Introduction
The General Data Protection Law (LGPD), established by Law No. 13.709/2018, was a regulatory milestone in the protection of personal data in Brazil. Inspired by international legislation such as the European GDPR, the LGPD brought significant advances, mainly regarding the autonomy and informational self-determination of individuals. One of the most debated provisions, both in the legal and technological fields, is Article 20, which deals with the data subject's right to review automated decisions.
But in practice, is this right effective? Does human review function as a real instrument of control, or is it merely a legal formality? In this article, we will examine the wording of Article 20 of the LGPD (Brazilian General Data Protection Law), its practical implications, implementation difficulties, and possible ways to make it more functional.
I – What does Article 20 of the LGPD say?
Article 20 of the LGPD (Brazilian General Data Protection Law) stipulates: “ The holder of personal data has the right to request a review of decisions made solely on the basis of automated processing of personal data that affect their interests, including decisions intended to define their personal, professional, consumer, and credit profile or aspects of their personality. ”
In other words, any decision made exclusively by algorithms — without human intervention — that has a significant impact on the data subject (such as denying a loan, rejecting a resume, or adjusting the value of an insurance policy) can be challenged.
Furthermore, paragraph 1 of the article mentions that the controller must provide, whenever requested, clear and adequate information about the criteria and procedures used for automated decision-making. Paragraph 2 allows the ANPD (National Data Protection Authority) to establish complementary regulations.
I.1 – Why is Article 20 important?
In a world increasingly mediated by algorithms, automated decisions have become an everyday part of modern life. Banks use artificial intelligence to assess credit risk; e-commerce companies determine prices based on user profiles; recruiters use automated screening software to evaluate resumes.
In these situations, the risk of opacity, algorithmic discrimination, and inefficiency is high. Article 20 seeks to guarantee transparency, fairness, and accountability in these processes by allowing the data subject to question and review decisions that may be unfair or incorrect.
I.2 – Does revision really work?
Despite the noble objective, there are doubts about the effectiveness of the mechanism, especially from a functionality perspective.
Many companies claim that their decisions involve some degree of human intervention, even if minimal or routine. This allows them to avoid the direct application of the article. But if a customer service representative merely "confirms" a decision previously made by the system, would that be enough to disqualify it as not being automated?
This interpretation weakens Article 20, as it creates a gray area regarding what is, in fact, a purely algorithmic decision. Without regulatory clarity, companies have leeway to restrict the rights of the data subject.
The LGPD (Brazilian General Data Protection Law) does not specify how the review should be conducted or who should perform it. For example, it is unclear: Should the review be done by a human with the authority to modify the decision? Should the criteria used by the system be explained? Does the reviewer need to justify their analysis in detail?
In the absence of regulation by the ANPD (National Data Protection Authority), many companies adopt vague or merely formal internal protocols, in which the "review" amounts to reiterating the system's decision, without any real reconsideration.
Furthermore, limited access to algorithmic logic has generated widespread debate, especially due to the conflict between industrial property and transparency in decision-making.
Paragraph 1 of the article requires that the data subject have access to "clear and adequate information" about the criteria and procedures used in the decision. However, machine learning algorithms, especially those based on deep learning, are often opaque even to their developers.
Furthermore, companies often claim trade secrets or intellectual property rights to avoid disclosing the details of how their systems work. This makes it difficult or even impossible for the owner to file an informed challenge.
Finally, informational and technical asymmetry comes to the fore, since the user, in the vast majority of cases, finds themselves limited in their ability to make company decisions. Even when review is possible, the average citizen lacks the technical knowledge to understand the algorithmic basis of a decision. Terms such as "convolutional neural network" or "K-means-based clustering" are unintelligible to most people.
In other words, without digital education and legal or technical support, the right to review often becomes inoperative in practice.
II – International and comparative scenario
In the European Union, the GDPR has a similar provision. The European model also ensures the data subject's right not to be subject to automated decisions that produce significant legal effects.
However, the challenges remain the same: defining what constitutes a "purely automated" decision, algorithmic transparency, and the effectiveness of the review process.
Some countries, such as France and Germany, have made progress in developing complementary regulations and case law that strengthen the role of data protection authorities and courts in overseeing algorithmic systems.
III – The role of the ANPD and the future of regulation
The National Data Protection Authority is still in the process of regulating several provisions of the LGPD (Brazilian General Data Protection Law), including Article 20. The 2023–2025 Regulatory Agenda prioritizes the development of regulations on:
- Clear definition of automated decisions;
- Minimum review procedures;
- Technical and informational transparency;
- Explainability patterns for algorithms.
Furthermore, there is an expectation of a technical note or sector-specific resolution to guide sectors that are more dependent on automation, such as finance, digital retail, and the supplementary healthcare sector.
III.1 – Expected changes
For the right to review to be more than just an abstract ideal, some practical measures can be adopted.
The first of these consists of imposing the requirement that every automated decision has significant and documented human intervention, capable of altering or questioning the result.
Nevertheless, companies must provide the data subject with understandable explanations, using accessible language, about the factors that influenced the decision. This does not require opening the source code, but rather translating the determining factors.
Access to justice must also be considered. The role of public and private ombudsman offices, as well as the Public Defender's Office, should be expanded to intervene in reviews involving vulnerable or underprivileged populations.
Finally, the ANPD (National Data Protection Authority) can impose fines and sanctions when it verifies that the review was carried out merely to fulfill a formality, without any real power of reconsideration.
III.2 – Practical cases and emerging case law
To date, Brazilian case law on Article 20 is still scarce. Some rulings address credit denial based on scores, discussing the need for transparency regarding the criteria adopted by credit bureaus. However, there is still no consensus on what constitutes a valid review, nor on the obligation to provide a detailed explanation of the algorithmic logic.
With the rise in lawsuits involving algorithmic discrimination and biases in recruitment, credit, and digital advertising, the Judiciary is likely to be increasingly called upon to interpret the limits and guarantees of Article 20.
Conclusion
Article 20 of the LGPD (Brazilian General Data Protection Law) represents a significant step forward in the attempt to humanize the age of algorithms. However, its effectiveness is directly linked to clear regulation, digital education for the population, technical transparency of the systems, and firm action by the ANPD (National Data Protection Authority) and the Judiciary.
The review of automated decisions will only work if it is genuine, understandable, and binding—and not just an empty ritual. To achieve this, Brazil needs to confront the technological, legal, and social challenges posed by automation, or risk transforming an essential right into mere normative fiction.
BIBLIOGRAPHIC REFERENCES
FERNANDES, Micaela Barros Barcelos; OLIVEIRA, Camila Helena Melchior Baptista de. Article 20 of the LGPD and the interpretative challenges to the right of data subjects to review decisions made by data processing agents. Journal of Law and New Technologies, 2020.
LOCATELLI, Jovair. Non-delegability of the jurisdictional function: limits of the use of artificial intelligence and automated decisions in light of article 20 of the LGPD and the fundamental right to data protection. 2023. Dissertation presented to the Postgraduate Program in Law of the Federal University of Rio Grande do Sul.
MIZIARA, Raphael. Protection against algorithmic dismissal in the workplace: consequences of non-compliance with the right to explainability provided for in Article 20 of the LGPD. Revista do Tribunal Superior do Trabalho, v. 90, n. 1, p. 230-249, 2024.
PRADO, Nathalia Estevao. Automated decisions: the (human) review of article 20 of the LGPD. 2023.
SILVA, Neide Costa da. The courts' view on the review of automated decisions in light of article 20 of the LGPD. 2023.
