UNDERSTANDING PERSONAL DATA PROTECTION IN BURKINA FASO
🔎 Everything you need to know about the CIL, personal data laws in Burkina Faso and the rights of citizens and dangers for companies.
Introduction
Declaring your personal data processing to the Commission de l’informatique et des libertés (“CIL“) is mandatory in Burkina Faso if your start-up processes personal data.
Law n°001-2021/AN on the protection of individuals with regard to the processing of personal data dated March 30, 2021 (the ”
Law n°001-2021
“ ) imposes obligations on you when you process personal or sensitive data. Its purpose is to protect the fundamental rights and freedoms of individuals with regard to the processing of their personal data.
What is personal data processing? Which form to fill in? What are my other obligations as a start-up under this
Law n°001-2021
? If you don’t know how to answer these questions, this article will considerably broaden your knowledge on the subject.
To whom does Law no. 2013-450 apply?
Law n°001-2021 applies:
- automated or non-automated processing of personal data, for which the controller or processor is established in Burkina Faso or, without being established there, is subject to Burkina Faso public international law.
In other words, Law n°001-2021 applies to you if your data controller is based in Burkina Faso and processes personal data such as the names, addresses or telephone numbers of your customers. If it is not based in Burkina Faso, it may come under the jurisdiction of Burkina Faso by virtue of an international convention ratified by Burkina Faso, for example. - the data controller or processor not established in Burkina Faso, who carries out processing operations from the national territory, excluding transit data.
To whom does Law no. 2013-450 not apply?
Law n°001-2021 does not apply:
- processing carried out by a natural personexclusively forpersonal or domestic purposes;
- at temporary copies made as part of the technical transmission and provision of access to a digital network for the automatic intermediate and transient data storage at for the sole purpose of enabling other recipients of the service to make the best possible access to information, except for updating and security ;
- at data processing personal information to the for literary purposes only and artistic or journalismThis is in line with the deontological and ethical rules of these professions, security measures to ensure the confidentiality of journalistic sources, and moderation rules applicable to discussion forums set up by publishers of journalistic information.
What is personal data protection?
What is personal data under Burkinabe law?
According to Article 5 of Law no. 001-2021, personal data refers to ” any information relating to an identified or identifiable natural person, directly or indirectly, in particular by reference to an identification number, to one or more factors specific to his or her physical, physiological, genetic, mental, cultural, social or economic identity “.
This may include, for example, the following information: name, address, telephone number, e-mail address, date of birth, place of work, shopping habits, location data, etc.
How can I determine whether my startup is processing personal data in accordance with Law n°001-2021?
Under the terms of Article 5 of Law n°001-2021, processing of personal data means “. any operation or set of operations performed on personal data, whether or not by automated means, such as collection, organization, storage, adaptation, alteration, backup, copying, consultation, recording, retrieval, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, encryption, erasure or destruction. “.
You may therefore (subject to certain exceptions) be considered to be processing personal data if you carry out any of the above operations.