LibyaLaw No. 6 of 2022, notice, access and objection rights over personal data
Law No. 6 of 2022, arts. 76-77, 79 (Electronic Transactions, notice, access and objection)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Disclosure, Data subject rights
- Audit expectation
- none
What it requires
- Before processing a person's data, give them notice of who is responsible for the processing and the nature, purpose, and method of the processing.NIST Privacy FrameworkCM.AW-P1
- Let a person access and update the personal data collected about them, through appropriate technological means.NIST Privacy FrameworkCT.PO-P3
- Do not send a person electronic documents once they have explicitly refused to accept them, and stop processing their personal data once they have explicitly refused it.NIST Privacy FrameworkCT.PO-P3
- Do not process personal data where doing so causes harm to, or infringes the rights or freedoms of, the person it was collected from.NIST Privacy FrameworkCT.PO-P1
- Do not use a person's data for a purpose other than the one they agreed to without obtaining their consent.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 76 requires a person who controls personal data in electronic transactions to notify the data subject, before processing, of the protection procedures followed, Article 77 requires an authentication service provider to give the data subject electronic access to and the ability to update the data, and Article 79 bars sending electronic documents to, or processing data of, a person who refuses. A notice, a right of access and a bar on processing are duties of conduct toward the data subject; none requires the controller to make, keep or produce a log or record. The articles state no territorial hook.
- Kind
- None
- As of
What this law does
Article 76 requires any person who controls personal data by virtue of their work in electronic transactions to give the data subject, before processing, a special notification identifying who is responsible for the processing and the nature, purpose, methods, and locations of the processing.
Article 77 requires the authentication service provider to let the person whose data was collected access and update it, including all personal data sites related to them, through appropriate technological means. Article 79 bars sending electronic documents to a person who has explicitly refused them, bars processing personal data against the data subject's explicit refusal, and bars processing that causes harm to, or infringes the rights or freedoms of, the person the data was collected from.
Article 79 also bars using personal data for a purpose other than the one agreed to without the data subject's consent, echoing article 73's purpose limitation from the data subject's own side.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .