UgandaData Protection and Privacy Act, 2019, automated decisions
Data Protection and Privacy Act, 2019, s. 27 (automated individual decisions)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://ulii.org/en/akn/ug/act/2019/9/eng@2019-05-03In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Do not base a decision that significantly affects a data subject solely on automated processing where they have given written notice against it, and where such a decision is made, notify the data subject and reconsider it within twenty-one days of their written request.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 3.3Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.
- NIST Privacy Framework
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Section 27 lets a data subject require that a significant decision not rest solely on automated processing, and requires notice of such a decision and a written answer within twenty-one days. Those are communications to the data subject; the section names no log, record or proof, and gives the Authority only a complaint-handling role (subsections 5 and 6). No scope clause.
- Kind
- None
- As of
What this law does
Section 27 lets a data subject require in writing that a data controller not base a decision significantly affecting them solely on the processing of their personal data by automatic means.
Where a controller does base such a decision solely on automated processing, it must tell the data subject that fact as soon as reasonably practicable, and the data subject can require reconsideration within twenty-one days, with the controller answering in writing within a further twenty-one days of that request. The section does not apply to a decision made in considering, entering into or performing a contract with the data subject, or for a purpose a law authorises or requires.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .