LiechtensteinDatenschutzgesetz (DSG), Chapter III, record of processing categories and logging
Datenschutzgesetz (DSG), LGBl. 2018 Nr. 272, Articles 69 and 75
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- If you process personal data for a Liechtenstein authority responsible for criminal prosecution or the enforcement of penalties, keep a record of the categories of processing you carry out for it, and make it available to the Datenschutzstelle on request.
- In an automated system that processes personal data for such an authority, log collection, alteration, consultation, disclosure including transfer, combination and erasure, record the justification, date and time and, as far as possible, the person and the recipient for consultations and disclosures, erase the logs at the end of the year after they were generated, and make them available to the Datenschutzstelle on request.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator, Data subject
What the log must hold
Event time, Actor identity, Decision basis, Access record
Log retention
Article 75(4) sets a deletion deadline rather than a minimum: the log data are erased at the end of the year after the year they were generated, so a log is kept for between one day and just under two years. Article 69 sets no period for the record of processing categories; its paragraph 1(h) concerns the deletion periods for the personal data.
- Unit
- Years
- As of
- Basis
- Fixed
- Maximum value
- 2
Logging duty
Article 69 has the controller keep a record of all categories of processing activities, with the contents in paragraph 1, and the processor a record of the categories of processing it carries out for a controller (paragraph 2); both are made available to the Datenschutzstelle on request (paragraph 4). Article 75 has the controller and the processor log the six operations in paragraph 1, with the justification, the date and time and, as far as possible, the person and the recipient for consultations and disclosures (paragraph 2). The logs may be used only for the purposes in paragraph 3, naming the data protection officer, the Datenschutzstelle and the person concerned among those who check lawfulness, and must be erased at the end of the year after they were generated (paragraph 4). Article 64(5), the breach documentation, and Article 78(2), the documentation of transfers on the controller's own assessment, are carried by the existing rows for Articles 43, 64 and 65 and for Articles 77 to 80. The chapter's own scope article (Article 45) limits it to public bodies in the criminal-justice field and is not a section this row cites, so no territorial hook is set.
- Kind
- Explicit
- As of
- Provision
- DSG Articles 69 and 75
- Trigger
- personal_data_processing
What this law does
In the criminal-justice field that Chapter III of the Datenschutzgesetz governs (the public bodies responsible for preventing, investigating, detecting or prosecuting criminal offences or enforcing penalties, and their processors), the controller must keep a record of all categories of processing activities in its responsibility, and a processor a record of the categories of processing it carries out for a controller, in writing or electronically.
Both must make the records available to the Datenschutzstelle on request. In automated processing systems the controller and the processor must log collection, alteration, consultation, disclosure including transfer, combination and erasure; the logs of consultations and disclosures must show the justification, the date and time and, as far as possible, who consulted or disclosed the data and who received them.
The logs may be used only to check the lawfulness of processing by the data protection officer, the Datenschutzstelle and the person concerned, for self-monitoring, for the integrity and security of the data and for criminal proceedings, and are erased at the end of the year after they were generated. The Datenschutzstelle can ask for them.
When LexLint raises it
When your app profile says your app crawls the web, trains models or sends automated outreach.