MauritaniaLoi n° 2017-020, droits de la personne concernée
Loi n° 2017-020 du 22 juillet 2017, arts. 18, 50-63 (droits de la personne concernée)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Consent
- Audit expectation
- none
What it requires
- Do not process a person's personal data once they have validly objected, including where the processing serves commercial prospecting.NIST Privacy FrameworkCT.PO-P3
- Tell the person, at the time of collection, who is responsible for the processing, its purpose, the categories of data, whether a reply is mandatory or optional, and any recipients, and let them access, object to, correct, or delete their data on request.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.PO-P3
- Where you did not collect the data from the person directly, give them the same information when you record it or, if you plan to disclose it, no later than the first disclosure.NIST Privacy FrameworkCM.AW-P1
- Do not access or write information on a user's terminal equipment, and do not condition access to a service on accepting that, without telling the user its purpose and how to object, unless the access only enables the communication or is strictly necessary for a service they expressly requested.NIST Privacy FrameworkCM.AW-P1
- Give a person, on written request, access to their data in an accessible and intelligible form and its origin, and a copy on payment of no more than the reproduction cost.NIST Privacy FrameworkCT.DM-P1
- Correct, complete, update, block, or delete a person's data within one month of a written request where it is inaccurate, incomplete, ambiguous, outdated, or unlawfully processed, notifying any third party the data was disclosed to, and honour the same request from their heir after their death.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Data subject
Logging duty
Article 62 requires the controller, when the person asks in writing in any form, to justify without charge that it carried out the rectification, completion, update, blocking or erasure within one month, and puts the burden of proof on the controller when that is disputed; article 63 gives the heirs of a deceased person the same justification. A controller can show what it did only from a record of the operation, but the clause names no log and sets no contents, so the contents are left empty. The justification goes to the person who asked, so the data subject is the party named, and no audit or retention period is stated. Articles 50 and 51 require notices to the person, including the retention period of the data, which concern the data and not a log; article 55 lets the person refer a suspected mismatch to the Authority, whose verification power is coded on the authority row.
- Kind
- Implicit
- As of
- Provision
- Article 62 (with article 63 for heirs)
- Trigger
- personal_data_processing
What this law does
Article 50 requires a controller collecting data directly from the person to tell them, at the latest when collecting it, who is responsible for the processing, its purpose, the categories of data, the recipients, whether a reply is mandatory or optional and the consequences of not replying, their access, rectification and objection rights, the retention period, any transfer abroad, and their right to be removed from the file, subject to exemptions for state security, defence, public security, criminal enforcement, and major economic or financial interests of the State.
Article 51 requires that same information to be given, when data is not collected from the person, at the time it is recorded or, if disclosure is planned, no later than the first disclosure.
Article 52 requires a controller accessing or writing information on a user's terminal equipment to tell the user its purpose and how to object, bars conditioning access to a service on accepting that processing, unless the access only enables the communication or is strictly necessary for a service the user expressly requested.
Articles 53 and 54 give a person a written right to access their data in an accessible and intelligible form, its origin, and a copy on payment of no more than the reproduction cost, and article 55 lets them refer a suspected mismatch between the data disclosed and the data actually processed to the Authority for verification.
Article 56 lets a patient's access right be exercised through a physician they designate, article 57 lets a controller resist manifestly abusive requests while carrying the burden of proving abuse, and article 58 routes access to a state security, defence or public security processing through an Authority member who investigates and decides what can be disclosed.
Article 59 gives a person the right to object, without cost, to processing of their data, to be told before their data is first disclosed to or used by a third party for prospecting, and to object to that disclosure or use free of charge, unless the processing meets a legal obligation, and article 60 gives a right to object to the lifting of professional secrecy concerning them, subject to the legal exceptions, while article 18 separately bars sending a person direct marketing communications by any means before they have expressed prior consent to receive them.
Articles 61 through 63 let a person demand that inaccurate, incomplete, ambiguous, outdated, or unlawfully processed data about them be corrected, completed, updated, blocked, or deleted, require the controller to prove compliance within one month at no cost and to notify any third party the data was disclosed to, and let an heir make the same demand to reflect the person's death.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .