> The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
> In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
Data can be both, in which case GDPR right still apply. Several GDPR fines have been handed down for processing business data about a person. Especially (but not only) data about sole proprietors/solo traders.
Got a link? Because while I don't doubt the logic, it just seems too esoteric to be an actual "issue" that people know about. Plus, I can't find anything.
Cool sounds like this guy can open a police case, a detective or police person looks into it, finds "yeah, sure enough, we audited Google's code and they broke rule 2c, so we'll give you X-million in compensation for this." And then the detective (because it's an open-shut case mind you) goes further with: Getting an extract of 12,393,333 other people affected by this "problem" so they issue a court order to charge Google 12,393,333 * X-million in damages. And then further also issuing a court order for Google to stop all operations immediately until they deactivate this automated process.
As if that will ever happen. We don't live in a world of rules and logic until things play out as simply as above.
> The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
> In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
https://gdpr-info.eu/art-22-gdpr/