Equatorial Guinea

Article 2 applies the Law to the personal data of any citizen recorded on any medium, in both the public and the private sector. It applies when the processing is carried out or used by means located in the national territory, or when Equatoguinean law applies to a controller not established in the country.

Article 6 allows only personal data that is adequate, accurate, truthful, pertinent, complete and not excessive for determined, explicit and legitimate purposes to be collected for processing, and prohibits obtaining it by fraudulent or unlawful means. Article 7 bars keeping personal data in a form that identifies the data subject for longer than the purposes for which it was collected or recorded require.

Article 8 requires processing carried out on behalf of third parties to be governed by a written contract, signed by the parties, stating that the processor will process the data only on the controller's instructions. Article 10 requires the clear, undeniable and unquestionable consent of the data subject for the processing of personal data, subject to listed exceptions for administrative activity, contracts and public-service sources.

Article 10 lets that consent be revoked for a justified reason, without retroactive effect. Article 11 requires the file controller and any processors to adopt the technical and organizational measures needed to keep personal data secure, preventing its alteration, loss, or unauthorized processing or access. Article 12 binds the controller, the processor and everyone involved in processing to professional secrecy and confidentiality at all times.

Article 17 lets private persons create personal data files by obtaining the corresponding administrative concession or authorization from the competent body. Article 20 requires the project of any private file to be notified beforehand to the Órgano Rector de Protección de Datos Personales. Article 39 classes as a minor infraction the failure to request the registration of a personal data file in the General Data Protection Register.

The transitional provision gives personal data files that exist when the Law enters into force six months to comply with it. The Law's own final provision ties commencement to twenty days after its publication in the Official Gazette, and no source stating the day of that publication has been located. The Law is dated at Malabo on 22 July 2016.

Article 27 bars personal data that has been processed, or obtained for processing, from being communicated, assigned or transferred to countries that do not provide a level of legal protection comparable to the Law's, unless the Órgano Rector de Protección de Datos Personales gives its prior authorization. Article 27 provides that the level of protection of the destination country is assessed in light of all the circumstances of the transfer and the category of data requested.

Article 28 exempts transfers resulting from treaties or conventions to which Equatorial Guinea is a party, transfers to which the data subject has given unequivocal consent, transfers for international judicial assistance or for medical prevention, diagnosis or care, transfers necessary or legally required for a public interest, money transfers under specific legislation, transfers made from a public register at the request of a person with a legitimate interest, and transfers necessary for a contract in the data subject's interest.

Article 9 requires the persons from whom personal data is requested to be informed beforehand, expressly, concisely and without ambiguity, when the data is requested. They must be told the purpose and consequences of the collection, the destination of the data and its recipients, whether answering is mandatory or optional, the effects of refusing, the existence of files or processing, and the identity and address of the controller or its representative.

Article 13(a) provides that, within a period of twelve months, the data subject may request and obtain free of charge, by consultation or in writing, a copy of the information on their personal data under processing, the origin of that data and the communications made or planned. Article 13(d) lets the data subject rectify and request the cancellation of inaccurate or incomplete personal data, and obliges the controller to give effect to the request within fifteen days from its date.

Article 13(e) gives data subjects the right to compensation for the damage or injury the controller or processor causes them, enforceable before the ordinary jurisdiction for privately held files. Article 14 lets the controllers of files held for police or tax purposes deny the rights of access, rectification, objection or cancellation.

Article 22 gives data subjects a free right to have their personal data excluded from publicly accessible sources or advertising activity, a matter to be resolved within five days of receiving the complaint or request. Article 24 requires a provider of credit-information services that records payment-default data to notify the data subject, within fifteen days, of the data included in its files and to inform them of the right to obtain information on all of it.

Article 24 also gives data subjects the right to object to the processing of their personal data in those services, which must be cancelled and removed from processing on their simple, free request.

Article 13(b) gives the data subject the right to obtain from the file controller information on the criteria used to assess their personal data and behavior and on the program used in processing, and to challenge any administrative act or decision that implies an assessment of their conduct, characteristics or personality.

Article 15 names the Órgano Rector de los Datos Personales, to be created by decree, as the body that protects the rights derived from personal data protection. Article 16 gives every person the right to bring actions before the courts of the ordinary jurisdiction against those who violate the Law or deny them a right. Article 35 assigns the power to sanction under the Law to the Ministry of Telecommunications and New Technologies, within its functions, against any infringer.

Article 35 gives the Órgano Rector de Protección de Datos Personales a sanctioning power of its own within its competences. Article 35 allows an appeal (Recurso de Alzada) against the Minister's sanctioning resolutions to the Council of Ministers within thirty days from notification. Article 36 requires file controllers and those responsible for processing to attend the inspecting officials and give them due collaboration in their functions.

Article 38 classifies infractions as minor, serious and very serious. Article 42 sets fines of 200,000 to 500,000 FCFA for a minor infraction, 500,001 to 5,000,000 FCFA for a serious one, and 5,000,001 to 15,000,000 FCFA for a very serious one, alongside non-monetary sanctions such as suspension of a file's processing, sealing of premises, seizure of equipment, permanent closure of premises, disqualification and cancellation of a file's registration.

Article 42 lets the sanctioning body, in serious and very serious cases, require the controllers of public or private files to stop the unlawful use, communication, assignment or transfer of the data.

Article 10 allows personal data relating to race, tribe or ethnicity, health, sex life, or religious, political or union creed to be obtained or processed only with the data subject's express written consent, except in files specially established for that purpose and linked to political parties, religious confessions, trade unions and similar associations or foundations.

Article 10 allows personal data on the commission of criminal or administrative offences to be included only in the files of the competent bodies of the General State Administration, in the cases their governing rules provide. Article 10 permits processing where necessary for medical prevention or diagnosis, healthcare or medical treatment, or the management of health services, provided a health professional bound by professional secrecy carries it out.

Article 10 also permits that processing where necessary to safeguard the vital interest of the data subject or another person who is physically or legally unable to consent. Article 41 classes as a very serious infraction processing or transferring data on freedom of conscience, political affiliation or ideology, health, sex life, race, tribe or ethnicity, or religion without the data subject's express written consent.

Annex VII Article 8 gives an author the exclusive right to reproduce, translate, adapt, distribute, and publicly perform a work.

Article 15 carves out a free-use exception for informational purposes: without the author's authorisation or any payment, but subject to crediting the source and the author's name where the source states it, any person may reproduce by print or audiovisual press an economic, political, or religious article published in a newspaper or periodical, or a broadcast work of the same character, in any case where the right of reproduction, broadcast, or communication to the public has not been expressly reserved; reproduce or make accessible, for reporting a current event, a work seen or heard in the course of that event, to the extent the informational purpose justifies; and reproduce by print or audiovisual press a political speech, lecture, address, or sermon delivered in public, or courtroom pleadings, for informational purposes, unless the author has expressly reserved the right.

Authors retain the right to publish a collection of such works. Equatorial Guinea is a signatory government named in the 2015 Act and an OAPI member state, so Annex VII applies to it directly as the Organization's uniform copyright law.