Mauritius: Data Protection Laws of the World Handbook: Second Edition - Mauritius

E-Commerce And Privacy Alert

LAW

Data Protection Act 2004 (the "MU DPA") was enacted for the protection of the privacy rights of individuals in response to the developments in the techniques used to capture, transmit, manipulate, record or store data relating to individuals. The MU DPA came into operation in February 2009. Data Protection Regulations were issued in 2009 by the Data Protection Office. It also is responsible for ensuring compliance with the Data Protection Act and bringing enforcement actions.

DEFINITION OF PERSONAL DATA

"Personal data" means –

  1. data which relate to an individual who can be identified from those data; or
  2. data or other information, including an opinion forming part of a database, whether or not recorded in a material form, about an individual whose identity is apparent or can reasonably be ascertained from the data, information or opinion.

DEFINITION OF SENSITIVE PERSONAL DATA

"Sensitive personal data" means personal information concerning a data subject that include information as to:

  • the racial or ethnic origin;
  • political opinion or adherence;
  • religious belief or other belief of a similar nature;
  • membership to a trade union;
  • physical or mental health;
  • sexual preferences or practices;
  • the commission or alleged commission of an offence; or
  • any proceedings for an offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.

NATIONAL DATA PROTECTION AUTHORITY

REGISTRATION

Every data controller (and, in principle every data processor) must:

  • apply for registration in writing to the Commissioner; and
  • together with the application, provide the particulars specified, in the case of a data controller, in section 35 of the MU DPA and, in the case of a data processor, in section 35A of the MU DPA.

Subject to Part VII of the MU DPA (which sets out sections of the MU DPA to which data controllers are exempt from), the MU DPA shall apply to a data controller

  • who is established in Mauritius and processes data in the context of that establishment; and
  • who is not established in Mauritius but uses equipment in Mauritius for processing data, other than for the purpose of transit through Mauritius.

A data controller, who is not established in Mauritius, shall nominate for the purposes of this Act, a representative established in Mauritius.

A Controller will be treated as being established in Mauritius if:

  • they are ordinarily resident in Mauritius; or
  • they carry out data processing activities through an office, branch or agency in Mauritius.

An application for registration as a data controller must contain: (i) a description of the personal data being, or to be, processed by or on behalf of the data controller; (ii) the category of data subjects to which the personal data relates; (iii) specify whether or not he holds or is likely to hold sensitive personal data; (iv) a description of the purpose for which the personal data is being or is to be processed; and (v) a description of the recipient(s) to whom the data controller intends, or may wish, to disclose the personal data.

The MU DPA also requires that data processors be registered with the Data Protection Office. However, the relevant regulations setting out the procedure to be followed for such registration have not been issued. Thus, for the time being, in practice, data processors do not need to be registered for the time being.

Where any data controller or data processor intends to keep or process personal data or sensitive personal data for two or more purposes, it must apply a separate registration form for each purpose.

The Commissioner shall grant an application for registration, unless he reasonably believes that:

  • the particulars proposed for inclusion in an entry in the register are insufficient or any other information required by the Commissioner either has not been furnished, or is insufficient;
  • appropriate safeguards for the protection of the privacy of the data subjects concerned are not being, or will not continue to be, provided by the data controller; or
  • the person applying for registration is not a fit and proper person.

DATA PROTECTION OFFICERS

There is no formal requirement for organisations to appoint a data protection officer in Mauritius.

However, in practice, for the purposes of registration of a data controller with the data protection office, a compliance person will need to be designated for every organisation.

COLLECTION AND PROCESSING

Data controllers may collect and process personal data when any of the following conditions are met:

  • the data subject consents;
  • the data controller needs to process the data to enter into or carry out a contract to which the data subject is a party;
  • processing of data is required for the performance of a contract to which the data subject is a party; or in order to take steps required by the data subject prior to entering into a contract;
  • the processing protects the data subject's vital interests;
  • the processing is required for compliance with any legal obligation to which the data controller is subject;
  • processing is needed for the administration of justice; or
  • processing is needed in the public interest.

The conditions for processing of sensitive personal data include most of the above conditions, but contain an additional list of more stringent conditions that must also be satisfied, such as compliance with a legal obligation to which the data controller is subject; processing that does not involve the disclosure of the personal data to a third party unless the consent of the data subject has been obtained; or where the processing is required by law.

Whichever of the above conditions is relied upon, the data controller must provide the data subject with "fair processing information" notice. This includes the identity of the data controller, the purposes of processing and any other information needed under the circumstances to ensure that the processing is fair and lawful.

TRANSFER

Personal data must not be transferred to a third country, unless that country ensures an adequate level of protection for the rights of data subjects in relation to the processing of personal data. Adequacy of the level of protection of a country is assessed by considering all the circumstances surrounding the transfer, in particular the nature of the data, purpose and duration of the proposed processing, country of origin and country of final destination, rules of law, both general and sectorial in force in the country in question and any relevant codes of conduct or other rules and security measures which are complied with in that country.

However, personal data transfers to third countries are permissible if:

  • the data subject consents;
  • the transfer is necessary;
    • for the performance of or for entering into a contract between the data subject and the data controller;
    • for the conclusion of or performance of a contract between the data controller and a third party if the contract serves the data subject's interests; or
    • in the public interest, to safeguard public security or national security.
  • the transfer is made on such terms as may be approved by the Commissioner as ensuring the adequate safeguards for the protection of the rights of the data subject.

In all cases, a data controller cannot transfer personal data to another country, except with the written authorisation of the Commissioner.

SECURITY

Data controllers must take appropriate security and organisational measures for the prevention of unauthorised access to, alteration of, disclosure of, accidental loss, and destruction of personal data. The measures must ensure a level of security appropriate to the nature of the personal data and the harm which might result from the unauthorised access to, alteration of, disclosure of, destruction of the data and its accidental loss.

Where a data controller is using the services of a data processor, he must choose a data processor providing sufficient guarantees regarding security and organisational measures.

In determining the appropriate security measures, in particular, where the processing involves the transmission of data over an information and communication network, a data controller must have regard to (a) the state of technological development available; (b) the cost of implementing any of the security measures; (c) the special risks that exist in the processing of the data; and (d) the nature of the data being processed.

BREACH NOTIFICATION

The MU DPA provides for an option to make a complaint to the Commissioner in cases of actual or potential contraventions of the MU DPA or of its regulations. However, there is no mandatory requirement in the MU DPA to report data security breaches or losses to the Data Protection Office or to data subjects.

The guidelines issued by the Data Protection Office however provide that if a privacy breach creates a risk of harm to the individual, those affected should be notified so as to mitigate the damage caused or likely to be caused by such harm.

ENFORCEMENT

The Commissioner is responsible for the enforcement of the MU DPA.

In cases where the Commissioner is of opinion that a data controller or a data processor has contravened, is contravening or is about to contravene the MU DPA, the Commissioner may serve an enforcement notice on the data controller or the data processor requiring him to take such steps within such time as may be specified in the notice.

The Commissioner can apply to a Judge in Chambers for an order for the expeditious preservation of data ("preservation order") where he has reasonable grounds to believe that such data is vulnerable to loss or modification.

The Commissioner can also carry out prior security checks in relation to processing of data, and periodic audits of the systems of data controllers to ensure compliance with data protection principles specified under the First Schedule of the MU DPA. It must be noted that on completion of an investigation under the MU DPA, the Commissioner must, where the investigation reveals that an offense has been committed under the MU DPA or the Regulations, refer the matter to the Police.

A data controller who knowingly supplies false information in relation to particulars furnished (further to his registration with the Data Protection Office) commits an offence and will, on conviction, be liable to a fine not exceeding Rs. 100,000 and to imprisonment for a term of up to 2 years.

If a data controller or data processor does not comply with an enforcement notice (as provided for under the MU DPA) he may be liable for a fine of up to Rs. 50,000 and to imprisonment for a term of up to 2 years.

The MU DPA provides that any person who contravenes the MU DPA commits an offence. Where no specific penalty (e.g. in cases of unlawful disclosure of data) is provided for an offense, the person will on conviction, be liable for a fine of up to Rs. 200,000 and to imprisonment for a term of up to 5 years.

In addition to any penalty, the Court may (a) order the forfeiture of any equipment or any article used or connected in any way with the commission an offense; (b) order or prohibit any act to stop a continuing contravention.

ELECTRONIC MARKETING

The MU DPA will apply to most electronic marketing activities, as there is likely to be processing and use of personal data involved (e.g. an email address is likely to be "personal data" for the purposes of the MU DPA). The MU DPA does not prohibit the use of personal data for the purposes of electronic marketing, but provides individuals with the right to prevent the processing of their personal data (e.g. a right to "opt out") for use of their personal data for direct marketing purposes.

A person may, at any time, by notice in writing, ask a data controller to cease, or not to begin, the processing of personal data for the purposes of direct marketing. Where the data controller receives such a request, it must, as soon as reasonably practicable and in any event not more than 28 days after the request has been received:

  • erase the data at locations where the personal data are kept only for purposes of direct marketing; and
  • where the data are kept for direct marketing and another purpose, stop processing the data for direct marketing.

ONLINE PRIVACY (INCLUDING COOKIES AND LOCATION DATA)

Mauritius law does not contain special provisions relating to online privacy.

Whilst Mauritius law does not contain special provisions relating to online privacy, please find set out below guidelines that have been issued by the Commissioner in relation thereto.

Part IV of the MU DPA sets out the obligations to collect personal data in a responsible way by imposing through section 22, the duty to inform the user/s of the identity of the data controller, the purposes for which the data are being collected, the intended recipients or beneficiaries of the data, whether the express consent of the user/s is/are required for the collection and the right of the user/s to access the data, amongst others. Section 27 further provides for the duty of the data controller to cater for appropriate security and organisational measures in order to protect the processing or collection of the data.

Pursuant to the general obligations provided under the MU DPA, the user should be informed when a cookie is intended to be received, stored or sent by the internet software. The message should specify, in clear terms, which personal information is intended to be stored in the cookie, for what purpose as well as the period of validity of the cookie.

On establishing a connection with a web server (sending a request or receiving a web page), the user must be informed which information is intended to be transferred and for what purposes. Hyperlinks are also sent by a website to a user, and the user's browser should be able to reveal them all to the user.

The MU DPA is also applicable when behavioural advertising is based on the use of identifiers that enable the creation of very detailed user profiles which, in most cases, are personal data.

Ad network providers should create prior opt-in mechanisms. Mechanisms to deliver informed, valid consent should require an affirmative action by the data subject indicating his/her willingness to receive cookies and the subsequent monitoring of his/her surfing behaviour for the purposes of sending him/her tailored advertising.

A user's acceptance to receive a cookie could also entail his/her acceptance for the subsequent readings of the cookie, and hence for the monitoring of his/ her internet browsing. It would not be necessary to request consent for each reading of the cookie.

However, to ensure that data subjects remain aware of the monitoring over time, ad network providers should:

  • limit in time the scope of the express consent;
  • offer the possibility to easily revoke their consent to being monitored for the purposes of serving behavioural advertising; and
  • create a symbol or other tools which should be visible in all the web sites where the monitoring takes place (the website partners of the ad network provider). This symbol would not only remind individuals of the monitoring but also help them to control whether they want to continue being monitored or wish to revoke their consent.

Network providers should ensure compliance with the purpose limitation principle and security obligations. Ad network providers should implement retention policies which ensure that information collected each time that a cookie is read is automatically deleted after a justified period of time necessary for the purposes of the processing.

Ad network providers are bound by the obligations of data controllers insofar as they place cookies and/or retrieve information from cookies already stored in the data subjects' terminal equipment and determine the purposes and the essential means of the processing of data. Ad network providers have complete control over the purposes and means of the processing.

Publishers will be joint controllers if they collect and transmit personal data regarding their visitors such as name, address, age, location, etc to the ad network provider. To the extent that publishers act as data controllers or processors, they are bound by the obligations arising under the MU DPA regarding the part of the data processing under their control.

Social Networking Site ("SNS") providers and third party application providers are typically data controllers with corresponding responsibilities towards users. Section 54 of the MU DPA on 'Domestic purposes" will apply to SNS such that personal data processed by an individual for his personal, family or household affairs or for recreational purposes would be exempt from certain provisions of the Act. The dissemination and use of information available on SNS for other secondary, unintended purposes is of key concern to the Data Protection Office. Robust security and privacy-friendly default settings are advocated throughout the guide as the ideal starting point with regard to all services on offer.

The express consent of the user must be sought for all use/s of his/her data including profile enrichment exercises. Opt-outs facilities must be provided by search engines and requests from users to update/refresh caches must be complied with.

Search engines may only process personal data for lawful and necessary purposes and the amount of data has to be relevant and not excessive in respect to the various purposes to be achieved.

Search engine providers must delete or anonymise personal data in an irreversible manner once they are no longer necessary for the purpose for which they were collected.

© DLA Piper

This publication is intended as a general overview and discussion of the subjects dealt with. It is not intended to be, and should not used as, a substitute for taking legal advice in any specific situation. DLA Piper Australia will accept no responsibility for any actions taken or not taken on the basis of this publication.


DLA Piper Australia is part of DLA Piper, a global law firm, operating through various separate and distinct legal entities. For further information, please refer to www.dlapiper.com

To print this article, all you need is to be registered on Mondaq.com.

Click to Login as an existing user or Register so you can print this article.

Authors
Similar Articles
Relevancy Powered by MondaqAI
 
In association with
Practice Guides
by Mondaq Advice Centres
Relevancy Powered by MondaqAI
Related Topics
 
Similar Articles
Relevancy Powered by MondaqAI
Related Articles
 
Up-coming Events Search
Tools
Print
Font Size:
Translation
Channels
Mondaq on Twitter
 
Mondaq Free Registration
Gain access to Mondaq global archive of over 375,000 articles covering 200 countries with a personalised News Alert and automatic login on this device.
Mondaq News Alert (some suggested topics and region)
Select Topics
Registration (please scroll down to set your data preferences)

Mondaq Ltd requires you to register and provide information that personally identifies you, including your content preferences, for three primary purposes (full details of Mondaq’s use of your personal data can be found in our Privacy and Cookies Notice):

  • To allow you to personalize the Mondaq websites you are visiting to show content ("Content") relevant to your interests.
  • To enable features such as password reminder, news alerts, email a colleague, and linking from Mondaq (and its affiliate sites) to your website.
  • To produce demographic feedback for our content providers ("Contributors") who contribute Content for free for your use.

Mondaq hopes that our registered users will support us in maintaining our free to view business model by consenting to our use of your personal data as described below.

Mondaq has a "free to view" business model. Our services are paid for by Contributors in exchange for Mondaq providing them with access to information about who accesses their content. Once personal data is transferred to our Contributors they become a data controller of this personal data. They use it to measure the response that their articles are receiving, as a form of market research. They may also use it to provide Mondaq users with information about their products and services.

Details of each Contributor to which your personal data will be transferred is clearly stated within the Content that you access. For full details of how this Contributor will use your personal data, you should review the Contributor’s own Privacy Notice.

Please indicate your preference below:

Yes, I am happy to support Mondaq in maintaining its free to view business model by agreeing to allow Mondaq to share my personal data with Contributors whose Content I access
No, I do not want Mondaq to share my personal data with Contributors

Also please let us know whether you are happy to receive communications promoting products and services offered by Mondaq:

Yes, I am happy to received promotional communications from Mondaq
No, please do not send me promotional communications from Mondaq
Terms & Conditions

Mondaq.com (the Website) is owned and managed by Mondaq Ltd (Mondaq). Mondaq grants you a non-exclusive, revocable licence to access the Website and associated services, such as the Mondaq News Alerts (Services), subject to and in consideration of your compliance with the following terms and conditions of use (Terms). Your use of the Website and/or Services constitutes your agreement to the Terms. Mondaq may terminate your use of the Website and Services if you are in breach of these Terms or if Mondaq decides to terminate the licence granted hereunder for any reason whatsoever.

Use of www.mondaq.com

To Use Mondaq.com you must be: eighteen (18) years old or over; legally capable of entering into binding contracts; and not in any way prohibited by the applicable law to enter into these Terms in the jurisdiction which you are currently located.

You may use the Website as an unregistered user, however, you are required to register as a user if you wish to read the full text of the Content or to receive the Services.

You may not modify, publish, transmit, transfer or sell, reproduce, create derivative works from, distribute, perform, link, display, or in any way exploit any of the Content, in whole or in part, except as expressly permitted in these Terms or with the prior written consent of Mondaq. You may not use electronic or other means to extract details or information from the Content. Nor shall you extract information about users or Contributors in order to offer them any services or products.

In your use of the Website and/or Services you shall: comply with all applicable laws, regulations, directives and legislations which apply to your Use of the Website and/or Services in whatever country you are physically located including without limitation any and all consumer law, export control laws and regulations; provide to us true, correct and accurate information and promptly inform us in the event that any information that you have provided to us changes or becomes inaccurate; notify Mondaq immediately of any circumstances where you have reason to believe that any Intellectual Property Rights or any other rights of any third party may have been infringed; co-operate with reasonable security or other checks or requests for information made by Mondaq from time to time; and at all times be fully liable for the breach of any of these Terms by a third party using your login details to access the Website and/or Services

however, you shall not: do anything likely to impair, interfere with or damage or cause harm or distress to any persons, or the network; do anything that will infringe any Intellectual Property Rights or other rights of Mondaq or any third party; or use the Website, Services and/or Content otherwise than in accordance with these Terms; use any trade marks or service marks of Mondaq or the Contributors, or do anything which may be seen to take unfair advantage of the reputation and goodwill of Mondaq or the Contributors, or the Website, Services and/or Content.

Mondaq reserves the right, in its sole discretion, to take any action that it deems necessary and appropriate in the event it considers that there is a breach or threatened breach of the Terms.

Mondaq’s Rights and Obligations

Unless otherwise expressly set out to the contrary, nothing in these Terms shall serve to transfer from Mondaq to you, any Intellectual Property Rights owned by and/or licensed to Mondaq and all rights, title and interest in and to such Intellectual Property Rights will remain exclusively with Mondaq and/or its licensors.

Mondaq shall use its reasonable endeavours to make the Website and Services available to you at all times, but we cannot guarantee an uninterrupted and fault free service.

Mondaq reserves the right to make changes to the services and/or the Website or part thereof, from time to time, and we may add, remove, modify and/or vary any elements of features and functionalities of the Website or the services.

Mondaq also reserves the right from time to time to monitor your Use of the Website and/or services.

Disclaimer

The Content is general information only. It is not intended to constitute legal advice or seek to be the complete and comprehensive statement of the law, nor is it intended to address your specific requirements or provide advice on which reliance should be placed. Mondaq and/or its Contributors and other suppliers make no representations about the suitability of the information contained in the Content for any purpose. All Content provided "as is" without warranty of any kind. Mondaq and/or its Contributors and other suppliers hereby exclude and disclaim all representations, warranties or guarantees with regard to the Content, including all implied warranties and conditions of merchantability, fitness for a particular purpose, title and non-infringement. To the maximum extent permitted by law, Mondaq expressly excludes all representations, warranties, obligations, and liabilities arising out of or in connection with all Content. In no event shall Mondaq and/or its respective suppliers be liable for any special, indirect or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortious action, arising out of or in connection with the use of the Content or performance of Mondaq’s Services.

General

Mondaq may alter or amend these Terms by amending them on the Website. By continuing to Use the Services and/or the Website after such amendment, you will be deemed to have accepted any amendment to these Terms.

These Terms shall be governed by and construed in accordance with the laws of England and Wales and you irrevocably submit to the exclusive jurisdiction of the courts of England and Wales to settle any dispute which may arise out of or in connection with these Terms. If you live outside the United Kingdom, English law shall apply only to the extent that English law shall not deprive you of any legal protection accorded in accordance with the law of the place where you are habitually resident ("Local Law"). In the event English law deprives you of any legal protection which is accorded to you under Local Law, then these terms shall be governed by Local Law and any dispute or claim arising out of or in connection with these Terms shall be subject to the non-exclusive jurisdiction of the courts where you are habitually resident.

You may print and keep a copy of these Terms, which form the entire agreement between you and Mondaq and supersede any other communications or advertising in respect of the Service and/or the Website.

No delay in exercising or non-exercise by you and/or Mondaq of any of its rights under or in connection with these Terms shall operate as a waiver or release of each of your or Mondaq’s right. Rather, any such waiver or release must be specifically granted in writing signed by the party granting it.

If any part of these Terms is held unenforceable, that part shall be enforced to the maximum extent permissible so as to give effect to the intent of the parties, and the Terms shall continue in full force and effect.

Mondaq shall not incur any liability to you on account of any loss or damage resulting from any delay or failure to perform all or any part of these Terms if such delay or failure is caused, in whole or in part, by events, occurrences, or causes beyond the control of Mondaq. Such events, occurrences or causes will include, without limitation, acts of God, strikes, lockouts, server and network failure, riots, acts of war, earthquakes, fire and explosions.

By clicking Register you state you have read and agree to our Terms and Conditions