DIFC Data Protection Law Art. 38 (automated decisions)

Binding law — in force AI-adjacent law

Data subjects may object to solely automated decisions with legal or seriously impactful effects and require manual review (DIFC Data Protection Law Art. 38)

Art. 38 (automated individual decision-making, including Profiling) · official text · In force: applies since 1 Jul 2020 · AE-DU-DIFC

Under the DIFC Data Protection Law, a data subject has the right to object to any decision based solely on automated processing, including profiling, that produces legal or other seriously impactful consequences for them and to require the decision to be reviewed manually (Art. 38(1)). The right does not apply to decisions necessary for a contract, authorised by applicable law with safeguards, or based on explicit consent (Art. 38(2)), but those exceptions never apply to minors (Art. 38(4)), and the contract and consent exceptions require suitable safeguards including at least the ability to have the processing reviewed manually (Art. 38(5)). Decisions based solely on automated processing of special categories need explicit consent or a substantial public interest under applicable law (Art. 38(6)). Detect a model output that becomes a decision about a person with no objection and manual-review route and no human decision.

Who it applies to

• Duty falls on: controller
• Systems covered: automated decision, consequential decision
• Controllers within the DIFC Data Protection Law (incorporated in the DIFC, or processing in the DIFC as part of stable arrangements, Art. 6(3)) that take decisions based solely on automated processing with legal or seriously impactful consequences. The Law is in force from 2020-07-01 (Art. 4); the consolidated text does not show whether the 2022 or 2025 amendment laws changed Art. 38.
• Not covered:
  • Processing by natural persons in a purely personal or household activity with no commercial connection (Art. 6(4))
• Whether it applies depends on facts outside the code; a person has to decide.

verdict = client.chat.completions.create(model=MODEL, messages=msgs).choices[0].message.content
if verdict.strip() == 'deny':
    deny(applicant)
    send_decision_email(applicant, 'Your application was not approved.')

out = client.chat.completions.create(model=MODEL, messages=msgs,
                                     response_format={'type': 'json_object'})
result = json.loads(out.choices[0].message.content)
if result['decision'] == 'deny':
    if requires_human_review('credit'):                 # a person decides
        review_queue.enqueue(applicant.id, proposal=result)
    else:                                               # solely automated, recorded basis
        deny(applicant, basis=DECISION_BASIS['credit'], reasons=result['reasons'])
        send_decision_email(applicant, render('adm_denial.txt', notice=ADM_NOTICE,
            reasons=result['reasons'], contest_url=f'{BASE}/decisions/{applicant.id}/contest'))

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

• UnitedHealth nH Predict claim-denial litigation (2023-11; alleged (not proven)). A class action filed in November 2023 alleges that UnitedHealth's nH Predict model had a 90% error rate, measured by denials reversed on appeal, while only about 0.2% of members appealed. UnitedHealth disputes the allegations; the litigation is ongoing. Source: STAT News · evidence grade: primary · cited by Monitor how often adverse AI decisions are reversed, and suspend models that are usually wrong
• Cigna PXDX batch claim denials (reported) (2022; alleged (not proven)). ProPublica, citing internal Cigna records, reported that Cigna's PXDX system was used to reject more than 300,000 claims over two months in 2022, with physicians spending an average of 1.2 seconds on each. Cigna disputes the reporting; related lawsuits are ongoing. Source: ProPublica / The Capitol Forum · evidence grade: press of record · cited by Make human review of adverse AI decisions substantive, not nominal

Rule id difc-dp-law-art38.object-and-manual-review · review status: primary source derived