North MacedoniaLaw on Personal Data Protection (LPDP), automated individual decision-making
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Give a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, under Article 26.
- Where a decision based solely on automated processing rests on a contract with the data subject or their explicit consent, implement suitable measures to safeguard their rights, freedoms and legitimate interests, at a minimum human intervention by the controller, the chance to express a personal view and the right to contest the decision, under Article 26, paragraph 3.
- Do not base such a decision on special categories of personal data unless Article 13, paragraph 2, point 1 or 7 applies and suitable safeguards are in place, under Article 26, paragraph 4.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- NIST Privacy Framework
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Article 26 gives the right not to be subject to a solely automated decision, sets the exceptions and requires safeguards (human intervention, the right to express a view and to contest). It states no duty to create, keep or produce a log or record of the decision.
- Kind
- None
- As of
What this law does
Article 26, paragraph 1 gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them. The right does not apply to a decision that is necessary for a contract between the data subject and the controller, that a law applying to the controller authorizes with suitable safeguards, or that rests on the data subject's explicit consent.
In the contract and consent cases the controller must implement suitable measures to safeguard the data subject's rights, freedoms and legitimate interests, at a minimum the right to human intervention by the controller, the right to express a personal view and the right to contest the decision. Article 26, paragraph 4 bars basing those decisions on special categories of personal data unless Article 13, paragraph 2, point 1 or 7 applies and suitable safeguards are in place.
Chapter III, which carries Article 26, applies until North Macedonia's accession to the European Union, when it ceases to apply under Article 122 as amended.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .