Processes personal data, in Equatorial Guinea

Règlement CEMAC/UMAC/CM du 21 décembre 2018 relatif aux conditions d'exercice, de contrôle et de supervision de l'activité des bureaux d'information sur le crédit dans la CEMAC, articles 1, 3, 6, 58, 60 à 66 et 100 à 102 · Read the law's page

• Operate as a credit information bureau only as a licensed legal entity, and supply a client's credit information only for the reasons the Regulation lists.
• As a credit institution or other entity supervised by the banking commission or the central bank, send the licensed bureaus, at least monthly, all credit information on your clients; the clients' prior consent is not required for this.
• As a user of bureau information, obtain the client's prior written consent before consulting the information held on the client, for each credit application and for follow-up of the credit relationship, and keep proof of the consent.
• Guarantee persons whose credit information you hold a right of access and rectification, and tell them the categories of data, the purpose of the collection and the bureau's contact details.
• Do not use bureau information for commercial prospecting, marketing or advertising without the client's prior written consent.
• Do not collect, keep, process or disclose sensitive data in a credit report.

Ley Núm. 1/2016, art. 10 (datos sensibles) · Read the law's page

• Process personal data relating to race, tribe or ethnicity, health, sex life, or religious, political or union creed only with the data subject's express written consent, unless the processing is in a file specially established for a political party, religious confession, trade union or similar association, or another Article 10 exception applies (Article 10).
• Include personal data on the commission of criminal or administrative offences only in the files of the bodies of the General State Administration, in the cases their governing rules provide (Article 10).

Ley Núm. 1/2016, arts. 13-14, 22, 24 (derechos de los interesados) · Read the law's page

• Before asking a person for personal data, tell them expressly and concisely the purpose and consequences of the collection, the destination and recipients of the data, whether answering is mandatory or optional, the effects of refusing, the existence of files or processing, and the identity and address of the controller or its representative (Article 9).
• On a data subject's request, provide free of charge, by consultation or in writing, a copy of the information on their personal data under processing, the origin of that data and the communications made or planned (Article 13(a), which states a period of twelve months).
• Give effect to a data subject's request to rectify or cancel inaccurate or incomplete personal data within fifteen days from the date of the request (Article 13(d)).
• Compensate a data subject for the damage or injury that you or your processor cause them (Article 13(e)).
• Resolve within five days of receipt a complaint or request to exclude a person's data from publicly accessible sources or advertising use, and do so free of charge (Article 22).
• Where you provide credit-information services, notify the data subject within fifteen days of the data entered about them in your files, and tell them they may obtain information on all of it (Article 24).
• Cancel and remove from processing, on the data subject's simple free request, the data of a person who objects to its processing in the services Article 24 covers (Article 24).

Ley Núm. 1/2016, arts. 27-28 (comunicación internacional de datos) · Read the law's page

• Do not communicate, assign or transfer personal data to a country that does not provide a level of legal protection comparable to the Law's, unless the Órgano Rector de Protección de Datos Personales has authorized the transfer in advance (Article 27).

Ley Núm. 1/2016, arts. 29-47 (órgano rector y régimen sancionador) · Read the law's page

• Attend the inspecting officials and give them the collaboration they need, appearing at the place, day and hour set and providing the documents, books, data, reports and records they request (Article 36).
• Stop the unlawful use, communication, assignment or transfer of personal data when the sanctioning body requires it, in a serious or very serious case (Article 42).

Ley Núm. 1/2016, de 22 de julio, de Protección de Datos Personales · Read the law's page

• Obtain the data subject's clear, undeniable and unquestionable consent before processing personal data, which the data subject may revoke for a justified reason without retroactive effect (Article 10).
• Collect for processing only personal data that is adequate, accurate, truthful, pertinent, complete and not excessive for determined, explicit and legitimate purposes, and do not obtain it by fraudulent or unlawful means (Article 6).
• Do not keep personal data in a form that identifies the data subject for longer than the purposes for which it was collected require, and cancel and replace inaccurate or incomplete data (Article 7).
• Govern processing carried out on your behalf by a third party with a written contract, signed by the parties, under which the processor processes the data only on your instructions (Article 8).
• Adopt the technical and organizational measures needed to keep personal data secure, and do not record it in files, systems or programs that lack conditions of integrity and confidentiality (Article 11).
• Keep personal data confidential at all times, and share it with a third party only within the cases Article 12 allows (Article 12).
• Create a private personal data file only under an administrative concession or authorization, and notify the project beforehand to the Órgano Rector de Protección de Datos Personales (Articles 17 and 20).
• Request the registration of each personal data file in the General Data Protection Register (Article 39(a)).