Overview
The GDPR grants data subjects comprehensive rights that also apply when AI systems are deployed. Particularly relevant is Art. 22 GDPR -- the right not to be subject to a decision based solely on automated processing.
Relevant Data Subject Rights
Right of Access (Art. 15)
Data subjects have the right to know:
- Whether their data are being processed
- Which data are being processed
- For what purpose the processing takes place
- Whether automated decision-making including profiling exists
Practical Tip
Prepare standardised responses that transparently explain the use of AI. This saves time and ensures consistent quality.
Right to Rectification (Art. 16)
When AI systems work with erroneous data, data subjects can request correction. This particularly concerns:
- Input data: Incorrect base data leading to wrong results
- Profile data: Wrong assignments or categorisations
- Training data: Where demonstrably erroneous data have influenced the model
Automated Individual Decision-Making (Art. 22)
Particularly important when deploying AI:
- General prohibition of automated decisions with legal effect
- Exceptions only for contractual necessity, legal authorisation or explicit consent
- For permitted automated decisions: right to human review
Implementation in Practice
| Right | Implementation Measure | Deadline |
|---|---|---|
| Access | Maintain AI processing register | 1 month |
| Rectification | Implement feedback process | Without delay |
| Erasure | Deletion concept for AI data | 1 month |
| Objection | Provide opt-out mechanism | Without delay |
| Explanation | Deploy explainable AI models | Ongoing |
Fine Risk
Violations of data subject rights can be sanctioned with fines of up to EUR 20 million or 4% of annual global turnover (Art. 83(5) GDPR).
Recommendations
- Implement explainability in your AI systems
- Ensure that data subjects can easily object
- Document the logic of automated decisions
- Provide a human contact person for AI-related enquiries
- Conduct regular bias checks to avoid discrimination
Implementing Data Subject Rights Technically?
From explainable AI models to opt-out mechanisms — Creativate AI Studio helps you implement the technical requirements of GDPR data subject rights in your AI systems.
Need legal clarity?
For specific legal questions on the AI Act and GDPR, specialized legal advice focusing on AI regulation, data protection and compliance structures is available.
Independent legal advice. No automated legal information. The platform ai-playbook.eu does not provide legal advice.