Binding law — in force
Let data subjects request review of solely automated decisions and give clear information on the criteria and procedures used (Brazil, LGPD Art. 20)
Under Brazil's General Data Protection Law (LGPD) Art. 20, a data subject may request review of decisions taken solely on the basis of automated processing of personal data that affect their interests, including decisions defining their personal, professional, consumer or credit profile or aspects of their personality; on request the controller must give clear and adequate information on the criteria and procedures used, subject to commercial and industrial secrecy, and where it refuses on that ground the ANPD may audit for discriminatory aspects. The paragraph requiring review by a natural person was vetoed, so the review need not be human. Detect a model-driven adverse decision with no review-request route or no stored criteria.
br-lgpd.automated-decision-review-and-criteria · LGPD, Art. 20, caput (right to request review of solely automated decisions) · official source · jurisdictions: BR