GuineaLoi n° L/2016/037/AN, protection des données à caractère personnel, droits de la personne concernée
Loi n° L/2016/037/AN, arts. 30-38 et 40 (droits de la personne concernée)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Consent
As of .
What it requires
- At the latest when you collect personal data, tell the data subject your identity, the purposes, the categories of data, the recipients, the possibility of refusing to appear in the file, the existence of the rights of access and rectification, the retention period, and any possible transfer to a third country (Article 30).
- On a data subject's request, confirm whether their data is processed, communicate it with any available information on its origin, and give the purposes, categories of data and recipients (Article 31).
- Honor a data subject's objection, on legitimate grounds, to the processing of their data, and their free objection to use of their data for direct marketing (Article 32).
- Before personal data is first communicated to third parties, or used on their behalf, for direct marketing, inform the data subject and give them the express right to object free of charge (Article 32).
- On the request of a person who proves their identity, rectify, complete, update, block or delete personal data that is inaccurate, incomplete, equivocal or outdated, or whose collection, use, communication or retention is prohibited (Article 33).
- Erase a data subject's data on the grounds Article 35 lists, and do so without delay, unless an exception in Article 37 applies (Articles 35 and 37).
- Where personal data is processed automatically in a structured, commonly used format, give the data subject on request a copy of it in a structured, commonly used electronic format (Article 40).
- Do not carry out direct marketing, by any means of communication, with the personal data of a person who has not given prior written consent to receive it or who has formally objected (Article 54, the paragraph on direct marketing).
These lines are LexLint's reading of the law's text, as of .
What this law does
Article 30 requires the controller to give the data subject, at the latest at the time of collection, its identity, the purposes, the categories of data, the recipients, the possibility of refusing to appear in the file, the existence of rights of access and rectification, the retention period, and any possible transfer to a third country.
Article 31 lets a data subject ask the controller for the information needed to know and contest the processing, confirmation of whether their data is processed, communication of the data and any available information on its origin, and information on the purposes, categories of data and recipients. Article 31 lets the controller oppose manifestly abusive requests from the same data subject, and puts the burden of proving that character on the controller.
Article 32 gives a data subject the right to object, on legitimate grounds relating to their situation, to the processing of their data, except where a legal provision expressly provides for the processing. Article 32 also gives a data subject a free right to object to processing for direct marketing, and a right to be informed before their data is first communicated to third parties or used on their behalf for direct marketing, with an express free right to object to that communication or use.
Article 33 lets a person who proves their identity require the controller to rectify, complete, update, block or delete personal data that is inaccurate, incomplete, equivocal or outdated, or whose collection, use, communication or retention is prohibited. Article 35 gives a data subject the right to obtain from the controller the erasure of their data. Article 37 requires the controller to erase without delay (sans délai), except where retention is necessary.
Article 40 gives a data subject whose data is processed automatically in a structured, commonly used format the right to a copy of that data in a structured, commonly used electronic format that allows reuse. Article 54 prohibits, on pain of one to five years' imprisonment and a fine of 30,000,000 to 200,000,000 Guinean francs, direct marketing by any means of communication using the personal data of a person who has not given prior written consent to receive it or who has formally objected.
When LexLint raises it
When your app profile says your app crawls the web, trains models, sends automated outreach or deploys a chatbot.