GDPR article 22 provides basic safeguards against automated decision making, thankfully. Imperfect perhaps, dofficult to enforce - but at least it is addressed.