---
title: "Gibraltar — Algorithmic, Biometric & Surveillance Governance | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/gibraltar/algorithmic-biometric-and-surveillance-governance/
source_html: /jurisdictions/gibraltar/algorithmic-biometric-and-surveillance-governance/index.html
description: "Gibraltar — Algorithmic, Biometric & Surveillance Governance (Red, 6 sub-modules, 2 claims): Almost no Gibraltar-specific guidance found on profiling, ADM transparency, AI risk assessment, biometrics or genetic data; only the state-surveill"
generated_at: 2026-10-25T04:46:50Z
content_sha256: 2044ff80f0b7d0554cb354b285d7e43b7f61121e1b386cae409e0a13c09fb13a
generator: "fe-fleet/md-twin@1.0"
---
# Gibraltar — Algorithmic, Biometric & Surveillance Governance | Data Protection Monitor

### D8Algorithmic, Biometric & Surveillance Governancered6 sub-modules2 claimsRed▾#

Almost no Gibraltar-specific guidance found on profiling, ADM transparency, AI risk assessment, biometrics or genetic data; only the state-surveillance carve-out is confirmed.

Primary framework Gibraltar GDPR Arts 9 & 22

Supervisory authority [Gibraltar Regulatory Authority (GRA)](https://www.gra.gi/data-protection)

Traffic-light rationale — Red Almost no Gibraltar-specific guidance found on profiling, ADM transparency, AI risk assessment, biometrics or genetic data; only the state-surveillance carve-out is confirmed.

#### Sub-modules (6)

Category narrative 256 words

Gibraltar retains the unamended Art. 22 Gibraltar GDPR prohibition on solely automated decision-making, including profiling, that produces legal effects concerning a data subject or similarly significantly affects them (the UK's DUAA 2025 Arts. 22A–22D relaxation does NOT apply in Gibraltar). Under Art. 22(2) Gibraltar GDPR and s.19 DPA 2004, solely automated significant decisions are permitted only where (a) necessary for entering into or performing a contract between the data subject and controller, (b) authorised by Gibraltar law laying down suitable safeguards (subject to s.19 DPA 2004 written notification and 21-day reconsideration rights), or (c) based on the data subject's explicit consent, and in cases (a) and (c) the controller must implement suitable safeguards including the right to obtain human intervention, express the data subject's point of view, and contest the decision (Art. 22(3)). Solely automated decisions based on Art. 9 special category data are prohibited under Art. 22(4) unless explicit consent or substantial public interest (Art. 9(2)(a) or (g)) applies. This framework directly governs automated AML/fraud blocking, affordability scoring, and responsible-gambling interventions across Gibraltar's licensed gaming and fintech sectors: where a system automatically suspends an account or refuses service without meaningful human review, Art. 22(3) / s.19 DPA 2004 safeguards and Arts. 13(2)(f)/14(2)(g)/15(1)(h) logic-transparency disclosures apply. Biometric data processed for unique identification (e.g., facial recognition KYC liveness checks or workplace biometric access) is Art. 9(1) special category data requiring explicit consent or a Schedule 1 DPA 2004 condition plus an Art. 35 DPIA, while CCTV and video surveillance are governed by the GRA's dedicated CCTV Guidance.

Evidence 2

Sources and claims (2)
- Confirmedunavailable — Art. 22 Gibraltar GDPR and s.19 of the Data Protection Act 2004 prohibit solely automated decision-making (including profiling) producing legal or similarly significant effects unless necessary for contract, authorised by Gibraltar law with a 21-day human reconsideration right, or based on explicit consent.
- Confirmed[OneTrust DataGuidance](https://www.dataguidance.com/news/gibraltar-gra-publishes-guidance-exemptions-data-protection-legislation) — GRA guidance confirms exemptions from the Data Protection Act 2004 and GDPR for crime, law enforcement and public protection purposes, which cannot be routinely relied upon and require case-by-case justification and documentation under the accountability principle.observed 2026-08-05