Personal Data Protection Law, supervisory authority and sanctions

Article 45 creates the Commission de l'informatique et des libertés (CIL) as an independent administrative authority with administrative and management autonomy, charged with policing the use of information and communication technologies in personal data processing.

Article 46 sets the CIL's composition at nine members drawn from the Conseil d'Etat, the Cour de Cassation, the National Assembly, human-rights associations, information-technology professional associations, and the President of Faso.

Articles 47 to 55 fix the members' five-year renewable mandate, their irremovability except on listed grounds, the President's status and permanent duties, incompatibilities with government office or a technology-industry role, an oath before the Ouagadougou Court of Appeal, their functional immunity, and the CIL's budget and financing rules, including a bar on borrowed funds.

Article 56 lists the CIL's attributions, including issuing individual and regulatory decisions and sector recommendations, ordering exceptional security measures, warning offenders and referring infractions to the public prosecutor, receiving complaints and petitions, authorizing foreign transfers, and advising public authorities and the government.

Article 57 lets the CIL send members, agents or experts to verify and control any processing on site, and Article 58 bars anyone the CIL is investigating from obstructing its action. Article 61 requires the CIL to submit an annual public report on its mission to the President of Faso and the President of the National Assembly.

Article 63 lists the CIL's administrative sanctions: a warning, a formal notice, an order to stop the processing, the locking of certain data, a forfeitary fine, and withdrawal of authorization. Article 65 sets that forfeitary fine at one percent of the controller's tax-exclusive turnover for the last closed financial year on a first violation, rising to five percent on a repeat violation, proportioned to the gravity of the breach and the advantage gained from it.

Article 66 lets the CIL's president or a person whose rights are violated seek urgent court relief for a serious and immediate violation, and lets a data subject or their representative seek damages for the moral or material harm suffered.

Articles 67 to 75 set a schedule of fixed-range fines for specific violations, running from one million to one hundred million francs CFA depending on the violation, including a reduced fine for an unauthorized disclosure caused by imprudence or negligence, though the act's own text does not state how this fixed-range schedule relates to the Article 65 percentage formula.

Article 76 lets the CIL confiscate or order the erasure of the data's physical media and bar a sanctioned controller from managing any processing for up to two years, and Article 77 lets it order publication of its decision at the offender's expense. Article 79 refers violations of the act to the Penal Code's own provisions on information-technology and communications-technology offenses.