BotswanaData Protection Act, 2024, automated decisions
Data Protection Act, 2024 (Act No. 18 of 2024), s. 49 (automated individual decisions)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Do not base a decision that produces legal effects concerning a person, or significantly affects them, solely on automated processing, including profiling, unless a listed exception applies, and where one does, let the person obtain human intervention, express their point of view, and contest the decision.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 3.3Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.
- NIST Privacy Framework
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Section 49 gives a right not to be subject to a decision based solely on automated processing and, where the contract or consent exception applies, requires suitable safeguards including human intervention, a chance to state a view and a right to contest. It names no log, register or record of the automated decision to be kept or produced. The section states no territorial scope clause.
- Kind
- None
- As of
What this law does
Section 49 gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or significantly affects them. The right does not apply where the decision is necessary for entering into or performing a contract, is based on the data subject's explicit consent, or is authorized by a law.
Where the decision rests on the contract or consent exception, the data controller must implement suitable safeguards, including letting the data subject obtain human intervention, express their point of view, and contest the decision.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .