### Legal Framework
#### 1.6.1 General Data Protection Regulation (GDPR)  
The GDPR came into effect on 25 May 2018, aiming to safeguard personal data [13]. The GDPR sets rules for handling data and provides individuals with more control over their personal information, granting them specific rights. Entities worldwide must comply with this regulation if they handle EU citizens' data. The GDPR has become somehow a \"standard\" for data protection legislation. According to the GDPR (see Art. 4(1)) [13], the term personal data refers to any information related to a natural person, in case this person (the so-called _\"data subject\"_) can be identified either directly or not. Moreover, the GDPR defines personal data processing as any operation that is performed on personal data, _\"the collection, recording, structuring, storage, adaptation or alteration, retrieval, use, disclosure by transmission, dissemination, combination and erasure\"_ (see Art. 4(2) in the GDPR) [13]. The main entity that determines the purposes and means of the processing is the so-called _\"data controller\"_, whereas the entity that processes personal data on behalf of the controller is the _\"data processor\"_ (see Art. 4(7) and 4(8), respectively) [13]. According to the GDPR, specific principles need to be in place when personal data are processed, yielding, in turn, specific obligations to data controllers. More precisely, according to Article 5, par. 1 of the GDPR [13], the personal data shall be processed _\"fairly and in a transparent manner\"_, being _\"adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed\"_ (purpose limitation principle), whereas the purpose shall be _\"specified, explicit and legitimate\"_. Moreover, personal data shall be _\"adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed\"_ (data minimization principle). Other basic principles are also defined in the same article in [13], including the security of personal data. An important requirement for personal data processing that should always be in place is the so-called data protection by design principle (also known as privacy by design--see Art. 25, par. 1) [13]. In simple words, personal data protection should be considered from the very beginning of the design of data processing. It is clear that this provision implies that when an ADM system is to be used, the data controller should examine from the very beginning whether this system is indeed necessary for achieving the intended purpose and, if yes, what risks to rights and freedoms does it entail and can these risks be effectively alleviated by appropriate safeguards. The GDPR defines also several rights of the individuals that can be exercised at any time, and the respective data controller is obligated to respond. An important right for data subjects related with ADM systems is the one defined in Art. 22, par. 1 in the GDPR [13]: _\"The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her\"_. Hence, human intervention in a decision process is essential, while the whole process should be transparent for the individuals (transparency is an individual's right that spans horizontally any type of data process). An important obligation for data controllers, as determined in the GDPR, is the so-called Data Protection Impact Assessment (DPIA), pursuant to Art. 35 of the GDPR [13]. In simple words, a DPIA aims to find out, in a systematic way that can be demonstrated, whether all the data protection risks stemming from intended personal data processing can be addressed by appropriate mitigation measures; therefore, conducting a DPIA, which needs to be performed before the starting of the data process, clearly facilitates the compliance with the data protection by design principle.