NIST Privacy Framework, Control-PCT.DM-P10

Do not subject a person in Bulgaria to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).

Do not base an administrative or private decision assessing a person's behavior solely on automated processing that produces a profile or personality assessment of them.

Do not base a decision that produces legal effects on, or significantly affects, a person solely on automated processing of their personal data, including profiling, unless the law authorizes it, or the person consents to it in the course of entering into or performing a contract and either their request was satisfied or adequate measures guarantee their legitimate interests and their chance to put their point of view.

Where you rely on the CNPD's authorization to take a decision that produces legal effects on a person, or significantly affects them, solely on automated processing, take measures that guarantee the data subject's legitimate interests.

Give a data subject the right to request human involvement where an automated decision, including profiling, produces a legal effect or similarly affects them, unless the decision is necessary to perform a contract, is authorized by specific legal provisions, or rests on the data subject's own explicit consent.

Do not subject a person in Croatia to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).

Where a decision based solely on automated processing about a person in Cyprus rests on a contract with them or on their explicit consent, put suitable safeguards in place, at least the right to obtain human intervention, to express their point of view and to contest the decision, under GDPR Article 22(3).

Do not subject a person in Cyprus to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).

Do not subject a person in the Czech Republic to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).

Do not base an administrative or private decision assessing a person's behavior or personality solely on automated processing of their personal data.

Give a person in Denmark a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them, under GDPR Article 22.

Do not subject a person in Denmark to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).

Do not base a decision that produces legal effects on a person, or significantly affects them, solely on automated processing of their personal data, including profiling, unless a statutory or consent-based exception applies with human-intervention, expression and contestation safeguards.

Do not make a decision based solely or partly on automated processing, including profiling, that produces legal or similarly significant effects for a data subject, and give heightened protection where the data subject is a child or adolescent.

Give children and adolescents the heightened protection article 21 provides against a decision based solely or partly on automated processing.

Give a person in Estonia a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them, under GDPR Article 22.

Do not subject a person in Estonia to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).

Do not base a decision that has a legal effect on a person, or that significantly affects them, solely on automated processing of their personal information intended to profile their personality or habits, except where taken under a contract at their request or under a law, code or scientific standard with safeguards in place.

Give a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or significantly affects them.

Do not base an automated evaluation of personal aspects relating to an individual on sensitive personal data, and where an automated decision rests on a contract with the data subject or their explicit consent, put suitable measures in place to safeguard the data subject's rights, freedoms and legitimate interests.

Subject any decision to enter or refuse to enter into or maintain a business relationship with a customer, or to carry out or refuse to carry out an occasional transaction for a customer, or to increase or decrease the extent of the customer due diligence measures applied pursuant to Article 20, to meaningful human intervention to ensure the accuracy and appropriateness of the decision (Article 76(5), point (b)).

If your creditworthiness assessment involves the use of automated processing of personal data, give the consumer the right to request and obtain human intervention from you (Article 18(8)).

Do not subject a natural person to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless it is necessary to enter into or perform a contract with them, is authorised by a law that itself safeguards their rights, or rests on their explicit consent.

Oversee, and with the involvement of workers' representatives, regularly and in any event every two years, evaluate the impact of individual decisions taken or supported by automated monitoring systems and automated decision-making systems on persons performing platform work, including, where applicable, on their working conditions and equal treatment at work (Article 10(1)).

Have any decision to restrict, suspend or terminate the contractual relationship or the account of a person performing platform work, or any other decision of equivalent detriment, taken by a human being (Article 10(5)).

Where a decision based solely on automated processing about a person in Finland rests on a contract with them or on their explicit consent, put suitable safeguards in place, at least the right to obtain human intervention, to express their point of view and to contest the decision, under GDPR Article 22(3).

Do not subject a person in Finland to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).

Do not subject a person in France to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).

Do not base a decision that produces legal effects for a person, or otherwise significantly affects them, solely on automated processing, including profiling.

Where a decision based solely on automated processing about a person in Germany rests on a contract with them or on their explicit consent, put suitable safeguards in place, at least the right to obtain human intervention, to express their point of view and to contest the decision, under GDPR Article 22(3).

Do not subject a person in Germany to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).

Where a decision based solely on automated processing about a person in Greece rests on a contract with them or on their explicit consent, put suitable safeguards in place, at least the right to obtain human intervention, to express their point of view and to contest the decision, under GDPR Article 22(3).

Do not subject a person in Greece to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).

Do not subject a person in Hungary to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).

Where a decision based solely on automated processing about a person in Iceland rests on a contract with them or on their explicit consent, put suitable safeguards in place, at least the right to obtain human intervention, to express their point of view and to contest the decision, under the incorporated GDPR Article 22(3).

Do not subject a person in Iceland to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by a law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under the incorporated GDPR Article 22(1) and (2).

Where a decision based solely on automated processing about a person in Ireland rests on a contract with them or on their explicit consent, put suitable safeguards in place, at least the right to obtain human intervention, to express their point of view and to contest the decision, under GDPR Article 22(3).

Do not subject a person in Ireland to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).

Do not subject a person in Italy to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).

Do not subject a data subject to a decision based solely on automated processing of personal data that produces a legal or similarly significant effect on them, unless the decision is necessary to a contract with them, authorised by a law with suitable safeguards, or authorised by their consent.

Do not subject a data subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless a listed exception applies and you provide the required safeguards, including the right to obtain human intervention.

Give a person in Latvia a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them, under GDPR Article 22.

Do not subject a person in Latvia to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).

Do not base a decision that has a legal effect on a person, or that significantly affects them, solely on automated processing of their personal information intended to profile their personality or habits, except where taken under a contract at their request or under a law with safeguards in place.

Where a decision based solely on automated processing about a person in Liechtenstein rests on a contract with them or on their explicit consent, put suitable safeguards in place, at least the right to obtain human intervention, to express their point of view and to contest the decision, under GDPR Article 22(3) as incorporated into the EEA Agreement.

Where a decision about a person in Liechtenstein is taken solely by automated processing within the insurance, due diligence, credit or investment-service matters listed in DSG Article 37(1), take suitable measures to protect their legitimate interests, at least the right to obtain human intervention, to state their point of view and to contest the decision, under DSG Article 37(2), unless the decision grants the person's request in an insurance matter or concerns due diligence.

Where a decision based solely on automated processing about a person in Lithuania rests on a contract with them or on their explicit consent, put suitable safeguards in place, at least the right to obtain human intervention, to express their point of view and to contest the decision, under GDPR Article 22(3).

Do not subject a person in Lithuania to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).

Where a decision based solely on automated processing about a person in Luxembourg rests on a contract with them or on their explicit consent, put suitable safeguards in place, at least the right to obtain human intervention, to express their point of view and to contest the decision, under GDPR Article 22(3).

Do not subject a person in Luxembourg to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).

Do not base an administrative or private decision assessing a person's conduct solely on automated profiling.

Do not base a decision producing legal effects for a person solely on an automated processing designed to profile them or evaluate aspects of their personality.

Where a decision based solely on automated processing about a person in Malta rests on a contract with them or on their explicit consent, put suitable safeguards in place, at least the right to obtain human intervention, to express their point of view and to contest the decision, under GDPR Article 22(3).

Do not subject a person in Malta to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).

Do not base a decision producing legal effects for a person solely on automated profiling or an automated evaluation of their personality.

Do not subject a person to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, and where a carve-out applies, give them human intervention, a chance to express their point of view and a way to contest the decision.

Do not base a decision that produces legal effects for a person or significantly affects them solely on automated processing, including profiling, unless a listed exception applies, and where it does, guarantee at least the right to obtain human intervention, express a view, and contest the decision.

Do not base a decision producing legal effects on a person solely on automated processing meant to profile them or evaluate an aspect of their personality, except a decision taken in forming or performing a contract where the person could comment, or one that grants the person's own request.

Do not subject a person in the Netherlands to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).

Do not base an administrative or private decision assessing a person's behaviour or personality solely on automated processing, unless the person gave explicit consent, it is necessary to enter into or perform a contract with them, or a law or regulation otherwise authorizes it.

Give a data subject the right not to be subject to a decision based solely on automated processes or algorithms.

Give a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, under Article 26.

Where a decision based solely on automated processing about a person in Norway rests on a contract with them or on their explicit consent, put suitable safeguards in place, at least the right to obtain human intervention, to express their point of view and to contest the decision, under the incorporated GDPR Article 22(3).

Do not subject a person in Norway to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by a law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under the incorporated GDPR Article 22(1) and (2).

Do not subject a data subject to a decision based solely on automated processing of their personal data that produces a negative legal effect or a detriment to a right, unless they consented, the decision is necessary to perform a contract, or a special law authorizes it.

Do not base a decision that has legal effects on a person, or significantly affects them, solely on an automated evaluation of their personality or conduct, outside a contractual relationship or a public-entity entry evaluation, and let them state their own view.

Do not subject a person in Poland to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).

Give a person in Portugal a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them, under GDPR Article 22.

Do not subject a person in Portugal to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).

Do not base a decision producing legal effects for a person solely on automated processing intended to define their profile or evaluate aspects of their personality, unless the decision arises from concluding or performing a contract on which the person had a chance to comment, or it grants their own request.

Do not subject a person in Romania to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).

Do not subject a data subject to a decision based solely on automated processing, including profiling, that produces legal or other significant consequences for them, unless their explicit consent, contract necessity, or an authorising law with safeguards applies.

Where a decision based solely on automated processing about a person in San Marino rests on a contract with them or on their explicit consent, put appropriate measures in place to safeguard their rights, freedoms and legitimate interests, at least the right to obtain human intervention, to express their point of view and to contest the decision, under Article 22(3) of Law No. 171 of 2018.

Do not subject a person to a decision that affects their legal situation or affects them significantly based solely on automated processing that assesses their personality, professional capacity, credit, trustworthiness or behavior, unless the decision is taken in connection with a contract and the person's request for the contract has been satisfied or appropriate measures safeguard their legitimate interests, or a law authorizing it establishes measures guaranteeing the data holder's legitimate rights and interests.

Do not base a decision producing legal effects for a person solely on automated profiling or an automated evaluation of their personality, except where they had the chance to make observations or the decision grants their own request.

Do not base a decision producing legal effects or significantly affecting a person solely on automated processing, including profiling, unless it is necessary for a contract with them, authorized by law with adequate safeguards, or based on their explicit consent, and even then give them the right to obtain human intervention, express their view, and contest the decision.

Do not subject a person in Slovakia to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).

Do not subject a person in Slovenia to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).

Do not base a decision that produces legal or similar significant effects on a person solely on automated processing, including profiling, unless a contract, a written law with safeguards, or the person's consent authorises it.

Do not base a decision that has legal or substantially similar consequences for a person solely on automated processing of their personal information, unless the person can make representations about the decision and you have explained the underlying logic of the processing to them.

Do not subject a person in Spain to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).

Give a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects for them or otherwise significantly affects them, unless a listed exception applies, and never base such a decision on special categories of personal data unless a narrow exception applies with appropriate safeguards.

Do not subject a person in Sweden to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).

Do not base a decision producing legal effects concerning a person solely on an automated evaluation of their personal characteristics or profile, except a contractual decision on which they could state their views or one granting their own request.

Let a data subject avoid a decision based solely on automated processing.

Do not base a decision that significantly affects a data subject solely on automated processing where they have given written notice against it, and where such a decision is made, notify the data subject and reconsider it within twenty-one days of their written request.

Do not base a decision that significantly affects a data subject in Ukraine solely on automated processing, including profiling, under Article 25.

Where you take a significant decision about a person in the United Kingdom based solely on automated processing of their personal data, have safeguards in place that give them information about the decision, let them make representations about it, let them obtain human intervention, and let them contest it, under UK GDPR Article 22C.

Do not take a significant decision based solely on automated processing where your processing for it relies in any part on the recognised legitimate interests basis in UK GDPR Article 6(1)(ea), and base one on special category data only with the person's explicit consent, or where it is necessary for a contract or required or authorised by law and the Article 9(2)(g) substantial public interest condition applies, under UK GDPR Article 22B.

Let a data subject challenge, and obtain the valuation criteria and the program behind, any administrative act or private decision based solely on automated processing of their personal data that offers an assessment of their character or personality.

Do not subject a data subject to a decision based solely on automated processing, including profiling.

Do not subject a data subject to a decision based solely on automated processing that has legal or similarly significant effects without human intervention.

Where an automated decision rests on a contract, a written law or explicit consent, put suitable safeguards in place, including the right to obtain human intervention, to put a point of view and to contest the decision, and do not process sensitive personal data automatically at all unless the data subject expressly consented, the processing is in the public interest, or a written law permits it with safeguards.

Do not take a decision about a data subject on the basis of automatic data processing outside what section 25 allows, and deal with a child data subject through the representation section 26 provides.