South Africa POPIA s. 71 (automated decision making)

Binding law — in force AI-adjacent law

No decision with legal or substantial effect may rest solely on automated profiling, save with representations and information on the logic (POPIA s. 71)

s. 71(1) (no decision based solely on automated profiling) · official text · In force: applies since 1 Jul 2020 · ZA

South Africa's POPIA provides that a data subject may not be subject to a decision with legal consequences or substantial effect based solely on automated processing of personal information intended to profile them, including their performance at work, creditworthiness, reliability, location, health, personal preferences or conduct (s. 71(1)). The bar does not apply where the decision is taken in connection with a contract and the person's request was met or appropriate measures protect their legitimate interests, or where a law or code of conduct specifies appropriate measures (s. 71(2)). The appropriate measures must give the person an opportunity to make representations about the decision and require the responsible party to give them sufficient information about the underlying logic of the automated processing (s. 71(3)). Detect a model output that becomes a decision about a person with no representations route and logic explanation, and no human decision.

Who it applies to

• Duty falls on: controller
• Systems covered: automated decision, consequential decision
• Responsible parties whose decisions with legal consequences or substantial effect on a data subject rest solely on automated profiling, where POPIA applies (s. 3(1)(b): a responsible party domiciled in the Republic, or not domiciled there but using automated or non-automated means in the Republic). s. 71 commenced on 2020-07-01 and processing had to conform within one year (s. 114(1)), by 2021-07-01. Whether a juristic person is a data subject here ('him, her or it') and what makes an effect 'substantial' are counsel questions.
• Not covered:
  • Processing in the course of a purely personal or household activity, de-identified information, listed public-body national-security and law-enforcement processing, the Cabinet and Executive Councils, and judicial functions of courts (s. 6(1))
• Whether it applies depends on facts outside the code; a person has to decide.

verdict = client.chat.completions.create(model=MODEL, messages=msgs).choices[0].message.content
if verdict.strip() == 'deny':
    deny(applicant)
    send_decision_email(applicant, 'Your application was not approved.')

out = client.chat.completions.create(model=MODEL, messages=msgs,
                                     response_format={'type': 'json_object'})
result = json.loads(out.choices[0].message.content)
if result['decision'] == 'deny':
    if requires_human_review('credit'):                 # a person decides
        review_queue.enqueue(applicant.id, proposal=result)
    else:                                               # solely automated, recorded basis
        deny(applicant, basis=DECISION_BASIS['credit'], reasons=result['reasons'])
        send_decision_email(applicant, render('adm_denial.txt', notice=ADM_NOTICE,
            reasons=result['reasons'], contest_url=f'{BASE}/decisions/{applicant.id}/contest'))

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

• UnitedHealth nH Predict claim-denial litigation (2023-11; alleged (not proven)). A class action filed in November 2023 alleges that UnitedHealth's nH Predict model had a 90% error rate, measured by denials reversed on appeal, while only about 0.2% of members appealed. UnitedHealth disputes the allegations; the litigation is ongoing. Source: STAT News · evidence grade: primary · cited by Monitor how often adverse AI decisions are reversed, and suspend models that are usually wrong
• Cigna PXDX batch claim denials (reported) (2022; alleged (not proven)). ProPublica, citing internal Cigna records, reported that Cigna's PXDX system was used to reject more than 300,000 claims over two months in 2022, with physicians spending an average of 1.2 seconds on each. Cigna disputes the reporting; related lawsuits are ongoing. Source: ProPublica / The Capitol Forum · evidence grade: press of record · cited by Make human review of adverse AI decisions substantive, not nominal

Rule id za-popia-s71.automated-profiling-decision-representations-and-logic · review status: primary source derived