Data Protection in Gabon

Registration in Gabon

The is no country-wide system of registration in Gabon. However, the processing of personal data may be subject to prior notification to, or authorisation from APDPVP.

The requirement of prior authorisation is applicable in the following circumstances:

  • automatic or non-automatic processing of data regarding criminal convictions and infractions, except for processing carried out by Justice officials in the context of their obligations to ensure the security of possibly affected persons;
  • automatic processing of genetic data (except when carried out by healthcare professionals for the purpose of preventive medicine, medical diagnosis or the provision of medical care and treatment);
  • automatic processing which, considering the nature of the data or of the underlying purpose of processing, may result in excluding an individual from rights, benefits, contributions, or contract(s), without a legal or regulatory basis;
  • automatic processing aimed at interconnection by one or more entities in the context of public service aimed at different public interests, or interconnection between different entities, for different purposes;
  • processing which concerns a person's registration number in a national identification database;
  • automatic processing of data containing comments, observations, and analysis of social difficulties experienced by individuals; and
  • automatic processing of biometric data required for controlling the identity of individuals.

Article 85 of the aforementioned law states that the APDPVP shall take a decision within two months from receiving the request for authorisation. This time limit may be renewed once by a decision from the President of the APDPVP. Where theAPDPVP has not taken a decision within these time limits, the application for authorisation shall be deemed to be rejected.

Specific activities for data processing are subject to ministerial approval. These include data processing carried out on behalf of the State and aimed at State security, defence or public safety, or which is carried out for the purpose of preventing, investigating, detecting, pursuing, or executing criminal infractions is approved by the competent Government ministry(ies), subject to a prior opinion by the  APDPVP. Other matters are also approved by legislative measures, such as publicly relevant processing aimed at public census.

Other data processing operations are subject to a mere prior notification to the,APDPVP except if a complete exemption from notification or authorisation applies. Specifically, the following activities are exempt from formalities in accordance with article 89 of the aforementioned law:

  • processing operations aimed solely at forming a register which is legally intended exclusively for public information and is open to public consultation by any person with legitimate interest;
  • processing operations by any organisation, not-for-profit organisation, or any religious, political, philosophical, or trade union organisation or association – this exemption only applies if:
    • the processing operations corresponds to the formal and official purpose of said organisation / association;
    • the processing relates only to its members, and, where applicable, to people who have regular contact with the organisation / association in the context of its activity; and
    • the data is not disclosed to third parties, unless the data subject has given its / her consent;
  • processing operations for which the data controller has appointed a data protection officer ('DPO'), unless personal data is being transferred across borders.

In addition, in accordance with Article 80 of the aforementioned Protection Act,  the APDPVP may identify specific data processing operations which, due to their simplicity and low-risk level, may be subject only to a simplified notification process. This simplified process includes:

  • the purposes of the processing operations;
  • personal data or categories of personal data processed;
  • the category or categories of persons concerned;
  • the addressees or categories of addressees to whom personal data are communicated; and
  • the data retention periods.

Continue reading

  • no results

Previous topic
Back to top