European data protection law said that a person should not be judged by a machine alone long before the AI Act existed. This chapter sets out what that right means when the machine manages people: GDPR Article 22 as read in SCHUFA and Dun & Bradstreet, the room Article 88 leaves for collective agreements, and Chapter III of the Platform Work Directive, to be transposed by 2 December 2026. It concerns M2 Evaluation, where scores are produced, and M3 Consequence, where they meet a person's pay, job or access to work; it touches M1 Direction where allocating work shades into access to work.
Four bodies of law ask what an employer must show about the person who decided and the logic a system applied. The GDPR, Regulation (EU) 2016/679, answers through the data subject: Article 22 limits solely automated decisions, Articles 13 to 15 require information about the logic, and Article 35 requires a data protection impact assessment (DPIA) (5, European Union, 2016). It binds every employer now. The Platform Work Directive, Directive (EU) 2024/2831, answers through the working relationship, but only for digital labour platforms (37, European Union, 2024). The AI Act's Article 86 gives a right to an explanation (Chapter 21), but Article 86(3) limits it to cases where Union law does not already provide one, and Article 2(11) leaves room for rules more favourable to workers (1, European Union, 2024). The AI Act therefore sits on top of the GDPR, not in its place. What follows describes architectural implications, not legal advice.
Article 22(1) gives the data subject "the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her" (5, European Union, 2016). In SCHUFA the Court split it into three cumulative conditions: a decision, based solely on automated processing, with legal or similarly significant effects (53, CJEU, 2023). A decision is broad: recital 71 covers "e-recruiting practices without any human intervention" and names the prediction of "performance at work" as profiling, so shortlists, pay bands, warnings, deactivations and, in some circumstances, scores are candidates.
Primary topics explored
- Four instruments, one question
- Solely automated decisions
- Scores that decide
- What a human decision must mean to count
- Explaining the logic
- Employment data: Article 88 and national rules
About AI Boss
AI Boss is Book 7 of The Transformed Architecture. It examines what happens when artificial intelligence takes the manager's chair: algorithmic management of direction, evaluation, consequence, development and care, the effects on people, the management of AI agents, Europe's legal answer, and how to design an accountable AI boss, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat and The Transformed Security Architect.
Executives, line managers, HR and people leaders, works councils and trade unions, public employers, architects and AI governance leads, data protection and legal officers, procurement and programme leaders, and risk, compliance and audit.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 22: Data Protection and the Platform Work Directive: The Right to a Human Decision in AI Boss gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Europe's Answer” and is one of 37 drawn from the manuscript.