TanzaniaPersonal Data Protection Act, 2022, automated decision making
In force since .
A data subject rights rule binding public and private bodies.
- Private right of action
- Yes
As of .
What it requires
- When a data subject requires it, ensure that a decision significantly affecting them is not based solely on automatic processing; where such a decision is made, notify them as soon as practicable and reconsider it if they ask, unless the decision is necessary for a contract with them, authorised by written law, or based on their explicit consent.
- Tell a data subject the logic involved where automatic evaluation of matters relating to them is, or is likely to be, the sole basis of a decision significantly affecting them.
What this law does
Section 36 lets a data subject require a controller to ensure that a decision significantly affecting them is not based solely on automatic processing. Where such a decision is made, the controller must notify the data subject as soon as practicable, and the data subject may require the controller to reconsider it. The section does not apply to a decision necessary for a contract with the data subject, authorised by written law, or based on their explicit consent.
Section 33(1)(c) entitles a data subject to be told the logic involved where automatic evaluation of matters relating to them is the sole basis of a decision significantly affecting them.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.