The Public Employment Service in Austria implemented an algorithm with the specific purpose of assisting counsellors by categorising job seekers based on various factors such as age, education, and employment history, among others. Importantly, the algorithm's role was not to directly place job seekers into employment but to aid in providing targeted counseling based on their predicted job market opportunities.

The Data Protection Authority (DPA) raised concerns that the algorithm constituted automated individual decision-making under Article 22 GDPR, which restricts decisions made solely on automated processing, including profiling, that produces legal or similarly significant effects on individuals. Despite the human element in the final decision, the DPA argued that the algorithm's categorisation could unduly influence the counseling process, potentially affecting job seekers' opportunities.

The Federal Administrative Court initially overturned the DPA's prohibition, citing the legal basis under 'Austrian national law' and the non-binding nature of the algorithm's results on final employment counselling decisions. The court emphasised the importance of human oversight and the necessity for counsellors to undergo training to assess the algorithm's outputs critically.

However, the Supreme Administrative Court sided with the DPA on appeal, asserting that the algorithm plays a decisive role in the counseling process and could limit job seekers' opportunities based on its categorisation. The ruling reflects a broader interpretation of Article 22 of GDPR, considering the significant effects of profiling and automated categorization on individuals' rights and freedoms.

This ruling highlights several critical compliance aspects for employers and public bodies:

• Automated decision-making must have a clear legal basis under national and EU law.
• Meaningful human involvement must be involved in decisions that rely on automated processing to ensure that technology supports rather than dictates decision-making.
• Entities using such technologies need to maintain transparency in their processes and provide adequate training to staff to prevent over-reliance on automated tools.

This case serves as a crucial reminder of the legal complexities surrounding using advanced data processing technologies in employment and other public service contexts. It stresses the need for a balanced approach that respects both the efficiency gains from automation and the fundamental rights of individuals under GDPR.