MadagascarLaw No. 2014-038, rights of data subjects
Loi n° 2014-038, arts. 22-27 (droits des personnes)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Access restriction
- Audit expectation
- none
What it requires
- Honour a data subject's request, made on a legitimate ground and free of charge, to object to processing of their data, and stop processing for prospecting purposes as soon as they object to it, without requiring a reason.NIST Privacy FrameworkCT.PO-P3
- Answer a request for access free of charge and without delay, giving the purposes, the data categories, the recipients, the data itself and its origin, and enough information to understand and contest any automated decision-making logic behind a decision that has legal effects.NIST Privacy FrameworkCT.DM-P1
- Rectify, complete, update, block, or erase inaccurate, incomplete, outdated, or unlawfully held data on request, free of charge, and tell any third party the data were disclosed to of the change.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P5
- Tell a person, when you collect their personal data, who you are, the purpose of the processing, whether the information is mandatory or optional, the data categories, the recipients, their rights of objection, access, and rectification, and any transfer and its safeguards, and give the same notice, including how to object, before storing or reading information on their communications-terminal equipment.NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Data subject
Logging duty
Article 25 requires the controller, on the data subject's request, to show without charge that it carried out the rectification, completion, update, blocking or erasure demanded, and puts the burden of proof on the controller in a dispute, which can only be met from a record of what was done. Articles 22 to 24, 26 and 27 give the rights of objection, access, indirect access and information and state no record. The justification is made to the data subject in answer to a rights request and is not a review of a kept record, so no audit is expected. The register of processing duty is in Articles 43 and 51, which are not cited on this row.
- Kind
- Implicit
- As of
- Provision
- Article 25
- Trigger
- personal_data_processing
What this law does
Article 22 gives a person with a legitimate reason the right to object at any time and free of charge to processing of personal data concerning them, gives an unqualified right to object to processing for prospecting purposes, and lets the CMIL judge a disputed reason's legitimacy, though the right does not apply where the processing meets a legal obligation or where the act authorizing the processing has expressly excluded it.
Article 23 gives every person the right to know whether they are concerned by a processing operation and, on proof of identity, to obtain the purposes, the categories of data processed, the recipients, the data itself in an intelligible form and its origin, and enough information to understand and contest automated logic behind a decision with legal effects, free of charge and without delay, and, for health data, directly or through a doctor the person designates; these access rights do not apply to processing concerning public security or the detection and prosecution of offenses, which article 26 governs instead.
Article 24 lets the controller refuse a manifestly abusive request, judged by its number or its repetitive or systematic character, with the burden of proving abuse on the controller who received it.
Article 25 gives a person the right to have inaccurate, incomplete, ambiguous, outdated, or unlawfully held, used, disclosed, or retained data rectified, completed, updated, blocked, or erased free of charge, and requires the controller to notify any third party the data were disclosed to of the changes made.
Article 26 substitutes an indirect procedure through a CMIL member drawn from the judiciary for the ordinary access and rectification rights where the processing concerns State security, defense, or public security.
Article 27 requires the controller to make sure the person data are collected from is told the controller's identity, the purpose of the processing, whether supplying the information is mandatory or optional, the data categories, the recipients, the rights of objection, access, and rectification and how to exercise them, and, where relevant, the transfers made and their article 20 safeguards, and requires equivalent clear notice, including the means to object, before storing or reading information on a user's terminal equipment for electronic communications, unless that access serves only to carry the communication or is strictly necessary for a service the user expressly requested; where data were not collected from the person, the same information is due when the data are recorded or, if disclosure to a third party is planned, by the first such disclosure at the latest.
When LexLint raises it
When your app profile says your app sends automated outreach, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .