Article 22 GDPR right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, subject to exceptions for contract necessity, legal authorisation or explicit consent. Currently the subject of active CJEU litigation (Dun & Bradstreet, C-203/22) and repeated EDPS guidance through 2025-26.