African Union Legal Instrument
6.
P a g e | 23
a)
The data controller shall not transfer personal data to a non-Member State
of the African Union unless such a State ensures an adequate level of protection
of the privacy, freedoms and fundamental rights of persons whose data are being
or are likely to be processed.
b)
The previous prohibition is not applicable where, before any personal data
is transferred to the third country, the data controller shall request authorization
for such transfer from the national protection authority.
Article 15: Interconnection of personal data files
The interconnection of files laid down in Article 10.4 of this Convention should help to
achieve the legal or statutory objectives which are of legitimate interest to data
controllers. This should not lead to discrimination or limit data subjects‟ rights, freedoms
and guarantees, should be subject to appropriate security measures, and also take into
account the principle of relevance of the data which are to be interconnected.
Section IV: The Data Subjects‟ Rights
Article 16:
Right to information
The data controller shall provide the natural person whose data are to be processed with
the following information, no later than the time when the data are collected, and
regardless of the means and facilities used, with the following information:
a)
b)
c)
d)
e)
f)
g)
h)
Article 17:
His/her identity and of his/her representative, if any;
The purposes of the processing for which the data are intended;
Categories of data involved;
Recipient(s) to which the data might be disclosed;
The capacity to request to be removed from the file;
Existence of the right of access to and the right to rectify the data
concerning him/her;
Period for which data are stored;
Proposed transfers of data to third countries.
Right of access
Any natural person whose personal data are to be processed may request from the
controller, in the form of questions, the following:
a)
Such information as would enable him/her to evaluate and object to the
processing;
b)
Confirmation as to whether or not data relating to him/her are being
processed;