Processes personal data, in Sao Tome and Principe

Lei n.º 03/2016, arts. 10-12 (information, access and opposition) · Read the law's page

• Inform the data holder, at collection, of your identity, the purpose of the processing, and their right of access and rectification, and where you did not collect the data from the holder directly, give that information by the time you register the data or before you first disclose it to a third party.
• Answer a data holder's request, free of charge, at reasonable intervals and without undue delay, with confirmation of whether you are processing their data, the purposes, the categories of data and recipients, the data itself in an intelligible form, its origin, and the reasoning behind any automated processing decision about them, and correct, erase or block data that does not comply with this Law.
• Let a data holder object, for weighed and legitimate reasons relating to their particular situation, to your continued processing of their data, and stop processing their data for direct marketing or another commercial solicitation, free of charge, as soon as they object or before you first communicate their data to a third party for that purpose.

Lei n.º 03/2016, arts. 14, 27-44 (compensation, complaints, administrative offenses, crimes and the NAPPD) · Read the law's page

• Expect a person who suffered damage from your unlawful processing, or from any other act breaching this Law, to have the right to obtain compensation from you, unless you can prove the act causing the damage is not attributable to you.
• Expect a data holder to be able to complain to NAPPD, and to pursue administrative or judicial recourse, including appeal to the Court of last instance, for a violation of the rights this Law guarantees.
• Expect an administrative fine reaching 1,000,000,000 Dobras, doubled for a violation involving data subject to prior checking under Article 22, for negligently failing to notify NAPPD of processing, giving false information, notifying in breach of Article 23, or maintaining access to open data transmission networks for controllers that do not comply with this Law after NAPPD gives notice, and a separate, lower fine for breaching another provision of this Law.
• Expect negligence to be punishable in the administrative offenses of Article 31, an attempt to be punishable in the administrative offenses that Article 34(2) refers to in Articles 32 and 33, and an attempt to be punishable in each of the crimes in this Law.
• Expect an accessory penalty, such as a temporary or permanent ban on processing, publication of the conviction, or NAPPD's public warning or censure, in addition to any fine or criminal penalty NAPPD or a court imposes.

Lei n.º 03/2016, arts. 19-20 (transfer of personal data abroad) · Read the law's page

• Before transferring personal data outside Sao Tome and Principe, confirm the destination legal order offers an adequate level of protection or rely on a stated derogation, and notify NAPPD of a transfer that relies on one.
• Assess the adequacy of the destination legal order's protection in light of the nature of the data, the purpose and duration of the processing, the countries of origin and destination, and the rules of law, professional rules and security measures in force there, since NAPPD alone decides whether that order meets the standard.
• Where the destination legal order does not ensure an adequate level of protection, transfer personal data only with the holder's unequivocal authorization, under one of the Law's listed derogations (contract necessity, an important public interest or judicial defense, the holder's vital interests, or a public register open to consultation), or with NAPPD's authorization based on sufficient contractual safeguards.

Lei n.º 03/2016, arts. 7-8, 16 (sensitive categories, criminal-offense records and special security measures) · Read the law's page

• Before processing a sensitive category of data (political, religious, trade-union or philosophical affiliation, racial or ethnic origin, private life, health, sex life, or genetic data), obtain the holder's explicit authorization, rely on a specific legal provision, or obtain NAPPD authorization for an important public interest.
• Where you process health or sex-life data, including genetic data, for preventive medicine, diagnosis, care or health-service management, do so only through a health professional or another person bound by professional secrecy, notify NAPPD of the processing, and secure it with appropriate information-security measures.
• Obtain NAPPD's authorization before processing sensitive personal data under the important-public-interest ground.
• Maintain a central record of persons suspected of unlawful activity, a criminal offense or an administrative offense, and of penalties, security measures, fines or ancillary sanctions, only where you are a public service with specific legal competence to do so, and limit any processing for police investigation to what a specific danger or offense requires.
• Put in place the special safety measures the Law requires of a controller that processes sensitive data under Article 7(2) or keeps records of suspected unlawful activity under Article 8: control of premises entry, data-carrier handling, unauthorized disclosure, system access, transmission, and data-entry logging, and keep health and sex-life data logically separated from other personal data.

Lei n.º 03/2016, de 10 de Maio, sobre a Protecção de Dados Pessoais, arts. 1-6, 9, 15, 17-18, 21-26, 45, 47 · Read the law's page

• Obtain the data holder's unequivocal authorization before processing their personal data, or rely on one of the Law's specific grounds: performing a contract with them, a legal obligation you face, protecting their vital interests, a public-interest mission, or your own legitimate interest weighed against their rights.
• Notify the National Agency for the Protection of Personal Data (NAPPD) in writing at least eight days before starting a wholly or partly automated processing operation.
• Obtain NAPPD's prior authorization before processing credit or solvency data, interconnecting personal-data files, or using collected data for a purpose other than the one it was collected for.
• If you are not established in Sao Tome and Principe but use means located there to process personal data, designate a representative established in the country and notify NAPPD of that designation.
• Process personal data lawfully and in good faith, collect it only for specified, explicit and legitimate purposes tied to your activity, keep it adequate, relevant and not excessive, accurate and updated, and retain it in identifiable form no longer than the collection purpose requires.
• Implement appropriate technical and organizational measures against accidental or unlawful destruction, loss, unauthorized alteration, disclosure or access to personal data, choose a subcontractor offering sufficient guarantees, bind it by contract to your instructions and the same measures, and record that contract in a document with legally recognized probative value.
• Do not process personal data you access as a subcontractor, or on the controller's authority, beyond the controller's instructions except under a legal obligation, and keep confidential any personal data you learn of in the course of your duties, including after those duties end.
• Obtain NAPPD's authorization before interconnecting personal data unless a legal or organic provision already authorizes it, and include in any notification or authorization request to NAPPD your identity, the processing's purposes, the categories of data and data holders, the recipients, the retention period, how holders can access or correct their data, any planned interconnection or transfer abroad, and a description of your security measures.
• Where your processing is exempt from notification, still give any person who asks your identity, the processing's purposes, and the data holder's rights of access and rectification.