AngolaLaw on the Protection of Personal Data, automated decisions
Lei n.º 22/11, de 17 de Junho de 2011, art. 29 (automated individual decisions)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Do not base a decision that produces legal effects on, or significantly affects, a person solely on automated processing evaluating personal aspects such as their professional capacity, creditworthiness, trustworthiness or conduct, unless it occurs in performing a contract at the data subject's request with safeguards for their legitimate interests, or the APD has authorised it with safeguards.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- NIST Privacy Framework
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Article 29 gives a person the right not to be subject to a decision based solely on automated processing that assesses aspects of their personality, with contract and authorization exceptions. It requires no log or record of the decision and names no audit.
- Kind
- None
- As of
What this law does
Article 29 gives every person the right not to be subject to a decision that produces legal effects on them or significantly affects them, taken solely on automated processing of data intended to evaluate personal aspects of their character, in particular their professional capacity, creditworthiness, trustworthiness or conduct.
Paragraph 2 allows such a decision where it is taken in forming or performing a contract at the data subject's own request and adequate measures safeguard their legitimate interests, including a right of representation and expression. Paragraph 3 also allows it where the Agência de Protecção de Dados has authorized it, defining measures that safeguard the data subject's legitimate interests.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .