Re: Theory and Reality
The context of the article was in the dear old USA,,, but on the other side of the pond there are some useful levers to pull....
The GDPR has provisions both on profiling and automated decision making (without any human involvement).
You can only carry out that type of stuff in very limited circumstances. You have to identify if the processing of your data falls into that category, if so, then you have to give the data subject information about that processing, as well as provide the ability for them to request human intervention and challenge any decisions made. It's mostly in Article 22 if you want some bedtime reading. Also, there is a more extensive article on this from the UK ICO.
However, this is also in the category of people bothering to read the information, the usual lie "I have read and understood....<Click>".