CHAPTER I—PRELIMINARY PROVISIONS Article 1: Name of the Law This Law shall be cited as the “Data Protection Act.” Article 2: Definitions In this Law, unless the context otherwise requires, the following words shall have their respective meaning as below: 1. “Authority” means the Data Protection Authority, as established in article 6; 2. “Binding corporate rules” means personal data protection policies and procedures adhered to by the members of a group of firms under common control with respect to the transfer of personal data among such members; 3. “Biometric data” means personal data resulting from specific technical processing relating to an individual’s body or behaviour, which allow or confirm the unique identification of that individual, including without limitation by physical measurements, facial images, blood typing, fingerprinting, retinal scanning, voice recognition and deoxyribonucleic acid (DNA) analysis; 4. “Certification mechanism” means a process by which the Authority or a third-party entity registered by the Authority confirms that personal data protection policies and procedures of data controllers or data processors comply with specified standards; 5. “Child” means an individual below eighteen years of age; 6. “Consent” means any freely given, specific, informed, and unambiguous indication, whether by a written or oral statement or an affirmative action, of an individual’s agreement; 7. “Data controller” means an individual, private entity, public authority or agency or any other body who or which, alone or together with others, determines the purposes and means of the processing of personal data; 8. “Data controller of major importance” means a data controller that is domiciled, resident or operating in the Federal Republic of Somalia and processes, or engages one or more data processors that collectively process, personal data relating to data subjects who are within the Federal Republic of Somalia; 5