Research opportunity · Regulation-in-Practice: Rights, Compliance & Developmental Steering
How often do people use GDPR rights over automated decisions, and what happens?
Earlier version (v1)
This is RO-LD12-01 as it was published at v1, kept unchanged. The current version is v2; its changes are listed there.
Question
After the Court of Justice's 2025 ruling that people subject to automated decisions are owed meaningful information about the procedure and principles actually applied, how many explanation and objection requests do data subjects make in a few high-exposure sectors (credit scoring, insurance, platform work), how do organizations answer them, and how many escalate to a data protection authority or court and with what outcome?
Not yet measuredOne PhD chapter or paperLow costPartly addressed
Why it matters
The debate finds that the strongest realized rights protection around AI currently comes from the GDPR and the courts, but it can only say what the law entitles people to, not how often the entitlement is used or whether it changes anything. Without use and outcome figures, it is impossible to tell whether the rights function of AI regulation is a working channel or a mostly symbolic one.
The debate lists this among what we still do not know: remedy-use rates under GDPR automated-decision rights
Evidence that motivates it
- The CJEU held in C-203/22 that an automated-decision subject is entitled under GDPR to meaningful information about the procedure and principles actually applied; merely handing over a complex formula or algorithm is insufficient.
The Court of Justice set what people are entitled to receive (meaningful information about the procedure and principles actually applied; handing over a complex formula or algorithm is not enough), but the claim explicitly does not show common use, low burden or successful remedies. - Across the examined jurisdictions, the operative function of AI regulation differs by instrument and stage: rights, compliance infrastructure, market organization and developmental steering coexist rather than forming one regime.
The debate's overall picture treats rights protection as one coexisting function; measured remedy use is the kind of evidence it says would shift which function dominates.
A possible design
Three linked components. (1) Administrative counts: freedom-of-information requests to the data protection authorities of 8–10 EU countries asking for the number of complaints since 2022 that invoke Article 15(1)(h) or Article 22, their sector and their disposition, plus a coded set of all published decisions and court rulings on these articles (GDPRhub and national databases) before and after the February 2025 ruling. (2) A field audit: with consenting volunteers who have actually been subject to credit, insurance or platform-work decisions, send standardized access and explanation requests to 60–100 organizations and code the replies against the standard the Court set (what procedure and principles were applied, which personal data mattered, how a different input would change the result). (3) Follow-up of unsatisfactory replies through complaints to the authority, recording time to resolution and outcome. Compare replies sent before and after the ruling where earlier studies give a baseline.
Data needed
FOI responses from data protection authorities; published decisions (GDPRhub, national case-law portals); a volunteer panel of real data subjects with ethics approval; a coding scheme derived from the ruling.
Feasibility
One PhD chapter or paper. Low: mostly researcher time; small incentives for volunteers; translation help for non-English authorities. Authorities often do not code complaints by article, so the FOI component may return partial or no counts; that gap is itself a finding but should be planned for. Requests must be made by or with the consent of the real data subject.
Has this been done?
Partly done already: related work covers some of this question (first-pass screen of 12 October 2026; not yet checked in depth).
Earlier work surveyed authorities about how Article 15(1)(h) requests are handled (Custers and Heijne, data collected 2020–2021) and sent information requests to a convenience sample of 100 organizations, mostly in Germany (Wulf and Seizov); volunteer insurance customers in five countries sent premium-setting requests to 26 insurers (Dexe et al.); and the Future of Privacy Forum analysed more than 70 decisions qualitatively. Wulf and Seizov's UK survey asked whether people had ever made any information request (about 10% had), but none counts requests or complaints about automated decisions specifically, none measures outcomes of escalated complaints, and none was found that tests replies against the standard set by the February 2025 Court of Justice ruling.
How strong this evidence is
- Who searched and checked: an independent AI reviewer with fresh context (not a person), 12 October 2026: every nearest-work citation checked against its source page; corrections applied. Every check so far was done by AI; no person or domain expert has checked it yet.
- What was read: 1 of the 4 nearest works below was judged from an abstract, summary or search listing only; it is marked. Not every entry says how much of the work was read.
- Where the search could not reach: Screened by web search on the date shown; the ScienceDirect page for Custers and Heijne blocked automated reading, so the open working-paper version was used. The Dexe et al. study was found at independent review, not in the original screen. Google Scholar, SSRN, national-language legal databases and paywalled journals were only partly reachable. Absence of a hit is not proof that the work does not exist.
- Before building a project on it, run your own search in a scholarly database such as Scopus, Web of Science, Google Scholar or SSRN.
Nearest work found
- Custers & Heijne, "The right of access in automated decision-making: The scope of article 15(1)(h) GDPR in theory and practice," Computer Law & Security Review 46, 105727 (2022)
Survey of data protection authorities (21 of 30 countries responded) plus seven expert interviews, carried out December 2020 to July 2021: of the 10 authorities that answered the question, 70% said a description of the workings or rationale of algorithms is not provided on access requests, and only two complaints specifically about Article 15(1)(h) were reported (Malta and Spain). Reports authority perceptions, not use rates or remedy outcomes; predates the 2025 ruling. Read via the Leiden working-paper version; bibliographic details confirmed with Crossref. - Wulf & Seizov, "'Please understand we cannot provide further information': evaluating content and transparency of GDPR-mandated AI disclosures," AI & Society 39(1), 235–256 (2024; online May 2022)
Sent GDPR information requests to a convenience sample of 100 companies and organizations, mostly operating in Germany, and found only 18% of disclosures sufficiently thorough; adds a survey of 835 UK respondents in which about 10% had ever made an information request. No escalation or outcome tracking, no count of requests about automated decisions, predates the ruling. - Barros Vale & Zanfir-Fortuna, "Automated Decision-Making Under the GDPR: Practical Cases from Courts and Data Protection Authorities," Future of Privacy Forum (May 2022)
Qualitative analysis of more than 70 items (19 court rulings and more than 50 authority decisions, opinions or guidance) from 18 EEA countries, the UK and the European Data Protection Supervisor. Shows how the provisions are applied; reports no rates of use or remedy outcomes. - Dexe, Franke, Söderlund, van Berkel, Jensen, Lepinkäinen & Vaiste, "Explaining automated decision-making: a multinational study of the GDPR right to meaningful information," Geneva Papers on Risk and Insurance – Issues and Practice 47(3), 669–697 (2022) Judged from an abstract, summary or search listing only
Volunteer insurance customers sent requests about how their premiums were set to 26 insurers in Denmark, Finland, the Netherlands, Poland and Sweden; the replies showed shortcomings and omissions. The closest precedent for the proposed field audit and a possible pre-ruling baseline for insurance; one sector, no use-rate estimate or escalation tracking. Read from the abstract page; added at review.
Search queries used
empirical study use of GDPR Article 22 right to explanation requests data subjects automated decision complaints data protection authoritiesArticle 15 access requests automated decision-making explanation audit study researchers sent subject access requests algorithmGDPRhub case law analysis Article 22 automated decisions court decisions empirical review Dun & Bradstreet C-203/22 aftermathdata protection authority statistics complaints automated decision-making Article 22 number of complaints annual report freedom of information study
Provenance
RO-LD12-01 v1. Drafted by Claude (SocioLens Project Lead), AI-drafted from the LD-12 debate on 2026-10-12. Checked by an independent AI reviewer with fresh context (not a person), 12 October 2026: every nearest-work citation checked against its source page; corrections applied. Not yet reviewed by a domain expert. This is a research hypothesis, not a finding.