Il diritto di contestazione delle decisioni automatizzate nel Regolamento Europeo sulla Protezione dei Dati Personali

The art. 22 of the General Data Protection Regulation (GDPR) provides for the prohibition of decisions based “solely” on automated data processing which may have legal effects concerning the data subject or “similarly affects” him or her. However, three significant exceptions are also indicated. Since these cases are supposed to be exceptional, art. 223 requires some additional safeguards and provides the data subject with extra rights. This work argues that those minimal safeguards are ordered in a progressive line that reaches its climax with the “right to contest”, which in turn has to be seen as the most comprehensive. Drawing from the juridical proper meaning of it, it is also argued that in order to be fully exercised, the data subject must be allowed to deeply understand the technicalities involved in the processing, if needed. In other words, the right to contest seems to presuppose a right to explanation, whose existence in the GDPR is currently highly discussed. Since there is an intimate link between the two, I suggest revising the notion of “explanation” rejecting any abstract definition and adopting a relative and contextual one, strictly linked to the particular way in which the contestation needs to be mediated.