Step 5. Automated processing and profiling

How to customise the section of a privacy notice about automated processing or profiling

You must inform data subjects if you use automated decision making without any human intervention and this has a significant impact on or legal consequences for the data subjects. For example, if HR were to use a computer programme to collect sickness absence notifications and, after a threshold has been reached within a certain period, issue an automatic letter putting the employee on probation.

Profiling uses the results of an automated process to evaluate aspects of a person. For example, if Development & Alumni were to employ a service that conducts automated wealth screening among potential donors and then contact them for a donation.

You must include a sentence about automated decision making and profiling in your privacy notice – either to confirm that you will not use these mechanisms or that you intend to do so. In the latter case, you must provide details about why and how.

Examples

“We do not use profiling or automated decision-making processes.”

D&A uses an automated tool to ascertain the ability of potential donors to support the University philanthropically. We utilise the information resulting from this to contact potential donors.”