Regulatory Alerts2020-02-28
Instruction No. 001-DDI/2020 amending and supplementing certain provisions of Instruction No. 001-DDI/2019 of October 2, 2019 implementing Law No. 2017-045 of February 15, 2018 governing Credit Information Bureaus
The Central Bank of Madagascar issued Instruction No. 001-DDI/2020 to amend Article 12 of its 2019 directive governing Credit Information Bureaus, mandating that supervised entities obtain free, informed, and explicit client consent before collecting, sharing, or using personal and credit data. The revised provisions require consent to be documented in writing or electronically with a "read and approved" notation, automatically covering future loans unless explicitly objected to, and extend to executive data of corporate clients. Supervised entities and Credit Information Bureaus must implement adequate staff training, verification controls, and AML/CFT and KYC due diligence to ensure compliant consent management.
CENTRAL BANK OF MADAGASCAR
DEPARTMENT OF DOCUMENTATION AND INFORMATION CENTERS
Instruction No. 001-DDI/2020 amending and supplementing certain provisions of Instruction No. 001-DDI/2019 of October 2, 2019 setting out the implementation procedures for Law No. 2017-045 of February 15, 2018 governing the activity and supervision of Credit Information Bureaus
The Governor of the Central Bank of Madagascar,
Having regard to Law No. 2014-038 of January 9, 2015 on the protection of personal data;
Having regard to Law No. 2016-004 of July 29, 2016, supplemented by Law No. 2016-057 of February 2, 2017, establishing the statutes of the Central Bank of Madagascar;
Having regard to Law No. 2017-018 of December 19, 2017 governing the Integrated Information System of the Central Bank of Madagascar;
Having regard to Law No. 2017-045 of February 15, 2018 governing the activity and supervision of Credit Information Bureaus;
Having regard to Decree No. 2019-2069 repealing the provisions of Decree No. 2014-1684 of October 29, 2014 on the appointment of the Governor of the Central Bank of Madagascar and the appointment of the Governor of the Central Bank of Madagascar;
Having regard to Instruction No. 001-DDI/2019 of October 2, 2019 setting out the implementation procedures for Law No. 2017-045 of February 15, 2018 governing the activity and supervision of Credit Information Bureaus;
DECIDES
Article 1.
This Instruction aims to amend the provisions of Article 12 of Instruction No. 001-DDI/2019 of October 2, 2019 setting out the implementation procedures for Law No. 2017-045 of February 15, 2018 governing the activity and supervision of Credit Information Bureaus;
Article 2.
The provisions of Article 12 of Instruction No. 001-DDI/2019 of October 2, 2019 setting out the implementation procedures for Law No. 2017-045 of February 15, 2018 governing the activity and supervision of Credit Information Bureaus are amended as follows:
« Article 12 (new). OBTAINING CONSENT
12.1. Supervised entities must obtain the free, informed, and explicit consent of their Client prior to any collection and use, sharing, and dissemination of personal data, including credit information.
12.2. Upon establishing a relationship with a natural person Client, supervised entities must specify the Client's consent in the account opening agreement with the account holder.
12.3. Without prejudice to the provisions of the preceding paragraph 12.2, the Client's consent is also obtained upon signing a credit grant agreement. Unless the Client expressly objects, the consent thus given covers all future loans granted by the supervised entity to the same Client.
12.4. The provisions of the preceding paragraphs apply to the data of natural persons holding executive or social management positions within a legal entity that is a client of a supervised entity.
12.5. The Client's consent, as the data subject, may take the form of:
- an independent written document, or included in another document such as a credit application or contract terms and conditions,
- an electronic document meeting legal validity requirements. It must clearly and explicitly highlight the Client's intention to share their personal data, credit history, solvency, and information related to value-added services with Credit Information Bureaus (CIBs) and their users. It must be signed by the Client and bear the notation "read and approved". A model consent clause is provided in ANNEX B.
12.6. CIBs and Supervised entities must ensure that their respective employees have been adequately trained and that required controls are in place to manage client consent.
12.7. Supervised entities are responsible for verifying the Client's identity when collecting consent by implementing necessary due diligence within the framework of AML/CFT and KYC procedures. »
Article 3.
This Instruction enters into force on the date of its signature.
Antananarivo, February 28, 2020
THE GOVERNOR HENRI EDMOND RABARIJOHN