3. States shall ensure, in relation to the processing of a person’s personal information, that the person has the rights to: a. b. c. d. be informed in detail about the processing; access personal information that has been or is being processed; object to the processing; and rectify, complete or erase personal information that is inaccurate, incomplete or prohibited from collection, use, disclosure or storage. 4. Every person shall have the right to exercise autonomy in relation to their personal information by law and to obtain and reuse their personal information, across multiple services, by moving, copying or transferring it. 5. Any person whose personal information has been accessed by an unauthorised person has the right to be notified of this fact within a reasonable period and of the identity of the unauthorised person, unless such identity cannot be established. 6. The harmful sharing of personal information, such as child sexual abuse or the non-consensual sharing of intimate images, shall be established as offences punishable by law. 7. Every individual shall have legal recourse to effective remedies in relation to the violation of their privacy and the unlawful processing of their personal information. 8. Oversight mechanisms for the protection of communication and personal information shall be established by law as independent entities and include human rights and privacy experts. Part V: Implementation Principle 43. Implementation 1. States shall adopt legislative, administrative, judicial and other measures to give effect to this Declaration and facilitate its dissemination. 2. When States review or adopt legislation on access to information, they shall be further guided by the African Commission’s Model Law on Access to Information for Africa. 3. When States adopt measures related to elections, they shall be further guided by the African Commission’s Guidelines on 27