BrazilLGPD, review of automated decisions
Lei nº 13.709, de 2018 (LGPD), art. 20 (review of automated decisions)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Let a data subject request review of any decision made solely on automated processing of their personal data, including a decision that defines their personal, professional, consumer, or credit profile or an aspect of their personality.NIST Privacy FrameworkCT.DM-P10
- Provide, on request, clear and adequate information about the criteria and procedures used for an automated decision, subject to trade and industrial secrecy.NIST Privacy FrameworkCM.AW-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.
- MEASURE 3.3Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.
- NIST Privacy Framework
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
Paragraph 1 requires the controller to give, whenever asked, clear and adequate information on the criteria and procedures used for an automated decision. Paragraph 2 lets the national authority audit for discriminatory aspects of automated processing where the controller withholds that information as a trade secret. The Article names no log and no period; a controller can state the criteria and procedures, or open an audit, only from a record of them.
- Kind
- Implicit
- As of
- Provision
- Article 20, paragraphs 1 and 2
- Trigger
- automated_decisions
What this law does
Article 20, in the wording given by Lei nº 13.853, de 2019, gives a data subject the right to request review of a decision taken solely on automated processing of their personal data that affects their interests, including a decision defining their personal, professional, consumer, or credit profile or an aspect of their personality. The article's original 2018 text specified review by a natural person, and the 2019 amendment removed that qualifier, leaving only a right to request review.
Paragraph 1 requires the controller to provide, on request, clear and adequate information about the criteria and procedures used for the automated decision, subject to trade and industrial secrecy. Paragraph 2 lets the ANPD audit the processing for discriminatory effects where the controller withholds that information on a trade-secrecy basis.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .