HondurasLey de Transparencia y Acceso a la Información Pública, protección de datos personales y hábeas data
In force since .
A sensitive categories rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not force a person to provide personal data that could cause them discrimination, or patrimonial or moral harm or risk.NIST Privacy FrameworkCT.PO-P1
- Keep personal data protected at all times, and let access to it proceed only by judicial order or at the request of the person whose data it is.NIST Privacy FrameworkPR.DS-P5
- Do not collect, transmit, disclose false personal data, or refuse to rectify or update it, outside the cases this law allows.NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text. Also read by: Instituto de Acceso a la Información Pública (IAIP) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- PR.DS-P5Protections against data leaks are implemented.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Article 29 sends an infringement of the Law that amounts to an offence to the offences against the public administration in the Código Penal; the Law states no term of imprisonment or fine of its own.
Who enforces it
Enforcement body
Instituto de Acceso a la Información Pública (IAIP), which reviews refused requests (Article 26) and imposes the administrative fines (Article 28); the Comisionado Nacional de los Derechos Humanos and the Ministerio Público may bring the legal actions needed to protect personal data (Article 24)
Settledness
- As of
- Guidance link
- https://portalunico.iaip.gob.hn/preguntas_frecuentes
- Guidance body
- Instituto de Acceso a la Información Pública (IAIP)
- Open questions
- Which monthly minimum wage fixes the fine of 'medio salario hasta cincuenta (50) salarios mínimos mensuales' that the IAIP imposes under Article 28 of the Ley de Transparencia?
What it reaches
Obligation class
Disclosure, Data subject rights
Applicability criteria
Article 25 forbids forcing another to provide personal data in terms that name no obligated institution; the administrative infractions of Article 27(4) concern data held by an obligated institution.
- As of
- Combinator
- Any of
- Criteria
- The holder is a State body: the Legislative, Judicial or Executive Branch, an autonomous institution, a municipality or another organ or institution of the State (Article 3(4)(a)).
- The holder is an NGO, a private development organization or any natural or legal person that in any capacity receives or administers public funds, whatever their origin (Article 3(4)(b)).
What it makes you log
Logging duty
Articles 23 to 25 recognize Habeas Data, say that personal data are always protected and may be reached only by judicial decree or at the request of the person concerned, and bar forcing a person to give data that could cause discrimination or harm. Articles 27 to 29 set the infractions and sanctions, including for collecting, transmitting or disclosing personal data outside the cases the law allows or refusing to rectify them. None of these articles requires a log or a record. Article 3(7), which defines confidential personal data, is a definition and adds no record. The cited articles state no territorial hook.
- Kind
- None
- As of
What this law does
Article 3(7) defines confidential personal data as information relating to ethnic or racial origin, physical, moral or emotional characteristics, home address, private telephone number, private email address, political participation or affiliation, political ideology, religious or philosophical beliefs, physical or mental health status, personal or family assets, and anything else touching honor, personal or family privacy, or one's own image.
Article 25 bars any person from forcing another to provide personal data that could cause discrimination or patrimonial or moral harm or risk, a general prohibition not limited to an obligated institution.
Article 24 states personal data shall always be protected, and lets the data subject, the National Human Rights Commissioner acting for the affected party, or the Public Prosecutor's Office bring the legal actions needed for its protection, with access to the data proceeding only by judicial order or at the request of the person whose data it is.
Articles 27 to 29 sanction an obligated institution's staff who improperly collect, transmit, disclose or refuse to correct false personal data with a written warning, suspension, fine, dismissal or removal for administrative infractions, a fine of half to fifty monthly minimum wages imposed by the IAIP, and referral to the Código Penal's public-administration offences where the conduct is a crime.
Article 39 provides that the Habeas Data articles of this law did not take effect on the law's own 2006 commencement date but only once the corresponding constitutional reform was ratified.
Back to the example · Lint your app
Page updated .