SerbiaLaw on Personal Data Protection, automated decisions
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Do not base a decision producing legal effects or significantly affecting a person solely on automated processing, including profiling, unless it is necessary for a contract with them, authorized by law with adequate safeguards, or based on their explicit consent, and even then give them the right to obtain human intervention, express their view, and contest the decision.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 3.3Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.
- NIST Privacy Framework
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Article 38 gives the data subject the right not to be subject to a decision based solely on automated processing, with exceptions and safeguards. It states no duty to log, record or document the decision or its basis. The Article carries no scope clause of its own, so no territorial hook is read.
- Kind
- None
- As of
What this law does
Article 38 gives a person the right not to have a decision applied to them that is made solely on automated processing, including profiling, if that decision produces legal effects or significantly affects their position. That right does not apply where the decision is necessary for concluding or performing a contract with the person, is based on a law that prescribes adequate safeguards for the person's rights, freedoms and legitimate interests, or rests on the person's explicit consent.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .