§ 29 NDSG
Automated decision-making
(1)A decision based solely on automated processing which produces an adverse legal effect concerning the data subject or significantly affects the data subject, including profiling, shall be permitted only where it is provided for by a legal provision.
(2)Decisions pursuant to paragraph 1 shall not be based on special categories of personal data unless appropriate measures have been taken to safeguard the rights and freedoms and the legitimate interests of the data subject.
(3)Profiling which results in the discrimination of data subjects on the basis of special categories of personal data shall be prohibited.