Data Protection Monitor
Global Privacy & Data Protection Intelligence

European Economic Area (EEA) · Module Detail

European Economic Area: Algorithmic, Biometric & Surveillance Governance

← Full European Economic Area overview Build report with European Economic Area Request deeper dive

#

Article 22 is settled law with recent CJEU interpretation, but the practical GDPR/AI Act interface remains in active development pending joint EDPB-Commission guidelines and AI Act simplification.

Primary frameworkGDPR Article 22 (Regulation (EU) 2016/679); interplay with Regulation (EU) 2024/1689 (AI Act)
Supervisory authorityEDPB (joint guideline development with European Commission)
Traffic-light rationale — AmberArticle 22 is settled law with recent CJEU interpretation, but the practical GDPR/AI Act interface remains in active development pending joint EDPB-Commission guidelines and AI Act simplification.

Sub-modules (6)

Category narrative288 words

Algorithmic, AI, and biometric governance in the EEA is governed by the dual regime of the GDPR (Arts. 5, 6, 9, 15(1)(h), 22, and 35) and the EU Artificial Intelligence Act (Regulation (EU) 2024/1689, entered into force 1 August 2024). Under Art. 22 GDPR and CJEU Case C-634/21 SCHUFA Holding (7 December 2023), automated profiling (such as probability credit scoring) falls within the Art. 22(1) prohibition even where a third party makes the final formal decision, if that third party relies predominantly on the automated score; and under Case C-203/22 Dun & Bradstreet Austria (27 February 2025), controllers must give data subjects a concrete, understandable explanation of how their specific attributes produced the automated output under Art. 15(1)(h). On AI model training and deployment, EDPB Opinion 28/2024 (17 December 2024) establishes the criteria for evaluating when a trained AI model can be considered anonymous (requiring negligible likelihood of both direct training-data extraction and query-based regurgitation) and how Art. 6(1)(f) legitimate interests applies to web-scraped training data. Under the EU AI Act, Chapter II prohibitions entered into force on 2 February 2025 — banning untargeted scraping of facial images from the internet or CCTV to build facial recognition databases (Art. 5(1)(e)), emotion recognition in workplaces and educational institutions (Art. 5(1)(f)), biometric categorisation inferring sensitive traits (Art. 5(1)(g)), social scoring (Art. 5(1)(c)), and real-time remote biometric identification in publicly accessible spaces for law enforcement save under narrow judicial-warrant exceptions (Art. 5(1)(h)) — while General-Purpose AI (GPAI) obligations applied from 2 August 2025 and high-risk AI system obligations (including Art. 27 Fundamental Rights Impact Assessments aligned with Art. 35 GDPR DPIAs) apply from 2 August 2026 (subject to targeted timeline adjustments proposed in the Digital Omnibus Package of 19 November 2025).

Sources and claims (7)
  1. ConfirmedIAPP — Article 22 GDPR provides data subjects with the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them.observed
  2. ProbableIAPP — The EDPB and the European Commission are jointly preparing guidelines on the interplay between the GDPR and the AI Act, addressing transparency, risk assessments, bias detection and accountability, with a first draft potentially available soon and final adoption possible by end of 2026.observed
  3. Confirmedunavailable — The EU's AI Act high-risk system compliance timeline, originally set for August 2026, is being extended via the Digital Omnibus on AI, with organisations to receive six months to comply once implementing standards and support tools are confirmed, capped at December 2027.
  4. Confirmedunavailable — Genetic data falls within the Article 9 special-category regime; the Digital Omnibus's proposed derogation for incidental/residual sensitive-data processing in AI development would potentially extend to genetic data, subject to EDPB/EDPS-recommended lifecycle safeguards.
  5. ConfirmedEDPB — The EDPB has issued formal correspondence to the European Commission addressing the privacy implications of proposed US legislative changes to entry conditions for EEA citizens, and separately regarding a US Supreme Court judgment, reflecting ongoing EDPB engagement with law-enforcement and surveillance-adjacent international-cooperation matters.observed
  6. Confirmedunavailable — Regulation (EU) 2026/1744 (Digital Omnibus on AI) extends deadline: Entered into force 27 July 2026 (published in the OJ 24 July 2026); postpones AI Act high-risk-system obligations to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I product-embedded systems.
  7. Probableunavailable — AI Act Art. 4a grants: Permits providers of high-risk AI systems, and under Art. 4a(2) deployers and providers/deployers of other AI systems, to exceptionally process special-category personal data strictly necessary for bias detection and correction under Art. 10(2)(f)-(g), subject to stated safeguards.