Bosnia and HerzegovinaLaw on the Protection of Personal Data of Bosnia and Herzegovina, rights of data subjects
Law on the Protection of Personal Data, arts. 14-23, 25 (rights of data subjects)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Tell a person, at the latest when you collect their personal data or within a reasonable period if collected elsewhere, who you are, the purpose and legal basis of the processing, the recipients, any transfer abroad, the retention period and their rights, under Articles 15 and 16.NIST Privacy FrameworkCM.AW-P1
- Answer a request for access, rectification, erasure, restriction, or portability under Articles 17 to 22, and notify any recipient the data were disclosed to of a rectification, erasure or restriction you make.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P5
- Stop processing personal data for direct marketing purposes as soon as a person objects, under Article 23.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
The row cites Articles 14 to 23 and 25: the controller's information duties, the rights of access, rectification, erasure, restriction, portability and objection, and the restriction clause. They are duties to inform and to act on a request, and none asks for a log or record. Articles 67 to 74, which sit in the row's short code but not in its citation or summary, govern a competent authority; Article 71(5) and (6), which has the authority document a refusal of access and make that file available to the Agency, is therefore not read into this row.
- Kind
- None
- As of
What this law does
Articles 14 to 16 require the controller to tell a person, in a concise, transparent, intelligible and easily accessible form, its identity and contact details, the purposes and legal basis of the processing, the recipients, any transfer abroad, the retention period and the person's rights, giving that information when the data are obtained or, where they come from elsewhere, within a reasonable period and at the latest one month afterward.
Article 17 gives a person the right to confirm whether their personal data are processed and to access them, Article 18 the right to have inaccurate data rectified, Article 19 the right to erasure on the listed grounds, and Article 20 the right to restrict processing; Article 21 requires the controller to tell every recipient the data were disclosed to of a rectification, erasure or restriction, unless that proves impossible or involves disproportionate effort.
Article 22 gives a right to receive personal data in a structured, commonly used and machine-readable format and to have it transmitted to another controller, and Article 23 gives a right to object to processing, including an unconditional right to object to direct marketing that stops the processing as soon as it is exercised. Article 25 lets a special law restrict these rights only where necessary and proportionate to a listed public interest.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .