ZimbabweCyber and Data Protection Regulations 2024, children's information and automated decisions
Statutory Instrument 155 of 2024, regulation 10 (children's information and automated decisions)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Age verification, DPIA, Prohibition
- Audit expectation
- periodic
- Who audits it
- Self
What it requires
- Obtain the consent of a parent or legal guardian before processing a child's personal information, and do not subject a child's data to automated decision-making that affects the child's rights.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.DM-P10
- Make reasonable efforts to verify that the consent to process a child's personal information was given or authorised by the parent or legal guardian, taking available technology into account.NIST Privacy FrameworkCT.PO-P1
- Conduct regular data protection impact assessments to identify and mitigate privacy risks to children, and ensure data protection by design and by default when processing children's data.NIST Privacy FrameworkID.RA-P4NIST Privacy FrameworkGV.PO-P2
- Do not subject any data subject to a decision based solely on automated processing which produces legal effects concerning them, without their consent or a provision established by law.NIST Privacy FrameworkCT.DM-P10
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
What the log must hold
Decision basis
Logging duty
Regulation 10(5)(d) requires a controller processing children's data to conduct regular data protection impact assessments to identify and mitigate privacy risks to children, an assessment that leaves a record of the grounds for the processing. The regulation sets no interval, no content, no retention period and no recipient for the assessment. The parental consent in regulation 10(5)(a) and the verification effort in 10(5)(b) are conditions of processing that state no record, the notice to the Authority of processing activities in 10(2) is a filing, and the bar on solely automated decisions in 10(3) and 10(5)(f) is a prohibition. The regulation names no territorial hook.
- Kind
- Implicit
- As of
- Provision
- Regulation 10(5)(d) (regular data protection impact assessments for children's data)
- Trigger
- personal_data_processing
What this law does
Regulation 10(5)(a) bars a data controller from processing a child's personal information without the consent of the child's parent or legal guardian, and regulation 10(5)(b) requires reasonable efforts to verify that the consent was given or authorised by that parent or guardian, taking available technology into account.
Regulation 10(5)(d) requires regular data protection impact assessments to identify and mitigate privacy risks to children, regulation 10(5)(e) requires data protection by design and by default when processing children's data, and regulation 10(5)(f) bars subjecting children's data to automated decision making that has the effect of affecting the children's rights.
Regulation 10(3) separately bars subjecting any data subject to a decision based solely on automated processing which produces legal effects concerning them, without that data subject's consent or a provision established by law. Regulation 10(6) makes contravening the regulation an offence carrying a fine up to level 11 or up to seven years' imprisonment, or both.
The Regulations were made by the Minister of Information Communications Technology, Postal and Courier Services in consultation with the Authority under section 32 of the Cyber and Data Protection Act, and took effect on their publication on .
When LexLint raises it
When your app profile says your app serves under-18s or makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .