The European Court of Justice (ECJ) concluded that in the case of automatic decision-making, the controller must provide the person concerned with information about the process and the rules that were actually applied in the decision-making process, according to the General Data Protection Regulation (GDPR).