Summary findings

General:

• 44% of the surveyed companies reported using algorithms that process personal data. All subsequent percentages refer to this group.
• Algorithms that process personal data are not considered crucial: only 6% of these companies consider such algorithms essential to their operations.
• Algorithms that process personal data are employed across various sectors, but notably in ICT, culture, recreation, and healthcare.
• Larger companies are more likely to report using algorithms that process personal data than smaller companies.

Applications:

• The primary uses of these algorithms include administrative tasks (e.g. automated invoicing) and marketing (e.g. personalisation).
• 20% of the mentioned algorithms involve high-risk applications such as fraud detection, behavioural assessment, risk profiling, medical applications, or evaluating job applicants.
• 15% of companies use algorithms to make decisions about individuals, with nearly one-third doing so (partially) without human involvement.
• 65% acquire their most significant algorithms from third parties.

Organisational Maturity and Oversight:

• More than 70% of respondents indicate that they handle algorithms either not responsibly or only in specific situations, and they lack structural knowledge or procedures.
• Companies report having limited understanding of relevant regulations.
• 43% do not check whether there are risks associated with using an algorithm, and only 8% continue to monitor these risks afterward.
• There is often no standard evaluation process when purchasing algorithms.
• 31% of companies have no one internally overseeing the use of algorithms, and 16% do not know whether such a person exists.
• For many companies, algorithms are an invisible technology: only one-third say they are certain whether or not they use algorithms that process personal data.
• More than 40% of companies do not know what type of algorithm they are using.