Handles health records, in Lebanon

Law No. 81/2018, Arts. 102 and 106 to 109 (penal provisions and the court remedy), with the Ministry of Economy and Trade's role under Arts. 95 to 98 · Read the law's page

• Deal with the Ministry of Economy and Trade for a permit and with the Minister of Public Health, the Minister of Justice, or the Minister of National Defence and the Minister of Interior and Municipalities for a licence: Law 81/2018 creates no independent data protection authority.
• Expect a fine of one million to thirty million Lebanese Pounds and imprisonment of three months to three years, or one of those two penalties, for processing personal data without a filed permit or a prior licence, for collecting or processing it outside the Section II rules, or for disclosing personal data under processing to unauthorized persons, even negligently.
• Expect a fine of one million to fifteen million Lebanese Pounds for refusing to answer a person's access or correction request within ten working days, or for answering it incorrectly or imperfectly.
• Expect both fines and prison terms to rise by one third to one half where the act recurs.
• Expect the owner of the personal data, or any of their heirs, to bring you before the competent courts, in particular the Magistrate of Summary Justice, to compel the right of access and correction.
• Note that prosecution for disclosing data to unauthorized persons and for refusing an access or correction request starts only on the complaint of the injured party, and ends if that party waives the personal right before the judgment becomes final.

Law No. 81/2018, Arts. 91 and 97(3) (health, genetic identity and sexual-life data) · Read the law's page

• Do not collect or process data that reveals, directly or indirectly, the health status, genetic identity or sexual life of a person in Lebanon.
• Rely on one of the four exceptions only: the person made the data public or explicitly agreed to the processing and no legal impediment applies, the processing is necessary to establish a medical diagnosis or provide medical treatment by a healthcare professional, a right is being proved or defended before a court, or you hold a licence under Article 97.
• Apply to the Minister of Public Health for that licence before processing health, genetic-identity or sexual-life data, and treat silence for two months from the application as a refusal.
• Treat a voiceprint, a faceprint or any other biometric identifier as ordinary personal data under the Article 95 permit rule: Lebanon's special-category list names only health status, genetic identity and sexual life, and the act sets no heightened biometric standard.
• Treat a child's personal data as ordinary personal data as well, since the act sets no age threshold, no parental-consent rule and no children's design duty.