MaliLoi n° 2013-015, rights of data subjects
Loi n° 2013-015, arts. 12-19 (rights of data subjects)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Access restriction
- Audit expectation
- none
What it requires
- Answer an access request free of charge and without delay with all data concerning the person in an understandable form, its available origin, and the information and reasoning used in any automated processing whose results are used against them.NIST Privacy FrameworkCT.DM-P1
- Rectify, complete, update, block, or delete inaccurate, incomplete, ambiguous, outdated, or unlawfully processed personal data on a person's written request, justify within thirty days that you have done so, and notify any third party the data were transmitted to of the correction.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P5
- Where a processing concerns State security, national defence, or public security, route an access or rectification request to the Autorité de Protection des Données à Caractère Personnel instead of answering it yourself.NIST Privacy FrameworkCT.PO-P3
- At collection, or before transmitting data you did not collect directly, tell the person your identity, the purposes of processing, the categories of data, the recipients, whether answering is obligatory or optional and the consequences of not answering, their right to ask to no longer appear in the file, their rights of access and rectification, the retention period, and any transfer abroad you envisage.NIST Privacy FrameworkCM.AW-P1
- Before accessing or writing information to a user's connection terminal equipment over an electronic communication network, clearly and completely tell them the purpose and how to object, unless doing so is solely to enable the communication itself or is strictly necessary to supply a service the user expressly asked for.NIST Privacy FrameworkCM.AW-P1
- Honor a person's right to object, for legitimate reasons, to processing of data concerning them, and tell them, before their data are first communicated to or used on behalf of third parties for prospecting purposes, of their free right to object to that communication or use.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Data subject
Logging duty
Article 13 makes the controller justify to a person who asks for rectification, completion, updating, locking or erasure, within thirty days of the request being registered, that it has carried out the operations required, and puts the burden of proof on the controller in a dispute; that can only be shown from a record of what the controller did with the request. The thirty days is a response period, not a retention period. Articles 12 and 14 to 19 (access, indirect access, information, objection) name no log or register, and no review of the record is stated.
- Kind
- Implicit
- As of
- Provision
- Article 13
- Trigger
- personal_data_processing
What this law does
Article 12 gives every person the right to obtain from a controller, free of charge and without delay, communication in an understandable form of all data concerning them and any information available on its origin, together with the information and reasoning used in any automated processing whose results are used against them, and lets the Autorité order appropriate measures where data risk being concealed or made to disappear.
Article 13 gives a person who proves their identity the right to have inaccurate, incomplete, ambiguous, outdated, or unlawfully processed data rectified, completed, updated, blocked, or deleted, requires the controller to justify, free of charge and within thirty days of a written request, that it has done so, puts the burden of proof on the controller in case of dispute, and requires the controller to notify any third party the data were transmitted to of the corrections made.
Article 14 routes an access or rectification request to the Autorité, rather than to the controller directly, where the processing concerns State security, defence, or public security, and has the Autorité designate one of its members to investigate and secure the necessary corrections.
Articles 15 and 16 require a controller, whether or not the data are collected directly from the person concerned, to give that person, at collection or on transmission, the controller's identity, the purposes of the processing, the categories of data, the recipients or categories of recipients, whether answering is obligatory or optional and the consequences of not answering, the right to ask to no longer appear in the file, the rights of access and rectification, the retention period, and any transfer of the data abroad that is envisaged; article 17 exempts processing the State carries out for State security, national defence, public security, or the execution of criminal sentences, and processing necessary to prevent, investigate, establish, or prosecute an offence or to protect an important economic or financial interest of the State, to the extent the limitation is necessary.
Article 18 requires a controller to clearly and completely inform anyone using electronic communication networks of the purpose of any action to access or write information to their connection terminal equipment and of the means available to object to it, except where the access or writing is solely to enable the electronic communication or is strictly necessary to supply an online communication service the user expressly requested.
Article 19 gives every person the right to object, for legitimate reasons, to processing of data concerning them, the right to be informed before their data are first communicated to or used on behalf of third parties for prospecting purposes, and the right to be told, free of charge, of their right to object to that communication or use.
When LexLint raises it
When your app profile says your app sends automated outreach, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .