SurinameDraft Law on the Protection of Privacy and Personal Data, rights of the data subject
Arts. 10-11 Wet Bescherming Privacy en Persoonsgegevens
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Give a data subject the transparency information article 10(3) lists, including your identity, the purposes and legal basis of processing, recipients, retention period, and their rights, at collection, or, where the data did not come from the data subject, within a reasonable time and at latest within one month.NIST Privacy FrameworkCM.AW-P1
- Let a data subject obtain confirmation that you are processing their personal data, and on request give them the reasons underlying a decision produced by processing their data.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P1
- Where processing rests on a contract or consent and is carried out by automated means, give the data subject their personal data in a structured, commonly used, machine readable format, and transmit it directly to another controller where technically feasible.NIST Privacy FrameworkCT.DM-P6NIST Privacy FrameworkCT.DM-P2
- Let a data subject object at any time to processing on grounds relating to their situation, and stop processing their personal data for direct marketing and any related profiling outright as soon as they object to it.NIST Privacy FrameworkCT.PO-P3
- Rectify or erase a data subject's personal data on request where it has been processed in violation of this law, and let them withdraw consent at any time as easily as they gave it.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCT.PO-P1
- Act on a rights request without undue delay and within one month of receipt, extendable by one further month for complex or numerous requests with notice of the extension within three weeks, and if you decline to act, tell the data subject why within one month and of their right to complain to the Commissioner or go to court.NIST Privacy FrameworkCT.PO-P3
- Provide the article 10 information and act on a rights request free of charge, unless the request is manifestly unfounded or excessive, in which case you may charge a reasonable administrative fee or refuse it, bearing the burden of showing it is unfounded or excessive.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P2Data elements can be accessed for transmission or disclosure.
- CT.DM-P6Data are transmitted using standardized formats.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 11(7) lets a data subject object at any time to processing on grounds relating to their situation, and the processing may continue only if the controller shows legitimate grounds for it that outweigh the interests, rights and freedoms of the data subject, so the controller must be able to show the basis on which it kept processing. The paragraph names no log, no field, no retention period and no audit. Article 11(16) also puts on the controller the burden of showing that a rights request is manifestly unfounded or excessive before it charges a fee or refuses; that is a rule of proof about the request, not about consent or the lawfulness of the processing, and it names no record. Article 10 and the other paragraphs of article 11 make the controller inform the data subject and answer requests, and name no record. The controller's register is article 18 and sits on the general row. None of the cited articles carries a scope clause. The text is a draft bill.
- Kind
- Implicit
- As of
- Provision
- Article 11(7) (once a data subject objects, the controller must show legitimate grounds for the processing that outweigh the data subject's interests, rights and freedoms)
- Trigger
- personal_data_processing
What this law does
Article 10 requires a controller to give a data subject the identity and contact details of the controller and any representative, the data protection officer's contact details where one exists, the purposes and legal basis of the processing, the categories of data, the recipients including any third country recipient, the storage period, the existence of the data subject's rights, and the right to complain to the Commissioner.
That information is due when the data are collected from the data subject, or, where they were not, within a reasonable time and at latest within one month.
Article 11 gives a data subject the right to confirmation of processing and to the reasons underlying a decision applied to them, a right to portability of data they provided under a contract or consent and processed by automated means, a right to object at any time to processing on grounds relating to their situation, with processing for direct marketing and its related profiling stopping outright once the data subject objects, a right to rectification or erasure where processing violated this law, and a right to withdraw consent at any time as easily as it was given.
A controller must act on a rights request without undue delay and within one month of receipt, extendable by one further month for complex or numerous requests with notice of the extension within three weeks, and must tell a data subject who it declines to act for why within one month, including the possibility of a complaint to the Commissioner or a court.
Exercising these rights and receiving the article 10 information is free, except that a controller facing a manifestly unfounded or excessive request, particularly a repetitive one, may charge a reasonable administrative fee or refuse it, bearing the burden of showing the request is unfounded or excessive. The bill remains under consideration before De Nationale Assemblee, with no enactment timeline.
When LexLint raises it
When your app profile says your app sends automated outreach, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .