LexLint.ioBeta

Know the law your code answers to.

Law / Panama

Ley 81 de 2019, rights of data subjects

Ley 81 de 2019, arts. 15-18 and 21-23 (rights of data subjects)

In force since .

A data subject rights rule binding public and private bodies.

Obligation class
Data subject rights, Access restriction, Disclosure
Audit expectation
on_request
Who audits it
Regulator

What it requires

  • Let a data subject access their personal data held in your databases, free of charge, and tell them its origin and purpose.NIST Privacy FrameworkCT.DM-P1
  • Correct, cancel, or stop processing a data subject's personal data on request when it is incorrect, irrelevant, incomplete, outdated, inaccurate or false, and let them revoke consent.NIST Privacy FrameworkCT.PO-P3
  • Give a data subject a structured, commonly used, machine readable copy of their personal data on request, transferable to another responsible party, at least where they supplied the data directly, a relevant volume of automated processing is involved, or they consented or a contract requires it.NIST Privacy FrameworkCT.DM-P2
  • Answer an access request within ten business days free of charge, and complete a correction, blocking, or deletion within five business days of the request.NIST Privacy FrameworkCT.PO-P3
  • Do not limit a data subject's access, rectification, cancellation, opposition or blocking rights by contract or agreement of any kind; a clause that tries is void.NIST Privacy FrameworkCT.PO-P3
  • Let a data subject reach any one of several responsible parties that feed a shared database, and extend these rights to personal data you held before the Law took effect.NIST Privacy FrameworkCT.PO-P3

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
  • CT.DM-P1Data elements can be accessed for review.
  • CT.DM-P2Data elements can be accessed for transmission or disclosure.
FINOS AIGF

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Logging duty

Articles 15 to 18 and 21 to 23 set the data subject's rights and response times; article 16 has the responsible party give the data subject a certificate of the updated database entry on request, a document handed over rather than a record kept. Article 18 lets ANTAI request information and make verifications limited to the complaint before it, a power to demand information and not a duty to keep a record. The register of transfers in Article 31 sits in an article the row does not cite.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 15 gives every data subject the irrenounceable rights of access, rectification, cancellation, opposition and portability, including a structured, commonly used, machine readable copy of their personal data that can be moved to another responsible party, at least where the data subject supplied the data directly, a relevant volume of automated processing is involved, or the data subject consented or a contract requires it.

Article 16 requires a response to an access request within ten business days, free of charge, and article 17 requires an inaccurate, erroneous or incomplete datum to be corrected within five business days of the request, letting the Autoridad Nacional de Transparencia y Acceso a la Información decide when a datum is inaccurate or unfounded.

Article 18 lets a data subject take an unanswered request to that Authority, which may then demand information and carry out verifications limited to the complaint presented. Article 21 bars limiting a data subject's access, revocation, cancellation, opposition or blocking rights by any act or agreement between parties, voiding any clause that tries. Article 22 lets a data subject reach any one of several responsible parties feeding a shared database.

Article 23 withholds an information, rectification, cancellation or blocking request where it would impede a pending administrative or judicial process or state security, and withholds rectification, cancellation or blocking of data a legal mandate requires to be kept, outside the cases special laws allow. Article 44 extends these rights to personal data already held in a database that existed before the Law took effect.

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example  ·  Lint your app

Page updated .