- To guarantee, a posteriori, the checking of the identities of people that have
had an access to the information network, to the data that have been inserted
in the network, to the time of this insertion as well as the person who did it;
- To prevent the data from being read, copied, modified, deleted or struck off
at the time of its communication or its media transport;
- To save the data by the constitution of a stock of secured copies.
Article 20:
When the data controller entrusts to third -parties some or all the processing
within the framework of a sub- contracting contract, he shall choose the subcontractor very carefully.
The sub-contractor shall observe the provisions of this Act and may act only
under the data controller's authorized limitations. Furthermore, the subcontractor shall offer all the required and appropriate technical means to carry
out his assignments.
In case of violation of the provisions of this Act, the data controller and the
sub-contractor shall engage their civil liabilities.
Article 21:
The data controller and the sub-contractor shall rectify, complete, modify,
update or delete personal data from data files if they know of any inaccuracy
or insufficiency in this data.
In this case, the data controller and the sub-contractor must inform the data
subject and the data beneficiary of every modification made to the personal
data.
Notification shall be done within two months from the date of modification, by
registered letter with acknowledgement on receipt or by any other means that
leave a written trace.
Article 22:
Without prejudice of the laws and rules in force, the individual or the legal
representative of a legal entity who applied for the processing of personal
data, as well as their employees, must fulfill the following conditions:
- To be Tunisian;
- To be resident in Tunisia;
- To be without criminal record.
These conditions shall also apply to the sub-contractor and his employees.
Article 23:
Even after the end of the processing or loss of their qualities, the data
controller, the sub-contractor and their employees must protect the
confidentiality of personal data and the processed information, except when
diffusion of information has been accepted in writing by the data subject or in
all cases regulated by the law in force.
Article 24:
The data controller and the sub-contractor, who intend putting an end to their
activities, shall inform the "Instance" three months before the date of
suspension of their activities.
5