The Automated Means Criterion is explicitly used in setting the scope of applicability of the GDPR. Article 2(1) states that the regulation applies to the processing of personal data "wholly or partly by automated means". This broad definition ensures that the GDPR covers a wide range of data processing activities, including those that involve any degree of automation.

Recital 15 further elaborates on this concept, emphasizing that the protection should be "technologically neutral" and "should not depend on the techniques used". This approach ensures that the regulation remains flexible and applicable to various forms of automated processing, regardless of the specific technology employed.

The criterion also extends to non-automated processing in certain cases. Article 2(1) includes "processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system". This provision ensures that structured manual processing of personal data is also covered by the regulation.

Implications

The Automated Means Criterion has significant implications for businesses and organizations processing personal data:

1. Wide applicability: Almost all modern data processing activities involve some degree of automation, meaning most businesses handling personal data will fall under the GDPR's scope.
2. Technological neutrality: Companies must ensure compliance regardless of the specific technologies or techniques they use for data processing.
3. Manual processing inclusion: Even organizations primarily using manual data processing methods may be subject to the GDPR if their data is structured or intended to be part of a filing system.
4. Future-proofing: The broad and neutral language of the criterion helps ensure the GDPR remains relevant as new data processing technologies emerge.
5. Compliance considerations: Organizations must assess all their data processing activities, including partially automated ones, to ensure GDPR compliance.