Limits of automated decision making WRT workplace surveys

Question

As part of the GDPR, if personal data is used for automated decision making a number of rules apply, particularly regarding consent and access to data.

A number of companies offer workplace surveys, for example DJS Research. While they are not completely clear about what data processing they provide and the questions they attempt to answer, one would assume the goal is some sort of decision making, whether this is "donuts should be provided on Fridays" or "this department should be closed".

Is this the sort of thing that constitutes automated decision making, such that the data subjects should be provided with details of what decisions are being made and using what data if they make a subject access request requesting such data?

Answer 1

Workplace surveys aren't ATM, which is good because ATM wouldn't be permissible in a workplace context.

The GDPR's concept of automated decision making (ADM) refers to decisions that are based solely on automated processing or profiling (without human review) and produce legal or otherwise significant effects with respect to the data subject. Such ADM is only legal if one of the following applies:

• The ADM is necessary for entering into or for performing a contract with the data subject.¹ For example, credit scoring might be covered by this.
• The ADM is authorized by specific UK/EU/member state laws that include suitable safeguards for the data subject.
• The ADM is based on the data subject's explicit consent.¹

¹ In the “contractual necessity” or “explicit consent” cases, the controller is required to implement suitable safeguards, and at the minimum a right to obtain human intervention so that the decision can be contested.

From this list of permitted cases, it can be seen that an employment context does not generally allow ADM. Consent is typically impossible in an employment relationship. ADM is not necessary for performing the employment contract. In particular, there is no need for Taylorist/Amazonesque performance review systems that automatically terminate employment without human review if metrics aren't met. However, it might be necessary to use automated skill tests as part of a hiring pipeline. Of course, the employer might always find some law that specifically authorizes ADM in the employment context.

But workplace surveys aren't ADM – they might be partially automated, but the survey doesn't produce automated decisions. While such surveys might be one input into a decision that produces significant effects for the employees, such decisions would typically still be made by humans.

The lawfulness of surveys instead depends on an ordinary Art 6(1) legal basis such as a legitimate interest.

Answer 2

Automated decision making is decisions made by algorithms without human involvement

Looking at DJS’s research, there is no suggestion that decision making is automated.