Processes personal data, in Burkina Faso

Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel, arts. 1-11, 13, 23-41 (dispositions générales, principes fondamentaux, obligations du responsable et formalités préalables) · Read the law's page

• Obtain the data subject's prior consent before processing their personal data, unless a specific legal exception applies, such as performing a contract, complying with a legal obligation, protecting a vital interest, or a public interest ground.
• Collect personal data only for determined, explicit and legitimate purposes, keep it accurate and updated, and do not retain it beyond the period the purpose requires.
• Implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or unauthorized access.
• Before using a processor, choose one that offers sufficient guarantees of protection, and sign a written agreement with it fixing the processing operations it may carry out and what happens to the data when the contract ends.
• Complete the applicable prior formality with the Commission de l'informatique et des libertés (CIL) before processing personal data, a normal or simplified declaration, a request for its opinion, or its authorization depending on the category of processing.
• Obtain a CIL authorization before interconnecting personal data files or processing a national identification number, and limit any interconnection to a legitimate legal or statutory objective without discriminating against or reducing the rights of the people concerned.
• Obtain the CIL's authorization, given after the Health Research Ethics Committee's concurring opinion, before processing personal data for health research, anonymize the data before transmission wherever the research's purpose allows it, and host any health data that still permits identification on national territory.

Loi n°001-2021/AN, arts. 14, 16-17, 19-22 (droits de la personne concernée) · Read the law's page

• Obtain a person's prior consent before sending them unsolicited direct marketing communications of any kind, tell them before their data is first used for that purpose or disclosed to a third party, and let them withdraw consent at any time.
• Tell a data subject, no later than when you collect their data, your identity, the purposes of the processing, the categories of data, the recipients, the rights of access, rectification, erasure and objection, the retention period, any transfer abroad, and how to give or withdraw consent.
• Answer a data subject's access request by letting them consult their data on site or by giving them a copy after they prove their identity, and let a deceased adult's spouse, children or designated heir exercise that right on their behalf, or a minor's parent or legal representative exercise it for the minor, keeping the minor informed for medical data.
• Tell a data subject, on request, the information and reasoning behind a decision, automated or not, applied against them.
• Stop processing a person's data on their objection for legitimate reasons, unless you can show an overriding legitimate ground for the processing that outweighs their rights.
• Rectify, complete, update, lock or erase personal data at a data subject's written request within two months, notify any third party the data was disclosed to, and carry the burden of proof if you dispute the request.
• Remove, on request, personal data about a person's past private life that was collected and made public on a website, whether or not it is indexed by a search engine.

Loi n°001-2021/AN, arts. 31, 42-44 (transfert de données hors du Burkina Faso) · Read the law's page

• Before transferring personal data to a foreign country or an international organization, confirm that it assures a level of protection adequate to the protection Burkina Faso itself assures for privacy, fundamental freedoms and rights.
• Before any transfer of personal data outside Burkina Faso, obtain the CIL's authorization, sign a data confidentiality and reversibility clause with the receiving party letting data migrate back fully at the end of the contract, and put in place technical and organizational security measures covering encryption, availability, confidentiality, integrity and resilience.
• Assess the destination's level of protection against the nature of the data, the purpose and duration of the processing, the countries of origin and destination, and the legal and professional rules and security measures in force there, or rely on an international convention or CIL-approved ad hoc or standardized safeguards.
• Absent an adequate level of protection at the destination, transfer personal data abroad only under a listed exception, such as the data subject's specific informed consent, contractual necessity, a vital interest, a bilateral or multilateral agreement, or the CIL's express authorization of adequate contractual clauses or internal rules.

Loi n°001-2021/AN, arts. 45-79 (autorité de contrôle et sanctions) · Read the law's page

• Expect the Commission de l'informatique et des libertés (CIL), an independent administrative authority of nine members, to issue individual or regulatory decisions, warnings and referrals to the public prosecutor, and to receive complaints and petitions from data subjects.
• Cooperate with a CIL verification or control mission on site, including any expert it brings, and pay the mission's costs yourself if you were the one who requested the control.
• Take all useful measures to facilitate the CIL's mission, and do not obstruct its action for any reason.
• Expect a data subject or their representative to be able to seek urgent court relief for a serious and immediate violation of their rights, and to seek damages for the moral or material harm they suffered.
• Expect the CIL to pronounce a forfeitary fine of one percent of your prior year's tax-exclusive turnover for a first violation, rising to five percent for a repeat violation, on top of the fixed-range fines, confiscation, publication or activity-ban penalties it may add, and expect a violation of this law to be punished under the Penal Code's information-technology offense provisions.

Loi n°001-2021/AN, arts. 5, 12, 30-31, 35 (données sensibles) · Read the law's page

• Obtain the data subject's express consent before collecting or processing sensitive personal data, including data about health, biometric or genetic characteristics, sex life, racial or ethnic origin, political, philosophical, religious or trade union opinions or activity, morals, or criminal investigations, prosecutions, convictions and administrative or safety measures, unless a specific statutory exception applies.
• Obtain a Commission de l'informatique et des libertés (CIL) authorization before processing genetic or biometric data in the private sector, including for health research, and before processing personal data about offenses, convictions or safety measures in the private sector.
• Restrict any processing of personal data about offenses, convictions or safety measures to a court or public authority acting within its legal powers, a public body managing a public service after the CIL's concurring opinion, or a legal auxiliary acting strictly within duties assigned to it.