GDPR Article 22
Keep automating claims, and answer the customer who pushes back
An agent that settles routine claims saves your team real hours. Article 22 lets a customer ask a person to look again at a decision about them. When that request comes in, your privacy team can answer from one record instead of pausing the agent to investigate.
A travel claim, contested
A claims agent reviews a traveler's claim for a cancelled trip and pays half. The policy excludes cancellations for a pre-existing condition, and the agent matched the reason code on the claim to that exclusion.
The customer writes in. They weren't told a system made the call, the condition was diagnosed after they bought the policy, and they want a person to review it.
Here is what the privacy team opens:
- The original decision. The facts the agent submitted, including the reason code and the purchase date, the rule version that applied, and the partial payout it returned.
- The notice reference. The notice version your application reported sending with the decision, so the team can check what the customer was told.
- The human review. The request went to a claims handler with authority to overturn it. Their response, their reason, and the time sit with the case.
- The outcome. The application reports the full payout it made after the review.
What Article 22(3) gives the customer, and where the record helps
Scroll horizontally to see all columns.
| The customer's right | What your team needs to show | Where it comes from in VeriProof |
|---|---|---|
| Obtain human intervention | A person with authority actually looked at the decision | The review request, the reviewer, and their decision |
| Express their point of view | What the customer said reached the reviewer | Context your application attaches to the review request |
| Contest the decision | The decision could change, and did or didn't | The reviewer's response and the outcome the application reported afterward |
Whether Article 22 applies depends on whether the decision is solely automated and has legal or similarly significant effects. Your privacy team makes that call. The EDPB guidance on automated decision-making is the usual starting point.
A separate question: erasure
Article 22 is about the decision. A request to erase personal data is a different right with its own workflow. VeriProof handles erasure requests and retention settings in their own workflow. See data retention and erasure.
Questions privacy teams ask
The record shows who was asked and what choices they had, including overturning the result. Your team confirms that person's authority and training.
No. Send the facts the rule needs. A claim reference and reason code are often enough.