Almost no Gibraltar-specific guidance found on profiling, ADM transparency, AI risk assessment, biometrics or genetic data; only the state-surveillance carve-out is confirmed.
Traffic-light rationale — RedAlmost no Gibraltar-specific guidance found on profiling, ADM transparency, AI risk assessment, biometrics or genetic data; only the state-surveillance carve-out is confirmed.
Sub-modules (6)
Category narrative256 words
Gibraltar retains the unamended Art. 22 Gibraltar GDPR prohibition on solely automated decision-making, including profiling, that produces legal effects concerning a data subject or similarly significantly affects them (the UK's DUAA 2025 Arts. 22A–22D relaxation does NOT apply in Gibraltar). Under Art. 22(2) Gibraltar GDPR and s.19 DPA 2004, solely automated significant decisions are permitted only where (a) necessary for entering into or performing a contract between the data subject and controller, (b) authorised by Gibraltar law laying down suitable safeguards (subject to s.19 DPA 2004 written notification and 21-day reconsideration rights), or (c) based on the data subject's explicit consent, and in cases (a) and (c) the controller must implement suitable safeguards including the right to obtain human intervention, express the data subject's point of view, and contest the decision (Art. 22(3)). Solely automated decisions based on Art. 9 special category data are prohibited under Art. 22(4) unless explicit consent or substantial public interest (Art. 9(2)(a) or (g)) applies. This framework directly governs automated AML/fraud blocking, affordability scoring, and responsible-gambling interventions across Gibraltar's licensed gaming and fintech sectors: where a system automatically suspends an account or refuses service without meaningful human review, Art. 22(3) / s.19 DPA 2004 safeguards and Arts. 13(2)(f)/14(2)(g)/15(1)(h) logic-transparency disclosures apply. Biometric data processed for unique identification (e.g., facial recognition KYC liveness checks or workplace biometric access) is Art. 9(1) special category data requiring explicit consent or a Schedule 1 DPA 2004 condition plus an Art. 35 DPIA, while CCTV and video surveillance are governed by the GRA's dedicated CCTV Guidance.
Sources and claims (2)
Confirmedunavailable — Art. 22 Gibraltar GDPR and s.19 of the Data Protection Act 2004 prohibit solely automated decision-making (including profiling) producing legal or similarly significant effects unless necessary for contract, authorised by Gibraltar law with a 21-day human reconsideration right, or based on explicit consent.
ConfirmedOneTrust DataGuidance — GRA guidance confirms exemptions from the Data Protection Act 2004 and GDPR for crime, law enforcement and public protection purposes, which cannot be routinely relied upon and require case-by-case justification and documentation under the accountability principle.observed