How often do people use GDPR rights over automated decisions, and what happens?

Research question

After the Court of Justice's 2025 ruling that people subject to automated decisions are owed meaningful information about the procedure and principles actually applied, how many explanation and objection requests do data subjects make in a few high-exposure sectors (credit scoring, insurance, platform work), how do organizations answer them, and how many escalate to a data protection authority or court and with what outcome?

Why it matters

The debate finds that the strongest realized rights protection around AI currently comes from the GDPR and the courts, but it can only say what the law entitles people to, not how often the entitlement is used or whether it changes anything. Without use and outcome figures, it is impossible to tell whether the rights function of AI regulation is a working channel or a mostly symbolic one.

The debate lists this among what we still do not know: remedy-use rates under GDPR automated-decision rights

Evidence that motivates it

1. The CJEU held in C-203/22 that an automated-decision subject is entitled under GDPR to meaningful information about the procedure and principles actually applied; merely handing over a complex formula or algorithm is insufficient. (LD12-HQ-C08 v1.0)
   The Court of Justice set what people are entitled to receive (meaningful information about the procedure and principles actually applied; handing over a complex formula or algorithm is not enough), but the claim explicitly does not show common use, low burden or successful remedies.
   Cites: CJEU C-203/22, ECLI:EU:C:2025:117
2. Across the examined jurisdictions, the operative function of AI regulation differs by instrument and stage: rights, compliance infrastructure, market organization and developmental steering coexist rather than forming one regime. (LD12-HQ-C19 v1.0)
   The debate's overall picture treats rights protection as one coexisting function; measured remedy use is the kind of evidence it says would shift which function dominates.
   Cites: R08 HQ Batches 01–03 + canonical claim set

Claims are shown as they read on the day this pack was built; claim pages keep every earlier version.

A possible design

Three linked components. (1) Administrative counts: freedom-of-information requests to the data protection authorities of 8–10 EU countries asking for the number of complaints since 2022 that invoke Article 15(1)(h) or Article 22, their sector and their disposition, plus a coded set of all published decisions and court rulings on these articles (GDPRhub and national databases) before and after the February 2025 ruling. (2) A field audit: with consenting volunteers who have actually been subject to credit, insurance or platform-work decisions, send standardized access and explanation requests to 60–100 organizations and code the replies against the standard the Court set (what procedure and principles were applied, which personal data mattered, how a different input would change the result). (3) Follow-up of unsatisfactory replies through complaints to the authority, recording time to resolution and outcome. Compare replies sent before and after the ruling where earlier studies give a baseline.

Data needed

FOI responses from data protection authorities; published decisions (GDPRhub, national case-law portals); a volunteer panel of real data subjects with ethics approval; a coding scheme derived from the ruling.

Feasibility

One PhD chapter or paper. Low: mostly researcher time; small incentives for volunteers; translation help for non-English authorities. Authorities often do not code complaints by article, so the FOI component may return partial or no counts; that gap is itself a finding but should be planned for. Requests must be made by or with the consent of the real data subject.

Has this been done?

Partly done already: related work covers some of this question (first-pass screen of 12 October 2026, checked again on 13 October 2026).

Earlier work surveyed authorities about how Article 15(1)(h) requests are handled (Custers and Heijne, data collected 2020 to 2021) and sent information requests to a convenience sample of 100 organizations, mostly in Germany (Wulf and Seizov); volunteer insurance customers in five countries sent premium-setting requests to 26 insurers (Dexe et al.); and the Future of Privacy Forum analysed more than 70 decisions qualitatively. Wulf and Seizov's UK survey asked whether people had ever made any information request (about 10% had), but none counts requests or complaints about automated decisions specifically, none measures outcomes of escalated complaints, and none was found that tests replies against the standard set by the February 2025 Court of Justice ruling. Work published since the ruling and found in a second screen (October 2026) is doctrinal (for example Arnesen 2026) or audits general data exports rather than automated-decision explanations (Poehn and Gruschka 2025).

Literature check. No study was found that counts explanation or objection requests about automated decisions, tracks escalation to authorities or courts, or audits replies against the February 2025 Dun & Bradstreet Austria (C-203/22) standard. Post-ruling literature found this round is doctrinal (Arnesen 2026 in International Data Privacy Law; commentaries on the ruling), and the newest access-request audit (Poehn and Gruschka 2025) covers general data exports from online services, not automated-decision explanations. The existing nearest work (Custers and Heijne; Wulf and Seizov; Dexe et al.; FPF) remains the closest and is all pre-ruling. Checked by Claude (SocioLens Project Lead) with AI research agents, by web search; not a person and not a domain expert.

Where the search could not reach. Screened by web search on the date shown; the ScienceDirect page for Custers and Heijne blocked automated reading, so the open working-paper version was used. The Dexe et al. study was found at independent review, not in the original screen. Google Scholar, SSRN, national-language legal databases and paywalled journals were only partly reachable. Absence of a hit is not proof that the work does not exist. Literature check of 2026-10-13: SSRN abstract pages could not be fetched (the Ponce commentary on C-203/22, SSRN 5821222, was seen only as a search result and appears doctrinal). National-language legal databases other than a German web query, and DPA annual reports, were not searched; paywalled journals were reached only through abstract pages. Absence of a hit is not proof that the work does not exist.

Before building a project on it, run your own search in a scholarly database such as Scopus, Web of Science, Google Scholar or SSRN.

Nearest work found

• Custers & Heijne, "The right of access in automated decision-making: The scope of article 15(1)(h) GDPR in theory and practice," Computer Law & Security Review 46, 105727 (2022)
  Survey of data protection authorities (21 of 30 countries responded) plus seven expert interviews, carried out December 2020 to July 2021: of the 10 authorities that answered the question, 70% said a description of the workings or rationale of algorithms is not provided on access requests, and only two complaints specifically about Article 15(1)(h) were reported (Malta and Spain). Reports authority perceptions, not use rates or remedy outcomes; predates the 2025 ruling. Read via the Leiden working-paper version; bibliographic details confirmed with Crossref.
• Wulf & Seizov, "'Please understand we cannot provide further information': evaluating content and transparency of GDPR-mandated AI disclosures," AI & Society 39(1), 235–256 (2024; online May 2022)
  Sent GDPR information requests to a convenience sample of 100 companies and organizations, mostly operating in Germany, and found only 18% of disclosures sufficiently thorough; adds a survey of 835 UK respondents in which about 10% had ever made an information request. No escalation or outcome tracking, no count of requests about automated decisions, predates the ruling.
• Barros Vale & Zanfir-Fortuna, "Automated Decision-Making Under the GDPR: Practical Cases from Courts and Data Protection Authorities," Future of Privacy Forum (May 2022)
  Qualitative analysis of more than 70 items (19 court rulings and more than 50 authority decisions, opinions or guidance) from 18 EEA countries, the UK and the European Data Protection Supervisor. Shows how the provisions are applied; reports no rates of use or remedy outcomes.
• Dexe, Franke, Söderlund, van Berkel, Jensen, Lepinkäinen & Vaiste, "Explaining automated decision-making: a multinational study of the GDPR right to meaningful information," Geneva Papers on Risk and Insurance – Issues and Practice 47(3), 669–697 (2022) Judged from an abstract, summary or search listing only
  Volunteer insurance customers sent requests about how their premiums were set to 26 insurers in Denmark, Finland, the Netherlands, Poland and Sweden; the replies showed shortcomings and omissions. The closest precedent for the proposed field audit and a possible pre-ruling baseline for insurance; one sector, no use-rate estimate or escalation tracking. Read from the abstract page; added at review.
• Arnesen, "Comparing the right to information about automated decision-making to the new right to explanation," International Data Privacy Law 16(2), ipag008 (published online 27 May 2026)
  Doctrinal comparison of the GDPR right to meaningful information (as read after Dun & Bradstreet Austria) with the AI Act Article 86 right to explanation. Contains no empirical data on requests, replies, complaints or outcomes. Opened on the publisher page. Useful for the coding scheme, not as an empirical precedent.
• Poehn & Gruschka, "Qualitative In-Depth Analysis of GDPR Data Subject Access Requests and Responses from Major Online Services," arXiv:2503.04259 (Mar 2025), DOI 10.5220/0013093000003899 Judged from an abstract, summary or search listing only
  Qualitative review of access-request processes and data exports from major online services, comparing November 2018 and November 2023 exports with privacy policies. The abstract does not mention automated decision-making or Article 15(1)(h), and it reports no escalation tracking. Shows the access-request audit method is active, but does not cover the proposed sectors or the explanation standard. Opened on the arXiv abstract page; the number of services was not stated there.

References

Sources behind the motivating claims:

• CJEU C-203/22, ECLI:EU:C:2025:117 (SRC-LD12-CJEU-C203-22-2025, original)
• R08 HQ Batches 01–03 + canonical claim set (SRC-R08-HQ-CROSS-SOURCE-SYNTHESIS, no checked link to the original yet)

BibTeX

The first entry cites this opportunity; then its nearest work; then the sources above. Nearest work and sources are recorded as reference strings, so each goes in whole as the title; add authors and year from the original before you cite it.

@misc{sociolens_ro_ld12_01_v2,
  author = {{SocioLens project}},
  title = {How often do people use GDPR rights over automated decisions, and what happens?},
  year = {2026},
  date = {2026-10-13},
  howpublished = {\url{https://sociolens-web.pages.dev/opportunities/ro-ld12-01/v2/}},
  note = {Research opportunity RO-LD12-01, version v2}
}

@misc{ro_ld12_01_nearest_1,
  title = {Custers \& Heijne, "The right of access in automated decision-making: The scope of article 15(1)(h) GDPR in theory and practice," Computer Law \& Security Review 46, 105727 (2022)},
  url = {https://universiteitleiden.nl/binaries/content/assets/rechtsgeleerdheid/instituut-voor-metajuridica/elaw-working-paper-series/paper-2022-005.pdf},
  note = {Reference as recorded by SocioLens; authors, title and year are not separated}
}

@misc{ro_ld12_01_nearest_2,
  title = {Wulf \& Seizov, "'Please understand we cannot provide further information': evaluating content and transparency of GDPR-mandated AI disclosures," AI \& Society 39(1), 235–256 (2024; online May 2022)},
  url = {https://link.springer.com/article/10.1007/s00146-022-01424-z},
  note = {Reference as recorded by SocioLens; authors, title and year are not separated}
}

@misc{ro_ld12_01_nearest_3,
  title = {Barros Vale \& Zanfir-Fortuna, "Automated Decision-Making Under the GDPR: Practical Cases from Courts and Data Protection Authorities," Future of Privacy Forum (May 2022)},
  url = {https://fpf.org/blog/fpf-report-automated-decision-making-under-the-gdpr-a-comprehensive-case-law-analysis/},
  note = {Reference as recorded by SocioLens; authors, title and year are not separated}
}

@misc{ro_ld12_01_nearest_4,
  title = {Dexe, Franke, Söderlund, van Berkel, Jensen, Lepinkäinen \& Vaiste, "Explaining automated decision-making: a multinational study of the GDPR right to meaningful information," Geneva Papers on Risk and Insurance – Issues and Practice 47(3), 669–697 (2022)},
  url = {https://doi.org/10.1057/s41288-022-00271-9},
  note = {Reference as recorded by SocioLens; authors, title and year are not separated; Judged from an abstract, summary or search listing only}
}

@misc{ro_ld12_01_nearest_5,
  title = {Arnesen, "Comparing the right to information about automated decision-making to the new right to explanation," International Data Privacy Law 16(2), ipag008 (published online 27 May 2026)},
  url = {https://academic.oup.com/idpl/article/16/2/ipag008/8696574},
  note = {Reference as recorded by SocioLens; authors, title and year are not separated}
}

@misc{ro_ld12_01_nearest_6,
  title = {Poehn \& Gruschka, "Qualitative In-Depth Analysis of GDPR Data Subject Access Requests and Responses from Major Online Services," arXiv:2503.04259 (Mar 2025), DOI 10.5220/0013093000003899},
  url = {https://arxiv.org/abs/2503.04259},
  note = {Reference as recorded by SocioLens; authors, title and year are not separated; Judged from an abstract, summary or search listing only}
}

@misc{src_ld12_cjeu_c203_22_2025,
  title = {CJEU C-203/22, ECLI:EU:C:2025:117},
  url = {https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=ecli:ECLI%3AEU%3AC%3A2025%3A117},
  note = {Reference as recorded by SocioLens; authors, title and year are not separated}
}

@misc{src_r08_hq_cross_source_synthesis,
  title = {R08 HQ Batches 01–03 + canonical claim set},
  note = {Reference as recorded by SocioLens; authors, title and year are not separated}
}