Visit fondia.com
The content concerns Finnish legislation.
 

Automated Decision-making and Cookies

Automated decision-making means decision-making without any form of human intervention, that has legal effects on the data subject. The purpose behind the decision must be to assess the characteristics of the data subject, such as professional performance, creditworthiness, reliability or behavior. Since the decision must have legal effects on the data subject or affect the data subject in a significant way, sending a direct marketing ad to the data subject based on a mailing list compiled automatically by a computer does not constitute an automated decision within the meaning of the article.

The controller must remember the obligation to provide information within all personal data processing activities. In case the controller’s activities include automated decision-making or profiling, special attention must be paid to the transparency of the processing. The data subject has the right to object to automated decision-making concerning its own personal data, that is based solely on automated processing, such as profiling, and has legal effects on or significantly affects the data subject in a similar manner. However, there are exception to this prohibition. Automated decision-making shall be permitted, if the decision:

  • is necessary for the conclusion or performance of a contract between the data subject and the controller

  • is permitted by the EU law or legislation of an EU member state to which the controller is subject

  • is based on the explicit consent of the data subject

Individuals who are subject to automated decision-making must be informed about the actions, receive meaningful information about the logic involved in the processing and the significance and possible consequences on the data subject.

The use of cookies or other tools to store information about users of a service on their terminal devices and the use of such data is permitted for the service provider, provided that the user has given an explicit consent to the processing. In this case, the service provider must provide the user with comprehensible and covering information about the purpose of the data storage and use. A valid consent for the use of cookies cannot be obtained through a pre-ticked box but requires active behavior on the part of the data subject.