Art 22 GDPR doesn't distinguish it says "solely automated processing" Five ifs and a model are the same thing to the regulator.