Template Letter to Raise an Objection for Automated Processing

Summary

This is a template letter published by the Jersey Office of the Information Commissioner (JOIC) for individuals who want to object to, or seek information about, a decision made about them through automated processing or profiling. It is a form for data subjects to adapt and send to an organisation, invoking rights under Article 38 of the Data Protection (Jersey) Law 2018 (DPJL 2018).

• Information requested: Whether a decision was made solely by automated means, what personal data was used, the logic involved, the factors and inputs considered, and the likely significance and consequences of the decision.
• Rights invoked: Where a solely automated decision has a legal or similarly significant effect, the individual can request human intervention, a meaningful review, and the chance to present additional information or challenge the outcome.
• Profiling explanation: Where profiling was involved, the individual can ask for an explanation of how their data was analysed or used to predict characteristics, behaviours or preferences.
• Processing restriction: The letter asks the organisation to confirm that processing has been restricted while the request is being reviewed.

The template notes that under the DPJL 2018 organisations must respond without undue delay and, in any event, within four weeks of receipt, and if unable to meet this deadline must inform the individual of the expected timescale and reasons for delay. It is guidance material only and must be adapted to the individual's circumstances; JOIC offers assistance to organisations handling such requests.

Key obligations

• An organisation receiving such a request must respond without undue delay and, in any event, within four weeks of receipt
• If unable to respond within four weeks, the organisation must inform the individual of the anticipated timescale and the reasons for the delay
• Upon receipt of such a request, the organisation should confirm restriction of processing while the request is under review, if asked to do so

Applies to

data controllers, organisations processing personal data using automated means, individuals (data subjects) in Jersey

Deadlines

• within four (4) weeks of receipt: Deadline for an organisation to respond to a request objecting to automated processing/profiling under the DPJL 2018