South AfricaPOPIA, automated decisions
POPIA, s. 71 (automated individual decisions)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
As of .
What it requires
- Do not base a decision that has legal or substantially similar consequences for a person solely on automated processing of their personal information, unless the person can make representations about the decision and you have explained the underlying logic of the processing to them.
What this law does
Section 71(1) bars subjecting a data subject to a decision that has legal consequences for them, or affects them to a substantial degree, when the decision is based solely on the automated processing of their personal information to profile them, including their work performance, creditworthiness, reliability, location, health, preferences or conduct.
Subsection (2) lifts the bar where the decision was taken in connection with concluding or executing a contract and the data subject's request was met or appropriate measures protect their interests, or where a law or code of conduct governs the decision with the same safeguards specified.
Those safeguards must let the data subject make representations about the decision, and require the responsible party to give them enough information about the automated processing's underlying logic to make those representations.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.