Processes personal data, in the Comoros

Loi n° 14-029/AU portant protection des données à caractère personnel, deliberated and adopted by the Assemblée de l'Union des Comores in plenary session on 26 June 2014, arts. 1-5, 41-42, 43(a) and (e)-(g), 44-46, 49-53 and 66-68 (comprehensive regime, formalities and obligations) · Read the law's page

• Collect and process personal data lawfully and fairly, only for determined and legitimate purposes, keep it accurate and up to date, and do not retain it beyond the period necessary for those purposes.
• Declare personal data processing to the Commission before implementing it, or enter it in a register kept by a designated person, unless it is exempt as general accounting, payroll, supplier management, or a non profit association's membership processing.
• Obtain the Commission's prior authorization before processing a national identification number or a national census, processing concerning state security, defense or public safety or the investigation and prosecution of offenses, interconnecting files serving different purposes, or processing that could exclude a person from a right, a benefit or a contract.
• State in your declaration the controller's identity and address, the processing's purposes, the data collected and its retention period, who may access it, any transfer abroad, and the security measures you have taken.
• Collect personal data for an electronic certification service directly from the data subject, and use it only for the purpose it was collected for, unless the data subject expressly consents otherwise.
• Take precautions appropriate to the nature of the data and the risks the processing presents to preserve its security, including against distortion, damage, or access by unauthorized third parties.
• Confine a sub processor to your instructions under a contract addressing security and confidentiality, without relieving yourself of the duty to see those measures respected.
• Notify the Commission without delay of any change to the information in your declaration and of the discontinuation of the processing.

Loi n° 14-029/AU, arts. 10-18, 48 (rights of data subjects) · Read the law's page

• Let a data subject object, on legitimate grounds, to the processing of their personal data.
• Let a data subject object, free of charge and without needing to state a reason, to their personal data being used for commercial, charitable or political prospecting.
• Tell a data subject, when you collect their personal data directly from them, your identity, the processing's purpose, whether answering is mandatory, the recipients, and how to exercise the rights of objection, access and rectification.
• Answer an access request with the information in clear language and a copy on payment of no more than the Commission's scale fee, unless the Commission has granted you a response delay or let you disregard a manifestly abusive request.
• Correct, complete, update, lock or erase personal data on a data subject's request when it is inaccurate, incomplete, ambiguous, outdated, or unlawfully collected, used, disclosed or retained; where you passed the information to a third party, notify that third party of its rectification or cancellation, unless the Commission has dispensed you from doing so.
• Let access to medical information be exercised only through a physician the data subject designates.
• Tell a network communication user, clearly and completely, the purpose of accessing or storing information in their terminal equipment and the means available to object to it, unless the access or storage has the exclusive purpose of enabling or facilitating electronic communication or is strictly necessary to provide an online communication service at the user's express request.

Loi n° 14-029/AU, arts. 19-40, 47, 54-65 (enforcement, sanctions and offenses) · Read the law's page

• Expect the Commission to inform and advise you of your rights and obligations, to receive and answer complaints about your processing, and to alert the public prosecutor to a violation amounting to a criminal offense.
• Comply with a warning or formal notice the Commission issues within the period it sets, no more than eight days, or face a pecuniary sanction (unless the State carries out the processing), an injunction to stop the processing, withdrawal of an authorization, or a data lock, after a contradictory procedure.
• Do not obstruct the Commission's action and take useful measures to facilitate its mission, including letting its members and agents access the premises where processing is carried out.
• Expect a person harmed by your processing to be able to seek damages before the competent court, and expect criminal liability of five to ten years' imprisonment and a fine of 10,000,000 to 35,000,000 Comorian francs, or either penalty alone, for obstructing the Commission, processing without required formalities, or another article 64 offense.

Loi n° 14-029/AU, arts. 6-8, 43(b)-(d) (sensitive personal data) · Read the law's page

• Do not collect or process data revealing political, philosophical or religious opinions, trade union membership, or health or sexual life data, without the data subject's express consent, unless a listed exception applies, such as safeguarding a life the data subject cannot consent to protect.
• Process data on offenses, convictions or security measures only as a court, a public authority, a body managing a public service, a legal auxiliary acting within your legal duties, or another legal person managing a dispute over an offense of which you were the victim.
• Obtain the Commission's prior authorization and submit to its control before processing biometric data needed to verify a person's identity, data on a person's health or condition, or data on offenses and convictions.

Loi n° 14-029/AU, arts. 9, 43(h) (cross border transfer) · Read the law's page

• Do not transfer personal data to a foreign state unless that state ensures a sufficient level of protection for privacy and fundamental rights and freedoms, judged by the protections and security measures in force there and by the nature, origin and destination of the data.
• Obtain the Commission's prior authorization before a processing operation that provides for transferring personal data to another state, even where you rely on contractual clauses or internal rules to show a sufficient level of protection.