KosovoLaw No. 06/L-082 on Protection of Personal Data, automated decisions
Law No. 06/L-082 on Protection of Personal Data, art. 21 (automated individual decisions)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Do not subject a data subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless a listed exception applies and you provide the required safeguards, including the right to obtain human intervention.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- NIST Privacy Framework
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Article 21 gives the data subject a right not to be subject to a decision based solely on automated processing and, where an exception applies, requires safeguards including human intervention, the chance to state a view and the right to contest. Those are safeguards, and the article names no record of the decision, its logic or the intervention. The impact assessment that Article 35(3)(1) requires for profiling decisions is in the main sibling row. The row imposes no log or record duty.
- Kind
- None
- As of
What this law does
Neni 21(1) gives the data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces effects concerning them or similarly affects them. Paragraph 2 lists exceptions under which that right does not apply. Paragraph 4 bars such a decision from resting on special categories of personal data, unless a narrow exception applies with appropriate safeguards for the data subject's rights, freedoms and legitimate interests.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .