Sends faxes, in Benin

Loi n°2017-20 du 20 avril 2018, Livre V, arts. 399-400, 415-423, 437-445 et 447 (droits des personnes concernées) · Read the law's page

• Respond to a data subject's request to access, rectify, or object to the processing of their personal data, and pass on any correction to any third party the data was disclosed to.
• Tell a data subject, no later than when you collect their personal data, your identity, the purposes of the processing, the recipients, whether automated decision making is in use, how long you will keep the data, and their rights of access, rectification, erasure, and objection.
• Where personal data was not collected from the data subject, give them the same information within a reasonable time and at most thirty days after obtaining it, or at the first communication or disclosure of the data if that comes sooner.
• Give a data subject their personal data in a structured, commonly used, machine readable format on request, and let them transmit it to another controller without obstruction, where the processing rests on consent or a contract and is carried out by automated means.
• Let a data subject object at any time, on legitimate grounds, to the processing of their personal data, and let them object free of charge and without any justification to processing for direct marketing, charitable, or political prospecting.
• Correct, complete, update, block, or erase personal data on a data subject's request where it is inaccurate, incomplete, ambiguous, outdated, irrelevant, or unlawfully processed, and pass the correction or erasure on to anyone the data was disclosed to.
• Where you made a data subject's personal data public, take reasonable steps, including technical measures, to tell any third party processing that data that the data subject has asked for it to be erased.
• Let an incapacitated adult's rights be exercised by their cohabiting spouse or partner, or in order, an adult child, a parent, or a sibling, or a court appointed guardian, and involve the data subject as far as their understanding allows.

Loi n°2017-20 du 20 avril 2018, Livre V, arts. 448-490 et Livre VI, arts. 514-517 (Autorité, sanctions et infractions pénales) · Read the law's page

• Comply with a formal notice the Autorité issues within the period it sets, which may not exceed eight days, before it moves to a sanction.
• Expect the Autorité to impose a pecuniary sanction, an order to stop processing, a temporary or permanent withdrawal of authorization, or a lock on the data concerned where you do not comply with a formal notice, up to fifty million CFA francs for a first violation, rising to one hundred million CFA francs, or five percent of your last closed financial year's turnover excluding tax up to that same figure, for a violation repeated within five years.
• Expect a sanction the Autorité pronounces to be made public, and expect a report and the chance to respond in writing or in person before the Autorité rules on it.
• Expect a data subject to be able to complain to the Autorité about your processing, and expect them to have an effective judicial remedy against you or against the Autorité where it fails to act within ninety days.
• Expect a data subject who suffered material or moral harm from your violation of this Book to seek reparation from you or your processor, with joint liability between multiple controllers or processors who took part in the same processing.
• Do not obstruct the Autorité's investigations, and furnish it, its designated agents, or its members the information, documents, and premises access they request.
• Complete the prior formalities and security measures this Book requires, or expect criminal liability of up to ten years' imprisonment and a fine of up to fifty million CFA francs for the offenses this Book's criminal chapter lists, reduced to a fine alone for a negligent failure to complete prior formalities.
• Include an unsubscribe link in every unsolicited electronic message you send based on personal data you collected, and do not use another person's or entity's identity to deceive message recipients or website users into disclosing personal or confidential data.