MontenegroLaw on Personal Data Protection, rights of the data subject
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Give a person from whom you collect personal data directly notice of your name and address, the purpose and legal basis of processing, the third party or user and the legal basis for disclosing to it, whether giving the data is mandatory or voluntary, and their rights of access and rectification, under Article 20, and give a similar notice no later than immediately before processing begins where the data were not collected directly, under Article 21.NIST Privacy FrameworkCM.AW-P1
- Erase personal data whose processing does not comply with the law on the person's request, under Articles 23 and 44.NIST Privacy FrameworkCT.DM-P4
- Answer a person's written request within 15 days, telling them whether personal data concerning them is processed and, if it is, the controller's identity, the content of the data, the purpose and legal basis, the source and the third party or user, under Article 43.NIST Privacy FrameworkCT.PO-P3
- Supplement or alter incomplete data and erase inaccurate or unlawfully processed data within 15 days of a person's written request, and notify the person and any third party of the change within eight days, under Article 44.NIST Privacy FrameworkCT.DM-P3NIST Privacy FrameworkCM.AW-P5
- Expect the rights in Articles 43 and 44 to be restricted only for defence, national or public security, the prevention, detection and prosecution of criminal offences, protection of economic or financial interests, or protection of the person or the rights and freedoms of others, to the extent necessary and in accordance with a special law, under Article 45, and bear the cost of an Article 43 or 44 proceeding yourself, under Article 46.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P3Data elements can be accessed for alteration.
- CT.DM-P4Data elements can be accessed for deletion.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 20 and 21 require notice to the person, Article 23 requires deletion of unlawfully processed data on request, and Articles 43 to 46 give the rights of access, correction and deletion within 15 days and allow limits on them. These articles tell the controller to notify and to act on requests, and they state no duty to create, keep or produce a log or record. The Article 19 record of third parties and users, which would answer an access request, is outside the cited articles. Article 11 was deleted in 2012. Article 5, the territorial scope clause, is not cited by this row, so no hook is recorded.
- Kind
- None
- As of
What this law does
Article 11 was deleted by the 2012 amendments (Official Gazette of Montenegro No. 44/12) and is no longer law; the right to have unlawfully processed data erased now rests on Articles 23 and 44.
Article 20 requires the controller, unless a special law provides otherwise, to give a person from whom it collects data directly notice of its name and address, the purpose and legal basis of processing, the third party or user and the legal basis for disclosing to it, whether giving the data is mandatory or voluntary and the consequences of refusing, and the rights of access and rectification.
Article 21 imposes a similar duty, no later than immediately before processing begins, where the data were not collected directly from the person, with an exception for statistical or scientific research use and processing prescribed by law where notice is impossible or disproportionate. Article 23 requires the controller to erase personal data, on the person's request, if their processing does not comply with the law, and suspends access to the data while the request is being decided.
Article 43 requires the controller to tell a person, on written request and within 15 days of the request, whether personal data concerning him are processed, and if they are, the controller's identity, the content of the data, the purpose and legal basis, the source and the third party or user. Article 44 requires the controller, on written request and within 15 days, to supplement or alter incomplete data, erase inaccurate data and erase data whose processing does not comply with the law.
Article 44 also requires the controller to notify the person and any third party of the change within eight days, and gives a person whose request is refused the right to object to the controller or seek protection from the supervisory authority.
Article 45 lets the rights in Articles 43 and 44 be restricted for defence, national and public security, the prevention, detection and prosecution of criminal offences, the protection of economic or financial interests, or the protection of the person or the rights and freedoms of others, to the extent necessary and in accordance with a special law, and Article 46 puts the cost of an Article 43 or 44 proceeding on the controller.
The Law as first enacted came into force on and has applied since . The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .