LexLint.ioBeta

Know the law your code answers to.

Law / Frameworks / NIST Privacy Framework / Communicate-P

NIST Privacy Framework, Communicate-PCM.AW-P8

Individuals are provided with mitigation mechanisms (e.g., credit monitoring, consent withdrawal, data alteration or deletion) to address impacts of problematic data actions.NIST Privacy Framework, version 1.0, January 2020, CM.AW-P8

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of .

5
laws
5
jurisdictions
0
with court rulings behind them
2
not yet in force

Related controls in other frameworks the same duties, in at least two laws we track, reach both

  • NIST AI RMFMEASURE 3.3 Feedback processes for end users and impacted communities to report problems..., 2 laws

A law in force is unmarked; the rest wear their state: not yet in force

  • Canada
  • European Union
  • Massachusetts
  • Pennsylvania
  • Utah

Breach notification

2 laws, 2 jurisdictions
JurisdictionLawWhat it asks, as read here
Massachusetts Security Breach statute, credit monitoring offer required

Offer at least 18 months of free credit monitoring to a Massachusetts resident whose Social Security number was disclosed, or reasonably believed disclosed, in a breach of security.

If you are a consumer reporting agency that experienced the breach, offer not less than 42 months of free credit monitoring instead of 18.

+1 more
Pennsylvania Breach of Personal Information Notification Act

If you determine a breach of the security of the system has occurred and reasonably believe an individual's name in combination with a Social Security number, bank account number, or driver's license or State ID number has been accessed, assume the cost of one independent credit report for an individual not eligible for a free one and of credit monitoring services for 12 months following notification, and inform the affected individual of those no-cost services when you notify them (Section 5.4).

AI prohibited practices

1 law, 1 jurisdiction
JurisdictionLawWhat it asks, as read here
Utah Digital Voyeurism Prevention Act (HB 276, 2026 General Session), Utah Code Title 13 Chapter 72b from , in 7 weeks

Give users a clear way to report a non-consensual counterfeit intimate image and remove a reported image within 48 hours of notice, if you operate a covered platform

Data subject rights

1 law, 1 jurisdiction
JurisdictionLawWhat it asks, as read here
European Union Platform Work Directive, Transparency, Human Oversight and Human Review of Automated Systems (Articles 9 to 11) from , in 3 weeks

Where a decision referred to in Article 11(1) infringes the rights of a person performing platform work, rectify it without delay and in any case within two weeks of its adoption; where rectification is not possible, offer adequate compensation for the damage sustained; and in any event take the steps necessary, including, if appropriate, the modification of the automated decision-making system or the discontinuation of its use, in order to avoid such decisions in the future (Article 11(3)).

Full text of the NIST Privacy Framework, public domain (a US government work). Every control of the framework.