ChadLoi n°007/PR/2015, droits de la personne concernée (information, accès, opposition, rectification)
Loi n°007/PR/2015 du 10 février 2015, arts. 35-50
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://arcep.td/sites/default/files/Loi-N%C2%B007-PR-2015.pdfIn force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
What it requires
- At the point of collecting personal data, provide the data subject the controller's identity, the processing purposes, the data categories, the recipients, the retention period, and any prospect of transfer to a third country.NIST Privacy FrameworkCM.AW-P1
- On a data subject's request, confirm whether their data is processed, communicate that data and its origin, purposes, legal basis, categories, and recipients, and provide a copy at no more than reproduction cost, free of the request itself.NIST Privacy FrameworkCT.DM-P1
- Honor a data subject's objection, made on legitimate grounds, to processing of their personal data, including before first communicating it to a third party or using it for prospecting.NIST Privacy FrameworkCT.PO-P3
- Within one month of a written request, rectify, complete, update, block, or erase personal data that is inaccurate, incomplete, equivocal, outdated, or unlawfully held.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Data subject
Logging duty
Article 46 makes the controller justify, at no cost to the requester, that it has carried out the correction, completion, update, blocking or erasure the data subject asked for in writing, within one month of registering the request, failing which the data subject may complain to ANSICE. That cannot be shown without a record of the request and of what was done, although the clause does not name a log. What the record must hold is not stated, so the contents are left empty. Article 43 puts on the controller the burden of showing that an access request is manifestly abusive, and article 47 requires notice to third parties of a rectification, erasure or restriction; neither names a record. The access right in articles 38 to 40 adds no record duty. The one-month period in article 46 is a deadline for acting, not a period for keeping a record.
- Kind
- Implicit
- As of
- Provision
- Article 46 (the controller must justify, within one month of registering a written request, that it has carried out the rectification, completion, update, blocking or erasure asked for)
- Trigger
- personal_data_processing
What this law does
Article 35 requires a controller collecting personal data directly from the data subject to provide, at collection, its own identity, the processing purposes, the categories of data, the recipients, the retention period, the existence of access and rectification rights, and any prospect of transfer to a third country; article 36 extends this duty to data not collected directly from the data subject, timed to registration or first communication to a third party.
Article 38 lets any natural person demand, free of charge, confirmation of whether their data is processed, communication of that data and its origin, information on the processing's purposes, legal basis, categories, and recipients, and information on any transfer to a third country; article 39 adds a copy of the data at no more than reproduction cost, and under article 43 the controller may refuse a manifestly abusive request, bearing the burden of proving abuse.
Article 45 gives any natural person the right to object, on legitimate grounds, to processing of their personal data, and specifically to object, free of charge, before their data is first communicated to a third party or used for prospecting on a third party's behalf, except where the processing meets a legal obligation.
Article 46 lets any natural person demand, free of charge, that the controller rectify, complete, update, block, or erase personal data concerning them that is inaccurate, incomplete, equivocal, outdated, or unlawfully collected, used, communicated, or retained, within one month of a written request, on pain of a complaint to ANSICE.
Article 48 has a minor's rights exercised by the parent holding parental authority or the minor's guardian, with the minor associated to the exercise of those rights according to age and maturity.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .