> On a side note: GDPR demands that companies provide a way to get a manual review for decisions made by machines.

Correct. Unfortunately, from what I've heard so far, all that this entails is that some drone looks over the case, and checks a "reviewed" box or so. It's a right to manual review, not to manual rectification.