Binding law — not yet in force or stayed
Decisions from automated processing with legal or serious effects need an objection route and, on request, human review (UAE PDPL Art. 18)
The UAE's Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data gives the data subject a right to object to decisions issued by automated processing that have legal consequences or seriously affect them, including profiling (Art. 18(1)). There is no objection where the automated processing is within the terms of a contract between the data subject and the controller, is required by other legislation in force in the State, or rests on the data subject's prior consent under Art. 6 (Art. 18(2)); in those cases the controller must still apply suitable measures to protect the data's privacy and confidentiality and the person's rights (Art. 18(3)). In every case the controller must bring the human element into the review of automated-processing decisions at the data subject's request (Art. 18(4)). 'Automated processing' covers processing by a program or electronic system working automatically, wholly without human intervention or partly with limited human supervision (Art. 1). Detect a model output that becomes a decision about a person with no objection route and no human review on request, and no human decision.
ae-pdpl-art18.object-and-human-review · Art. 18(1) (right to object to automated-processing decisions with legal or serious effects, including profiling) · official source · applies from 2022-01-02 · jurisdictions: AE