SenegalLoi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, droits de la personne concernée
Loi n° 2008-12 du 25 janvier 2008, arts. 47, 58-69 (droits de la personne concernée)
In force.
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Consent
- Audit expectation
- none
What it requires
- Tell the person, at the time of collection, who is responsible for the processing, its purpose, the categories of data, whether a reply is mandatory or optional, and any recipients, and let them access, object to, correct, or delete their data on request.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.PO-P3
- Where you did not collect the data from the person directly, give them the same information when you record it or, if you plan to disclose it, no later than the first disclosure, unless it falls within the state-security, defence, criminal-enforcement, or major economic-interest exemption.NIST Privacy FrameworkCM.AW-P1
- Do not access or write information on a user's terminal equipment by electronic transmission without telling them its purpose and how to object, unless the access only enables the communication or is strictly necessary for a service they expressly requested.NIST Privacy FrameworkCM.AW-P1
- Give a person, on written request, access to their data and its origin, and a copy on payment of no more than the reproduction cost, and refer a disputed mismatch to the CDP for verification.NIST Privacy FrameworkCT.DM-P1
- Do not send a person direct-marketing communications using their personal data unless they have first expressed consent to receive them.NIST Privacy FrameworkCT.PO-P1
- Let a person object, free of charge and for legitimate reasons, to processing of their data, and correct, complete, update, block, or delete it within one month of a written request where it is inaccurate, incomplete, ambiguous, outdated, or unlawfully processed, notifying any third party the data was disclosed to.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Data subject
Logging duty
Article 69 requires the controller, on a written request for rectification, completion, update, blocking or deletion, to justify to the person, free of charge and within one month of registering the request, that it carried out the operations, and puts the burden of proof on the controller in a dispute. The Law names no log, but that justification cannot be given without a record of what was done and when. The one month is a response period and not a retention period. The data subject is the party entitled to the justification, and no audit or inspection is named in the cited articles. Articles 58 to 68 set information, access and objection rights and Article 47 bars direct marketing without prior consent; Article 66 puts the burden of proving that an access request is manifestly abusive on the controller, which is a rule of proof and names no record. None of the cited articles carries a scope clause.
- Kind
- Implicit
- As of
- Provision
- Article 69, second and third paragraphs (the controller must justify that it carried out a requested correction or deletion, and bears the burden of proof)
- Trigger
- personal_data_processing
What this law does
Article 58 requires a controller collecting data directly from the person to tell them, at the latest when collecting it, who is responsible for the processing, its purpose, the categories of data, the recipients, whether a reply is mandatory or optional and the consequences of not replying, their right to be removed from the file, their access and rectification rights, the retention period, and any transfer abroad.
Article 59 requires that same information to be given, when data is not collected from the person, at the time it is recorded or, if disclosure is planned, no later than the first disclosure, while article 60 exempts data used for state security, defence, public security, criminal enforcement, or an important economic or financial interest of the State.
Article 61 requires a controller accessing or writing information on a user's terminal equipment by electronic transmission to tell the user its purpose and how to object, unless the access only enables the communication or is strictly necessary for a service the user expressly requested.
Articles 62 and 63 give a person a written right to access their data, its origin and purpose, and a copy on payment of no more than the reproduction cost, and article 64 lets them refer a suspected mismatch between the data disclosed and the data actually processed to the CDP for verification.
Article 65 lets a patient's access right be exercised through a physician they designate, article 66 lets a controller resist manifestly abusive requests while carrying the burden of proving abuse, and article 67 routes access to a state security, defence or public security processing through a CDP member who investigates and decides what can be disclosed.
Article 68 gives a person the right to object, for legitimate reasons, to processing of their data, to be told before their data is first disclosed to or used by a third party for prospecting, and to object to that disclosure or use free of charge, and article 47 separately bars sending a person direct marketing communications by any means before they have expressed prior consent to receive them.
Article 69 lets a person demand that inaccurate, incomplete, ambiguous, outdated, or unlawfully processed data about them be corrected, completed, updated, blocked, or deleted, requires the controller to prove compliance within one month at no cost, and requires the controller to notify any third party the data was disclosed to. Loi n° 2008-12 was promulgated on . It was published in Journal officiel n° 6406 of .
The law's final articles state no day of its own for its entry into force. Under article 2 of Loi n° 70-14 du 6 février 1970, a promulgated law that does not postpone its entry into force becomes executory on the third day after the Journal officiel issue carrying it is deposited at the General Secretariat in the Cap-Vert region and the communes of Diourbel, Kaolack, Saint-Louis and Thiès, and on the fifth day in the rest of the territory.
Article 17 of Loi n° 2021-21 du 2 mars 2021 abrogates Loi n° 70-14, as modified by Loi n° 71-07 du 21 janvier 1971. No official record of the day on which the law became executory has been located.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .