UruguayLey N° 18.331, rights of data subjects
In force.
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Before or when you collect personal data, tell the data subject expressly, precisely, and unambiguously the purpose of the processing and who may receive it, the existence and identity of the database's controller, whether answering is mandatory, the consequences of refusing or of inaccuracy, their rights of access, rectification, and challenge, whether the data will be transferred internationally, and, for an automated-decision process, the valuation criteria, the process applied, and the technology or program used.NIST Privacy FrameworkCM.AW-P1
- Give a data subject free access, at most every six months, to all information about them held in your database, supplied within five business days, in clear language, covering the whole record without revealing a third party's data.NIST Privacy FrameworkCT.DM-P1
- Correct, update, include, or delete a data subject's personal data within five business days of their request when it is erroneous, false, or missing, or explain why it does not, and notify any recipient of the data of the correction within five business days.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P5
- On request, remove or block a data subject's data from a marketing, canvassing, or profiling database at any time, and give the data subject access to the data you hold in such a database free of charge.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
The articles give the data subject rights to information (Article 13), access within five business days (Article 14), rectification, update and deletion within five business days (Article 15) and free access and blocking for advertising databases (Article 21). Article 15 requires the controller to note, when a third party asks for a report, that the data are under review, and to notify recipients of a correction; that annotates the data disclosed and is not a record of processing, and a data subject's right to read their own data is access to the data and not to a log. No article requires a log, register or kept record, names an audit or names a body entitled to one. No territorial clause sits in the cited articles.
- Kind
- None
- As of
What this law does
Article 13, as rewritten by Ley N° 20.075 art. 62, requires telling a data subject, before or when their data is collected, the purpose of the processing and who may receive it, the existence and identity of the database's controller, whether answering is mandatory, particularly for sensitive data, the consequences of refusing or of inaccuracy, the rights available under articles 14 to 16, whether the data will be transferred internationally, and, for an automated-decision process, the valuation criteria, the process applied, and the technology or program used.
Article 14 gives a data subject free access, at most every six months, to all information about them held in a public or private database, supplied within five business days in clear language, covering the whole record without revealing a third party's data.
Article 15 gives a right to rectification, updating, inclusion, or deletion of erroneous, false, or missing personal data, to be carried out within five business days of the request, or the controller must give the reasons it considers the request does not apply, with any recipient of the data notified of the change within five business days.
Article 21 lets a data subject exercise the right of access free of charge in a marketing, canvassing, or profiling database, and request the withdrawal or blocking of their data from it at any time. The sections this entry groups came into force on different days.
When LexLint raises it
When your app profile says your app sends automated outreach, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .