UruguayLey N° 18.331, automated decisions
Ley N° 18.331, art. 16, según Ley N° 18.719, de 2010 (automated individual decisions)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Let a data subject challenge, and obtain the valuation criteria and the program behind, any administrative act or private decision based solely on automated processing of their personal data that offers an assessment of their character or personality.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.
- MEASURE 3.3Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.
- NIST Privacy Framework
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Article 16 gives a right not to be subject to a decision based solely on automated processing and, where one is made, a right to obtain information from the controller on the criteria of evaluation and the program used. That is a right to information on the decision logic and sets no duty to keep a log of decisions, inputs or outputs. The article names no audit and no body entitled to a record. No territorial clause sits in the cited article.
- Kind
- None
- As of
What this law does
Article 16, in the wording given by Ley N° 18.719 of 2010, gives a person the right not to be subjected to a decision with legal effects that significantly affects them, based on automated processing intended to assess aspects of their personality such as work performance, creditworthiness, reliability or conduct.
It lets the affected person challenge an administrative act or a private decision that assesses their conduct where personal-data processing offering a definition of their characteristics or personality is its sole basis, and in that case gives them the right to obtain from the database controller both the assessment criteria and the program used in the processing behind the decision.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .