MongoliaLaw on Protection of Personal Data, decisions made without human involvement
Law on Protection of Personal Data (), Art. 18.2.6 (decisions made without human involvement)
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Explain to a Mongolian data subject a decision made by processing their data electronically without human involvement, and its consequences.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Article 18.2.6 requires the controller to explain to the data subject a decision reached by processing data electronically without human involvement and its consequences; it is a duty to explain and keeps no record of its own. Other paragraphs of Article 18 sit outside the cited paragraph and are not coded on this row: 18.2.12 (keep a record of collecting, processing and using data) and 18.2.13 (store the data obtained). Article 23 (an assessment, delivered to the National Human Rights Commission, before processing that way) is likewise not cited.
- Kind
- None
- As of
What this law does
Article 18.2.6 requires a controller to explain to the data subject a decision made as a result of processing their information electronically without human involvement, and the consequences that follow from it.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .