Handles health records, in Cabo Verde

Lei n.º 133/V/2001, de 22 de Janeiro, arts. 11 (nos. 1 and 3) and 25 as republished by Lei n.º 121/IX/2021, de 17 de Março (registos de infrações e medidas especiais de segurança) · Read the law's page

• Create or keep a central register on persons suspected of illegal activities or on criminal or administrative offences, penalties or security measures only as a public service with that legal competence, and limit processing for police investigation to what a concrete danger or a particular offence requires.
• Take the additional information security measures Article 25 lists for special-category and criminal-record data, including controlling entry to processing premises, controlling who can read, copy or alter data carriers, controlling use of and access to the processing systems, and logically separating health and sex life data, including genetic data, from other personal data.

Lei n.º 133/V/2001, de 22 de Janeiro, art. 29 as republished by Lei n.º 121/IX/2021, de 17 de Março (avaliação de impacto sobre a proteção de dados) · Read the law's page

• Before you start processing, and before you notify it to the CNPD, carry out an impact assessment of the envisaged operations on the protection of personal data if the processing, in particular using new technologies, is likely to result in a high risk to individuals' rights and freedoms (Article 29(1)).
• Carry out the assessment in particular for a systematic and extensive evaluation of personal aspects of individuals based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based; for large-scale processing of the special categories of data in Article 8(1) or of data on criminal convictions and offences in Article 11; and for large-scale systematic monitoring of publicly accessible areas (Article 29(2)).
• Make the assessment include at least a systematic description of the envisaged processing and its purpose, an assessment of its necessity and proportionality, an assessment of the risks to data subjects' rights and freedoms, and the measures envisaged to address those risks (Article 29(7)).
• Seek the advice of your data protection officer, if you have designated one, when you carry out the assessment (Article 29(4)).
• Where necessary, seek the views of data subjects or their representatives on the intended processing, and review whether the processing follows the assessment, at least when the risk changes (Article 29(8) and (9)).
• Communicate the result of the assessment to the CNPD when you notify the processing (Article 29(10)).

Lei n.º 133/V/2001, de 22 de Janeiro, arts. 30 to 32 as republished by Lei n.º 121/IX/2021, de 17 de Março (encarregado da proteção de dados) · Read the law's page

• Designate a data protection officer if the processing is carried out by a public authority or body, other than the courts and the public prosecutor acting in their procedural capacity, if your core activities require regular and systematic monitoring of data subjects on a large scale, or if your core activities consist of large-scale processing of the special categories of data in Article 8 or of data on criminal convictions and offences in Article 11 (Article 30(1)).
• Designate the officer on the basis of professional qualities and expert knowledge of data protection law and practice, and communicate the officer's contact details to the CNPD (Article 30(4) and (6)).
• Involve the officer properly and in good time in all issues relating to the protection of personal data, and give the officer the resources, and the access to personal data and processing operations, needed to perform the tasks and keep expert knowledge up to date (Article 31(1) and (2)).
• Give the officer no instructions on the exercise of the tasks, do not dismiss or penalize the officer for performing them, and let the officer report directly to the highest management level (Article 31(3)).
• Where the officer has other tasks and duties, ensure that they do not result in a conflict of interests (Article 31(6)).

Lei n.º 133/V/2001, de 22 de Janeiro, as republished by Lei n.º 121/IX/2021, de 17 de Março, art. 8 and art. 11 (no. 2) (dados sensíveis) · Read the law's page

• Do not process personal data relating to political, philosophical or ideological convictions or positions, religious faith, party or trade union membership, racial or ethnic origin, genetic data, biometric data, data relating to private life, health, sex life or sexual orientation, unless the data subject has expressly consented with guarantees of non-discrimination and adequate security measures, the law authorizes it with the same guarantees, the processing is statistical and not individually identifiable, the CNPD authorizes it, or another of the law's listed grounds is met.
• Process health, sex life and sexual orientation data, including genetic data, only through a health professional or other person bound by professional secrecy, only for preventive medicine, work-capacity assessment, medical diagnosis, health or social care or health system management, and only once notified to the CNPD, with adequate information security measures.
• Process data on suspected illegal activities, criminal and administrative offences, convictions, security measures, fines, additional penalties or disciplinary offences under the CNPD's authorization, which is available where the processing is necessary for your legitimate purposes and does not override the data subject's rights, observing data protection and information security rules.
• Do not use profiling that leads to discrimination against individuals on the basis of the special categories of personal data.

Decreto-lei nº 9/2021, arts. 11, 15 and 17 (regime jurídico de cibersegurança) · Read the law's page

• Take appropriate and proportionate technical and organisational measures to manage the risks to the security of the networks and information systems you use, at a level of security that suits the risk and the latest technical progress (Articles 15(1)-(2) and 17(1)-(2)).
• If you are a public administration body or a critical infrastructure operator, apply the security requirements of the decree-law that sets the information security policies, standards and rules for the State's Private Technology Network (RTPE), together with the technical implementing measures the Centro Nacional de Cibersegurança approves (Article 15(1) and (4)).
• Take adequate measures to prevent incidents that affect the security of the networks and information systems you use and to minimise their impact; an essential-service operator does so to ensure the continuity of its services (Articles 15(3) and 17(3)).
• If you are an essential-service operator, register formally with CSIRT.CV, the national computer security incident response team (Article 11(2)).
• If you are an essential-service operator, carry out an internal audit every year by 31 December and send its report to the Centro Nacional de Segurança, as Article 17(4) names the recipient, within 15 days of completing the audit (Article 17(4)).
• Follow the cybersecurity instructions the Centro Nacional de Cibersegurança issues (Articles 8(1)(b) and 24(1)(b)).
• This binds the public administration (central, local, independent administrative entities, public institutes, public companies and public associations), the operators of critical infrastructure and the operators of essential services, public or private, in the sectors the Annex lists: energy, transport, banking, financial market infrastructure, health, drinking water, and digital infrastructure and telecommunications (Articles 2, 3 and 11 and the Annex); the Centro Nacional de Cibersegurança identifies the essential-service operators within one year of its installation and updates that identification every year (Article 30(1)-(2)). Reached by declaring that you operate an essential service.

Decreto-lei nº 9/2021, arts. 16 and 18 (regime jurídico de cibersegurança) · Read the law's page

• If you are a public administration body or a critical infrastructure operator, notify the Centro Nacional de Cibersegurança of incidents with a relevant impact on the security of the networks and information systems, within the period set by the regulation Article 14 provides for (Article 16(1)).
• If you are a critical infrastructure operator, include in the notification the information that lets the Centro determine the cross-border impact of the incident (Article 16(2)).
• If you are an essential-service operator, notify the Centro of incidents with a relevant impact on the continuity of the essential services you provide, within the period set by regulation, and include the information that lets it determine the cross-border impact (Article 18(1)-(2)).
• If you are an essential-service operator that depends on a third-party digital service provider, notify every important impact on the continuity of your services that results from incidents affecting that provider (Article 18(10)).
• Weigh whether an incident's impact is relevant by the number of users affected, the duration of the incident and its geographic spread (Articles 16(4) and 18(4)).
• This binds the public administration (central, local, independent administrative entities, public institutes, public companies and public associations), the operators of critical infrastructure and the operators of essential services, public or private, in the sectors the Annex lists: energy, transport, banking, financial market infrastructure, health, drinking water, and digital infrastructure and telecommunications (Articles 2, 3 and 11 and the Annex); the Centro Nacional de Cibersegurança identifies the essential-service operators within one year of its installation and updates that identification every year (Article 30(1)-(2)). Reached by declaring that you operate an essential service.