TogoLoi n° 2019-014, droits de la personne concernée
Loi n° 2019-014 du 29 octobre 2019, arts. 26, 35-50 (rights of data subjects)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2020. Publisher's page: https://numerique.gouv.tg/wp-content/uploads/2020/01/Loi-n-2019-014-du-29-octobre-2019-relative-a-la-protection-des-donnees-a-caractere-pers…In force.
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Access restriction
- Audit expectation
- none
What it requires
- Tell a data subject, at the latest when you collect their personal data directly from them, your identity, the purposes of the processing, the categories of data and recipients, whether answering is mandatory, their right to be excluded from the file, their rights of access and rectification, the retention period, and any transfer abroad you envisage.NIST Privacy FrameworkCM.AW-P1
- Answer an access request by confirming whether you process the person's data, providing it in an accessible form with its origin, purposes, categories and recipients, and any transfer abroad, and deliver a copy at no more than reproduction cost.NIST Privacy FrameworkCT.DM-P1
- Let a data subject object, on legitimate grounds, to the processing of their personal data, and tell them before their data is first disclosed to or used by a third party for prospecting, offering a free right to object to it, unless the processing meets a legal obligation.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P1
- Correct, complete, update, lock or delete personal data on a data subject's written request within one month and at no cost, when it is inaccurate, incomplete, ambiguous, outdated or unlawfully held, and notify any third party the data was disclosed to.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P5
- Where you have made a data subject's personal data public, take reasonable measures, including technical ones, to tell third parties processing that data to erase links to it or any copy, when the data subject asks.NIST Privacy FrameworkCM.AW-P5
- Do not send unsolicited direct marketing to a person using their personal data without their prior consent to receive it.NIST Privacy FrameworkCT.PO-P1
- Let the heirs of a deceased data subject require you to record the death and make the necessary updates, and justify doing so at no charge.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
The rights articles require notices, answers and corrections: Article 39 gives access, Article 40 a copy, Article 46 correction or deletion on request and Article 47 erasure. Article 46 has the controller show it carried out the corrections within a month and puts the burden of proof on the controller if the request is contested, and Article 43 puts on the controller the burden of showing that a request is manifestly abusive. Both allocate proof in a dispute with the data subject and name no record, so they are not a duty to log. Article 48 asks for mechanisms for erasure or a periodic review of the need to keep the data, which concerns the personal data rather than a record. The Law's access log duty is in Article 52, point 3, which this row does not cite. The cited articles have no scope clause.
- Kind
- None
- As of
What this law does
Article 35 requires a controller collecting data directly from the data subject to disclose, at the latest when collecting it, its identity, the purposes of the processing, the categories of data, the recipients, whether an answer is mandatory, the possibility of objecting to inclusion in the file, the rights of access and rectification, the retention period, and any transfer abroad envisaged.
Article 39 gives a data subject the right to demand confirmation of processing, communication of their data in an accessible form together with its origin, and information on the purposes, categories, recipients and any transfer abroad, and article 40 entitles them to a copy at no more than reproduction cost.
Article 45 gives a data subject the right to object, on legitimate grounds, to processing of their data, and the right to be told before their data is first disclosed to or used by a third party for prospecting and to object to that disclosure or use free of charge, subject to the exception for processing required by a legal obligation.
Article 46 lets a data subject demand correction, completion, updating, locking or deletion of data that is inaccurate, incomplete, ambiguous, outdated or unlawfully held, within one month and at no cost, and requires the controller to notify any third party the data was disclosed to.
Article 47 requires a controller who has made a data subject's data public to take reasonable measures, including technical ones, to tell third parties processing that data to erase links to it or any copy, on the data subject's request. Article 26 bars unsolicited direct marketing using a person's data without their prior consent to receive it.
Article 50 lets the heirs of a deceased data subject require the controller to record the death and make the necessary updates, and requires the controller to justify doing so free of charge. Article 97, the closing article, provides that the law is executed as a law of the State but names no day of its own entry into force, and no commencement notice has been located in the Journal officiel.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .