Automated decision-making notice and review right
In force since .
A data subject rights rule binding private bodies.
- Audit expectation
- none
What it requires
- Before or at the time you communicate a decision based exclusively on automated processing of personal information, tell the person that the decision was made this way.NIST Privacy FrameworkCM.AW-P1
- On the person's request, disclose the personal information used to reach the decision, the reasons and the principal factors and parameters that led to it, and their right to have that personal information corrected.NIST Privacy FrameworkCT.PO-P3
- Give the person an opportunity to submit observations to a staff member who is in a position to review the automated decision.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Data subject
What the log must hold
Input reference, Decision basis
Logging duty
Section 12.1 makes an enterprise that renders a decision based exclusively on automated processing tell the person so, and, on the person's request, tell them the personal information used, the reasons and the principal factors and parameters that led to the decision, and the right to have the information corrected, and gives the person an opportunity to submit observations to a member of the personnel who can review the decision. The section names no log, but the enterprise can only give those particulars from a record of the inputs and the factors applied. No period, audit or regulator access is stated. The one-year retention of information used for a decision is in section 11, which this row does not cite, so it is not borrowed. The section binds any person carrying on an enterprise and states no territorial hook.
- Kind
- Implicit
- As of
- Provision
- CQLR c P-39.1, s. 12.1
- Trigger
- automated_decisions
What this law does
A person carrying on an enterprise who uses personal information to render a decision based exclusively on automated processing of that information must inform the person concerned of that fact no later than when the decision itself is communicated.
On request, the enterprise must also disclose the personal information used to render the decision, the reasons and the principal factors and parameters that led to it, and the person's right to have that personal information corrected, and must give the person an opportunity to submit observations to a staff member able to review the decision. This right was newly created by Law 25 and did not exist in the Act before .
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .