KenyaData Protection Act, 2019, automated individual decision making
Data Protection Act, 2019 (No. 24 of 2019), s. 35 (automated individual decision making)
In force since .
A data subject rights rule binding public and private bodies.
As of .
What it requires
- Notify a data subject in writing when a decision about them is based solely on automated processing, including profiling, that produces a legal or similarly significant effect, and allow them to request reconsideration or a new decision that is not based solely on automated processing.
What this law does
Section 35 gives every data subject a right not to be subject to a decision based solely on automated processing, including profiling, that produces a legal effect or significantly affects them, unless the decision is necessary for a contract with them, authorized by a law with safeguards, or based on their consent.
Where such a decision is made, the controller must notify the data subject in writing as soon as reasonably practicable, and the data subject may then request reconsideration or a new decision not based solely on automated processing. The controller must act on that request within a reasonable time and answer in writing with the steps taken and the outcome. The Cabinet Secretary may make Regulations providing further safeguards for these decisions.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.