The General Data Protection Regulation (GDPR) establishes a series of individual data protection rights regarding automated decision-making. While article 22(1) GDPR provides for a right for a data subject ‘not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her’, articles 13 to 15 GDPR implement a right for individuals to get access to ‘meaningful information about the logic involved’ in ‘automated decision-making, including profiling’ based on personal data. These provisions create difficulties for the insurance industry, as automated decision-making is widespread among insurance companies for both pricing and claims management. The aim of this paper is to investigate the litigation risks arising from articles 13–15 and 22 GDPR and to present the current state of case law.