Law / Economic Community of West African States
ECOWAS Supplementary Act on Personal Data Protection, scope, principles, consent, security and direct prospecting
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent, Security, Disclosure
As of .
What it requires
- As a data controller or processor handling personal data in an ECOWAS Member State, declare the processing to the national data protection Authority, except in the cases the Act exempts, and obtain consent or another ground Article 23 lists.
- Obtain personal data only for specified, explicit and lawful purposes and do not process it further in a manner incompatible with those purposes.
- Do not obtain or process data that reveals racial, ethnic or regional origin, political opinions, religious or philosophical beliefs, trade union membership, sexual life, genetic data or health, except in a case Article 31 lists.
- Do not use an individual's personal data for direct prospecting by any means of communication without the individual's prior consent.
- Do not base a decision that has legal effect on an individual solely on automatic processing of personal data that defines the individual's profile or evaluates aspects of personality.
- Keep personal data confidential and protected, and take all necessary precautions so that it is not deformed, damaged or accessible to unauthorised third parties.
- Where processing is carried out on your behalf, choose a data processor that provides sufficient guarantees.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The independent data protection Authority that each Member State is to establish under Article 14, which is responsible for ensuring that personal data is processed in compliance with the Supplementary Act.
Settledness
- As of
- Open questions
- Does the Revised Supplementary Act on the Protection of Personal Data in the ECOWAS Region, which the Authority of Heads of State and Government adopted on , replace the 2010 Supplementary Act A/SA.1/01/10 in the Community's Official Journal, and from which day?
What this law does
Supplementary Act A/SA.1/01/10 was signed by the Heads of State and Government at Abuja on . Article 3 applies the Act to the collection, processing, transmission, storage and use of personal data by any individual, by government and local authorities, and by public or private legal entities. Article 4 excludes processing an individual carries out in the exclusive framework of personal or domestic activities.
Article 5 subjects the processing of personal data to a declaration to the data protection Authority, except in the cases set out in Articles 6, 11 and 12. Article 23 treats processing as legitimate where the data subject has given consent. Article 25 requires personal data to be obtained for specified, explicit and lawful purposes and not further processed in a manner incompatible with those purposes.
Article 28 requires personal data to be processed confidentially and protected, in particular when it is transmitted on a network. Article 29 requires a data controller who has processing carried out on its behalf to choose a data processor providing sufficient guarantees.
Article 30 prohibits obtaining and processing data that reveals racial, ethnic or regional origin, political opinions, religious or philosophical beliefs, trade union membership, sexual life, genetic data or data on the state of health. Article 34 prohibits direct prospecting, by whatever means of communication, using the personal data of an individual who has not given prior consent to receiving it.
Article 35(2) bars a decision that has legal effect on an individual from resting solely on automatic processing of personal data to define the individual's profile or evaluate aspects of the personality. Article 43 requires the data controller to take all necessary precautions, in relation to the nature of the data, to ensure that it is not deformed, damaged or accessible to unauthorised third parties.
Article 14 requires each Member State to establish its own data protection Authority, an independent administrative Authority responsible for ensuring that personal data is processed in compliance with the Act. Under Article 20 the data protection Authority may withdraw a processor's authorization provisionally or definitively, or impose a fine, where the processor does not conform with a formal notice.
Under Article 48 the Act enters into force upon publication in the Official Journal of the Community and in the Official Gazette of each Member State.
When LexLint raises it
When your app profile says your app sends automated outreach, makes high-risk automated decisions or processes personal data.