LebanonLaw No. 81/2018, Part V, notice, objection, access and correction
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Consent, Access restriction
- Audit expectation
- none
What it requires
- Tell the people you collect personal data from who you are or who your representative is, what the processing is for, whether answering is mandatory or optional, what follows from not answering, who the data will be sent to, and that they may access and correct it, and print that statement explicitly and clearly on the collection form itself.NIST Privacy FrameworkCM.AW-P1
- Where you did not collect the data from the person, tell them personally and explicitly what the data contains, what the processing is for and that they may object to it, unless they already know or telling them is impossible or takes an effort out of proportion to the benefit.NIST Privacy FrameworkCM.AW-P1
- Let a person object, for legitimate reasons, to the collection and processing of their personal data, including processing for commercial promotion, unless the law obliges you to collect it or they have already agreed to the processing.NIST Privacy FrameworkCT.PO-P3
- Let a person review and object, before the person responsible for processing, to the information and analyses used in the automated processing relating to them that is invoked against them.NIST Privacy FrameworkCT.PO-P3
- Answer a person's or their heir's question about whether their data is being processed, and give them a copy of the data at their request, in an understandable form where it is encoded, compressed or encrypted.NIST Privacy FrameworkCT.DM-P1
- Give, on the same request, the purposes, categories, source, subject and nature of the processing, the persons and categories of persons the data is sent to or who can access it, and the timing and purposes of that access.NIST Privacy FrameworkCT.DM-P1
- Charge no more than the cost of copying for that copy, and, if you refuse a request as arbitrary, repetitive or systematic, be ready to carry the burden of proving that it is.NIST Privacy FrameworkCT.PO-P3
- Correct, complete, update or erase personal data that is incorrect, incomplete, ambiguous, expired or incompatible with the purposes of processing, free of charge and within ten days of the request, and prove that you did it.NIST Privacy FrameworkCT.PO-P3
- Notify every third party the data was sent to of an amendment made at the request of its owner or their heirs, and make the same correction on your own initiative as soon as you learn of a reason to modify or cancel the data.NIST Privacy FrameworkCM.AW-P5NIST Privacy FrameworkCT.PO-P2
- Do not inform a person of processing that relates to the internal or external security of the State where informing them may endanger the objectives of the processing or that security.
- Mark an online promotional advertisement as a promotional advertisement and name the person it was placed for, send no unsolicited marketing email to a real person's name and address without their consent unless you obtained the address lawfully through a previous engagement with them, and put in every marketing email a reply address through which the recipient can ask to stop receiving them permanently and free of charge.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.PO-P3
- Expect Articles 99, 100 and 101 not to reach processing carried out solely for literary or artistic expression or for the professional exercise of journalism, within the limits of the laws in force.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 3.3Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Data subject
What the log must hold
Event time, Actor identity, Access record, Data lineage
Logging duty
Article 99 lets the person whose data is processed, or an heir, ask the processing officer for the persons and categories of persons to whom the data is sent or who can access it, with the timing and purposes of that access, and for the purposes, categories, source, subject and nature of the processing, which an officer can supply only from a record of disclosures and access. Article 101 requires the officer to carry out a requested correction, completion, update or erasure within ten days and to prove that it was performed. No article in this set names a log, fixes how long a record is kept or provides for anyone to review one. The court remedy in Article 102 carries no record duty of its own.
- Kind
- Implicit
- As of
- Provision
- Law No. 81 of 2018, Articles 99 and 101
- Trigger
- personal_data_processing
What this law does
Article 88 requires the processing officer or their representative to tell the people the data is taken from who the officer or representative is, what the processing is for, whether answering the questions is mandatory or optional, what follows from not answering, who the data will be sent to, and that they may access and correct it, and requires the collection form itself to carry that statement explicitly and clearly.
Article 89 extends the duty to data not collected from the person concerned, who must be told personally and explicitly what the data contains, what the processing is for and that they may object to it, unless they already know or telling them is impossible or would take an effort out of proportion to the benefit.
Article 92 gives every natural person the right to object, for legitimate reasons, to the collection and processing of their personal data, including collection and processing for the purpose of commercial promotion, except where the law obliges the officer to collect it or the person has agreed to the processing.
Article 86 gives everyone the right to review and object, before the processing officer, to the information and analyses used in the automated processing about them that is invoked against them.
Articles 99 to 101 carry the access and correction rights: the owner of the data or any of their heirs may ask whether their data is being processed and receive a copy of it, in an understandable form where it is encoded, compressed or encrypted, together with the purposes, categories, source, subject and nature of the processing and the identity of everyone the data is sent to or who can access it and when; the officer may charge no more than the cost of copying and may refuse only requests of an arbitrary, repetitive or systematic nature, carrying the burden of proving that character; and the officer must correct, complete, update or erase data that is incorrect, incomplete, ambiguous, expired or incompatible with the purposes of processing, free of charge and within ten days of the request, prove the work was done, notify any third party the data was sent to, and make the same correction on their own initiative once they learn of a reason for it.
Article 103 withholds that information where the processing relates to the internal or external security of the State and informing the person would endanger it, and Article 105 lifts Articles 99 to 101 from processing carried out solely for literary or artistic expression or for the professional exercise of journalism.
Article 32, in the electronic-commerce part of the same law, requires an online promotional advertisement to say that it is one and to name the person it was placed for, forbids unsolicited marketing email to a real person's name and address without that person's consent unless the address was lawfully obtained through a previous engagement with them, and requires every marketing email to carry a reply address through which the recipient can stop receiving them permanently and free of charge.
Article 136 makes the law effective three months after its publication in the Official Gazette, so these provisions bind today.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .