Artificial Intelligence, Profiling and Automated Decision Making | Dubai International Financial Center (DIFC) | Global Data and Cyber Handbook | Baker McKenzie Resource Hub

Start Comparison

Artificial Intelligence, Profiling and Automated Decision Making

Jump to

Artificial Intelligence, Profiling and Automated Decision Making Start Comparison

Are there any restrictions or requirements related to creating profiles of data subjects or utilizing automated decision-making for decisions related to data subjects, including with respect to artificial intelligence?

Last review date: 23 December 2024

Yes.

The restrictions or requirements are as follows:

qualified right not to be subject to a decision based solely on automated decision making, including profiling – for example, only applicable if the decision produces legal effects concerning them or similarly significantly affects them
right to information / transparency requirement
right to request human review of the automated decision making

If such restrictions or requirements exist, are they subject to any exceptions?

Last review date: 23 December 2024

Yes.

The decision of a data subject to object to any decision based solely on automated processing, which includes profiling, shall not apply to a decision that is: (i) necessary for entering into, or performance of a contract between a data subject and a controller; (ii) authorized by applicable law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights; or (iii) based on the data subject's explicit consent.

Has the data privacy regulator issued guidance on data privacy and artificial intelligence, automated decision-making or profiling?

Last review date: 23 December 2024

Yes.

In September 2023, the DIFC enacted amendments to Regulations under the DIFC Data Protection Law. The new Regulation 10 concerning personal data processed through autonomous and semi-autonomous systems 10 is the first regulation of its kind in the Gulf region to impose specific obligations for controllers and processors with respect to the use of autonomous systems (such as AI systems).

Has the data privacy regulator taken enforcement action in relation to artificial intelligence, including automated decision-making or profiling?

Last review date: 23 December 2024

No enforcement activity to date

Do other (non-personal data or cybersecurity) laws or regulations impose restrictions on use of artificial intelligence, automated decision-making or profiling?

Last review date: 23 December 2024

Yes, laws in force

Regulation 10 introduced new obligations for users and operators aimed at developing a responsible and ethical approach with regard to the processing of personal data processed through autonomous and semi-autonomous systems. The Regulation emphasizes ensuring transparency (through the provision of a notice in clear and explicit terms upon the initial use of, or access to, the systems, alerting users to any underlying technology and processes comprising the systems that may undertake any processing activities which is not human-initiated, controlled, or directed), fairness, ethics, security and accountability (e.g. a system must have mechanisms in place to ensure responsibility and accountability for enabling its systems and outcomes), and require implementing robust risk management and governance frameworks for AI-powered systems.