Summary
Creates rights to opt out of consequential profiling, question and obtain reasons for profiling results, review underlying personal data, and obtain reevaluation when inaccurate data is corrected. Significant decisions expressly include health-care services; specified risky processing requires data-protection assessments.
Healthcare Implications
Covered nonexempt health-related controllers must honor applicable profiling rights and assessment duties. HIPAA-protected information, health records, other exempt clinical data, and insurance companies remain outside coverage. Reevaluation after correcting inaccurate data is not a right to clinician review of a clinical decision.
Operational Implications
- Covered controllers must conduct and document assessments for profiling presenting specified foreseeable risks and other covered processing; provide relevant assessments to the Attorney General on request.