ChadLoi n°007/PR/2015, transfert des données vers un pays non membre de la CEEAC/CEMAC
Loi n°007/PR/2015 du 10 février 2015, arts. 29-32
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://arcep.td/sites/default/files/Loi-N%C2%B007-PR-2015.pdfIn force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Governance
- Audit expectation
- none
What it requires
- Do not transfer personal data to a country outside the CEMAC and CEEAC blocs unless that country ensures a sufficient level of protection for privacy and fundamental rights and freedoms.
- Before any transfer of personal data to a country outside the CEMAC and CEEAC blocs, inform ANSICE in advance.
- Where the destination country does not ensure a sufficient level of protection, transfer personal data only on the data subject's unambiguous consent, another article 31 ground, or ANSICE's authorization on the strength of sufficient contractual safeguards.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 29 bars a transfer of personal data to a country outside CEMAC and CEEAC unless that country ensures a sufficient level of protection, article 30 makes the controller inform the data protection authority, ANSICE, before any such transfer, article 31 lists the derogations and article 32 lets ANSICE authorize transfers where the controller offers sufficient guarantees. The advance notice is a report sent to the authority, and no clause makes the controller keep a log or record of transfers or produce one on demand. The consent in article 31(a) must be given without doubt, which names no record. The articles name no territorial hook, so the hook is empty.
- Kind
- None
- As of
What this law does
Article 29 bars a controller from transferring personal data to a country outside the CEMAC and CEEAC blocs unless that State ensures a sufficient level of protection for privacy and fundamental rights and freedoms with respect to the processing the data will or may undergo. Article 30 requires the controller to inform ANSICE before any transfer to such a third country, regardless of that country's adequacy.
Article 31 lets a transfer to a non-adequate country proceed by derogation where the data subject has unambiguously consented, the transfer is necessary to a contract with the data subject or its pre-contractual steps, the transfer is necessary to a contract in the data subject's interest between the controller and a third party, the transfer is necessary or legally required to safeguard an important public interest or to establish, exercise, or defend a legal claim, the transfer safeguards the data subject's vital interest, or the transfer comes from a public register open to public consultation under legislative or regulatory provision.
Article 32 lets ANSICE authorize a transfer or set of transfers to a non-adequate country where the controller offers sufficient guarantees for privacy and fundamental rights and freedoms, including through appropriate contractual clauses.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .