A/78/310 controller of the processing shall inform the data subject without delay, except as otherwise provided in the Regulations on the exercise of the other rights set out in the Act and its […] Regulations. 46. In Sao Tome and Principe, Act No. 3/2016 of 2 May 2016, the Individual Personal Data Protection Act, is unique in that it stipulates in its article 21 that controllers or their representatives shall notify the National Personal Data Protection Agency, in writing and no more than eight days before the processing is to begin, that they will begin fully or partially automated processing or batch processing to achieve one or more interrelated ends, with some exceptions. Arti cle 11 of the Act also provides that data subjects, when exercising their right to access, have the right to be informed by the controller of the reasons behind the automated processing of data concerning them. 47. In Uruguay, article 13 of Act No. 18831 of 11 August 2008, the Personal Data Protection Act, establishes that data subjects have the right to be informed, in an express, clear and unmistakable manner, prior to data collection, about the assessment criteria, the processes applied and the technological solution or software utilized in cases in which automated data processing is used to evaluate certain aspects of their personality, such as job performance, creditworthiness, reliability and conduct, to make decisions with legal effects that could significantly affect the data subjects. The Act also states that “when personal data are not collected directly from the data subjects, the information […] shall be provided to them within a period of five business days from the date on which the request is received by the controllers”. VI. Principle of explainability in the processing of personal data in artificial intelligence projects 48. The creation of “virtual profiles” on individuals based on existing information is becoming increasingly common and decisions are often made about them based on the automated processing of their data using various technological tools. 49. Human beings can be positively or negatively affected by the decisions made about them based on the use and processing of data in artificial intelligence projects. There are concerns about how to protect the rights of individuals affected by decisions made about them with artificial intelligence tools or technologies. In the White Paper on artificial intelligence, for example, it is noted that: “as with any new technology, the use of [artificial intelligence] brings both opportunities and risks. Citizens fear being left powerless in defending their rights and safety when facing the information asymmetries of algorithmic decision-making”. 41 50. Given the above, people need to be aware of which data were used to make a decision that affects them, as well as the logic used to reach such decision. Having access to this information will, inter alia, enable the affected person to know whethe r the decision made about them is correct and, if not, to defend themselves. In other words, such information is necessary to ensure due process, as it will serve as evidence of possible inaccuracies or injustices generated against people during the processing of their personal data in artificial intelligence processes. In this regard, the aforementioned High-Level Expert Group on Artificial Intelligence has emphasized that the principle of explicability: is crucial for building and maintaining users’ trust in [artificial intelligence] systems. This means that processes need to be transparent, the capabilities and __________________ 41 23-15851 See https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1603192201335&uri=CELEX% 3A52020DC0065, p. 9. 15/20