EswatiniData Protection Act, 2022, automated decisions
Data Protection Act, 2022, s. 45 (automated individual decisions)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Do not base a decision that has a legal effect on a person, or that significantly affects them, solely on automated processing of their personal information intended to profile their personality or habits, except where taken under a contract at their request or under a law, code or scientific standard with safeguards in place.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- NIST Privacy Framework
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Section 45 bars a decision with legal or significant effect based solely on automated profiling, with exceptions for a contract the data subject requested, appropriate protective measures such as giving the data subject sufficient information about the decision and a chance to make representations, and a law or code that specifies protective measures. It does not require a controller to make, keep or produce a log or record of the decision, names no audit, and sets no period. Section 45 carries no territorial clause, so the hook is empty.
- Kind
- None
- As of
What this law does
Section 45(1) bars subjecting a person to a decision that has a legal effect on them, or significantly affects them, when the decision is based solely on the automated processing of their personal information to profile their personality or habits.
The bar does not apply where the decision is taken in connection with entering into or performing a contract and either the data subject's request under that contract has been met or appropriate measures let the data subject learn about the decision and make representations on it, or where the decision is governed by a law, code or body of scientific proof or facts specifying the same protective measures.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .