LexLint.ioBeta

Know the law your code answers to.

Law / Barbados

Data Protection Act, 2019, automated decisions

Data Protection Act, 2019, s. 18 (automated individual decision-making, including profiling)

In force since .

A data subject rights rule binding public and private bodies.

Obligation class
Data subject rights
Audit expectation
none

What it requires

  • Honour a data subject's right to object to automated decision-making.NIST Privacy FrameworkCT.PO-P3
  • Where an automated decision rests on a contract with the data subject or on their consent, implement suitable measures to safeguard their rights, freedoms and legitimate interests, and do not extend the exception to sensitive personal data unless the processing is in the public interest and those measures are in place.NIST Privacy FrameworkCT.DM-P10

These lines are LexLint's reading of the law's text.

In the frameworks

NIST AI RMF
  • MEASURE 3.3Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.
NIST Privacy Framework
  • CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
  • CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
FINOS AIGF

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What record it asks for

Logging duty

Section 18 gives a person the right not to be subject to a decision based solely on automated processing, lists the exceptions, and in the contract and consent cases requires suitable safeguards. It does not require the controller to log or document the decision.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Section 18(1) gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them. Section 18(2) excepts a decision necessary for entering into or performing a contract with the data subject, one authorised by an enactment that lays down suitable safeguards, or one based on the data subject's consent.

Where the contract or consent exception is relied on, section 18(3) requires the controller to implement suitable measures to safeguard the data subject's rights, freedoms and legitimate interests, and section 18(4) bars the exceptions from reaching sensitive personal data unless the processing is in the public interest and those safeguards are in place.

When LexLint raises it

When your app profile says your app makes high-risk automated decisions.

Back to the example  ·  Lint your app

Page updated .