Makes justice decisions, in Cabo Verde

Lei n.º 133/V/2001, de 22 de Janeiro, art. 23 (no. 3) as republished by Lei n.º 121/IX/2021, de 17 de Março (decisões automatizadas autorizadas pela CNPD) · Read the law's page

• Where you rely on the CNPD's authorization to take a decision that produces legal effects on a person, or significantly affects them, solely on automated processing, take measures that guarantee the data subject's legitimate interests.

Lei n.º 133/V/2001, de 22 de Janeiro, art. 18 as republished by Lei n.º 121/IX/2021, de 17 de Março (direito de portabilidade dos dados) · Read the law's page

• Let a data subject receive the personal data concerning them that they provided to you, in a structured, commonly used and machine-readable format, and transmit it to another controller without hindrance from you, where the processing is based on consent or on a contract and is carried out by automated means (Article 18(1)).
• When a data subject exercises the right of portability, transmit the personal data directly to the other controller where that is technically possible (Article 18(2)).

Lei n.º 133/V/2001, de 22 de Janeiro, art. 29 as republished by Lei n.º 121/IX/2021, de 17 de Março (avaliação de impacto sobre a proteção de dados) · Read the law's page

• Before you start processing, and before you notify it to the CNPD, carry out an impact assessment of the envisaged operations on the protection of personal data if the processing, in particular using new technologies, is likely to result in a high risk to individuals' rights and freedoms (Article 29(1)).
• Carry out the assessment in particular for a systematic and extensive evaluation of personal aspects of individuals based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based; for large-scale processing of the special categories of data in Article 8(1) or of data on criminal convictions and offences in Article 11; and for large-scale systematic monitoring of publicly accessible areas (Article 29(2)).
• Make the assessment include at least a systematic description of the envisaged processing and its purpose, an assessment of its necessity and proportionality, an assessment of the risks to data subjects' rights and freedoms, and the measures envisaged to address those risks (Article 29(7)).
• Seek the advice of your data protection officer, if you have designated one, when you carry out the assessment (Article 29(4)).
• Where necessary, seek the views of data subjects or their representatives on the intended processing, and review whether the processing follows the assessment, at least when the risk changes (Article 29(8) and (9)).
• Communicate the result of the assessment to the CNPD when you notify the processing (Article 29(10)).

Lei n.º 133/V/2001, de 22 de Janeiro, as republished by Lei n.º 121/IX/2021, de 17 de Março, art. 23 (nos. 1 and 2) (automated individual decisions) · Read the law's page

• Do not base a decision that produces legal effects on, or significantly affects, a person solely on automated processing of their personal data, including profiling, unless the law authorizes it, or the person consents to it in the course of entering into or performing a contract and either their request was satisfied or adequate measures guarantee their legitimate interests and their chance to put their point of view.

Lei n.º 133/V/2001, de 22 de Janeiro, as republished by Lei n.º 121/IX/2021, de 17 de Março, art. 8 and art. 11 (no. 2) (dados sensíveis) · Read the law's page

• Do not process personal data relating to political, philosophical or ideological convictions or positions, religious faith, party or trade union membership, racial or ethnic origin, genetic data, biometric data, data relating to private life, health, sex life or sexual orientation, unless the data subject has expressly consented with guarantees of non-discrimination and adequate security measures, the law authorizes it with the same guarantees, the processing is statistical and not individually identifiable, the CNPD authorizes it, or another of the law's listed grounds is met.
• Process health, sex life and sexual orientation data, including genetic data, only through a health professional or other person bound by professional secrecy, only for preventive medicine, work-capacity assessment, medical diagnosis, health or social care or health system management, and only once notified to the CNPD, with adequate information security measures.
• Process data on suspected illegal activities, criminal and administrative offences, convictions, security measures, fines, additional penalties or disciplinary offences under the CNPD's authorization, which is available where the processing is necessary for your legitimate purposes and does not override the data subject's rights, observing data protection and information security rules.
• Do not use profiling that leads to discrimination against individuals on the basis of the special categories of personal data.

Lei n.º 133/V/2001, de 22 de Janeiro, as republished by Lei n.º 121/IX/2021, de 17 de Março, arts. 13 (nos. 1 and 3), 14 (no. 1) and 20 (a) (direitos dos titulares dos dados) · Read the law's page

• Tell a data subject, except where they already know it, your identity and address and any representative's, the data protection officer's contact details, the categories of data, the purposes and legal basis of processing, the recipients or categories of recipients, whether a reply is mandatory or voluntary and the consequences of not replying, and the existence and conditions of the rights of access, rectification, erasure and objection, at the time of collection or, if not collected from the data subject, when the data is recorded or at the latest on first disclosure to a third party, unless the law authorizes the processing or informing them is impossible or would take disproportionate effort.
• Give a data subject, freely and without restriction, at reasonable intervals and without excessive delay or cost, confirmation of whether you process their data, the purposes, categories and recipients, a copy of the data on request, an intelligible communication of the data and any available information on its source, the logic behind automated decisions including profiling, and notice to third parties of any rectification, erasure or destruction.
• Let a data subject object at any time, on compelling legitimate grounds relating to their particular situation, to processing you carry out for a public interest or legitimate interest ground, and stop unless you show overriding compelling legitimate grounds or the processing serves a legal claim.