BoliviaAnteproyecto de Ley de Protección de Datos Personales (AGETIC)
Anteproyecto de Ley de Protección de Datos Personales
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Data subject rights, Security, Disclosure
What it requires
- Process a natural person's personal data lawfully, for a stated purpose, and with the security, transparency, and accountability the principles of AGETIC's draft Anteproyecto describe.NIST Privacy FrameworkGV.PO-P1
- Let a person exercise access, rectification, erasure, objection, processing-limitation, portability, and revocation rights over their personal data, and let them object to being subject to a fully automated decision.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 3.3Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What this law does
The Anteproyecto is a preliminary draft law; what follows is what AGETIC's public presentation of the draft states it would do. The Anteproyecto de Ley de Protección de Datos Personales states its object as the protection of the personal data of natural persons contained in automated or non-automated, public or private files, records, or databases, with the stated purpose of guaranteeing the lawful, controlled, and informed processing of that data.
The presentation lists lawfulness, confidentiality, quality, purpose limitation, proportionality, security, transparency, loyalty, accountability, access, rectification, erasure, objection, processing limitation, portability, a right not to be subject to automated decisions, revocation, compensation, and information among its stated principles and rights.
It states the draft would secure personal data with adequate physical, technical, and administrative measures to prevent its alteration, loss, unauthorised or fraudulent access or use, and to guarantee its confidentiality, integrity, and availability. It also proposes a Data Protection Authority with powers of investigation, supervision, promotion, and sanction, to make sanctions for infractions effective in proportion to the violation committed.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .