KenyaData Protection Act, 2019, automated individual decision making
Data Protection Act, 2019 (No. 24 of 2019), s. 35 (automated individual decision making)
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Notify a data subject in writing when a decision about them is based solely on automated processing, including profiling, that produces a legal or similarly significant effect, and allow them to request reconsideration or a new decision that is not based solely on automated processing.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Section 35 requires the controller to notify the data subject in writing of a solely automated decision, to consider a request for reconsideration and to tell the data subject the steps taken and the outcome. It names no log of automated decisions and no record to be kept.
- Kind
- None
- As of
What this law does
Section 35 gives every data subject a right not to be subject to a decision based solely on automated processing, including profiling, that produces a legal effect or significantly affects them, unless the decision is necessary for a contract with them, authorized by a law with safeguards, or based on their consent.
Where such a decision is made, the controller must notify the data subject in writing as soon as reasonably practicable, and the data subject may then request reconsideration or a new decision not based solely on automated processing. The controller must act on that request within a reasonable time and answer in writing with the steps taken and the outcome. The Cabinet Secretary may make Regulations providing further safeguards for these decisions.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .