Source: Center for Democracy and Technology

The piece explains that the GDPR can provide meaningful avenues for redress for harms caused by algorithmic or AI-driven processing of personal data, acting as a tech‑agnostic legal framework that applies regardless of whether a system meets the AI Act’s definitional thresholds. It highlights that the GDPR prohibits decisions based solely on automated processing when those decisions produce legal effects or significantly affect a data subject, creating a broader default ban than some AI Act prohibitions and addressing “gating” issues where an AI label is disputed. The GDPR nonetheless contains three targeted exceptions — explicit consent, necessity for contract performance, and processing authorised by law with safeguards — and, even when exceptions apply, requires safeguards such as the right to human intervention, the right to be heard, and the right to contest decisions.

The summary also contrasts the GDPR’s and the AI Act’s versions of a right to an explanation: CJEU case law has recognised a disclosure obligation about the logic of solely automated decisions under the GDPR, while the AI Act creates an explanation right tied to specific high‑risk use cases listed in Annex III and does not require decisions to be solely automated. The AI Act’s narrower, Annex‑based approach may limit remedies in many deployments, and the text notes an ongoing development of Commission guidelines on high‑risk examples; scholars describe a “hydraulic” relationship where stronger pre‑existing explanation rights under laws like the GDPR could narrow the AI Act’s interpretation, necessitating further analysis to ensure these mechanisms reinforce rather than weaken each other.