Machine learning and data privacy regarding the upcoming GDPR

The deployment of machine learning tools across different sectors, be it for eligibility for a loan or scoring candidates during a recruitment process, is becoming more and more common. The main privacy issues relating to machine learning (ML) tools come from the collection of large amounts of information coupled with the tool's ability to make autonomous decisions and actions aimed at maximising success. As the GDPR comes into force tomorrow (25 May 2018), the recently published'GDPR Article 29 Working Party' guidelines in automated individual decision making and profiling is likely to turn any ML activities into hurdles. Let's start by quoting the GDPR itself: 'data subjects shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her'. At first sight, this seems to read that only decisions that are based solely on automated processes trigger a right for the data subject to opt out.