ISO 27701 | 7.3.10

Automated decision making

The organization should identify and address all obligations, including legal obligations, to the PII principals resulting from decisions made by the organization and related to the... ... - Licensed content not shown -

GDPR (EU)

13.2.f: Article(13)(2)(f): In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing: (f) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

14.2.g: Article(14)(2)(g):In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject: (g) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

22.1: Article(22)(1): The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

22.3: Article(22)(3): In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

LGPD (BRA)

Art.20: The data subjects have the right to request the revision, of the decisions made solely on the basis of automated processing of personal data, that affect their interests, including decisions intended to define their personal, professional, consumer, or credit profile or aspects of their personality. (New wording included by Law No. 13,853 of 2019) § 1 The controller must provide, whenever requested, clear and adequate information regarding the criteria and the data procedures used for the automated decision, respecting commercial and industrial secrecy. § 2 In case of failure to supply the information referred to in § 1 based on respect for commercial or industrial secrecy, the National Data Protection Authority may conduct an audit to verify discriminatory aspects in the automated processing of personal data. § 3 (VETOED). (Included by Law No. 13,853 of 2019)

Turkish Data Protection Law numbered 6698

A.11.1.g: Data subject may object to processing of personal data exclusively through automated systems (A.11.1.g)