GhanaData Protection Act, 2012, automated decision-taking
Data Protection Act, 2012 (Act 843), s. 41 (automated decision-taking)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://nita.gov.gh/wp-content/uploads/2017/12/Data-Protection-Act-2012-Act-843.pdfIn force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Give a data subject the right to demand that a decision significantly affecting them is not based solely on automated processing of their personal data, and notify them as soon as reasonably practicable when such a decision is taken without a prior notice.
- Where a data subject, within twenty-one days after you notify them of a solely automated decision, requires you in writing to reconsider it, reconsider the decision and, within twenty-one days after receiving their notice, tell them in writing what steps you intend to take to comply.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 3.3Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Section 41 gives an individual the right to require that a significant decision not rest solely on automatic processing, requires the controller to notify the individual when such a decision was taken, and requires a written reply within twenty-one days of a notice. It names no log, record of the decision or retention period. Section 35(1)(d), on the logic behind a decision, is a disclosure duty in another section.
- Kind
- None
- As of
What this law does
Section 41 entitles an individual, by written notice to a data controller, to require that any decision significantly affecting them is not based solely on the automatic processing of their personal data.
Even without a prior notice, if a controller does base such a significant decision solely on automated processing, it must notify the individual as soon as reasonably practicable, and the individual may then require the controller to reconsider the decision within twenty-one days of that notification. The controller must then answer in writing, within twenty-one days after receiving the individual's notice, what steps it intends to take to comply.
The right does not apply to a decision made in the course of considering or performing a contract with the data subject, one authorized or required by an enactment, or other circumstances the Minister prescribes.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .