Makes housing decisions, in Ethiopia

Computer Crime Proclamation No. 958/2016, art. 2(13), art. 2(19), art. 17, art. 27, art. 46 · Read the law's page

• Immediately notify the Information Network Security Agency (now the Information Network Security Administration) and report the crime to the police, and take appropriate measures.
• This binds a service provider, defined as a person who provides technical data-processing or communication service or alternative infrastructure to users by means of a computer system, or a government organ; the trigger is knowledge that a crime under this Proclamation is being committed, or knowledge that a third party is disseminating illegal content through the computer system you administer, which on this definition's own terms reaches an app or platform operator whose product is itself that computer system, not only a network, hosting, or telecommunications intermediary.
• The Agency may issue a directive setting the form and procedure for this report; no such directive is confirmed as a separately published text in the primary sources located here.
• No provision of this Proclamation states a separate penalty for failing this reporting duty. The Article 17 offense for failing to cooperate with an investigation lists five other, unrelated articles on data retention, real-time collection, data preservation orders, data-production orders, and search assistance, and does not include this one.

National Artificial Intelligence Policy of Ethiopia, approved by the Council of Ministers at its 37th regular meeting, 27 June 2024; published and implemented by the Ethiopian Artificial Intelligence Institute (EAII)

Proclamation No. 1321/2024, art. 31 (automated individual decision-making) · Read the law's page

• Give a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or significantly affects them.
• Do not base an automated evaluation of personal aspects relating to an individual on sensitive personal data, and where an automated decision rests on a contract with the data subject or their explicit consent, put suitable measures in place to safeguard the data subject's rights, freedoms and legitimate interests.

Proclamation No. 1321/2024, arts. 24-30, 32 (rights of data subjects) · Read the law's page

• Tell a data subject, when you obtain their personal data, who you are, the purposes and lawful basis of the processing, the recipients, any transfer to a third-party jurisdiction, the retention periods, their rights, and whether automated decision-making including profiling is in use; where the data came from elsewhere, add the categories obtained and their source, and give the information within a reasonable period and at the latest one month after obtaining it.
• Answer a request for access at reasonable intervals, free of charge and without excessive delay, with confirmation of processing, the data in an intelligible form, their origin and the storage period, in electronic or hard copy at the data subject's preference, and put any refusal in writing with detailed reasons.
• Correct inaccurate, incomplete, misleading or out-of-date personal data on request, free of charge and without excessive delay, and pass the correction on to every other data controller or third party the data were disclosed to in the year before the request.
• Erase personal data on request, free of charge and without excessive delay, where it is no longer necessary for its purpose, where consent is withdrawn and no other ground applies, where the data subject objects and no overriding legitimate ground exists, or where it was processed unlawfully, and take reasonable steps to tell third parties processing data you made public.
• Stop processing personal data for direct marketing, including the profiling related to it, as soon as the data subject objects, and bring the right to object to the data subject's attention explicitly.
• Restrict processing on request in the cases article 30 lists, keep the data stored but otherwise unused without the data subject's consent, and tell the data subject before lifting the restriction.
• Give a data subject their personal data in a structured, commonly used and machine-readable format on request, free of charge and without excessive delay, and transmit it directly to another controller or processor where that is technically possible.

Proclamation No. 1321/2024, arts. 9-11 (sensitive personal data and minors) · Read the law's page

• Do not process sensitive personal data, including genetic or biometric data, unless a listed exception applies, such as the data subject's specific written consent.
• Process a minor's personal data only with the consent or authorization of a parent, guardian, or tutor, or where necessary to the minor's vitally important interest, and never for marketing, profiling, or merging of profiles.
• Do not process sensitive personal data in respect of race or ethnic origin unless the processing ensures justice and equality with regard to race or ethnic origin and is carried out with appropriate safeguards for the data subject's rights and freedoms.
• Where an exception does permit sensitive personal data to be processed, put appropriate technical and security safeguards in place first.
• Make reasonable efforts to verify the age of a data subject, and that consent was given or authorized by the minor's parent or guardian, taking available technology into account.