Law 08-17, Legislation for Personal Privacy in Algeria

The law No. 18-07 dated 10 June 2018 on the protection of individuals in the processing of personal data, also known as Law 18-07 for short, is an Algerian data privacy law that was recently passed in 2018. Law 18-07 establishes the legal framework for the collection, processing, use, and disclosure of personal data with respect to data processing activities, in a manner similar to that as other data privacy laws that have been passed in Africa in recent years, such as Togo’s Law No. 2019-014 Relating to the Protection of Personal Data and Zimbabwe’s Cybersecurity and Data Protection Bill of 2019. Furthermore, Law 18-07 also outlines the punishments that data controllers and processors operating with Algeria stand to face should they fail to comply with the law.

What is the scope and application of Law 18-07?

In terms of the scope and application of the law, “Law 18-07 applies to the automated processing (in whole or in part) of personal data, as well as to the nonautomated processing of personal data contained or to be included in manual files.” Moreover, as it pertains to the territorial application of the law, Law 18-07 is applicable to the following types of data processing:

• Data processing that is “carried out by a natural or legal person whose head is established in Algeria or in the territory of a State whose legislation is recognized as equivalent to the Algerian legislation on the protection of personal data.”
• Data processing that is carried out “when the personal data controller is not established in Algeria but uses, for the purpose of processing personal data, automated or nonautomated means, located in Algeria (excluding processing used for transit purposes in Algeria).”

What are the responsibilities of data controllers and processors under Law 18-07?

Much like the European Union’s landmark General Data Protection Regulation or GDPR, Algeria’s Law 18-07 mandates that data controllers and processors operating within the country adhere to a variety of principles when collecting or processing personal data. These principles include:

• All personal data that is collected or processed must be treated lawfully and fairly.
• Personal data may only be collected or processed for explicit, legitimate, and specific purposes, and may not be further processed for any reason other than those that are compatible with such purposes.
• All personal data that is collected or processed must be relevant, adequate, and non-excessive in relation to the purposes for which said data was collected or processed.
• All personal data that is collected or processed must be complete, accurate, and updated whenever necessary.
• All personal data that is collected or processed must be “kept in a form permitting the identification of the persons concerned for a period not exceeding that necessary to achieve the purposes for which they were collected or processed.”
• Data controllers and processors are responsible for ensuring that all personal data in their possession remains confidential and secure at all times.
• Data controllers and processors are required to register “on a national data protection register kept by the national authority.”

What are the rights of Algerian citizens under Law 08-17?

Under Law 08-17, Algerian citizens have the following rights data privacy rights:

• The right to prior information.
• The right to access.
• The right to rectification.
• The right to opposition.
• The right of withdrawal.

In terms of punishments with respect to non-compliance, data controllers and processors within Algeria who violate the provisions of Law 08-17 are subject to a variety of sanctions. Such sanctions include “a fine of up to one million dinars for violations of packaging requirements, date of manufacture, expiry date, method of use, etc.”, as well as various terms of imprisonment. What’s more, Law 08-17 is enforced by Alegria’s National Authority, who also have the power to “carry out on-site investigations in the premises where the processing took place and may, for the performance of its duties, access the processed data and any information and documents regardless of their medium.”

The issues of data protection and personal privacy have become increasingly more important due to the rise of internet communications. As such, Algeria has addressed these issues through the passing of law No. 18-07 dated 10 June 2018 on the protection of individuals in the processing of personal data, as the law creates a legal precedent that Algerian citizens can take advantage of should their personal data be misused or mishandled. Through the passing of such legislation, Algerian citizens can rest assured that their personal data is in good hands when they are engaging in business activities and other related transactions within their country.