MadagascarDecree No. 2023-1541, CMIL powers and inspection and sanction procedure
Décret n° 2023-1541, arts. 4-6, 75-79 (attributions de la CMIL, contrôle et sanctions)
In force.
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Commission Malagasy de l'Informatique et des Libertés (CMIL)
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Give the CMIL any useful information on the computer files you use when it orders you to.
- Carry out a CMIL injunction within the period it sets, and prove in writing when that period expires that you did so.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Articles 4 to 6 and 75 to 79 of the Decree set the CMIL's powers and the inspection and sanction procedure. They require the controller to prove in writing that it carried out an injunction, which is a report to the CMIL and not a kept record, and state no duty to create or keep a log. The register of sanctions is kept by the CMIL itself under article 80.
- Kind
- None
- As of
What this law does
Article 4 of Decree No. 2023-1541 makes the CMIL the independent administrative authority in charge of protecting personal data and monitoring its processing, with regulatory and sanctioning power. Article 6 empowers the CMIL to order controllers to give it any useful information on the computer files they use, and to carry out information and inspection missions on site or online.
Article 75 requires the mission order for an on-site inspection to state the identity of the CMIL members and agents authorized to inspect, the address of the premises and the object of the mission. Article 76 gives the controller eight days from receipt of the record of an inspection mission to send its observations to the CMIL.
Article 77 gives the controller thirty days from receipt of the CMIL's investigation report on a breach that may lead to administrative sanctions to send written and oral observations, after which the observations are inadmissible. Article 78 requires the CMIL's President to summon the controller to a session of the deliberative body at least fifteen days before it rules, by registered letter with acknowledgment of receipt or equivalent electronic means.
Article 79 requires a controller to carry out the CMIL's injunction within the period the CMIL sets and to prove it in writing when that period expires.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .