CambodiaCambodia's Draft Law on Personal Data Protection, automated decisions
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://data.opendevelopmentcambodia.net/en/dataset/792fc94d-1a84-49cc-bad3-9b420f99b70f/resource/03e9c060-9bc8-42d5-80a6-8db777f61d1c/downl…A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Give a data subject the right to request human involvement where an automated decision, including profiling, produces a legal effect or similarly affects them, unless the decision is necessary to perform a contract, is authorized by specific legal provisions, or rests on the data subject's own explicit consent.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- NIST Privacy Framework
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Article 34 of the draft gives a data subject the right to request human involvement where an automated decision has legal effects or similarly affects them, lists three cases where the right does not apply (contract, specific legal provision, explicit consent), and in the contract and consent cases requires the controller to implement measures to protect the data subject, including the right to human intervention and to express views or object. It names no log, record or audit of automated decisions. The row is a draft (Final Version, ). English: a right to request human involvement in an automated decision.
- Kind
- None
- As of
What this law does
Cambodia's Draft Law on Personal Data Protection is a ministry draft; the Ministry of Post and Telecommunications confirmed on that the draft remained at a pre-legislative validation-workshop stage.
If enacted as drafted, article 34 would give a data subject the right to request human involvement where an automated decision produces a legal effect that impacts their legitimate interests or similarly affects them, unless the decision is necessary to perform a contract, is authorized by specific legal provisions, or rests on the data subject's own explicit consent.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .