The thin red line: Refocusing data protection law on ADM, a global perspective with lessons from case-law

This article explores existing data protection law provisions in the EU and in six other ju-risdictions from around the world -with a focus on Latin America -that apply to at least some forms of the processing of data typically part of an Artificial Intelligence (AI) system. In particular, the article analyzes how data protection law applies to "automated decision-making" (ADM), starting from the relevant provisions of EU's General Data Protection Regu-lation (GDPR). Rather than being a conceptual exploration of what constitutes ADM and how "AI systems" are defined by current legislative initiatives, the article proposes a targeted ap-proach that focuses strictly on ADM and how data protection law already applies to it in real life cases. First, the article will show how GDPR provisions have been enforced in Courts and by Data Protection Authorities (DPAs) in the EU, in numerous cases where ADM is at the core of the facts of the case considered. After showing that the safeguards in the GDPR already apply to ADM in real life cases, even where ADM does not meet the high threshold in its spe-cialized provision in Article 22 ("solely" ADM which results in "legal or similarly significant effects" on individuals), the article includes a brief comparative law analysis of six jurisdic-tions that have adopted general data protection laws (Brazil, Mexico, Argentina, Colombia, China and South Africa) and that are visibly inspired by GDPR provisions or its predeces-sor, Directive 95/46/EC, including those that are relevant for ADM. The ultimate goal of this study is to support researchers, policymakers and lawmakers to understand how existing data protection law applies to ADM and profiling.1 & COPY; 2023 Katerina Demetzou, Gabriela Zanfir-Fortuna, Sebastiao Barros Vale. Published by Elsevier Ltd. All rights reserved.