Nigeria Data Protection Act 2023, s. 37

Binding law — in force AI-adjacent law

Solely automated decisions with legal or similar significant effects need human intervention, the person's view and a way to contest (Nigeria NDPA s. 37)

Official Gazette No. 119, Vol. 110, Lagos, 1st July, 2023 (masthead) · official text · In force: applies since 12 Jun 2023 · NG

Nigeria's Data Protection Act, 2023 gives a data subject the right not to be subject to a decision based solely on automated processing of personal data, including profiling, that produces legal or similar significant effects concerning them (s. 37(1)), except where the decision is necessary for a contract between the data subject and the controller, authorised by a written law with suitable safeguards, or authorised by the data subject's consent (s. 37(2)). The data controller must implement suitable measures to safeguard the data subject's rights, including the rights to obtain human intervention, to express their point of view and to contest the decision (s. 37(3)). Before collecting personal data, the controller must tell the data subject of the existence of automated decision-making, including profiling, its significance and envisaged consequences, and the right to object to and challenge it (s. 27(1)(g)). Detect a model output that becomes a decision about a person with no human-intervention and contest route, and no human decision.

Who it applies to

• Duty falls on: controller
• Systems covered: automated decision, consequential decision
• Data controllers domiciled in, resident in or operating in Nigeria, processing personal data in Nigeria, or processing personal data of a data subject in Nigeria from outside it (s. 2(2)), that take decisions based solely on automated processing, including profiling, with legal or similar significant effects. In force since commencement on 2023-06-12. Whether the s. 37(3) measures apply to every such decision or only to those taken under a s. 37(2) exception, and whether a s. 3(2) purpose reaches s. 37, are counsel questions.
• Not covered:
  • Processing by one or more persons solely for personal or household purposes, unless it violates a data subject's fundamental right to privacy (s. 3(1))
• Whether it applies depends on facts outside the code; a person has to decide.

verdict = client.chat.completions.create(model=MODEL, messages=msgs).choices[0].message.content
if verdict.strip() == 'deny':
    deny(applicant)
    send_decision_email(applicant, 'Your application was not approved.')

out = client.chat.completions.create(model=MODEL, messages=msgs,
                                     response_format={'type': 'json_object'})
result = json.loads(out.choices[0].message.content)
if result['decision'] == 'deny':
    if requires_human_review('credit'):                 # a person decides
        review_queue.enqueue(applicant.id, proposal=result)
    else:                                               # solely automated, recorded basis
        deny(applicant, basis=DECISION_BASIS['credit'], reasons=result['reasons'])
        send_decision_email(applicant, render('adm_denial.txt', notice=ADM_NOTICE,
            reasons=result['reasons'], contest_url=f'{BASE}/decisions/{applicant.id}/contest'))

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

• UnitedHealth nH Predict claim-denial litigation (2023-11; alleged (not proven)). A class action filed in November 2023 alleges that UnitedHealth's nH Predict model had a 90% error rate, measured by denials reversed on appeal, while only about 0.2% of members appealed. UnitedHealth disputes the allegations; the litigation is ongoing. Source: STAT News · evidence grade: primary · cited by Monitor how often adverse AI decisions are reversed, and suspend models that are usually wrong
• Cigna PXDX batch claim denials (reported) (2022; alleged (not proven)). ProPublica, citing internal Cigna records, reported that Cigna's PXDX system was used to reject more than 300,000 claims over two months in 2022, with physicians spending an average of 1.2 seconds on each. Cigna disputes the reporting; related lawsuits are ongoing. Source: ProPublica / The Capitol Forum · evidence grade: press of record · cited by Make human review of adverse AI decisions substantive, not nominal

Rule id ng-ndpa-s37.automated-decision-safeguards · review status: primary source derived