Determining and fulfilling obligations to PII principals
The organization should determine, document and comply with their legal, regulatory and business obligations
to PII principals, related to the processing of their PII and provide...
...
- Licensed content not shown - LGPD (BRA)
Art.6: The operations of personal data processing
must be performed in good faith and follow these
principles:
I – Purpose: Performing the processing for legitimate,
specific, and explicit purposes that the data subject
is informed of, without the possibility of further
processing in a manner that is incompatible with
those purposes;
II – Adequacy: Compatibility of the processing with
the purposes that the data subject was informed of,
according to the context of the processing;
III – Necessity: Limitation of processing to the
minimum necessary for fulfilling its purposes, using
pertinent, proportional and non-excessive data in
relation to the purposes of processing;
IV – Free Access: Guarantee, to the data subjects, of
the ability to easily query free of charge the means
and duration of processing, as well as the integrity
of their personal data;
V – Data Quality: Guarantee, to the data subjects,
of accuracy, clarity, relevance, and updating of data,
according to the need and to fulfill the purpose of its
processing;
VI – Transparency: Guarantee, to the data subjects,
of clear, precise, and easily-accessible information
regarding the processing and the respective
processing agents, respecting commercial and
industrial secrecy;
VII – Security: Use of technical and administrative measures suitable to protect personal data from
unauthorized access and accidental or illicit
destruction, loss, change, communication, or
dissemination events;
VIII – Prevention: Adoption of measures to prevent
the occurrence of damage as result of the
processing of personal data;
IX – Non-Discrimination: Impossibility of processing
for illegal or abusive discriminatory purposes;
X – Liability and Accountability: Demonstration,
by the processing agent, that effective measures
capable of proving the observance and compliance
with personal data protection rules, including the
efficacy of these measures, is adopted.
Processing of personal data activities must be in good faith and, among others, be for notified purpose(s), necessary and transparent (Art 6)
If testing is not... Art.9: The data subject has the right to easily
access information regarding the processing of data,
which must be made available in a clear, adequate,
and ostensive manner, among other characteristics
outlined in regulations to comply with the principle of
free access:
I – Specific purpose of processing;
II – Form and duration of processing, respecting
commercial and industrial secrecy;
III – Identification of the controller;
IV – The controller’s contact information;
V – Information regarding the shared use of data by
the controller and the purpose of the sharing;
VI – Liabilities of the processing agents; and
VII – The data subject’s rights with explicit mention
of the rights contemplated in Article 18 of this Law. § 1 If consent is requested, such consent will be
considered void in case the information provided to
the data subject have misleading or abusive content or
were not previously presented in a transparent, clear,
and unambiguous manner.
§ 2 If consent is requested, if there is a change in the
purpose of the processing of personal data that is not
compatible with the original consent, the controller
must inform the data subjects beforehand, who may
revoke the consent, if they disagree with the changes.
§ 3 When the processing of personal data is a
condition for the provision of a good or service or the
exercise of a right, the data subjects will be informed in
a highlighted manner regarding this fact and the means
through which they may exercise the rights identified in
Article 18 of this Law. Art.14: The processing of personal data of children
and teenagers must be performed on their best
interest, under the terms of this Article and relevant
legislation.
§ 1 The processing of personal data of children must
be performed with the specific and explicit consent
provided by at least one of the parents or legal
guardian.
§ 2 In processing the data under the provision of § 1 of
this Article, the controllers must permanently disclose
all information regarding the types of collected data,
the way they are used, and the procedures for the
exercise of rights under Article 18 of this Law.
§ 3 The personal data of children may be collected
without the consent referred to in § 1 of this
Article when the collection is necessary to contact the
parents or legal guardian, and data is used only once
and without being stored, or to protect them, and in
no case data may be given to third parties without the
consent under the provisions of § 1 of this Article.
§ 4 Controllers must not require data subjects referred
to § 1 of this Article to provide information in order to
participate in games, internet applications, or other
activities beyond those information strictly necessary
for the activity.
§ 5 Controller must undertake all reasonable efforts to
verify that the consent referred to in § 1 of this Article
was provided by one of the parents or legal guardian of
the children, considering available technology.
§ 6 The information on the processing of data referred
to in this Article must be provided in a simple, clear and
accessible manner, considering the physical-motor, perception, sensory, intellectual, and mental
characteristics of the user, with the use of audiovisual
resources when appropriate, in order to provide the
necessary information to the parents or legal guardian
and adequate information for the understanding of the
children. Art.19: The confirmation of the existence of
processing or the access to personal data will be
provided through request of the data subject:
I – In a simplified format and immediately; or
II – Through a clear and complete statement
specifying the origin of the data, the nonexistence
of records, and criteria used for processing, as well
as its purpose, respecting commercial and industrial
secrecy, provided within at least fifteen (15) days,
counting from the date of the data subject’s
request.
§ 1 The personal data will be stored in a format that
promotes the exercise of the right to access.
§ 2 The information and data may be provided, at the
discretion of the data subject:
I – Through electronic means that are secure and
appropriate for such purpose; or
II – Through printed means.
§ 3 When the processing originates from the data
subject’s consent or from a contract, the data subjects
may request a full electronic copy of their personal
data, respecting commercial and industrial secrecy,
under the terms of the National Data Protection
Authority ‘s regulations, in a format that allows it to
be used subsequently, including in other processing
operations. § 4 For specific industries, the National Data Protection
Authority may establish different terms than those
provided in items I and II of the head provision of this
Article. Art.46: Processing agents must adopt security
measures, both technical and administrative, suitable
to protect personal data from unauthorized access
and accidental or illegal destruction, loss, change,
communication, or dissemination events, or any other
occurrence resulting from inappropriate or illegal
processing.
§ 1 The National Data Protection Authority may
determine minimum technical standards for the
purposes of the provisions this Article, considering
the nature of the information processed, the specific.
characteristics of the processing, and the current
state of technology, especially in the case of sensitive
personal data, as well as the principles outlined in
Article 6 of this Law.§ 2 The measures contemplated in the head provision
of this Article must be considered from the phase
of the development of the good or service until its
execution. CCPA (US, CA)
S.1798.120: (a) A consumer shall have the right, at any time, to direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information. This right may be referred to as the right to opt out.
(b) A business that sells consumers’ personal information to third parties shall provide notice to consumers, pursuant to subdivision (a) of Section 1798.135, that this information may be sold and that consumers have the right to opt out of the sale of their personal information.
(c) A business that has received direction from a consumer not to sell the consumer’s personal information or, in the case of a minor consumer’s personal information has not received consent to sell the minor consumer’s personal information shall be prohibited, pursuant to paragraph (4) of subdivision (a) of Section 1798.135, from selling the consumer’s personal information after its receipt of the consumer’s direction, unless the consumer subsequently provides express authorization for the sale of the consumer’s personal information.
(d) Notwithstanding subdivision (a), a business shall not sell the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers between 13 and 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale of the consumer’s personal information. A business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age. This right may be referred to as the “right to opt in.” S.1798.130: (a) In order to comply with Sections 1798.100, 1798.105, 1798.110, 1798.115, and 1798.125, in a form that is reasonably accessible to consumers, a business shall:
(1) Make available to consumers two or more designated methods for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, including, at a minimum, a toll-free telephone number, and if the business maintains an Internet Web site, a Web site address.
(2) Disclose and deliver the required information to a consumer free of charge within 45 days of receiving a verifiable request from the consumer. The business shall promptly take steps to determine whether the request is a verifiable request, but this shall not extend the business’s duty to disclose and deliver the information within 45 days of receipt of the consumer’s request. The time period to provide the required information may be extended once by an additional 45 days when reasonably necessary, provided the consumer is provided notice of the extension within the first 45-day period. The disclosure shall cover the 12-month period preceding the business’s receipt of the verifiable request and shall be made in writing and delivered through the consumer’s account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumer’s option if the consumer does not maintain an account with the business, in a readily useable format that allows the consumer to transmit this information from one entity to another entity without hindrance. The business shall not require the consumer to create an account with the business in order to make a verifiable request.
(3) For purposes of subdivision (b) of Section 1798.110:
(A) To identify the consumer, associate the information provided by the consumer in the verifiable request to any personal information previously collected by the business about the consumer.
(B) Identify by category or categories the personal information collected about the consumer in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information collected.
(4) For purposes of subdivision (b) of Section 1798.115:
(A) Identify the consumer and associate the information provided by the consumer in the verifiable request to any personal information previously collected by the business about the consumer.
(B) Identify by category or categories the personal information of the consumer that the business sold in the preceding 12 months by reference to the enumerated category in subdivision (c) that most closely describes the personal information, and provide the categories of third parties to whom the consumer’s personal information was sold in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information sold. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (C).
(C) Identify by category or categories the personal information of the consumer that the business disclosed for a business purpose in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information, and provide the categories of third parties to whom the consumer’s personal information was disclosed for a business purpose in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information disclosed. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (B).
(5) Disclose the following information in its online privacy policy or policies if the business has an online privacy policy or policies and in any California-specific description of consumers’ privacy rights, or if the business does not maintain those policies, on its Internet Web site, and update that information at least once every 12 months:
(A) A description of a consumer’s rights pursuant to Sections 1798.110, 1798.115, and 1798.125 and one or more designated methods for submitting requests.
(B) For purposes of subdivision (c) of Section 1798.110, a list of the categories of personal information it has collected about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information collected.
(C) For purposes of paragraphs (1) and (2) of subdivision (c) of Section 1798.115, two separate lists:
(i) A list of the categories of personal information it has sold about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information sold, or if the business has not sold consumers’ personal information in the preceding 12 months, the business shall disclose that fact.
(ii) A list of the categories of personal information it has disclosed about consumers for a business purpose in the preceding 12 months by reference to the enumerated category in subdivision (c) that most closely describe the personal information disclosed, or if the business has not disclosed consumers’ personal information for a business purpose in the preceding 12 months, the business shall disclose that fact.
(6) Ensure that all individuals responsible for handling consumer inquiries about the business’s privacy practices or the business’s compliance with this title are informed of all requirements in Sections 1798.110, 1798.115, 1798.125, and this section, and how to direct consumers to exercise their rights under those sections.
(7) Use any personal information collected from the consumer in connection with the business’s verification of the consumer’s request solely for the purposes of verification.
(b) A business is not obligated to provide the information required by Sections 1798.110 and 1798.115 to the same consumer more than twice in a 12-month period.
(c) The categories of personal information required to be disclosed pursuant to Sections 1798.110 and 1798.115 shall follow the definition of personal information in Section 1798.140. S.1798.135: (a) A business that is required to comply with Section 1798.120 shall, in a form that is reasonably accessible to consumers:
(1) Provide a clear and conspicuous link on the business’ Internet homepage, titled “Do Not Sell My Personal Information,” to an Internet Web page that enables a consumer, or a person authorized by the consumer, to opt out of the sale of the consumer’s personal information. A business shall not require a consumer to create an account in order to direct the business not to sell the consumer’s personal information.
(2) Include a description of a consumer’s rights pursuant to Section 1798.120, along with a separate link to the “Do Not Sell My Personal Information” Internet Web page in:
(A) Its online privacy policy or policies if the business has an online privacy policy or policies.
(B) Any California-specific description of consumers’ privacy rights.
(3) Ensure that all individuals responsible for handling consumer inquiries about the business’s privacy practices or the business’s compliance with this title are informed of all requirements in Section 1798.120 and this section and how to direct consumers to exercise their rights under those sections.
(4) For consumers who exercise their right to opt out of the sale of their personal information, refrain from selling personal information collected by the business about the consumer.
(5) For a consumer who has opted out of the sale of the consumer’s personal information, respect the consumer’s decision to opt out for at least 12 months before requesting that the consumer authorize the sale of the consumer’s personal information.
(6) Use any personal information collected from the consumer in connection with the submission of the consumer’s opt-out request solely for the purposes of complying with the opt-out request.
(b) Nothing in this title shall be construed to require a business to comply with the title by including the required links and text on the homepage that the business makes available to the public generally, if the business maintains a separate and additional homepage that is dedicated to California consumers and that includes the required links and text, and the business takes reasonable steps to ensure that California consumers are directed to the homepage for California consumers and not the homepage made available to the public generally.
(c) A consumer may authorize another person solely to opt out of the sale of the consumer’s personal information on the consumer’s behalf, and a business shall comply with an opt out request received from a person authorized by the consumer to act on the consumer’s behalf, pursuant to regulations adopted by the Attorney General. APP (Australian Privacy Principles)
APA (Australian Privacy Act)
PIPEDA (Personal Information Protection and Electronic Documents Act) - Canada
Personal Data (Privacy) Ordinance - Hong Kong
Personal Data Protection Act - Singapore
Personal Information Protection Act - South Korea
Turkish Data Protection Law numbered 6698