ZambiaData Protection Act, 2021, automated decisions
Data Protection Act, 2021, s. 62 (automated individual decisions)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
As of .
What it requires
- Do not subject a data subject to a decision based solely on automated processing that has legal or similarly significant effects without human intervention.
- Where an automated decision rests on a contract, a written law or explicit consent, put suitable safeguards in place, including the right to obtain human intervention, to put a point of view and to contest the decision, and do not process sensitive personal data automatically at all unless the data subject expressly consented, the processing is in the public interest, or a written law permits it with safeguards.
What this law does
Section 62 bars subjecting a data subject to a decision based solely on automated processing, including profiling, that produces legal effects on them or similarly affects them, unless the decision is necessary for entering into or performing a contract, authorised by a written law, or based on the data subject's explicit consent.
Where one of those grounds applies, the controller must put suitable safeguards in place, including the data subject's right to obtain human intervention to express their point of view and contest the decision. Automated processing of sensitive personal data is barred outright unless the data subject has expressly consented, the processing is in the public interest, or a written law permits it with the same safeguards in place.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.