IAPP Artificial Intelligence Governance Professional (AIGP) — Question 31

According to the GDPR, an individual has the right to have a human confirm or replace an automated decision unless that automated decision:

Answer options

• A. Is authorized with the data subject’s explicit consent.
• B. Is authorized by applicable EU law and includes suitable safeguards.
• C. Is deemed to solely benefit the individual and includes documented legitimate interests.
• D. Is necessary for entering into or performing under a contact between the data subject and data controller.

Correct answer: B

Explanation

The correct answer is B because GDPR allows automated decisions only when they are lawful under EU regulations and have appropriate safeguards. Options A, C, and D are incorrect as they do not provide the legal basis required by GDPR for such automated decisions, which must be supported by applicable laws and protections.