An organization processes personal data using AI systems for targeted advertising. Under GDPR, what is the MOST important compliance requirement when using solely automated decision-making that produces legal or similarly significant effects on individuals?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — when AI makes a solely automated decision that has legal or similarly significant effects, you've got to give people human review, an explanation, and a way to contest it. That's the core GDPR Article 22 safeguard, not just encryption or public disclosures.
Full Explanation
The correct requirement is providing individuals the right to obtain human review, explain their situation, and contest the decision. GDPR Article 22 restricts solely automated decisions with legal or similarly significant effects unless safeguards apply, including human intervention, expressing one's point of view, and contesting the decision. Encrypting all personal data is a general security obligation, not the key automated-decision safeguard. Publishing the model's architecture and training data sources is not required by GDPR. Obtaining Digital Markets Act approval relates to different legislation.