CoChat
Sign Up
Cited by 94Digitalization, Law, and RegulationEthics and Social Impacts of AILegal and Labor Studies

Humans in the GDPR and AIA governance of automated and algorithmic systems. Essential pre-requisites against abdicating responsibilities

Open access
Lazcoz, Guillermo, de Hert, Paul·2023·Computer Law & Security Review
DOI 10.1016/j.clsr.2023.105833
Open this paper in CoChat — free accountOpen PDF

Abstract

The GDPR mandates humans to intervene in different ways in automated decision-making (ADM). Similar human intervention mechanisms can be found amongst the human oversight requirements in the future regulation of AI in the EU. However, Article 22 GDPR has become an unenforceable second-class right, following the fate of its direct precedent -Article 15 of the 1995 Data Protection Directive-. Then, why should European policymakers rely on mandatory human intervention as a governance mechanism for ADM systems? Our approach aims to move away from a view of human intervention as an individual right towards a procedural right that is part of the culture of accountability in the GDPR. The core idea to make humans meaningfully intervene in ADM is to help controllers comply with regulation and to demonstrate compliance. Yet, human intervention alone is not sufficient to achieve appropriate human oversight for these systems. Human intervention will not work without human governance. This is why DPIAs should play a key role before introducing it and throughout the life-cycle of the system. This approach fits better with the governance model proposed in the Artificial Intelligence Act. Human intervention is not a panacea, but we claim that it should be better understood and integrated into the regulatory ecosystem to achieve appropriate oversight over ADM systems.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1016/j.clsr.2023.105833

Cites

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Lazcoz and de Hert (2023) warn that human intervention can become a mechanism for responsibility absorption when the human is present formally but does not exercise meaningful control.

    “Lazcoz and de Hert (2023) warn that human intervention can become a mechanism for responsibility absorption when the human is present formally but does not exercise meaningful control.”

    From From Human Oversight to Cognitive Sovereignty: A Process-Based Governance Standard for AI-Assisted Legal Reasoning (2026) · cites this paper as Lazcoz and de Hert (2023)

    Section 7 warns that adding a human to the loop can let controllers avoid safeguards, while insisting that intervention must be meaningful rather than token. Section 12 describes human agents who routinely apply algorithmic outputs without improving decisions. These passages support the warning about merely formal human involvement, but the paper does not describe that involvement as a mechanism for absorbing responsibility; Section 9 places accountability with controllers. (LLM, conf=0.81)

    Experimental — accuracy not yet measured

  • Human intervention depends on human governance: responsibility, institutional support and an organizational culture that permits officials to challenge the system rather than simply validate it.

    “Lazcoz and de Hert therefore argue that human intervention depends on human governance: responsibility, institutional support and an organizational culture that permits officials to challenge the system rather than simply validate it (Lazcoz and de Hert, 2023).”

    From Human-centric AI governance in the European Union. Accountability, fundamental rights, and institutional resilience in public administration (2026) · cites this paper as Lazcoz and de Hert, 2023

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cited by

Sorted by citations

Related

Authors
Lazcoz, G., & de Hert, P.
ORCID
Lazcoz, Guillermo
Venue
Computer Law & Security Review
Publisher
Elsevier BV
Published
2023-09
Volume
50
Pages
105833
ISSN
2212-473X (ISSN-L)
DOI
10.1016/j.clsr.2023.105833
OpenAlex
W4380841591
Cited by
93
References
0
Citations by year
2026: 23 · 2025: 16 · 2024: 8 · 2023: 45 · 2015: 1
FWCI
106.56
Type
journal article
Language
en
Open access
Licence
Locations
  • Computer law & security review (publishedVersion, cc-by-nc)
  • SSRN Electronic Journal (publishedVersion)
  • Research portal (Tilburg University) (publishedVersion, other-oa)
  • VUBIR (Vrije Universiteit Brussel) (submittedVersion)
Funders
Ministerio de Universidades
Topics
  • Social Sciences › Law › Digitalization, Law, and Regulation
  • Social Sciences › Safety Research › Ethics and Social Impacts of AI
  • Social Sciences › Business, Management and Accounting › Industrial relations › Legal and Labor Studies
Keywords
GDPR, GDPR Article 22, automated decision-making, human intervention, human oversight, AI governance, EU AI Act, accountability, data protection law, EU AI regulation, regulatory compliance

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review