Cabo VerdeLaw No. 133/V/2001 on the Protection of Personal Data, automated decisions authorized by the CNPD
Lei n.º 133/V/2001 de 22 de Janeiro, art. 23 (no. 3) as republished by Lei n.º 121/IX/2021, de 17 de Março (decisões automatizadas autorizadas pela CNPD)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
As of .
What it requires
- Where you rely on the CNPD's authorization to take a decision that produces legal effects on a person, or significantly affects them, solely on automated processing, take measures that guarantee the data subject's legitimate interests.
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What this law does
Article 23(3) permits a decision that produces legal effects concerning a person, or significantly affects them, taken solely on the basis of automated processing, when the CNPD authorizes it and measures guaranteeing the data subject's legitimate interests are taken. The law itself entered into force thirty days after its publication, following approval by the Assembleia Nacional on and enactment by the President on . The Law appears in the Boletim Oficial da República de Cabo Verde, I Série, n.º 2, of .
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.