San MarinoSan Marino Law No. 171, rights of the data subject
Legge 21 dicembre 2018 n. 171, articoli 12-21 (diritti dell'interessato)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Give a data subject, at collection, your identity and contact details, the purposes and legal basis of the processing, the recipients, any transfer abroad, the retention period and their rights, and where the data came from elsewhere, its source and the categories concerned.NIST Privacy FrameworkCM.AW-P1
- Answer a request for access, rectification, erasure, restriction or portability, and notify every recipient the data was disclosed to of a rectification, erasure or restriction you carry out.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P5
- Stop processing personal data for direct marketing as soon as the data subject objects, including the profiling related to it.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 12 to 21 set how and when the controller answers a rights request (one month, extendable by two), what it tells the data subject, and the rights of access, rectification, erasure, restriction, portability and objection. They state no duty to create, keep or produce a log or record. Article 12(5) puts the burden of proving that a request is manifestly unfounded or excessive on the controller, Article 12(2) lets the controller refuse only if it demonstrates that it cannot identify the data subject, and Article 21(1) requires it to demonstrate compelling legitimate grounds; each is a rule of proof and names no record. Article 19 requires notice of a rectification, erasure or restriction to recipients, which is a notice and not a record. The cited articles carry no scope clause.
- Kind
- None
- As of
What this law does
Article 13 fixes the information a controller gives when it collects personal data from the data subject, and article 14 the information due where the data came from elsewhere.
Article 15 gives a right of access, article 16 a right to rectification, article 17 a right to erasure described as the right to be forgotten, article 18 a right to restriction of processing, article 19 the duty to notify recipients of a rectification, erasure or restriction, article 20 a right to data portability and article 21 a right to object, including to direct marketing.
Articles 23 and 24 set the restrictions on those rights, including for reasons of justice, and article 25 carries the rights of deceased persons. Law 171/2018 was approved by the Great and General Council on and promulgated by the Captains Regent on , the date carried in the law's own official title. Article 129 provides that the law enters into force on the fifteenth day after its legal publication. The Bollettino Ufficiale records its publication on , so the law entered into force on .
When LexLint raises it
When your app profile says your app sends automated outreach, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .