Equatorial GuineaLey de Protección de Datos Personales, derechos de los interesados
Ley Núm. 1/2016, arts. 13-14, 22, 24 (derechos de los interesados)
In force.
A data subject rights rule binding public and private bodies.
- Private right of action
- Yes
- Obligation class
- Data subject rights, Disclosure
As of .
What it requires
- Before asking a person for personal data, tell them expressly and concisely the purpose and consequences of the collection, the destination and recipients of the data, whether answering is mandatory or optional, the effects of refusing, the existence of files or processing, and the identity and address of the controller or its representative (Article 9).
- On a data subject's request, provide free of charge, by consultation or in writing, a copy of the information on their personal data under processing, the origin of that data and the communications made or planned (Article 13(a), which states a period of twelve months).
- Give effect to a data subject's request to rectify or cancel inaccurate or incomplete personal data within fifteen days from the date of the request (Article 13(d)).
- Compensate a data subject for the damage or injury that you or your processor cause them (Article 13(e)).
- Resolve within five days of receipt a complaint or request to exclude a person's data from publicly accessible sources or advertising use, and do so free of charge (Article 22).
- Where you provide credit-information services, notify the data subject within fifteen days of the data entered about them in your files, and tell them they may obtain information on all of it (Article 24).
- Cancel and remove from processing, on the data subject's simple free request, the data of a person who objects to its processing in the services Article 24 covers (Article 24).
These lines are LexLint's reading of the law's text, as of .
What this law does
Article 9 requires the persons from whom personal data is requested to be informed beforehand, expressly, concisely and without ambiguity, when the data is requested. They must be told the purpose and consequences of the collection, the destination of the data and its recipients, whether answering is mandatory or optional, the effects of refusing, the existence of files or processing, and the identity and address of the controller or its representative.
Article 13(a) provides that, within a period of twelve months, the data subject may request and obtain free of charge, by consultation or in writing, a copy of the information on their personal data under processing, the origin of that data and the communications made or planned. Article 13(d) lets the data subject rectify and request the cancellation of inaccurate or incomplete personal data, and obliges the controller to give effect to the request within fifteen days from its date.
Article 13(e) gives data subjects the right to compensation for the damage or injury the controller or processor causes them, enforceable before the ordinary jurisdiction for privately held files. Article 14 lets the controllers of files held for police or tax purposes deny the rights of access, rectification, objection or cancellation.
Article 22 gives data subjects a free right to have their personal data excluded from publicly accessible sources or advertising activity, a matter to be resolved within five days of receiving the complaint or request. Article 24 requires a provider of credit-information services that records payment-default data to notify the data subject, within fifteen days, of the data included in its files and to inform them of the right to obtain information on all of it.
Article 24 also gives data subjects the right to object to the processing of their personal data in those services, which must be cancelled and removed from processing on their simple, free request.
When LexLint raises it
When your app profile says your app sends automated outreach, crawls the web or trains models.