MoldovaMoldova Law No. 195/2024, automated decisions
Legea Nr. 195 din 25 iulie 2024, articolul 22 (automated individual decisions)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Do not subject a person to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, and where a carve-out applies, give them human intervention, a chance to express their point of view and a way to contest the decision.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 3.3Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.
- NIST Privacy Framework
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Article 22 gives the data subject a right not to be subject to a decision based solely on automated processing, with exceptions for contract, authorising law and explicit consent. Article 22(3) requires safeguards, at least human intervention, the chance to state a view and the right to contest the decision. It states no duty to create, keep or produce a log or record of the decision. The record duties of Articles 7(1), 30 and 33(5) sit outside the cited article. Article 3, the territorial scope clause, is not cited by this row, so no hook is recorded.
- Kind
- None
- As of
What this law does
Article 22(1) gives the data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them. Paragraph 2 lists exceptions, including where the decision is necessary for a contract with the data subject.
Where a carve-out applies, the controller must implement suitable measures to safeguard the data subject's rights, freedoms and legitimate interests, including at least the right to obtain human intervention, express a point of view, and contest the decision.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .