MadagascarLaw No. 2014-038, cross-border transfer of personal data
Loi n° 2014-038, art. 20 (transfert de données à l'étranger)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Access restriction
- Audit expectation
- none
What it requires
- Before transferring personal data to a foreign State, confirm that State's law assures a similar level of protection, weighing the data's nature, the processing's purpose and duration, the countries of origin and destination, and the destination's laws, professional rules, and security measures.
- Where the destination does not assure a similar level of protection, obtain CMIL authorization by offering sufficient guarantees such as appropriate contractual clauses or binding internal rules, or rely on one of the law's listed exceptional grounds, such as the data subject's informed consent to the transfer.
- Do not transfer received personal data onward to another foreign country without the agreement of both the original controller and the CMIL.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 20 conditions a transfer abroad on a similar level of protection, a Commission authorization or one of the listed exceptions. It states no duty to create, keep or produce a log or record of a transfer.
- Kind
- None
- As of
What this law does
Article 20 bars a controller from transferring personal data to a foreign State unless that State's legislation assures a level of protection for people similar to what this law assures, a level assessed against every circumstance of the transfer, including the data's nature, the purpose and duration of the processing, the countries of origin and final destination, and the third country's general or sector rules of law, professional rules, and security measures.
Absent a similar level of protection, the CMIL may still authorize the transfer where the controller offers sufficient guarantees for privacy and fundamental rights and freedoms, which may rest on appropriate contractual clauses or binding internal rules.
By way of exception to those paragraphs, a transfer to a country that does not assure a similar level of protection may still go ahead where the data subject has unambiguously consented to the transfer after being informed there is no similar level of protection, where the transfer is necessary to perform or negotiate a contract with the data subject or a contract in the data subject's interest with a third party, where it is necessary or legally required to safeguard an important public interest or to establish, exercise, or defend a legal right, where it safeguards the data subject's vital interest, or where it comes from a public register open to public consultation under legislative or regulatory provisions and the legal conditions for consulting it are met.
Article 20 also bars a recipient from transferring the data onward to a foreign country again without the agreement of the original controller and of the CMIL.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .