Guinea

Article 3 subjects to the law every collection, processing, transmission, storage and use of personal data by a natural person, the State, local or decentralized authorities, public establishments and institutions, or private legal entities. Article 3 also reaches any processing of data carried out on the territory of the Republic of Guinea. Article 5 subjects the processing of personal data to a prior declaration to the competent Authority designated by regulation.

Under Article 5 the applicant may begin the processing on receipt of the Authority's acknowledgment, without being relieved of any of its responsibilities.

Article 7 requires the competent Authority's prior authorization for processing of genetic and medical data and related scientific research, data on offences, convictions or security measures, a national identification number or similar identifier such as a telephone number, biometric data, processing in the public interest such as for historical, statistical or scientific purposes, and a transfer envisaged to a third country.

Article 12 gives the Authority two months to accept or refuse a declaration or an authorization request, extendable by two further months where it gives reasons or justifies the extension. After those periods, under Article 12, the absence of an express answer equals implicit acceptance of the declaration or a tacit authorization granted to the applicant.

Article 18 treats processing as legitimate where the data subject gives express prior consent, with derogations where the controller is duly authorized and the processing is necessary for a legal obligation, a public-interest or official-authority mission, a contract with the data subject, or safeguarding the data subject's interest or fundamental rights and freedoms.

Article 20 requires personal data to be collected for determined, explicit and legitimate purposes and not to be processed further in a way incompatible with those purposes. Article 20 also limits retention to the period necessary for the purposes for which the data was collected or processed. Article 21 requires collected data to be accurate and, where necessary, kept up to date.

Article 24 requires a controller that has processing carried out on its behalf to choose a processor able to give guarantees for the protection and confidentiality of the data. Article 42 requires the controller to take all useful precautions, given the nature of the data, to prevent the data being distorted, damaged or reached by unauthorized third parties.

Article 44 requires the controller to draw up an annual report for the personal data protection Authority on compliance with the relevant provisions of the law. Article 63 gives controllers a maximum of one year from the date of promulgation to bring themselves into compliance. Article 65 brings the statute into force from the date of its promulgation, and its promulgation line is dated at Conakry on 28 July 2016. The statute was printed in a special issue of the Journal officiel in September 2019.

Article 1 defines a third country as any State that is not a member of ECOWAS (CEDEAO). Article 28 allows a controller to be authorized to transfer personal data to a third country only if that State ensures a level of protection of privacy and of fundamental freedoms and rights that is superior or equivalent with respect to the processing the data undergoes or may undergo.

Article 28 requires the controller, before any actual transfer to that third country, to obtain the prior authorization of the personal data protection Authority. Article 28 subjects every transfer to a third country to strict and regular control by the Authority in light of its purpose.

Article 30 requires the controller to give the data subject, at the latest at the time of collection, its identity, the purposes, the categories of data, the recipients, the possibility of refusing to appear in the file, the existence of rights of access and rectification, the retention period, and any possible transfer to a third country.

Article 31 lets a data subject ask the controller for the information needed to know and contest the processing, confirmation of whether their data is processed, communication of the data and any available information on its origin, and information on the purposes, categories of data and recipients. Article 31 lets the controller oppose manifestly abusive requests from the same data subject, and puts the burden of proving that character on the controller.

Article 32 gives a data subject the right to object, on legitimate grounds relating to their situation, to the processing of their data, except where a legal provision expressly provides for the processing. Article 32 also gives a data subject a free right to object to processing for direct marketing, and a right to be informed before their data is first communicated to third parties or used on their behalf for direct marketing, with an express free right to object to that communication or use.

Article 33 lets a person who proves their identity require the controller to rectify, complete, update, block or delete personal data that is inaccurate, incomplete, equivocal or outdated, or whose collection, use, communication or retention is prohibited. Article 35 gives a data subject the right to obtain from the controller the erasure of their data. Article 37 requires the controller to erase without delay (sans délai), except where retention is necessary.

Article 40 gives a data subject whose data is processed automatically in a structured, commonly used format the right to a copy of that data in a structured, commonly used electronic format that allows reuse. Article 54 prohibits, on pain of one to five years' imprisonment and a fine of 30,000,000 to 200,000,000 Guinean francs, direct marketing by any means of communication using the personal data of a person who has not given prior written consent to receive it or who has formally objected.

Article 27 bars a court decision that assesses a person's behavior from being founded on automated processing of personal data designed to evaluate aspects of their personality, a clause that binds courts only. Article 27 also bars an administrative or private decision that assesses human behavior from having as its sole basis an automated processing of personal data that defines the person's profile or personality.

Article 47 provides that the authority in charge of personal data protection will be created by regulation. Article 48 charges the Authority with carrying out, through sworn agents, verifications of any processing of personal data. Article 48 also charges the Authority with imposing administrative and pecuniary sanctions on controllers, and their agents, subordinates or processors, that do not comply with the law.

Article 50 lets the Authority issue a warning, or a formal notice to cease or remedy the failures found, within the period it fixes. Article 52 lets the Authority, after hearing a controller or processor that has not complied with a formal notice, withdraw an authorization provisionally or definitively, or impose a fine proportionate to the gravity of the failures and the benefits drawn from them.

Article 55 punishes with six months to three years' imprisonment and a fine of 20,000,000 to 150,000,000 Guinean francs anyone who obstructs or attempts to obstruct the Authority's action or fails to comply with its decisions and injunctions. Article 56 punishes any controller, or its processor, subordinate or agent, that does not respect the law with a fine of 50,000,000 to 150,000,000 Guinean francs.

Article 54 prohibits, on pain of criminal reclusion (réclusion criminelle) of ten to twenty years and a fine of 300,000,000 to 600,000,000 Guinean francs, collecting or processing, or attempting to collect or process, personal data revealing ethnic, racial or regional origin, filiation, political opinions, religious or philosophical convictions, trade-union membership, sex life, genetic data, or health.

The prohibition does not apply where the data has manifestly been made public by the data subject, where genetic or health data processing is necessary to safeguard the vital interests of a person unable to consent or to establish, exercise or defend a legal right, where a judicial procedure or criminal investigation is open, or in the legitimate activities of a non-profit political, philosophical, religious, mutualist or trade-union body concerning its own members.

Article 54 requires every excepted processing to be authorized and controlled, in its design and implementation, by the authority in charge of personal data protection. A legal person that commits the offence faces a fine of 150,000,000 to 800,000,000 Guinean francs.

Article 1 defines sensitive data as personal data relating to religious, philosophical, political or trade-union opinions or activities, sex life or race, health, social-order measures, prosecutions, and criminal or administrative sanctions.

Guinea's cybersecurity and personal-data protection statute, Loi n° L/2016/037/AN, punishes unauthorized access to a computer system with one to five years of imprisonment and a fine of 60,000,000 to 130,000,000 Guinean francs. It punishes hindering the operation of computer systems with three to six years of imprisonment and a fine of 100,000,000 to 500,000,000 Guinean francs.

It punishes the fraudulent interception of data with five to ten years of imprisonment and a fine of 500,000,000 to 1,000,000,000 Guinean francs. It punishes child pornography with penalties reaching up to ten years of imprisonment. The statute reaches every cybercrime offense committed on Guinean territory. It also reaches an offense whose prosecution requires the collection of electronic evidence.

Guinea's own cybersecurity agency does not itself state how unauthorized access is read for a publicly accessible, unauthenticated web page, and no Guinean court decision construing that question is reported. No separate statute or case law addressing terms-of-service enforceability, browsewrap versus clickwrap formation, or the effect of a login or a terms acceptance is reported. No commencement notice for the statute has been located.

Article 9 extends copyright to collections of works, of expressions of traditional cultural heritage, or of mere facts or data, such as encyclopaedias, anthologies and databases, whether in machine-readable or any other form, which by the selection, coordination or arrangement of their contents constitute intellectual creations. Article 22 keeps the reproduction of all or a substantial part of a database outside the private-copy exception.

The law provides no sui generis database right and no text-and-data-mining exception, so a database with no original selection, coordination or arrangement is not protected on that basis. The law enters into force from the date of its promulgation. The National Assembly adopted it on 7 June 2019. No notice stating the day of its promulgation has been located.

Article 23 permits, once a work has been lawfully disclosed, analyses and short quotations justified by the critical, polemical, pedagogical, scientific or informational character of the work into which they are incorporated. The same article permits press reviews. It also permits the reproduction and dissemination, even in full, by media or broadcast, of current political, social, economic or religious news articles for current-information purposes.

That news-article use is barred where the exploitation rights have been expressly reserved. Each of these uses is conditional on the author's name and the source being clearly indicated. The law enters into force from the date of its promulgation. It repeals Loi n° 043/APN/CP of 9 August 1980. The National Assembly adopted it on 7 June 2019. No notice stating the day of its promulgation has been located.