MonacoLoi n. 1.565 du 3 décembre 2024, automated decisions
Loi n. 1.565 du 3 decembre 2024, art. 19 (automated individual decisions)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Do not base a decision that produces legal effects for a person or significantly affects them solely on automated processing, including profiling, unless a listed exception applies, and where it does, guarantee at least the right to obtain human intervention, express a view, and contest the decision.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 3.3Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.
- NIST Privacy Framework
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Article 19 gives a person the right not to be subject to a decision based solely on automated processing, including profiling, with exceptions for contract, authorizing law and explicit consent, and requires the controller to implement measures for human intervention, expressing a view and contesting the decision. It is a safeguard on decisions and requires no log or record to be made, kept or produced. No scope clause is cited.
- Kind
- None
- As of
What this law does
Article 19 gives a person the right not to be subject to a decision that produces legal effects for them or significantly affects them, where that decision rests solely on automated processing, including profiling.
A person can still be subject to such a decision where it is necessary to enter into or perform a contract at their request, where a law or regulation authorizes it with safeguards for the person's rights and legitimate interests, where they gave explicit consent, or, for sensitive data, where they gave explicit consent or the decision serves an important public interest with appropriate and specific safeguards.
In each of those cases the controller must still implement measures letting the person obtain human intervention, express their point of view, and contest the decision.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .