UAVG Article 40 and automated decisions in the Netherlands

What it is

The Uitvoeringswet Algemene verordening gegevensbescherming (UAVG) is the Dutch law of 16 May 2018 that implements the GDPR in the Netherlands. The GDPR applies directly, and the UAVG fills in the choices the GDPR leaves to member states. Article 40 is the Dutch choice on automated individual decision-making.

GDPR Article 22 gives people the right not to be subject to a decision based solely on automated processing, including profiling, that has legal or similarly significant effects on them. Article 22(2)(b) allows member state law to authorise such decisions if it lays down suitable safeguards. Article 40 is that authorisation for one narrow category.

Who it applies to

Article 40 applies to any controller subject to Dutch law, public or private, that makes solely automated decisions with legal or similarly significant effects on people. In practice it matters most for government bodies and for private organisations that carry out public tasks or must make decisions to meet a legal obligation.

It does not reach decisions based on profiling. A system that evaluates personal aspects of someone, such as predicting their behaviour, reliability or risk, is profiling, and Article 40 does not cover it. Those decisions are allowed only under the GDPR’s own exceptions for contracts and explicit consent, or another specific legal basis.

What it requires

When the exception applies. Article 40(1) says Article 22(1) GDPR does not apply where automated individual decision-making, other than on the basis of profiling, is necessary to comply with a legal obligation resting on the controller, or necessary to perform a task in the public interest.

Suitable measures. Article 40(2) requires the controller to take suitable measures to protect the rights, freedoms and legitimate interests of the person concerned.

A safe harbour for non-government controllers. Article 40(3) says that if the controller is not a government body (bestuursorgaan), suitable measures are in any event taken when the right to human intervention, the right of the person to express their point of view and the right to contest the decision are guaranteed.

For an AI system, that gives three questions. Does the system profile the people it decides about? If not, is the decision necessary for a legal obligation or a public task? And can an affected person reach a human, put their side and contest the outcome?

The rest of the GDPR still applies. The person must be told about the automated decision and given meaningful information about the logic involved, and a data protection impact assessment is usually required.

Key dates

• 16 May 2018. Uitvoeringswet AVG enacted.
• 25 May 2018. GDPR and the UAVG apply.
• 20 April to 1 June 2026. The draft Uitvoeringswet AI-verordening, which designates Dutch AI Act supervisors, is open for consultation.
• 2 December 2027. EU AI Act high-risk duties apply to Annex III systems, including AI used for access to public benefits and for credit scoring.

How it relates to other frameworks

Article 40 sits beneath GDPR Article 22 and narrows it for public tasks and legal obligations without profiling. Where the system is AI used in an Annex III area, such as eligibility for public assistance benefits, the EU AI Act adds high-risk duties, and public deployers must carry out a fundamental rights impact assessment. The Dutch government’s Algoritmekader brings these requirements together for public bodies, and the Algoritmeregister is where they publish their impactful algorithms.

A note on this page

This is Aicura’s reading of Article 40 of the Uitvoeringswet AVG. It is not legal advice and it is not the Act itself. Read the text on wetten.overheid.nl, and take advice on how it applies to your organisation.