Makes justice decisions, in Rwanda

Law N° 58/2021, art. 21 (automated individual decisions) · Read the law's page

• Do not subject a data subject to a decision based solely on automated processing, including profiling, that produces legal or other significant consequences for them, unless their explicit consent, contract necessity, or an authorising law with safeguards applies.

Law N° 58/2021, arts. 18-20 and 22-26 and 42 (rights of the data subject and the information notice) · Read the law's page

• On a data subject's written or electronic request, provide the purposes of processing, a copy of their personal data, a description of what you hold including third-party recipients, the source of data not obtained from them, and whether it was transferred to a third country or an international organisation, subject to the listed exceptions such as another person's rights, legal privilege, or confidential examination materials.
• Within thirty days of a request to object, port, erase or rectify personal data, tell the data subject in writing or electronically whether you complied and, if not, why, and expect the supervisory authority to answer an appeal against your response within sixty days.
• Stop processing a data subject's personal data on their objection, including for direct marketing or related profiling, unless you can demonstrate compelling legitimate grounds that override their interests, rights and freedoms.
• On request, resend a data subject's personal data in a structured, readable format, or transmit it directly to another data controller where technically feasible.
• Restrict processing at a data subject's or the supervisory authority's request while accuracy is contested, an objection is under review, or unlawful processing is alleged, and tell the data subject before lifting a restriction imposed because processing was unlawful.
• Erase a data subject's personal data on request where it is no longer necessary, consent has been withdrawn, they object, or it was unlawfully processed, and tell any third party you disclosed it to, or posted it publicly, that erasure was requested.
• Before or when collecting personal data, tell the data subject your identity and contact details, the purposes and recipients, whether provision is mandatory, their rights including to withdraw consent, access, rectify, restrict, erase, object and appeal, the retention period, and the existence and consequences of any automated decision making.

Cabinet Decision of 20 April 2023 (Ministry of ICT and Innovation)