LexLint

Know the law your code answers to.

Law / Frameworks / NIST Privacy Framework / Communicate-P

NIST Privacy Framework, Communicate-PCM.AW-P3

System/product/service design enables data processing visibility.NIST Privacy Framework, version 1.0, January 2020, CM.AW-P3

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Corpus as of .

10
laws
10
places
0
with court rulings behind them
2
not yet in force

A law in force is unmarked; the rest wear their state: not yet in force

  • Benin
  • Brazil
  • Burkina Faso
  • Central African Republic
  • Colombia
  • Djibouti
  • Minnesota
  • Tanzania
  • Utah
  • Vermont

Data subject rights

10 laws, 10 places
PlaceLawWhat it asks, as read here
Benin Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, automated decisions

Do not base a decision that produces legal effects for a person, or otherwise significantly affects them, solely on automated processing, including profiling, and disclose the underlying logic and the significance and consequences of such processing when the person asks.
Brazil LGPD, review of automated decisions

Provide, on request, clear and adequate information about the criteria and procedures used for an automated decision, subject to trade and industrial secrecy.
Burkina Faso Personal Data Protection Law, rights of the data subject

Tell a data subject, on request, the information and reasoning behind a decision, automated or not, applied against them.
Central African Republic Loi n° 24.001 portant protection des données à caractère personnel, droits liés au traitement

On request, give a person access to their data and to information about how any automated decision producing legal effects for them was reached, so they can understand and contest it.
Colombia SIC Circular on AI, Data Subject Rights

Let a data subject obtain, at any time and without restriction, information about how an artificial intelligence system is processing their personal data.
Djibouti Digital Code, Book I: automated individual decision-making

Disclose to a data subject, on request, the logic underlying an automated decision taken about them under Article 65 and the significance and expected consequences of that processing.
Minnesota Minnesota Consumer Data Privacy Act, consumer rights and profiling

Offer a Minnesota consumer the right to opt out of automated profiling in furtherance of decisions with legal or similarly significant effects, question the result, receive an explanation, and have the decision reevaluated if based on inaccurate data.
Tanzania Personal Data Protection Act, 2022, automated decision making

Tell a data subject the logic involved where automatic evaluation of matters relating to them is, or is likely to be, the sole basis of a decision significantly affecting them.
Utah Motor Vehicle Data Privacy from , in 3 months

As a motor vehicle manufacturer selling or leasing vehicles in Utah, once in effect, provide in-vehicle privacy controls letting a consumer view what personal data categories the vehicle collects and shares, opt out of sale or targeted-advertising processing, and delete readily accessible data stored locally on the vehicle.
Vermont Vermont Data Privacy and Online Surveillance Act, consumer rights from , in 15 months

Once in force, give a Vermont consumer access, correction, deletion, portability, opt-out of targeted advertising and sale, a profiling explanation and reevaluation right for housing decisions, and a list of third parties their data was sold to.

Full text of the NIST Privacy Framework, public domain (a US government work). Every control of the framework.