Law / Economic Community of West African States
ECOWAS Supplementary Act on Personal Data Protection, rights of the data subject
ECOWAS Supplementary Act A/SA.1/01/10, arts. 38 to 41, rights of the data subject
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
As of .
What it requires
- Give an individual whose personal data you process, no later than at the time of collection, the information Article 38 lists, including the purposes, the recipients, the period of preservation and any possible transfer to a third country.
- Answer an individual's request for confirmation that the individual's data is or is not being processed, and for disclosure of the data and any available information about its origin.
- Honor an individual's objection, for legitimate reasons, to the processing of the individual's personal data.
- Before disclosing an individual's data for the first time to a third party, or using it for a third party's prospecting, inform the individual and give the individual an express, free right to object.
- Rectify, supplement, update, block or destroy inaccurate, incomplete, questionable, outdated or prohibited personal data when the individual asks.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The independent data protection Authority that each Member State is to establish under Article 14, which is responsible for ensuring that personal data is processed in compliance with the Supplementary Act.
Settledness
- As of
- Open questions
- Does the Revised Supplementary Act on the Protection of Personal Data in the ECOWAS Region, which the Authority of Heads of State and Government adopted on , replace the 2010 Supplementary Act A/SA.1/01/10 in the Community's Official Journal, and from which day?
What this law does
Article 38 requires the data controller to give the individual whose data is processed the listed information no later than the time of collection. That information includes the defined purposes for which the data is to be processed. It includes the recipients to whom the data is likely to be disclosed. It includes the period of preservation of the processed data. It includes the possibility of any transfer of the data to a third country.
Article 39 lets an individual whose data is processed ask the data controller for confirmation that the individual's data is or is not being processed. Article 39 also lets the individual ask for disclosure of the data and any available information about its origin. Article 40 entitles an individual, for legitimate reasons, to object to the processing of the individual's personal data.
Article 40 also gives the individual an express right to object, free of charge, to disclosure to a third party or use on a third party's behalf for prospecting. Under Article 41 an individual may ask the data controller to have inaccurate, incomplete, questionable, outdated or prohibited data rectified, supplemented, updated, blocked or destroyed, as appropriate.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.