Cabo VerdeLaw No. 133/V/2001 on the Protection of Personal Data, rights of data subjects
Lei n.º 133/V/2001 de 22 de Janeiro, as republished by Lei n.º 121/IX/2021, de 17 de Março, arts. 13 (nos. 1 and 3), 14 (no. 1) and 20 (a) (direitos dos titulares dos dados)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Tell a data subject, except where they already know it, your identity and address and any representative's, the data protection officer's contact details, the categories of data, the purposes and legal basis of processing, the recipients or categories of recipients, whether a reply is mandatory or voluntary and the consequences of not replying, and the existence and conditions of the rights of access, rectification, erasure and objection, at the time of collection or, if not collected from the data subject, when the data is recorded or at the latest on first disclosure to a third party, unless the law authorizes the processing or informing them is impossible or would take disproportionate effort.NIST Privacy FrameworkCM.AW-P1
- Give a data subject, freely and without restriction, at reasonable intervals and without excessive delay or cost, confirmation of whether you process their data, the purposes, categories and recipients, a copy of the data on request, an intelligible communication of the data and any available information on its source, the logic behind automated decisions including profiling, and notice to third parties of any rectification, erasure or destruction.NIST Privacy FrameworkCT.DM-P1NIST Privacy FrameworkCM.AW-P5
- Let a data subject object at any time, on compelling legitimate grounds relating to their particular situation, to processing you carry out for a public interest or legitimate interest ground, and stop unless you show overriding compelling legitimate grounds or the processing serves a legal claim.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 13(1) and (3), 14(1) and 20(a) give the data subject the right to be informed, the right of access and the right to object. They are duties to inform and answer, and none requires the controller to keep a log or a record. The access right is a right to the data subject's own data and to information about it, not an entitlement to read a record of the controller's processing. The cited sections state no territorial hook.
- Kind
- None
- As of
What this law does
Article 13(1) requires the controller or its representative to provide a data subject, from whom data is collected, with at least the controller's identity and address, the contact details of the data protection officer where there is one, the categories of data processed, the purposes and legal basis of the processing, the recipients or categories of recipients, whether replying is mandatory or voluntary and the consequences of not replying, and the existence and conditions of the rights of access, rectification, erasure and objection, unless the data subject already knows them.
Article 13(3) requires that information, where the data is not collected from the data subject, to be given at the time the data is recorded or, if disclosure to a third party is planned, no later than the first disclosure, unless the processing is authorized by law or giving the information is impossible or would take disproportionate effort.
Article 14(1) gives a data subject the right to obtain from the controller, freely and without restriction, at reasonable intervals and without excessive delay or cost, confirmation of whether data concerning them is processed together with the purposes, categories of data and recipients, a copy of the data on request, communication in intelligible form of the data and any available information on its source, knowledge of the logic behind automated decisions, including profiling, and notification to third parties of any rectification, erasure or destruction.
Article 20(a) lets a data subject object at any time, on compelling and legitimate grounds relating to their particular situation, to processing based on a public interest task or on the legitimate interest of the controller or a third party, in which case the controller must stop processing unless it shows compelling legitimate grounds that override the data subject's interests, rights and freedoms or the processing serves a legal claim.
Lei n.º 121/IX/2021 added the controller's address, the categories of data processed and the legal basis of the processing to the information a controller must give a data subject. Lei n.º 121/IX/2021 added the possibility of asking for a copy of one's personal data when exercising the right of access. Lei n.º 121/IX/2021 entered into force thirty days after its own publication on .
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .