Provides telecom services, in Lebanon

Law No. 81, Official Gazette of Lebanon, promulgated 10 October 2018 (in force 31 March 2019), Arts. 85, 87, 90, 93 to 98 and 103 to 105 (Part V, Personal Data Protection), with the definitions in Article One and the provider retention duties in Arts. 72 and 74 · Read the law's page

• File a permit with the Ministry of Economy and Trade, issued against a receipt, before collecting or processing the personal data of a person in Lebanon, unless one of the exemptions in Article 94 covers the processing.
• State in that permit the objectives of the processing, the personal data and its source, the categories of persons concerned, the third parties who may view the data, the retention period, your identity and address and those of your representative if you live outside Lebanon, the agency carrying out the processing, who exercises the right of access and how, any subcontractor, and the measures you take to keep the data intact.
• Obtain a ministerial licence before processing personal data on the internal or external security of the State or on penal offences and judicial proceedings, and treat no answer within two months of the application as a refusal.
• Collect personal data faithfully and for legitimate, specific and explicit purposes, keep it appropriate to and within those purposes, correct, complete and as relevant as possible, and do not later process it for purposes out of line with the objectives you stated, except for statistical, historical or scientific research.
• Retain personal data only for the period stated in the declaration of processing or in the decision authorizing it.
• Take all measures, in light of the nature of the data and the risks of processing it, to keep the data intact and secure and to protect it against distortion, damage and access by unauthorized persons.
• Do not rely on a contract clause, an agreement or a unilateral undertaking that contravenes Part V: none of them may be invoked against the rights of the persons concerned or against your own obligations.
• As a network service provider or data host, keep the traffic data of everyone using your service, the data that identifies them and the other technical data of their communications for three years from the service delivery date, keep it under professional secrecy, and produce it to the judicial police or the court when the competent judicial authority so decides.
• As a data host, store for ten years the identification data of a non-professional who makes information available online to the public anonymously.
• Expect the Ministry of Economy and Trade to publish your permit or licence, its date, the name and purpose of the processing, your identity and address, the categories of personal data processed and the third parties authorized to view them on a public list on its website.

Law No. 81/2018, Arts. 102 and 106 to 109 (penal provisions and the court remedy), with the Ministry of Economy and Trade's role under Arts. 95 to 98 · Read the law's page

• Deal with the Ministry of Economy and Trade for a permit and with the Minister of Public Health, the Minister of Justice, or the Minister of National Defence and the Minister of Interior and Municipalities for a licence: Law 81/2018 creates no independent data protection authority.
• Expect a fine of one million to thirty million Lebanese Pounds and imprisonment of three months to three years, or one of those two penalties, for processing personal data without a filed permit or a prior licence, for collecting or processing it outside the Section II rules, or for disclosing personal data under processing to unauthorized persons, even negligently.
• Expect a fine of one million to fifteen million Lebanese Pounds for refusing to answer a person's access or correction request within ten working days, or for answering it incorrectly or imperfectly.
• Expect both fines and prison terms to rise by one third to one half where the act recurs.
• Expect the owner of the personal data, or any of their heirs, to bring you before the competent courts, in particular the Magistrate of Summary Justice, to compel the right of access and correction.
• Note that prosecution for disclosing data to unauthorized persons and for refusing an access or correction request starts only on the complaint of the injured party, and ends if that party waives the personal right before the judgment becomes final.