Processes personal data, in Lebanon

Law No. 81, Official Gazette of Lebanon, promulgated 10 October 2018 (in force 31 March 2019), Arts. 85, 87, 90, 93 to 98 and 103 to 105 (Part V, Personal Data Protection), with the definitions in Article One and the provider retention duties in Arts. 72 and 74 · Read the law's page

• File a permit with the Ministry of Economy and Trade, issued against a receipt, before collecting or processing the personal data of a person in Lebanon, unless one of the exemptions in Article 94 covers the processing.
• State in that permit the objectives of the processing, the personal data and its source, the categories of persons concerned, the third parties who may view the data, the retention period, your identity and address and those of your representative if you live outside Lebanon, the agency carrying out the processing, who exercises the right of access and how, any subcontractor, and the measures you take to keep the data intact.
• Obtain a ministerial licence before processing personal data on the internal or external security of the State or on penal offences and judicial proceedings, and treat no answer within two months of the application as a refusal.
• Collect personal data faithfully and for legitimate, specific and explicit purposes, keep it appropriate to and within those purposes, correct, complete and as relevant as possible, and do not later process it for purposes out of line with the objectives you stated, except for statistical, historical or scientific research.
• Retain personal data only for the period stated in the declaration of processing or in the decision authorizing it.
• Take all measures, in light of the nature of the data and the risks of processing it, to keep the data intact and secure and to protect it against distortion, damage and access by unauthorized persons.
• Do not rely on a contract clause, an agreement or a unilateral undertaking that contravenes Part V: none of them may be invoked against the rights of the persons concerned or against your own obligations.
• As a network service provider or data host, keep the traffic data of everyone using your service, the data that identifies them and the other technical data of their communications for three years from the service delivery date, keep it under professional secrecy, and produce it to the judicial police or the court when the competent judicial authority so decides.
• As a data host, store for ten years the identification data of a non-professional who makes information available online to the public anonymously.
• Expect the Ministry of Economy and Trade to publish your permit or licence, its date, the name and purpose of the processing, your identity and address, the categories of personal data processed and the third parties authorized to view them on a public list on its website.

Law No. 81/2018, Arts. 102 and 106 to 109 (penal provisions and the court remedy), with the Ministry of Economy and Trade's role under Arts. 95 to 98 · Read the law's page

• Deal with the Ministry of Economy and Trade for a permit and with the Minister of Public Health, the Minister of Justice, or the Minister of National Defence and the Minister of Interior and Municipalities for a licence: Law 81/2018 creates no independent data protection authority.
• Expect a fine of one million to thirty million Lebanese Pounds and imprisonment of three months to three years, or one of those two penalties, for processing personal data without a filed permit or a prior licence, for collecting or processing it outside the Section II rules, or for disclosing personal data under processing to unauthorized persons, even negligently.
• Expect a fine of one million to fifteen million Lebanese Pounds for refusing to answer a person's access or correction request within ten working days, or for answering it incorrectly or imperfectly.
• Expect both fines and prison terms to rise by one third to one half where the act recurs.
• Expect the owner of the personal data, or any of their heirs, to bring you before the competent courts, in particular the Magistrate of Summary Justice, to compel the right of access and correction.
• Note that prosecution for disclosing data to unauthorized persons and for refusing an access or correction request starts only on the complaint of the injured party, and ends if that party waives the personal right before the judgment becomes final.

Law No. 81/2018, Arts. 86, 88, 89, 92, 99 to 101, 103, 105 and 32 (notice, objection, access and correction) · Read the law's page

• Tell the people you collect personal data from who you are or who your representative is, what the processing is for, whether answering is mandatory or optional, what follows from not answering, who the data will be sent to, and that they may access and correct it, and print that statement explicitly and clearly on the collection form itself.
• Where you did not collect the data from the person, tell them personally and explicitly what the data contains, what the processing is for and that they may object to it, unless they already know or telling them is impossible or takes an effort out of proportion to the benefit.
• Let a person object, for legitimate reasons, to the collection and processing of their personal data, including processing for commercial promotion, unless the law obliges you to collect it or they have already agreed to the processing.
• Let a person review and object, before the person responsible for processing, to the information and analyses used in the automated processing relating to them that is invoked against them.
• Answer a person's or their heir's question about whether their data is being processed, and give them a copy of the data at their request, in an understandable form where it is encoded, compressed or encrypted.
• Give, on the same request, the purposes, categories, source, subject and nature of the processing, the persons and categories of persons the data is sent to or who can access it, and the timing and purposes of that access.
• Charge no more than the cost of copying for that copy, and, if you refuse a request as arbitrary, repetitive or systematic, be ready to carry the burden of proving that it is.
• Correct, complete, update or erase personal data that is incorrect, incomplete, ambiguous, expired or incompatible with the purposes of processing, free of charge and within ten days of the request, and prove that you did it.
• Notify every third party the data was sent to of an amendment made at the request of its owner or their heirs, and make the same correction on your own initiative as soon as you learn of a reason to modify or cancel the data.
• Do not inform a person of processing that relates to the internal or external security of the State where informing them may endanger the objectives of the processing or that security.
• Mark an online promotional advertisement as a promotional advertisement and name the person it was placed for, send no unsolicited marketing email to a real person's name and address without their consent unless you obtained the address lawfully through a previous engagement with them, and put in every marketing email a reply address through which the recipient can ask to stop receiving them permanently and free of charge.
• Expect Articles 99, 100 and 101 not to reach processing carried out solely for literary or artistic expression or for the professional exercise of journalism, within the limits of the laws in force.

Law No. 81/2018, Arts. 91 and 97(3) (health, genetic identity and sexual-life data) · Read the law's page

• Do not collect or process data that reveals, directly or indirectly, the health status, genetic identity or sexual life of a person in Lebanon.
• Rely on one of the four exceptions only: the person made the data public or explicitly agreed to the processing and no legal impediment applies, the processing is necessary to establish a medical diagnosis or provide medical treatment by a healthcare professional, a right is being proved or defended before a court, or you hold a licence under Article 97.
• Apply to the Minister of Public Health for that licence before processing health, genetic-identity or sexual-life data, and treat silence for two months from the application as a refusal.
• Treat a voiceprint, a faceprint or any other biometric identifier as ordinary personal data under the Article 95 permit rule: Lebanon's special-category list names only health status, genetic identity and sexual life, and the act sets no heightened biometric standard.
• Treat a child's personal data as ordinary personal data as well, since the act sets no age threshold, no parental-consent rule and no children's design duty.

Law No. 81/2018, Arts. 96(12) and 98(8) (transfer of personal data to another State) · Read the law's page

• Declare in the permit you file with the Ministry of Economy and Trade any transfer of personal data to another State, in any form, that the processing involves.
• Keep that declaration accurate for the life of the processing, because the Ministry publishes the personal data intended for transfer to a foreign State against your entry on its public list.
• Note what Lebanon does not ask for: no adequacy finding, no standard contractual clauses, no binding corporate rules, no separate consent to the transfer, no prior ministerial approval and no duty to keep Lebanese personal data on a server in Lebanon.