Côte d'IvoireLaw No. 2013-450 on the Protection of Personal Data, rights of the data subject
Loi n° 2013-450, arts. 28-38 (rights of the data subject)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.artci.ci/images/stories/pdf-english/lois_english/loi_2013_450_english.pdfIn force.
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Access restriction
- Audit expectation
- none
What it requires
- Give the person concerned, at the latest when you collect their data, your identity, the purpose, the categories of data, the recipients, their right to refuse to appear on the file, their rights of access and rectification, the retention period, and whether the data may be transferred to a third country.NIST Privacy FrameworkCM.AW-P1
- Answer a request for access with confirmation of whether the person's data are processed, the data themselves and their origin, and the purposes, categories and recipients of the processing.NIST Privacy FrameworkCT.DM-P1
- Stop processing a person's data for prospecting purposes as soon as they object, free of charge, and tell them before their data are first disclosed to a third party for prospecting so they can object to that disclosure.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P1
- Rectify, complete, update, delete or lock personal data on request where it is inaccurate, incomplete, ambiguous or outdated, including at the request of a deceased person's successors.NIST Privacy FrameworkCT.PO-P3
- Erase a person's personal data and end its distribution on request, including data made available while they were a minor, where it is no longer necessary, where consent is withdrawn, where the processing lacks a legal ground, or for another legitimate reason, and tell every third party the data were disclosed to that removal is sought.NIST Privacy FrameworkCT.DM-P4NIST Privacy FrameworkCM.AW-P5
- Give a person their personal data in a structured, commonly used electronic format on request, and forward it to another system where the processing rests on consent or a contract.NIST Privacy FrameworkCT.DM-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CT.DM-P2Data elements can be accessed for transmission or disclosure.
- CT.DM-P4Data elements can be accessed for deletion.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Data subject
Logging duty
Article 32 lets the successors of a deceased person require the person responsible for the processing to take the death into account and update the data, and then requires that person to justify to the claimant, free of charge, that the updates were made. That cannot be shown without a record of the update, but the article names no log and no content. The successors stand in for the data subject, so the data subject is listed as the party who may ask. Articles 28 to 31 and 33 to 35 set information, access, rectification and erasure duties without a record, and Article 36 asks for mechanisms or a periodic review of the need to keep data, which concerns the data and not a log. No audit of a record is named, and the sections cited here carry no territorial clause, so the hook is empty.
- Kind
- Implicit
- As of
- Provision
- Article 32
- Trigger
- personal_data_processing
What this law does
Article 28 requires the person responsible for the processing to give the person concerned, at the latest when the data are collected, their identity, the purpose, the categories of data, the recipients, the possibility of refusing to appear on the file, the existence of the rights of access and rectification, the retention period, and the possibility of a transfer to a third country.
Article 29 gives a person the right to obtain confirmation of whether their data are being processed, the data themselves and their origin, and the purposes, categories and recipients of the processing, and lets the Protection Body exercise that access on the person's behalf where direct access is impossible.
Article 30 gives a person the right to object to processing on legitimate grounds relating to their situation, to object at no cost to processing for prospecting purposes, and to be told before their data are first disclosed to a third party for prospecting and given the right to object to that disclosure free of charge.
Article 31 gives a person the right to have inaccurate, incomplete, ambiguous or outdated personal data rectified, completed, updated, deleted or locked, and article 32 extends that right to a deceased person's successors.
Article 33 gives a person the right to erasure of their personal data and to the end of its distribution, including data made available while they were a minor, where it is no longer necessary, where consent is withdrawn or the retention period has lapsed with no other legal ground, where the processing lacks a legal ground, or for any other legitimate reason, and articles 34 to 36 require the person responsible to tell any third party the data were disclosed to that the person concerned seeks removal of every link, copy or reproduction, to carry out the erasure without delay unless a listed ground for retention applies, and to establish mechanisms implementing that right and periodically reviewing the need to keep data.
Article 38 gives a person the right to receive their data in a structured, commonly used electronic format and, where the processing rests on consent or a contract, to have it forwarded to another system. No commencement notice for the Act has been located in the Official Gazette.
When LexLint raises it
When your app profile says your app sends automated outreach, serves under-18s or processes personal data.
Back to the example · Lint your app
Page updated .