Makes public services decisions, in Andorra

Llei 29/2021, art. 25 (automated individual decisions) · Read the law's page

• Do not subject a data subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them, unless a listed exception applies and you provide the required safeguards, and never subject a minor to such a decision at all.

Llei 29/2021, arts. 15-24, 26 (rights of the data subject) · Read the law's page

• Answer an access, rectification, erasure, restriction, portability or objection request within one month of receipt, extendable by two further months for complex or numerous requests, and tell the data subject about any extension within the first month.
• Tell a data subject, at the point you collect or first obtain their personal data, your identity, the purposes and legal basis of processing, the recipients, any transfer to a third country, the storage period, and their rights.
• Give a data subject a copy of their personal data on request, along with the purposes, categories, recipients, storage period and other Article 18 information, free of charge for the first copy.
• Correct inaccurate or incomplete personal data on request without undue delay, and pass the correction on to recipients the data were disclosed to.
• Erase personal data on request without undue delay where it is no longer necessary, consent is withdrawn with no other lawful basis, the data subject objects with no overriding ground, it was processed unlawfully, a legal obligation requires erasure, or it was collected under the child information-society-service consent rule, and de-reference it if you operate a search engine indexing it.
• Restrict processing on request while accuracy is contested, in place of erasure where the data subject prefers restriction, where you no longer need the data but the data subject does for legal claims, or while an objection is being verified.
• Give a data subject their data in a structured, commonly used, machine-readable format and transmit it to another controller on request where processing rests on consent or a contract and is automated.
• Stop processing personal data for direct marketing, including related profiling, as soon as a data subject objects, and bring that right to their attention explicitly and separately no later than the first communication with them.
• If you provide internet access as a service, offer transparent terms free of technical or economic discrimination and inform users of their rights, per Article 21's digital-rights guarantee.

Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law, Council of Europe Treaty Series No. 225, opened for signature 5 September 2024; signed by Andorra the same day, not yet ratified · Read the law's page

• Each Party must adopt or maintain measures for the identification, assessment, prevention and mitigation of risks posed by AI systems, considering their actual and potential impacts on human rights, democracy and the rule of law, and apply those measures iteratively throughout the activities within an AI system's lifecycle; an app operator is reached through the measures its Party adopts.
• Each Party must seek to ensure, as appropriate for the context, that persons interacting with an AI system are notified that they are interacting with such a system rather than with a human, and must adopt or maintain measures for accessible and effective remedies, as far as its international obligations require and its domestic legal system allows, including measures to ensure that information about an AI system is sufficient for affected persons to contest a decision made or substantially informed by its use.