Côte d'IvoireLaw No. 2013-450 on the Protection of Personal Data, enforcement and the Protection Body
Loi n° 2013-450, arts. 45-52 (enforcement and the Protection Body)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.artci.ci/images/stories/pdf-english/lois_english/loi_2013_450_english.pdfIn force.
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Respond to ARTCI's declarations, authorization requests, claims, complaints and audits, and comply with a warning or formal notice it issues within the time it sets.
- Do not invoke professional secrecy against the Protection Body, whether you are a cryptologic service provider or the person responsible for the processing.
- Comply with an order interrupting a processing, locking data, or prohibiting a processing temporarily or permanently once the Protection Body issues it after an adversarial procedure.
- Expect a financial penalty proportionate to the breach and the benefit derived from it, capped at 10 million CFA francs for a first failure and rising, for a repeated failure within five years, to 100 million CFA francs or, for a company, to 5 percent of the prior financial year's turnover excluding tax up to a maximum of 500 million CFA francs.
- Do not oppose the Protection Body's members or authorized agents, refuse or conceal information or documents they request, or supply information inconsistent with your own records.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Processing sensitive-category data without an article 21 exemption is punishable by ten to twenty years' imprisonment and a fine of 20 million to 40 million CFA francs (art. 21); unsolicited electronic direct marketing without consent is punishable by one to five years' imprisonment and a fine of 1 million to 10 million CFA francs (art. 22); obstructing the Protection Body is punishable by one month to two years' imprisonment and a fine of 1 million to 10 million CFA francs (art. 45).
Penalty structure
Article 51's administrative and pecuniary penalty for a first breach, without prejudice to any criminal penalty. On a repeated failure within five years the ceiling rises to 100 million CFA francs, or for a company to 5 percent of the prior year's turnover excluding tax up to a maximum of 500 million CFA francs.
- Rule
- Fixed only
- As of
- Currency
- XOF
- Fixed cap
- 10,000,000
Who enforces it
Enforcement body
Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire (ARTCI), acting as the Autorité de Protection des données à caractère personnel
What it makes you log
Logging duty
Article 47 gives the Protection Body (ARTCI) the power to audit any personal data processing through sworn officers and to keep a public directory of processing, and Article 45 makes it an offence to refuse to give the Body's members or agents the information and documents their mission needs. None of these sections requires the person responsible to keep a particular log or record. The Body's power to audit and to demand documents is its own and is exercised when it chooses, and the audit produces no report owed by the person audited. The directory is the Body's register, not a record the controller keeps, so no access party is listed. The sections cited here carry no territorial clause, so the hook is empty.
- Kind
- None
- As of
What this law does
Article 46 entrusts the mission of personal-data Protection Body to ARTCI, the independent administrative body regulating telecommunications and information and communication technologies, and article 47 gives it the power to receive declarations and grant or withdraw authorizations, receive and resolve claims and complaints, audit any processing through sworn officers, impose administrative and pecuniary penalties, maintain a public directory of processing, authorize cross-border transfers, and issue guidelines for the processing and protection of personal data.
Article 48 bars a cryptologic service provider or a person responsible for processing from invoking professional secrecy against the Protection Body. Article 49 lets the Protection Body issue a warning or a formal notice to stop a deficiency within a set time, and article 50 lets it, after an adversarial procedure, order the interruption of a processing, the locking of some of the data, or a temporary or permanent prohibition where a processing violates human freedoms.
Article 51 lets the Protection Body, after hearing the person responsible or their subcontractor, withdraw an authorization temporarily or finally or impose a financial penalty proportionate to the seriousness of the breach and the benefit derived from it, capped at 10 million CFA francs for a first failure and, for a repeated failure within five years, at 100 million CFA francs or, for a company, 5 percent of the prior financial year's turnover excluding tax up to a maximum of 500 million CFA francs, without prejudice to any criminal penalty.
Article 45 punishes obstructing the Protection Body, by opposing its members' tasks, refusing or concealing information or documents it requests, or supplying inconsistent information, with imprisonment of one month to two years and a fine of 1 million to 10 million CFA francs, and requires the prosecutor or investigating judge to be told without delay of any such obstruction. No commencement notice for the Act has been located in the Official Gazette.
When LexLint raises it
When your app profile says your app is a listed company or processes personal data.
Back to the example · Lint your app
Page updated .