DjiboutiDigital Code, Book I: automated individual decision-making
Code Numérique, Livre Premier, Art. 65 (décisions individuelles automatisées)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Do not base a decision that produces legal effects on a person, or significantly affects them, solely on automated processing of their personal data, including profiling, unless a statutory or consent-based exception applies with human-intervention, expression and contestation safeguards.NIST Privacy FrameworkCT.DM-P10
- Disclose to a data subject, on request, the logic underlying an automated decision taken about them under Article 65 and the significance and expected consequences of that processing.NIST Privacy FrameworkCM.AW-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.
- MEASURE 3.3Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.
- NIST Privacy Framework
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 65 bars a decision with legal or similarly significant effect from resting solely on automated processing, with exceptions that carry safeguards: human intervention, the chance to state a view and to contest the decision, and, on the data subject's request, a statement of the rules defining the processing and its main features. Those are rights of the person affected and a duty to explain the processing on request; the article does not require the controller to make or keep a log or record of decisions, and it names no inspection of one. The scope clause in Article 4 is not cited by this row, so the row names no territorial hook.
- Kind
- None
- As of
What this law does
Article 65 bars a decision producing legal effects on a person, or significantly affecting them, from resting solely on automated processing of their personal data, including profiling, unless the decision is authorised by law with appropriate safeguards, or rests on explicit consent or contract performance together with the right to human intervention, to express a point of view, and to contest the decision.
The controller must also disclose, on request, the logic underlying the automated decision and the significance and expected consequences of that processing for the data subject. The Digital Code, including Book I, was adopted by the National Assembly on and signed by the President of the Republic on . The Digital Code states no day of entry into force.
Under Article 1 of the Civil Code (Loi n° 003/AN/18/8ème L), a law comes into force on the day it fixes or, failing that, on the day after its publication in the Journal Officiel, publication meaning the earliest publication, whether by the National Printing Office (Imprimerie Nationale) or by electronic means. The Digital Code appears in edition n° 04 of the Journal Officiel dated .
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .