1. Data Protection and You Your Rights & The Law Registration Basics Other Activities Disclaimer: This presentation only provides an introductory info. Please consult the Data Protection Office for further queries.

2. How does data protection concern me? And why it matters?

3. W o u l d y o u h a v e t h o u g h t t h a t … t h e s e d i g i t a l c o d e s m i g h t r e p r e s e n t I N F O a b o u t Y O U ! ! ! Data Protection & You

4. Bank Data Protection & You

5. Personal Sensitive Data Data Protection & You

7. Name Address Telephone Data Protection & You

8. Sensitive Racial/Ethnic Origin Political Opinion / Adherence Religious / Similar Belief Membership to Trade Union Physical / Mental Health Sexual Preferences / Practices Criminal Convictions Data Protection & You

9. Did You Know More than 50 countries have Laws related to International Data Privacy*. * http://www.informationshield.com/intprivacylaws.html Data Protection & You

10. Did You Know Identity theft cases and data breaches are increasing worldwide*. * http://www.identitytheft.info Data Protection & You

11. TRUE or FALSE? Are data breaches also prevalent in Mauritius? Data Protection & You

12. You might be the next Victim, so it is important to know what Data Protection is about… Data Protection & You

14. As individuals, you should have control over your personal data. Your Rights & The Law

15. Enacted in 2004, Proclaimed in 2009. DPA provides a legal framework to ensure that your personal information is handled properly. Your Rights & The Law

16. But… Who Holds Info about Me? Your Rights & The Law

18. Data Controllers are: People who decide how to use personal data of living individuals A medical practitioner Human Resource Manager A sports club manager A public librarian Your Rights & The Law

19. Can data controllers do anything with my personal info??? Your Rights & The Law

20. The Data Protection Office (DPO) enforces the provisions of the Data Protection Act Mission of DPO: Safeguard the privacy rights of all individuals with regard to the processing of their personal data. Your Rights & The Law

21. Data Protection Commissioner 201 3604 Investigative Unit 201 3990 Finance Unit 201 3991 IT Database Unit 201 3963 Administrative Unit 201 3962 Your Rights & The Law

22. Register all data controllers and data processors in Mauritius Conduct periodical security checks and data protection compliance audits Research on data processing & computer technology Investigate Complaints Exercise control on all data protection issues Your Rights & The Law

23. 1.Fairly and lawfully processed. 2.Collected for specified & lawful purpose/s. 3.Adequate, relevant and not excessive. 4.Accurate. 5.Not kept longer than necessary. 6.Processed in accordance with data subjects rights. 7.Secure. 8.Not transferred to countries without adequate data protection law. Data collected must be: Your Rights & The Law

25. How do I register as a data controller? 1 for Employee 1 for Non-Employee Non-employee is any personal information pertaining to clients/suppliers/creditors/debtors/shareholders/board of directors (non-salaried) or any other categories of persons who are not employees, e.g subcontractors Registration Basics

26. Online Registration at http://dataprotection. gov.mu http://dataprotection. gov.mu 1. Log-in with your Username and password Note: for 1 st time users, a user account must be created using the guidelines online 2. Complete 2 separate forms & submit online 3. Await validation from DPO 4. Make payment at DPO Get a copy of the application form at http://dataprotection. gov.mu http://dataprotection. gov.mu or at the DPO 1. Fill in 2 separate forms 2. Validate application forms at DPO 3. Make payment at DPO

27. Section 1 - Provide details about the organisation: public/private organisations, professionals, sole traders, partnerships, societes, etc... Section 2 – Provide details of a contact person Section 3 – List down only the TYPE of information and NOT the data being held for: (1)employee in the employee form and (2)non-employee in the non-employee form Note: ‘Name’ is a type but ‘John’ is the data. For registration purposes, only specify the type, i.e ‘Name’ Section 4 – Fill in for any sensitive data being held Section 5 – Describe nature of business Section 6 - Fill in for any disclosure to entities e.g National Pension Fund Section 7 – Fill in for any transfer of data abroad Section 8 – Confirm if information is disclosed to public Registration Basics

28. Make payments for BOTH forms. Payment for non-employee form will bear the same amount as the employee form. First time registrations for: Above 25 employees = Rs 2000 for employee + Rs 2000 for non-employee 1-25 employees = Rs 1000 for employee + Rs 1000 for non-employee Zero employee = Rs 800 for non-employee Registration Basics

29. Registrations have to be renewed annually by filling both employee and non-employee application forms with respective payments. Renewal fees for: Above 25 employees = Rs 1750 for employee + Rs 1750 for non-employee 1-25 employees = Rs 750 for employee + Rs 750 for non-employee Zero employee = Rs 550 for non-employee Registration Basics

31. Other Activities

32. Who can make a complaint to the Data Protection Office? Any individual who feels that the privacy rights with regard to his/her personal data may have been affected. Other Activities

33. 1. Download and fill in a complaint form available on the Data Protection Office website. 2. Investigation is carried out on complaint unless complaint is of frivolous or vexatious nature. 3. Commissioner notifies complainant of the decision which has been taken. 4. Complainant can appeal to ICT tribunal if he/she is not satisfied with the decision. Other Activities

35. 1. Download and fill in a Request for Access form found on the Data Protection Office website. 2. Submit the form along with a payment of Rs 75 to the data controller from whom the information is being requested. 3. Data controller must comply with a request not later than 28 days after receipt of request. Other Activities

36. Data Protection Act Enacted in 2004, proclaimed in 2009 D P O Data Protection Office Data Personal and Sensitive information Complaint Form Available from DPO Website Registration For both employee and non-employee Other Activities

37. Is the Data Protection Office a public one? Yes. Other Activities

38. What can the Data Protection Office do when a data controller contravenes the Data Protection Act? The Commissioner may serve an enforcement notice requiring the data controller to take steps and implement measures within a specified period of time. Other Activities

39. Is it an offence not to comply with the enforcement notice? Yes. Any person who does not comply with the enforcement notice and does not have a reasonable excuse for not complying, will commit an offence, the penalty of which will be a fine not exceeding Rs 50,000 and imprisonment not exceeding 2 years. Other Activities

40. DATA PROTECTION OFFICE 4 th Floor, Emmanuel Anquetil Building, Port Louis Website: http://dataprotection.gov.mu Telephone: 201 3962, 201 2182

41. http://templateswise.com http://www.infotheft.info http://www.linkedin.com http://www.facebook.com http://office.microsoft.com http://www.iconarchive.com http://dataprotection.gov.mu http://www.informationshield.com