South AfricaPOPIA, automated decisions
POPIA, s. 71 (automated individual decisions)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Do not base a decision that has legal or substantially similar consequences for a person solely on automated processing of their personal information, unless the person can make representations about the decision and you have explained the underlying logic of the processing to them.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.
- NIST Privacy Framework
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Section 71 bars a decision with legal or substantial effects that rests solely on automated processing, unless it falls under a contract or a law or code of conduct with appropriate measures. Those measures are an opportunity to make representations and enough information about the underlying logic of the processing (section 71(3)). They are disclosure to the data subject and ask for no log, record or retention.
- Kind
- None
- As of
What this law does
Section 71(1) bars subjecting a data subject to a decision that has legal consequences for them, or affects them to a substantial degree, when the decision is based solely on the automated processing of their personal information to profile them, including their work performance, creditworthiness, reliability, location, health, preferences or conduct.
Subsection (2) lifts the bar where the decision was taken in connection with concluding or executing a contract and the data subject's request was met or appropriate measures protect their interests, or where a law or code of conduct governs the decision with the same safeguards specified.
Those safeguards must let the data subject make representations about the decision, and require the responsible party to give them enough information about the automated processing's underlying logic to make those representations.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .