Makes education decisions, in Liberia

An Act for the Collection, Processing, Transmission, Storage, Protection, and Use of Personal Information in Liberia (Data Protection Act of Liberia) · Read the law's page

• Process personal information only on a lawful basis: the data subject's consent, performance of a contract with the data subject, a legal obligation of the controller, protection of vital interests, response to a national emergency or the functions of a public authority, or the legitimate interests of the controller or a third party that the data subject's fundamental rights do not override.
• Collect personal data only for specified and legitimate purposes declared before or soon after collection, process it fairly and lawfully, keep it accurate, adequate and not excessive, and retain it only as long as necessary.
• Do not process sensitive personal information or privileged information unless an exception in section 13 applies, such as the data subject's consent specific to the purpose.
• Before personal information enters your system, or at the next practical opportunity, give the data subject the description, purposes, scope and method of processing, the recipients, your identity and contact details, the storage period and the existence of the rights of access, correction and complaint.
• On demand, give a data subject reasonable access to their personal information, its sources and recipients and the manner of processing; correct disputed inaccurate information immediately unless the request is vexatious or unreasonable; and honor a request to suspend, withdraw, block, remove or destroy information that is incomplete, outdated, false, unlawfully obtained or no longer necessary.
• On request, give a data subject a copy of personal information processed by electronic means in a structured and commonly used electronic format.
• Implement reasonable and appropriate organizational, physical and technical measures to protect personal information against accidental or unlawful destruction, alteration and disclosure and against other unlawful processing, and ensure that third parties processing it for you apply the same measures.
• Promptly notify affected data subjects when sensitive personal information, or other information that may enable identity fraud, is reasonably believed to have been acquired by an unauthorized person and the acquisition is likely to give rise to a real risk of serious harm, describing at least the nature of the breach, the sensitive personal information possibly involved and the measures taken.
• Do not conceal a security breach once you know of it and of the obligation to notify.
• Remain responsible for personal information transferred to a third party for processing, domestically or internationally, use contractual or other reasonable means to provide a comparable level of protection, and designate an individual accountable for compliance, whose identity is made known to a data subject on request.
• This binds any natural or juridical person that collects, processes, transmits, stores or uses personal information of residents of Liberia or the ECOWAS Region, including a personal information controller and a personal information processor.