ZambiaData Protection Act, 2021, automated decisions
Data Protection Act, 2021, s. 62 (automated individual decisions)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Do not subject a data subject to a decision based solely on automated processing that has legal or similarly significant effects without human intervention.NIST Privacy FrameworkCT.DM-P10
- Where an automated decision rests on a contract, a written law or explicit consent, put suitable safeguards in place, including the right to obtain human intervention, to put a point of view and to contest the decision, and do not process sensitive personal data automatically at all unless the data subject expressly consented, the processing is in the public interest, or a written law permits it with safeguards.NIST Privacy FrameworkCT.DM-P10NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 3.3Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Section 62 bars a decision based solely on automated processing that has legal or similarly significant effects, subject to exceptions, and requires suitable safeguards including human intervention and the chance to contest. Those are safeguards, and the section names no record of the decision, its logic or the intervention. The row imposes no log or record duty.
- Kind
- None
- As of
What this law does
Section 62 bars subjecting a data subject to a decision based solely on automated processing, including profiling, that produces legal effects on them or similarly affects them, unless the decision is necessary for entering into or performing a contract, authorised by a written law, or based on the data subject's explicit consent.
Where one of those grounds applies, the controller must put suitable safeguards in place, including the data subject's right to obtain human intervention to express their point of view and contest the decision. Automated processing of sensitive personal data is barred outright unless the data subject has expressly consented, the processing is in the public interest, or a written law permits it with the same safeguards in place.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .