Processes biometric data, in Cameroon

Loi n°2010/012 du 21 décembre 2010, art. 6-7, 13-14, 24, 26-30, 32, 61(3) · Read the law's page

• This applies to any operator of an electronic-communications network or an information system that offers a service in Cameroon, directly or indirectly; Cameroon's law does not gate this duty by sector, size, or a government designation, so it reaches a network operator, an electronic-communications service provider, and an information-system operator alike, except that article 2 excludes the specific applications used in national defense and security.
• Take all technical and administrative measures necessary to guarantee the security of the services you offer.
• Adopt standardized systems that let you continuously identify, assess, treat, and manage the risks to your information systems' security.
• Have Cameroon's National Information and Communication Technologies Agency (ANTIC) approve the security mechanisms you put in place for this purpose.
• Submit your networks and information systems to ANTIC's mandatory security audit, conducted at least once a year or whenever circumstances require it.
• Evaluate and revise your security systems as technology evolves, and make the changes your security practices, measures, and techniques need.
• Inform your users of the dangers of using your network or service, the specific security risks it faces, and the technical means available to secure their communications.
• Do not obstruct, resist, or prevent ANTIC's security audit, and do not refuse to provide the information or documents it requires; doing so is a criminal offense.

Loi n°2024/017 du 23 décembre 2024 · Read the law's page

• Obtain the data protection authority's prior authorization before processing personal data (Article 19).
• Obtain the data subject's prior, free, informed, specific, and unequivocal consent before processing personal data, unless the processing is necessary to meet a legal obligation, to perform a public-interest mission, or to preserve a person's health (Article 9).
• Obtain the backing of a parent or legal representative for the consent of a person under 18 (Article 9).
• Do not process data on religious, philosophical, political, or trade-union opinions or activities, racial, ethnic, linguistic, or regional origin, sexual life, or genetic or biometric data in matters of health, and do not process personal data in banking transactions without the competent administrations' prior authorization (Article 48).
• Keep a physical or digital register of processing activities that records the controller's name and contact details, the purposes, the categories of persons and data, the categories of recipients, and the documents attesting to the guarantees or the authorization number (Article 29).
• Inform the data protection authority and the data subject without delay on learning of a personal-data breach, and send the authority an annual report on the security measures implemented (Articles 22 and 27).
• Obtain the authority's prior authorization before transferring personal data to a foreign state or an international organization (Article 32).
• Give the data subject, at the latest when the data are collected, the controller's identity, the purposes, the categories of data, the recipients, the data retention period, any planned transfer to a foreign state, and notice of the data subject's rights, including access, rectification, erasure, objection, limitation, portability, the right not to be subject to an automated decision, and the right to complain to the data protection authority (Article 21).
• Stop the dissemination of a data subject's personal data and erase it without delay when the data subject asks on a listed ground: the data are no longer needed for the purposes of processing, the consent was defective, withdrawn or has expired, or the processing has no legal basis, subject to any retention requirement in law (Articles 37 and 38).
• Answer a data subject's request for confirmation that the data subject's personal data are processed, for the data and their origin, for the purpose, categories and recipients of the processing, and for a copy in intelligible form, for a charge no higher than the cost of reproduction (Article 39).
• Honor a data subject's objection, at any time, to processing of the data subject's personal data on grounds relating to special categories of data, for direct marketing, or on any other ground in law, and stop using the data for commercial marketing once the data subject objects (Article 40).
• Obtain the data subject's prior consent, given after the information the law requires, before communicating personal data to third parties, or using the data on their behalf, for direct marketing (Article 41).
• Rectify, complete, update, block or delete inaccurate or incomplete personal data when a data subject who proves identity asks (Article 42).
• Give a data subject, free of charge and on request, the personal data the data subject provided, in a structured, commonly used and machine-readable format, and transmit them directly to another controller where technically possible, except for processing necessary for a public-interest task or the exercise of public authority (Article 43).
• Do not make a decision based exclusively on automated processing of a data subject's personal data, including profiling, over the data subject's objection, unless the data subject was told of the automated system and gave prior, explicit and informed consent or the law authorizes it with safeguards, and on request give the data subject human intervention, a chance to state a view, and a way to contest the decision (Article 44).