Skip to content
srilawsby aturio
As enacted
Contents

Part II · Rights of Data Subjects

18. Automated individual decision making

Official English translation. Where it differs from the Sinhala or Tamil text, the Act itself says which text prevails.

(1)

Subject to section 19, every data subject shall have the right to request a controller to review a decision of such controller based solely on automated processing, which has created or which is likely to create an irreversible and continuous impact on the rights and freedoms of the data subject under any written law.

(2)

The provisions of subsection (1) shall not apply where a decision of a controller, based on automated processing is–

(a)

authorized by any written law, which a controller is subject to;

(b)

authorized in a manner determined by the

Authority;

(c)

based on the consent of the data subject; or

(d)

necessary for entering into or performance of a contract between the data subject and the controller, and the controller shall comply with such measures and applicable criteria as may be specified by the Authority by rules made in that behalf to safeguard the rights and freedoms of the data subject:

Provided however, the requirement under paragraph (d)

shall not apply to special categories of personal data.

Read on from s 19

Part III

Controllers and Processors

Read on from Part III

Part IV

Use of Personal Data to Disseminate Solicited Messages

Read on from Part IV

Part V

Data Protection Authority

Read on from Part V

Part VI

Director-General and the Staff of the Authority

Read on from Part VI

Part VII

Penalties

Read on from Part VII

Part VIII

Fund of the Authority

Read on from Part VIII

Part IX

Miscellaneous

Read on from Part IX

Part X

Interpretation

Read on from Part X

Schedules