Processes personal data, in Gabon

Loi N° 027/2023 du 11 juillet 2023, Titre III, Chapitre III, Section 2, arts. 28-35 · Read the law's page

• This binds any operator of an information system with effects in Gabon, a term Law No. 027/2023 defines without a sector or size gate as an organised set of resources that collects, groups, classifies, processes or disseminates information, and separately binds any person whose activity is to offer users access to an information system.
• Take all technical and administrative measures necessary to guarantee the security of the services you offer, including a standardised system to identify, evaluate, treat and continuously manage the risks affecting your information systems' security.
• Deploy technical mechanisms addressing threats to your systems' continuous availability, integrity, authentication, resistance to repudiation by third-party users, data confidentiality and physical security, and have those mechanisms cleared for conformity with the competent administrative authority's cybersecurity policy.
• If your activity is to offer users access to an information system, inform them of the danger of using an unsecured system, the need for a parental-control device, the particular risks of a security breach, and the existence of a technical means to restrict access to certain services, and offer them at least one such means.
• Retain your systems' connection and traffic data for ten years, and submit your networks and information systems to a mandatory, periodic security audit on terms a regulation sets.
• Comply within six months of the law's entry into force; Article 98 does not itself state what sanction follows a late or missing compliance with this duty.

Loi n°001/2011 du 25 septembre 2011 relative à la protection des données à caractère personnel, telle que modifiée et complétée par la loi n°025/2023 du 9 juillet 2023, Journal Officiel n°218 bis du 15 juillet 2023, articles 1 à 6, 70 à 73, 78 à 90, 111 à 141, 164 à 167, 175 à 187 et 215 à 221 · Read the law's page

• Collect and process personal data fairly and lawfully, only for determined, explicit and legitimate purposes, and keep it accurate, adequate and no longer than those purposes need.
• Have a lawful basis for processing, such as the data subject's consent, a legal obligation, a public-service mission, contract performance, or a legitimate interest that does not override the data subject's own rights and freedoms.
• Where you rely on consent, be able to demonstrate it was given and present the request clearly and separately from other terms; never treat acceptance of general terms of use or a pre-checked box as consent, and in an electronic transaction take it through an unambiguous act such as a checkbox.
• Let the data subject withdraw consent at any time without affecting the lawfulness of processing already carried out, and tell them of that right before they consent.
• Declare an automated personal-data processing activity to the APDPVP before carrying it out and wait for the Authority's receipt before starting, unless a simplified or exempt category applies; processing touching a more sensitive category instead needs the APDPVP's prior authorization or a ministerial or Council-of-Ministers decree.
• Keep processing confidential, bind everyone who processes the data under your authority to a signed written undertaking, and impose the same security and confidentiality guarantees on any processor by contract.
• Implement technical and organizational security measures adapted to the risk, including pseudonymization and encryption, and regularly test, assess and evaluate their effectiveness.
• Keep a written or electronic register of your processing activities, and require the same of any processor, naming the controller, purposes, data categories, recipients, transfers and retention periods, and produce it to the APDPVP on request; an organization of fewer than ten employees is exempt unless the processing is not occasional, carries a risk to rights and freedoms, or touches sensitive or criminal-offence data.
• Designate a data protection officer, notify the APDPVP of the designation, and give the officer the office, resources and independence to advise you, monitor compliance, and liaise with the APDPVP, where you are a public authority, carry out large-scale systematic monitoring, or process sensitive or criminal-offence data at scale.
• Carry out a data protection impact assessment, the study the law says must be carried out whenever processing is likely to create a high risk to the rights and freedoms of the people concerned.
• Before deploying an artificial-intelligence system, a facial-recognition or other biometric-identification system, a drone or other connected object, an electronic-signature or digital-identity service, or a national or sectoral identifier system that processes personal data, file the declaration or notice the applicable norme or decree requires with the APDPVP.
• Comply with the law from the date of its publication.

Loi n°025/2023, articles 142 à 147 (violation de données à caractère personnel) · Read the law's page

• Notify the APDPVP without delay of a personal-data breach, describing its nature, the categories and approximate number of data subjects and records concerned where possible, the data protection officer's or another contact point's details, the likely consequences, and the measures taken or proposed to address it; the law sets no numeric deadline for this notice.
• Accompany a notification to the APDPVP with supporting evidence of the breach.
• As a processor, notify the controller without delay of a personal-data breach as soon as you become aware of it.
• Where a breach is likely to create a high risk to a person's rights and freedoms, inform the affected person as soon as possible, in clear and simple terms, giving at least the same information given to the APDPVP.
• Skip that communication to the person only where you had already applied protective measures rendering the affected data unintelligible, where later measures mean the high risk is no longer likely to materialize, or where it would take disproportionate effort, in which case make a public communication of equal effect instead; expect the APDPVP to be able to compel direct communication anyway after weighing the breach's gravity.
• Keep an up-to-date register of every personal-data breach, its circumstances, its impact and the remedial measures taken, and make it available to the APDPVP.

Loi n°025/2023, articles 168 à 174 (interconnexion et transfert transfrontalier de données) · Read the law's page

• Obtain the APDPVP's prior authorization before transferring personal data to another State; consult the list of States the Authority has found to offer a sufficient level of protection.
• Absent that authorization, transfer only where the data subject has expressly consented to the specific transfer and it is necessary to safeguard their life or the public interest, to establish, exercise or defend a legal claim, to consult a public register, or to perform or negotiate a contract with or for the data subject's benefit, or where the APDPVP or a decree has found the processing otherwise offers a sufficient level of protection, such as through contractual clauses or binding internal rules.
• Expect the APDPVP to suspend or cancel a transfer, on a receipt served to that effect, once it finds the destination State does not offer a sufficient level of protection, and expect the suspension to lift once it finds that level established.
• Obtain the APDPVP's authorization before interconnecting your data systems with those of another public-service body pursuing a different public interest, or with another private party's systems pursuing a different main purpose.

Loi n°025/2023, articles 200 à 214 (recours, contrôle et sanctions) · Read the law's page

• Expect the APDPVP's members and sworn, authorized agents to access your professional premises used for processing, accompanied by judicial police officers with the public prosecutor informed in advance, and expect a court order to be needed only if you oppose the visit.
• Produce any document the APDPVP's members or agents request for their mission, and let them access your programs and data for control purposes.
• Expect a warning, then a formal notice to end a breach within a set period, then a financial penalty, for failing to meet a duty under the law; a first breach is capped at 98,400,000 FCFA and, on repetition, at 300,000,000 FCFA or 5% of a company's last closed-year turnover up to 196,000,000 FCFA, alongside a provisional processing suspension that becomes definitive after three months.
• Where you already hold a declaration receipt or an authorization and breach the law, expect its suspension for up to two months and then its definitive withdrawal, alongside a fine of 1,000,000 to 100,000,000 FCFA; operating without ever having filed makes you a de facto controller facing the same fine.
• Expect the APDPVP to order, without a prior notice-and-cure period, the interruption of a processing operation, the locking of data, a temporary ban of up to three months, or a definitive ban, wherever it finds the processing violates rights and freedoms.
• Appeal a sanction or decision of the APDPVP to the Conseil d'Etat.
• Expect a data subject to be able to sue you or your processor in the competent courts after first bringing the matter to the APDPVP, including through a nongovernmental organization or association working in data protection that the person mandates; the APDPVP itself cannot award compensation.
• Expect criminal offences arising from a breach of the law to be punished under the Penal Code, and expect six months' to a year's imprisonment and a fine of 1,000,000 to 10,000,000 FCFA, doubled on repetition, for obstructing the APDPVP's own action.

Loi n°025/2023, articles 43 à 65 et 91 à 110 (droits de la personne concernée et obligation de transparence) · Read the law's page

• Respond to a data subject's request to access, rectify, erase, restrict, port, or object to the processing of their personal data.
• Act on a data-subject request within one month of receiving it, extendable by two months for complex or numerous requests provided you tell the person of the extension and its reasons within the first month; where you decline to act, tell the person why within one month and of their right to complain to the APDPVP or go to court.
• Provide the information free of charge, except that you may charge a reasonable fee or refuse where a request is manifestly unfounded or excessive, in which case you carry the burden of showing that.
• At collection, tell the person your identity, the data protection officer's contact details where designated, the purpose and legal basis, any legitimate interest relied on, recipients, any transfer abroad, the retention period or the criteria for it, their rights including withdrawal of consent, their right to complain to the APDPVP, and the existence and logic of any automated decision-making or profiling that concerns them.
• Where you did not collect the data from the person, give them the same categories of information, including the data's origin and whether it came from a publicly accessible source, within one month, or by the time you first contact them or first disclose the data to another recipient, whichever is earliest.
• Before accessing or storing information on a subscriber's or user's terminal equipment, such as through a cookie, tell them the purpose and how to object, and proceed only once they have consented, except where the access is strictly necessary to provide an electronic communication service they expressly requested.

Loi n°025/2023, articles 74 à 77, 148 à 163 et 188 à 199 (catégories sensibles de données et protection des mineurs) · Read the law's page

• Process a minor's personal data only on their own consent once they turn eighteen, or otherwise only with the express authorization of the holder of parental authority, and confirm by some means that the consent you rely on is theirs.
• Do not collect or process data revealing racial or ethnic origin, political, philosophical or religious opinions, trade-union membership, biometric or genetic data, or data on health or sex life, unless a listed exception applies, such as the data subject's own express consent, a non-profit body's processing of its own members, data the person made public, or preventive medicine and care administered by a bound health professional.
• Process data on offences, criminal convictions and safety measures only where you are a public, judicial or public-service body acting within your legal remit, or a legal auxiliary acting for the defense of the person concerned.
• Before processing personal data for a public-interest research, study or evaluation purpose in the health domain, obtain the APDPVP's authorization, given after the health-research consultative committee opines on your methodology and the necessity and relevance of the data.
• Before collecting a child's personal data through a search engine, website, platform, application, or connected or geolocation service, obtain the prior consent of the child's parent or the person holding parental responsibility.
• Do not profile a child, except where the APDPVP has authorized it on a motivated opinion for the child's best interest or on a public-interest ground.
• Treat as void, on a challenge before the competent court, a contract a child enters through an internet-based service where it is prejudicial to the child.
• Where your online service is aimed at children, build in privacy-protective technical measures such as marking and filtering, write information for them in terms they can understand, keep advertising, entertainment and games clearly distinct from content, never incite a child to buy goods or enter an online contract, and never use prizes, rewards or links to a non-compliant site to keep them engaged.