Processes personal data, in the Republic of the Congo

Loi n° 26-2020 du 5 juin 2020 relative à la cybersécurité, articles 18 et 19 · Read the law's page

• Inform the agency in charge of the security of information systems and networks (defined in Article 3) without delay of any attack, intrusion or other disturbance likely to impede the operation of another information system or electronic communications network; the Law sets the clock as 'without delay' and states no hour limit (Article 18).
• Comply with the measures the agency decides in order to end those disturbances (Article 18).
• This binds every operator of an information system or an electronic communications network, whether a public body or a private organisation; the Law excludes the systems and networks used for national defence and security (Article 2).

Loi n° 26-2020 du 5 juin 2020 relative à la cybersécurité, articles 4 à 11 · Read the law's page

• Take adequate measures to protect against and prevent any risk to third parties arising from your use of information systems and networks (Article 4).
• Be accountable for the security of the systems and networks you develop, own, supply, manage, maintain or use, and continuously review and assess your own security policies, practices, measures and procedures to make sure they fit their environment (Article 4).
• Do everything possible to prevent, detect and respond to security incidents (Article 5).
• Exchange the information you hold on threats to and vulnerabilities of networks and systems in an appropriate manner, and put in place procedures for rapid and effective cooperation to prevent and detect security incidents (Article 6).
• Carry out risk assessments that cover the main internal and external factors, such as technology, physical and human factors, and the policies and services of third parties (Article 8).
• Design, implement and coordinate your information systems and networks to optimize their security, with technical and non-technical protective measures proportionate to the value of the information in them (Article 9).
• Base your security management on the risk assessment, covering every level of your activities and including responses to identifiable or foreseeable threats, the prevention, detection and resolution of incidents, system recovery, permanent maintenance, control and audit (Article 10).
• Guarantee the security of your systems and networks constantly as risks evolve, with continuous risk assessment and appropriate changes to your security policies, practices, measures and procedures (Article 11).
• This binds anyone, whether a citizen, a business, an organization or a public authority, that develops, owns, supplies, manages, maintains or uses an information system or network; the Law excludes the systems and networks used for national defense and security (Article 2).

Loi n° 29-2019 du 10 octobre 2019 portant protection des données à caractère personnel, articles 2, 3, 5 à 12, 31 à 45, 63 à 70 et 79 à 91 (champ d'application, principes, formalités préalables et obligations du responsable de traitement) · Read the law's page

• Obtain the data subject's consent before processing their personal data, unless a legal obligation, public-interest mission, vital-interest, or another statutory ground applies.
• File a prior declaration of processing with the national commission, unless the processing is exempt, requires the commission's prior authorization under article 37, or requires a presidential decree issued after the commission's opinion under article 40.
• Choose a processor offering sufficient technical and organisational security guarantees, govern the engagement by a written contract confining the processor to your instructions, and process personal data under your own or the processor's authority only on the controller's instructions.
• Keep processing confidential and take precautions appropriate to the data and the risk to preserve its security, including against unauthorised access, alteration or loss.
• Keep a written register of your processing activities and make it available to the national commission on demand, and cooperate with the commission when it asks.
• Carry out a data protection impact assessment before a type of processing likely to create a high risk to the rights and freedoms of natural persons, and designate a data protection officer where article 83 requires one.

Loi n° 29-2019, articles 23 à 25 (transfert transfrontalier de données à caractère personnel) · Read the law's page

• Do not transfer personal data to a country outside the Republic of the Congo unless it offers a sufficient level of protection for the privacy and fundamental rights and freedoms of the persons the data concerns, and inform the national commission of the transfer in advance.
• Rely on the article 24 derogation only for a one-off, non-massive transfer, and only where the data subject has expressly consented, or the transfer is necessary to protect that person's life, safeguard the public interest, allow the establishment, exercise or defence of a legal claim, or perform a contract between you and the data subject.
• Where the destination country does not offer a sufficient level of protection and no article 24 derogation applies, obtain the national commission's authorization for the transfer by showing sufficient guarantees for privacy, fundamental rights and freedoms, and the exercise of the corresponding rights.

Loi n° 29-2019, articles 4, 14 à 19 et 37 (catégories particulières de données et autorisation préalable) · Read the law's page

• Do not collect or process personal data revealing ethnic or regional origin, filiation, political opinions, religious or philosophical beliefs, trade union membership, sex life, genetic data, or a person's state of health, unless one of the article 15 grounds applies.
• Process genetic data itself only to verify a genetic link for a person's identification, or for the prevention or repression of a specific criminal offence, in the administration of proof in court.
• Process personal data relating to offences, convictions, or security measures only if you are a court, a public authority, a legal person managing a public service acting within its legal remit, or a legal auxiliary acting for the strict needs of a mission the law entrusts to it.
• Process personal data for health purposes only on one of the article 17 grounds, and collect health data from the data subject directly unless collecting it from another source is necessary for the processing's purpose or the data subject cannot supply it themselves.
• Obtain the national commission's prior authorization before processing personal data bearing on genetic data or health research, offence, conviction or security-measure data, or biometric data.

Loi n° 29-2019, articles 46 à 62 (droits de la personne concernée) · Read the law's page

• At collection, give the data subject your identity, the purposes and categories of data, the recipients, whether a reply is obligatory or optional and the consequences of not replying, their right to be removed from the file, their rights of access and rectification, the retention period, and any transfer envisaged to a third country.
• Answer a written access request with the information needed to know and contest the processing, confirmation of whether their data is processed, the data and its known origin, the purposes and categories of recipients, and any transfer envisaged to a third country.
• Give a data subject their personal data in a structured, commonly used, machine-readable format, and transmit it directly to another controller where technically possible.
• Let a data subject object to processing of their personal data on legitimate grounds, and tell them, before their data is first communicated to or used by a third party for prospecting, of their free right to object to it.
• Answer a request for rectification, completion, updating, blocking or erasure of inaccurate, incomplete, ambiguous, outdated or unlawfully processed personal data within one month of registering it, free of charge.
• Let a minor consent alone to processing of their personal data for an information-society service from age sixteen; below that age, take consent jointly from the minor and the holder or holders of parental authority, and write the information addressed to the minor in clear, simple terms.

Loi n° 29-2019, articles 74 à 78 (violation de données à caractère personnel) · Read the law's page

• Notify the national commission of a personal-data breach without undue delay and, where possible, within 72 hours of becoming aware of it, unless the breach is not likely to create a risk to the rights and freedoms of natural persons.
• Communicate the breach to the affected data subject without undue delay, in clear and simple terms, where it is likely to create a high risk to their rights and freedoms.
• As a processor, notify the controller of any personal-data breach without undue delay after becoming aware of it.
• Put in the notification to the commission the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned, the contact point, the likely consequences, and the measures taken or proposed to remedy it and mitigate its effects.

Loi n° 29-2019, articles 92 à 98 (sanctions administratives et pénales) · Read the law's page

• Expect the national commission to issue a warning, or a formal notice fixing a period to remedy a failure to meet the Law's obligations, before any sanction follows.
• Expect the commission, after adversarial procedure, to withdraw an authorization, ban processing for up to three months or permanently, order you to cease processing, or impose an administrative fine of one million to one hundred million CFA francs, where you do not comply with its formal notice.
• Expect the commission, in an emergency, to order the interruption of processing or the locking of data for up to three months, or a temporary or permanent prohibition, where the processing violates rights and freedoms.
• Expect the commission's sanctions and decisions to be open to appeal before the Supreme Court.