INTERNATIONAL JOURNAL OF TOURISM, TRAVEL AND HOSPITALITY LAW account of other factors in making the final decision, that decision would not be 'based solely' on automated processing". At the same time, “the controller cannot avoid the Article 22 provisions by fabricating human involvement. For example, if someone routinely applies automatically generated profiles to individuals without any actual influence on the result, this would still be a decision based solely on automated processing”. In essence, Article 22 does not operate when there is significant human involvement; in fact, “to qualify as human involvement, the controller must ensure that any oversight of the decision is meaningful, rather than just a token gesture”. In this way, the provision is interpreted in the broadest sense51 and any circumvention intent is prevented. More generally, profiling must be carried out with the use of only data that are necessary for a specific purpose, in accordance with the principle of proportionality; thus, under Article 5(1)(b) of the Regulation, data must be collected for specified, explicit and legitimate purposes, while Article 6 clarifies the limits within which processing may take place52. More generally, even profiling algorithms are imperfect and, therefore, may lead to errors, with the additional problem that, if people using them are not the programmers, they may be unaware of the underlying logic and, therefore, the effects of their application. Therefore, the Regulation provides for a special information obligation53. According to Article 554, the manner and purpose of the initiative must be disclosed, with an indication of the criteria. However, the user may not be aware of the operation because he is not the author of the programme. In this context, as the expression of an automated process, the algorithm for the dynamic fixing of air fares falls within the scope of Article 22 of the Regulation; in fact, without significant human intervention, the system takes 51 See M. Nisevic, Profiling consumers through big data analytics: strengths and weaknesses of Article 22 GDPR, loc. cit., 110 ff., according to whom, “if non - human involvement at all is allowed, the scope of Article 22 would, however, be excessively small”. 52 See Article 2b of Legislative Decree No 196 of 2003, as amended by Legislative Decree No. 101 of 2018, on provisions for the adaptation of the national system to EU Regulation No. 679 of 2016. 53 See Article 12 of the Regulation according to which “the data controller shall take appropriate measures to provide the data subject with all information (...) relating to the processing in a concise, transparent, intelligible and easily accessible form, using clear and plain language”. 54 See Article 5 of the Regulation, according to which “personal data shall be collected (...) for specified, explicit and legitimate purposes”. Cf. Article 2 quater of Legislative Decree No 196 of 2003, as amended by Legislative Decree No. 101 of 2018, on provisions for the adaptation of the national system to EU Regulation No. 679 of 2016.
RkJQdWJsaXNoZXIy MTE4NzM5Nw==