Data Protection Act 2004 (the "MU DPA") was enacted for the protection of the privacy rights of individuals in response to the developments in the techniques used to capture, transmit, manipulate, record or store data relating to individuals. The MU DPA came into operation in February 2009. Data Protection Regulations were issued in 2009 by the Data Protection Office. It also is responsible for ensuring compliance with the Data Protection Act and bringing enforcement actions.
DEFINITION OF PERSONAL DATA
"Personal data" means –
- data which relate to an individual who can be identified from those data; or
- data or other information, including an opinion forming part of a database, whether or not recorded in a material form, about an individual whose identity is apparent or can reasonably be ascertained from the data, information or opinion.
DEFINITION OF SENSITIVE PERSONAL DATA
"Sensitive personal data" means personal information concerning a data subject that include information as to:
- the racial or ethnic origin;
- political opinion or adherence;
- religious belief or other belief of a similar nature;
- membership to a trade union;
- physical or mental health;
- sexual preferences or practices;
- the commission or alleged commission of an offence; or
- any proceedings for an offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.
NATIONAL DATA PROTECTION AUTHORITY
Every data controller (and, in principle every data processor) must:
- apply for registration in writing to the Commissioner; and
- together with the application, provide the particulars specified, in the case of a data controller, in section 35 of the MU DPA and, in the case of a data processor, in section 35A of the MU DPA.
Subject to Part VII of the MU DPA (which sets out sections of the MU DPA to which data controllers are exempt from), the MU DPA shall apply to a data controller
- who is established in Mauritius and processes data in the context of that establishment; and
- who is not established in Mauritius but uses equipment in Mauritius for processing data, other than for the purpose of transit through Mauritius.
A data controller, who is not established in Mauritius, shall nominate for the purposes of this Act, a representative established in Mauritius.
A Controller will be treated as being established in Mauritius if:
- they are ordinarily resident in Mauritius; or
- they carry out data processing activities through an office, branch or agency in Mauritius.
An application for registration as a data controller must contain: (i) a description of the personal data being, or to be, processed by or on behalf of the data controller; (ii) the category of data subjects to which the personal data relates; (iii) specify whether or not he holds or is likely to hold sensitive personal data; (iv) a description of the purpose for which the personal data is being or is to be processed; and (v) a description of the recipient(s) to whom the data controller intends, or may wish, to disclose the personal data.
The MU DPA also requires that data processors be registered with the Data Protection Office. However, the relevant regulations setting out the procedure to be followed for such registration have not been issued. Thus, for the time being, in practice, data processors do not need to be registered for the time being.
Where any data controller or data processor intends to keep or process personal data or sensitive personal data for two or more purposes, it must apply a separate registration form for each purpose.
The Commissioner shall grant an application for registration, unless he reasonably believes that:
- the particulars proposed for inclusion in an entry in the register are insufficient or any other information required by the Commissioner either has not been furnished, or is insufficient;
- appropriate safeguards for the protection of the privacy of the data subjects concerned are not being, or will not continue to be, provided by the data controller; or
- the person applying for registration is not a fit and proper person.
DATA PROTECTION OFFICERS
There is no formal requirement for organisations to appoint a data protection officer in Mauritius.
However, in practice, for the purposes of registration of a data controller with the data protection office, a compliance person will need to be designated for every organisation.
COLLECTION AND PROCESSING
Data controllers may collect and process personal data when any of the following conditions are met:
- the data subject consents;
- the data controller needs to process the data to enter into or carry out a contract to which the data subject is a party;
- processing of data is required for the performance of a contract to which the data subject is a party; or in order to take steps required by the data subject prior to entering into a contract;
- the processing protects the data subject's vital interests;
- the processing is required for compliance with any legal obligation to which the data controller is subject;
- processing is needed for the administration of justice; or
- processing is needed in the public interest.
The conditions for processing of sensitive personal data include most of the above conditions, but contain an additional list of more stringent conditions that must also be satisfied, such as compliance with a legal obligation to which the data controller is subject; processing that does not involve the disclosure of the personal data to a third party unless the consent of the data subject has been obtained; or where the processing is required by law.
Whichever of the above conditions is relied upon, the data controller must provide the data subject with "fair processing information" notice. This includes the identity of the data controller, the purposes of processing and any other information needed under the circumstances to ensure that the processing is fair and lawful.
Personal data must not be transferred to a third country, unless that country ensures an adequate level of protection for the rights of data subjects in relation to the processing of personal data. Adequacy of the level of protection of a country is assessed by considering all the circumstances surrounding the transfer, in particular the nature of the data, purpose and duration of the proposed processing, country of origin and country of final destination, rules of law, both general and sectorial in force in the country in question and any relevant codes of conduct or other rules and security measures which are complied with in that country.
However, personal data transfers to third countries are permissible if:
- the data subject consents;
- the transfer is necessary;
- for the performance of or for entering into a contract between the data subject and the data controller;
- for the conclusion of or performance of a contract between the data controller and a third party if the contract serves the data subject's interests; or
- in the public interest, to safeguard public security or national security.
- the transfer is made on such terms as may be approved by the Commissioner as ensuring the adequate safeguards for the protection of the rights of the data subject.
In all cases, a data controller cannot transfer personal data to another country, except with the written authorisation of the Commissioner.
Data controllers must take appropriate security and organisational measures for the prevention of unauthorised access to, alteration of, disclosure of, accidental loss, and destruction of personal data. The measures must ensure a level of security appropriate to the nature of the personal data and the harm which might result from the unauthorised access to, alteration of, disclosure of, destruction of the data and its accidental loss.
Where a data controller is using the services of a data processor, he must choose a data processor providing sufficient guarantees regarding security and organisational measures.
In determining the appropriate security measures, in particular, where the processing involves the transmission of data over an information and communication network, a data controller must have regard to (a) the state of technological development available; (b) the cost of implementing any of the security measures; (c) the special risks that exist in the processing of the data; and (d) the nature of the data being processed.
The MU DPA provides for an option to make a complaint to the Commissioner in cases of actual or potential contraventions of the MU DPA or of its regulations. However, there is no mandatory requirement in the MU DPA to report data security breaches or losses to the Data Protection Office or to data subjects.
The guidelines issued by the Data Protection Office however provide that if a privacy breach creates a risk of harm to the individual, those affected should be notified so as to mitigate the damage caused or likely to be caused by such harm.
The Commissioner is responsible for the enforcement of the MU DPA.
In cases where the Commissioner is of opinion that a data controller or a data processor has contravened, is contravening or is about to contravene the MU DPA, the Commissioner may serve an enforcement notice on the data controller or the data processor requiring him to take such steps within such time as may be specified in the notice.
The Commissioner can apply to a Judge in Chambers for an order for the expeditious preservation of data ("preservation order") where he has reasonable grounds to believe that such data is vulnerable to loss or modification.
The Commissioner can also carry out prior security checks in relation to processing of data, and periodic audits of the systems of data controllers to ensure compliance with data protection principles specified under the First Schedule of the MU DPA. It must be noted that on completion of an investigation under the MU DPA, the Commissioner must, where the investigation reveals that an offense has been committed under the MU DPA or the Regulations, refer the matter to the Police.
A data controller who knowingly supplies false information in relation to particulars furnished (further to his registration with the Data Protection Office) commits an offence and will, on conviction, be liable to a fine not exceeding Rs. 100,000 and to imprisonment for a term of up to 2 years.
If a data controller or data processor does not comply with an enforcement notice (as provided for under the MU DPA) he may be liable for a fine of up to Rs. 50,000 and to imprisonment for a term of up to 2 years.
The MU DPA provides that any person who contravenes the MU DPA commits an offence. Where no specific penalty (e.g. in cases of unlawful disclosure of data) is provided for an offense, the person will on conviction, be liable for a fine of up to Rs. 200,000 and to imprisonment for a term of up to 5 years.
In addition to any penalty, the Court may (a) order the forfeiture of any equipment or any article used or connected in any way with the commission an offense; (b) order or prohibit any act to stop a continuing contravention.
The MU DPA will apply to most electronic marketing activities, as there is likely to be processing and use of personal data involved (e.g. an email address is likely to be "personal data" for the purposes of the MU DPA). The MU DPA does not prohibit the use of personal data for the purposes of electronic marketing, but provides individuals with the right to prevent the processing of their personal data (e.g. a right to "opt out") for use of their personal data for direct marketing purposes.
A person may, at any time, by notice in writing, ask a data controller to cease, or not to begin, the processing of personal data for the purposes of direct marketing. Where the data controller receives such a request, it must, as soon as reasonably practicable and in any event not more than 28 days after the request has been received:
- erase the data at locations where the personal data are kept only for purposes of direct marketing; and
- where the data are kept for direct marketing and another purpose, stop processing the data for direct marketing.
ONLINE PRIVACY (INCLUDING COOKIES AND LOCATION DATA)
Mauritius law does not contain special provisions relating to online privacy.
Whilst Mauritius law does not contain special provisions relating to online privacy, please find set out below guidelines that have been issued by the Commissioner in relation thereto.
Part IV of the MU DPA sets out the obligations to collect personal data in a responsible way by imposing through section 22, the duty to inform the user/s of the identity of the data controller, the purposes for which the data are being collected, the intended recipients or beneficiaries of the data, whether the express consent of the user/s is/are required for the collection and the right of the user/s to access the data, amongst others. Section 27 further provides for the duty of the data controller to cater for appropriate security and organisational measures in order to protect the processing or collection of the data.
Pursuant to the general obligations provided under the MU DPA, the user should be informed when a cookie is intended to be received, stored or sent by the internet software. The message should specify, in clear terms, which personal information is intended to be stored in the cookie, for what purpose as well as the period of validity of the cookie.
On establishing a connection with a web server (sending a request or receiving a web page), the user must be informed which information is intended to be transferred and for what purposes. Hyperlinks are also sent by a website to a user, and the user's browser should be able to reveal them all to the user.
The MU DPA is also applicable when behavioural advertising is based on the use of identifiers that enable the creation of very detailed user profiles which, in most cases, are personal data.
Ad network providers should create prior opt-in mechanisms. Mechanisms to deliver informed, valid consent should require an affirmative action by the data subject indicating his/her willingness to receive cookies and the subsequent monitoring of his/her surfing behaviour for the purposes of sending him/her tailored advertising.
A user's acceptance to receive a cookie could also entail his/her acceptance for the subsequent readings of the cookie, and hence for the monitoring of his/ her internet browsing. It would not be necessary to request consent for each reading of the cookie.
However, to ensure that data subjects remain aware of the monitoring over time, ad network providers should:
- limit in time the scope of the express consent;
- offer the possibility to easily revoke their consent to being monitored for the purposes of serving behavioural advertising; and
- create a symbol or other tools which should be visible in all the web sites where the monitoring takes place (the website partners of the ad network provider). This symbol would not only remind individuals of the monitoring but also help them to control whether they want to continue being monitored or wish to revoke their consent.
Network providers should ensure compliance with the purpose limitation principle and security obligations. Ad network providers should implement retention policies which ensure that information collected each time that a cookie is read is automatically deleted after a justified period of time necessary for the purposes of the processing.
Ad network providers are bound by the obligations of data controllers insofar as they place cookies and/or retrieve information from cookies already stored in the data subjects' terminal equipment and determine the purposes and the essential means of the processing of data. Ad network providers have complete control over the purposes and means of the processing.
Publishers will be joint controllers if they collect and transmit personal data regarding their visitors such as name, address, age, location, etc to the ad network provider. To the extent that publishers act as data controllers or processors, they are bound by the obligations arising under the MU DPA regarding the part of the data processing under their control.
Social Networking Site ("SNS") providers and third party application providers are typically data controllers with corresponding responsibilities towards users. Section 54 of the MU DPA on 'Domestic purposes" will apply to SNS such that personal data processed by an individual for his personal, family or household affairs or for recreational purposes would be exempt from certain provisions of the Act. The dissemination and use of information available on SNS for other secondary, unintended purposes is of key concern to the Data Protection Office. Robust security and privacy-friendly default settings are advocated throughout the guide as the ideal starting point with regard to all services on offer.
The express consent of the user must be sought for all use/s of his/her data including profile enrichment exercises. Opt-outs facilities must be provided by search engines and requests from users to update/refresh caches must be complied with.
Search engines may only process personal data for lawful and necessary purposes and the amount of data has to be relevant and not excessive in respect to the various purposes to be achieved.
Search engine providers must delete or anonymise personal data in an irreversible manner once they are no longer necessary for the purpose for which they were collected.
© DLA Piper
This publication is intended as a general overview and discussion of the subjects dealt with. It is not intended to be, and should not used as, a substitute for taking legal advice in any specific situation. DLA Piper Australia will accept no responsibility for any actions taken or not taken on the basis of this publication.
DLA Piper Australia is part of DLA Piper, a global law firm, operating through various separate and distinct legal entities. For further information, please refer to www.dlapiper.com