In compliance with the provisions of paragraph 3 of article 53 of Law nº. 22/11, of 17 June, the Board of Directors of the Angolan Data Protection Agency makes public that, through deliberations nº. 001, 002 and 003, dated April 30th and June 19th, respectively, the following entities were sentenced to pay a fine for violating personal data protection rules:
MAXAM - Companhia de Pólvoras e Explosivos de Angola, SA: It has been fined equivalent in AKZ to 150,000.00 USD (One Hundred and Fifty Thousand US Dollars) for illegally transferring the personal data of a national citizen to the United Kingdom and failing to comply with the obligation to notify APD of the processing of its employees' personal data.
Banco Comercial do Huambo: It has been fined equivalent in AKZ to 75,000.00 USD (Seventy-Five Thousand US Dollars) for failure to comply with the duty to implement appropriate technical and organizational measures to protect its customers' personal data, which facilitated the cyber attack on its IT infrastructure.
UNITEL, SA: It has been fined equivalent in AKZ to 75,000.00 USD (Seventy-Five Thousand US Dollars) for failure to comply with the duty to implement appropriate technical and organizational measures to protect the personal data of a national citizen, which resulted in the fraudulent change of ownership of her telephone number and personal identification data.
It should be noted that the penalty imposed on each of these entities corresponds to an extraordinary mitigation, due to the fact that, among other circumstances, they were readily willing to cooperate with APD in clarifying the facts, had no previous history of breaches of data protection rules and demonstrated a serious commitment to improving their internal processes and procedures, with a view to effectively protecting the personal data in their possession.
Finally, APD recalls that the protection of personal data is a fundamental right of citizens, guaranteed by the Constitution of the Republic of Angola and that it therefore encourages all those who feel they have been harmed to report it.
Data Protection Agency, in Luanda, on June 21st, 2024