Processes personal data, in the Central African Republic

Règlement n° 03/18/CEMAC/UMAC/CM du 21 décembre 2018 relatif aux conditions d'exercice, de contrôle et de supervision de l'activité des bureaux d'information sur le crédit dans la CEMAC, articles 1, 3, 6, 58, 60 à 66 et 100 à 102 · Read the law's page

• Operate as a credit information bureau only as a licensed legal entity, and supply a client's credit information only for the reasons the Regulation lists.
• As a credit institution or other entity supervised by the banking commission or the central bank, send the licensed bureaus, at least monthly, all credit information on your clients; the clients' prior consent is not required for this.
• As a user of bureau information, obtain the client's prior written consent before consulting the information held on the client, for each credit application and for follow-up of the credit relationship, and keep proof of the consent.
• Guarantee persons whose credit information you hold a right of access and rectification, and tell them the categories of data, the purpose of the collection and the bureau's contact details.
• Do not use bureau information for commercial prospecting, marketing or advertising without the client's prior written consent.
• Do not collect, keep, process or disclose sensitive data in a credit report.

Loi n° 24.001 du 25 janvier 2024 portant protection des données à caractère personnel, Chapitres Ier, II, V, VII et IX, articles 1 à 21, 28, 38 à 43, 57 et 58 (dispositions générales, principes, interconnexion des fichiers, délégué à la protection des données et dispositions finales) · Read the law's page

• Have a lawful basis, such as a contract's performance, a legal obligation, a legitimate interest that does not override the data subject's rights, the data subject's freely given and revocable consent, a vital interest, or a public interest mission, before processing someone's personal data.
• Apply the Act's core principles to every processing activity: lawfulness, fairness, transparency, security, purpose limitation, accuracy, proportionality, and a retention period no longer than the purpose requires.
• Take precautions appropriate to the data's nature and the risks involved to keep personal data secure, including protection against accidental or unlawful destruction, loss, alteration, or unauthorized access.
• Only retain personal data for archival, historical, statistical, or scientific purposes beyond its ordinary retention period under the safeguards a law defines for that purpose.
• Process personal data as a subcontractor only on the controller's instruction, offer sufficient guarantees to implement security and confidentiality measures, and put those obligations in the contract with the controller.
• If you provide electronic signature certification services, collect the personal data needed for issuing and keeping the certificates directly from the person concerned, and use it only for that purpose absent the person's express consent otherwise.
• Get the agency's prior authorization before interconnecting personal data files held for different purposes or by different controllers, stating in the request the nature of the data, the interconnection's purpose, and its duration.
• Designate a data protection officer to keep the processing register, review new processing before it starts, consult the agency in case of doubt, and handle data subject requests; only a person residing in the Central African Republic with the necessary qualifications may hold the role, and the agency must be told before the officer is removed.

Loi n° 24.001 du 25 janvier 2024, Chapitre II et Chapitre VI, articles 11 à 21 et 29 à 37 (droits liés au traitement, prospection directe) · Read the law's page

• Get a person's prior consent before contacting them with direct marketing by phone, fax, SMS, email, instant message, or social network, and let them unsubscribe or change their preferences at any time.
• Give every marketing communication, including one sent to a business or a professional contact, a notice and an unsubscribe mechanism as simple and effective as the original sign up.
• On request, give a person access to their data and to information about how any automated decision producing legal effects for them was reached, so they can understand and contest it.
• Let a person object, at any time and free of charge, to processing of their data where they show a legitimate reason, and answer an access request free of charge, on the spot or remotely, without delay, handing over a copy of the data on request.
• Correct, complete, update, block, or erase personal data on a substantiated request where it is inaccurate, incomplete, ambiguous, outdated, or unlawfully processed, and notify any third party you disclosed it to of the change without delay.
• You may refuse a manifestly abusive, repeated, or systematic request, but carry the burden of proving the abuse if the person disputes your refusal.
• Where a request concerns data processed for State security, defense, or public safety, expect the data protection agency, not the data subject directly, to route the access or rectification request.

Loi n° 24.001 du 25 janvier 2024, Chapitre III, articles 22 à 27 (flux transfrontalier) · Read the law's page

• Before transferring personal data outside the Central African Republic, confirm the destination offers a similar level of protection, or rely on one of the Act's specific derogations.
• Assess the destination's level of protection against the nature of the data, the purpose and duration of the processing, the countries of origin and destination, and the legal, professional, and security rules it applies, before any transfer.
• Do not let a recipient in a foreign State transfer the data onward to another State without your agreement as the original controller.
• Give the agency prior notice before transferring personal data to a State outside the CEMAC or CEEAC, and rely on the agency's authorization, supported by appropriate contractual clauses, where the destination lacks equivalent protection.

Loi n° 24.001 du 25 janvier 2024, Chapitre Ier Section 2 et Chapitre II, articles 11 à 21 (données sensibles et mineurs) · Read the law's page

• Get a data subject's explicit consent, and apply extra security and organisational safeguards, before processing a sensitive category of data such as racial origin, biometric or genetic data, health data, or political, religious, or trade union information.
• Get authorisation from a holder of parental responsibility before processing a minor's personal data, including for a direct offer of information society services to a child.
• Do not process sensitive data at all unless a listed derogation applies: the person's express consent unless a law bars it, safeguarding a life, a non profit body's own member processing for its religious, philosophical, political, or trade union purpose, establishing or defending a legal claim, health care or public interest health research, data the person made public, a law authorizing a public interest purpose, or a labor law right or obligation.
• Restrict processing of data about a person's offences, convictions, or safety measures to courts and public authorities acting within their legal powers, and to legal auxiliaries strictly for the duties assigned to them by law.
• When a processing activity involves sensitive data or a particularly vulnerable person's data, put additional organizational and technical safeguards in place and give that person heightened information before you process it.

Loi n° 24.001 du 25 janvier 2024, Chapitre VIII et Chapitre IX, articles 44 à 58 (sanctions et agence) · Read the law's page

• Comply with an administrative sanction the agency imposes for a breach of the Act, a warning, an order to stop processing, a pecuniary sanction of up to 5 percent of your turnover, or withdrawal of an authorization or certification, doubled on repeat conduct.
• Expect the agency to order an urgent interruption of your processing for up to three months, or to lock the data concerned for up to three months where the processing serves State security, defense, or public safety, whenever it violates the rights and freedoms the Act protects, and expect it to seek a court order under an emergency referral for a grave and immediate breach.
• Respond to the agency's report before any sanction, in writing or orally and represented if you choose, and expect a reasoned, published decision you may appeal to the administrative courts, at your cost if you are sanctioned.
• Expect criminal liability, from six months to five years' imprisonment and a fine of 100,000 to 10,000,000 FCFA depending on the offence, for obstructing the agency, negligent processing without required prior formalities, fraudulent collection, misusing a file's declared purpose, continuing to process despite a valid objection or rectification request, unlawful retention beyond the declared duration, or an unauthorized disclosure harming a person's standing or privacy.
• Expect the Ministry in charge of the digital economy to perform the agency's supervisory functions until the dedicated agency is formally established, within twelve months of the Act's promulgation.

Loi n° 24.002 relative à la cybersécurité et à la lutte contre la cybercriminalité, Titre II, Chapitre II (art. 14, 15 et 25) et Titre III, Chapitre I (art. 43) · Read the law's page

• Submit your networks or information systems to a mandatory security audit and severity-impact assessment by the Agence Nationale de la Cybersécurité at least once a year, or more often where circumstances require it.
• Provide the information and documents a security audit requires, and do not obstruct or resist it: obstructing a security audit is a criminal offense under Article 43.
• This binds a network operator, a certification authority and an electronic-communications service provider by name under Article 14, and Article 25 extends the mandatory security-audit regime to every electronic-communications network and every information system.
• Expect the confidential audit report to reach the Agence Nationale de la Cybersécurité for approval and then the Ministères chargés de la Sécurité Publique and de l'Economie Numérique for decision.

Loi n° 24.002 relative à la cybersécurité et à la lutte contre la cybercriminalité, Titre II, Chapitre III, Sections I et II (art. 16, 19, 20, 21, 23) · Read the law's page

• This binds an electronic-communications network operator or service provider (Article 16) and any information-system operator, whether public or private (Article 19), regardless of the sector in which the network or system is deployed.
• Take all technical and administrative measures necessary to guarantee the security of the services you offer, and adopt standardized systems to continually identify, assess, treat and manage the risks to your information systems' security.
• Put in place technical mechanisms addressing threats to your systems' permanent availability, integrity, authentication, non-repudiation and data confidentiality, and to their physical security, and submit those mechanisms to the Agence Nationale de la Cybersécurité for approval.
• Periodically evaluate and revise your security systems, and introduce necessary changes as technology evolves, under the Agence Nationale de la Cybersécurité's oversight.
• Inform your users of the dangers of using your network or information system, the particular security-violation risks involved, and the technical means available to secure their communications or restrict access to certain services.