Processes biometric data, in the Central African Republic

Loi n° 24.001 du 25 janvier 2024, Chapitre II (motifs de licéité, données librement accessibles) et Chapitre III (flux transfrontalier), articles 11 à 27 · Read the law's page

• Before relying on data a person has made freely accessible as your lawful basis for collecting it, confirm your use fits the context in which the person made it accessible; freely accessible data supports the legitimate-interest basis but is not an exemption from the Act's other duties.
• Before transferring personal data you collected in the Central African Republic, or personal data about a person there, to another country, confirm the destination offers a similar level of protection or rely on one of the Act's specific derogations.
• Give the data protection agency prior notice before transferring personal data to a State outside the CEMAC or CEEAC, and rely on the agency's authorization, supported by appropriate contractual guarantees, where the destination lacks equivalent protection.
• Get the data subject's explicit consent, or rely on one of the Act's other listed derogations, before collecting or processing a sensitive category of data such as biometric, genetic, health, political, religious, or criminal-record data, whatever the source.

Loi n° 24.001 du 25 janvier 2024, Chapitre Ier Section 2 et Chapitre II, articles 11 à 21 (données sensibles et mineurs) · Read the law's page

• Get a data subject's explicit consent, and apply extra security and organisational safeguards, before processing a sensitive category of data such as racial origin, biometric or genetic data, health data, or political, religious, or trade union information.
• Get authorisation from a holder of parental responsibility before processing a minor's personal data, including for a direct offer of information society services to a child.
• Do not process sensitive data at all unless a listed derogation applies: the person's express consent unless a law bars it, safeguarding a life, a non profit body's own member processing for its religious, philosophical, political, or trade union purpose, establishing or defending a legal claim, health care or public interest health research, data the person made public, a law authorizing a public interest purpose, or a labor law right or obligation.
• Restrict processing of data about a person's offences, convictions, or safety measures to courts and public authorities acting within their legal powers, and to legal auxiliaries strictly for the duties assigned to them by law.
• When a processing activity involves sensitive data or a particularly vulnerable person's data, put additional organizational and technical safeguards in place and give that person heightened information before you process it.

Loi n° 24.002 relative à la cybersécurité et à la lutte contre la cybercriminalité, Titre II, Chapitre II (art. 14, 15 et 25) et Titre III, Chapitre I (art. 43) · Read the law's page

• Submit your networks or information systems to a mandatory security audit and severity-impact assessment by the Agence Nationale de la Cybersécurité at least once a year, or more often where circumstances require it.
• Provide the information and documents a security audit requires, and do not obstruct or resist it: obstructing a security audit is a criminal offense under Article 43.
• This binds a network operator, a certification authority and an electronic-communications service provider by name under Article 14, and Article 25 extends the mandatory security-audit regime to every electronic-communications network and every information system.
• Expect the confidential audit report to reach the Agence Nationale de la Cybersécurité for approval and then the Ministères chargés de la Sécurité Publique and de l'Economie Numérique for decision.

Loi n° 24.002 relative à la cybersécurité et à la lutte contre la cybercriminalité, Titre II, Chapitre III, Sections I et II (art. 16, 19, 20, 21, 23) · Read the law's page

• This binds an electronic-communications network operator or service provider (Article 16) and any information-system operator, whether public or private (Article 19), regardless of the sector in which the network or system is deployed.
• Take all technical and administrative measures necessary to guarantee the security of the services you offer, and adopt standardized systems to continually identify, assess, treat and manage the risks to your information systems' security.
• Put in place technical mechanisms addressing threats to your systems' permanent availability, integrity, authentication, non-repudiation and data confidentiality, and to their physical security, and submit those mechanisms to the Agence Nationale de la Cybersécurité for approval.
• Periodically evaluate and revise your security systems, and introduce necessary changes as technology evolves, under the Agence Nationale de la Cybersécurité's oversight.
• Inform your users of the dangers of using your network or information system, the particular security-violation risks involved, and the technical means available to secure their communications or restrict access to certain services.