UAE PDPL (Federal Decree-Law No. 45 of 2021), Art. 18

Binding law — not yet in force or stayed AI-adjacent law

Decisions from automated processing with legal or serious effects need an objection route and, on request, human review (UAE PDPL Art. 18)

Art. 18(1) (right to object to automated-processing decisions with legal or serious effects, including profiling) · official text · Application uncertain: dated 2 Jan 2022, enforcement status not confirmed; check the official source · AE

The UAE's Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data gives the data subject a right to object to decisions issued by automated processing that have legal consequences or seriously affect them, including profiling (Art. 18(1)). There is no objection where the automated processing is within the terms of a contract between the data subject and the controller, is required by other legislation in force in the State, or rests on the data subject's prior consent under Art. 6 (Art. 18(2)); in those cases the controller must still apply suitable measures to protect the data's privacy and confidentiality and the person's rights (Art. 18(3)). In every case the controller must bring the human element into the review of automated-processing decisions at the data subject's request (Art. 18(4)). 'Automated processing' covers processing by a program or electronic system working automatically, wholly without human intervention or partly with limited human supervision (Art. 1). Detect a model output that becomes a decision about a person with no objection route and no human review on request, and no human decision.

Who it applies to

• Duty falls on: controller
• Systems covered: automated decision, consequential decision
• Controllers in the UAE, and controllers outside the UAE processing personal data of data subjects in the UAE (Art. 2(1)), that issue decisions by automated processing, including profiling, with legal consequences or serious effects on the data subject. The Decree-Law is in force from 2022-01-02 (Art. 31); Art. 29 gives controllers six months from the issue of the Executive Regulation to adjust, and whether that Regulation has been issued, and so whether Art. 18 is enforced, is a counsel question. Excluded: government data and authorities, security and judicial authorities, personal use, health and banking data with their own legislation, and free zones with their own data protection laws (Art. 2(2)).
• Not covered:
  • Government data; government authorities that control or process personal data; personal data held by security and judicial authorities (Art. 2(2)(a)-(c))
  • A data subject processing their own data for personal purposes (Art. 2(2)(d))
  • Health personal data and banking and credit personal data that have their own protection legislation (Art. 2(2)(e)-(f))
  • Companies and establishments in the State's free zones that have their own personal data protection legislation, such as the DIFC and ADGM (Art. 2(2)(g))
• Whether it applies depends on facts outside the code; a person has to decide.

verdict = client.chat.completions.create(model=MODEL, messages=msgs).choices[0].message.content
if verdict.strip() == 'deny':
    deny(applicant)
    send_decision_email(applicant, 'Your application was not approved.')

out = client.chat.completions.create(model=MODEL, messages=msgs,
                                     response_format={'type': 'json_object'})
result = json.loads(out.choices[0].message.content)
if result['decision'] == 'deny':
    if requires_human_review('credit'):                 # a person decides
        review_queue.enqueue(applicant.id, proposal=result)
    else:                                               # solely automated, recorded basis
        deny(applicant, basis=DECISION_BASIS['credit'], reasons=result['reasons'])
        send_decision_email(applicant, render('adm_denial.txt', notice=ADM_NOTICE,
            reasons=result['reasons'], contest_url=f'{BASE}/decisions/{applicant.id}/contest'))

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

• UnitedHealth nH Predict claim-denial litigation (2023-11; alleged (not proven)). A class action filed in November 2023 alleges that UnitedHealth's nH Predict model had a 90% error rate, measured by denials reversed on appeal, while only about 0.2% of members appealed. UnitedHealth disputes the allegations; the litigation is ongoing. Source: STAT News · evidence grade: primary · cited by Monitor how often adverse AI decisions are reversed, and suspend models that are usually wrong
• Cigna PXDX batch claim denials (reported) (2022; alleged (not proven)). ProPublica, citing internal Cigna records, reported that Cigna's PXDX system was used to reject more than 300,000 claims over two months in 2022, with physicians spending an average of 1.2 seconds on each. Cigna disputes the reporting; related lawsuits are ongoing. Source: ProPublica / The Capitol Forum · evidence grade: press of record · cited by Make human review of adverse AI decisions substantive, not nominal

Rule id ae-pdpl-art18.object-and-human-review · review status: primary source derived