Processes personal data, in Benin

Loi n°2017-20 du 20 avril 2018, Livre V, Protection des Données à Caractère Personnelle, portant Code du Numérique en République du Bénin, arts. 379-390, 393, 405-414, 424-426 et 428-436 (principes généraux, licité et obligations des responsables de traitement) · Read the law's page

• Obtain a lawful basis, ordinarily the data subject's consent, before collecting, processing, transmitting, storing, or using their personal data, unless a specific legal exception applies.
• Collect personal data only for determined, explicit, and legitimate purposes, and do not process it further in a way incompatible with those purposes.
• Keep personal data accurate, correct or erase inaccurate or incomplete data, and do not keep it in identifiable form beyond what its purpose requires.
• Choose a processor offering sufficient security and confidentiality guarantees, fix the processor's obligations in a written contract, and ensure the processor acts only on your documented instructions.
• Where two or more controllers jointly determine the purposes and means of a processing, allocate your respective obligations toward data subjects in a transparent arrangement made available to them.
• Declare each processing of personal data to the Autorité de Protection des Données Personnelles (APDP) before implementing it, or obtain the Autorité's prior authorization where the processing falls into one of its listed higher risk categories.
• Implement data protection by design and by default, including pseudonymization and data minimization, so that only the personal data necessary to each specific purpose is processed by default.
• Implement appropriate technical and organizational measures against unauthorized or unlawful processing and against accidental loss, destruction, or damage, including pseudonymization and encryption where appropriate, and test their effectiveness regularly.
• Carry out a data protection impact assessment before a processing likely to create a high risk to individuals' rights and freedoms, and consult the Autorité first where the assessment shows a risk you cannot mitigate.
• Designate a data protection officer where you are a public body, or your core activities require regular and systematic large scale monitoring or large scale processing of sensitive personal data, and publish that officer's contact details.
• Keep a written record of your processing activities, covering the purposes, the categories of data subjects and data, the recipients, retention periods, and security measures, and make it available to the Autorité on request.

Loi n°2017-20 du 20 avril 2018, Livre V, art. 427 (notification des ruptures de sécurité) · Read the law's page

• Notify the Autorité de Protection des Données Personnelles (APDP) and the affected person without delay of any security breach that has affected their personal data.
• As a processor, warn the controller without delay of any security breach affecting personal data you process on the controller's behalf.
• Describe in the breach notification the nature of the breach, including where possible the categories and approximate number of affected data subjects and personal data records, your data protection contact point, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects.
• Skip notifying the affected person only where you had already applied protective measures such as encryption that make the data unintelligible, where later measures removed the high risk, or where it would take disproportionate effort and you make an equally effective public communication instead.

Loi n°2017-20 du 20 avril 2018, Livre V, arts. 391-392 (transfert transfrontalier de données) · Read the law's page

• Obtain the Autorité de Protection des Données Personnelles (APDP)'s finding that the destination country or international organization assures a level of data protection equivalent to Benin's own before any transfer of personal data outside Benin.
• Obtain the Autorité's prior authorization before any actual transfer of personal data to a third country or international organization, even where an equivalence finding exists.
• Where the destination does not assure an adequate level of protection, transfer personal data only where the data subject has given express consent, the transfer is necessary to perform or negotiate a contract with or for the benefit of the data subject, the transfer serves an important public interest or a legal claim, protects vital interests, or comes from a public register open to consultation, or where the Council of Ministers has authorized it by decree on the Autorité's opinion after you show sufficient privacy safeguards.
• Identify in your register of processing activities every transfer of personal data to a third country or international organization, including that country's or organization's identity and, where relied on, the documents evidencing appropriate safeguards.

Loi n°2017-20 du 20 avril 2018, Livre V, arts. 394-404, 407 et 446 (données sensibles et mineurs) · Read the law's page

• Do not process sensitive personal data, including racial or ethnic origin, political opinions, religion or beliefs, trade union membership, genetic data, biometric data used to uniquely identify a person, health data, or data about a person's sex life or sexual orientation, unless a listed exception applies, such as the data subject's explicit consent or data the person has manifestly made public.
• Verify that a minor is at least sixteen years old before processing their personal data in connection with an information society service offered directly to them, and otherwise obtain the consent of the holder of parental responsibility, making reasonable efforts to verify that consent given the technology available.
• Obtain the Autorité's prior authorization before processing personal data covered by Article 394, personal data processed for journalism, research, artistic, or literary purposes under Article 397, a national identification number, or biometric data.
• Do not process personal data about criminal convictions or related security measures except where the law specifically authorizes you to, such as a legal or regulatory obligation, or where it is necessary to manage your own contentious proceedings.
• Designate the categories of staff with access to sensitive personal data, keep that list available to the Autorité, and bind them to confidentiality by a legal, statutory, or contractual obligation.
• Where sensitive personal data is processed solely on the data subject's written consent, tell the data subject beforehand the reasons for the processing and the categories of staff who will access the data, in addition to the standard information notice.
• Do not rely on written consent alone to process sensitive personal data where you are the data subject's present or prospective employer, or where the data subject depends on you in a way that prevents them from freely refusing consent, unless the processing grants them a benefit.

Loi n°2017-20 du 20 avril 2018, Livre V, arts. 399-400, 415-423, 437-445 et 447 (droits des personnes concernées) · Read the law's page

• Respond to a data subject's request to access, rectify, or object to the processing of their personal data, and pass on any correction to any third party the data was disclosed to.
• Tell a data subject, no later than when you collect their personal data, your identity, the purposes of the processing, the recipients, whether automated decision making is in use, how long you will keep the data, and their rights of access, rectification, erasure, and objection.
• Where personal data was not collected from the data subject, give them the same information within a reasonable time and at most thirty days after obtaining it, or at the first communication or disclosure of the data if that comes sooner.
• Give a data subject their personal data in a structured, commonly used, machine readable format on request, and let them transmit it to another controller without obstruction, where the processing rests on consent or a contract and is carried out by automated means.
• Let a data subject object at any time, on legitimate grounds, to the processing of their personal data, and let them object free of charge and without any justification to processing for direct marketing, charitable, or political prospecting.
• Correct, complete, update, block, or erase personal data on a data subject's request where it is inaccurate, incomplete, ambiguous, outdated, irrelevant, or unlawfully processed, and pass the correction or erasure on to anyone the data was disclosed to.
• Where you made a data subject's personal data public, take reasonable steps, including technical measures, to tell any third party processing that data that the data subject has asked for it to be erased.
• Let an incapacitated adult's rights be exercised by their cohabiting spouse or partner, or in order, an adult child, a parent, or a sibling, or a court appointed guardian, and involve the data subject as far as their understanding allows.

Loi n°2017-20 du 20 avril 2018, Livre V, arts. 448-490 et Livre VI, arts. 514-517 (Autorité, sanctions et infractions pénales) · Read the law's page

• Comply with a formal notice the Autorité issues within the period it sets, which may not exceed eight days, before it moves to a sanction.
• Expect the Autorité to impose a pecuniary sanction, an order to stop processing, a temporary or permanent withdrawal of authorization, or a lock on the data concerned where you do not comply with a formal notice, up to fifty million CFA francs for a first violation, rising to one hundred million CFA francs, or five percent of your last closed financial year's turnover excluding tax up to that same figure, for a violation repeated within five years.
• Expect a sanction the Autorité pronounces to be made public, and expect a report and the chance to respond in writing or in person before the Autorité rules on it.
• Expect a data subject to be able to complain to the Autorité about your processing, and expect them to have an effective judicial remedy against you or against the Autorité where it fails to act within ninety days.
• Expect a data subject who suffered material or moral harm from your violation of this Book to seek reparation from you or your processor, with joint liability between multiple controllers or processors who took part in the same processing.
• Do not obstruct the Autorité's investigations, and furnish it, its designated agents, or its members the information, documents, and premises access they request.
• Complete the prior formalities and security measures this Book requires, or expect criminal liability of up to ten years' imprisonment and a fine of up to fifty million CFA francs for the offenses this Book's criminal chapter lists, reduced to a fine alone for a negligent failure to complete prior formalities.
• Include an unsubscribe link in every unsolicited electronic message you send based on personal data you collected, and do not use another person's or entity's identity to deceive message recipients or website users into disclosing personal or confidential data.