MozambiqueElectronic Transactions Law, data subject rights and information notice
Lei n.º 3/2017, de 9 de Janeiro, arts. 63(3)-(4), (6), 65(2) (direitos do titular dos dados)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://archive.gazettes.africa/archive/mz/2017/mz-government-gazette-series-i-dated-2017-01-09-no-5.pdfIn force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Where personal data was not collected from the data subject directly, give the subject the reason it was collected and your identity as the processor, by the time the data is first disclosed to a third party, unless notice is impossible, disproportionately burdensome, permitted by law, or the data is collected for statistical, historical, or scientific purposes.NIST Privacy FrameworkCM.AW-P1
- On a data subject's request, confirm whether their personal data is held and communicate it to them within a reasonable period on payment of a fee, and give the reasons where you refuse either request.
- Where a data subject objects to data concerning them and the objection is accepted, remove, rectify, complete, or alter it.NIST Privacy FrameworkCT.PO-P3
- Make available to any person specific information about your policies and practices for managing personal information, including who to contact with a complaint or question, how to obtain access to personal information you retain, and a description of the type of personal information retained and its general use.NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 63(3), (4) and (6) and article 65(2) give the data subject notice of why data was collected, access on request with reasons for a refusal, a right to object and have data removed or corrected, and a public statement of the processor's information policies and practices. They require the processor to give reasons and information to people, not to keep a log, register or record, and no audit is named. English of the pinned clause: the data processor must make specific information about its policies and practices on managing personal information available to any person. The cited provisions carry no scope clause, so there is no territorial hook.
- Kind
- None
- As of
What this law does
Article 63(3) requires the data processor, where personal data was not collected from the data subject directly, to give the subject the reason for collecting it and the processor's identity by the time the data is first disclosed to a third party. Article 63(4) excuses that notice where it is impossible, involves a disproportionate effort, is permitted by law, or the data is registered for statistical, historical, or scientific purposes.
Article 63(6) gives every person the right to obtain confirmation from a data controller of whether it holds data about them, to be told about that data within a reasonable period on payment of a fee, to receive a reasoned refusal where a request under either of those points is denied, and, where they object to data concerning them and the objection is accepted, to have it removed, rectified, completed, or altered.
Article 65(2) requires the data processor to make available to any person specific information about its policies and practices for managing personal information, including who is responsible for those policies and to whom a complaint or question should be directed, how to obtain access to personal information the processor retains, and a description of the type of personal information retained, including a general report of its use.
Article 75 brings the Law into force 90 days after its publication. The Law appears in the Boletim da República, I Série, n.º 5, as Lei n.º 3/2017 de 9 de Janeiro.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .