Binding law — in force
Data subjects may object to solely automated decisions with legal or seriously impactful effects and require manual review (DIFC Data Protection Law Art. 38)
Under the DIFC Data Protection Law, a data subject has the right to object to any decision based solely on automated processing, including profiling, that produces legal or other seriously impactful consequences for them and to require the decision to be reviewed manually (Art. 38(1)). The right does not apply to decisions necessary for a contract, authorised by applicable law with safeguards, or based on explicit consent (Art. 38(2)), but those exceptions never apply to minors (Art. 38(4)), and the contract and consent exceptions require suitable safeguards including at least the ability to have the processing reviewed manually (Art. 38(5)). Decisions based solely on automated processing of special categories need explicit consent or a substantial public interest under applicable law (Art. 38(6)). Detect a model output that becomes a decision about a person with no objection and manual-review route and no human decision.
difc-dp-law-art38.object-and-manual-review · Art. 38 (automated individual decision-making, including Profiling) · official source · jurisdictions: AE-DU-DIFC