It's article 22 (https://gdpr-info.eu/art-22-gdpr/) "The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her." - with the emphasis on solely, and it does have certain caveats which perhaps maybe might make it permissible.

Like, this restricts automatic refusal of service due to automated profiling, but doesn't restrict automatic acceptance of service due to automated profiling, and it doesn't restrict automatic recommendation to refuse service which then is rapidly 'reviewed' by a human.