Société Quipux Afrique SA
Warning + formal notice; cloud transfers held illegitimate; 60 days to cure. ARTCI (Autorité de Protection), 23 August 2023.
The facts
A control of Quipux Afrique SA found identifier processing that had never been authorised, prescriptions from three 2021 avis of the Autorite de Protection left unapplied, and data transfers to a technology platform hosted on the AWS cloud and to the IBM WATSON platform used as an artificial-intelligence engine, none of which had processing authorisation. The data collected by those platforms had not been identified, nor had the destination countries been established, and the company had not completed the conformity process required by the law.
Orders and outcome
The Autorite de Protection issued a warning for non-compliance with the data protection law, a formal notice to cease the observed breaches within sixty days of receipt, a formal notice to bring itself into conformity with the law within the same period, and a formal notice to apply all prescriptions contained in the three 2021 avis. Non-compliance would expose the company to the sanctions provided by the law. Dated 23 August 2023.
Cite this decision
Track Côte d'Ivoire enforcement
Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.