Guidelines 2/2020 on articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies

Paragraph 2.4.3  Automated individual decision-making

36. If relevant to the agreement in question, international agreements should as a general principle contain a clause stating that the receiving public body will not take a decision based solely on automated individual decision-making, including profiling, producing legal effects concerning the data subject in question or similarly affecting this data subject. Where the purpose of the transfer includes the possibility for the receiving public body to take decisions solely on automated processing in the sense of Article 22 GDPR, this should only take place under certain conditions set forth in the international agreement, such as the need to obtain the explicit consent of the data subject. If the decision does not comply with such conditions, the data subject should have the right not to be subject to it. Where it allows automated individual decision-making, the international agreement should, in any case, provide for necessary safeguards, including the right to be informed about the specific reasons underlying the decision and the logic involved, to correct inaccurate or incomplete information, and to contest the decision and obtain human intervention.