LibyaLaw No. 6 of 2022, protection of personal data collected in electronic transactions
Law No. 6 of 2022 Concerning Electronic Transactions arts. 73-75 (Protection of Personal Data: lawful basis, purpose limitation and confidentiality)
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent, Governance, Security
- Audit expectation
- none
What it requires
- Before collecting personal data for issuing, maintaining, or facilitating an authentication certificate, obtain the person's explicit consent, and do not use it for a different purpose without a further explicit consent.
- Do not collect, disclose, provide, or process personal data without the data subject's consent unless it is necessary to prevent or detect a crime under an official request from investigative bodies, required or permitted by law or a court decision, needed for a tax assessment or collection, or needed to protect the person's vital urgent interest.
- Keep personal data confidential and do not disclose, transfer, declare, or publish it without the data subject's prior consent.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does Article 76, which binds "Any person who controls personal data by virtue of his work in electronic transactions", reach a private operator that is neither a "public entity" nor an "authentication service provider", the only parties Article 73 names for collecting personal data?
- What level of protection is "appropriate" under Article 78 when personal data is transferred outside Libya, and which authority decides it?
What it makes you log
Logging duty
Article 73 lets a public entity or an authentication service provider collect personal data only after the person's explicit consent and only to issue, maintain or facilitate a certificate, Article 74 lists the grounds on which obtaining, disclosing or processing is otherwise legitimate, and Article 75 binds the authentication service provider to confidentiality procedures. None of the three requires a person to make, keep or produce a log or record: a consent that must be given is a condition of collection and the text does not say it must be recorded or shown. The notice and access duties (Articles 76 and 77) sit on a sibling row and are not borrowed. The Law names no scope clause in these articles that fixes a territorial hook.
- Kind
- None
- As of
What this law does
Article 73 requires a public entity or an authentication service provider to obtain a person's explicit consent before collecting their personal data, and confines any collection to the purpose of issuing, maintaining, or facilitating a certificate, absent the person's further explicit consent to a different purpose.
Article 74 lists narrow grounds on which collecting, disclosing, providing, or processing personal data is otherwise legitimate without that consent, including a criminal investigation, a court decision, a tax assessment, or protecting a person's vital urgent interest.
Article 75 binds the authentication service provider to follow appropriate procedures to ensure the confidentiality of personal data in its custody, and bars disclosing, transferring, declaring, or publishing it without the data subject's prior consent.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .