The General Data Protection Regulation is an important, but not sufficient step towards regulation of automated decision making. This is the result of a study published by HIIG-director Wolfgang Schulz and Stephan Dreyer (HBI) commissioned by Bertelsmann Stiftung.