LexLint.ioBeta

Know the law your code answers to.

Law / Monaco

Loi sur la Protection des Données Personnelles, droits de la personne concernée

Loi n. 1.565 du 3 decembre 2024, arts. 10-18, 20 (rights of the data subject)

In force since .

A data subject rights rule binding public and private bodies.

Obligation class
Data subject rights, Disclosure, Access restriction
Audit expectation
none

What it requires

  • Act on a data subject's rights request concisely, understandably, and in an easily accessible form, in clear and plain language, with particular care where the information is meant for a minor, and answer within one month of receipt, extendable by two months for a complex or repeated request.NIST Privacy FrameworkCT.PO-P3
  • Tell a person, at the point you collect their data, who you are, the purposes and legal basis of the processing, any legitimate interest relied on, the categories of data, the retention period or the criteria for setting one, whether a reply from them is mandatory, the right to withdraw consent, the recipients, how to exercise their rights, the right to complain to the Authority, whether automated decision making including profiling is in use, and any transfer outside Monaco and its safeguards.NIST Privacy FrameworkCM.AW-P1
  • Answer an access request with confirmation of processing, a copy of the data in an intelligible form, and the Article 12 information, in the electronic form the person asks for where they submit the request electronically.NIST Privacy FrameworkCT.DM-P1
  • Correct inaccurate or incomplete personal data without delay on request, including by adding a supplementary statement.NIST Privacy FrameworkCT.DM-P3
  • Erase personal data without delay on request in the listed cases, such as withdrawn consent with no other legal basis, a successful objection, data no longer necessary for its purpose, unlawfully processed data, or data collected from a minor for an information society service, and tell any third party you disclosed it to that it must be erased too.NIST Privacy FrameworkCT.DM-P4NIST Privacy FrameworkCM.AW-P5
  • Restrict processing on request in the listed cases, keep the data stored but otherwise untouched without the person's consent while the restriction lasts, and tell the person before you lift it.NIST Privacy FrameworkCT.PO-P3
  • Notify every recipient the data were disclosed to of a rectification, erasure, or restriction, unless that is impossible or would take disproportionate effort.NIST Privacy FrameworkCM.AW-P5
  • Stop processing a person's data for direct marketing, including any profiling tied to it, the moment they object, and flag that right to them clearly and separately no later than the first communication.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P1
  • Give a person their data in a structured, commonly used, machine readable format on request, and transmit it directly to another controller where that is technically possible.NIST Privacy FrameworkCT.DM-P2
  • Let a deceased person's ascendant, descendant to the second degree, surviving spouse, cohabitant, or registered partner exercise the access, rectification, erasure, restriction, objection, and portability rights over that person's data where they show an interest.NIST Privacy FrameworkCT.PO-P3

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
  • CT.DM-P1Data elements can be accessed for review.
  • CT.DM-P2Data elements can be accessed for transmission or disclosure.
  • CT.DM-P3Data elements can be accessed for alteration.
  • CT.DM-P4Data elements can be accessed for deletion.
  • CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
1 more
  • CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
FINOS AIGF

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Logging duty

Articles 10 to 18 and 20 set how a controller answers rights requests (within one month, extendable by two), what it tells a person at collection, and the rights of access, rectification, erasure, restriction, portability and objection, and Article 20 lets close relatives exercise a deceased person's rights. They are duties to inform and to act on a request; none requires the controller to make, keep or produce a log or record. Article 10 puts the burden of showing that a request is manifestly unfounded or excessive on the controller, which names no record. The register of Article 27 and the demonstration duty of Article 22 sit outside the articles this row cites and are not borrowed. No scope clause is cited.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 10 requires the controller to act on a rights request concisely, understandably, and in an easily accessible form, in clear and plain language, with particular care where the information is meant for a minor, and to answer within one month of receipt, extendable by two months for a complex or repeated request.

Article 11 lists what a controller must tell a person at collection, its identity and contact details, the purposes and legal basis of the processing, any legitimate interest relied on, the categories of data, the retention period or the criteria for setting one, whether a reply is mandatory, the right to withdraw consent, the recipients, how to exercise the access, objection, rectification, erasure, restriction, or portability rights, the right to complain to the Authority, the data protection officer's contact details if any, the existence of automated decision making including profiling, and any transfer outside Monaco and its safeguards under Articles 97 to 100.

Article 12 gives a right of access to confirmation of processing and a copy of the data, Article 13 a right to rectification, and Article 14 a right to erasure in the listed cases, including where the data were collected from a minor for an information society service and the person later asks for their removal.

Article 15 gives a right to restrict processing in the listed cases, and Article 16 requires every recipient the data were disclosed to be told of a rectification, erasure, or restriction unless that is impossible or disproportionately burdensome. Article 17 gives an unqualified right to object to processing for direct marketing, including any profiling tied to it, which the controller must flag separately no later than the first communication.

Article 18 gives a right to receive personal data in a structured, commonly used, and machine readable format and to have it transmitted directly to another controller where technically possible. Article 20 lets a deceased person's ascendant, descendant to the second degree, surviving spouse, cohabitant, or registered partner exercise the access, rectification, erasure, restriction, objection, and portability rights over that person's data where they show an interest.

When LexLint raises it

When your app profile says your app sends automated outreach, makes high-risk automated decisions or processes personal data.

Back to the example  ·  Lint your app

Page updated .