GDPR has some stuff about biased algorithms. It's all civil, of course, no prison time for that, just fines.