TanzaniaPersonal Data Protection Act, 2022, automated decision making
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- When a data subject requires it, ensure that a decision significantly affecting them is not based solely on automatic processing; where such a decision is made, notify them as soon as practicable and reconsider it if they ask, unless the decision is necessary for a contract with them, authorised by written law, or based on their explicit consent.NIST Privacy FrameworkCT.PO-P3
- Tell a data subject the logic involved where automatic evaluation of matters relating to them is, or is likely to be, the sole basis of a decision significantly affecting them.NIST Privacy FrameworkCM.AW-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 63(1) makes any contravention of a provision of the Act an offence and, where no penalty is specifically provided, punishes it on conviction with a fine of not less than 100,000 shillings and not more than 5,000,000 shillings, or imprisonment of up to five years, or both.
Penalty structure
Section 47 states the maximum penalty the Commission may impose in a penalty notice for a contravention of the Act as one hundred million shillings. The Commission may issue a penalty notice under section 46 where an enforcement notice served under section 45 is not complied with.
- Rule
- Fixed only
- As of
- Currency
- TZS
- Fixed cap
- 100,000,000
Who enforces it
Enforcement body
Personal Data Protection Commission (PDPC)
Settledness
- As of
- Open questions
- Which decisions "significantly affect" a data subject under section 36(1), the term that decides whether the section 36 rights and the controller's duty to notify and reconsider apply, when the Act does not define it?
What record it asks for
Logging duty
Section 36 requires a controller to notify the data subject that a decision was taken solely by automated processing and to reconsider it on request, and section 33(1)(c) entitles the data subject to be told the logic involved. Neither requires the controller to make, keep or produce a log or record of the decision.
- Kind
- None
- As of
What this law does
Section 36 lets a data subject require a controller to ensure that a decision significantly affecting them is not based solely on automatic processing. Where such a decision is made, the controller must notify the data subject as soon as practicable, and the data subject may require the controller to reconsider it. The section does not apply to a decision necessary for a contract with the data subject, authorised by written law, or based on their explicit consent.
Section 33(1)(c) entitles a data subject to be told the logic involved where automatic evaluation of matters relating to them is the sole basis of a decision significantly affecting them.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .