A/79/173 The information must be provided in clear, simple and easily understood language. 13. Principle of explainability When requested by the data subject, the data controller or data processor must provide explanations in clear and understandable language regarding the information and the process used to make a decision affecting the data subject. These explanations must not only accurately reflect the reasoning of the system used to make the decision, but must also be comprehensible, truthful, complete, easily understood and specific or directly related to the case of the affected data subject. All information and explanations necessary for people to understand how decisions that affect them were made and to have the tools to defend their human rights or request a review of a decision must be provided. Furthermore, there must be an accountable human being with whom concerns related to automated decisions can be raised and rights can be exercised, and who can also trigger evaluation and review of the automated decision -making process. 14. Principle of demonstrated or proactive responsibility (accountability) Data controllers and processors must adopt and implement useful, timely, appropriate and effective technical, organizational and other measures to ensure and demonstrate that processing is being carried out in accordance with the principles set out in the present resolution. These measures must be audited and updated periodically to ensure that they are functioning properly, measure the degree to which the rights of data subjects are protected and assess compliance with these principles. 15. Data processing impact assessments Where a type of processing, in particular one using new technologies, by virtue of its nature, scope, context or purposes, is likely to entail a high risk to the rights and freedoms of natural persons, the data controller shall, prior to the processing, carry out an assessment of the potential impact of processing operations on the protection of personal data, with a view to taking preventive measures to address and mitigate the risks identified. An impact assessment must be carried out, inter alia, when personal aspects relating to natural persons are to be systematically and extensively evaluated on the basis of processing that is automated, including profiling, and that forms the basis for decisions that produce legal effects for the natural person or similarly significantly affect the natural person; or when massive or large -scale processing of data that is sensitive or relates to minors is planned. 16. Privacy by design and by default Taking reasonable account of the costs of implementation of the processing, the state of the art, the nature, circumstances and purposes of the processing, as well as the likely risk and the severity thereof, the data controller (and potentially the data processor) must implement appropriate technical and organizational measures to ensure that the principles set forth in the present resolution are given effect when determining the applicable means of processing and during the processing itself. Furthermore, those measures must be applied with a view to ensuring that, by default, only personal data that are necessary for each specific purpose of the processing are processed. This obligation applies also to the amount of data to 20/23 24-13146