Page 1

24 to 31 OCTOBER 2011
FIFTY SECOND

YEAR - N ° 74

PRICE: 2,000 Francs

Legal deposit 777

OFFICIAL NEWSPAPER
OF THE GABONESE REPUBLIC

FOR SUBSCRIPTIONS AND ADS:
“DIRECTORATE OF OFFICIAL PUBLICATIONS” - ​LIBREVILLE - BP 563 - TEL. : 72.01.04
These are payable in advance, by money order or transfer in the name of the Director of “Official Publications” in Libreville
Postal current account N ° 0101 100 2534, center of Libreville.

SUMMARY
_____________________

ACTS OF THE GABONESE REPUBLIC
_____________________
________________

personal data …………………………… 511
Decree n ° 01099 / PR of 25 September 2011 on
promulgation of organic law n ° 009/2911 amending and
supplementing certain provisions of organic law n ° 9/91
of September 26, 1991 on the Constitutional Court….…. 511

PARLIAMENT
_____________
Law n ° 001/2011 relating to the protection of data
personal character ……………………………… ... …… .. 491

___________________
Organic law n ° 009/2011 of September 25, 2011 amending and
supplementing certain provisions of organic law n ° 9/91
of September 26, 1991 on the Constitutional Court….… 505
_____________

ACTS IN SHORT
__________
Declaration of constitution of associations …………… ... 511

PRESIDENCY OF THE REPUBLIC
________

Declaration of incorporation ………………… ... 512

Decree n ° 01098 / PR of September 25, 2011 on
promulgation of law n ° 001/2011 relating to the protection of

__________________________________________________
__________________________________________________

Page 2
24 to 31 OCTOBER 2011 - N ° 74

OFFICIAL JOURNAL OF THE GABONESE REPUBLIC

491

significant economic or financial interest of the State, under
subject to the exemptions defined by this law and the
specific provisions in this area laid down by other laws.

ACTS OF THE GABONESE REPUBLIC
_____________
PARLIAMENT
________

Article 5 : This law does not apply:
- data processing implemented by a
natural person within the exclusive framework of its activities
personal or domestic, provided, however, that the
data are not intended for communication
systematic to third parties or to distribution;
- temporary copies made as part of the activities
techniques of transmission and provision of access to a
digital network, for automatic storage,
intermediate and transient data and for the sole purpose of
allow other recipients of the service the best access
possible to the information transmitted.

Law n ° 001/2011 relating to the protection of data
personal character
THE NATIONAL ASSEMBLY AND THE SENATE HAVE
DELIBERATE AND ADOPTED;
THE PRESIDENT OF THE REPUBLIC, HEAD OF
THE STATE, PROMULATES THE LAW OF WHICH
CONTENT FOLLOWS:
Article 1 st : This law, adopted under
Articles 1 st and 47 of the Constitution, determines
the rules relating to the processing of personal data
personal and aims to set up a system
to fight against privacy breaches
likely to be generated by the collection, processing,
transmission, storage and use of personal data
staff.

Section II: Definitions
Article 6 : We mean by:
- Biometrics: The mathematical analysis of characteristics
biological data of a person intended to determine
identity irrefutably. Biometrics is based on
principle of recognition of physical characteristics
including fingerprints, iris, retina, hand,
voice prints and deoxyribonucleic acid
(DNA) which provide irrefutable proof of the identity of a
person since they are a characteristic
unique biological that distinguishes one person from another and
can only be associated with one and only one person;
- Code of conduct: any set of rules, in particular
the user charters, drawn up by the person in charge of
treatment, in order to establish a correct use of resources
IT, Internet and communications
of the structure concerned and approved by the
National Commission for Data Protection at
personal character;
- Electronic communications: broadcasts,
transmissions or receptions of signs, signals, writings,
of images or sounds, by electronic or magnetic means;
- Consent of the person concerned: any
express, unequivocal, free manifestation of will,
specific and informed by which the data subject or
his legal, judicial or contractual representative, accepts
that his personal data are subject to a
manual or electronic processing;
- Temporary copies: data temporarily copied into
a dedicated space, for a limited period of time, to
the operational requirements of the processing software;
- Recipient of personal data processing
staff: any person authorized to receive
communication of these data other than the person
concerned, the controller, the processor and
the persons who, by reason of their functions, are responsible
to process the data;
- Personal data: any related information
to an identified or identifiable natural person
directly or indirectly, by reference to a number
identification or to one or more elements, specific to its
physical, physiological, genetic, psychic identity,
cultural, social or economic;
- Data in the field of health: any information
concerning the physical and mental state of a person
concerned, including the genetic data referred to in point
2 of this article;

Chapter I: General provisions and definitions
Section I: Principles
Article 2 : This law applies to processing
automated or not personal data
contained or intended to appear in files, with the exception of
of the treatments implemented for the exercise of activities
exclusively personal, when their manager fulfills
the conditions provided for in article 4 of this law.
Article 3 : Information and communication technologies
communication must be at the service of every citizen.
Their development must take place within the framework of
international cooperation, within the limits of agreements in
force. They must not undermine the identity
human rights, human rights, privacy, or
individual or public freedoms.
Article 4 : The following are subject to this law:
- any collection, any processing, any transmission, any
storage and any use of personal data
personal by a natural person, by persons
public law or private law;
- any automated or non-automated processing of the data contained
or called to appear in a file, with the exception of
treatments mentioned in article 5 of this law;
- any processing carried out by a manager such as
defined in article 6 of this law on Gabonese territory
or in any place where Gabonese law applies;
- any processing carried out by a manager, established or
not on Gabonese territory, which resorts to means of
treatment located on Gabonese territory, excluding
means that are used only for transit purposes on this
territory. In the cases referred to in point 3 above, the
controller must appoint a representative
established on Gabonese territory, without prejudice to actions which
can be brought against him;
- any processing of data concerning security
public, defense, research and prosecution
criminal offenses or the security of the State, even linked to a

Page 3
492

OFFICIAL JOURNAL OF THE GABONESE REPUBLIC 24 to 31 OCTOBER 2011 - N ° 74

- Sensitive data: all personal data
personnel relating to religious opinions or activities,
philosophical, political, union, sex life,
race, health, social measures, prosecution,
criminal or administrative sanctions;
- Personal data file: all together
structured data accessible according to criteria
determined, whether this set is centralized, decentralized or
distributed functionally or geographically;
- Computer science: the science of automatic processing and
rational information as a support for
knowledge and communications;
- Interconnection of personal data networks
personal: any connection mechanism consisting of
linking of processed data for a purpose
determined with other data processed for purposes
identical or not, or linked by one or more managers
treatment ;
- Freedom: the faculty recognized for each human being to act,
to think, to express oneself according to one's own choices, without
violate applicable laws and regulations;
- Data subject: any natural person who makes
the purpose of processing of personal data;
- Direct prospecting: any solicitation made by means of
sending a message, whatever the medium or nature
in particular commercial, political or charitable, intended
promote, directly or indirectly, services or
the image of a person selling goods or providing
services ;
- Data controller: any natural person,
legal, public or private, any other organization or
authorized association which, alone or jointly with
others, make the decision to collect and process
personal data and determines their purposes;
- Subcontractor: any natural or legal person,
public or private, any other organization or association which
processes data on behalf of the data controller
treatment ;
-information and communication technologies:
All the techniques used in the treatment and
transmission
of
information, mainly from
Computing, Internet and Telecommunications;
- Third parties: any natural, legal, public or
private, any other organization or association other than the
data subject, the controller, the subtreating and the persons who, placed under the direct authority of the
controller or processor, are empowered
to process the data;
- Processing of personal data: any
operation or set of operations provided for in Article 4 of the
this Act carried out using automated procedures or
not and applied to data, such as collection,
exploitation,
the record,
the organization,
conservation, adaptation, modification, extraction,
saving, copying, consulting, using,
communication by transmission, broadcast or any other
form of provision, reconciliation or
interconnection, as well as locking, encryption,
erasure or destruction of personal data
personnel, as well as the interconnection of networks.

Chapter II: The rights of the persons concerned by the
processing of personal data
Section I: Right of access
Article 7 : Any natural person proving their identity has
the right to request, in writing, regardless of the medium, the
responsible for processing personal data,
to provide him with:
- information making it possible to know and contest the
treatment ;
- confirmation that the personal data
concerning are or are not the subject of this processing;
- communication, in an accessible form, of data
of a personal nature that concern them as well as any
information available as to their origin;
- information relating to the purposes of processing,
categories of personal data processed and
recipients or categories of recipients to whom the
data is communicated;
- possible transfers of personal data
planned for a third country.
Article 8 : A copy of personal data
concerning the interested party is issued at his request. The
controller may make the issuance of
this copy to the payment of a sum which cannot exceed the
cost of reproduction.
In case of risk of concealment or disappearance
personal data, the data subject can
inform the National Commission for the Protection of
personal data that takes any measure of
nature to avoid this concealment or disappearance.
Article 9 : Anyone who, in the exercise of their right
access, has serious reasons to believe that the data which
have been communicated to him do not comply with the data
processed, may inform the National Commission for
protection of personal data which carries out
due diligence.
Article 10 : A patient's right of access to information is
exercised by the patient himself or through a
doctor of their choice. In the event of the patient's death, the spouse
survivor or his children, and, in the case of a minor, his father and
mother, can exercise, through a doctor that they
designate this right of access.

the

Article 11 : The controller may oppose
manifestly abusive requests, in particular by their
number, their repetitive or systematic nature. In case of
dispute, the burden of proof of the character
manifestly abusive requests is the responsibility of the responsible
the processing to which they are sent.
Article 12 : By way of derogation from Articles 11 et seq. Of the
this law, when a treatment interests the security of the State,
defense or public security, the right of access is exercised
under the following conditions:
- the request is addressed to the National Commission for
protection of personal data which designates one
of its members belonging or having belonged to the Board
State or the Court of Cassation to carry out
necessary investigations. The latter can be assisted by a

Page 4
24 to 31 OCTOBER 2011 - N ° 74

OFFICIAL JOURNAL OF THE GABONESE REPUBLIC

other agent of the Commission. The applicant is notified that he
has been carried out;
- when the Commission finds, in agreement with the
controller, that the communication of
data contained therein does not call into question its
purposes, state security, defense or security
public, these data may be communicated to
applicant;
- when the treatment is likely to include
information the communication of which would not call into question
the purposes assigned to it, the regulatory act establishing
creation of the file may provide that this information may
be communicated to the applicant by the manager of the
directly entered file.

administrative and financial, referred to as: 'Commission
national data protection
personnel ”abbreviated as“ CNPDCP ”.
The National Commission for the Protection of
personal data is an administrative authority
independent responsible for ensuring that the processing of
personal data are implemented
in accordance with the provisions of this law.
Article 16 : The National Commission for the Protection of
personal data is made up of the auditors
permanent and non-permanent commissioners.
The members of the said Commission are chosen in
because of their proven skills in the field of
IT and / or questions relating to freedoms
individual. They are appointed by decree taken by the Council of
Ministers.

Section II: Right of opposition
Article 13 : Any natural person has the right to object,
for legitimate reasons, that data of a
personnel concerning them are subject to treatment.
It has the right, on the one hand, to be informed before
data concerning her is for the first time
communicated to third parties or used on behalf of third parties
for prospecting purposes and, on the other hand, to see each other
expressly offer the right to oppose, free of charge, said
communication or use.
The provisions of the first paragraph of this article
do not apply when the treatment responds to a
legal obligation.
Section III: Right of rectification and deletion
Article 14 : Any natural person proving their identity
may require the controller to be, depending on
cases, rectified, completed, updated, locked or
deleted personal data concerning him,
that are inaccurate, incomplete, equivocal, out of date, or
including the collection, use, communication or
retention is prohibited.
When the interested party requests it in writing, what
whatever the medium, the controller must justify,
at no cost to the applicant, that he carried out the operations
required under the previous paragraph within one month
after registration of the request.
In the event of a dispute, the burden of proof
is the responsibility of the controller with whom is
exercised the right of access.

Article 17 : The permanent commissioners are
nine (9). They are designated as follows:
- three personalities appointed by the President of the
Republic, including the President of the Commission;
- a Magistrate member of the Council of State appointed on
proposal of the President of the Council of State;
- a Magistrate member of the Court of Cassation appointed on
proposal of the First President of the Court of Cassation;
- a lawyer appointed by the Bar Association;
- a Doctor appointed by the Order of Doctors;
- a representative of human rights organizations
the man designated by his peers;
- an expert in information technology and
communication appointed by the Minister in charge of
the Digital Economy.
Article 18 : There are non-permanent commissioners
of four (4). They are designated as follows:
- a Deputy appointed by the President of the Assembly
National;
- a Senator appointed by the President of the Senate;
- a Government Commissioner appointed by the Prime
Minister;
- a representative of Gabonese employers appointed by their peers.
Article 19 : The non-permanent commissioners are
convened to all meetings of the Commission, within
same conditions as the permanent commissioners, but they
do not take part in the vote.
The Government Commissioner informs the
Government Motivations and Orientations Committee
regarding the implementation and data protection at
personal character.

If data has been transmitted to a third party, the
controller must perform the necessary due diligence
in order to notify him of the operations he has carried out
in accordance with the first paragraph.

Section II: Organs
Article 20 : The bodies of the National Commission for
protection of personal data are:
- office ;
- plenary training;
- restricted training.

Chapter III: Of the National Commission for
protection of personal data
Section I: Creation and composition
Article 15 : A commission responsible for the
protection of personal data with the
personality
legal
and enjoying

493

autonomy

Page 5
494

OFFICIAL JOURNAL OF THE GABONESE REPUBLIC 24 to 31 OCTOBER 2011 - N ° 74

Article 21 : The office of the National Commission for
protection of personal data consists of
three (3) members, namely:
- a president ;
- a Quaestor;
- a protractor.
Apart from the President, the other members of the
officers are elected by their peers.
Article 22 : The bureau is the governing body of the Commission
national body for the protection of personal data.
Article 23 : The plenary formation is the decision-making body of
the National Commission for Data Protection at
personal character. In the event of a tie, that of the
President is decisive.
Article 24 : The restricted formation is an organ of
proposal within the National Commission for
protection of personal data. She may be
charged, by the plenary formation, to exercise certain
powers relating to its investigative powers.
Section III: Mandate and incompatibilities
Article 25 : The mandate of the members of the Commission
national body for the protection of personal data
is for 5 years, renewable once.
However, that of non-permanent commissioners
short for the term of office at the origin of their appointment.
A member of the Commission who ceases to exercise his
functions during the term of office is replaced, in the same
conditions, for the remainder of his term of office.
Unless resignation, the functions cannot be terminated.
of a member that in the event of incapacity noted by the
Commission under the conditions it defines.
Article 26 : Before taking office, the commissioners
permanent loan before the Court of Cassation sitting in
solemn hearing, the oath, the content of which follows: "I swear
solemnly of good and faithfully fulfilling my function of
member of the National Commission for the Protection of
personal data, independently and
impartiality in a dignified and loyal manner and to keep the secret of
deliberations ”.
The officials of the Commission referred to in Article 36 below
below, lend oath before the Court of 1 st Instance
Libreville in these terms: "I swear good and fair
fulfill my duties as an agent of the National Commission
for the protection of personal data in all
independence and impartiality and to keep the confidentiality of
deliberations ”.
Article 27 : Sworn officers, in accordance with article
26 above and which may be called upon to participate in the
carrying out verification missions, must be authorized to do so
by the Commission. This authorization does not exempt from
the application of the provisions defining the procedures
authorizing access to secrets protected by law.

Article 28 : The members and agents of the Commission are
bound by professional secrecy for the facts, acts or
information which they may have become aware of due to
their functions.
Article 29 : In the exercise of their attributions, the members
of the Commission do not receive instructions from any authority.
Public authorities, business leaders
public or private, the heads of various groups
and, more generally, the holders or users of
processing or files of personal data,
cannot oppose the action of the Commission. They must
take all necessary measures to facilitate its task.
Except in cases where they are bound to secrecy
professional, the people interviewed in the context of
verifications made by the Commission in application of
paragraph f to Article 33, are required to provide the
information requested by it for the exercise of its
missions.
Article 30 : Members of the National Commission for
protection of personal data enjoy a
total immunity for opinions expressed in the exercise or at
the occasion of the exercise of their functions.
Article 31 : Membership of the National Commission
for the protection of personal data is
incompatible with that of member of the Government.
Article 32 : No member of the National Commission for
the protection of personal data cannot:
- participate in a deliberation or carry out verifications
relating to a body in which he has an interest,
direct or indirect, performs functions or holds a
mandate;
- participate in a deliberation or carry out verifications
relating to an organization within which it has, during the
thirty-six months preceding the deliberation or verifications,
held a direct or indirect interest, exercised functions or
held a warrant.
Likewise, any member of the Commission must
inform the president of the direct or indirect interests he
holds or comes to hold, functions that he exercises or comes to
exercise and any mandate he holds or comes to hold at the
within a legal person. This information, as well as those
concerning the President, are made available to
members of the Commission.
Any breach of the above obligations taints
nullity of the deliberations concerned and may give rise to
suspension of the offending member.
In any event, the President of the Commission
take appropriate measures, including the adoption of a
internal regulations, to ensure compliance with all
obligations resulting from this law.
Section IV: Missions
Article 33 : The National Commission for the Protection of
personal data performs the following tasks:

Page 6
24 to 31 OCTOBER 2011 - N ° 74

OFFICIAL JOURNAL OF THE GABONESE REPUBLIC

1- it informs all those concerned and all
data controllers for their rights and obligations;
2- it ensures that the processing of personal data
personnel are implemented in accordance with
provisions of this law.
As such, she:
a) authorizes the processing referred to in Article 54, gives
an opinion on the treatments mentioned in Articles 55 and 57
and receives declarations relating to other treatments;
b) establish and publish the standards referred to in paragraph 1 st of
Article 53 and enact, where appropriate, model regulations
to ensure the security of the systems;
c) receives claims, petitions and complaints relating to the
implementation of the processing of personal data
personnel and informs their authors of the follow-up given to
these;
d) respond to requests for advice from public authorities and,
where appropriate, jurisdictions, and advises individuals and
organizations that are implementing or planning to
implementing automated data processing at
personal character;
e) immediately inform the Public Prosecutor,
in accordance with the Code of Criminal Procedure,
offenses of which it is aware and may present
observations in criminal proceedings, in
conditions provided for in Articles 26 and 28;
f) may, by special decision, appoint one or more
of its members or agents of its departments, in the
conditions provided for in Articles 97 to 100 to carry out
verifications relating to any processing and, where applicable,
obtain copies of any document or medium
information useful for its missions;
g) may, under the conditions defined in Chapter VIII,
pronounce with regard to a data controller, one
the measures provided for in Articles 101 to 111;
h) respond to requests for access to processing
mentioned in Articles 16 and 59;
3- at the request of professional organizations or
institutions bringing together mainly those responsible for
treatments, she:
a) give an opinion on compliance with the provisions of the
this law of the draft professional rules as well as
products and procedures for the protection of
people with regard to the processing of personal data
personal data, or the anonymization of this data, which
are submitted;
b) assess the guarantees offered by
professional rules that it has previously recognized
in accordance with the provisions of this law, with regard to
respect for the fundamental rights of individuals;
c) issues a label to products or procedures
tending to the protection of persons with regard to
processing of personal data, after it
recognized them as complying with the provisions of this
law ;
4- it keeps itself informed of the evolution of technologies of
information and makes public, where appropriate, its
appreciation of the resulting consequences for
the rights and freedoms mentioned in article 1 st .
As such, she:

495

a) is consulted on any bill or decree relating to the
protection of individuals with regard to processing
automated;
b) propose legislative measures to the Government or
regulatory adaptation of the protection of freedoms to
developments in IT processes and techniques;
c) may, at the request of other administrative authorities
independent, provide assistance in
Data protection ;
d) may be associated, at the request of the Prime Minister, with the
preparation and definition of the Gabonese position in
international negotiations in the field of
protection of personal data;
e) may participate, at the request of the Prime Minister, in the
representation
Gabonese
in
the
organizations
international and community organizations competent in
field.
Article 34 : For the accomplishment of its missions, the
Commission may proceed by way of recommendation and
make individual or regulatory decisions in the
cases provided for by this law.
Article 35 : The Commission presents each year to the
President of the Republic, the Prime Minister and the
Parliament a public report on the execution of
his mission.
Section V: Operation
Article 36 : The National Commission for the Protection of
personal data has a staff
by the State and may recruit agents in accordance with
provisions of the Labor Code.
Article 37 : A General Secretariat ensures the administration of
the National Commission for Data Protection at
personal character.
The General Secretariat is headed by a Secretary
General appointed by decree of the President of the Republic
among Civilian Directors or Directors
economic and financial category A, hierarchy A1,
having at least 10 years of experience.
The organization of the General Secretariat is set by
regulatory route.
Article 38 : Members of the National Commission for
protection of personal data perceive a
remuneration and benefits that ensure them a
material and moral independence in the exercise of their
functions.
The components of the remuneration and the
benefits of members of the National Commission for
protection of personal data are set by
regulatory route.
Article 39 : The National Commission for the Protection of
personal data establishes internal regulations
which specifies the rules relating to its organization and
operation, in particular the rules relating to
deliberations, the examination of files and their presentation
before the Commission.

Page 7
496

OFFICIAL JOURNAL OF THE GABONESE REPUBLIC 24 to 31 OCTOBER 2011 - N ° 74
Section VI: Resources

Article 40 : For the accomplishment of its missions, the
National Commission for Data Protection at
personal character has an independent budget of
operation. This budget is made up of the appropriations entered
in the finance law.
Article 41 : The National Commission for the Protection of
personal data cannot be donated or
grant from an individual, organization or foreign state
only through a state cooperation structure
Gabonese.
Article 42 : The Budget of the National Commission for
protection of personal data is prepared by the
office and adopted by the plenary formation.
Article 43 : The accounts of the National Commission for
protection of personal data are presented to the
control of the Court of Auditors.
Article 44 : The President of the National Commission for
protection of personal data is authorizing officer
income and expenditure. An accountant is placed
to the Commission by the Minister responsible for the Budget.
Chapter IV: Processing conditions and
use of personal data
Section I: Conditions of lawfulness of data processing
personal
Article 45 : Processing can only relate to data
of a personal nature that meet the following conditions:
- the data is collected and processed fairly and
lawful;
- they are collected for specific purposes,
explicit, legitimate and non-inhumane and are not addressed
subsequently in a manner incompatible with these purposes.
However, further processing of the data at
statistical or scientific research purposes or
history is considered compatible with the purposes
initial data collection, if it is carried out in the
compliance with the principles and procedures provided for in this
chapter as well as in section I of chapter V and if it is not
used to make decisions about people
concerned;
- they are adequate, relevant and not excessive in terms of
with regard to the purposes for which they are collected and
their subsequent processing;
- they are accurate, complete and, if necessary, updated;
appropriate measures must be taken to ensure that
inaccurate or incomplete data with regard to the purposes
for which they are collected or processed are
erased or corrected;
- they are kept in a form allowing
the identification of the persons concerned for a period
which does not exceed the duration necessary for the purposes for
which they are collected and processed.
Article 46 : Processing of personal data
must have received the consent of the data subject or
meet one of the following conditions:

- compliance with a legal obligation incumbent on the person responsible
processing;
- safeguarding the privacy of the data subject;
- the execution of a public service mission with which
the controller or recipient of the processing;
- the performance, either of a contract to which the data subject
party, or pre-contractual measures taken at the
request for it;
- the realization of the legitimate interest pursued by the
controller or by the recipient, subject to
not to disregard the interest or the rights and freedoms
fundamentals of the person concerned.
Article 47 : It is prohibited to collect or process
personal data which shows, directly
or indirectly, racial or ethnic origins,
political, philosophical or religious opinions or
the trade union membership of people, or which relate to
their health or sex life.
Article 48 : Insofar as the purpose of the processing so requires,
certain categories of data are not subject to
the prohibition provided for in article 47 above:
1- the processing operations for which the data subject has
given his express consent, except in cases where the law
provides that the prohibition referred to in Article 47 cannot be
waived by the consent of the data subject;
2- the treatments necessary to save life
human, but to which the data subject cannot
give consent due to legal incapacity
or a material impossibility;
3- the treatments implemented by an association or any
other non-profit and religious organization,
philosophical, political or union:
a) only for the data mentioned in article 47
corresponding to the purpose of said association or said
organism;
b) provided that they concern only the members of
this association or body and, where applicable, the
people who have contact with him
regular within the framework of its activity;
c) and that they relate only to data not
communicated to third parties, unless the persons
concerned expressly consent to it;
4- processing of personal data
personnel made public by the data subject;
5- the treatments necessary for the observation, for the exercise
or the defense of a legal right;
6- the treatments necessary for the purposes of medicine
preventive, medical diagnostics, administration
care or treatment, or the management of
health and implemented by a member of a professional
health, or by another person to whom it is necessary in
because of their duties, the obligation of professional secrecy;
7- statistical processing carried out for economic purposes
by the statistical services of the competent ministries, in
compliance with the law on the obligation, coordination and
secrecy in matters of statistics, after notice of
the administration competent in the matter and in the
conditions provided for in article 52 of this law;

Page 8
24 to 31 OCTOBER 2011 - N ° 74

OFFICIAL JOURNAL OF THE GABONESE REPUBLIC

8- the treatments necessary for research in the field
health in accordance with the procedures set out in Chapter V.
Article 49 : If the personal data referred to in
Article 50 are called upon to be the subject of a short notice.
anonymization process previously recognized in accordance with
provisions of this law by the National Commission
Personal Data, which may authorize,
given their purpose, certain categories of
processing in accordance with the procedures provided for in Article 52 of the
this law. The provisions of Chapter V are not
applicable.
Likewise, are not subject to the prohibition provided for in
Article 50 processing, automated or not, justified by
public interest and authorized under the conditions set out in
paragraph 1 of article 55 or paragraph 2 of article 56 of
this law.
Article 50 : Processing of personal data
relating to offenses, convictions and security measures
can only be implemented by:
- courts, public authorities and individuals
legal entities managing a public service, acting within the framework of
their legal powers;
- court officers, for the strict needs of
the exercise of the missions entrusted to them by law.
No court decision involving a
appreciation of a person's behavior cannot have
for basis an automated processing of data to
personal character intended to assess certain aspects of their
personality.
No other decision having effects
against a person cannot be taken on the
sole basis for automated data processing intended
to define the profile of the interested party or to assess certain aspects of
her personality.
Are not seen as taken on the one hand
basis for automated processing, the decisions taken
in connection with the conclusion or performance of a contract and
for which the data subject has been able to
present its observations, nor those satisfying the requests
of the person concerned.
Section II: Formalities prior to the implementation of
processing of personal data
Article 51 : With the exception of those who fall under
provisions provided for in Articles 54, 55 and 56 or which are referred to
in Article 65 of this law, the automated processing of
personal data are declared
to the National Commission for the Protection of
personal data.
1- However, are not subject to any of the formalities
prerequisites provided for in this chapter:
a) processing whose sole purpose is to hold a
register which, by virtue of legislative or
regulatory, is intended exclusively for information
of the public and is open to consultation of the public or
any person showing a legitimate interest;

four hundred ninety seven

b) processing mentioned in 3 th point of the article 48
above.
2- The processing operations for which the manager has appointed a
corresponding to the protection of personal data
personnel responsible for ensuring, in an independent manner,
compliance with the obligations provided for in this law are
exempt from the formalities provided for in Articles 52 and 53 of the
this law, except when a transfer of personal data
personnel destined for another State is envisaged.
The designation of the correspondent is notified to the
Commission. It is brought to the attention of the authorities
representative of staff.
The correspondent is a person benefiting from
qualifications required to perform its duties. He is holding a
list of treatments carried out immediately accessible to
any person making the request and can not be the subject
no sanction from the employer due to
the accomplishment of its missions. He can grab the
Committee on the difficulties he encounters in the exercise of
his missions.
In the event of non-compliance with the provisions of the law, the
controller is ordered by the Commission of
carry out the formalities provided for in Articles 52 and 53 of the
this law. In the event of a breach of his duties, the
correspondent is relieved of his duties upon request, or
after consulting the Commission.
3- The person responsible for the processing of personal data
staff who are not subject to any of the formalities provided for
in this chapter, communicate to anyone who makes
the request, the information relating to this processing.
Article 52 : The declaration includes the commitment that the
processing meets legal requirements.
It is addressed to the National Commission for
protection of personal data by means of
traditional or electronically.
The Commission shall issue a receipt without delay, if
appropriate, electronically. The applicant can put in
implements processing upon receipt of this receipt; it is not
exempt from any of its responsibilities.
Processing under the same body and
having identical or related purposes can be
the subject of a single declaration. In this case, the information
required, pursuant to Article 53 below, are not
provided for each of the processing operations only insofar as
they are his own.
Article 53 : For the most common categories of
processing of personal data, including the implementation
work is not likely to infringe privacy or
freedoms, the National Commission for the Protection of
personal data establishes and publishes standards,
after having received, if applicable, the proposals made by
representatives of organizations to simplify the obligation to
declaration. These standards specify:
- the purposes of the processing operations that are the subject of a declaration
simplified;

Page 9
498

OFFICIAL JOURNAL OF THE GABONESE REPUBLIC 24 to 31 OCTOBER 2011 - N ° 74

- personal data or categories of
personal data processed;
- the category or categories of data subjects;
- the recipients or categories of recipients to whom
personal data is communicated;
- the retention period for personal data.
Treatments that correspond to one of these
standards are subject to a simplified declaration of conformity
sent to the Commission, where appropriate, by
electronic.
The Commission may define, among the categories of
treatments referred to in paragraph 1 st , those given
their purposes, recipients or categories of
recipients, the personal data processed, the
retention period of these and the categories of
persons concerned, are exempt from declaration.
Under the same conditions, the Commission may
authorize those responsible for certain categories of
processing operations to make a single declaration according to the
provisions of point 1 of article 51 above.
Article 54 : Are implemented after authorization of the
National Commission for Data Protection at
personal character, excluding those mentioned
in Articles 55 and 56 of this Law:
1- the processing, automated or not, mentioned in the article
48 above;
2- automated processing of data
genetic, with the exception of those of them which are
work by physicians or biologists and who are
necessary for the purposes of preventive medicine,
medical diagnoses or the administration of care or
treatments;
3- processing, automated or not, relating to
data relating to offenses, convictions or
safety measures, except those implemented by the
auxiliaries of justice for the needs of their missions of
defense of the persons concerned;
4- automated processing likely, because of their
nature, scope or purposes, to exclude
persons benefiting from a right, a service or a
contract in the absence of any legislative provision or
regulatory;
5.- automated processing aimed at:
- the interconnection of files under one or more
legal persons managing a public service and whose
purposes correspond to different public interests;
- the interconnection of files belonging to other persons and
whose main purposes are different;
- processing of data including
figure the registration number of people in a
national identification file for natural persons and
those which require a consultation of this file without
include the registration number of people in this file;
- automated processing of data comprising
assessments of people's social difficulties;

- automated processing comprising data
biometrics required to verify the identity of
people.
For the purposes of this article, the processing
which meet the same purpose, relate to categories
identical data and have the same recipients or
categories of recipients may be authorized by a
single decision of the Commission. In this case, the
responsible for each processing operation sends the Commission a
commitment of compliance thereof with the description appearing
in the authorization.
The Commission takes a decision within two
months from receipt of the request. However, this
time limit may be renewed once upon a reasoned decision of its
President. When the Commission has not taken a decision in
within these deadlines, the authorization request is deemed to be rejected.
Article 55 : Are authorized by order of the minister (s)
competent authorities, taken after a reasoned and published opinion of the Commission
national body for the protection of personal data,
the processing of personal data implemented
works on behalf of the State and:
- which concern the security of the State, defense or security
public;
- or whose purpose is prevention, research,
discovery or prosecution of criminal offenses or
the execution of criminal convictions or measures of
safety.
The Commission's opinion is published with the decree
authorizing processing.
Those of these treatments which relate to data
mentioned in article 45 above, are authorized by decree
taken in the Council of Ministers after a reasoned and published opinion of the
Commission; this notice is published with the decree authorizing the
treatment.
Certain treatments mentioned in this article
may be exempted, by decree taken by the Council of
Ministers, the publication of the regulatory act which
authorizes; for these treatments, is published, at the same time as
the decree authorizing the exemption from publication of the act, the meaning
of the opinion issued by the Commission.
For the purposes of this article, the processing
which meet the same purpose, relate to categories
identical data and have the same recipients or
categories of recipients may be authorized by an act
single regulatory. In this case, the person responsible for each
processing sends to the Commission a commitment of
conformity of the latter to the description in
authorization.
Article 56 : Are authorized by decree taken by the Council of
Ministers, after a reasoned and published opinion of the Commission
national data protection
staff :
- the processing of personal data implemented
work on behalf of the State, a legal person of
public law or a legal person governed by private law
a public service, which relate to data among

Page 10
24 to 31 OCTOBER 2011 - N ° 74

OFFICIAL JOURNAL OF THE GABONESE REPUBLIC

which is the registration number of the persons in
a national file for the identification of natural persons;
- the processing of personal data implemented
work on behalf of the State, which relate to the data
biometrics required for authentication or control
of the identity of persons.
Are authorized by decree or, in the case of treatment
operated on behalf of a public institution or a
legal person of private law managing a public service, by
decision of the deliberative body responsible for their organization,
taken after a reasoned and published opinion of the Commission:
- processing carried out by the State or by individuals
legal entities mentioned in 1 st
paragraph of this article which
require consultation in a national file
identification of natural persons without including the
registration number for this file;
- those of the treatments mentioned in the 1st paragraph;
- which do not include any of the data mentioned in
article 47 or article 48 above;
- which do not give rise to an interconnection between
processing or files corresponding to public interests
different ;
- and which are implemented by services whose purpose is
mission, either to determine the opening conditions or
the scope of a citizen's right, namely to establish the base,
to control or collect charges or taxes of
of any kind, either to establish statistics;
- processing relating to the population census;
- processing carried out by the State or by individuals
legal entities mentioned in the 1 st paragraph of this article for the purposes of
to provide users of the administration with a
or several e-administration tele-services, if
these treatments carry data including
the registration number of people in a file
national identification or any other identifier of
physical persons.
The provisions of article 55 above are
applicable to the processing operations covered by this article.
Article 57 : The National Commission for the Protection of
personal data, entered as part of the articles
54 or 55 above, take a decision within two months of
from receipt of the request. However, this delay
can be renewed once by reasoned decision of the President.
The opinion requested from the Commission on a treatment,
which is not paid to the expiry of the deadline to 1 st paragraph
is deemed favorable.
Article 58 : Acts authorizing the creation of a processing
application of Articles 54, 55 and 56 above specify:
- the name and purpose of the processing;
- the service to which the right of access defined to the
chapter VII;
- the categories of personal data
recorded;
- the recipients or categories of recipients authorized to
receive communication of this data;
- where applicable, exemptions from the information obligation
provided for in article 59 of this law.

499

Section III: Obligations incumbent on those responsible for
processing of personal data
Sub-section I: The obligation of transparency
Article 59 : The person from whom are collected
of personal data concerning him is informed,
by the controller or his representative:
- the identity of the controller and, where applicable,
that of its representative;
- the purpose pursued by the processing for which the
data is intended;
- the obligatory or optional nature of the answers;
- the possible consequences, with regard to it, of a failure to
reply ;
- the recipients or categories of recipients of
data;
- the rights which it holds from the provisions of section 2 of the
this chapter;
- planned transfers of personal data
to another State, if applicable.
When such data is collected through
questionnaires, these must mention the
requirements of this article.
Article 60 : When the personal data have not
not collected from the data subject, the
controller or his representative must provide
the latter, the information listed in Article 59 below.
on it as soon as the data is saved or, if a
communication of data to third parties is envisaged, at most
late during the first data communication.
When the personal data has been
initially collected for another purpose, the provisions of
the previous paragraph do not apply to processing
necessary for the conservation of this data for the purposes
historical, statistical or scientific.
Article 61 : If the personal data collected
are called upon to be the subject of a process at short notice
anonymization previously recognized in accordance with
provisions of this law by the National Commission
for the protection of personal data,
information provided by the controller to the
data subject may be limited to those mentioned in
1 st and 2 nd indents of article 59 above.
Article 62 : The provisions of article 59 do not apply
to the data collected under the conditions provided for in article
60 and used during a treatment implemented for the
account of the State and concerning State security, defense,
public security or having as its object the execution of
criminal convictions or security measures, in the case of
where such a limitation is necessary for the respect of the purposes
continued by the treatment.
Article 63 : The provisions of Articles 59, 61 and 62 do not
do not apply to data processing for the purpose of
prevention, research, discovery or prosecution
criminal offenses.

Page 11
500

OFFICIAL JOURNAL OF THE GABONESE REPUBLIC 24 to 31 OCTOBER 2011 - N ° 74
Sub-section II: Obligation of confidentiality

Article 64 : Processing of personal data
is confidential. It is performed by people who act
under the authority of the controller and only on
his instructions.
To carry out the processing, the controller must
choose people presenting, with regard to preservation
data confidentiality, all the guarantees
technical and legal knowledge as well as integrity
personal. A written commitment from the people required to
processing such data to comply with this law must be
sign.
Failure to comply with the obligation of confidentiality in
the processing of personal data constitutes a
violation of professional secrecy. As such, he is liable to
penalties provided for by the Penal Code, in particular in its article
289.
Article 65 : Personal data cannot
be the subject of a processing operation by a subtreating, a person acting under the authority of the person in charge
processing or that of the subcontractor, only on instruction
of the controller.
The subcontractor must present guarantees
sufficient to ensure the implementation of the
security and confidentiality mentioned in article 64 below
above. This requirement does not relieve the person in charge of
treatment of its obligation to ensure compliance with these
measures.
The contract between the subcontractor and the person responsible for
processing includes an indication of the obligations incumbent on the
subcontractor in terms of protection, security and
confidentiality of data and provides that the subcontractor does not
can act only on the instruction of the controller.
Sub-section III: The safety obligation
Article 66 : The controller is required to take
any useful precaution with regard to the nature of the data and,
in particular to prevent them from being deformed,
damaged or accessed by unauthorized third parties. He
take, in particular, any measure aimed at:
- ensure that, for the use of a treatment system
automated data, authorized persons cannot
access only personal data relating to
their competence;
- ensure that the identity of the
third parties to whom personal data may
be transmitted;
- guarantee that can be verified and noted a posteriori
the identity of the people before they had access to the system
information and what data has been read or entered
in the system, when and by whom;
- prevent any unauthorized person from accessing
premises and equipment used for the treatment of
data;
- prevent data carriers from being read,
copied, modified, destroyed or moved by a person not
authorized;

- prevent the unauthorized entry of any data into
the information system as well as any
knowledge, modification or deletion not
authorized recorded data;
- prevent data processing systems
can be used by persons not authorized to
using data transmission facilities;
- prevent that, during the communication of data and
transport of the data carriers, the data can be
read, copied, modified or deleted in an unauthorized manner;
- save the data by making copies of
security ;
- refresh and if necessary convert the data for a
long-term storage.
Article 67 : Decrees issued after consultation with the Commission
national body for the protection of personal data,
may lay down the technical requirements to which must
comply with the treatments mentioned in the 2 nd and 6 th indent
of article 48.
Sub-section IV: The retention obligation
Article 68 : Data must be collected for
determined, explicit and legitimate purposes and cannot
be further processed in a manner incompatible with these
purposes.
They must be adequate, relevant and not
excessive in relation to the purposes for which they are
collected and further processed.
They must be kept for a period of time that
does not exceed the period necessary for the purposes for which
they have been collected or processed. Beyond this period
required, the data cannot be
conservation than in order to respond specifically to a
processing for historical, statistical or research purposes
under legal provisions.
Article 69 : Except with the express consent of the person
concerned, the personal data collected by the
providers of electronic certification services for
certificate issuance and retention needs
linked to electronic signatures must be directly
with the data subject and can only be processed
for the purposes for which they were collected.
Sub-section V: The obligation of sustainability
Article 70 : The controller is required to take
any useful measure to ensure the sustainability of the data to be
personal character.
Chapter V: Specific principles relating to
processing of certain personal data
Section I: Processing of personal data
for research in the field of health
Article 71 : Processing of personal data
for research purposes in the field of health are
subject to the provisions of this law, with the exception of
articles 52, 55 to 58 and 59 of this law.

Page 12
24 to 31 OCTOBER 2011 - N ° 74

OFFICIAL JOURNAL OF THE GABONESE REPUBLIC

Data processing for the purpose of monitoring
therapeutic or medical individual patients are not
subject to the provisions of this chapter. It is the same
processing allowing studies to be carried out based on
data thus collected if these studies are carried out by
personnel ensuring this monitoring and intended for their exclusive use.
Article 72 : For each request for the implementation of a
processing of personal data, a committee
advisory on the processing of information on
research in the field of health, instituted at the
Minister in charge of research and composed of people
competent in research in the field of
health, epidemiology, genetics and bio-statistics, issues

international; it can also be waived if a
peculiarity of the research requires it. The authorization request
includes the scientific and technical justification for the
derogation and indication of the period necessary for the
research. At the end of this period, the data are
stored and processed under the conditions set out in article 68
of this law.
The presentation of the results of the treatment of
data can in no case allow direct identification
or indirect of the persons concerned.
The data is received by the person in charge of
research designated for this purpose by the natural person or

501

an opinion on the research methodology with regard to
provisions of this law, the need for recourse to
personal data and the relevance of these by
in relation to the research objective, prior to the referral
from the National Commission for Data Protection to
personal character.
The advisory committee has one month to
forward its opinion to the applicant. Otherwise, the notice is deemed
favorable. In an emergency, this period may be reduced to fifteen
days.
The Chairman of the Advisory Committee may
implements a simplified procedure.
The implementation of data processing is
then submitted to the authorization of the Commission, which
pronounces under the conditions provided for in article 53 above.
For the most common categories of treatments
automated for the purpose of research in the field
health and relating to data that does not allow a
identification
direct contact with the people concerned,
Commission may approve and publish methodologies for
reference, established in consultation with the advisory committee
as well as with representative public and private organizations, and
intended to simplify the procedure provided for in the first four
paragraphs of this article.
These methodologies specify, in view of the
characteristics mentioned in article 52 of this law,
the standards to which the treatments must correspond
may be the subject of a request for an opinion and a request
simplified authorization.
For the other categories of processing, the committee
consultative, in consultation with the Commission, the
conditions under which its opinion is not required.
Article 73 : Notwithstanding the rules relating to secrecy
professional, members of the health professions can
transmit the personal data they hold
in the context of data processing authorized in
application of article 74 below.
When these data allow the identification of
persons, they must be encoded before transmission.
However, this obligation may be waived when the
data processing is associated with studies of
pharmacovigilance or research protocols carried out
as part of national cooperative studies or

legal authority authorized to carry out the processing. This
manager ensures the security of information and its
processing, as well as compliance with the purpose thereof.
The people called upon to implement the
data processing as well as those who have access to
data to which it relates are bound to secrecy
professional under penalty of criminal prosecution.
Article 74 : Everyone has the right to oppose
personal data concerning them are subject
the lifting of professional secrecy made necessary by a
treatment of the nature of those referred to in Article 62 above
above.
In the event that the research requires the collection of
biological samples and express identifiers, the
informed and express consent of the persons concerned must
be obtained prior to the implementation of the treatment
Datas.
Information concerning deceased persons,
including those which appear on the certificates of the causes of
death, may be the subject of data processing, unless
the person concerned expressed his refusal in writing during his lifetime.
Article 75 : The persons from whom are collected
data of a personal nature or about which
such data is transmitted are, before the start of the
processing of these data, individually informed:
- the nature of the information transmitted;
- the purpose of the data processing;
- natural or legal persons receiving the
data where applicable;
- the right of access and rectification instituted in Articles 16 and
17 above;
- the right to object or the obligation to collect their
consent.
However, this information may not be
issued if, for legitimate reasons the attending physician
appreciates in conscience, the patient is left in ignorance
a serious diagnosis or prognosis.
In the event that the data was initially
collected for a purpose other than processing, it may be
waived from the obligation of individual information when this
this comes up against the difficulty of finding people
concerned. Exceptions to the obligation to inform
people of the use of the data concerning them for purposes
research are mentioned in the application file
authorization sent to the National Commission for

Page 13
502

OFFICIAL JOURNAL OF THE GABONESE REPUBLIC 24 to 31 OCTOBER 2011 - N ° 74

protection of personal data, which decides on this
point.
Article 76 : The recipients of the information and exercise the
rights arising therefrom, the holders of parental authority, for the
minors, or the legal representative for persons making
the subject of a guardianship measure.
Article 77 : Information relating to the provisions of
this chapter must be ensured in any establishment or
center where prevention and diagnostic activities are carried out
and care giving rise to the transmission referred to in Article 74 of
this law.
Article 78 : The implementation of data processing in
violation of the conditions provided for in this chapter,
entails the temporary or permanent withdrawal of the authorization by
the National Commission for Data Protection at
personal character.
The same applies in the event of refusal to submit to the
verifications provided for in point f of article 33 of this
law.
Article 79 : The transmission to another State of data to
uncoded personal character being processed
aiming at research in the field of health is
authorized, subject to compliance with the rules set out in
chapter IV of this law.
Section II: Processing of personal health data
staff for evaluation or analysis of practices
or care and prevention activities
Article 80 : Processing of personal health data
staff whose purpose is the evaluation of care practices
and prevention are authorized under the conditions provided for in
this chapter.
The provisions of this chapter do not apply
to the processing of personal data carried out at
for reimbursement or control purposes by organizations
responsible for the management of a basic health insurance scheme,
nor to the treatments carried out in the establishments of
health by physicians responsible for information.
Article 81 : Data from held medical files
within the framework of the liberal exercise of the professions of health,
as well as those from the information systems of the cash registers
health insurance, cannot be communicated for
statistics for the evaluation or analysis of practices and
care and prevention activities than in the form of
aggregated statistics or data per patient consisting of
so that the persons concerned cannot be
identified.
The provisions of paragraph
previous only with the authorization of the National Commission
for the protection of personal data. In this
In this case, the data used does not include the name or
first names of people, nor their registration number in the file
national identification of natural persons.
Article 82 : For each request, the National Commission
for the protection of personal data checks the

guarantees presented by the applicant for the application of
these provisions and, where applicable, the compliance of its
asks about its missions or its corporate purpose. She makes sure to
the need to use personal data and
the relevance of the processing with regard to its declared purpose
evaluation or analysis of the practices or activities of
care and prevention.
It checks that personal data
whose treatment is envisaged do not include the name or
first names of the persons concerned, nor their number
registration in the national personal identification file
physical. In addition, if the applicant does not provide elements
sufficient to demonstrate the need for certain
information among all the personal data
staff whose treatment is envisaged, the Commission may
prohibit the communication of this information by
the body that holds them and only authorize the processing of
data thus reduced.
The Commission determines the retention period
of the data necessary for processing and assesses the
measures taken to ensure their safety and the guarantee of
secrets protected by law.
Article 83 : The National Commission for the Protection of
personal data has, from its referral
by the applicant, for a period of two months, renewable once
only once, to decide. In the absence of a decision in this
delay, this silence constitutes acceptance decision.
Processing for the same purpose
relating to identical categories of data and having
identical recipients or categories of recipients
may be the subject of a single Commission decision.
Article 84 : Processing authorized in accordance with
Articles 85 and 94 of this law may not be used for purposes
search or identification of people. The people
called upon to implement these treatments, as well as those
who have access to the data subject to such processing or
to the results of these when they indirectly allow
to identify the persons concerned, are bound to secrecy
professional under penalty of criminal prosecution provided for in the
this law.
The results of these treatments cannot be
the subject of a communication, publication or
dissemination only if the identification of persons on the state
from which this data was collected is impossible.
Section III: Processing of personal data
for the purposes of journalism and literary and artistic expression
Article 85 : The provisions of this law do not apply
not to the processing of personal data implemented
works for the sole purpose of:
- literary and artistic expression;
- exercise, in a professional capacity, of the activity of journalist,
in compliance with the ethical rules of this
profession.
Article 86 : For the treatments mentioned in the 2 nd point of
the previous article, the exemption from the reporting obligation
provided for in Article 51 above is subject to the

Page 14
24 to 31 OCTOBER 2011 - N ° 74

503

OFFICIAL JOURNAL OF THE GABONESE REPUBLIC

designation by the controller of a
corresponding to the protection of data belonging to a
body of the written or audiovisual press, responsible for
a register of the processing operations carried out by this manager and
ensure, in an independent manner, the application of
provisions of this law. This designation is brought to the
knowledge of the National Commission for the Protection
personal data.

Article 92 : The authorization may be renewed after a
request of the data controllers.
Article 93 : The request for authorization of interconnection as
that the interconnection authorizations are registered on the
directory of personal data processing
made available to the public.
Section II: Transfer of personal data

Article 87 : In the event of non-compliance with the provisions of the law
applicable to the processing operations provided for in Articles 85 and 86, the
controller is ordered by the Commission
national body for the protection of personal data
to comply with the law. In the event of a breach
noted in his duties, the correspondent is relieved of his
functions on request or after consultation of the
Commission.
Article 88 : The provisions of this section do not
obstacle to the application of the provisions of the Civil Code, laws
relating to the written or audiovisual press and the Penal Code,
which provide for the conditions for exercising the right of reply and
that prevent, limit, repair and, where appropriate, repress
attacks on the privacy and reputation of individuals.
Chapter VI: Interconnection and transfer of
personal data
Section I: Data interconnection
personal
Article 89 : Interconnection of the information systems concerned
in article 52 of this law falling under one or more
legal persons managing a public service and whose purposes
correspond to different public interests must be the subject of
authorization from the National Commission for
protection of personal data. It is
even for processing carried out by the State for the purposes of
make available to users of the administration one or
several remote services as part of the administration
electronic. The interconnection of files under
private individuals and whose main purposes are
different is also subject to authorization by the
Commission.
Article 90 : The interconnection of information systems must
to achieve legal or statutory objectives
of legitimate interest to those responsible for
treatments. It cannot lead to discrimination or
reduction of rights, freedoms and guarantees for people
concerned or be accompanied by appropriate security measures
and must take into account the principle of data relevance
subject to interconnection.
Article 91 : The request for authorization of interconnection
provided for in Article 52 includes all information on:
- the nature of the personal data relating to
interconnection;
- the purpose for which the interconnection is considered
necessary ;
- the duration for which interconnection is permitted;
- where applicable, the conditions and terms with regard to the
most effective protection of rights and freedoms and
in particular the right to privacy of the persons concerned
or third parties.

Article 94 : The controller cannot transfer
personal data to another State only if this
State ensures a sufficient level of privacy protection,
fundamental rights and freedoms of individuals with regard to
processing of which these data are subject or may be
the object.
The sufficiency of the level of protection provided
by a State is assessed according in particular to the provisions
in force in that State, of the security measures
applied, the specific characteristics of the processing, such as
that its purposes and duration, as well as the nature, origin and
the destination of the processed data.
The National Commission for the Protection of
personal data ensures and publishes the list of
States which guarantee a sufficient level of protection to
with regard to any transfer of personal data.
Article 95 : However, the controller may
transfer personal data to a State does not
not meeting the conditions provided for in article 99 below
if the person to whom the data relates has consented
expressly upon their transfer or if the transfer is necessary for
one of the following conditions:
- to safeguard the life of that person;
- to safeguard the public interest;
- compliance with obligations to ensure recognition,
the exercise or defense of legal claims;
- consultation, under regular conditions, of a
public register which, by virtue of legislative or
regulatory, is intended for public information and is
open to the consultation of the latter or any person
justifying a legitimate interest;
- the performance of a contract between the controller
and the interested party, or pre-contractual measures taken at the
request of it;
- the conclusion or the performance of a concluded contract or
conclude, in the interest of the data subject, between the
controller and a third party.
An exception can also be made to the prohibition
provided for in Article 94 above, by decision of the Commission
national body for the protection of personal data
or, if it is a treatment mentioned in article 55 above,
by decree issued after a reasoned and published opinion of the Commission,
when the treatment guarantees a sufficient level of protection
privacy and fundamental rights and freedoms
people, in particular due to contractual clauses
or internal rules to which it is subject.
The Commission brings to the attention of others
States, decisions authorizing the transfer of data to
personal character that it takes under the previous paragraph.

Page 15
504

OFFICIAL JOURNAL OF THE GABONESE REPUBLIC 24 to 31 OCTOBER 2011 - N ° 74

Article 96 : If the National Commission for the Protection of
personal data has established that a State does not ensure
not a sufficient level of protection with regard to a transfer
personal, it issues a receipt with mention of
prohibition of data transfer.
To this end, it immediately informs the authorities.
officials and the public. When it receives a declaration
filed in application of articles 52 or 53 above and
showing that personal data will be
transferred to that State, the Commission issues the receipt and
instructs the controller, as the case may be, to
suspend or cancel data transfer.
If the Commission finds that the State to which the
transfer is being considered now ensures a level of
sufficient protection, it notifies the controller
the termination of the suspension of the transfer.
Chapter VII: Control and sanctions
administrative
Section I: Control of the implementation of processing
Article 97 : Members of the National Commission for
protection of personal data as well as
sworn service agents referred to in article 36 above have
access, under the conditions provided for by the Civil Code, for
the exercise of their missions, in places, premises, enclosures,
facilities or establishments used for the implementation of a
processing of personal data and which are
professional use, excluding parts thereof
assigned to the private home. The prosecutor
territorially competent is informed in advance.
Article 98 : In case of opposition from the person in charge of the premises, the
visit can only take place with the permission of the President
the court in whose jurisdiction the premises at
visit or the judge delegated by him.
This magistrate is seized at the request of the President of the
National Commission for Data Protection at
personal character. It decides by a reasoned ordinance,
in accordance with the provisions of the Civil Code.
Article 99 : Members of the National Commission for
protection of personal data and agents
mentioned in Article 97 may request communication of
all documents necessary for the accomplishment of their
mission, whatever the medium, and take a copy. They
can collect, on site or on convocation, any
information and any useful justification. They can access
computer programs and data, request the
transcription of any treatment in appropriate documents
directly usable for control purposes. They
can be assisted by experts chosen by the
Commission.
Article 100 : A report is drawn up contradictorily
verifications and visits carried out in accordance with articles
previous ones.

Section II: Sanctions pronounced by the Commission
National Data Protection Authority at
Personal character
Article 101 : The National Commission for the Protection of
personal data can pronounce the measures
following:
- a warning to the controller does not
not respecting the obligations arising from this law;
- a formal notice to put an end to the breaches
noted within the time limit that it sets.
Article 102 : If the controller does not comply
not to the formal notice sent to it, the Commission
national body for the protection of personal data
may pronounce against him, after contradictory procedure,
the following sanctions:
- temporary withdrawal for a period of three (3) months at
the expiration of which, the withdrawal becomes final;
- a financial fine of one (1) million to one hundred (100)
million CFA Francs.
The recovery of penalties is carried out in accordance with
to the legislation relating to the recovery of State debts.
Article 103 : In case of emergency, when the implementation of a
processing or use of processed personal data
leads to a violation of rights and freedoms, the Commission
national body for the protection of personal data,
after adversarial procedure, may decide:
- the interruption of the implementation of the treatment for a
maximum duration of three (3) months;
- blocking of certain personal data
processed for a maximum of 3 months;
- temporary or definitive prohibition of treatment
contrary to the provisions of this law.
Article 104 : The sanctions provided for in article 101 of the
this law are pronounced on the basis of a report drawn up
name of the National Commission for the Protection of
personal data, through restricted training.
This report is notified to the controller,
who can submit observations and be represented or
assist. The rapporteur may present oral observations to
the Commission but does not take part in its deliberations. The
Commission may hear any person whose hearing it
seems likely to make a useful contribution to its information.
The
Commission
can make
warnings she utters. It can also, in case
in bad faith by the controller, order
the inclusion of the other sanctions it pronounces in this
publication, newspapers and media it designates. Expenses
are borne by the sanctioned persons.

public

the

Article 105 : The amount of the financial penalty provided for in
this article is proportionate to the seriousness of the breaches
committed and the benefits derived from this breach.
During the first breach, it cannot exceed
98,400,000 CFA francs. In the event of a recurrence within five
years from the date on which the financial penalty
previously pronounced has become final, it cannot
exceed 300,000,000 CFA francs or, in the case of a

Page 16
24 to 31 OCTOBER 2011 - N ° 74

505

OFFICIAL JOURNAL OF THE GABONESE REPUBLIC

company, 5% of the turnover excluding tax of the last
year ended within the limit of 196,000. 000 CFA francs.
When the National Commission for the Protection
personal data has imposed a sanction
pecuniary become final before the criminal judge has ruled
definitely on the same or related facts,
the latter may order that the financial penalty be charged to
the fine he pronounces.
Financial penalties are collected as
State tax claims.
Article 106 : The National Commission for the Protection of
personal data can exercise the powers
provided for in article 102 above and in article 112 below at
with regard to processing operations whose transactions are
works, in whole or in part, on the national territory, including
when the controller is established in the territory
from another state.
Article 107 : The National Commission for the Protection of
personal data may, at the request of a
authority exercising powers similar to its own in
another State, carry out checks in the same
conditions, according to the same procedures and under the same
sanctions than those provided for in article 105 above, unless
this is a treatment mentioned in article 55.
The Commission is empowered to communicate
information that it collects or holds, to their
asks the authorities exercising similar powers
to its own in other states.
Article 108 : Sanctions and decisions taken by the
National Commission for Data Protection at
personal character are subject to appeal before the
Board of state.
Chapter VIII: Penal provisions

personal character of all prosecutions relating to
offenses against the Penal Code and the consequences given to them.
He informs him of the date and purpose of the judgment hearing
by registered letter sent at least ten days before
this date.
The investigating or trial court may
call the President of the Commission or his representative to
file observations or develop them orally at
the audience.
Chapter IX: Miscellaneous and final provisions
Article 112 : Regulatory texts, adopted after notice of the
National Commission for Data Protection at
personal character, set the terms of application of the
this law.
Article 113 : This law will be registered, published according to the
emergency procedure and execute as state law.
Done in Libreville, September 25, 2011
By the President of the Republic,
Head of state
Ali BONGO ONDIMBA
The Prime Minister, Head of Government
Paul BIYOGHE MBA
The Minister of the Interior, Public Security,
Immigration and Decentralization
Jean Francois NDONGOU
The Minister of Health, Social Affairs, Solidarity
and family
Flavien NZENGUI NZOUNDOU
The Minister of National Defense
Pacôme Rufin ONDZOUNGA

Article 109 : The offenses, contained in this law,
are planned and punished in accordance with the provisions of
this law and the Penal Code.

The Minister of Budget, Public Accounts and Public Service
Public, in charge of State Reform
Emmanuel ISSOZE NGONDET

Article 110 : Is punished by a term of imprisonment of six
(6) months to one (1) year and a fine of one (1) to ten (10)
million CFA francs hindering the action of the
National Commission for Data Protection at
personal character either in:
- opposing the exercise of the missions entrusted to its
members or authorized agents pursuant to the last
paragraph of Article 27 above;
- refusing to communicate to its members or agents
empowered in application of article 27 above
information and documents useful for their mission, or
concealing such documents or information, or by
making it disappear;
- communicating information that is not in conformity
the content of the recordings as they were at the time
the request has been made or who do not present this
content in a directly accessible form.

The Minister of Communication, Post and
Digital Economy
Paul NDONG NGUEMA
_______

Article 111 : The Public Prosecutor notifies the President
from the National Commission for Data Protection to

Organic law n ° 009/2011 of September 25, 2011
amending and supplementing certain provisions of the law
organic n ° 9/91 of September 26, 1991 on the Court
Constitutional
PARLIAMENT DELIBERATES AND ADOPTS;
THE CONSTITUTIONAL COURT HAS DECLARED
COMPLIANT WITH THE CONSTITUTION;
THE PRESIDENT OF THE REPUBLIC, HEAD OF
THE STATE, PROMULATES THE LAW OF WHICH
CONTENT FOLLOWS:
Article 1 st : This order, adopted under
provisions of Articles 47, 52 and 93 of the Constitution,

