NetherlandsGDPR Article 22 and UAVG Article 40, Automated Decisions in the Netherlands
Regulation (EU) 2016/679, Art. 22; UAVG, Art. 40
In force since .
A data subject rights rule binding public and private bodies.
As of .
What it requires
- Give a person in the Netherlands a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them, subject to UAVG Article 40's exceptions.
- If a solely automated decision about a person in the Netherlands is not based on profiling and is necessary to comply with a legal obligation on you or to perform a task in the public interest, you may make it despite General Data Protection Regulation (GDPR) Article 22(1), but if you are not a public authority you must still let the person obtain human intervention, express their view and contest the decision, under UAVG Article 40.
What this law does
General Data Protection Regulation (GDPR) Article 22 gives a person in the Netherlands the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.
Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.
UAVG Article 40 is the Dutch Article 22(2)(b) law: a solely automated decision not based on profiling may be made where it is necessary to comply with a legal obligation or to perform a task in the public interest, and a controller that is not a public authority must then still let the person obtain human intervention, express their view and contest the decision.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.