Processes personal data, in Senegal

Loi n° 2014-02 du 6 janvier 2014 portant réglementation des bureaux d'information sur le crédit (loi uniforme UMOA), arts. 4, 35, 41-44, 53, 62 and 71 · Read the law's page

• Do not carry on the activity of a credit information bureau, or present yourself as one, unless you have been approved and entered on the list of bureaux.
• If you are a data provider, get the customer's prior consent before sharing credit information about them with the bureau, and keep that consent.
• If you are a data provider or a user of credit reports, before asking for the customer's consent tell them what the information is collected for, which data it covers, who receives it, how long the bureau keeps it, and their right to refuse, to see it and to have it corrected.
• If you are a credit information bureau, circulate only information no more than five years old and archive it for a further five years.when it serves a financial business
• If you are a credit information bureau, give a customer access to their own credit report on proof of identity, and let them contest and correct data about them.when it serves a financial business
• If you are a credit information bureau, keep a register of every request received from users that shows the purpose of the request, and secure the database against access, change or disclosure by unauthorized people, your own staff included.when it serves a financial business
• If you are a credit information bureau, do not keep your databases or backup sites outside the UMOA.when it serves a financial business
• Do not collect, keep, process or show sensitive data, or savings and deposit account data, in a credit report.
• If you are a user of credit reports and you refuse credit on the basis of a report, tell the customer and give them a copy of the report, and do not use the reports for marketing.

Décret n° 2008-721 du 30 juin 2008, arts. 2-19, 55-57, 67-75 (Commission des données personnelles, contrôles et sanctions) · Read the law's page

• Comply with a formal notice within the period it sets, because the notice states the breaches found and the deadline for ending them.
• Expect the CDP to hear you before any sanction other than a warning, on at least fifteen days' notice, or eight days in an emergency.
• Expect a pecuniary sanction from the CDP if you do not meet your obligations, unless the processing is carried out by the State or by a private-law legal person managing a public service.
• Expect any sanction decision to state its legal and factual grounds and the means and time limits of appeal, and to be published in the Journal officiel within one month of becoming final.

Décret n° 2008-721 du 30 juin 2008, arts. 20-32, 63-66 (régimes de traitement et obligations du responsable) · Read the law's page

• Keep the data confidential, available and accurate, and protect your systems and networks against accidental or unauthorized destruction of data, technical errors, falsification, theft and unlawful use.
• If a processor handles the data for you, stay responsible for how it uses and communicates them.
• Destroy, erase, delete or archive personal data when the retention period set for the processing ends.

Décret n° 2008-721 du 30 juin 2008, arts. 33-41 (données génétiques, recherche médicale et traitements ultérieurs) · Read the law's page

• Inform people received in prevention, diagnosis and care establishments, by a document or another appropriate means, when their data are transmitted for medical research processing.
• Make data anonymous or coded before you communicate them to a third party for later historical, statistical or scientific processing.
• Do not make the results of historical, statistical or scientific processing public in a form that identifies a person, unless the person expressly consented or the data are limited to data the person manifestly made public.

Décret n° 2008-721 du 30 juin 2008, arts. 42-44 (transferts vers un pays tiers) · Read the law's page

• Before the first transfer of personal data to a third country, refer it to the CDP with a declaration giving the sender and recipient, the file, the data categories, the people concerned, the recipient's purpose, the mode and frequency of transfers and the date of the first transfer.
• Declare to the CDP, within fifteen working days, any change to the information you declared for the transfer.
• Where a transfer is within a group, or to several recipients for the same data and purposes, make one joint declaration if you wish.
• Do not treat the CDP's list of States with equivalent legislation as relieving you of any responsibility.

Décret n° 2008-721 du 30 juin 2008, arts. 45-62 (droits de la personne concernée) · Read the law's page

• When you collect data in writing from the person, ask them on the collection document whether they wish to exercise the right to object.
• When you collect data from the person other than in writing, ask them whether they wish to object, at the latest one month after collection and by a means that keeps proof; without that communication the right to object applies as of right.
• When you did not obtain the data from the person, ask them, on any medium, whether they wish to exercise the right to object.
• Let a person object to use of their data for prospecting, including commercial prospecting, without giving any reason.
• Tell a person in writing what you did about their request to rectify or delete data about them.

Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, arts. 1-4, 17-24, 33-39, 45-46, 52-57, 70-74 (principes généraux, formalités préalables et obligations du responsable) · Read the law's page

• Have a lawful basis, ordinarily the person's consent, before collecting, processing, transmitting, storing, or using their personal data.
• Take precautions appropriate to the nature of the data, including restricting access to authorized staff and keeping security copies.
• Declare your processing to the CDP before you start it, using its published form, and do not implement the processing until you receive the CDP's certificate of receipt.
• Choose a sub-processor offering sufficient guarantees, bind them by a written contract limited to your instructions, and keep processing confidential and restricted to authorized staff.
• Get the CDP's authorization before combining personal data files across purposes or processing a national identification number or other general-purpose identifier.
• Do not keep personal data longer than its purpose requires, unless you keep it only for historical, statistical, or scientific treatment.

Loi n° 2008-12 du 25 janvier 2008, arts. 20, 40-44 (catégories sensibles de données) · Read the law's page

• Before collecting or processing data revealing racial, ethnic, or regional origin, political opinion, religious or philosophical belief, trade union membership, sexual life, genetic data, or health, confirm one of the Act's narrow exceptions applies.
• Process data on criminal offences, convictions, or security measures only if you are a court, a public authority, a public-service body, or a legal auxiliary acting within your legal mission.
• Process health data only on one of the Act's listed grounds, such as the person's own consent or a public-health necessity, keep it under a health professional's supervision, and collect it from the person themselves unless collecting it elsewhere is necessary or they cannot supply it.
• Get the CDP's prior authorization before processing genetic data, health-related research data, data on criminal offences or convictions, or biometric data.

Loi n° 2008-12 du 25 janvier 2008, arts. 47, 58-69 (droits de la personne concernée) · Read the law's page

• Tell the person, at the time of collection, who is responsible for the processing, its purpose, the categories of data, whether a reply is mandatory or optional, and any recipients, and let them access, object to, correct, or delete their data on request.
• Where you did not collect the data from the person directly, give them the same information when you record it or, if you plan to disclose it, no later than the first disclosure, unless it falls within the state-security, defence, criminal-enforcement, or major economic-interest exemption.
• Do not access or write information on a user's terminal equipment by electronic transmission without telling them its purpose and how to object, unless the access only enables the communication or is strictly necessary for a service they expressly requested.
• Give a person, on written request, access to their data and its origin, and a copy on payment of no more than the reproduction cost, and refer a disputed mismatch to the CDP for verification.
• Do not send a person direct-marketing communications using their personal data unless they have first expressed consent to receive them.
• Let a person object, free of charge and for legitimate reasons, to processing of their data, and correct, complete, update, block, or delete it within one month of a written request where it is inaccurate, incomplete, ambiguous, outdated, or unlawfully processed, notifying any third party the data was disclosed to.

Loi n° 2008-12 du 25 janvier 2008, arts. 49-51 (transferts vers un pays tiers) · Read the law's page

• Transfer personal data to a third country only if it ensures a sufficient level of protection for privacy and fundamental rights, unless a narrow consent-based or necessity derogation applies, and tell the CDP before every transfer to a third country.
• Where the destination country does not offer that level of protection and no derogation applies, get the CDP's authorization for the transfer on a motivated request backed by guarantees sufficient to protect the person's privacy and rights.

Loi n° 2008-12 du 25 janvier 2008, arts. 5-16, 25-32, 75 (Commission des Données Personnelles, contrôles et sanctions) · Read the law's page

• Cooperate with the CDP's on-site inspections and give its members or agents any document they need for their mission.
• Comply with a CDP warning or formal notice within the period it sets, or face suspension or definitive withdrawal of your processing authorization and a pecuniary fine of one million to one hundred million CFA francs.
• Expect the CDP to interrupt your processing, lock the data, or ban the processing without prior formal notice where it creates an urgent risk to rights and freedoms.
• Expect a violation of the Act to be prosecuted under the Penal Code and the cybercrime law, carrying imprisonment and fines as those instruments set.