Processes biometric data, in Guinea

Loi n° L/2016/037/AN, titre données à caractère personnel, portant Cybersécurité et Protection des Données à Caractère Personnel · Read the law's page

• Treat any processing of personal data belonging to a natural person as within this law's scope, whether you are an individual, a business, or a public institution operating in Guinea.
• Declare the processing of personal data to the competent Authority before you start, and begin only once you hold its acknowledgment of receipt (Article 5).
• Obtain the competent Authority's prior authorization before processing genetic or medical data, data on offences, convictions or security measures, a national identification number or similar identifier, biometric data, or data processed in the public interest, and before a transfer to a third country (Article 7).
• Process personal data only with the data subject's express prior consent, unless you are duly authorized and the processing is necessary for a legal obligation, a public-interest mission, a contract with the data subject, or safeguarding the data subject's interest or fundamental rights and freedoms (Article 18).
• Collect and process personal data lawfully and fairly, for determined, explicit and legitimate purposes, and keep it no longer than those purposes require (Articles 19 and 20).
• Keep personal data accurate and, where necessary, up to date, and erase or rectify data that is inaccurate or incomplete (Article 21).
• Choose a processor that can give guarantees for the protection and confidentiality of the data (Article 24).
• Take all useful precautions, given the nature of the data, to prevent it being distorted, damaged or reached by unauthorized third parties (Article 42).
• Draw up an annual report for the personal data protection Authority on your compliance with the relevant provisions of the law (Article 44).
• Bring your processing into compliance within one year of the law's promulgation, which is dated 28 July 2016 (Article 63).