RussiaFederal Law No. 152-FZ, Article 16, Decisions Based Solely on Automated Processing
Federal Law No. 152-FZ, Art. 16
In force since .
A data subject rights rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- Yes
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Do not make a decision that produces legal consequences for a Russian data subject, or otherwise affects their rights and legitimate interests, solely on the basis of automated processing of their personal data, unless they consented in writing or a federal law that protects their rights provides for it.NIST Privacy FrameworkCT.PO-P1
- Explain to the data subject how such a decision is made and its possible legal consequences, let them object and explain how they can protect their rights, and consider an objection within thirty days and tell them the result.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
Roskomnadzor (Federal Service for Supervision of Communications, Information Technology and Mass Media), which investigates and refers KoAP RF Article 13.11 administrative-offense cases for a court to fine; a data subject may also sue directly in civil court under Federal Law No. 152-FZ Article 17(2).
Settledness
- As of
- Open questions
- Which operator decisions count as "иным образом затрагивающих его права и законные интересы" (otherwise affecting the data subject's rights and legitimate interests) under Article 16(1) when an automated system scores or ranks a person but a human then signs the outcome?
What record it asks for
Logging duty
Article 16 bans decisions with legal effect based solely on automated processing unless the data subject gave written consent or a federal law allows them. The operator must explain the decision procedure and its legal consequences, allow an objection, and answer the objection within thirty days (parts 3 and 4). These are duties to inform and respond; the Article names no log of the automated decisions, no retention period and no inspector.
- Kind
- None
- As of
What this law does
Article 16 bars a decision that produces legal consequences for a data subject, or otherwise affects their rights and legitimate interests, from being made solely on the basis of automated processing of their personal data. Such a decision may be made only with the data subject's written consent or where a federal law that also protects their rights provides for it.
The operator must explain to the data subject how the decision is made and its possible legal consequences, give them a chance to object, and explain how they can protect their rights. The operator must consider an objection within thirty days of receiving it and tell the data subject the result.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .