26
AFI GUIDELINE NOTE ON DATA PRIVACY FOR DIGITAL FINANCIAL SERVICES
- Number of data subjects. - Turnover. - Risk of harm to data subjects e.g., on basis of discrimination or bias. - Use of new technologies for data processing, such as automated processing and profiling.
1.4. GUIDING PRINCIPLE: DEVELOP DP4DFS LEGAL FRAMEWORK KEY RECOMMENDATIONS: > Consider regional/international good practices relevant to DP4DFS. > Apply framework to both public and private entities. > Establish key definitions and concepts (see suggestions in Annex 3).
PILLAR 2: DATA CONTROLLER AND PROCESSOR OBLIGATIONS This Pillar sets out suggestions for the main obligations to be imposed on data controllers and data processors, including key data processing principles. 2.1 GUIDING PRINCIPLE: REQUIRE EFFECTIVE DP4DFS INTERNAL GOVERNANCE ARRANGEMENTS KEY RECOMMENDATIONS:
> Consider any exceptions that might apply, e.g., for data covered by other laws such as credit reporting or debt collection, for data processing permitted or required by another law or where there are overriding considerations such as national security.
• Require that data controllers:
> Provide a transitional period for industry to change processes and procedures and IT systems and to build public awareness.
- Ensure senior management/Board oversight of compliance with DP4DFS rules
> Develop public awareness campaign for new DP4DFS framework and related rights and responsibilities.
- Ensure employees and agents are trained and aware of DP4DFS rules - Develop and maintain documented policies and procedures consistent with DP4DFS rules
- Have adequate technological and organizational systems and resources > Mandate that internal audit function reviews compliance with all DP4DFS rules. > Require an annual independent assessment of compliance with DP4DFS rules.
2.2 GUIDING PRINCIPLE: ESTABLISH OVERARCHING DATA PROCESSING PRINCIPLES KEY RECOMMENDATIONS: > Make foundation implementation of proactive Privacy by Design principles that are set out in a policy, which is approved and monitored by governing body of the relevant entity and published on their website and possibly that of the DPA.64 > Set overarching obligation to ensure processing is always (regardless of consent) fair, lawful, and transparent. > Establish other data processing principles, including: - Processing limitation: require processing to be with consent unless it is strictly for purposes of DFS
64 See also World Bank Group. Digital ID and the Data Protection Challenge: Practitioner’s Note. 2019
