Processes personal data, in Libya

Law No. 6 of 2022 Concerning Electronic Transactions, arts. 73-75 (Protection of Personal Data: lawful basis, purpose limitation and confidentiality) · Read the law's page

• Before collecting personal data for issuing, maintaining, or facilitating an authentication certificate, obtain the person's explicit consent, and do not use it for a different purpose without a further explicit consent.
• Do not collect, disclose, provide, or process personal data without the data subject's consent unless it is necessary to prevent or detect a crime under an official request from investigative bodies, required or permitted by law or a court decision, needed for a tax assessment or collection, or needed to protect the person's vital urgent interest.
• Keep personal data confidential and do not disclose, transfer, declare, or publish it without the data subject's prior consent.

Law No. 6 of 2022, art. 78 (Electronic Transactions, cross border transfer) · Read the law's page

• Before transferring personal data outside Libya, give due consideration to the nature of the data, its source, the purpose and duration of processing, and the destination country's international commitments, applicable law, rules, and security measures.

Law No. 6 of 2022, arts. 76-77, 79 (Electronic Transactions, notice, access and objection) · Read the law's page

• Before processing a person's data, give them notice of who is responsible for the processing and the nature, purpose, and method of the processing.
• Let a person access and update the personal data collected about them, through appropriate technological means.
• Do not send a person electronic documents once they have explicitly refused to accept them, and stop processing their personal data once they have explicitly refused it.
• Do not process personal data where doing so causes harm to, or infringes the rights or freedoms of, the person it was collected from.
• Do not use a person's data for a purpose other than the one they agreed to without obtaining their consent.

Law No. 6 of 2022, arts. 80-82 (Electronic Transactions, licensing and penalties) · Read the law's page

• Obtain a license from the National Authority for Information Security and Safety before providing authentication services that involve collecting personal data.
• Expect the National Authority for Information Security and Safety to accredit and monitor the electronic authentication processes and sites through which you collect personal data.
• Expect imprisonment of at least one year and a fine of three thousand to ten thousand dinars for providing authentication services without a license, rising to a fine of at least ten thousand dinars where the offence disrupts a government, military, security, or banking transaction.
• As the legal representative of a legal person, expect the same penalties where your failure to perform your duties contributed to an offence under this law, and expect the legal person to be jointly liable for any resulting financial penalty.

Credit Inquiry System Regulation of the Libyan Credit Information Center, 2023 (Central Bank of Libya) · Read the law's page

• If you run the Libyan Credit Information Center, keep credit information confidential and private, and do not publish it or use it for purposes the Credit Inquiry System Regulation does not set out.when it serves a public body
• If you run the Libyan Credit Information Center, do not keep credit information on a borrower's accounts that could have a negative effect on the borrower's access to financing for more than ten years from the date those accounts are closed.when it serves a public body
• If you run the Libyan Credit Information Center, set up a mechanism for receiving customers' complaints and procedures for deciding them, and where a customer's objection is upheld investigate it and correct, complete or update the information within 15 days.when it serves a public body
• If you are a financial institution that grants financing and is a member of the Center, keep a database of the complaints you receive about credit data and the results of examining them.when it serves a financial business
• Expect the Central Bank of Libya to inspect and audit you as a member of the Center at any time if there are indications that you breached the regulation.