ComorosLaw on the Protection of Personal Data, rights of data subjects
Loi n° 14-029/AU, arts. 10-18, 48 (rights of data subjects)
In force.
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Access restriction
- Audit expectation
- none
What it requires
- Let a data subject object, on legitimate grounds, to the processing of their personal data.NIST Privacy FrameworkCT.PO-P3
- Let a data subject object, free of charge and without needing to state a reason, to their personal data being used for commercial, charitable or political prospecting.NIST Privacy FrameworkCT.PO-P3
- Tell a data subject, when you collect their personal data directly from them, your identity, the processing's purpose, whether answering is mandatory, the recipients, and how to exercise the rights of objection, access and rectification.NIST Privacy FrameworkCM.AW-P1
- Answer an access request with the information in clear language and a copy on payment of no more than the Commission's scale fee, unless the Commission has granted you a response delay or let you disregard a manifestly abusive request.NIST Privacy FrameworkCT.DM-P1
- Correct, complete, update, lock or erase personal data on a data subject's request when it is inaccurate, incomplete, ambiguous, outdated, or unlawfully collected, used, disclosed or retained; where you passed the information to a third party, notify that third party of its rectification or cancellation, unless the Commission has dispensed you from doing so.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P5
- Let access to medical information be exercised only through a physician the data subject designates.NIST Privacy FrameworkCT.DM-P1
- Tell a network communication user, clearly and completely, the purpose of accessing or storing information in their terminal equipment and the means available to object to it, unless the access or storage has the exclusive purpose of enabling or facilitating electronic communication or is strictly necessary to provide an online communication service at the user's express request.NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 10 to 18 give the rights to object, to be informed, to access, to rectify and to indirect access, and Article 48 requires information on access to a user's terminal equipment. They require notices, copies and corrections and name no log, register or record the controller must keep. Article 15 puts the burden of proof on the service where the right of access is exercised and the accuracy of data is contested, which allocates proof in a dispute and does not require a record to be kept. Article 14 asks that a communication match the content of the records, which refers to the data themselves. The articles have no territorial clause. The Comoros text cited is the law as deliberated and adopted by the Assemblee de l'Union on , reproduced by ANADEN; no promulgation or Official Gazette copy was read.
- Kind
- None
- As of
What this law does
Article 10 gives a data subject the right to object, on legitimate grounds, to processing of their personal data, and article 11 gives them a further right, free of charge and without needing to state a reason, to object to their data being used for commercial, charitable or political prospecting.
Article 12 requires a controller collecting data directly from the data subject to disclose its identity, the processing's purpose, whether answering is mandatory, the recipients, and how the rights of objection, access and rectification are exercised.
Article 13 gives a person the right to ask a body running a listed automated processing whether it holds data concerning them, and article 14 gives the holder of that right of access communication of the information in clear language and a copy on payment of a scale fee the Commission sets, subject to a response delay or the disregard of manifestly abusive requests the Commission may grant.
Article 15 lets a data subject demand correction, completion, updating, locking or erasure of data that is inaccurate, incomplete, ambiguous, outdated, or unlawfully collected, used, disclosed or retained.
Article 16 lets a file be completed or corrected, even on the controller's own initiative, on the Commission's favorable opinion, and requires the rectification or cancellation of information that was passed to a third party to be notified to that third party, unless the Commission grants a dispensation. Article 18 lets access to medical information be exercised only through a physician the data subject designates.
Article 48 requires a controller to tell a network communication user, clearly and completely, the purpose of accessing or storing information in their terminal equipment and the means available to object to it. That duty does not apply where the access or storage has the exclusive purpose of enabling or facilitating electronic communication or is strictly necessary to provide an online communication service at the user's express request.
Article 48 also requires information under article 14 to be given to a data subject the data was not collected from on recording the data or, where disclosure to third parties is envisaged, at the latest at the first communication of the data. The Law names no day for its entry into force, and no promulgation decree or commencement notice for it has been located.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .