TunisiaOrganic Act on the Protection of Personal Data, rights of the data subject
Loi organique n° 2004-63, arts. 27, 29-43 (droits de la personne concernée)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Data subject rights, Access restriction
- Audit expectation
- none
What it requires
- Obtain the person's express, written consent before processing their personal data, and let them withdraw that consent at any time.NIST Privacy FrameworkCT.PO-P1
- Do not rely on a consent given for one form or purpose of processing to cover a different form or purpose, and do not process personal data for advertising without the person's separate, express consent.NIST Privacy FrameworkCT.PO-P1
- Give the person written notice, at least one month before processing their data, of its nature, the processing's purpose, whether their answer is mandatory or optional, the recipient's and your own identity and address, their rights of access, withdrawal and objection, the retention period, a summary of your security measures, and the destination country of any transfer.NIST Privacy FrameworkCM.AW-P1
- Let the person consult, correct, complete, rectify, update, clarify or erase their own personal data, and give them a copy in clear language and, where it was processed automatically, an intelligible form, free of charge, within one month of their request.NIST Privacy FrameworkCT.PO-P3
- Offer an electronic channel for a rectification, modification, correction or erasure request where you process personal data by automated means.NIST Privacy FrameworkCT.PO-P3
- Flag personal data as disputed for as long as its accuracy is contested.NIST Privacy FrameworkCT.DM-P3
- Stop processing a person's personal data immediately once they object for a valid, legitimate and serious reason, and honor an objection to communicating their data to third parties for advertising unconditionally.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P3Data elements can be accessed for alteration.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 27 requires the person's express written consent and Article 31 requires prior notice by any means leaving a written trace; both are conditions of processing and not a duty to keep or produce a record. Articles 32 to 41 set out the right of access, with the INPDP deciding refusals. Article 39 requires the controller to mention the existence of a dispute over the accuracy of data until it is decided, which is an annotation of the data and not a log. Articles 42 and 43 cover the right to object. No article in the row requires a log or record, and none names an audit.
- Kind
- None
- As of
What this law does
Article 27 requires the person's express, written consent before processing their personal data, lets that consent be withdrawn at any time, and routes consent for an incapable person through the general rules of law.
Article 29 excuses consent only where processing manifestly serves the person's own interest and contacting them is impossible, obtaining consent would take disproportionate effort, or the processing rests on a law or a contract the person is party to, and article 30 confines a given consent to the form and purpose it was given for, barring use of personal data for advertising without the person's separate, express consent.
Article 31 requires written notice, given at least one month before the data are processed, of the data's nature, the processing's purpose, whether answering is mandatory or optional and the consequences of not answering, the recipient's and controller's identity and address, the person's rights of access, withdrawal and objection, the retention period, a summary of the security measures, and the destination country of any transfer.
Article 32 defines the right of access as the right to consult, correct, complete, rectify, update, clarify or erase data that prove inaccurate, ambiguous or unlawfully processed, and to obtain a copy in clear language and, for automated processing, an intelligible form; article 33 bars waiving that right in advance.
Articles 34 and 36 let the person exercise access at reasonable, non-excessive intervals, against each controller separately where there is more than one, and article 37 requires an automated controller to offer an electronic channel for a rectification, modification, correction or erasure request.
Article 38 gives the person one month to receive a requested copy, one month to bring a refusal or a delay to the INPDP, and the INPDP one month to decide, or seven days where the request is to stop the destruction or concealment of the data; article 39 requires the controller to flag data under dispute until the dispute is resolved.
Article 40 lets the person demand correction, completion, clarification, updating or erasure of data that prove inaccurate, incomplete or ambiguous, or its destruction where it was unlawfully collected or used, and a free copy within one month, escalating a refusal to the INPDP within a further month.
Article 42 gives the person the right to object at any time, for valid, legitimate and serious reasons, to processing of their data, and an unconditional right to object to its communication to third parties for advertising, with the objection suspending the processing immediately; a family court judge, not the INPDP, decides an objection dispute where the person is a child.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .