LexLint.ioBeta

Know the law your code answers to.

Law / Vanuatu

Data Protection and Privacy Act 2024, automated decisions

Data Protection and Privacy Act No. 13 of 2024, s. 13 (data subject's right not to be subject to automated decision making)

In force since .

A data subject rights rule binding public and private bodies.

Obligation class
Data subject rights
Audit expectation
none

What it requires

  • Do not subject a data subject to a decision based solely on automated processing, including profiling.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST AI RMF
  • MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
NIST Privacy Framework
  • CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.

Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law

What record it asks for

Logging duty

Section 13 bars a decision based solely on automated processing without the data subject's views being taken into account, with exceptions that carry a duty to adopt safeguarding measures and offer human intervention. It requires no log, record of the decision, retention period or audit.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Section 13(1) gives a data subject the right to ensure that, on their request, they are not subject to a decision significantly affecting them based solely on automated processing of personal data, including profiling, without their views having been taken into consideration.

Section 13(3) excepts a decision authorized by a law to which the controller is subject, one necessary for entering into or performing a contract with the data subject, or one based on the data subject's consent where appropriate guarantees are in place, and where the contract or consent exception applies, section 13(4) requires the controller to implement suitable safeguarding measures and let the data subject obtain human intervention.

Section 13(5) adds a further condition, public interest and a legal requirement, where the automated decision rests on special categories of personal data or the personal data of a child or a vulnerable individual.

When LexLint raises it

When your app profile says your app makes high-risk automated decisions.

Back to the example  ·  Lint your app

Page updated .