FranceLoi 78-17 Article 47, Automated Administrative Decisions
Loi n. 78-17 du 6 janvier 1978, Art. 47
In force since .
A data subject rights rule binding government bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, User location, Place of effect
- Audit expectation
- none
What it requires
- If you are a French public-sector body that takes an individual administrative decision about a person solely by automated processing, keep control of the algorithmic processing and its changes so you can explain to the person, in detail and in a form they can follow, how it was applied to them, under Loi 78-17 Article 47.
These lines are LexLint's reading of the law's text. Also read by: Conseil constitutionnel, décision n° 2018-765 DC du 12 juin 2018, Loi relative à la protection des données personnelles (recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P3System/product/service design enables data processing visibility.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://www.conseil-constitutionnel.fr/decision/2018/2018765DC.htm
- Case citation
- Conseil constitutionnel, décision n° 2018-765 DC du 12 juin 2018, Loi relative à la protection des données personnelles
- Open questions
- Which algorithms are 'susceptibles de réviser eux-mêmes les règles qu'ils appliquent' and so barred as the sole basis of an individual administrative decision under Article 47 of the Loi, when a machine-learning model is retrained between decisions with the controller's validation?
What it makes you log
Who may demand the log
Data subject
What the log must hold
Decision basis
Logging duty
For an individual administrative decision taken solely by automated processing, the controller must keep control of the algorithm and its changes so that it can explain to the person how the processing was applied to them, which it can do only from a record of the version and rules applied.
- Kind
- Implicit
- As of
- Provision
- Loi n. 78-17, Art. 47, 2°
- Trigger
- automated_decisions
What this law does
Loi 78-17 Article 47 extends an automated-decision explicability duty specifically to French government decisions, beyond General Data Protection Regulation (GDPR) Article 22's own scope. Ordonnance 2018-1125 of amended the Loi Informatique et Libertés. It entered into force together with the decree amending decree 2005-1309, and at the latest on .
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .