MAURITIUS Law and Practice Contributed by: Sameer K. Tegally, Sonia Xavier and Ashvan Luckraz, Venture Law
or processor not established in Mauritius but using equipment in Mauritius for processing personal data of Mauritian residents. In other words, the Act not only applies to organisations located within Mauritius but also to organisations located outside Mauritius if they offer goods or services to, or monitor the behaviour of, Mauritian data subjects. Within that framework, the Act imposes an obligation on such foreign controllers and processors to explain to Mauritian data subjects how their personal data will be processed, give details on the purposes of the processing and inform them of the right to withdraw their consent at any point in time. 8.3 Role and Authority of the Data Protection Agency The Act has established the DPO in Mauritius, which is empowered to act with complete independence and impartiality. The main roles and functions of the DPO are to ensure compliance with the Act, issue codes of practice and guidelines, maintain a register of controllers and pro - cessors, investigate complaints and co-operate with supervisory authorities of other countries. The DPO is headed by the commissioner, who is given wide powers under the Act to: • carry out periodical audits of information systems and security measures used by data controllers or processors; • exercise control of all data processing operations, either of his/her own motion or at the request of data subjects; • promote self-regulation among controllers and processors; • undertake research into, and monitor develop - ments in, data processing, and ensure that there is no significant risk or adverse effect of any develop - ments on the privacy of individuals; • examine any proposal for automated decision- making or data linkage that may involve interfer - ence with, or otherwise have an adverse effect on, the privacy of individuals and ensure that any adverse effect of the proposal on the privacy of individuals is minimised;
• investigate any complaint or information that gives rise to a suspicion that an offence may have been, is being or is about to be committed under the Act; • order any person to attend a hearing at a speci - fied time and place for the purposes of being orally examined in relation to a complaint; • apply to the judge in chambers in the Supreme Court for a preservation order where they believe the data is vulnerable to loss or modification; • enter and search any premises with a warrant issued by a magistrate for the purpose of discharg - ing any functions or exercising any powers under the Act; • serve an enforcement notice when they believe that a data controller or processor has contravened, is contravening or is about to contravene the provi - sions of this Act, requiring them to take such steps within such periods as may be specified in the notice; and • take such measures as may be necessary to bring the provisions of the Act to the knowledge of the general public. The registration as a controller or processor with the DPO will be for a period not exceeding three years, and on the expiry of such period, the relevant entry will be cancelled unless the registration is renewed within three months of expiry of the licence. Any controller who knowingly supplies false infor - mation while applying for registration will commit an offence and shall, on conviction, be liable to a fine of up to MUR100,000 and to imprisonment for a term of up to five years. Any person or organisation who fails to attend a hear - ing or to produce a document when required to do so shall be liable to a fine of up to MUR50,000 and, in the case of a person, to a term of imprisonment of up to two years. Additionally, in order to enforce the rules established under the Act, the commissioner of the DPO has been empowered with enhanced powers with regard to the handling of complaints, such as the power to call the parties and encourage an amicable resolution of the dispute wherever possible. Any person who considers themselves aggrieved by the decision of the commissioner may, within 21 days
664 CHAMBERS.COM
Powered by FlippingBook