AndorraLQPD, rights of the data subject
Llei 29/2021, arts. 15-24, 26 (rights of the data subject)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Access restriction
- Audit expectation
- none
What it requires
- Answer an access, rectification, erasure, restriction, portability or objection request within one month of receipt, extendable by two further months for complex or numerous requests, and tell the data subject about any extension within the first month.NIST Privacy FrameworkCT.PO-P3
- Tell a data subject, at the point you collect or first obtain their personal data, your identity, the purposes and legal basis of processing, the recipients, any transfer to a third country, the storage period, and their rights.NIST Privacy FrameworkCM.AW-P1
- Give a data subject a copy of their personal data on request, along with the purposes, categories, recipients, storage period and other Article 18 information, free of charge for the first copy.NIST Privacy FrameworkCT.DM-P1
- Correct inaccurate or incomplete personal data on request without undue delay, and pass the correction on to recipients the data were disclosed to.NIST Privacy FrameworkCT.DM-P3NIST Privacy FrameworkCM.AW-P5
- Erase personal data on request without undue delay where it is no longer necessary, consent is withdrawn with no other lawful basis, the data subject objects with no overriding ground, it was processed unlawfully, a legal obligation requires erasure, or it was collected under the child information-society-service consent rule, and de-reference it if you operate a search engine indexing it.NIST Privacy FrameworkCT.DM-P4
- Restrict processing on request while accuracy is contested, in place of erasure where the data subject prefers restriction, where you no longer need the data but the data subject does for legal claims, or while an objection is being verified.NIST Privacy FrameworkCT.PO-P3
- Give a data subject their data in a structured, commonly used, machine-readable format and transmit it to another controller on request where processing rests on consent or a contract and is automated.NIST Privacy FrameworkCT.DM-P2
- Stop processing personal data for direct marketing, including related profiling, as soon as a data subject objects, and bring that right to their attention explicitly and separately no later than the first communication with them.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P1
- If you provide internet access as a service, offer transparent terms free of technical or economic discrimination and inform users of their rights, per Article 21's digital-rights guarantee.NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CT.DM-P2Data elements can be accessed for transmission or disclosure.
- CT.DM-P3Data elements can be accessed for alteration.
- CT.DM-P4Data elements can be accessed for deletion.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
1 more
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 15 to 24 and 26 set the response period for a data subject's request and the rights of access, rectification, erasure, restriction, portability and objection. None of them requires a log of requests. The one clause that touches a record is Article 22(3), which makes the controller show on its information systems that processing of a person's data is restricted; it names no log, so the duty rests on the restriction flag the controller must be able to show. Where the controller refuses a request as manifestly unfounded or excessive it carries the burden of showing that (Article 15(6)), which is a burden of proof and names no record. Article 34(7), the register the Agency may ask for, is not cited by this row.
- Kind
- Implicit
- As of
- Provision
- Article 22(3) (restriction of processing marked in the controller's information systems)
- Trigger
- personal_data_processing
What this law does
Article 15 requires the controller to give the Article 16 and 17 information and handle an Article 18 to 25 request in a concise, transparent, intelligible and easily accessible form, free of charge and within one month of the request, extendable by two further months for complex or numerous requests.
Articles 16 and 17 set the information a controller must give a data subject, whether the data came from the subject or elsewhere, covering the controller's identity, the purposes and legal basis of processing, the recipients, any transfer to a third country, the storage period, and the data subject's rights. Article 18 gives a right of access to confirmation of processing, a copy of the personal data, and the accompanying information the article lists.
Article 19 gives a right to rectification of inaccurate personal data and completion of incomplete data. Article 20 gives a right to erasure, the right to be forgotten, on the listed grounds, including withdrawal of consent, unlawful processing, and collection under Article 8's information-society-service consent rule, and requires a controller whose data are accessed through a search engine to de-reference them.
Article 21 guarantees digital rights on the internet, including net neutrality, universal and non-discriminatory access, and the security of communications, and requires internet service providers to offer transparent service terms free of technical or economic discrimination.
Article 22 gives a right to restriction of processing where accuracy is contested, processing is unlawful, the controller no longer needs the data but the data subject does for legal claims, or an Article 24 objection is pending verification. Article 23 gives a right to data portability in a structured, commonly used and machine-readable format where processing rests on consent or a contract and is carried out by automated means.
Article 24(1) gives a right to object to processing the controller did not obtain directly from the data subject, for reasons related to their particular situation. Article 24(2) gives a separate, unconditional right to object to processing for direct marketing purposes, including related profiling.
Article 26 lets these rights be restricted only by law, consistently with the essence of fundamental rights and freedoms, and only where necessary and proportionate to safeguard the listed public interests, including state security, defence, public safety, and the prevention, investigation, detection or prosecution of criminal offences.
When LexLint raises it
When your app profile says your app sends automated outreach, provides telecom services, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .