Processes personal data, in Côte d'Ivoire

Décret n°2021-917 du 22 décembre 2021, Arts. 16-17 · Read the law's page

• Inform ARTCI, the body Article 16 names, immediately of any attack, intrusion or other disruption likely to impede your information system's proper functioning; ANSSI, which now houses the national incident-response centre CI-CERT, publishes the online declaration form for every kind of entity.
• Where you are designated and notified as a critical-infrastructure operator or manager, expect your cybersecurity focal point to also serve as your liaison to CI-CERT and to a sector cybersecurity officer, roles this vocabulary does not separately express.
• This duty runs to every public or private organization operating an information system in Côte d'Ivoire, with no activity or size gate.
• Expect ARTCI, not your own organization, to take the measures it judges necessary to stop a disruption once you have notified it.

Décret n°2021-916 du 22 décembre 2021, Arts. 1-2 · Read the law's page

• Comply with the RGSSI (the ISO 27001/27002-based security standard Décret n°2021-917's audits check you against), which Article 2 makes binding on every public body and private enterprise, and, if you also operate a designated critical-infrastructure asset, with the PPIC.
• Where you are designated and notified as a critical-infrastructure operator or manager, renew a complete risk analysis of your critical infrastructure at least every six months and designate a cybersecurity focal point, a designation this vocabulary does not separately express.
• Do not expect this décret to state its own penalty for noncompliance: enforcement runs through Décret n°2021-917's audit, certification and sanction mechanism, filed as its own row in this jurisdiction.

Décret n°2021-917 du 22 décembre 2021, Arts. 3-4, 19-21 · Read the law's page

• Undergo a security audit for certification of your information system every three years, performed by ANSSI or by an audit provider (PASSI) that ANSSI has approved.
• Undergo a further mandatory periodic security audit eighteen months after your certificate is issued.
• Correct a major nonconformity the auditing authority identifies and have your information system re-audited within twelve months, or receive a formal notice ordering you to comply.
• Expect a financial penalty proportional to the breach's severity and the advantage you gained, capped at 300,000,000 CFA francs and doubled on a repeat breach, if you fail to complete the mandatory audit.
• If you are a public body, or a private organization with an information system located on Côte d'Ivoire's territory, you fall inside Article 3's mandatory-audit population; Article 3 names in particular a telecommunications or ICT company, a telecommunications or internet service provider, a company whose information system connects through Côte d'Ivoire's public telecommunications networks, a company that automatically processes its customers' personal data in providing its service, an electronic-transactions company, an ARTCI-approved service provider, and an electronic-archiving or record-keeping provider, and that list is not exhaustive.

Loi n° 2013-450 du 19 juin 2013 relative à la protection des données à caractère personnel, arts. 1-20, 22, 27, 39-44 (lawful basis, registration and security) · Read the law's page

• Have a lawful basis, such as the person's express consent, before collecting, transmitting, storing or using anyone's personal data, whether the processing is automated or not.
• Declare the processing to ARTCI in advance, or designate an internal correspondent for the protection of personal data in its place, except before a cross-border transfer.
• Obtain ARTCI's prior authorization before processing on a national identification number or a personal-data set of public-interest, historical or scientific research value.
• Include in every declaration or application for authorization the identity of the person responsible, the purpose, the data categories and their origin, the retention period, the recipients, the office where access is exercised, the planned security measures, and any subcontractor or cross-border transfer.
• Collect and process personal data lawfully and fairly, for specified and legitimate purposes, keeping it no longer than those purposes require, accurate, and transparent to the person concerned.
• Choose a subcontractor who gives sufficient guarantees for the protection and security of the data, and ensure the subcontractor complies with this Law.
• Do not send unsolicited electronic direct-marketing messages using a person's personal data without their consent.
• Do not interconnect files in a way that causes discrimination or a reduction of a person's rights, freedoms or guarantees.
• Prevent unauthorized access to the installations and data used for processing, guard against the processing being used for money laundering or terrorist financing, and keep backup copies for security.
• Send ARTCI an annual report on compliance with these security measures.

Loi n° 2013-450, arts. 28-38 (rights of the data subject) · Read the law's page

• Give the person concerned, at the latest when you collect their data, your identity, the purpose, the categories of data, the recipients, their right to refuse to appear on the file, their rights of access and rectification, the retention period, and whether the data may be transferred to a third country.
• Answer a request for access with confirmation of whether the person's data are processed, the data themselves and their origin, and the purposes, categories and recipients of the processing.
• Stop processing a person's data for prospecting purposes as soon as they object, free of charge, and tell them before their data are first disclosed to a third party for prospecting so they can object to that disclosure.
• Rectify, complete, update, delete or lock personal data on request where it is inaccurate, incomplete, ambiguous or outdated, including at the request of a deceased person's successors.
• Erase a person's personal data and end its distribution on request, including data made available while they were a minor, where it is no longer necessary, where consent is withdrawn, where the processing lacks a legal ground, or for another legitimate reason, and tell every third party the data were disclosed to that removal is sought.
• Give a person their personal data in a structured, commonly used electronic format on request, and forward it to another system where the processing rests on consent or a contract.

Loi n° 2013-450, arts. 45-52 (enforcement and the Protection Body) · Read the law's page

• Respond to ARTCI's declarations, authorization requests, claims, complaints and audits, and comply with a warning or formal notice it issues within the time it sets.
• Do not invoke professional secrecy against the Protection Body, whether you are a cryptologic service provider or the person responsible for the processing.
• Comply with an order interrupting a processing, locking data, or prohibiting a processing temporarily or permanently once the Protection Body issues it after an adversarial procedure.
• Expect a financial penalty proportionate to the breach and the benefit derived from it, capped at 10 million CFA francs for a first failure and rising, for a repeated failure within five years, to 100 million CFA francs or, for a company, to 5 percent of the prior financial year's turnover excluding tax up to a maximum of 500 million CFA francs.
• Do not oppose the Protection Body's members or authorized agents, refuse or conceal information or documents they request, or supply information inconsistent with your own records.

Loi n° 2013-450, arts. 7, 21 (sensitive categories of personal data) · Read the law's page

• Obtain ARTCI's prior authorization before processing genetic or medical data and related scientific research, an offense, conviction or court-imposed security measure, or biometric data.
• Do not process personal data revealing a person's racial, ethnic or regional origin, political opinion, religious or philosophical belief, trade-union membership, sex life, or genetic data concerning health, unless a listed exception applies.
• Where an exception permits processing that data, obtain ARTCI's authorization and design and carry out the processing under its supervision.
• Confine processing under the non-profit exception to the body's own members or to people with regular contact related to its purposes, and do not disclose the data to a third party without their consent.

Loi n° 2013-450, arts. 7, 26 (cross-border transfer) · Read the law's page

• Before transferring personal data to a third country, confirm that country affords a level of protection of privacy, freedoms and fundamental rights equivalent to or higher than Côte d'Ivoire's.
• Obtain ARTCI's prior authorization before implementing any processing that transfers personal data to a third country, and its permission again before the actual transfer takes place.
• Expect the Protection Body to monitor a cross-border transfer on a continuing basis in light of its purpose.