those agreements.

The Platform Work Directive, Chapter III

The Directive covers digital labour platforms that organise work at a recipient's request by electronic means using automated monitoring or decision-making systems (Article 2(1)(a)) (47, European Union, 2024). Its definition of an automated decision-making system is wider than Article 22: any system used "to take or support" decisions that significantly affect persons performing platform work, including their recruitment, "access to and the organisation of work assignments", earnings, working time and contractual status (Article 2(1)(i)).

Article 7 forbids processing data on emotional or psychological state, private conversations, activity outside work, predictions of the exercise of fundamental rights, inferences of sensitive characteristics and biometric identification against a database. Article 8 declares such processing high-risk under GDPR Article 35(1), requires the platform to seek the views of workers and their representatives and to give the DPIA to the representatives. Article 9 requires written information on the systems, including "the main parameters ... and the relative importance of those main parameters", to individuals by their first working day and before changes, to representatives before use, and to applicants before recruitment. Article 10 requires oversight and an evaluation of the impact of individual decisions with the representatives "regularly and in any event every two years", sufficient protected overseers, correction or discontinuation of a system that discriminates, and, in paragraph 5: "Any decision to restrict, suspend or terminate the contractual relationship or the account of a person performing platform work or any other decision of equivalent detriment shall be taken by a human being." Article 11 gives a right to an explanation of any decision taken or supported by such a system and a designated contact person, a written statement of reasons for serious decisions by the date they take effect, a written review within two weeks of a request, and rectification within two weeks or compensation. Articles 12 to 15 add safety and health assessment and a ban on "undue pressure", information and consultation with an expert, direct information where there are no representatives, and rights for representatives of the self-employed.

Article 24(1) gives the data protection authorities enforcement of Articles 7 to 11, with the GDPR's upper fine level. Article 28 lets member states, by law or collective agreement, set more specific rules on Articles 9 to 11, the pattern of GDPR Article 88. Article 29(1) requires transposition by 2 December 2026.

The Directive's scope is platforms, but its content specifies the human decision this book recommends for every employer: a human being for serious detriment, an explanation and a named contact for every supported decision, written review within two weeks, periodic evaluation with the representatives and protection for the overseer who disagrees. Chapter 5's PWD-BENCH-* records use it as a benchmark in exactly that way.

What the courts and authorities added

Chapter 5 told the platform cases in full. Three lessons belong here. The burden of showing meaningful involvement falls on the party holding the evidence, and a conversation counts where a note does not (67, Gerechtshof Amsterdam, 2023). The access right reaches the scores that feed decisions, such as fraud probability scores and earnings profiles (68, Gerechtshof Amsterdam, 2023). And supervisory authorities treat scoring and allocation, not only deactivation, as automated decisions needing safeguards and order controllers to test their algorithms (194, Garante, 2021) (195, Garante, 2021); the reported 2026 Dutch fine against Uber, which Uber has said it will appeal, moves the question into supervisory enforcement (211, Autoriteit Persoonsgegevens, 2026). None concerned an ordinary employer, but their reasoning concerned the GDPR, which binds every employer.

The DPIA and the FRIA

A system that scores, ranks or allocates people usually needs a DPIA: Article 35(3)(a) requires one for systematic and extensive automated evaluation of personal aspects on which significant decisions are based, Article 35(2) requires the data protection officer's advice and Article 35(9) the views of data subjects or their representatives where appropriate (5, European Union, 2016). A public employer deploying a high-risk Annex III system also needs a fundamental rights impact assessment (FRIA) under AI Act Article 27, and Article 26(9) requires deployers to use the provider's information when they carry out the DPIA. The Digital Omnibus rewrote Article 27(4) so that, where an obligation is already met through the DPIA, the deployer may "include cross-references to the relevant sections of that data protection impact assessment or include relevant parts thereof", and Article 27(5) so that the AI Office's template offers that option (2, European Union, 2026).

The economy is welcome, but the assessments ask different questions. The DPIA asks whether the processing of personal data is necessary, proportionate and safe, and whether decisions are solely automated. The FRIA asks how the system affects fundamental rights, which for a workforce means fair and just working conditions under Article 31 of the Charter, non-discrimination under Article 21 and dignity, as well as data protection under Article 8 (48, European Union, 2012). A roster can be lawful processing and still compress visit times until work is unsafe. Kaminski and Malgieri argued that the DPIA links individual rights and systemic governance and can produce "multi-layered explanations" of a system (174, Kaminski & Malgieri, 2021). The architectural reading is one evidence base and two documents, with a cross-reference that maps each element of Article 27(1), points (a) to (f), to a section of the DPIA or to the FRIA's own text, so that gaps and changes are visible.

From rights to design

Five design requirements follow for every employer, platform or not. A human decision point for every decision of legal or similarly significant effect, meeting the five conditions above; for M3 Consequence this is the rule that Level 4 Autonomous is never used. A measurement of determining influence, reported routinely at the level agreed with the representatives. An explanation service that answers from the record, in the person's terms, with the procedure actually applied and, where useful, the counterfactual. A review path with a named contact, a written answer within a fixed time and the power to rectify. And an assessment chain: a DPIA that records human involvement, a FRIA that cross-refers to it, and an agreement with the representatives that governs both.

Practical guide: Checking a management system for solely automated decisions and building the human decision point and the explanation into it

Purpose. Establish which outputs of one management system feed decisions under GDPR Article 22, whether a person meaningfully decides each, and what must be built so that the answer stays true and can be shown.

Roles. The system owner leads. The data protection officer advises and signs the Article 22 analysis in the DPIA. HR describes the decisions. Two or three line managers describe actual use, with data. A workers' representative reviews the result and the metrics. A worker affected reads the draft explanation and says whether it is intelligible.

Steps.

  1. List the outputs. For each score, rank, allocation, flag or offer, record the decision it feeds, its management function and who takes it.
  2. Test the effect. Record whether the decision can have legal or similarly significant effects, for single decisions and for patterns that set hours or earnings.
  3. Test the human involvement. Collect the departure rate, the share of cases read below the line, the median time per decision, the information the decider sees and whether departure needs extra justification. For a new system, measure in a shadow period.
  4. Classify each decision as human, solely automated or uncertain, and treat uncertain as solely automated until the evidence changes.
  5. Redesign or justify. Redesign a solely automated decision so that a person decides, the default for M3 Consequence, or record the Article 22(2) exception, its necessity and the Article 22(3) safeguards. Do not rely on consent.
  6. Build the explanation from the record: data used, main parameters and their weight, what the person decided and why, and what would have changed the result. Test it with a worker, and settle with the supplier before go-live what it will provide to the employer, an authority and a court.
  7. Build the review path: a named contact per unit, a time to answer, and power to rectify the decision and report a system fault.
  8. Record steps 2 to 7 in the DPIA, cross-refer from the FRIA where Article 27 applies, and write conditions into the delegation profile.
  9. Set triggers to reopen: a new input, a change in ranking or ordering, a new degree of delegation, a departure rate below the floor, an upheld contestation, new case law.

Defaults. Report quarterly, at team level unless the works agreement allows more. Treat a departure rate under 5 per cent for two consecutive quarters, with a median decision time under one minute for a consequence decision, as evidence of determining influence requiring redesign. Answer requests for explanation and for review within two weeks each, as Article 11 does for platforms. Adapt these defaults to volume and agree them with the representatives.

Done when every output feeding a significant decision is classified with evidence, every solely automated decision is redesigned or justified in writing, the explanation has been tested with a worker, the review path is staffed, the DPIA records the human involvement and the representatives have the analysis.

Worked example: the DPIA and FRIA cross-reference for ShiftWise

Illustrative. Chapter 21 showed the home-care section of Nordvik Region's FRIA-2026-007, owned by Ingrid Halvorsen, cross-referring to "DPIA for ShiftWise, sections 3 to 5". That DPIA is DPIA-2026-031. In January 2027, before the unions agreed DLG-NR-ROS-01, the data protection officer assessed the one class of decision ShiftWise takes without a person in the individual case: open-shift offers at Level 3 Bounded, sent unranked to all staff who opted in, first acceptance winning. The officer concluded that the award is solely automated but, while offers are unranked and declining has no effect, involves no evaluation of personal aspects, and no single award similarly significantly affects anyone; because part-time and hourly staff depend on extra shifts, the pattern is monitored by contract type. Ranking recipients would evaluate personal aspects to set access to work and bring the award within Article 22. At the negotiation of 20 January the union obtained a published rotating order that moves one place with each offer, and because the DPIA named any ordering as a reason to reopen it, the officer reassessed the condition before the profile was signed: a fixed rotation that uses nothing about the person is not a ranking and evaluates no personal aspect. The Region recorded the conclusion and the condition in AIDR-0626.

# assessments/DPIA-2026-031.yaml (illustrative excerpt)
id: DPIA-2026-031
system: ShiftWise
controller: Nordvik Region
owner: Ingrid Halvorsen, HR director
dpo_advice: section 6, given 2027-01-14   # GDPR Article 35(2)
views_sought: [union for nurses and midwives, union for municipal and care workers, safety representatives]   # Article 35(9)
decision_record: AIDR-0626
sections:
  3_processing_and_necessity: rosters, routes, open-shift offers; data used and excluded; retention
  4_human_involvement:
    rosters_and_routes:
      level: Level 2 Supervised
      decider: unit manager approves each roster and route plan
      article_22: not solely automated
      evidence: [changes per roster in MDRs, median review time, override reasons]
    open_shift_offers:
      level: Level 3 Bounded
      decider: none in the individual case; unit manager sets the bounds
      article_22: solely automated award; no evaluation of personal aspects; effect of one award not similarly significant
      condition: no ordering based on any personal aspect; offers to all opted-in staff in a published rotating order; declining has no effect
      monitoring: extra hours by contract type, quarterly
      reopen_if: [ordering of recipients based on any personal aspect, use of acceptance history, offers to selected staff only]
    rest_rule_flags: {level: Level 1 Assisted, decider: unit manager}
  5_risks_and_measures: profiling via acceptance data; retention cut to 90 days; no per-person reporting
  6_dpo_advice: accepted
  7_review: on any change to optimisation objectives or offer rules; at least annually
fria_cross_reference:   # AI Act Article 27(4) as amended by Regulation (EU) 2026/1744
  fria: FRIA-2026-007
  27_1_a_processes: DPIA section 3
  27_1_b_period_and_frequency: DPIA section 3
  27_1_c_affected_groups: DPIA section 3; residents added in FRIA
  27_1_d_risks:
    data_protection: DPIA section 5
    working_conditions_and_equal_treatment: FRIA only, risks R1 and R2
  27_1_e_human_oversight: DPIA section 4
  27_1_f_measures_and_complaints: DPIA section 5; FRIA adds safety representative review and CNT-NR-* path
change_rule: a change to DPIA sections 3 to 5 opens a review of FRIA-2026-007 within 30 days

The map shows that the FRIA's risks to working conditions and equal treatment have no counterpart in the DPIA and remain its own work, and the change rule keeps the two documents from drifting apart.

Worked example: AIDR-0676, an Article 22 analysis of TalentLens and the claims allocation

Illustrative. Hansa Mutual's group data protection officer asked in early 2027 for one analysis of the two systems whose outputs meet people most often: TalentLens, which ranks applications and scores interview transcripts under DLG-HM-REC-01, and the claims-triage agent, which allocates claims to handlers at Level 3 Bounded under DLG-HM-CTA-01. For TalentLens the analysis applies the SCHUFA test to the hiring records, of which MDR-HM-0070 was the first; for the allocation it asks whether allocating a claim is a significant decision at all.

# decisions/AIDR-0676.yaml (illustrative)
id: AIDR-0676
title: GDPR Article 22 analysis of TalentLens ranking and claims-triage allocation
date: 2027-02-22
status: accepted
deciders: [chief HR officer, group head of claims operations]
advised_by: group data protection officer
consulted: [Konzernbetriebsrat, company trade union organisation PL]
related: [AIDR-0651, DLG-HM-REC-01, DLG-HM-CTA-01, KBV-IT-2024, DPIA-2026-033, DPIA-2026-034]
analyses:
  - system: TalentLens
    decision: shortlist and rejection, M3 Consequence
    significant_effect: true   # denial of an employment opportunity
    evidence_2026_q4:
      vacancies: 41
      shortlist_departures_from_ranking: 0.11
      vacancies_with_read_below_cut_evidenced: 0.95
      median_recruiter_time_per_application_read_s: 140
      rejections_released_before_signature: 0
    finding: recruiter decides; ranking informs but does not determine
    floor: departure rate under 0.05 for two quarters, or read-below-cut under 0.90, treated as determining
    if_floor_breached: pause ranking display; manual screening per DLG-HM-REC-01
    explanation: main criteria from HR-REC-CRIT-2026-01, applicant's scores per criterion, recruiter's reasons
  - system: claims-triage agent, allocation to handlers
    decision: allocation of individual claims, M1 Direction
    significant_effect: false for a single allocation
    pattern_check: monthly workload by handler and contract hours; no link to pay
    conditions:
      - no behavioural capacity factor (removed in release 7.0 under AIDR-0651)
      - throughput figures feed no M3 Consequence decision without a new KBV-IT-2024 version
      - team leader may reassign and switch the team to manual allocation
    finding: outside Article 22 while conditions hold
    explanation: allocation rules v2026.4 in plain language on request, per handler
article_88: KBV-IT-2024 and BDSG section 26(4) in DE; necessity of each data field documented for review
outside_eu: UK and CH entities apply the same analysis as group policy
reopen_on: [floor breached, new ranking model, new allocation input, throughput used for pay or discipline, contestation upheld]

The floor turns the SCHUFA test into a number the Konzernbetriebsrat can watch; it does not make a higher rate lawful, it obliges the group to act on a lower one. The allocation is found to be outside Article 22, but the explanation is offered anyway, because the conditions on which the finding rests are those KBV-IT-2024 already sets and handlers are entitled to see them. After the 2024 judgment the record also accepts that the necessity of each data field in the works agreement can be reviewed in full by a court.

Across the usage modes

Article 22 turns on whether a person meaningfully decides, not on the mode; the mode shapes where solely automated decisions arise and how easily they go unnoticed.

Usage mode Where a solely automated decision can arise Design response
Mode 0 Ambient AI Productivity or collaboration analytics that flag individuals and feed reviews Feature register entry; no per-person output until a DPIA and agreement cover it
Mode 1 Conversational assistants A manager pastes a ranking from a general assistant into a decision Policy forbids point 4 uses; the MDR records any AI input
Mode 2 Embedded workplace assistants Summaries that attribute performance to named people Advisory only; explanation of what was attributed and from which source
Mode 3 Agentic work tools Agents that assign or close colleagues' work items Level 2 Supervised for anything touching a person's record
Mode 4 Built AI applications Screening, scoring, rostering and dashboards Departure-rate floors, reading below the line, explanation service
Mode 5 Autonomous production agents Allocation at Level 3 Bounded that drifts into access to work Conditions in the delegation profile; Level 4 Autonomous never for M3 Consequence

Level 0 Advisory and Level 1 Assisted keep a decision outside Article 22 only if the involvement is real, Level 2 Supervised only if approvals are measured, and Level 3 Bounded only for actions without significant effect on a person.

What is observable and what is expected

Article 22, Articles 13 to 15 and 88, the judgments in SCHUFA, Dun & Bradstreet and the two Article 88 cases, the Amsterdam and Garante decisions and the Directive's text are observable. Transposition of the Directive by 2 December 2026 is expected on a decided date; how fully each member state transposes it, and whether national law or courts extend Chapter III to employers that are not platforms, are expected to vary and should be checked per member state. The outcome of the proposed amendment to Article 22 is expected but unknown. Convergence of employment data-protection rules into a common standard for algorithmic management, which the European Parliament's 2025 resolution called for, is speculation (62, European Parliament, 2025).

Nordvik Region and Hansa Mutual

At Nordvik Region the right to a human decision is mostly met by design and must be kept so. Unit managers such as Mikael Strand approve every roster at Level 2 Supervised, and the MDRs from MDR-NR-0001 onwards record their changes. The one solely automated award stays outside Article 22 only because no personal aspect orders it, and AIDR-0626 ties that condition to a reassessment. The paused recruitment-screening pilot (AIDR-0601) reads in this chapter as an Article 15(1)(h) failure before it was an AI Act one. As a public authority the Region holds itself to F31 of AI Governance, Chapter 17: the line between decision support and automated decision is drawn in the data model and the audit log, with a reasons log for every case (41, Nordqvist, 2026).

Hansa Mutual builds, scores and operates in seven legal systems. AIDR-0676 makes the SCHUFA test measurable for TalentLens and keeps the claims allocation outside Article 22 on conditions KBV-IT-2024 already enforces. The sales-performance score, an input to variable pay at Level 0 Advisory, is next: CNT-HM-0001 showed that a score compared with the wrong baseline can mislead a manager, and the departure-rate test will be applied to sales managers' pay decisions. In Germany the works agreement is the group's Article 88 instrument and must be defensible on necessity; elsewhere in the EU the same analysis runs through each entity's own body, and in the United Kingdom and Switzerland it is group policy. As in Chapter 21, Nordvik's exposure lies in what it procures and must be able to explain, Hansa's in what it builds and must be able to show.

Summary

Data protection law gave Europe the right to a human decision before the AI Act did, and it binds every employer now. GDPR Article 22 limits solely automated decisions with legal or similarly significant effects; SCHUFA reaches a score that plays a determining role; and the endorsed guidance requires involvement that is meaningful, by someone with authority and competence who considers all the relevant data. This chapter makes the test measurable: departure rates, reading below the line, information used and time per decision, recorded in the DPIA and reported to the representatives.

Dun & Bradstreet made meaningful information about the logic a design requirement: the procedure and principles actually applied, intelligible to the person, with trade secrets weighed by an authority or court rather than used to refuse. Article 88 and the Court's two judgments on it make works agreements and collective agreements the right instrument for employee data and subject them to full review of necessity. The Platform Work Directive, to be transposed by 2 December 2026, specifies for platforms what this book recommends for every employer: a human being for decisions of serious detriment, explanations and a named contact, written review within two weeks, periodic evaluation with the representatives and protection for the overseer.

The DPIA and the FRIA can share one evidence base under amended Article 27(4), provided each still asks its own questions and the cross-reference is mapped element by element, as Nordvik Region does in DPIA-2026-031 and AIDR-0626 and Hansa Mutual does for its own systems in AIDR-0676.

The chapter concerns M2 Evaluation, where the determining influence of scores must be measured, and M3 Consequence, where the law requires a person who decides and can explain; it touches M1 Direction wherever allocation becomes access to work. Chapter 23 turns to co-determination: how works councils, unions and the Nordic model, which hold the agreements this chapter relies on, can govern systems that change faster than agreements are renegotiated.

Sources

  1. European Parliament and Council of the European Union (2016). Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation). Official Journal of the European Union. (5, European Union, 2016)
  2. European Parliament and Council of the European Union (2024). Directive (EU) 2024/2831 of 23 October 2024 on improving working conditions in platform work. Official Journal of the European Union. (47, European Union, 2024)
  3. European Parliament and Council of the European Union (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union. (1, European Union, 2024)
  4. European Parliament and Council of the European Union (2026). Regulation (EU) 2026/1744 (Digital Omnibus on AI). Official Journal of the European Union. (2, European Union, 2026)
  5. Court of Justice of the European Union (2023). Judgment of 7 December 2023, OQ v Land Hessen (SCHUFA Holding (Scoring)), Case C-634/21, ECLI:EU:C:2023:957. EUR-Lex. (63, CJEU, 2023)
  6. Article 29 Data Protection Working Party (2018). Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679 (WP251rev.01). (61, Article 29 Data Protection Working Party, 2018)
  7. Article 29 Data Protection Working Party (2017). Opinion 2/2017 on data processing at work (WP 249). (60, Article 29 Data Protection Working Party, 2017)
  8. European Commission (2025). Proposal for a Regulation as regards the simplification of the digital legislative framework (Digital Omnibus), COM(2025) 837 final. EUR-Lex. (232, European Commission, 2025)
  9. European Parliament (2026). Procedure file 2025/0360(COD): Digital Omnibus (Omnibus VII). Legislative Observatory. (235, European Parliament, 2026)
  10. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. The Architecture as Code Series, Book 2. (41, Nordqvist, 2026)
  11. Gerechtshof Amsterdam (2023). Judgment of 4 April 2023, ECLI:NL:GHAMS:2023:793 (drivers and App Drivers & Couriers Union v Uber). Rechtspraak.nl. (67, Gerechtshof Amsterdam, 2023)
  12. Garante per la protezione dei dati personali (2021). Ordinanza ingiunzione nei confronti di Foodinho s.r.l. – 10 giugno 2021 [doc. web n. 9675440]. Garante Privacy. (194, Garante, 2021)
  13. Garante per la protezione dei dati personali (2021). Ordinanza ingiunzione nei confronti di Deliveroo Italy s.r.l. – 22 luglio 2021 [doc. web n. 9685994]. Garante Privacy. (195, Garante, 2021)
  14. Wachter, S., Mittelstadt, B. & Floridi, L. (2017). Why a Right to Explanation of Automated Decision-Making Does Not Exist in the General Data Protection Regulation. International Data Privacy Law, 7(2). (160, Wachter et al., 2017)
  15. Wachter, S., Mittelstadt, B. & Russell, C. (2018). Counterfactual Explanations Without Opening the Black Box: Automated Decisions and the GDPR. Harvard Journal of Law & Technology, 31(2). (162, Wachter et al., 2018)
  16. Court of Justice of the European Union (2025). Judgment of 27 February 2025, CK v Dun & Bradstreet Austria GmbH and Magistrat der Stadt Wien, Case C-203/22, ECLI:EU:C:2025:117. EUR-Lex. (65, CJEU, 2025)
  17. Nordqvist, G. (2026). AI Platform and Security: Building and Securing AI Platforms in European Enterprises and Public Authorities. The Architecture as Code Series, Book 3. (42, Nordqvist, 2026)
  18. Court of Justice of the European Union (2023). Judgment of 30 March 2023, Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium, Case C-34/21, ECLI:EU:C:2023:270. EUR-Lex. (64, CJEU, 2023)
  19. Federal Republic of Germany (2017). Bundesdatenschutzgesetz (BDSG), § 26. Gesetze im Internet. (234, Germany, 2017)
  20. Court of Justice of the European Union (2024). Judgment of 19 December 2024, MK v K GmbH, Case C-65/23, ECLI:EU:C:2024:1051. EUR-Lex. (233, CJEU, 2024)
  21. Gerechtshof Amsterdam (2023). Judgment of 4 April 2023, ECLI:NL:GHAMS:2023:804 (drivers and App Drivers & Couriers Union v Ola Netherlands). Rechtspraak.nl. (68, Gerechtshof Amsterdam, 2023)
  22. Team IO+ (2026). Uber beboet met €825 miljoen — wat het echt betekent. IO+. (211, Autoriteit Persoonsgegevens, 2026)
  23. European Union (2012). Charter of Fundamental Rights of the European Union. Official Journal of the European Union, C 326. (48, European Union, 2012)
  24. Kaminski, M. E. & Malgieri, G. (2021). Algorithmic impact assessments under the GDPR: producing multi-layered explanations. International Data Privacy Law, 11(2). (174, Kaminski & Malgieri, 2021)
  25. European Parliament (2025). Digitalisation, artificial intelligence and algorithmic management in the workplace – shaping the future of work. Resolution of 17 December 2025, P10_TA(2025)0337. (62, European Parliament, 2025)