Processes personal data, in Cabo Verde

Lei n.º 133/V/2001, de 22 de Janeiro (Lei de Protecção de Dados Pessoais), as republished by Lei n.º 121/IX/2021, de 17 de Março, arts. 7, 12, 24 (nos. 1 to 3), 33-34, 39-40, 43 and 71 · Read the law's page

• Process personal data only where the data subject has unambiguously consented or where processing is necessary for a contract, a legal obligation, the data subject's vital interests, a public interest task, or your or a third party's legitimate interest that does not override the data subject's rights.
• Obtain the CNPD's authorization, or point to a legal provision establishing the combination, before combining personal data from different filing systems, and ensure any combination is necessary and adequate for its purposes, avoids discrimination, and carries adequate security measures.
• Implement technical and organizational measures adequate to the risks and the nature of the data to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, and choose a processor offering sufficient guarantees about those measures.
• Do not process personal data you access in the course of your duties except on the controller's instructions, unless the law requires otherwise, and keep personal data confidential as a matter of professional secrecy, both during and after your role ends.
• Notify the CNPD before carrying out a wholly or partly automated personal data processing operation, and obtain the CNPD's prior authorization, unless a legal act authorizes it, for processing of the data referred to in points (a) and (c) of Article 8(1) and in Article 11(2), credit and solvency data, interconnection of personal data, or use of personal data for purposes other than those for which it was collected.
• Publish, through the CNPD's public register, or make available to anyone who asks, the particulars of a processing operation not covered by a legal provision.

Lei n.º 133/V/2001, de 22 de Janeiro, arts. 11 (nos. 1 and 3) and 25 as republished by Lei n.º 121/IX/2021, de 17 de Março (registos de infrações e medidas especiais de segurança) · Read the law's page

• Create or keep a central register on persons suspected of illegal activities or on criminal or administrative offences, penalties or security measures only as a public service with that legal competence, and limit processing for police investigation to what a concrete danger or a particular offence requires.
• Take the additional information security measures Article 25 lists for special-category and criminal-record data, including controlling entry to processing premises, controlling who can read, copy or alter data carriers, controlling use of and access to the processing systems, and logically separating health and sex life data, including genetic data, from other personal data.

Lei n.º 133/V/2001, de 22 de Janeiro, arts. 13 (no. 4), 14 (no. 5) and 20 (b) and (c) as republished by Lei n.º 121/IX/2021, de 17 de Março (direitos dos titulares dos dados) · Read the law's page

• Warn a data subject, when their data is collected over an open network and unless they already know it, that their personal data may circulate without security conditions and risk being seen and used by unauthorized third parties.
• Let a data subject exercise access to health data, including genetic data, through a doctor of their own choosing.
• Let a data subject object on request and free of charge to processing for direct marketing or other prospecting, and object without cost to a first disclosure to third parties for those purposes or to use on behalf of third parties.

Lei n.º 133/V/2001, de 22 de Janeiro, as republished by Lei n.º 121/IX/2021, de 17 de Março, arts. 35-36 (transferência internacional de dados) · Read the law's page

• Confirm that a destination country ensures an adequate level of data protection before transferring personal data there, and expect the CNPD to decide adequacy by the nature of the data, the purpose and duration of the processing, the countries of origin and final destination, and the legal, professional and security rules in force there.
• Before transferring personal data to a country that does not ensure an adequate level of protection, obtain the CNPD's permission based on the data subject's unambiguous consent or one of the law's other listed grounds, such as contractual necessity, an important public interest or legal claim, the data subject's vital interests, or a public register open to consultation.
• Present sufficient guarantees for the protection of privacy and fundamental rights and freedoms, in particular appropriate contractual clauses, to obtain the CNPD's authorization for a transfer or set of transfers to a country without an adequate level of protection.

Lei n.º 133/V/2001, de 22 de Janeiro, as republished by Lei n.º 121/IX/2021, de 17 de Março, arts. 37, 45-47, 49-50, 59, 61-63 and 69 (recursos, contraordenações e crimes) · Read the law's page

• Expect data protection supervision to follow up, evaluate and control the activity of the organs and services legally competent to process personal data, in compliance with the Constitution and this law.
• Expect the CNPD to help draft codes of conduct and to declare whether a draft submitted by a professional association or representative organization complies with the data protection laws and regulations in force.
• Expect any person to be able to seek judicial recourse for a violation of the rights this law guarantees, in addition to filing a complaint with the CNPD.
• Expect to be held liable to compensate a person for damage caused by unlawful processing or another act that breaches data protection legislation or regulation, unless you prove that the fact that caused the damage is not attributable to you.
• Expect an administrative fine of CVE 50,000 to 500,000 for an individual or CVE 300,000 to 3,000,000 for a legal person or entity without legal personality for negligently omitting or falsifying the Article 39 notification, doubled for data subject to Article 40 prior authorization, or a fine of CVE 100,000 to 1,000,000, doubled for failing the obligations in Articles 7, 8, 11, 12, 35 or 36, for another listed omission.
• Expect criminal liability of up to one year's imprisonment or a fine of up to 120 days, doubled for Article 8 or 11 data, for intentionally omitting a required CNPD notification or authorization request, giving false information in one, diverting or using data incompatibly with the purpose of collection, or carrying out an illegal data interconnection.
• Do not erase, destroy, damage, suppress or modify personal data without authorization so as to make it unusable or impair its usability, on pain of up to two years' imprisonment or a fine of up to 240 days, doubled for particularly serious damage.
• Interrupt, cease or block processing once notified to do so, cooperate with a CNPD request, and erase or destroy personal data once notified or once its retention period under Article 6 has elapsed, on pain of the penalty for qualified disobedience.
• Keep personal data confidential once bound by professional secrecy, on pain of imprisonment from six months to three years or a fine of eighty to two hundred days, increased by half for a civil servant, a financial gain motive, or endangering another person's reputation, honor or private life.
• Expect a temporary or permanent processing ban, an order to block, erase or destroy data, publication of the conviction at your expense in a widely circulated periodical, or a public warning or censure to be ordered alongside a fine or penalty.

Lei n.º 133/V/2001, de 22 de Janeiro, art. 38 as republished by Lei n.º 121/IX/2021, de 17 de Março (natureza da fiscalização) · Read the law's page

• Submit to supervision by the CNPD, the independent administrative authority that oversees personal data protection under this law and operates within the National Assembly.

Lei n.º 133/V/2001, de 22 de Janeiro, art. 18 as republished by Lei n.º 121/IX/2021, de 17 de Março (direito de portabilidade dos dados) · Read the law's page

• Let a data subject receive the personal data concerning them that they provided to you, in a structured, commonly used and machine-readable format, and transmit it to another controller without hindrance from you, where the processing is based on consent or on a contract and is carried out by automated means (Article 18(1)).
• When a data subject exercises the right of portability, transmit the personal data directly to the other controller where that is technically possible (Article 18(2)).

Lei n.º 133/V/2001, de 22 de Janeiro, art. 26 as republished by Lei n.º 121/IX/2021, de 17 de Março (proteção de dados desde a conceção e por defeito) · Read the law's page

• Apply appropriate technical and organizational measures, such as pseudonymization, both when you determine the means of processing and when you process personal data, so that the data protection principles such as minimization are implemented effectively and the processing protects data subjects' rights (Article 26(1)).
• Apply measures that ensure, by default, that you process only the personal data necessary for each specific purpose, as to the amount collected, the extent of processing, the storage period and accessibility (Article 26(2)).
• Ensure by default that personal data are not made available without human intervention to an indefinite number of individuals (Article 26(2)).

Lei n.º 133/V/2001, de 22 de Janeiro, arts. 27 and 28 as republished by Lei n.º 121/IX/2021, de 17 de Março (violação de dados pessoais) · Read the law's page

• Notify the CNPD of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to put individuals' rights, freedoms and guarantees at risk, and state the reasons for the delay if you notify later (Article 27(1) and (2)).
• Make the notification to the CNPD describe the nature of the breach, including where possible the categories and approximate number of data subjects affected, its likely consequences and the measures you have taken or propose, and keep it confidential (Article 27(3)).
• Document every personal data breach, with its facts, its effects and the remedial measures taken, so that the CNPD can verify your compliance (Article 27(5)).
• If you are a processor, notify the controller without undue delay of any personal data breach you become aware of (Article 27(6)).
• Communicate a personal data breach likely to result in a high risk to a data subject's rights, freedoms and guarantees to that data subject without undue delay, in clear and plain language, describing its nature, likely consequences and the measures taken or proposed, unless you applied appropriate protection measures to the affected data, have taken later measures that make the high risk no longer likely, or the effort would be disproportionate, in which case inform data subjects by an equally effective means such as a public communication (Article 28).

Lei n.º 133/V/2001, de 22 de Janeiro, arts. 30 to 32 as republished by Lei n.º 121/IX/2021, de 17 de Março (encarregado da proteção de dados) · Read the law's page

• Designate a data protection officer if the processing is carried out by a public authority or body, other than the courts and the public prosecutor acting in their procedural capacity, if your core activities require regular and systematic monitoring of data subjects on a large scale, or if your core activities consist of large-scale processing of the special categories of data in Article 8 or of data on criminal convictions and offences in Article 11 (Article 30(1)).
• Designate the officer on the basis of professional qualities and expert knowledge of data protection law and practice, and communicate the officer's contact details to the CNPD (Article 30(4) and (6)).
• Involve the officer properly and in good time in all issues relating to the protection of personal data, and give the officer the resources, and the access to personal data and processing operations, needed to perform the tasks and keep expert knowledge up to date (Article 31(1) and (2)).
• Give the officer no instructions on the exercise of the tasks, do not dismiss or penalize the officer for performing them, and let the officer report directly to the highest management level (Article 31(3)).
• Where the officer has other tasks and duties, ensure that they do not result in a conflict of interests (Article 31(6)).

Lei n.º 133/V/2001, de 22 de Janeiro, arts. 6 and 24 (nos. 4 to 6) as amended by Lei n.º 121/IX/2021, de 17 de Março (qualidade dos dados e subcontratação) · Read the law's page

• Process personal data lawfully, transparently and in good faith, collect it only for determined, explicit and legitimate purposes, keep it adequate, relevant and limited to the minimum necessary, keep it accurate and up to date, and do not keep it identifiable for longer than the purposes require.
• Bind a processor by a contract or other legal act under which it acts only on your instructions and that sets out the subject matter and duration of the processing, its nature and purpose, the categories of personal data and the controller's obligations and rights, and do not let it engage another processor without your prior specific written authorization (Article 24(4) and (6)).

Lei n.º 133/V/2001, de 22 de Janeiro, arts. 60 and 64 to 67 as republished by Lei n.º 121/IX/2021, de 17 de Março (acesso indevido e crimes contra os dados pessoais) · Read the law's page

• Do not access personal data barred to you without due authorization or justification, on pain of up to one year's imprisonment or a fine of up to 120 days, doubled where achieved by defeating security rules, where it let you or a third party learn personal data, or for a benefit.
• Do not copy, transfer or assign personal data without legal provision or consent, use it incompatibly with the purpose of collection, promote an illegal interconnection of data, or insert false personal data to obtain an undue advantage or cause harm, on pain of up to one or two years' imprisonment or a fine of up to 120 or 240 days.

Lei n.º 133/V/2001, de 22 de Janeiro, as republished by Lei n.º 121/IX/2021, de 17 de Março, art. 8 and art. 11 (no. 2) (dados sensíveis) · Read the law's page

• Do not process personal data relating to political, philosophical or ideological convictions or positions, religious faith, party or trade union membership, racial or ethnic origin, genetic data, biometric data, data relating to private life, health, sex life or sexual orientation, unless the data subject has expressly consented with guarantees of non-discrimination and adequate security measures, the law authorizes it with the same guarantees, the processing is statistical and not individually identifiable, the CNPD authorizes it, or another of the law's listed grounds is met.
• Process health, sex life and sexual orientation data, including genetic data, only through a health professional or other person bound by professional secrecy, only for preventive medicine, work-capacity assessment, medical diagnosis, health or social care or health system management, and only once notified to the CNPD, with adequate information security measures.
• Process data on suspected illegal activities, criminal and administrative offences, convictions, security measures, fines, additional penalties or disciplinary offences under the CNPD's authorization, which is available where the processing is necessary for your legitimate purposes and does not override the data subject's rights, observing data protection and information security rules.
• Do not use profiling that leads to discrimination against individuals on the basis of the special categories of personal data.

Lei n.º 133/V/2001, de 22 de Janeiro, as republished by Lei n.º 121/IX/2021, de 17 de Março, arts. 13 (nos. 1 and 3), 14 (no. 1) and 20 (a) (direitos dos titulares dos dados) · Read the law's page

• Tell a data subject, except where they already know it, your identity and address and any representative's, the data protection officer's contact details, the categories of data, the purposes and legal basis of processing, the recipients or categories of recipients, whether a reply is mandatory or voluntary and the consequences of not replying, and the existence and conditions of the rights of access, rectification, erasure and objection, at the time of collection or, if not collected from the data subject, when the data is recorded or at the latest on first disclosure to a third party, unless the law authorizes the processing or informing them is impossible or would take disproportionate effort.
• Give a data subject, freely and without restriction, at reasonable intervals and without excessive delay or cost, confirmation of whether you process their data, the purposes, categories and recipients, a copy of the data on request, an intelligible communication of the data and any available information on its source, the logic behind automated decisions including profiling, and notice to third parties of any rectification, erasure or destruction.
• Let a data subject object at any time, on compelling legitimate grounds relating to their particular situation, to processing you carry out for a public interest or legitimate interest ground, and stop unless you show overriding compelling legitimate grounds or the processing serves a legal claim.