Processes personal data, in Mali

Loi n° 2013-015 du 21 mai 2013 portant protection des données à caractère personnel en République du Mali, telle que modifiée, arts. 1, 4-8, 57 (objet, champ d'application, principes et déclaration) · Read the law's page

• Collect and process personal data fairly, lawfully, and without fraud, only for determined, explicit, and legitimate purposes, never using it for another purpose, and keep it adequate, proportionate, and relevant to those purposes, accurate and updated where necessary, and identifiable for no longer than those purposes require.
• Take every precaution useful to preserve the security of personal data, including preventing unauthorized access, deformation, or damage, and use a processor only where it offers sufficient security and confidentiality guarantees, which does not relieve you of your own duty to see those guarantees are met.
• Declare to the Autorité de Protection des Données à Caractère Personnel, before carrying it out, any processing operation you intend to carry out for a given purpose.

Loi n° 2013-015, art. 11 (transfer of personal data abroad) · Read the law's page

• Before transferring personal data to a foreign country, confirm that the Autorité de Protection des Données à Caractère Personnel has found the destination State's own legislation or international commitments provide a sufficient level of protection that is actually applied, or obtain an Autorité decision that the transfer and the recipient's processing, including through contractual clauses or internal rules, guarantee a sufficient level of protection for privacy and fundamental rights and freedoms.

Loi n° 2013-015, arts. 12-19 (rights of data subjects) · Read the law's page

• Answer an access request free of charge and without delay with all data concerning the person in an understandable form, its available origin, and the information and reasoning used in any automated processing whose results are used against them.
• Rectify, complete, update, block, or delete inaccurate, incomplete, ambiguous, outdated, or unlawfully processed personal data on a person's written request, justify within thirty days that you have done so, and notify any third party the data were transmitted to of the correction.
• Where a processing concerns State security, national defence, or public security, route an access or rectification request to the Autorité de Protection des Données à Caractère Personnel instead of answering it yourself.
• At collection, or before transmitting data you did not collect directly, tell the person your identity, the purposes of processing, the categories of data, the recipients, whether answering is obligatory or optional and the consequences of not answering, their right to ask to no longer appear in the file, their rights of access and rectification, the retention period, and any transfer abroad you envisage.
• Before accessing or writing information to a user's connection terminal equipment over an electronic communication network, clearly and completely tell them the purpose and how to object, unless doing so is solely to enable the communication itself or is strictly necessary to supply a service the user expressly asked for.
• Honor a person's right to object, for legitimate reasons, to processing of data concerning them, and tell them, before their data are first communicated to or used on behalf of third parties for prospecting purposes, of their free right to object to that communication or use.

Loi n° 2013-015, arts. 20-56, 58-67 (the Autorité, supervision, and sanctions) · Read the law's page

• Do not obstruct the Autorité de Protection des Données à Caractère Personnel's action, and take every measure useful to facilitate its work, including its information and on-site inspection missions.
• Expect a warning, a formal notice, an order to cease processing, or withdrawal of your approval where the Autorité finds you at fault, each decision reasoned and notified to you, followed by referral to the Procureur de la République or a criminal complaint where the conduct is also a criminal offence.
• Comply with an administrative sanction decision; the Autorité may use any technical means at its disposal to enforce it, though it may agree to settle a pecuniary sanction with you at your request, within the scales the law fixes.

Loi n° 2013-015, arts. 9-10 (sensitive data and offence records) · Read the law's page

• Do not process sensitive data (data relating to religious, philosophical, political, or union opinions or activities; sexual life or racial origin; health; social measures; prosecutions; or penal or administrative sanctions) unless the Autorité de Protection des Données à Caractère Personnel has defined appropriate safeguards for it and one of the listed conditions applies, such as necessity to safeguard the life of the data subject or a third party who cannot consent.
• Limit any processing of personal data relating to offences and convictions to a court or public authority acting within its legal powers, a judicial auxiliary acting for the strict needs of duties the law assigns it, or another legal person handling, for the strict needs of managing contentious matters, offences of which it was itself the victim.