SpainGDPR Article 22 and LOPDGDD Article 11(2), Automated Decisions in Spain
Regulation (EU) 2016/679, Art. 22; LOPDGDD, Ley Orgánica 3/2018, Art. 11(2)
In force since .
A data subject rights rule binding public and private bodies.
As of .
What it requires
- Give a person in Spain a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.
- If you use a person's data in Spain for profiling, state in the basic information you give them that they may object to a solely automated decision that produces legal or similarly significant effects on them, where General Data Protection Regulation (GDPR) Article 22 gives that right, under LOPDGDD Article 11(2).
What this law does
General Data Protection Regulation (GDPR) Article 22 gives a person in Spain the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.
Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision. The LOPDGDD adds no authorisation of its own under Article 22(2)(b); its Article 11(2) requires a controller that uses a person's data for profiling to state, in the basic information it gives them, that they may object to a solely automated decision where Article 22 gives that right.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.