Processes personal data, in Madagascar

Loi n° 2014-038 sur la protection des données à caractère personnel, arts. 1-2, 5-17, 21, 43-49, 51-54 (dispositions générales, champ d'application, principes fondamentaux, formalités préalables et délégué à la protection des données) · Read the law's page

• Collect and process personal data fairly, lawfully, and only for determined, explicit, and legitimate purposes, and do not use it later for another purpose without the data subject's consent or a purpose the law itself provides.
• Keep personal data adequate, relevant, accurate, and no longer than those purposes require, unless it is kept for archival, historical, statistical, or scientific purposes under the safeguards the law or the CMIL sets.
• Have the data subject's consent, or another of the five lawful grounds in article 17, before processing personal data.
• Take security precautions appropriate to the data and the risk, to prevent unauthorized access, alteration, loss, or disclosure.
• Process data on a subcontractor's behalf only on the controller's instructions, and use only a subcontractor that offers sufficient guarantees to implement the required security measures.
• As a provider of electronic certification services, collect the personal data needed for a signature certificate directly from the data subject, unless the data subject expressly consents otherwise.
• Declare a processing operation to the CMIL before implementing it, or obtain its prior authorization first where the processing presents a particular risk to rights and freedoms or to privacy.
• Designate a data protection officer to keep the processing register current, advise on new processing before it starts, take in data subjects' requests and complaints, and escalate an uncorrected breach to the CMIL.

Loi n° 2014-038, art. 20 (transfert de données à l'étranger) · Read the law's page

• Before transferring personal data to a foreign State, confirm that State's law assures a similar level of protection, weighing the data's nature, the processing's purpose and duration, the countries of origin and destination, and the destination's laws, professional rules, and security measures.
• Where the destination does not assure a similar level of protection, obtain CMIL authorization by offering sufficient guarantees such as appropriate contractual clauses or binding internal rules, or rely on one of the law's listed exceptional grounds, such as the data subject's informed consent to the transfer.
• Do not transfer received personal data onward to another foreign country without the agreement of both the original controller and the CMIL.

Loi n° 2014-038, arts. 18-19 (données sensibles) · Read the law's page

• Do not process sensitive data, including racial origin, biometric, genetic, political opinion, religious or other belief, trade union, health, or sex-life data, unless one of the law's listed exceptions applies, such as the data subject's express consent.
• Where an exception permits sensitive data to be processed, put in place the safeguards the law or the CMIL requires for that exception.
• Restrict processing personal data about offenses, convictions, or safety measures to a court, a public authority managing a public service acting within its legal powers, or a legal auxiliary acting within the strict needs of a legally assigned mission.

Loi n° 2014-038, arts. 22-27 (droits des personnes) · Read the law's page

• Honour a data subject's request, made on a legitimate ground and free of charge, to object to processing of their data, and stop processing for prospecting purposes as soon as they object to it, without requiring a reason.
• Answer a request for access free of charge and without delay, giving the purposes, the data categories, the recipients, the data itself and its origin, and enough information to understand and contest any automated decision-making logic behind a decision that has legal effects.
• Rectify, complete, update, block, or erase inaccurate, incomplete, outdated, or unlawfully held data on request, free of charge, and tell any third party the data were disclosed to of the change.
• Tell a person, when you collect their personal data, who you are, the purpose of the processing, whether the information is mandatory or optional, the data categories, the recipients, their rights of objection, access, and rectification, and any transfer and its safeguards, and give the same notice, including how to object, before storing or reading information on their communications-terminal equipment.

Loi n° 2014-038, arts. 4, 28-42, 50, 55-60, 61-73 (commission, contrôle, sanctions et pénalités) · Read the law's page

• Comply with any warning, injunction to stop processing, withdrawal of authorization, or monetary sanction the CMIL orders after an adversarial procedure, and with any urgent interruption or data-locking order it issues for up to three months.
• Give CMIL inspectors on a control mission access to your premises between six in the morning and seven at night, unrestricted access to your files, processing, and equipment, and copies of any information they request.
• Expect a monetary sanction proportioned to the seriousness of the breach and the advantage drawn from it, capped at five percent of your pre-tax turnover for the last closed financial year, doubling on a repeat offense.
• Expect criminal prosecution on top of any administrative sanction: unlawfully collecting personal data or disclosing it in a way that harms someone's reputation or privacy carries two to five years' imprisonment and a fine of 1,000,000 to 10,000,000 Ariary, and the other offenses in articles 61 to 70 carry six months to five years' imprisonment and a fine of 200,000 to 8,000,000 Ariary depending on the offense.

Décret n° 2023-1541, arts. 4-6, 75-79 (attributions de la CMIL, contrôle et sanctions) · Read the law's page

• Give the CMIL any useful information on the computer files you use when it orders you to.
• Carry out a CMIL injunction within the period it sets, and prove in writing when that period expires that you did so.

Décret n° 2023-1541, arts. 56-58 (droits des personnes) · Read the law's page

• Rule on a data subject's objection within eight days of the request, which may be made orally, in writing or by email; silence after eight days counts as a refusal.
• To refuse an objection, show that the processing meets legitimate and compelling grounds.
• Carry out the measures the CMIL orders after an access request to prevent concealment or disappearance of the data, and write the report on them that the CMIL requires.

Décret n° 2023-1541, arts. 59-61 (données sensibles) · Read the law's page

• Do not process sensitive data (racial origin, biometric, genetic, political opinion, religious or other belief, trade union, health or sex-life data) except in a case article 18 of Law No. 2014-038 permits.
• Keep sensitive data adequate, relevant and limited to what the purposes of the processing require.
• Reinforce the security of sensitive-data processing through pseudonymization or encryption.
• Before processing sensitive data, ask the CMIL for authorization, stating the public interest pursued, the type of sensitive data and the person concerned, and do not begin until the CMIL notifies its authorization.

Décret n° 2023-1541, arts. 62-63 (transfert de données à l'étranger) · Read the law's page

• Before transferring personal data abroad, ask the CMIL for authorization, showing a sufficient and appropriate level of data protection and that the data subject has enforceable rights and effective legal remedies, and do not begin the transfer until the CMIL notifies its authorization.
• As the recipient of transferred data, do not transfer it abroad again until the CMIL notifies its agreement to a request that attaches the original controller's written agreement and the appropriate safeguards.

Décret n° 2023-1541, arts. 64-74 (déclaration, registre et délégué à la protection des données) · Read the law's page

• Declare computerized processing to the CMIL before starting it, and start only once the declaration receipt is obtained.
• Keep the register of computerized processing, in physical or electronic form, with the contact details of the controller, any subcontractor and the data protection officer, the purposes, the CMIL's opinions and authorizations, the categories of data subjects, data and recipients, any transfers abroad, the retention period and the security measures.
• For processing that presents the risks article 46 of Law No. 2014-038 specifies, ask the CMIL beforehand for authorization, justify that the interest of the processing prevails over the fundamental rights and freedoms of the data subject, and begin only after the CMIL notifies its authorization.
• As a public-law legal entity, address the request for the CMIL's binding opinion on public-sector processing through the entity's legal representative.
• Choose the data protection officer on professional qualities in computing and data protection, and notify the CMIL of the controller's identity and professional contact details, the officer's identity and professional contact details, and the date of designation.
• Before revoking the data protection officer, inform the CMIL by any written means eight days ahead, giving the serious ground that article 54 of Law No. 2014-038 requires.