VanuatuData Protection and Privacy Act 2024, automated decisions
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
As of .
What it requires
- Do not subject a data subject to a decision based solely on automated processing, including profiling.
What this law does
Section 13(1) gives a data subject the right to ensure that, on their request, they are not subject to a decision significantly affecting them based solely on automated processing of personal data, including profiling, without their views having been taken into consideration.
Section 13(3) excepts a decision authorized by a law to which the controller is subject, one necessary for entering into or performing a contract with the data subject, or one based on the data subject's consent where appropriate guarantees are in place, and where the contract or consent exception applies, section 13(4) requires the controller to implement suitable safeguarding measures and let the data subject obtain human intervention.
Section 13(5) adds a further condition, public interest and a legal requirement, where the automated decision rests on special categories of personal data or the personal data of a child or a vulnerable individual.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.