NIST Privacy Framework, Control-PCT.DM-P10

Do not base a decision that produces legal effects on, or significantly affects, a person solely on automated processing evaluating personal aspects such as their work performance, creditworthiness, reliability or conduct, unless it occurs in entering into or performing a contract at the data subject's request with safeguards for their legitimate interests, or the CNPD has authorised it with safeguards.

If enacted as drafted, a data subject would have the right to request human involvement where an automated decision, including profiling, produces a legal effect or similarly affects them, unless the decision is necessary to perform a contract, is authorized by specific legal provisions, or rests on the data subject's own explicit consent.

Provide a meaningful human review before finalizing any decision based solely on automated processing that produces legal or similarly significant effects for a person in Cyprus, under GDPR Article 22.

Do not base an administrative or private decision assessing a person's behavior or personality solely on automated processing of their personal data.

Provide a meaningful human review before finalizing any decision based solely on automated processing that produces legal or similarly significant effects for a person in Denmark, under GDPR Article 22.

Do not base a decision that produces legal effects on a person, or significantly affects them, solely on automated processing of their personal data, including profiling, unless a statutory or consent-based exception applies with human-intervention, expression and contestation safeguards.

Do not make a decision based solely or partly on automated processing, including profiling, that produces legal or similarly significant effects for a data subject, and give heightened protection where the data subject is a child or adolescent.

Give children and adolescents the heightened protection article 21 provides against a decision based solely or partly on automated processing.

Guarantee, at all times, a data subject's right not to be the object of a decision based solely or partly on automated valuations reached by an AI system processing their personal data, along with the right to information and the right to object.

Provide a meaningful human review before finalizing any decision based solely on automated processing that produces legal or similarly significant effects for a person in Estonia, under GDPR Article 22.

Do not base a decision that has a legal effect on a person, or that significantly affects them, solely on automated processing of their personal information intended to profile their personality or habits, except where taken under a contract at their request or under a law, code or scientific standard with safeguards in place.

Give a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or significantly affects them.

Do not base an automated evaluation of personal aspects relating to an individual on sensitive personal data, and where an automated decision rests on a contract with the data subject or their explicit consent, put suitable measures in place to safeguard the data subject's rights, freedoms and legitimate interests.

Do not subject a person in the EU to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless it is necessary to enter into or perform a contract with them, is authorised by a law that itself safeguards their rights, or rests on their explicit consent.

Provide a meaningful human review before finalizing any decision based solely on automated processing that produces legal or similarly significant effects for a person in Finland, under GDPR Article 22.

Do not base a decision that produces legal effects for a person, or otherwise significantly affects them, solely on automated processing, including profiling.

Provide a meaningful human review before finalizing any decision based solely on automated processing that produces legal or similarly significant effects for a person in Germany, including a credit score generated for a third party's determinative use, under GDPR Article 22 and BDSG Section 31.

Provide a meaningful human review before finalizing any decision based solely on automated processing that produces legal or similarly significant effects for a person in Greece, under GDPR Article 22.

Provide a meaningful human review before finalizing any decision based solely on automated processing that produces legal or similarly significant effects for a person in Iceland.

Provide a meaningful human review before finalizing any decision based solely on automated processing that produces legal or similarly significant effects for a person in Ireland, under GDPR Article 22.

On commencement, do not subject a data subject to a decision based solely on automated processing of personal data that produces a legal or similarly significant effect on them, unless the decision is necessary to a contract with them, authorised by a law with suitable safeguards, or authorised by their consent.

Do not subject a data subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless a listed exception applies and you provide the required safeguards, including the right to obtain human intervention.

Provide a meaningful human review before finalizing any decision based solely on automated processing that produces legal or similarly significant effects for a person in Latvia, under GDPR Article 22.

Do not base a decision that has a legal effect on a person, or that significantly affects them, solely on automated processing of their personal information intended to profile their personality or habits, except where taken under a contract at their request or under a law with safeguards in place.

Provide a meaningful human review before finalizing any decision based solely on automated processing, including profiling, that produces a significant legal or similarly significant effect for a person in Liechtenstein, under the DSG's automated-decision provisions.

Provide a meaningful human review before finalizing any decision based solely on automated processing that produces legal or similarly significant effects for a person in Lithuania, under GDPR Article 22.

Provide a meaningful human review before finalizing any decision based solely on automated processing that produces legal or similarly significant effects for a person in Luxembourg, under GDPR Article 22.

Do not base an administrative or private decision assessing a person's conduct solely on automated profiling.

Do not base a decision producing legal effects for a person solely on an automated processing designed to profile them or evaluate aspects of their personality.

Provide a meaningful human review before finalizing any decision based solely on automated processing that produces legal or similarly significant effects for a person in Malta, under GDPR Article 22.

Do not base a decision producing legal effects for a person solely on automated profiling or an automated evaluation of their personality.

Do not subject a person to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, and where a carve-out applies, give them human intervention, a chance to express their point of view and a way to contest the decision.

Do not base a decision that produces legal effects for a person or significantly affects them solely on automated processing, including profiling, unless a listed exception applies, and where it does, guarantee at least the right to obtain human intervention, express a view, and contest the decision.

Do not base a decision producing legal effects on a person solely on automated processing meant to profile them or evaluate an aspect of their personality, except a decision taken in forming or performing a contract where the person could comment, or one that grants the person's own request.

Do not base an administrative or private decision assessing a person's behaviour or personality solely on automated processing, unless the person gave explicit consent, it is necessary to enter into or perform a contract with them, or a law or regulation otherwise authorizes it.

Give a data subject the right not to be subject to a decision based solely on automated processes or algorithms.

Once Chapter III takes effect, give a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, under Article 26.

Once Chapter III takes effect, where a decision based solely on automated processing rests on a contract with the data subject or their explicit consent, implement suitable measures to safeguard their rights, freedoms and legitimate interests, under Article 26(3).

Provide a meaningful human review before finalizing any decision based solely on automated processing that produces legal or similarly significant effects for a person in Norway, under the incorporated GDPR Article 22.

Do not subject a data subject to a decision based solely on automated processing of their personal data that produces a negative legal effect or a detriment to a right, unless they consented, the decision is necessary to perform a contract, or a special law authorizes it.

Do not base a decision that has legal effects on a person, or significantly affects them, solely on an automated evaluation of their personality or conduct, outside a contractual relationship or a public-entity entry evaluation, and let them state their own view.

Provide a meaningful human review before finalizing any decision based solely on automated processing that produces legal or similarly significant effects for a person in Portugal, under GDPR Article 22.

Do not base a decision producing legal effects for a person solely on automated processing intended to define their profile or evaluate aspects of their personality, unless the decision arises from concluding or performing a contract on which the person had a chance to comment, or it grants their own request.

Do not subject a data subject to a decision based solely on automated processing, including profiling, that produces legal or other significant consequences for them, unless their explicit consent, contract necessity, or an authorising law with safeguards applies.

Provide a meaningful human review before finalizing a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects for a person in San Marino, under Article 22.

Do not subject a person to a decision that affects their legal situation or affects them significantly based solely on automated processing that assesses their personality, professional capacity, credit, trustworthiness or behavior, unless the decision is taken in performing a contract at their request with safeguards for their interests, or a law authorizing it protects their rights.

Do not base a decision producing legal effects for a person solely on automated profiling or an automated evaluation of their personality, except where they had the chance to make observations or the decision grants their own request.

Do not base a decision producing legal effects or significantly affecting a person solely on automated processing, including profiling, unless it is necessary for a contract with them, authorized by law with adequate safeguards, or based on their explicit consent, and even then give them the right to obtain human intervention, express their view, and contest the decision.

Do not base a decision that produces legal or similar significant effects on a person solely on automated processing, including profiling, unless a contract, a written law with safeguards, or the person's consent authorises it.

Do not base a decision that has legal or substantially similar consequences for a person solely on automated processing of their personal information, unless the person can make representations about the decision and you have explained the underlying logic of the processing to them.

Give a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects for them or otherwise significantly affects them, unless a listed exception applies, and never base such a decision on special categories of personal data unless a narrow exception applies with appropriate safeguards.

Do not base a decision producing legal effects concerning a person solely on an automated evaluation of their personal characteristics or profile, except a contractual decision on which they could state their views or one granting their own request.

Let a data subject avoid a decision based solely on automated processing.

Do not base a decision that significantly affects a data subject solely on automated processing where they have given written notice against it, and where such a decision is made, notify the data subject and reconsider it within twenty-one days of their written request.

Once enacted, do not base a decision that significantly affects a data subject in Ukraine solely on automated processing, including profiling, under Article 25.

Before finalizing a solely automated decision producing legal or similarly significant effects for a person in the United Kingdom, inform them in advance, and provide a meaningful human review and a right to contest the decision on request, under UK GDPR Articles 22A to 22D.

Let a data subject challenge, and obtain the valuation criteria and the program behind, any administrative act or private decision based solely on automated processing of their personal data that offers an assessment of their character or personality.

Do not subject a data subject to a decision based solely on automated processing, including profiling.

Do not subject a data subject to a decision based solely on automated processing that has legal or similarly significant effects without human intervention.

Where an automated decision rests on a contract, a written law or explicit consent, put suitable safeguards in place, including the right to obtain human intervention, to put a point of view and to contest the decision, and do not process sensitive personal data automatically at all unless the data subject expressly consented, the processing is in the public interest, or a written law permits it with safeguards.

Do not take a decision about a data subject on the basis of automatic data processing outside what section 25 allows, and deal with a child data subject through the representation section 26 provides.