BeninLoi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, transfert transfrontalier de données
Loi n°2017-20 du 20 avril 2018, Livre V, arts. 391-392 (transfert transfrontalier de données)
In force.
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Access restriction
- Audit expectation
- none
What it requires
- Obtain the Autorité de Protection des Données Personnelles (APDP)'s finding that the destination country or international organization assures a level of data protection equivalent to Benin's own before any transfer of personal data outside Benin.NIST Privacy FrameworkCT.PO-P2
- Obtain the Autorité's prior authorization before any actual transfer of personal data to a third country or international organization, even where an equivalence finding exists.NIST Privacy FrameworkCT.PO-P2
- Where the destination does not assure an adequate level of protection, transfer personal data only where the data subject has given express consent, the transfer is necessary to perform or negotiate a contract with or for the benefit of the data subject, the transfer serves an important public interest or a legal claim, protects vital interests, or comes from a public register open to consultation, or where the Council of Ministers has authorized it by decree on the Autorité's opinion after you show sufficient privacy safeguards.NIST Privacy FrameworkCT.PO-P2
- Identify in your register of processing activities every transfer of personal data to a third country or international organization, including that country's or organization's identity and, where relied on, the documents evidencing appropriate safeguards.NIST Privacy FrameworkID.IM-P4
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 391 and 392 require the Autorité's finding of equivalent protection, its prior authorization of each transfer and, where protection is not equivalent, one of the listed exceptions or a decree. Article 391 adds that transfers are subject to regular control by the Autorité as to their purpose, which is a check on the transfers, not on a record. The register of processing activities that identifies each transfer is in Article 435, which this row does not cite. The row cites no territorial clause.
- Kind
- None
- As of
What this law does
Article 391 permits transferring personal data to a third country or an international organization only once the Autorité has found that the destination assures a level of data protection equivalent to this Book, weighing the rule of law, the data protection rules, and the available remedies there, and requires the Autorité's prior authorization before any actual transfer takes place.
Article 392 lets a transfer proceed despite an inadequate destination where the data subject has expressly consented, the transfer is necessary to perform or negotiate a contract with or for the data subject, it serves an important public interest or a legal claim, it protects vital interests, it comes from a public register open to consultation, or the Council of Ministers has authorized it by decree on the Autorité's opinion after the controller shows sufficient privacy safeguards.
Article 435 requires a controller's register of processing activities to identify every transfer of personal data to a third country or international organization, including its identity and, where relied on, the documents evidencing appropriate safeguards. The Digital Code states no day of entry into force, and no Journal officiel publication of it and no other source stating the day it came into force has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .