BulgariaGDPR Article 22, Automated Decisions in Bulgaria
Regulation (EU) 2016/679, Art. 22; Zakon za zashtita na lichnite danni, Art. 37a
In force since .
A data subject rights rule binding public and private bodies.
As of .
What it requires
- Give a person in Bulgaria a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.
- You may refuse to give effect to this right in Bulgaria where doing so would endanger an interest Article 37a lists, such as the rights and freedoms of others or the enforcement of a civil-law claim, under Personal Data Protection Act Article 37a.
What this law does
General Data Protection Regulation (GDPR) Article 22 gives a person in Bulgaria the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.
Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision. Article 37a of the Personal Data Protection Act reaches this right too: a controller may refuse to give effect to it where doing so would endanger a listed interest, such as another person's rights and freedoms or the enforcement of a civil-law claim.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.