Précédent 28 / 30 Next

28 appeal against decisions of the authority civil remedies Obstruction, interference with the authority Breach of confidentiality Data Protection No. 3 administrative penalty or an order to make good of profits, issued pursuant to this section commits an offence and shall, upon conviction, be liable to— (a) in the case of a natural person, a fine of k10,000,000 and to imprisonment for two years; or (b) in the case of a legal person, a fine of k50,000,000. (5) where pursuant to this section, the authority imposes an order to pay compensation or make good of profits or pay an administrative penalty on a data controller or data processor and the data controller or data processor fails to pay the compensation or penalty of make good of the profits within thirty days from the date the data controller or data processor receives the decision, the authority may recover the compensation profits or penalty as a civil debt due to the awardee of the compensation or the authority, as the case may be. Part X—MIsceLLaneOus 46.__(1) a person aggrieved by a decision of the authority under this act may, within thirty days of receiving the decision, apply to the high court for review of the decision. (2) the high court shall, upon hearing a matter brought pursuant to subsection (1)— (a) confirm, vary or set aside the decision; or (b) make any other order as the court considers fair and just. 47. notwithstanding sections 44 and 45, a data subject who suffers injury, loss or harm, as a result of a contravention of this act by a data controller or data processor, may commence legal action for a civil remedy against the data controller or data processor concerned. 48. a person who obstructs or interferes with the authority, an officer of the authority or any person authorized by the authority to carry out any function under this act in the performance of any function under this act, commits an offence and shall, upon conviction, be liable to a fine of k10,000,000 and to imprisonment for two years. 49. a person who— (a) being a member of the authority, an employee of the authority or a person authorized to perform any function under this act, publishes or communicates to any other person without lawful authority any information acquired by that person in the course of duty; or

Sélectionner le paragraphe cible3

● ● ●

The Data Protection Act 2024.

Law

Status of Law: Final/Active/Current

Country

Malawi

Country Location

Latitude: -13.235028216585723

Longitude: 33.91714876714785

Country Location (Lié Law): Malawi

Keywords

Privacy
Privacy, Data Protection and Retention

Adoption Date: 2 févr. 2024

Type of Law: Legislation

Research Category: II Fundamental Rights and Freedoms

Institution that Established this Law: Malawian Parlimanet

Institution Established by this Law: Data Protection Authority

Is this the Official Copy?: Yes

Source Name and URL: MALAWI.GOV

Notes: The Act is organized into ten distinct parts. It begins with preliminary matters, setting the stage by defining key terms such as "data controller," "data processor," "personal data," and "sensitive personal data." These definitions are crucial as they delineate the scope and applicability of the Act, ensuring that all stakeholders have a clear understanding of their responsibilities and the data subjects' rights.

The administration of the Act is designated to the Malawi Communications Regulatory Authority, identified as the Data Protection Authority. This body is endowed with broad functions and powers, from developing data protection guidelines to promoting public awareness and ensuring compliance through the ability to issue compliance orders.

One of the core elements of the Act is the set of principles governing data processing. These principles emphasize lawful, fair, and transparent processing, along with purpose limitation, ensuring that data is collected for explicit and legitimate purposes and not used in ways incompatible with those original purposes. Additionally, the principles of data minimization and accuracy dictate that only necessary data is collected and that it remains accurate and up-to-date.

The rights of data subjects are robustly protected under the Act. Individuals have the right to access their data, request corrections, and even demand the deletion of their data under certain circumstances. They can also restrict processing or object to the processing of their data, particularly in cases where the processing does not align with the data protection standards set out in the Act.

Duties of data controllers and processors are clearly outlined, focusing on compliance with the data protection principles and the secure handling of personal data. Data controllers are required to perform data protection impact assessments for processing activities that pose high risks to the rights and freedoms of individuals, emphasizing the Act's preventative approach.

Data security is another critical area addressed by the Act. It mandates controllers and processors to implement suitable technical and organizational measures to safeguard personal data. This includes obligations to notify the Data Protection Authority and affected individuals in the event of a data breach.

Cross-border data transfers are strictly regulated, prohibiting the transfer of personal data outside Malawi unless adequate protections are in place. This ensures that personal data is not subjected to jurisdictions with lax data protection standards.

Significant data controllers and processors must register with the Data Protection Authority, a measure aimed at ensuring that entities handling large volumes of data or sensitive information maintain high data protection standards.

Finally, the Act provides mechanisms for complaints and legal redress, allowing individuals to lodge complaints with the Data Protection Authority if they believe their data has been mishandled. It also outlines penalties for non-compliance, emphasizing the Act's enforceability.

Related Analysis

AU DATA POLICY FRAMEWORK

Collection

CIPIT

Date Updated: 6 mai 2024

Complete Name: Data Protection Act [Act No.3 of 2024]

Documents principaux

Data Protection Act 2024.pdf
English
Télécharger Vue

CYRILLA: Global Digital Rights Law

Sélectionner le paragraphe cible3

The Data Protection Act 2024.

Documents principaux

Notifications