The National Data Protection Agency ('APD') announced, on 3 January 2023, that it had issued a decision in which it fined Africell Global Holdings Ltd $150,000 for violations of the Law No. 22/11 on the Protection of Personal Data ('the Law'). 

Background to the case

In particular, the APD outlined that the decision follows an investigation into the data processing practices of Africell. Moreover, the APD detailed that Africell collected various categories of personal data, such as the name of the data subject, telephone number, address, gender, age, interests, credit or debit card details, bank details and other payment information, interests and preferences, location data, and identification documents.

Findings of the APD

Further to the above, the APD stated that Africell violated the duty to notify and request prior authorisation from the APD for the processing of its customers' personal data.

Outcome

In view of the above findings, the APD decided to fine Africell the amount of $150,000, having considered the following mitigating factors:

• Africell's manifest and immediate intention to comply with the Law; 
• that Africell did not have a history related to committing violations of data protection rules; and
• that Africell did not taken any economic advantage from the situation and having offered prompt cooperation with the APD.

You can read the press release, only available in Portuguese, here.