Sao Tome and PrincipeLei n.º 03/2016, rights of the data holder
Lei n.º 03/2016, arts. 10-12 (information, access and opposition)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2023. Publisher's page: https://www.nadpa-rapdp.org/sites/default/files/2020-11/Law_3_2016_protection_of_personal_data.pdfIn force.
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Access restriction
- Audit expectation
- none
What it requires
- Inform the data holder, at collection, of your identity, the purpose of the processing, and their right of access and rectification, and where you did not collect the data from the holder directly, give that information by the time you register the data or before you first disclose it to a third party.NIST Privacy FrameworkCM.AW-P1
- Answer a data holder's request, free of charge, at reasonable intervals and without undue delay, with confirmation of whether you are processing their data, the purposes, the categories of data and recipients, the data itself in an intelligible form, its origin, and the reasoning behind any automated processing decision about them, and correct, erase or block data that does not comply with this Law.NIST Privacy FrameworkCT.PO-P3
- Let a data holder object, for weighed and legitimate reasons relating to their particular situation, to your continued processing of their data, and stop processing their data for direct marketing or another commercial solicitation, free of charge, as soon as they object or before you first communicate their data to a third party for that purpose.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 10 to 12 give the data holder a right to information at collection, a right of access and a right of opposition. The controller must answer, but none of the three articles requires it to make, keep or produce a log or record. Article 10(5)(c) asks only that the National Agency be notified where information is waived. No audit, auditor, report or retention figure appears in these articles, and they contain no territorial scope clause.
- Kind
- None
- As of
What this law does
Article 10 gives the data holder the right to be told, at collection, the controller's identity, the purposes of the processing, the recipients or categories of recipients, whether a response is obligatory and the consequences of not responding, and the existence and conditions of the rights of access and rectification, and requires that information by the time of registration or before the first communication to a third party where the data were not collected from the holder directly; it excuses the duty where a law provides otherwise, for security or criminal-investigation reasons, or where informing the holder is impossible or disproportionate for statistical, historical or scientific processing, with NAPPD notified in that case.
Article 11 gives the holder free, undue-delay-free access at reasonable intervals to confirmation of whether their data is processed, the purposes, categories and recipients, the data itself in an intelligible form, its origin, the reasoning behind an automated-processing decision about them, and rectification, erasure or blocking of non-compliant data, with third parties who received the data told of any correction; access to health data, including genetic data, runs through a physician of the holder's choosing, and access concerning security or criminal matters runs through the competent authority or NAPPD.
Article 12 gives the holder the right to object, for weighed and legitimate reasons tied to their situation, to continued processing, and an unconditional, free right to stop processing of their data for direct marketing or other commercial solicitation, exercised before the data is first communicated to a third party for that purpose. Article 47 defers the Law's own entry into force to general law without stating a day.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .