Processes personal data, in Guinea

Loi n° L/2016/037/AN, art. 28 (transfert vers un pays tiers) · Read the law's page

• Transfer personal data to a third country, meaning a State that is not a member of ECOWAS (CEDEAO), only if that State ensures a level of protection of privacy, freedoms and fundamental rights superior or equivalent to the one the law requires (Article 28).
• Before any actual transfer to such a third country, obtain the prior authorization of the personal data protection Authority (Articles 7 and 28).

Loi n° L/2016/037/AN, art. 54 (données sensibles) · Read the law's page

• Do not collect or process personal data revealing ethnic, racial or regional origin, filiation, political opinions, religious or philosophical convictions, trade-union membership, sex life, genetic data, or health, unless one of the exceptions in Article 54 applies (Article 54).
• Have any processing that relies on an Article 54 exception authorized and controlled, in its design and implementation, by the authority in charge of personal data protection (Article 54).

Loi n° L/2016/037/AN, arts. 30-38 et 40 (droits de la personne concernée) · Read the law's page

• At the latest when you collect personal data, tell the data subject your identity, the purposes, the categories of data, the recipients, the possibility of refusing to appear in the file, the existence of the rights of access and rectification, the retention period, and any possible transfer to a third country (Article 30).
• On a data subject's request, confirm whether their data is processed, communicate it with any available information on its origin, and give the purposes, categories of data and recipients (Article 31).
• Honor a data subject's objection, on legitimate grounds, to the processing of their data, and their free objection to use of their data for direct marketing (Article 32).
• Before personal data is first communicated to third parties, or used on their behalf, for direct marketing, inform the data subject and give them the express right to object free of charge (Article 32).
• On the request of a person who proves their identity, rectify, complete, update, block or delete personal data that is inaccurate, incomplete, equivocal or outdated, or whose collection, use, communication or retention is prohibited (Article 33).
• Erase a data subject's data on the grounds Article 35 lists, and do so without delay, unless an exception in Article 37 applies (Articles 35 and 37).
• Where personal data is processed automatically in a structured, commonly used format, give the data subject on request a copy of it in a structured, commonly used electronic format (Article 40).
• Do not carry out direct marketing, by any means of communication, with the personal data of a person who has not given prior written consent to receive it or who has formally objected (Article 54, the paragraph on direct marketing).

Loi n° L/2016/037/AN, arts. 47-53, 55-61 (autorité et sanctions) · Read the law's page

• Comply with a warning or a formal notice (mise en demeure) from the personal data protection Authority to cease or remedy a failure within the period it fixes (Article 50).
• Do not obstruct the Authority's action, and comply with its decisions and injunctions (Article 55).

Loi n° L/2016/037/AN, titre données à caractère personnel, portant Cybersécurité et Protection des Données à Caractère Personnel · Read the law's page

• Treat any processing of personal data belonging to a natural person as within this law's scope, whether you are an individual, a business, or a public institution operating in Guinea.
• Declare the processing of personal data to the competent Authority before you start, and begin only once you hold its acknowledgment of receipt (Article 5).
• Obtain the competent Authority's prior authorization before processing genetic or medical data, data on offences, convictions or security measures, a national identification number or similar identifier, biometric data, or data processed in the public interest, and before a transfer to a third country (Article 7).
• Process personal data only with the data subject's express prior consent, unless you are duly authorized and the processing is necessary for a legal obligation, a public-interest mission, a contract with the data subject, or safeguarding the data subject's interest or fundamental rights and freedoms (Article 18).
• Collect and process personal data lawfully and fairly, for determined, explicit and legitimate purposes, and keep it no longer than those purposes require (Articles 19 and 20).
• Keep personal data accurate and, where necessary, up to date, and erase or rectify data that is inaccurate or incomplete (Article 21).
• Choose a processor that can give guarantees for the protection and confidentiality of the data (Article 24).
• Take all useful precautions, given the nature of the data, to prevent it being distorted, damaged or reached by unauthorized third parties (Article 42).
• Draw up an annual report for the personal data protection Authority on your compliance with the relevant provisions of the law (Article 44).
• Bring your processing into compliance within one year of the law's promulgation, which is dated 28 July 2016 (Article 63).