According to the GDPR's transparency principle, when an Al system processes personal data in automated decision-making, controllers are required to provide data subjects specific information on?

The General Data Protection Regulation (GDPR), under Articles 13(2)(f) and 14(2)(g), explicitly mandates that when automated decision-making (including profiling) is used, data controllers must provide the data subject with specific information. This includes confirming "the existence of automated decision-making" and providing "meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject." This requirement is a cornerstone of the transparency principle, ensuring individuals understand how and why an AI system is making decisions about them, particularly those with legal or similarly significant effects.

B. This describes the right of access under Article 15, which is a distinct right exercised upon request, not part of the initial transparency information provided at the point of data collection.
C. The legal basis for processing must be disclosed, but the Data Protection Impact Assessment (DPIA) is an internal risk assessment tool and is not required to be provided to data subjects.
D. While the DPO's contact details are a general transparency requirement, they are not specific to the automated decision-making process itself, which is the focus of the question.

1. Regulation (EU) 2016/679 (General Data Protection Regulation).

Article 13(2)(f): When data is collected from the data subject

the controller must provide "the existence of automated decision-making

including profiling

referred to in Article 22(1) and (4) and

at least in those cases

meaningful information about the logic involved

as well as the significance and the envisaged consequences of such processing for the data subject."

Article 14(2)(g): Provides the same requirement when personal data has not been obtained from the data subject.

2. European Data Protection Board (formerly Article 29 Working Party). "Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679" (WP251rev.01).

Page 26

Section V.B.3: "The controller should provide meaningful information about the logic involved

not a complex explanation of the algorithms used... The explanation should be simple enough for the average data subject to understand... The information provided should also explain the significance and envisaged consequences of the processing."

3. Kaminski

M. E. (2019). The Right to Explanation

Explained. Berkeley Technology Law Journal

34(1)

189-218.

Page 202: Discusses the transparency obligations under Articles 13-15

noting that Articles 13 and 14 require proactive disclosure of "meaningful information about the logic involved" in automated decision-making

distinguishing it from the reactive right of access. (Available via university repositories and academic databases).