IrelandGDPR Article 22 and Data Protection Act 2018 Section 57, Automated Decision-Making in Ireland
Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; Data Protection Act 2018, s. 57
In force since .
A data subject rights rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Data subject rights, Governance
- Audit expectation
- none
What it requires
- Where a decision based solely on automated processing about a person in Ireland rests on a contract with them or on their explicit consent, put suitable safeguards in place, at least the right to obtain human intervention, to express their point of view and to contest the decision, under General Data Protection Regulation (GDPR) Article 22(3).NIST Privacy FrameworkCT.DM-P10
- Where an Irish enactment authorises or requires a solely automated decision about a person and the decision does not simply grant what they asked for, let them make representations, request human intervention and appeal the decision, and tell them in writing the steps you took and, on appeal, the outcome, under Data Protection Act 2018 section 57.NIST Privacy FrameworkCT.PO-P3
- Do not subject a person in Ireland to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).NIST Privacy FrameworkCT.DM-P10
- Do not base a solely automated decision with legal or similarly significant effects on a person in Ireland on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).NIST Privacy FrameworkCT.PO-P1
- If you make solely automated decisions about a person in Ireland of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text. Also read by: Data Protection Commission (guidance, recorded ).
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 3.3Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
GDPR Article 83(5)(b): the higher fine tier, up to EUR 20,000,000 or 4% of total worldwide annual turnover of the preceding financial year, applies to infringement of the data subjects' rights in Articles 12 to 22, including the Article 22 right against solely automated decision making.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Data Protection Commission (An Coimisiún um Chosaint Sonraí), Ireland's supervisory authority under the GDPR and the Data Protection Act 2018.
Enforcement record
Counts the large scale statutory inquiries the Data Protection Commission finalised in calendar year 2025 (4), per the Commission's own press release announcing its 2025 Annual Report, published . The fines imposed that year included two fines totalling EUR 530 million against TikTok Technology Limited over transfers of EEA user data to China, and a EUR 550,000 fine against the Department of Social Protection over biometric facial matching in the Public Services Card registration process; the release's own stated total of fines for the year is just over EUR 530.77 million. Public enforcement actions only, counted from the Commission's own announcement rather than a private tracker; the release does not restate a cumulative total since 2018. This is the regime's own enforcement record, not specific to this instrument.
- As of
- Currency
- EUR
- Source link
- https://www.dataprotection.ie/en/data-protection-commission-publishes-2025-annual-report
- Fines per year
- 530,770,000
- Actions per year
- 4
Settledness
- As of
- Guidance link
- https://www.dataprotection.ie/en/individuals/know-your-rights/your-rights-relation-automated-decision-making-including-profiling
- Guidance body
- Data Protection Commission
- Open questions
- Does a decision count as based solely on automated processing under Article 22(1) of the GDPR where a person reviews the automated output before the decision is made?
What it makes you log
Logging duty
Article 22(3) and section 57 require safeguards (representations, human intervention, an appeal) and, on a request for intervention or an appeal, written notice of the steps taken and the outcome. They state no duty to create, keep or produce a log or record of the decision.
- Kind
- None
- As of
What this law does
General Data Protection Regulation (GDPR) Article 22 gives a person in Ireland the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.
Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.
Under Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.
Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.
Section 57 of the Data Protection Act 2018 is Ireland's Article 22(2)(b) law: a solely automated decision authorised or required by an enactment may be made where it grants the person's request, or where the controller lets the person make representations, request human intervention and appeal, and tells them in writing what it did.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .