Austrian court rules employment algorithm complies with GDPR Article 22

Austria's Federal Administrative Court ruled on September 1, 2025, that the Public Employment Service's Labor Market Opportunities Assistance System (AMAS) does not violate GDPR Article 22 prohibitions against automated individual decision-making. The decision overturns a 2020 Data Protection Authority ban that had effectively shut down the controversial algorithm.

The court's 30-page ruling establishes precedent for determining when automated systems involve sufficient human oversight to comply with European data protection regulations. According to the decision numbered W256 2235360-1/36E, the algorithm met legal requirements because employment advisors retained meaningful decision-making authority and could override automated assessments.

AMAS automatically calculated integration probabilities for unemployed individuals using personal characteristics including age, gender, education level, health status, and regional labor market conditions. The system assigned job seekers to three categories: high labor market opportunities, medium opportunities, and low opportunities. Each classification determined access to different support measures and funding pools.

Technical implementation avoided automated decision-making

The Federal Administrative Court found that employment advisors played substantive roles rather than merely rubber-stamping algorithmic outputs. According to the ruling, advisors received comprehensive training to independently assess job market prospects and were explicitly authorized to correct AMAS values when their evaluations differed.

"The assessment of labor market opportunities is carried out with the active involvement of AMS advisors and is their responsibility, and this assessment by AMS advisors is always preceded by a personal interview with the job seekers concerned," the court stated in its findings.

The system included technical safeguards preventing automated overrides of human corrections. When advisors modified AMAS calculations, the algorithm could not subsequently overwrite those changes. Employment offices maintained monitoring systems to track advisor modifications, enabling intervention if counselors routinely accepted automated recommendations without independent review.

Each office employed ombudsmen to handle client complaints about assessment decisions. Advisors were required to document disagreements with job seekers regarding market opportunity evaluations and explain their reasoning during mandatory consultations.

European Court of Justice precedent influenced decision

The ruling extensively references December 2023 European Court of Justice Case C-634/21 involving SCHUFA credit scoring. The ECJ established that automated processing constitutes prohibited decision-making under Article 22 when it plays decisive roles in subsequent choices, regardless of nominal human involvement.

However, the Austrian court distinguished AMAS from the SCHUFA case on grounds that employment advisors possessed real decision-making authority rather than perfunctory oversight. The ruling emphasized that advisors could access detailed explanations for algorithmic classifications and request plausibility checks when doubting system accuracy.

"The involvement of counselors in the decision-making process is not merely formal, but rather substantive in nature," the court concluded. "They are authorized or even obliged to deviate from the automatically calculated AMAS value in each individual case."

According to Luis Alberto Montezuma, an International Data Spaces Facilitator commenting on the decision, the ruling demonstrates how proper implementation of human oversight can satisfy GDPR requirements while enabling beneficial automation.

Data protection implications for marketing industry

The ruling carries significance for digital marketing professionals navigating automated decision-making restrictions. Marketing technology companies increasingly face scrutiny over algorithmic advertising targeting and customer segmentation practices.

Data protection authorities have imposed over 6,680 GDPR fines totaling approximately 4.2 billion euros since implementation. Recent enforcement actions demonstrate evolving interpretations of consent and automated processing requirements.

The Austrian decision provides framework for organizations implementing automated systems while maintaining GDPR compliance. Key requirements include meaningful human oversight, technical safeguards against automated overrides, comprehensive staff training, and robust appeal mechanisms for affected individuals.

Authority's concerns about algorithmic bias rejected

The Data Protection Authority had argued that AMAS created "informational added value" requiring explicit legal authorization and potentially influenced advisors through unconscious bias. The authority cited expert reports suggesting human actors tend to adopt algorithmic recommendations without exercising discretion.

The court rejected these arguments, finding that the Public Employment Service implemented sufficient preventive and corrective measures to ensure independent human judgment. Training programs explicitly instructed advisors to recognize factors not captured by the algorithm, including motivation, housing situations, debt problems, and qualification details beyond basic education levels.

"There are no indications that the consultants would nevertheless use AMAS as a decisive factor in assessing labor market opportunities, despite the complainant's clear guidelines regarding the use of AMAS and the control mechanisms established for this purpose," the ruling states.

The system had been suspended since January 1, 2021, following the initial prohibition. The Public Employment Service never implemented planned mandatory adoption scheduled for that date, instead maintaining the voluntary pilot program until legal clarification.

Technical specifications revealed system limitations

Court documents reveal AMAS processed nine data categories to calculate integration coefficients (IC values): age group, gender, country group, education, health impairment, care responsibilities, occupational group, career history, regional labor market conditions, and unemployment duration.

The algorithm mapped education on a three-point scale encompassing only compulsory schooling, apprenticeships, or high school diplomas. This limitation required advisors to assess detailed qualification information not captured by the system.

Advisors received computer-generated "segment supplementary information" providing detailed explanations for algorithmic classifications. Each regional office maintained an "AMAS representative" responsible for conducting plausibility checks when advisors questioned system accuracy.

Classification into high-opportunity groups emphasized rapid job placement, while medium-opportunity clients received intensive support across all available services. Low-opportunity individuals accessed 90-95% of support measures but were excluded from expensive specialized training programs.

Timeline

• 2016: Public Employment Service begins developing AMAS concept
• End of 2018: AMAS pilot implementation begins
• March 10, 2020: Data Protection Authority initiates review procedure
• August 11, 2020: Public Employment Service provides detailed documentation
• August 16, 2020: Data Protection Authority prohibits AMAS effective January 1, 2021
• December 18, 2020: Federal Administrative Court initially upholds appeal
• December 21, 2023: Administrative Court overturns decision based on ECJ precedent
• July 8, 2025: European authorities endorse GDPR record-keeping modifications
• August 3, 2024: Privacy advocates challenge consent mechanisms
• September 1, 2025: Federal Administrative Court rules AMAS complies with GDPR

Summary

Who: Austria's Federal Administrative Court ruled on an appeal by the Public Employment Service against a Data Protection Authority ban on the AMAS algorithm.

What: The court determined that the Labor Market Opportunities Assistance System does not constitute prohibited automated individual decision-making under GDPR Article 22 because employment advisors retain meaningful decision-making authority.

When: The September 1, 2025 ruling overturned a prohibition that had been in effect since January 1, 2021.

Where: The case originated in Austria's Federal Administrative Court in Vienna, addressing the Public Employment Service's use of algorithmic job seeker classification.

Why: The court found that sufficient human oversight, technical safeguards, and appeal mechanisms prevent the system from constituting purely automated decision-making prohibited under European data protection law.