EthiopiaPersonal Data Protection Proclamation, automated decisions
Proclamation No. 1321/2024, art. 31 (automated individual decision-making)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Give a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or significantly affects them.
- Do not base an automated evaluation of personal aspects relating to an individual on sensitive personal data, and where an automated decision rests on a contract with the data subject or their explicit consent, put suitable measures in place to safeguard the data subject's rights, freedoms and legitimate interests.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- NIST Privacy Framework
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Article 31 gives the right not to be subject to a decision based solely on automated processing, lists the exceptions, bars automated evaluation based on sensitive personal data and requires suitable safeguards. It names no log of automated decisions, no record of the logic or of human intervention, and no audit.
- Kind
- None
- As of
What this law does
Article 31(1) gives every data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or significantly affects them, the right to obtain human intervention from the data controller, and the right to express their views on the matter.
Article 31(2) lifts that right where the decision is necessary for a contract with the data subject, is authorized by a law that lays down suitable safeguards, or is based on the data subject's explicit consent. Article 31(3) bars an automated evaluation of personal aspects relating to an individual from being based on sensitive personal data.
Where a decision rests on a contract or on explicit consent, article 31(5) requires the controller to put suitable measures in place to safeguard the data subject's rights, freedoms and legitimate interests.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .