LesothoData Protection Act, 2011, automated decision making
Data Protection Act, 2011, s. 51 (automated decision making)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://lesotholii.org/akn/ls/act/2012/5/eng@2012-02-22In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Do not base a decision that has a legal effect on a person, or that significantly affects them, solely on automated processing of their personal information intended to profile their personality or habits, except where taken under a contract at their request or under a law with safeguards in place.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- NIST Privacy Framework
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Section 51 bars a decision with legal effect or significant effect that rests solely on automated profiling, except a decision taken in connection with a contract (where the request was met or measures let the data subject make representations) or one governed by a law or code with appropriate measures. It requires no log, register or record of automated decisions and names no check of one. The section has no scope clause of its own.
- Kind
- None
- As of
What this law does
Section 51 bars a decision that has a legal effect on a person, or that significantly affects them, from being based solely on automated processing of their personal information intended to profile their personality or habits. The bar does not apply to a decision taken in connection with a contract, where either the data subject's contractual request has been met or appropriate measures let the data subject make representations about the decision.
It also does not apply to a decision governed by a law or code that specifies appropriate measures protecting data subjects' legitimate interests.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .