§ 46 DSG NRW
Automated individual decisions
(1)Decisions that are associated with an adverse legal consequence for the data subject or that significantly affect them may not be based solely on automated processing, including profiling, unless a legal provision expressly permits this.
(2)Without prejudice to the general requirements for the processing of special categories of personal data, such data may only be processed in decisions pursuant to paragraph 1 where appropriate measures to protect the rights and freedoms and the legitimate interests of the data subject have been taken.
(3)Profiling that results in discrimination against data subjects on the basis of special categories of personal data shall be prohibited.
(4)Rights of data subjects