Economic Community of West African States

Supplementary Act A/SA.1/01/10 was signed by the Heads of State and Government at Abuja on 16 February 2010. Article 3 applies the Act to the collection, processing, transmission, storage and use of personal data by any individual, by government and local authorities, and by public or private legal entities. Article 4 excludes processing an individual carries out in the exclusive framework of personal or domestic activities.

Article 5 subjects the processing of personal data to a declaration to the data protection Authority, except in the cases set out in Articles 6, 11 and 12. Article 23 treats processing as legitimate where the data subject has given consent. Article 25 requires personal data to be obtained for specified, explicit and lawful purposes and not further processed in a manner incompatible with those purposes.

Article 28 requires personal data to be processed confidentially and protected, in particular when it is transmitted on a network. Article 29 requires a data controller who has processing carried out on its behalf to choose a data processor providing sufficient guarantees.

Article 30 prohibits obtaining and processing data that reveals racial, ethnic or regional origin, political opinions, religious or philosophical beliefs, trade union membership, sexual life, genetic data or data on the state of health. Article 34 prohibits direct prospecting, by whatever means of communication, using the personal data of an individual who has not given prior consent to receiving it.

Article 35(2) bars a decision that has legal effect on an individual from resting solely on automatic processing of personal data to define the individual's profile or evaluate aspects of the personality. Article 43 requires the data controller to take all necessary precautions, in relation to the nature of the data, to ensure that it is not deformed, damaged or accessible to unauthorised third parties.

Article 14 requires each Member State to establish its own data protection Authority, an independent administrative Authority responsible for ensuring that personal data is processed in compliance with the Act. Under Article 20 the data protection Authority may withdraw a processor's authorization provisionally or definitively, or impose a fine, where the processor does not conform with a formal notice.

Under Article 48 the Act enters into force upon publication in the Official Journal of the Community and in the Official Gazette of each Member State.

Article 36 permits a data controller to transfer personal data to a country outside ECOWAS only where that country provides an adequate level of protection for privacy, freedoms and the fundamental rights of individuals. Article 36 also requires the data controller to inform the Data Protection Authority before any such transfer.

Article 38 requires the data controller to give the individual whose data is processed the listed information no later than the time of collection. That information includes the defined purposes for which the data is to be processed. It includes the recipients to whom the data is likely to be disclosed. It includes the period of preservation of the processed data. It includes the possibility of any transfer of the data to a third country.

Article 39 lets an individual whose data is processed ask the data controller for confirmation that the individual's data is or is not being processed. Article 39 also lets the individual ask for disclosure of the data and any available information about its origin. Article 40 entitles an individual, for legitimate reasons, to object to the processing of the individual's personal data.

Article 40 also gives the individual an express right to object, free of charge, to disclosure to a third party or use on a third party's behalf for prospecting. Under Article 41 an individual may ask the data controller to have inaccurate, incomplete, questionable, outdated or prohibited data rectified, supplemented, updated, blocked or destroyed, as appropriate.