--- tags: Book --- # GDPR [Article 22.1 of the GDPR](https://gdpr-info.eu/art-22-gdpr/) states: >The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. A fully automated anti-sybil system built on a machine learning (ML) algorithm falls into the category of `automated processing`. It is necessary, therefore, to have some method of human supervision in the system or a method of appealing the decisions the system makes. This is why all the data that goes into decision making, both from the ML pipeline and from the human evaluation system, has to travel with the final decision. While the decision or label might be a single byte (1 or 0), the context is essential to fulfilling obligations under the GDPR.