§ 54 BDSG
Automated individual decision-making
(1)A decision based solely on automated processing, including profiling, which produces an adverse legal effect concerning the data subject or significantly affects him or her, shall be permissible only where it is provided for in a legal provision.
(2)Decisions under Subsection (1) may not be based on special categories of personal data, unless suitable measures to safeguard the rights and interests as well as the legitimate interests of the data subjects have been taken.
(3)Profiling that results in discrimination against data subjects on the basis of special categories of personal data shall be prohibited.