AndorraLQPD, automated decisions
Llei 29/2021, art. 25 (automated individual decisions)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Do not subject a data subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them, unless a listed exception applies and you provide the required safeguards, and never subject a minor to such a decision at all.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- NIST Privacy Framework
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Article 25 gives the right not to be subject to a solely automated decision with legal effect, lists the exceptions, and requires the controller to provide human intervention, the chance to state a view and the right to contest the decision where an exception applies (paragraph 4), and bars such a decision for a minor (paragraph 5). It asks for safeguards and does not require the controller to log, record or document the decisions or their basis.
- Kind
- None
- As of
What this law does
Article 25(1) gives any data subject the right not to be subject to a decision based solely on automated processing, including profiling, intended to evaluate aspects of their personality, that produces legal effects concerning them.
Where a listed exception in paragraph 2 applies, paragraph 4 requires the controller to adopt appropriate measures to protect the data subject's rights, freedoms and legitimate interests, including at least the right to obtain human intervention, express a point of view, and contest the decision. Paragraph 5 bars a minor from being subject to such a decision at all.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .