Under the GDPR, when an organization uses AI for solely automated profiling that significantly affects individuals, which principle MOST directly requires the organization to be able to demonstrate lawfulness and proper safeguards to the supervisory authority?
Select an answer to reveal the explanation.
Short Explanation
You need accountability because it’s the principle that makes you prove to the supervisory authority that the automated profiling is lawful and properly safeguarded. The other principles limit how data is handled, but they don’t directly require demonstrable compliance.
Full Explanation
Accountability (Article 5(2)) is correct because it requires the controller not only to comply with data protection principles but also to be able to demonstrate compliance to the supervisory authority. In the context of solely automated profiling that significantly affects individuals, that means being able to show that profiling under Article 22 meets legal requirements and includes proper safeguards. Data minimization under Article 5(1), third point, purpose limitation under Article 5(1), second point, and storage limitation under Article 5(1), fifth point are substantive data protection principles, but they are not the principle specifically concerned with the demonstrability of compliance.