BeninLoi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, droits des personnes concernées
In force.
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Access restriction
- Audit expectation
- none
What it requires
- Respond to a data subject's request to access, rectify, or object to the processing of their personal data, and pass on any correction to any third party the data was disclosed to.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P5
- Tell a data subject, no later than when you collect their personal data, your identity, the purposes of the processing, the recipients, whether automated decision making is in use, how long you will keep the data, and their rights of access, rectification, erasure, and objection.NIST Privacy FrameworkCM.AW-P1
- Where personal data was not collected from the data subject, give them the same information within a reasonable time and at most thirty days after obtaining it, or at the first communication or disclosure of the data if that comes sooner.NIST Privacy FrameworkCM.AW-P1
- Give a data subject their personal data in a structured, commonly used, machine readable format on request, and let them transmit it to another controller without obstruction, where the processing rests on consent or a contract and is carried out by automated means.NIST Privacy FrameworkCT.DM-P2
- Let a data subject object at any time, on legitimate grounds, to the processing of their personal data, and let them object free of charge and without any justification to processing for direct marketing, charitable, or political prospecting.NIST Privacy FrameworkCT.PO-P3
- Correct, complete, update, block, or erase personal data on a data subject's request where it is inaccurate, incomplete, ambiguous, outdated, irrelevant, or unlawfully processed, and pass the correction or erasure on to anyone the data was disclosed to.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P5
- Where you made a data subject's personal data public, take reasonable steps, including technical measures, to tell any third party processing that data that the data subject has asked for it to be erased.NIST Privacy FrameworkCM.AW-P5
- Let an incapacitated adult's rights be exercised by their cohabiting spouse or partner, or in order, an adult child, a parent, or a sibling, or a court appointed guardian, and involve the data subject as far as their understanding allows.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P2Data elements can be accessed for transmission or disclosure.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
What the log must hold
Disclosure shown
Logging duty
The clause lets the controller offer the right to object either on a document sent within sixty days of collection or by any technical means that keeps proof the person was given the chance. That is a duty to be able to show the offer was made, so the record content is the disclosure shown, not the person's answer. Article 440 names no authority that checks the proof and no period for keeping it, and the access right in Article 437 gives the person information about the processing, not access to such a record. The row cites no territorial clause.
- Kind
- Implicit
- As of
- Provision
- Article 440 (where data are collected otherwise than in writing, the controller asks the person whether they wish to object, by a document or by a technical means that keeps proof that the person had the chance to exercise the right; in a dispute the burden of proof lies with the controller)
- Trigger
- consent_or_optout
What this law does
Article 415 requires a controller to tell a data subject, no later than when their data is collected, the controller's identity, the purposes of the processing, the recipients, whether the automated decision making Article 401 addresses is in use, the retention period, and the data subject's rights of objection, access, rectification, and erasure.
Article 416 requires the same information within a reasonable time and at most thirty days after obtaining data that was not collected from the data subject, or at the first communication or disclosure of it if that comes sooner. Article 437 lets a data subject demand confirmation of whether their data is processed, the purposes and categories involved, the recipients, and any envisaged transfer to a third country, answered within sixty days.
Article 438 gives a data subject a right to receive, in a structured, commonly used, and machine readable format, personal data they provided under a consent or a contract, and to have it transmitted directly to another controller where technically possible.
Article 440 lets a data subject object at any time, on legitimate grounds, to processing of their data, and object free of charge and without any justification where the processing is for direct marketing, charitable, or political prospecting.
Article 441 lets a data subject demand rectification, completion, updating, blocking, or erasure of personal data that is inaccurate, incomplete, ambiguous, outdated, irrelevant, or unlawfully processed, and requires the controller to pass the correction on to anyone the data was disclosed to.
Article 443 requires a controller who made a data subject's personal data public to take reasonable steps, including technical measures, to tell third parties processing that data of an erasure request, unless the processing serves free expression, a legal obligation, an important public health reason, archiving, research, or statistical purposes, or a legal claim.
Article 447 lets an incapacitated adult's rights under this Book be exercised by a cohabiting spouse or partner, or in order, an adult child, a parent, or a sibling, or a court appointed guardian, involving the data subject as far as their understanding allows. The Digital Code states no day of entry into force, and no Journal officiel publication of it and no other source stating the day it came into force has been located.
When LexLint raises it
When your app profile says your app sends automated outreach, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .