LexLint.ioBeta

Know the law your code answers to.

Law / Niger

Loi n° 2022-59, droits des personnes concernées

Loi n° 2022-59, arts. 51-52 (part) et 68-76 (droits des personnes concernées)

In force.

A data subject rights rule binding public and private bodies.

Obligation class
Data subject rights, Disclosure, Access restriction, Prohibition
Audit expectation
none

What it requires

  • Give the data subject information about the processing no later than the time you collect their data.NIST Privacy FrameworkCM.AW-P1
  • Let a data subject access their data directly, on-site or by copy, and answer their request; where direct access is impossible for processing touching state security, defence or public safety, route the request through the HAPDP instead.NIST Privacy FrameworkCT.DM-P1
  • Correct, complete, update, lock or erase inaccurate, incomplete, ambiguous or outdated data within one month of a request from the person or a deceased person's heirs.NIST Privacy FrameworkCT.PO-P3
  • Do not use a person's data for direct marketing without their prior consent, and stop processing their data for direct marketing, free of charge, as soon as they object, telling them of that right before you first use or disclose their data for that purpose.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.PO-P3
  • Erase a person's data on request where consent is withdrawn, the processing purpose has lapsed, the processing is unlawful, or the data concerns a minor, unless a listed retention ground applies.NIST Privacy FrameworkCT.DM-P4
  • Where you have made a person's data public online, take reasonable steps, including technical measures, to tell any third party processing that data to remove links to it, or any copy or reproduction, on the person's request (the right to digital erasure).NIST Privacy FrameworkCM.AW-P5
  • Let a person obtain a temporary freeze on the use of some of their data on request (the right to restriction of processing).NIST Privacy FrameworkCT.PO-P3
  • Give a person a copy of their data in a structured, commonly used, machine-readable electronic format on request, and do not oppose the person transmitting their data to another controller, as far as the state of technology allows.NIST Privacy FrameworkCT.DM-P6NIST Privacy FrameworkCT.DM-P2
  • Let a person know and contest the information and reasoning used in any processing of their data, automated or not, whose results are used against them, and, where the processing involves artificial intelligence, tell them the criteria and the nature of the personal data behind it from the point of collection.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P1

These lines are LexLint's reading of the law's text.

In the frameworks

NIST AI RMF
  • MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.
NIST Privacy Framework
  • CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
  • CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
  • CT.DM-P1Data elements can be accessed for review.
  • CT.DM-P2Data elements can be accessed for transmission or disclosure.
  • CT.DM-P4Data elements can be accessed for deletion.
  • CT.DM-P6Data are transmitted using standardized formats.
2 more
  • CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
  • CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
FINOS AIGF

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Who may demand the log

Data subject

Logging duty

Under article 73 the controller must, on a written request, justify to the data subject at no cost that it carried out the erasure steps within one month, and the burden of proof falls on the controller in a dispute; article 71 sets the same duty for the update made after a death. The Act names no log, but a controller can justify those steps only from a record of them. Article 74 has the controller examine periodically the need to keep published data, which reviews the data and not a record, so no audit is expected. The row cites no scope clause, so no territorial hook is listed.

Kind
Implicit
As of
Provision
Articles 71 and 73
Trigger
personal_data_processing

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 68 requires the controller to give the data subject information about the processing no later than the time of collection.

Article 69 gives a data subject a direct right of access to their data, by on-site consultation or by copy, and lets the HAPDP exercise that access on the person's behalf, ordering rectification, erasure or locking of non-compliant data, when direct access is impossible; article 70 substitutes an indirect right of access through a HAPDP-designated investigator for processing touching state security, defence or public safety.

Article 71 gives a person, or a deceased person's heirs, the right to have inaccurate, incomplete, ambiguous or outdated data rectified, completed, updated, locked or erased within one month of the request.

Article 51 bars any direct-marketing solicitation using a person's data without their prior consent, and article 72 gives a person the right to object to processing for legitimate reasons particular to their situation and an unconditional right to object, free of charge, to processing for direct marketing, with prior notice before their data is first used or disclosed for that purpose.

Article 73 gives a person the right to erasure of unlawfully processed, withdrawn-consent or purpose-lapsed data, including data concerning a minor, subject to listed retention exceptions, and article 74 gives a right to digital erasure requiring the controller to tell any third party who processed data made public online to delete it as well. Article 75 gives a right to a temporary freeze on the use of some of a person's data.

Article 76 gives a right to receive a copy of one's data in a structured, commonly used, machine-readable format and to transmit one's data to another controller, as far as the state of technology allows, without the first controller's opposition.

Article 52 gives every person the right to know and contest the information and reasoning used in any processing of their data, automated or not, whose results are used against them, and, where the processing involves artificial intelligence, requires the criteria and nature of the personal data behind it to be given to the person from the point of collection.

Article 113, the closing article, orders publication in the Journal Officiel and execution as a law of the State, but names no day of the Law's own entry into force, and no commencement notice has been located in the Journal Officiel.

When LexLint raises it

When your app profile says your app sends automated outreach or processes personal data.

Back to the example  ·  Lint your app

Page updated .