Cabo VerdeLaw No. 133/V/2001 on the Protection of Personal Data, open-network warning, health-data access and marketing objection
Lei n.º 133/V/2001 de 22 de Janeiro, arts. 13 (no. 4), 14 (no. 5) and 20 (b) and (c) as republished by Lei n.º 121/IX/2021, de 17 de Março (direitos dos titulares dos dados)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Access restriction
As of .
What it requires
- Warn a data subject, when their data is collected over an open network and unless they already know it, that their personal data may circulate without security conditions and risk being seen and used by unauthorized third parties.NIST Privacy FrameworkCM.AW-P1
- Let a data subject exercise access to health data, including genetic data, through a doctor of their own choosing.NIST Privacy FrameworkCT.DM-P1
- Let a data subject object on request and free of charge to processing for direct marketing or other prospecting, and object without cost to a first disclosure to third parties for those purposes or to use on behalf of third parties.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What this law does
Article 13(4) requires the data subject to be informed, when their data is collected over open networks and unless they already know it, that their personal data may circulate without security conditions and risk being seen and used by unauthorized third parties. Article 14(5) lets the data subject exercise access to health data, including genetic data, through a doctor of their own choosing.
Article 20(b) and (c) let a data subject object, on request and free of charge, to processing for direct marketing or any other form of prospecting, and object without cost to a first disclosure of the data to third parties for those purposes or to its use on behalf of third parties. The law itself entered into force thirty days after its publication, following approval by the Assembleia Nacional on and enactment by the President on . The Law appears in the Boletim Oficial da República de Cabo Verde, I Série, n.º 2, of .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach or generates content with AI.