Bosnia and HerzegovinaLaw on the Protection of Personal Data of Bosnia and Herzegovina, automated decisions
Law on the Protection of Personal Data, art. 24 (automated individual decisions)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Give a person a right to obtain human intervention and express their view against a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, under Article 24.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- NIST Privacy Framework
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Article 24 gives a person the right not to be subject to a decision based solely on automated processing, lists the exceptions, and in the contract and consent cases requires safeguards (human participation, the right to express a view and to contest). It does not require the controller to log or document the decision.
- Kind
- None
- As of
What this law does
Article 24(1) gives a person the right not to be subject to a decision based solely on automated processing, including profiling, that produces a legal effect concerning them or similarly significantly affects them. Paragraph 2 lists exceptions, including where the decision is necessary for a contract with the person or is based on their explicit consent.
Paragraph 3 requires the controller, in the contract and consent cases, to take appropriate measures to safeguard the person's rights and legitimate interests, including at least the right to participate in the decision-making, express their point of view, and contest the decision.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .