Senegal: Data protection commission nails companies for non-compliance with regulations
In October 2022, the Senegalese Data Protection Commission (CDP) published its quarterly notice covering the period July-September 2022. Some actors are pinpointed for unfair treatment of their employees' data, others for fraudulent collection and use of personal data for prospecting purposes. Here is a look at some interesting cases dealt with by the Commission.
Unfair use of employees' data
Dakar Regional Express Train Operating Company (SETER): the CDP received a complaint from an employee of SETER regarding the geolocation of his vehicle without prior information. The CDP concluded from its investigation that SETER processes vehicle geolocation data to monitor employees' journeys and their presence at work. SETER received a formal notice for the following breaches:
failure to respect the data subject's right to prior information;
failure to comply with the obligation to declare the geolocation system to the CDP.
Total Energies Senegal : the CDP received a complaint from the Syndicat national des Travailleurs du Pétrole et Gaz du Sénégal regarding the installation of surveillance cameras in the cabins of Total Energies' fuel transport vehicles. The CDP enjoined Total Energies' subcontracted hydrocarbon transport companies to comply with the law on the protection of personal data and decided to organise an extended mediation meeting between the CDP, the National Union of Oil and Gas Workers, Total Energies' subcontracted hydrocarbon transport companies and Total Energies' general management.
Tje Brioche Dorée : the CDP received a warning from the College of Delegates of the Brioche Dorée regarding the installation of video surveillance systems that would violate their rights and privacy. The CDP ordered the Brioche Dorée to implement the following measures:
Formalise the exercise of data subjects' rights;
Put up posters with information on the presence of the video surveillance system;
Reset the image retention time to the time allowed by the CDP for declarations;
Do not film employees at their work position and remove cameras from offices;
Redirect the cameras that film the public highway;
Declare additional cameras not mentioned in the declarations made to the CDP;
Declare the other personal data processing operations carried out.
Collection and fraudulent use of personal data for marketing purposes
Sonatel: the CDP received a complaint from a private individual for receiving an unsolicited telephone call from an automatic telephone machine in the context of a Sonatel campaign to promote artists. Sonatel received a formal notice, as the CDP considered that the principle of prior consent had not been respected.
Political prospecting: the CDP received a report from an individual concerning the receipt of unsolicited direct political canvassing SMS. When contacted by the CDP, the politician who had sent the report indicated that he had contracted a service provider whose database, which consisted mainly of numbers collected during sponsorships, may have included the complainant's number. The CDP noted the following shortcomings:
- unlawful and excessive collection of personal data ;
- misuse of sponsorship data ;
- excessive data retention time.
The CDP issues a warning to the politician.
This quarterly report reveals two aspects: on the one hand, as the CDP points out, an increase in the number of complaints and reports, which translates into increased knowledge of their rights on the part of individuals; on the other hand, a great deal of dynamism on the part of the CDP, which announces in the conclusion of its report that its website will be overhauled, which will make it possible, in particular, for citizens to refer cases to its services directly
