GuineaLoi n° L/2016/037/AN portant Cybersécurité et Protection des Données à Caractère Personnel, titre relatif à la protection des données à caractère personnel
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Governance, Consent, Security
- Audit expectation
- periodic
- Who audits it
- Self
- Where the report goes
- Filed with regulator
What it requires
- Treat any processing of personal data belonging to a natural person as within this law's scope, whether you are an individual, a business, or a public institution operating in Guinea.
- Declare the processing of personal data to the competent Authority before you start, and begin only once you hold its acknowledgment of receipt (Article 5).
- Obtain the competent Authority's prior authorization before processing genetic or medical data, data on offences, convictions or security measures, a national identification number or similar identifier, biometric data, or data processed in the public interest, and before a transfer to a third country (Article 7).
- Process personal data only with the data subject's express prior consent, unless you are duly authorized and the processing is necessary for a legal obligation, a public-interest mission, a contract with the data subject, or safeguarding the data subject's interest or fundamental rights and freedoms (Article 18).
- Collect and process personal data lawfully and fairly, for determined, explicit and legitimate purposes, and keep it no longer than those purposes require (Articles 19 and 20).
- Keep personal data accurate and, where necessary, up to date, and erase or rectify data that is inaccurate or incomplete (Article 21).
- Choose a processor that can give guarantees for the protection and confidentiality of the data (Article 24).
- Take all useful precautions, given the nature of the data, to prevent it being distorted, damaged or reached by unauthorized third parties (Article 42).
- Draw up an annual report for the personal data protection Authority on your compliance with the relevant provisions of the law (Article 44).
- Bring your processing into compliance within one year of the law's promulgation, which is dated (Article 63).
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Which body is "l'Autorité compétente désignée par voie réglementaire" ("the competent Authority designated by regulation") to which Article 5 of the data protection title requires a "déclaration préalable" ("prior declaration") before personal data is processed, and has it been created, given that Article 47 says the Authority "sera créée par voie réglementaire" ("will be created by regulation")?
- Does Article 3's coverage of "Tout traitement de données mis en oeuvre sur le territoire de la République de Guinée" ("any processing of data carried out in the territory of the Republic of Guinea") reach a controller established outside Guinea that processes the personal data of people in Guinea?
What it makes you log
Who may demand the log
Public
What the log must hold
Event time, Actor identity, Access record
Logging duty
Article 43 requires the controller to guarantee that it can be verified and established afterwards who had access to the information system holding personal data, what data were introduced, modified, altered, copied, erased or read, and when they were handled; that is an access and change trail. Article 14 has the data protection correspondent keep a list of the processing carried out, immediately accessible to anyone who asks. Article 44 requires the controller to draw up an annual report for the Authority on compliance with the relevant provisions of the Law. No period is stated for the trail or the list, so no retention value is given; Articles 20 and 45 limit how long the personal data is kept, which concerns the data and not the trail. This row covers the whole data protection title, and Articles 43 and 44 sit in it although its summary does not recite them. The Authority's powers of verification are in Articles 48 and 55, coded on the authority row. Article 3 reaches processing carried out on the territory of Guinea, a test of where the processing is run that carries no hook value, so the hook is empty. The prior declaration of Article 5 is a filing with the Authority and not a record the controller keeps.
- Kind
- Explicit
- As of
- Provision
- Article 43 (after-the-fact trail of access and changes), with Article 14 (list of processing) and Article 44 (annual report)
- Trigger
- personal_data_processing
What this law does
Article 3 subjects to the law every collection, processing, transmission, storage and use of personal data by a natural person, the State, local or decentralized authorities, public establishments and institutions, or private legal entities. Article 3 also reaches any processing of data carried out on the territory of the Republic of Guinea. Article 5 subjects the processing of personal data to a prior declaration to the competent Authority designated by regulation.
Under Article 5 the applicant may begin the processing on receipt of the Authority's acknowledgment, without being relieved of any of its responsibilities.
Article 7 requires the competent Authority's prior authorization for processing of genetic and medical data and related scientific research, data on offences, convictions or security measures, a national identification number or similar identifier such as a telephone number, biometric data, processing in the public interest such as for historical, statistical or scientific purposes, and a transfer envisaged to a third country.
Article 12 gives the Authority two months to accept or refuse a declaration or an authorization request, extendable by two further months where it gives reasons or justifies the extension. After those periods, under Article 12, the absence of an express answer equals implicit acceptance of the declaration or a tacit authorization granted to the applicant.
Article 18 treats processing as legitimate where the data subject gives express prior consent, with derogations where the controller is duly authorized and the processing is necessary for a legal obligation, a public-interest or official-authority mission, a contract with the data subject, or safeguarding the data subject's interest or fundamental rights and freedoms.
Article 20 requires personal data to be collected for determined, explicit and legitimate purposes and not to be processed further in a way incompatible with those purposes. Article 20 also limits retention to the period necessary for the purposes for which the data was collected or processed. Article 21 requires collected data to be accurate and, where necessary, kept up to date.
Article 24 requires a controller that has processing carried out on its behalf to choose a processor able to give guarantees for the protection and confidentiality of the data. Article 42 requires the controller to take all useful precautions, given the nature of the data, to prevent the data being distorted, damaged or reached by unauthorized third parties.
Article 44 requires the controller to draw up an annual report for the personal data protection Authority on compliance with the relevant provisions of the law. Article 63 gives controllers a maximum of one year from the date of promulgation to bring themselves into compliance. Article 65 brings the statute into force from the date of its promulgation, and its promulgation line is dated at Conakry on . The statute was printed in a special issue of the Journal officiel in September 2019.
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s or processes personal data.
Back to the example · Lint your app
Page updated .