RwandaLaw N° 58/2021, automated decisions
Law N° 58/2021, art. 21 (automated individual decisions)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Do not subject a data subject to a decision based solely on automated processing, including profiling, that produces legal or other significant consequences for them, unless their explicit consent, contract necessity, or an authorising law with safeguards applies.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- NIST Privacy Framework
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Article 21 gives the data subject a right not to be subject to a solely automated decision and lists the exceptions (explicit consent, contract, authorising law with safeguards). It names no log, record, explanation record or period, and imposes no duty to demonstrate or produce anything. The logging and record duties are in Articles 16 and 17, which this row does not cite.
- Kind
- None
- As of
What this law does
Article 21 gives the data subject the right not to be subject to a decision based solely on automated personal data processing, including profiling, that may produce legal or other significant consequences for them. That right does not apply where the decision rests on the data subject's explicit consent, is necessary to enter into or perform a contract, or is authorised by a law that also puts in place suitable measures to safeguard the data subject's rights, freedoms and legitimate interests.
Automated processing intended to evaluate personal aspects of a natural person must not rest on sensitive personal data unless a ground listed in Article 10 applies.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .