Exam AIGP topic 1 question 124 discussion

The correct answers according to GDPR are: A. Is authorized with the data subject’s explicit consent. B. Is authorized by applicable EU law and includes suitable safeguards. D. Is necessary for entering into or performing under a contract between the data subject and data controller. These are the three lawful bases in GDPR Article 22 where fully automated decisions can be made without a required human override, so long as the appropriate safeguards are also in place. The "solely benefit" and legitimate interests basis (option C) is not a recognized exception for automated decisions under GDPR.

Tricky question, contract, not contact. Going with A.

The answer is all 4. https://gdpr-info.eu/art-22-gdpr/ if the decision: is necessary for entering into, or performance of, a contract between the data subject and a data controller; is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or is based on the data subject’s explicit consent.

This is not a valid exception under Article 22. Legitimate interest is not sufficient on its own to justify automated decisions that significantly affect individuals. GDPR requires stronger legal grounds such as explicit consent, contractual necessity, or legal authorization.