MauritiusData Protection Act 2017, automated individual decision making
Data Protection Act 2017 (Act No. 20 of 2017), s. 38 (automated individual decision making)
In force since .
A data subject rights rule binding public and private bodies.
As of .
What it requires
- Do not base a decision producing a legal or similarly significant effect on a data subject solely on automated processing, including profiling, unless a listed exception (contractual necessity, a safeguarded legal authorisation, or the data subject's explicit consent) applies.
- Do not base automated processing intended to evaluate personal aspects of an individual on special categories of personal data.
What this law does
Section 38 gives every data subject a right not to be subject to a decision based solely on automated processing, including profiling, that produces a legal effect or significantly affects them, unless the decision is necessary for a contract with them, is authorized by a law with safeguards, or rests on their explicit consent. Any automated processing intended to evaluate personal aspects of an individual must not be based on special categories of personal data.
Where one of the three exceptions applies, the controller's information notice under section 23 must disclose that this kind of decision-making exists and what effects it is expected to have. Where the exception is the contract or the consent ground specifically, the controller must also implement suitable measures to safeguard the data subject's rights, freedoms and legitimate interests.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.