NigerLoi n° 2022-59, contrôle, sanctions et recours
Loi n° 2022-59, arts. 87-110 (contrôle, sanctions administratives, dispositions pénales et recours)
In force.
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Comply with a HAPDP warning or formal notice to end a violation within the deadline it sets, or risk provisional or definitive withdrawal of your processing authorisation and a pecuniary sanction.
- Expect the HAPDP to be able to order the interruption of a persistent unlawful processing operation, the locking of the data concerned, or a temporary or permanent ban on the processing, after a contradictory procedure.
- Expect a pecuniary sanction proportional to the seriousness of the violation, capped at 100,000,000 CFA francs, rising to 200,000,000 francs, or, if you are a company, to 5 percent of your previous financial year's turnover excluding tax up to 500,000,000 francs, for a repeat violation within two years.
- Expect criminal liability on top of any pecuniary sanction for specific violations such as illicit processing of sensitive data, purpose diversion, unauthorised disclosure, fraudulent collection, unlawful retention, or obstructing a data subject's rights or the HAPDP, punished by imprisonment and a fine reaching, for the most serious offences, five years and 50,000,000 francs.
- Give a control agent the HAPDP assigns access to the premises and installations where you carry out processing, other than a private home, to verify your compliance.
- Let a data subject complain to the HAPDP, including after an unanswered complaint to you, and expect a judicial remedy independent of that complaint, including urgent injunctive relief for a serious and immediate violation of their rights.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Chapter XIV criminalises specific violations of the Act. The heaviest tier, three months to five years' imprisonment and a fine of 5,000,000 to 50,000,000 CFA francs, covers illicit processing of sensitive data (art. 95), purpose diversion (art. 99), unauthorised disclosure or access (art. 100), fraudulent collection (art. 101), unlawful retention (art. 103) and harmful disclosure of private data (art. 104). Direct marketing without consent (art. 96) carries three months to three years and 1,000,000 to 10,000,000 francs; obstructing the HAPDP (art. 97) and failing to secure personal data (art. 98) each carry three months to two years and 1,000,000 to 10,000,000 francs; obstructing a data subject's rights (art. 102) carries three months to two years and 1,000,000 to 20,000,000 francs; and a negligent, rather than intentional, harmful disclosure under article 104 carries a fine alone of 500,000 to 1,000,000 francs with no term of imprisonment.
Penalty structure
Article 94 caps the HAPDP's pecuniary sanction at 100,000,000 CFA francs for a first violation. For a repeated violation within two years of the earlier sanction becoming final, the cap is 200,000,000 francs or, for a company, 5 percent of the previous financial year's turnover excluding tax within a limit of 500,000,000 francs; the highest ceiling the text states, 500,000,000 francs, is coded. The criminal fines of Chapter XIV sit apart (arts. 95-104).
- Rule
- Fixed only
- As of
- Currency
- XOF
- Fixed cap
- 500,000,000
Who enforces it
Enforcement body
Haute Autorité de Protection des Données à caractère Personnel (HAPDP)
Settledness
- As of
- Open questions
- Does "ou" in Article 94 make the ceiling for a company in a repeated violation the higher or the lower of 200,000,000 francs and 5 percent of its turnover excluding tax, within the limit of 500,000,000 francs?
- On what date did Loi n° 2022-59 enter into force, given that Article 113 orders only its publication in the Journal Officiel and its execution as a law of the State?
What it makes you log
Who may demand the log
Regulator
Logging duty
Articles 87 and 88 let the HAPDP President appoint agents who may enter the premises where a processing operation runs, and article 97 makes it an offence to refuse the HAPDP's members or agents the information and documents useful to their mission or to hide or remove them. That is a power to inspect and demand documents and an offence for obstructing it, and no record is named; the register of operations in article 64 is outside this row. The sanctions, penal and complaint articles (92 to 110) require no record.
- Kind
- None
- As of
What this law does
Article 87 lets the HAPDP's President assign sworn control agents to verify compliance with the Act and its own deliberations, and article 88 gives those agents access to the premises, installations and establishments used for a processing operation, excluding the parts serving as a private home.
Article 92 lets the HAPDP issue a warning or a formal notice fixing a deadline to end a violation after a contradictory procedure, and where the controller does not comply, lets it withdraw the processing authorisation, provisionally or definitively, and impose a pecuniary sanction. Article 93 lets it order the interruption of a persistent unlawful processing operation, the locking of the data concerned, or a temporary or permanent ban on the processing.
Article 94 caps a pecuniary sanction proportional to the seriousness of the violation and the advantage gained at 100,000,000 CFA francs, rising, for a repeat violation confirmed within two years of the earlier sanction becoming final, to 200,000,000 francs, or, where the offender is a company, to 5 percent of its previous financial year's turnover excluding tax, within a ceiling of 500,000,000 francs.
Chapter XIV criminalises specific violations, from illicit processing of sensitive data to unauthorised disclosure, fraudulent collection, direct marketing without consent, and obstructing a data subject's rights or the HAPDP itself, each punished with imprisonment and a fine running as high as five years and 50,000,000 francs for the most serious offences.
Article 108 lets a person who considers themselves harmed in their privacy, or whose complaint to the controller went unanswered, complain to the HAPDP. Article 109 lets a person appeal a HAPDP sanction or decision to the Conseil d'État. Article 110 gives a data subject a judicial remedy independent of a HAPDP complaint, including urgent injunctive relief for a serious and immediate violation of their rights.
Article 113, the closing article, orders publication in the Journal Officiel and execution as a law of the State, but names no day of the Law's own entry into force, and no commencement notice has been located in the Journal Officiel.
When LexLint raises it
When your app profile says your app sends automated outreach, is a listed company or processes personal data.
Back to the example · Lint your app
Page updated .