Cabo VerdeLaw No. 133/V/2001 on the Protection of Personal Data, data protection officer
Lei n.º 133/V/2001 de 22 de Janeiro, arts. 30 to 32 as republished by Lei n.º 121/IX/2021, de 17 de Março (encarregado da proteção de dados)
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Governance
As of .
What it requires
- Designate a data protection officer if the processing is carried out by a public authority or body, other than the courts and the public prosecutor acting in their procedural capacity, if your core activities require regular and systematic monitoring of data subjects on a large scale, or if your core activities consist of large-scale processing of the special categories of data in Article 8 or of data on criminal convictions and offences in Article 11 (Article 30(1)).
- Designate the officer on the basis of professional qualities and expert knowledge of data protection law and practice, and communicate the officer's contact details to the CNPD (Article 30(4) and (6)).
- Involve the officer properly and in good time in all issues relating to the protection of personal data, and give the officer the resources, and the access to personal data and processing operations, needed to perform the tasks and keep expert knowledge up to date (Article 31(1) and (2)).
- Give the officer no instructions on the exercise of the tasks, do not dismiss or penalize the officer for performing them, and let the officer report directly to the highest management level (Article 31(3)).
- Where the officer has other tasks and duties, ensure that they do not result in a conflict of interests (Article 31(6)).
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What this law does
Article 30(1) requires the controller and the processor to designate a data protection officer where the processing is carried out by a public authority or body other than the courts and the public prosecutor acting in their procedural capacity, where their core activities require regular and systematic monitoring of data subjects on a large scale, or where their core activities consist of large-scale processing of the special categories of data in Article 8 or of data on criminal convictions and offences in Article 11.
Article 30(4) requires the officer to be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practice and the ability to perform the tasks in Article 32. Article 30(6) requires the controller to communicate the officer's contact details to the CNPD. Article 31(1) requires the controller and the processor to involve the officer properly and in good time in all issues relating to the protection of personal data.
Article 31(2) requires them to support the officer with the resources necessary to perform the tasks and maintain expert knowledge, and with access to personal data and processing operations. Article 31(3) requires them to ensure that the officer receives no instructions regarding the exercise of the tasks, that the officer is not dismissed or penalized for performing them, and that the officer reports directly to the highest management level.
Article 31(6) allows the officer to perform other tasks and duties and requires the controller and the processor to ensure that these do not result in a conflict of interests.
Article 32(1) sets the officer's minimum tasks: to inform and advise the controller, the processor and the staff who process data of their obligations, to monitor compliance with the law and with the controller's policies, to advise on the impact assessment and monitor its performance, to cooperate with the CNPD and to act as its contact point. Lei n.º 121/IX/2021 entered into force thirty days after its own publication on .
When LexLint raises it
When your app profile says your app crawls the web, trains models, processes biometric data or handles health records.