Art. 35 BayDSG
Automated Individual Decisions
(1)Decisions that are associated with an adverse legal consequence for the data subject or that significantly affect them, including profiling, shall not be based solely on automated processing, unless a legal provision expressly permits this.
(2)Profiling that results in data subjects being disadvantaged on the basis of special categories of data within the meaning of Art. 9 para. 1 GDPR shall be prohibited.