Question to the Ministry of Justice:

To ask the Secretary of State for Justice, whether significant Automated Decision-Making is taking place or planned within his Department, and if he will make a statement.

The UK’s data protection legislation applies to the private and public sector alike. Where significant decisions are taken solely based on automated processing, Departments must provide safeguards including rights to information, challenge and human intervention and comply with the relevant transparency obligations.

The Data (Use and Access) Act 2025 maintains safeguards for individuals who are subject to significant decisions based solely on automated processing. Organisations must provide individuals with the right to contest such decisions, obtain human intervention and make representations to the controller. These safeguards apply where solely automated decision-making (ADM) has legal or similarly significant effects on an individual.

Transparency requirements on organisations apply as soon as organisations obtain individuals’ data for solely ADM. Articles 13-14 of the UK GDPR require organisations to provide data subjects privacy information (usually in a privacy notice) about the existence of solely ADM including profiling, meaningful information about the logic involved, and the significance and the envisaged consequence of such automated processing for the individual.

After a decision has been based solely on automated processing, the reformed Article 22 includes safeguards that must be applied once a legal or similarly significant decision has been made about the data subject. Organisations are required to provide data subjects with information related to significant decisions that have been taken about them based solely on automated processing and enable them to obtain human intervention or challenge a decision.

Where a partly automated decision is taken in which the human input influences the final decision, it is likely that the human input would be considered to be meaningful. Consequently, it would not be necessary to provide the additional safeguards set out under the automated decision-making provisions.

Article 22C of the UK GDPR contains safeguards for solely automated decisions that have legal or similarly significant effects on individuals. Where organisations have made such decisions, must comply with these safeguards which include: providing information about the decision taken, the right for individuals to contest the decision, make representations, and obtain human intervention for the decision.

The Data (Use and Access) Act 2025 introduced reforms to the rules on solely automated decision-making, while maintaining safeguards for individuals. The Act clarifies that organisations must inform individuals when significant decisions are taken solely by automated means, and individuals retain rights to challenge such decisions and obtain human intervention.

The Government has required the Information Commissioner’s Office (ICO) as the independent data protection regulator to produce a Code of Practice on AI and ADM. This Code will provide authoritative guidance to support organisations with their data protection compliance in this area.