Testificate replied: Not automatically. The fact that IRIS generates a drowsiness score, decision, or alert does not by itself trigger GDPR Article 22. Article 22 is engaged only where there is a decision based solely on automated processing, including profiling, that produces legal effects or similarly significant effects on the individual.

Testificate replied: If IRIS merely gives the driver a real-time warning such as “you may be drowsy; take a break”, Article 22 is less likely to apply, because the alert is advisory and may not have a legal or similarly significant effect. GDPR transparency duties would still apply, including explaining what data is processed, why, how long it is retained, and how the drowsiness assessment broadly works. Article 22 becomes much more relevant if the IRIS output leads automatically to a significant consequence, for example if it disables or limits vehicle functions, reports the driver to an employer or fleet manager, affects insurance pricing, triggers disciplinary action, records an impairment event against the driver, or causes an automated safety intervention with substantial impact. In those cases, the drowsiness alert may amount to automated individual decision-making with similarly significant effects.

Testificate replied: I don't think it inherently does. It is also important to be precise about the so-called “right to an explanation.” GDPR does not contain a simple standalone right labelled “right to explanation”. Instead, where Article 22-type automated decision-making is involved, Articles 13 and 15 require the controller to provide meaningful information about the logic involved, as well as the significance and envisaged consequences of the processing for the data subject.

Testificate replied: No, for IRIS, the key question is not simply “does the system make an automated assessment?”, but what consequence follows from that assessment.