SurinameDraft Law on the Protection of Privacy and Personal Data, automated decisions
Art. 11, lid 2 Wet Bescherming Privacy en Persoonsgegevens (automated individual decisions)
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Give a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects for them or otherwise significantly affects them, unless a listed exception applies, and never base such a decision on special categories of personal data unless a narrow exception applies with appropriate safeguards.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Article 11(2) gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that has legal effects or significantly affects the person, with three exceptions (contract, a national law with suitable safeguards, explicit consent with safeguards including human intervention). It sets no duty to log the decisions, to keep their grounds or to produce them to anyone. The text is a draft bill.
- Kind
- None
- As of
What this law does
Article 11, paragraph 2 would give a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects for them or otherwise significantly affects them, unless a listed exception applies. The bill would also bar such a decision from resting on special categories of personal data unless a narrow exception applies with appropriate safeguards.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .