Equatorial GuineaLey de Protección de Datos Personales
Ley Núm. 1/2016, de 22 de julio, de Protección de Datos Personales
In force.
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent, Security, Governance, Retention
- Audit expectation
- none
What it requires
- Obtain the data subject's clear, undeniable and unquestionable consent before processing personal data, which the data subject may revoke for a justified reason without retroactive effect (Article 10).
- Collect for processing only personal data that is adequate, accurate, truthful, pertinent, complete and not excessive for determined, explicit and legitimate purposes, and do not obtain it by fraudulent or unlawful means (Article 6).
- Do not keep personal data in a form that identifies the data subject for longer than the purposes for which it was collected require, and cancel and replace inaccurate or incomplete data (Article 7).
- Govern processing carried out on your behalf by a third party with a written contract, signed by the parties, under which the processor processes the data only on your instructions (Article 8).
- Adopt the technical and organizational measures needed to keep personal data secure, and do not record it in files, systems or programs that lack conditions of integrity and confidentiality (Article 11).
- Keep personal data confidential at all times, and share it with a third party only within the cases Article 12 allows (Article 12).
- Create a private personal data file only under an administrative concession or authorization, and notify the project beforehand to the Órgano Rector de Protección de Datos Personales (Articles 17 and 20).
- Request the registration of each personal data file in the General Data Protection Register (Article 39(a)).
These lines are LexLint's reading of the law's text.
If you get it wrong
Private right of actionYes
Penalty structure
Three tiers: minor infraction 200,000 to 500,000 FCFA; serious infraction 500,001 to 5,000,000 FCFA; very serious infraction 5,000,001 to 15,000,000 FCFA (the highest fixed amount is the top of the very-serious tier). Very serious and serious tiers also carry non-monetary sanctions: suspension of processing, seizure of equipment, closure of premises, disqualification, or cancellation of a file's registration.
- Rule
- Fixed only
- As of
- Currency
- XAF
- Fixed cap
- 15,000,000
Who enforces it
Enforcement body
Ministry of Telecommunications and New Technologies (pending creation of the Órgano Rector de Protección de Datos Personales by decree)
Settledness
- As of
- Open questions
- Does "todos los ciudadanos" in article 2(1) limit the Law to nationals of Equatorial Guinea, or reach the personal data of any individual processed on means located in the national territory?
- On what date was Ley 1/2016 published in the Boletín Oficial del Estado, from which the twenty days of its final provision run?
What it makes you log
Logging duty
The articles this row cites set the principles of quality and storage limitation (Articles 6 and 7), a written processor contract (Article 8), consent (Article 10), security measures (Article 11), secrecy (Article 12), the concession or authorization and prior notification of a private file to the Órgano Rector (Articles 17 and 20) and the request to register each file in the General Data Protection Register (Article 39(a)). Each is a filing, a contract or a condition of processing, and none requires a person to make, keep or produce a log of the controller's own processing. The inspection and document-production powers are in Articles 35 and 36, coded on the enforcement row. Article 2(1) applies the Law to the personal data of citizens (a nationality test), to processing on means located in the national territory (a test of where the equipment is, which carries no hook value) and to a controller not established in the country to whom Equatoguinean law applies (no test is stated), so none of its prongs yields a hook value and the hook is empty.
- Kind
- None
- As of
What this law does
Article 2 applies the Law to the personal data of any citizen recorded on any medium, in both the public and the private sector. It applies when the processing is carried out or used by means located in the national territory, or when Equatoguinean law applies to a controller not established in the country.
Article 6 allows only personal data that is adequate, accurate, truthful, pertinent, complete and not excessive for determined, explicit and legitimate purposes to be collected for processing, and prohibits obtaining it by fraudulent or unlawful means. Article 7 bars keeping personal data in a form that identifies the data subject for longer than the purposes for which it was collected or recorded require.
Article 8 requires processing carried out on behalf of third parties to be governed by a written contract, signed by the parties, stating that the processor will process the data only on the controller's instructions. Article 10 requires the clear, undeniable and unquestionable consent of the data subject for the processing of personal data, subject to listed exceptions for administrative activity, contracts and public-service sources.
Article 10 lets that consent be revoked for a justified reason, without retroactive effect. Article 11 requires the file controller and any processors to adopt the technical and organizational measures needed to keep personal data secure, preventing its alteration, loss, or unauthorized processing or access. Article 12 binds the controller, the processor and everyone involved in processing to professional secrecy and confidentiality at all times.
Article 17 lets private persons create personal data files by obtaining the corresponding administrative concession or authorization from the competent body. Article 20 requires the project of any private file to be notified beforehand to the Órgano Rector de Protección de Datos Personales. Article 39 classes as a minor infraction the failure to request the registration of a personal data file in the General Data Protection Register.
The transitional provision gives personal data files that exist when the Law enters into force six months to comply with it. The Law's own final provision ties commencement to twenty days after its publication in the Official Gazette, and no source stating the day of that publication has been located. The Law is dated at Malabo on .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .