TogoLoi n° 2019-014, transfert des données vers un pays tiers
Loi n° 2019-014 du 29 octobre 2019, arts. 28-31 (cross border transfer)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2020. Publisher's page: https://numerique.gouv.tg/wp-content/uploads/2020/01/Loi-n-2019-014-du-29-octobre-2019-relative-a-la-protection-des-donnees-a-caractere-pers…In force.
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Before transferring personal data to a third country, confirm that country ensures a sufficient level of protection for privacy and fundamental rights and freedoms, and inform the Instance beforehand for its reasoned opinion.
- Where the destination country does not ensure a sufficient level of protection, transfer personal data there only as a one off, non massive transfer with the data subject's express consent, or where the transfer meets one of the law's listed grounds, such as safeguarding the person's life or a contractual necessity.
- Where you cannot meet the one off transfer conditions, obtain the Instance's authorization for a transfer or set of transfers to a country lacking adequate protection, by offering sufficient guarantees for privacy, fundamental rights and freedoms and the exercise of the corresponding rights.
- Expect the Instance to verify, before any processing of personal data you receive from abroad, that you assure a sufficient level of protection for privacy and fundamental rights, judged by your security measures and the purpose, duration, nature, origin and destination of the data.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 28 to 31 require the controller to inform the Instance before a transfer to a third country and let the Instance authorize transfers to countries without adequate protection. A prior notice to the regulator is a filing, and the articles name no log or register of transfers to be kept. The cited articles have no scope clause.
- Kind
- None
- As of
What this law does
Article 28 permits a transfer of personal data to a third country only if that country ensures a sufficient level of protection for privacy, freedoms and fundamental rights, and requires the controller to inform the Instance beforehand for its reasoned opinion.
Article 29 admits a one off, non massive transfer to a country that does not meet that standard where the data subject has expressly consented, or the transfer is necessary to safeguard the person's life, the public interest, a right in court, or a contract with the person.
Article 30 lets the Instance authorize a transfer or set of transfers to a country lacking adequate protection on a reasoned request, where the controller offers sufficient guarantees for privacy, fundamental rights and freedoms and for the exercise of the corresponding rights.
Article 31 requires the Instance, before any processing of personal data received from abroad, to verify that the controller assures a sufficient level of protection, judged by the security measures applied, the processing's purpose and duration, and the nature, origin and destination of the data.
Article 97, the closing article, provides that the law is executed as a law of the State but names no day of its own entry into force, and no commencement notice has been located in the Journal officiel.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .