Automatiserat beslutsfattande inom offentlig förvaltning – Med fokus på artikel 22 GDPR och svensk nationell lagstiftning inom socialförsäkringsområdet

Sammanfattning

In modern Swedish public administration, technical solutions are used to facilitate or streamline internal processes with the help of artificial intelligence (AI). Public management can use machine-learned systems for assessment purposes or even automated decision-making. The Swedish Social Insurance Agency (Försäkringskassan) uses such tools to automatically review Care of a sick child (vab) applications and highlight potential fraud cases to administrators. Article 22 of the General Data Protection Regulation (GDPR), as a key data protection law provision, establishes a general prohibition on automated decisions. However, the restriction is not absolute, as national law may allow automated decision-making under Article 22(2)(b) GDPR, provided that adequate safeguards are in place. This study examines how automated decisions are regulated in Article 22 GDPR and how the regulation is supplemented and affected by Swedish national law, with a particular focus on the social security area. The thesis applies a legal dogmatic method to systematize and analyze the GDPR, the legal space for automated decision-making and how national legislation can deviate from or supplement the GDPR's provisions, with reference to Section 28 of the Administrative Procedure Act (2017:900). In addition, the legal informatics approach is used to highlight the interaction between law and technology in the choice of automated systems. Central to the paper is the issue of technology neutrality in Article 22 GDPR, which prohibits automated decision-making with legal effects or significant impact on the individual, unless specific exemptions are provided. These exceptions, in particular Article 22(2)(b) GDPR, leave room for Member States to enable automated decisions through national legislation, as reflected in the Swedish Administrative Procedure Act. The thesis identifies that decision support systems often fall into a legal grey area that lacks a clear definition in Article 22. The risk-based approach that characterizes compliance with the GDPR requires impact assessments under Article 35 GDPR to determine and manage the risks in automated processing of personal data. The paper also highlights the role of Swedish legislation in enabling automated decision-making and how this may affect the data subject under the GDPR. The thesis concludes that Swedish law largely relies on opening clauses in the GDPR, which has led to a more generous application of automated decision-making than the GDPR itself prescribes. The technology neutral application of the general permission of automated decision-making in Section 28 of the Administrative Procedure Act is criticized in the legal doctrine but should be seen as acceptable when merged with register legislation such as that in Chapter 114. SFB. This compilation provides a deeper understanding of the legal framework sur-rounding automated decision-making and its impact on public administration and identifies the need for increased clarity and guidance in the legislation to ensure that technological solutions are utilized and further developed in accordance with current legal requirements.