Loi n° L/2016/037/AN, protection des données à caractère personnel, autorité de protection et sanctions

Article 47 provides that the authority in charge of personal data protection will be created by regulation. Article 48 charges the Authority with carrying out, through sworn agents, verifications of any processing of personal data. Article 48 also charges the Authority with imposing administrative and pecuniary sanctions on controllers, and their agents, subordinates or processors, that do not comply with the law.

Article 50 lets the Authority issue a warning, or a formal notice to cease or remedy the failures found, within the period it fixes. Article 52 lets the Authority, after hearing a controller or processor that has not complied with a formal notice, withdraw an authorization provisionally or definitively, or impose a fine proportionate to the gravity of the failures and the benefits drawn from them.

Article 55 punishes with six months to three years' imprisonment and a fine of 20,000,000 to 150,000,000 Guinean francs anyone who obstructs or attempts to obstruct the Authority's action or fails to comply with its decisions and injunctions. Article 56 punishes any controller, or its processor, subordinate or agent, that does not respect the law with a fine of 50,000,000 to 150,000,000 Guinean francs.