Processes personal data, in Angola

Lei n.º 22/11, de 17 de Junho de 2011 (Protecção de Dados Pessoais), arts. 1-12, 16, 18-24, 30-32, 35-43 and 63-67 · Read the law's page

• Obtain the data subject's unequivocal, express consent before processing their personal data, or notify the Agência de Protecção de Dados, unless a contract-performance, legal-obligation, vital-interest, public-interest, or legitimate-interest ground applies.
• Obtain the data subject's consent or the APD's authorisation before processing personal data on their creditworthiness or solvency, unless the information comes from a publicly accessible source, and notify the data subject within sixty days of entering their data in a debtor file.
• Notify the Agência de Protecção de Dados, or obtain the recipient's express consent, before sending postal or electronic marketing messages or recording a call for commercial purposes, and let the recipient object to further messages free of charge at any time.
• Treat a recipient who processes communicated personal data for its own purposes as a controller in its own right, and one who processes it on your behalf and under your instructions as a subcontractor bound by a written contract, and obtain the APD's authorisation before interconnecting personal data held in different files unless a legal provision already permits it.
• Implement technical and organisational measures adequate to the risk presented by the processing and the nature of the data, and keep a document describing the security measures, standards and procedures applied.
• Keep personal data confidential, both as a data controller and as anyone who learns of it in the course of their duties, including after the relationship ends.
• Notify the Agência de Protecção de Dados before processing personal data, or obtain its authorisation where notification is not enough, and give it the particulars the law requires about the processing.

Lei n.º 22/11, de 17 de Junho de 2011, arts. 13-15 e 17 (dados sensíveis) · Read the law's page

• Do not process sensitive data (philosophical or political convictions, party or union membership, religious faith, private life, racial or ethnic origin, or health and sex life including genetic data) unless a legal provision permits it or the Agência de Protecção de Dados authorises it on one of its listed grounds, such as the data subject's unequivocal, express and written consent.
• Notify the Agência de Protecção de Dados of sensitive-data processing carried out under a legal provision, and carry it out with guarantees of non-discrimination and special security measures.
• Process health and sex-life data, including genetic data, only with the data subject's or their legal representative's unequivocal, express and written consent or the APD's authorisation, unless it is for preventive medicine, medical diagnosis, consented medical care, health-service management, a medical emergency, or the public interest, and only through a health professional bound by professional secrecy.
• Process personal data on suspected illicit activities, criminal offences, contraventions, penalties or security measures only as a public authority acting under a legal provision cleared with the APD's prior opinion or under the APD's own authorisation, and limit processing for police investigation to what a specific prevention or prosecution purpose requires.
• Post clear notice at any location with a video surveillance or electronic monitoring system that identifies people, stating that image or sound is captured and giving the controller's name, address, phone number and email.

Lei n.º 22/11, de 17 de Junho de 2011, arts. 25-28 (direitos dos titulares dos dados) · Read the law's page

• Tell a data subject at least your identity and address, the purposes of processing and the file's existence, the recipients or categories of recipients, whether a reply is mandatory or voluntary and the consequences of not replying, and the existence and conditions of the rights of access, rectification, updating, elimination and objection, when you collect their data or, if collected elsewhere, at the latest thirty days after collection.
• Publish an easily accessible privacy policy carrying the article 25 disclosures, including that data on an open network may circulate without security guarantees and could be seen or used by unauthorised third parties, wherever data is collected over an open network.
• Give a data subject, free of charge, without restriction and without excessive delay, confirmation of whether you process their data, the purposes, categories and recipients, the specific data itself and any available information on its origin, and let them exercise access to health or sex-life data, including genetic data, through a doctor of their choice.
• Let a data subject object at any time, on compelling and legitimate grounds tied to their particular situation, to processing carried out under a public-interest or legitimate-interest ground, and exclude their data from that processing once the objection is justified.
• Rectify, update or eliminate a data subject's personal data within sixty business days of a request where its processing does not comply with this law, and notify any recipient the data was previously disclosed to of the correction, update or elimination unless that is demonstrably impossible.

Lei n.º 22/11, de 17 de Junho de 2011, arts. 33-34 (transferência internacional de dados) · Read the law's page

• Notify the Agência de Protecção de Dados before transferring personal data to a country that ensures a level of protection at least equal to this law's, and expect the APD to assess adequacy by the nature, purpose and duration of the processing, the destination country and the legal, professional and security rules in force there.
• Before transferring personal data to a country that does not ensure an adequate level of protection, obtain the APD's authorisation on one of the law's listed grounds, such as the data subject's unequivocal, express and written consent, an applicable international treaty, humanitarian aid, contractual necessity, an important public interest or legal claim, the data subject's vital interests, a publicly accessible source, or the recipient's contractual guarantee of adequate protection on APD-set terms.
• Rely on uniform, binding internal privacy and data protection rules to satisfy the adequate protection requirement for a transfer between companies of the same corporate group.

Lei n.º 22/11, de 17 de Junho de 2011, arts. 44-62 (Agência de Protecção de Dados, contravenções e crimes) · Read the law's page

• Expect the Agência de Protecção de Dados, a public legal person with administrative, financial and asset autonomy composed of seven members, to supervise compliance with this law, issue guidance, decide complaints, register and publish processing files, and exercise its sanctioning function.
• Register a code of conduct with the APD before relying on it, and expect the APD to reject a code that conflicts with this law or other applicable legislation.
• Expect any person to be able to pursue an administrative or judicial remedy for a breach of this law's data protection rules, in addition to filing a complaint with the APD, and expect an APD decision to be appealable to the administrative courts.
• Expect to face judicial liability for reparation of moral or patrimonial harm caused to a person by misuse of their personal data, with the amount set by a judge.
• Expect an administrative fine, in national currency equivalent, of USD 75,000 to USD 150,000 for violating the security, professional secrecy, or special category duties in Articles 14, 15, 16, 17, 20, 30, 31 or 32, or of USD 65,000 to USD 130,000 for violating the general principles in Articles 6 to 11 or the consent, communication, or interconnection duties in Articles 18, 19 and 21 to 24, tripled for a company or association.
• Expect criminal liability of three to eighteen months' imprisonment or a corresponding fine, doubled for sensitive category data, for omitting a required APD authorisation request, giving false information in a notification or authorisation request, carrying out an illegal data interconnection, or failing to comply with the APD's own deadline for a required action.
• Do not access personal data whose access is barred to you without authorisation, on pain of six months' to two years' imprisonment or a corresponding fine, aggravated where achieved by defeating security rules or for a benefit.
• Do not erase, destroy, damage, suppress or modify personal data without due authorisation, on pain of eighteen months' to three years' imprisonment or a corresponding fine, aggravated for particularly serious damage.
• Interrupt, cease or block processing once the APD has notified you to do so, and cooperate with an APD request, on pain of up to three years' imprisonment or a corresponding fine for qualified disobedience.
• Keep personal data confidential once bound by professional secrecy, on pain of imprisonment of up to eighteen months, rising to two years for a public official, a financial gain motive, or harm to the data subject's reputation or privacy.
• Expect a court to add, alongside a fine, a temporary or permanent processing ban, an order to block, erase or destroy data, or publication of the conviction at your expense in a widely circulated periodical.