TogoLoi n° 2019-014, cadre institutionnel et dispositions pénales
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2020. Publisher's page: https://numerique.gouv.tg/wp-content/uploads/2020/01/Loi-n-2019-014-du-29-octobre-2019-relative-a-la-protection-des-donnees-a-caractere-pers…In force.
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Instance de Protection des Données à Caractère Personnel (IPDCP)
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect the Instance de Protection des Données à Caractère Personnel to investigate complaints, petitions and claims about your processing, tell their authors the outcome, and alert the public prosecutor to any offense it learns of.
- Comply with a warning or formal notice the Instance issues within the period it sets, or face a provisional or, ultimately, definitive withdrawal of your authorization, an administrative fine of up to XOF 100,000,000, interruption of the processing, data locking, or a daily penalty of up to XOF 5,000,000, after a hearing.
- Do not obstruct the Instance's action by opposing its members' or agents' missions, refusing to communicate the information or documents they request, or supplying information that does not match your records.
- Expect criminal liability of up to five years' imprisonment and a fine of up to XOF 25,000,000 for processing without the required formalities, unauthorized use of the national identification number, fraudulent data collection, unlawful processing of sensitive or offense related data, breach of the right to object, misuse of data beyond its declared purpose, or unauthorized disclosure of data.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Chapter VII (arts. 79 to 93) fixes a distinct imprisonment and fine range for each offense. The base tier, covering processing without the required formalities (art. 79), continuing to process after a provisional authorization withdrawal (art. 80), unauthorized use of the national identification number (art. 82), failing to implement required security measures (art. 83), unlawfully processing sensitive data (art. 86) or offense related data (art. 87), exceeding or processing beyond the legal retention period (arts. 89 to 90), and intentional unauthorized disclosure (art. 92, first paragraph), carries one to five years' imprisonment and a fine of XOF 1,000,000 to XOF 10,000,000, or either penalty alone. A higher tier applies to fraudulent data collection and breach of the right to object to marketing (arts. 84 to 85), at one to five years and XOF 5,000,000 to XOF 20,000,000, and to unlawful health research processing and misuse of data beyond its declared purpose (arts. 88 and 91), at one to five years and XOF 5,000,000 to XOF 25,000,000. Violating simplified or exemption norms (art. 81) carries one to three years and XOF 500,000 to XOF 5,000,000, or three months to one year and XOF 100,000 to XOF 1,000,000 where committed negligently; negligence also lowers the article 79 and article 80 offenses to one to three years and XOF 500,000 to XOF 5,000,000. Negligent unauthorized disclosure (art. 92, second paragraph) and hindering the Instance's action (art. 93) each carry six months to two years, at XOF 500,000 to XOF 2,000,000 for negligent disclosure and XOF 1,000,000 to XOF 10,000,000 for hindering the Instance.
Penalty structure
The Instance may impose an administrative fine of up to XOF 100,000,000 for breach of an authorization it granted, after a contradictory procedure (art. 71), separate from the criminal fines of XOF 100,000 to XOF 25,000,000 stated for the distinct offenses in arts. 79 to 93.
- Rule
- Fixed only
- As of
- Currency
- XOF
- Fixed cap
- 100,000,000
What it makes you log
Who may demand the log
Regulator
Logging duty
The institutional articles create the Instance, give it a power to demand any document in any medium and to reach programs and data (Article 68), to sanction (Article 71) and to make visits (Articles 66 and 67, with a record of the visit under Article 69), and make obstruction an offence (Article 93). They impose no log or record duty on a controller, and the power to demand documents is not a rule about a record. The cited articles have no scope clause.
- Kind
- None
- As of
What this law does
Article 55 creates the Instance de Protection des Données à Caractère Personnel (IPDCP) as an independent administrative authority tasked with ensuring that processing complies with the law, and article 56 gives it the missions of receiving formalities, receiving and answering complaints, alerting the public prosecutor to offenses it learns of, verifying processing, sanctioning controllers under article 71, answering opinion requests, approving conduct codes, keeping a public register, advising controllers, authorizing cross border transfers, proposing legislative improvements, cooperating internationally, publishing authorizations and opinions, and reporting annually to the President, the Prime Minister and the presidents of the two legislative chambers.
Article 70 lets the Instance issue a warning or a formal notice fixing a deadline to end a breach, and article 71 lets it, after a hearing, provisionally or ultimately withdraw an authorization or impose a fine of up to XOF 100,000,000 where the controller does not comply.
Articles 72 and 73 let the Instance take emergency and conservatory measures, including interrupting a processing operation, locking data, ordering compliance under a daily penalty of up to XOF 5,000,000, or sealing and removing equipment used in an unauthorized processing operation, and article 74 lets the Instance's decisions be appealed before the administrative chamber of the Supreme Court.
Article 93 punishes obstructing the Instance's action, whether by opposing its members' or agents' missions, refusing to communicate the information or documents they request, or supplying information that does not match the records, with six months to two years' imprisonment and a fine of XOF 1,000,000 to XOF 10,000,000.
Article 97, the closing article, provides that the law is executed as a law of the State but names no day of its own entry into force, and no commencement notice has been located in the Journal officiel.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .