Burkina FasoPersonal Data Protection Law, automated decisions
Loi n°001-2021/AN, arts. 15, 19, 31 (automated individual decisions)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Do not base an administrative or private decision assessing a person's behavior solely on automated processing that produces a profile or personality assessment of them.NIST Privacy FrameworkCT.DM-P10
- Where the processing relies on artificial intelligence, disclose to the data subject the criteria and the nature of the personal data behind the automated decision, from the moment you collect it.NIST Privacy FrameworkCM.AW-P1
- Obtain a CIL authorization before using an automated decision-support tool that profiles a person or relies on artificial intelligence techniques for predictive purposes in an administrative or private decision.NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Article 15 bars an administrative or private decision resting solely on automated profiling, Article 19 gives a right to know and contest the reasoning and requires the criteria behind artificial-intelligence processing to be disclosed from collection, and Article 31 requires a CIL authorization for decision-support tools. These are disclosure and authorization duties. None asks the controller to keep a log or record, and the cited articles carry no territorial clause.
- Kind
- None
- As of
What this law does
Article 15 bars an administrative or private decision that assesses a person's behavior from resting solely on automated processing that produces a profile or personality assessment of them. A parallel sentence restricts a court decision the same way, but that clause binds only courts.
Article 19 requires that, where the processing relies on artificial intelligence, the controller disclose to the data subject the criteria and the nature of the personal data behind the automated decision, from the moment of collection. Article 31 requires the CIL's prior authorization before deploying a decision-support tool that assesses human behavior, profiles a person, or relies on artificial-intelligence techniques for predictive purposes in an administrative or private decision.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .