Kenya Data Protection Act 2019, s. 35

Binding law — in force AI-adjacent law

Solely automated significant decisions need written notice and, on request, reconsideration or a new decision with human involvement (Kenya DPA s. 35)

s. 35(1) (right not to be subject to solely automated decisions) · official text · In force: applies since 25 Nov 2019 · KE

Kenya's Data Protection Act, 2019 gives every data subject a right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or significantly affects them (s. 35(1)), except where necessary for a contract, authorised by law with safeguards, or based on consent (s. 35(2)). Where such a decision is taken, the controller or processor must notify the person in writing as soon as reasonably practicable, and the person may ask it to reconsider the decision or take a new decision not based solely on automated processing (s. 35(3)); the request must be considered and complied with, and the person told in writing of the steps and outcome (s. 35(4)). The 2021 General Regulations (reg. 22(2)) add: inform people of automated decision-making, give meaningful information about the logic, explain its significance and consequences, prevent errors, eliminate discriminatory effects and ensure the person can obtain human intervention and express a view. Detect a model output that becomes a decision about a person with no automated-decision notice and reconsideration route, and no human decision.

Who it applies to

• Duty falls on: controller, processor
• Systems covered: automated decision, consequential decision
• Data controllers and processors established or ordinarily resident in Kenya processing there, or not established there but processing personal data of data subjects located in Kenya (s. 4(b)), that take decisions with legal or significant effects based solely on automated processing. In force from 2019-11-25 (date of commencement printed in the Act); reg. 22 of the 2021 Regulations (gazetted 31 December 2021) adds duties. Whether the s. 35(3) notice and reconsideration apply also to decisions taken under a s. 35(2) exception is a counsel question.
• Not covered:
  • Processing by an individual in a purely personal or household activity, processing necessary for national security or public interest, and disclosure required by law or court order (s. 51(2))
• Whether it applies depends on facts outside the code; a person has to decide.

verdict = client.chat.completions.create(model=MODEL, messages=msgs).choices[0].message.content
if verdict.strip() == 'deny':
    deny(applicant)
    send_decision_email(applicant, 'Your application was not approved.')

out = client.chat.completions.create(model=MODEL, messages=msgs,
                                     response_format={'type': 'json_object'})
result = json.loads(out.choices[0].message.content)
if result['decision'] == 'deny':
    if requires_human_review('credit'):                 # a person decides
        review_queue.enqueue(applicant.id, proposal=result)
    else:                                               # solely automated, recorded basis
        deny(applicant, basis=DECISION_BASIS['credit'], reasons=result['reasons'])
        send_decision_email(applicant, render('adm_denial.txt', notice=ADM_NOTICE,
            reasons=result['reasons'], contest_url=f'{BASE}/decisions/{applicant.id}/contest'))

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

• UnitedHealth nH Predict claim-denial litigation (2023-11; alleged (not proven)). A class action filed in November 2023 alleges that UnitedHealth's nH Predict model had a 90% error rate, measured by denials reversed on appeal, while only about 0.2% of members appealed. UnitedHealth disputes the allegations; the litigation is ongoing. Source: STAT News · evidence grade: primary · cited by Monitor how often adverse AI decisions are reversed, and suspend models that are usually wrong
• Cigna PXDX batch claim denials (reported) (2022; alleged (not proven)). ProPublica, citing internal Cigna records, reported that Cigna's PXDX system was used to reject more than 300,000 claims over two months in 2022, with physicians spending an average of 1.2 seconds on each. Cigna disputes the reporting; related lawsuits are ongoing. Source: ProPublica / The Capitol Forum · evidence grade: press of record · cited by Make human review of adverse AI decisions substantive, not nominal

Rule id ke-dpa-s35.automated-decision-notice-and-reconsideration · review status: primary source derived