Binding law — in force
Solely automated significant decisions need written notice and, on request, reconsideration or a new decision with human involvement (Kenya DPA s. 35)
Kenya's Data Protection Act, 2019 gives every data subject a right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or significantly affects them (s. 35(1)), except where necessary for a contract, authorised by law with safeguards, or based on consent (s. 35(2)). Where such a decision is taken, the controller or processor must notify the person in writing as soon as reasonably practicable, and the person may ask it to reconsider the decision or take a new decision not based solely on automated processing (s. 35(3)); the request must be considered and complied with, and the person told in writing of the steps and outcome (s. 35(4)). The 2021 General Regulations (reg. 22(2)) add: inform people of automated decision-making, give meaningful information about the logic, explain its significance and consequences, prevent errors, eliminate discriminatory effects and ensure the person can obtain human intervention and express a view. Detect a model output that becomes a decision about a person with no automated-decision notice and reconsideration route, and no human decision.
ke-dpa-s35.automated-decision-notice-and-reconsideration · s. 35(1) (right not to be subject to solely automated decisions) · official source · jurisdictions: KE