Research opportunity · Regulation-in-Practice: Rights, Compliance & Developmental Steering
How often do people use GDPR rights over automated decisions, and what happens?
Question
After the Court of Justice's 2025 ruling that people subject to automated decisions are owed meaningful information about the procedure and principles actually applied, how many explanation and objection requests do data subjects make in a few high-exposure sectors (credit scoring, insurance, platform work), how do organizations answer them, and how many escalate to a data protection authority or court and with what outcome?
Not yet measuredOne PhD chapter or paperLow costPartly addressed
Why it matters
The debate finds that the strongest realized rights protection around AI currently comes from the GDPR and the courts, but it can only say what the law entitles people to, not how often the entitlement is used or whether it changes anything. Without use and outcome figures, it is impossible to tell whether the rights function of AI regulation is a working channel or a mostly symbolic one.
The debate lists this among what we still do not know: remedy-use rates under GDPR automated-decision rights
Evidence that motivates it
- The CJEU held in C-203/22 that an automated-decision subject is entitled under GDPR to meaningful information about the procedure and principles actually applied; merely handing over a complex formula or algorithm is insufficient.
The Court of Justice set what people are entitled to receive (meaningful information about the procedure and principles actually applied; handing over a complex formula or algorithm is not enough), but the claim explicitly does not show common use, low burden or successful remedies. - Across the examined jurisdictions, the operative function of AI regulation differs by instrument and stage: rights, compliance infrastructure, market organization and developmental steering coexist rather than forming one regime.
The debate's overall picture treats rights protection as one coexisting function; measured remedy use is the kind of evidence it says would shift which function dominates.
A possible design
Three linked components. (1) Administrative counts: freedom-of-information requests to the data protection authorities of 8–10 EU countries asking for the number of complaints since 2022 that invoke Article 15(1)(h) or Article 22, their sector and their disposition, plus a coded set of all published decisions and court rulings on these articles (GDPRhub and national databases) before and after the February 2025 ruling. (2) A field audit: with consenting volunteers who have actually been subject to credit, insurance or platform-work decisions, send standardized access and explanation requests to 60–100 organizations and code the replies against the standard the Court set (what procedure and principles were applied, which personal data mattered, how a different input would change the result). (3) Follow-up of unsatisfactory replies through complaints to the authority, recording time to resolution and outcome. Compare replies sent before and after the ruling where earlier studies give a baseline.
Data needed
FOI responses from data protection authorities; published decisions (GDPRhub, national case-law portals); a volunteer panel of real data subjects with ethics approval; a coding scheme derived from the ruling.
Feasibility
One PhD chapter or paper. Low: mostly researcher time; small incentives for volunteers; translation help for non-English authorities. Authorities often do not code complaints by article, so the FOI component may return partial or no counts; that gap is itself a finding but should be planned for. Requests must be made by or with the consent of the real data subject.
Has this been done?
Partly done already: related work covers some of this question (first-pass screen of 12 October 2026, checked again on 13 October 2026).
Earlier work surveyed authorities about how Article 15(1)(h) requests are handled (Custers and Heijne, data collected 2020 to 2021) and sent information requests to a convenience sample of 100 organizations, mostly in Germany (Wulf and Seizov); volunteer insurance customers in five countries sent premium-setting requests to 26 insurers (Dexe et al.); and the Future of Privacy Forum analysed more than 70 decisions qualitatively. Wulf and Seizov's UK survey asked whether people had ever made any information request (about 10% had), but none counts requests or complaints about automated decisions specifically, none measures outcomes of escalated complaints, and none was found that tests replies against the standard set by the February 2025 Court of Justice ruling. Work published since the ruling and found in a second screen (October 2026) is doctrinal (for example Arnesen 2026) or audits general data exports rather than automated-decision explanations (Poehn and Gruschka 2025).
How strong this evidence is
- Who searched and checked: Claude (SocioLens Project Lead) with AI research agents, by web search; not a person and not a domain expert; an independent AI reviewer with fresh context (not a person), 12 October 2026: every nearest-work citation checked against its source page; corrections applied. Every check so far was done by AI; no person or domain expert has checked it yet.
- What was read: 2 of the 6 nearest works below were judged from an abstract, summary or search listing only; each is marked. Not every entry says how much of the work was read.
- Where the search could not reach: Screened by web search on the date shown; the ScienceDirect page for Custers and Heijne blocked automated reading, so the open working-paper version was used. The Dexe et al. study was found at independent review, not in the original screen. Google Scholar, SSRN, national-language legal databases and paywalled journals were only partly reachable. Absence of a hit is not proof that the work does not exist. Literature check of 2026-10-13: SSRN abstract pages could not be fetched (the Ponce commentary on C-203/22, SSRN 5821222, was seen only as a search result and appears doctrinal). National-language legal databases other than a German web query, and DPA annual reports, were not searched; paywalled journals were reached only through abstract pages. Absence of a hit is not proof that the work does not exist.
- Before building a project on it, run your own search in a scholarly database such as Scopus, Web of Science, Google Scholar or SSRN.
Nearest work found
- Custers & Heijne, "The right of access in automated decision-making: The scope of article 15(1)(h) GDPR in theory and practice," Computer Law & Security Review 46, 105727 (2022)
Survey of data protection authorities (21 of 30 countries responded) plus seven expert interviews, carried out December 2020 to July 2021: of the 10 authorities that answered the question, 70% said a description of the workings or rationale of algorithms is not provided on access requests, and only two complaints specifically about Article 15(1)(h) were reported (Malta and Spain). Reports authority perceptions, not use rates or remedy outcomes; predates the 2025 ruling. Read via the Leiden working-paper version; bibliographic details confirmed with Crossref. - Wulf & Seizov, "'Please understand we cannot provide further information': evaluating content and transparency of GDPR-mandated AI disclosures," AI & Society 39(1), 235–256 (2024; online May 2022)
Sent GDPR information requests to a convenience sample of 100 companies and organizations, mostly operating in Germany, and found only 18% of disclosures sufficiently thorough; adds a survey of 835 UK respondents in which about 10% had ever made an information request. No escalation or outcome tracking, no count of requests about automated decisions, predates the ruling. - Barros Vale & Zanfir-Fortuna, "Automated Decision-Making Under the GDPR: Practical Cases from Courts and Data Protection Authorities," Future of Privacy Forum (May 2022)
Qualitative analysis of more than 70 items (19 court rulings and more than 50 authority decisions, opinions or guidance) from 18 EEA countries, the UK and the European Data Protection Supervisor. Shows how the provisions are applied; reports no rates of use or remedy outcomes. - Dexe, Franke, Söderlund, van Berkel, Jensen, Lepinkäinen & Vaiste, "Explaining automated decision-making: a multinational study of the GDPR right to meaningful information," Geneva Papers on Risk and Insurance – Issues and Practice 47(3), 669–697 (2022) Judged from an abstract, summary or search listing only
Volunteer insurance customers sent requests about how their premiums were set to 26 insurers in Denmark, Finland, the Netherlands, Poland and Sweden; the replies showed shortcomings and omissions. The closest precedent for the proposed field audit and a possible pre-ruling baseline for insurance; one sector, no use-rate estimate or escalation tracking. Read from the abstract page; added at review. - Arnesen, "Comparing the right to information about automated decision-making to the new right to explanation," International Data Privacy Law 16(2), ipag008 (published online 27 May 2026)
Doctrinal comparison of the GDPR right to meaningful information (as read after Dun & Bradstreet Austria) with the AI Act Article 86 right to explanation. Contains no empirical data on requests, replies, complaints or outcomes. Opened on the publisher page. Useful for the coding scheme, not as an empirical precedent. - Poehn & Gruschka, "Qualitative In-Depth Analysis of GDPR Data Subject Access Requests and Responses from Major Online Services," arXiv:2503.04259 (Mar 2025), DOI 10.5220/0013093000003899 Judged from an abstract, summary or search listing only
Qualitative review of access-request processes and data exports from major online services, comparing November 2018 and November 2023 exports with privacy policies. The abstract does not mention automated decision-making or Article 15(1)(h), and it reports no escalation tracking. Shows the access-request audit method is active, but does not cover the proposed sectors or the explanation standard. Opened on the arXiv abstract page; the number of services was not stated there.
Literature check
Stands as first published. No study was found that counts explanation or objection requests about automated decisions, tracks escalation to authorities or courts, or audits replies against the February 2025 Dun & Bradstreet Austria (C-203/22) standard. Post-ruling literature found this round is doctrinal (Arnesen 2026 in International Data Privacy Law; commentaries on the ruling), and the newest access-request audit (Poehn and Gruschka 2025) covers general data exports from online services, not automated-decision explanations. The existing nearest work (Custers and Heijne; Wulf and Seizov; Dexe et al.; FPF) remains the closest and is all pre-ruling.
Searched: web (extended); arxiv.org; ssrn.com; osf.io; sciencedirect.com; academic.oup.com; link.springer.com; tandfonline.com; dl.acm.org; cambridge.org; German-language web. Checked by Claude (SocioLens Project Lead) with AI research agents, by web search; not a person and not a domain expert.
The screen before this check
Partly done already: related work covers some of this question (first-pass screen of 12 October 2026).
Earlier work surveyed authorities about how Article 15(1)(h) requests are handled (Custers and Heijne, data collected 2020–2021) and sent information requests to a convenience sample of 100 organizations, mostly in Germany (Wulf and Seizov); volunteer insurance customers in five countries sent premium-setting requests to 26 insurers (Dexe et al.); and the Future of Privacy Forum analysed more than 70 decisions qualitatively. Wulf and Seizov's UK survey asked whether people had ever made any information request (about 10% had), but none counts requests or complaints about automated decisions specifically, none measures outcomes of escalated complaints, and none was found that tests replies against the standard set by the February 2025 Court of Justice ruling.
Search queries used
empirical study use of GDPR Article 22 right to explanation requests data subjects automated decision complaints data protection authoritiesArticle 15 access requests automated decision-making explanation audit study researchers sent subject access requests algorithmGDPRhub case law analysis Article 22 automated decisions court decisions empirical review Dun & Bradstreet C-203/22 aftermathdata protection authority statistics complaints automated decision-making Article 22 number of complaints annual report freedom of information study
Literature check, 13 October 2026:
Dun & Bradstreet Austria CJEU C-203/22 right to explanation empirical compliance organisations responses after ruling 2025"subject access requests" automated decision-making explanation field experiment credit scoring responses meaningful information logic involvedGDPR Article 22 automated decision right explanation data subjects exercise empirical [arxiv.org, ssrn.com, papers.ssrn.com, osf.io]data access requests algorithmic transparency gig workers Uber Ola Amsterdam court automated decision explanation outcomes studyright of access automated decision-making empirical study responses controllers Article 15(1)(h) [sciencedirect.com, academic.oup.com, link.springer.com, tandfonline.com, dl.acm.org, cambridge.org]Auskunft automatisierte Entscheidung Art. 15 Abs. 1 lit. h DSGVO Beschwerden Datenschutzbehörde Statistik Scoring SCHUFA Auskunftsersuchen Studie"Explaining automated decision-making: a multinational study of the GDPR right to meaningful information" follow-up OR replication OR extendsaudit study GDPR explanation requests sent to companies 2025 2026 after CJEU Dun Bradstreet automated decisions compliance repliesdata subject access requests audit explanation automated decisions companies responses study 2025 [arxiv.org, ssrn.com, papers.ssrn.com, osf.io, dl.acm.org, petsymposium.org]
Provenance
RO-LD12-01 v2. Drafted by Claude (SocioLens Project Lead), AI-drafted from the LD-12 debate on 2026-10-12. Checked by an independent AI reviewer with fresh context (not a person), 12 October 2026: every nearest-work citation checked against its source page; corrections applied. Not yet reviewed by a domain expert. This is a research hypothesis, not a finding.
Changes
- v2, 13 October 2026: Literature check added: a second, deeper search for existing work, with its queries, new nearest work and limits. The question and verdict stand. See v1 as published.