IcelandAct No. 90/2018 Article 22, Automated Decisions in Iceland
Log nr. 90/2018, arts. 2 and 22, incorporating Regulation (EU) 2016/679, Art. 22
In force since .
A data subject rights rule binding public and private bodies.
As of .
What it requires
- Provide a meaningful human review before finalizing any decision based solely on automated processing that produces legal or similarly significant effects for a person in Iceland.
What this law does
Act No. 90/2018 gives Regulation (EU) 2016/679 the force of law in Iceland (art. 2), and its own article 22 restates the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects a person, pointing to Article 22 of the Regulation for its exceptions.
Where such a decision rests on a contract or explicit consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.