ChadLoi n°007/PR/2015, principes directeurs du traitement des données (consentement, licéité, finalité, conservation)
Loi n°007/PR/2015 du 10 février 2015, arts. 1-15
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://arcep.td/sites/default/files/Loi-N%C2%B007-PR-2015.pdfIn force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Retention
- Audit expectation
- none
What it requires
- Process personal data only with the data subject's consent, or, absent consent, only when indispensable to a legal obligation, a public-interest mission, a contract with the data subject, or safeguarding the data subject's interest or fundamental rights and freedoms.
- Collect and process personal data only for determined, explicit, and legitimate purposes, and do not process it later in a way incompatible with those purposes.NIST Privacy FrameworkGV.PO-P1
- Keep personal data accurate and up to date, and retain it no longer than the purpose for which it was collected requires.NIST Privacy FrameworkCT.PO-P2
- Inform the data subject about the processing of their personal data, and process it confidentially and with security measures against unauthorized access.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkPR.DS-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 7 to 15 set the grounds for lawful processing and the principles of purpose limitation, adequacy, accuracy, transparency, confidentiality and security, and article 15 makes a processor show sufficient guarantees, which tests its capacity and is not proof of something only a record could show. Article 11 limits how long the personal data themselves may be kept to what the purposes require, which is a limit on the data and not on a record about them. None of these articles requires anyone to make, keep or produce a log or a register, or to prove something that only a record could show. The access-trace duty and the register of processing sit in later articles this row does not cite, so neither is borrowed. The scope clause in articles 2 and 3 names no territorial hook, so the hook is empty.
- Kind
- None
- As of
What this law does
Article 1 sets the law's object as protecting private and professional life against the collection, processing, transmission, storage, and use of personal data, subject to public-order protection, and article 2 applies it to any such operation by a natural person, the State, local authorities, or a public or private legal person.
Article 7 makes processing lawful when the data subject consents, or, absent consent, when it is indispensable to a legal obligation, a public-interest or public-authority mission, a contract to which the data subject is party, or safeguarding the data subject's interest or fundamental rights and freedoms.
Articles 8 through 10 require that collection and processing be lawful, fair, and non-fraudulent, and that data be collected for determined, explicit, and legitimate purposes and not processed incompatibly with them, and be adequate and not excessive for those purposes. Articles 11 through 15 require that data be retained no longer than the purpose requires, kept accurate, and that the controller inform the data subject and keep the data confidential and secure.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .