Loi n° 24.001 portant protection des données à caractère personnel

Loi n° 24.001 applies to processing carried out by an establishment of a controller or a processor in the Central African Republic, and to processing that produces effects in the country even where the controller is abroad, subject to carve outs for a purely personal or domestic use and for the temporary, intermediate technical copies an access provider makes to route traffic.

Every activity of processing personal data must respect the principles of lawfulness, fairness, transparency, security, purpose limitation, accuracy, proportionality, and retention limitation.

Personal data may be processed only where it is necessary for the performance of a contract, compliance with a legal obligation, a legitimate interest that does not override the data subject's rights, the data subject's freely given and revocable explicit consent, the safeguarding of someone's vital interests, or the performance of a public interest mission, and a person who has made their own data freely accessible supports a controller's reliance on the legitimate interest ground.

Data processed for archival, historical, statistical, or scientific purposes may be kept and used under safeguards a law defines for that purpose even after the Act's ordinary retention limit would otherwise apply. A controller must take precautions appropriate to the data's nature and the risks involved to keep personal data secure, including protection against accidental or unlawful destruction, loss, alteration, or unauthorized access.

Processing may be subcontracted only on the controller's instruction, the processor must offer sufficient guarantees to implement security and confidentiality measures, and the contract between them must specify the processor's security and confidentiality obligations.

A provider of electronic signature certification services must collect the personal data it needs to issue and keep the certificates directly from the person concerned, and use it only for that purpose, absent the person's express consent otherwise.

Interconnecting personal data files held by different public service bodies with different public interests, or held by private parties for different purposes, needs the agency's prior authorization, stating the nature of the data, the purpose the interconnection serves, and its duration.

Every controller must designate a data protection officer responsible for compliance with the Act's obligations, who keeps the register of processing operations, issues an opinion on every new processing operation before it starts, and consults the agency in case of doubt, and designating one exempts the controller from the ordinary prior declaration formalities except where the processing needs the agency's authorization.

Only a person residing in the Central African Republic with the necessary knowledge and qualifications may be designated data protection officer, whether an employee or an outside person, and the officer may be removed only for serious cause and after the agency has been told.

Chapitre Ier defines a violation of personal data as any destruction, loss, alteration, or unauthorized disclosure of personal data, transmitted, stored, or otherwise processed, that is accidental or unlawful, but no provision of the Act requires that violation to be notified to the agency or to the person concerned. The Act states that it takes effect from its date of promulgation, but the archived text does not show a legible date for that promulgation.