Polyclinique FARAH
Warning + formal notice; extra-ecowas transfers held illegitimate; 60 days to cure. ARTCI (Autorité de Protection), 13 September 2023.
The facts
A control of the Polyclinique FARAH found that patient and employee data handled in its business software could be accessed from France for maintenance, constituting a transfer of personal data to a third country, with the transferred data unidentified in the documents provided and the data shared with processors not communicated to the Autorite de Protection. The clinic had also not completed the conformity and authorisation steps the law requires for identifier processing.
Orders and outcome
The Autorite de Protection issued a warning for non-compliance with the data protection law, a formal notice to correct all observed non-conformities within sixty days of receiving the decision, and a formal notice to bring itself into conformity with the law within the same period, failing which one of the sanctions provided by the law would be pronounced. Sworn agents were directed to verify compliance. Dated 13 September 2023.
Cite this decision
Track Côte d'Ivoire enforcement
Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.