Automated decision-making under Irish data protection law

Part 1 Section 57 of the Irish Data Protection Act makes other exceptions to Art. 22 (2) GDPR possible if the decision is authorized or required by or under an enactment and either

• the effect of that decision is to grant a request of the data subject or
• in all other cases, adequate steps have been taken to safeguard the legitimate interests of the data subject, which must include:
  1. the right to make representations in relation to the decision,
  2. to request human intervention in the decision-making process and
  3. to appeal the decision.

Part 5 Section 89 of the Irish Data Protection Act gives rights regarding automated decision making. These include the right not to be subject to decisions based on automated processing, including profiling, unless the taking of the decision is authorized by law and the data subject has the possibility to make representations to the competent authority regarding the decision or the controller has taken adequate steps to safeguard the legitimate interests of the data subject.