There is no obligation for such a special case, but in general the data controller
should be accountable according to paragraph 14 OECD Privacy Framework, which
can include sanctions because of data breaches, as explained in the explanatory
memorandum for paragraph 14 OECD Privacy Framework. In addition to that,
personal data should be protected against risks such as unauthorized access, paragraph 11 OECD Privacy Framework.
Furthermore, article 27 ECOWAS Privacy Framework defines the principle of
transparency, which implies that the data controller is obliged to provide information
about the processing of personal data.
3 Data Protection in the Electronic Communications Sector
3.1 Specific Legal Rules and Case Law Regarding
the Electronic Communications Sector
The UN Guidelines for the Regulation of Computerized Personal Data Files contain
different principles regarding the processing of personal data files. They provide
minimum guarantees as
• the principle of lawfulness and fairness: collecting and processing data should not
be unfair or unlawful and data should not be used for ends contrary to the Charter
of the United Nations,
• the principle of accuracy: obligations to check accuracy and relevance,
• the principle of purpose-specification, and
• the principle of non-discrimination.
Those principles involve the processing of computerized personal data files not
only in the electronic communications sector, but in general.
Other legislations such as the Supplementary Act or the OECD Privacy Framework do not contain any particular rules.
3.1.1 Implementation of Security Measures by the Electronic
Communications Providers
The UN Guidelines’ Principle of Security (No. 7) requires appropriate measures in
order to protect personal data against accidental loss, destruction, unauthorized
access, fraudulent misuse or contamination by computer viruses.
UN Regulations
535
should be accountable according to paragraph 14 OECD Privacy Framework, which
can include sanctions because of data breaches, as explained in the explanatory
memorandum for paragraph 14 OECD Privacy Framework. In addition to that,
personal data should be protected against risks such as unauthorized access, paragraph 11 OECD Privacy Framework.
Furthermore, article 27 ECOWAS Privacy Framework defines the principle of
transparency, which implies that the data controller is obliged to provide information
about the processing of personal data.
3 Data Protection in the Electronic Communications Sector
3.1 Specific Legal Rules and Case Law Regarding
the Electronic Communications Sector
The UN Guidelines for the Regulation of Computerized Personal Data Files contain
different principles regarding the processing of personal data files. They provide
minimum guarantees as
• the principle of lawfulness and fairness: collecting and processing data should not
be unfair or unlawful and data should not be used for ends contrary to the Charter
of the United Nations,
• the principle of accuracy: obligations to check accuracy and relevance,
• the principle of purpose-specification, and
• the principle of non-discrimination.
Those principles involve the processing of computerized personal data files not
only in the electronic communications sector, but in general.
Other legislations such as the Supplementary Act or the OECD Privacy Framework do not contain any particular rules.
3.1.1 Implementation of Security Measures by the Electronic
Communications Providers
The UN Guidelines’ Principle of Security (No. 7) requires appropriate measures in
order to protect personal data against accidental loss, destruction, unauthorized
access, fraudulent misuse or contamination by computer viruses.
UN Regulations
535