Global Data and Cyber Handbook

Germany

Select a Topic
Start Comparison
Artificial Intelligence, Profiling and Automated Decision Making
Jump to
Artificial Intelligence, Profiling and Automated Decision Making Start Comparison
Are there any restrictions or requirements related to creating profiles of data subjects or utilizing automated decision-making for decisions related to data subjects, including with respect to artificial intelligence?

Last review date: 17 December 2024

Yes.

The restrictions or requirements are as follows:

  • qualified right not to be subject to a decision based solely on automated decision making, including profiling – for example, only applicable if the decision produces legal effects concerning them or similarly significantly affects them
  • right to information / transparency requirement
  • right to request human review of the automated decision making
  • other

Decision of the Court of Justice of the European Union dated 7 December 2023 (C‑634/21) ruling that "Article 22(1) of the GDPR must be interpreted as meaning that the automated establishment, by a credit information agency, of a probability value based on personal data relating to a person and concerning his or her ability to meet payment commitments in the future constitutes ‘automated individual decision-making’ within the meaning of that provision, where a third party, to which that probability value is transmitted, draws strongly on that probability value to establish, implement or terminate a contractual relationship with that person".

If such restrictions or requirements exist, are they subject to any exceptions?

Last review date: 17 December 2024

Yes.

The exceptions are as follows:

If the decision:

  • is necessary for entering into, or performance of, a contract between the data subject and a data controller
  • is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, or
  • is based on the data subject's explicit consent

Pursuant to Sec. 37 of the Federal Data Protection Act, if the decision is made in the context of providing services pursuant to an insurance contract and:

  • the request of the data subject was fulfilled; or
  • the decision is based on the application of binding rules of remuneration for therapeutic treatment and the controller takes suitable measures, in the event that the request is not granted in full, to safeguard the data subject's legitimate interest, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision; the controller shall inform the data subject of these rights no later than the notification indicating that the data subject's request will not be granted in full.

The decisions pursuant to Sec. 37 of the Federal Data Protection Act may be based on the processing of health data as referred to in Art. 4 No. 15 GDPR.

Has the data privacy regulator issued guidance on data privacy and artificial intelligence, automated decision-making or profiling?

Last review date: 17 December 2024

Please refer to the EU Chapter for detailed information regarding EU-wide legislation.

Yes

For example (all in German only):

Has the data privacy regulator taken enforcement action in relation to artificial intelligence, including automated decision-making or profiling?

Last review date: 17 December 2024

  • Enforcement activity against AI developer(s)
  • Enforcement activity against AI user(s)/deployer(s)
  • Enforcement activity under existing privacy law
Do other (non-personal data or cybersecurity) laws or regulations impose restrictions on use of artificial intelligence, automated decision-making or profiling?

Last review date: 17 December 2024

Please refer to the EU Chapter for detailed information regarding EU-wide legislation.

Yes, laws in force, although not specifically focusing on artificial intelligence

{{ $store.state.loadingScreen.message }} ...