Law / 
Democratic Republic of the Congo
Digital Code, Title III, sensitive personal data and minors
Code du numérique, Titre III, arts. 195 à 199, 206 et 247 (catégories sensibles et mineurs)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Disclosure, Age verification
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, refugee or stateless status, trade union membership, sex life, or health, unless a statutory exception applies.NIST Privacy FrameworkCT.PO-P1
- Rely on the data subject's explicit consent, a manifestly public disclosure by the data subject, a vital interest, an important public interest, a public authority's public-interest mission, public-statistics legislation, or supervised preventive or occupational medicine as the only grounds for processing a prohibited special category of data.NIST Privacy FrameworkCT.PO-P1
- Where you cannot answer a request or a judicial or national-security requisition within the ordinary period, tell the requester the next day and answer within eight days at the latest.NIST Privacy FrameworkCT.PO-P3
- Designate by function the staff who may access special-category personal data, keep that list available to the Data Protection Authority, and bind those staff to confidentiality by a legal, statutory or contractual duty.NIST Privacy FrameworkPR.AC-P4
- Obtain the consent of the holder of parental responsibility before offering an information-society service directly to a minor, and verify, taking available technology into account, that the consent was given or authorized by that holder.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state
Logging duty
Article 196 requires a controller relying on consent to be able to demonstrate that the data subject consented, which cannot be shown without a consent record, and article 206 point 2 requires the list of categories of staff designated to access the sensitive data to be kept available to the Data Protection Authority. Article 247 requires the controller to verify parental consent for a minor, but names no record. Article 199 sets a two-day answer period for a judicial requisition and requires the controller to inform the Authority, which is a response duty and not a record the row codes.
- Kind
- Implicit
- As of
- Provision
- Code du numérique, Titre III, arts. 196 and 206(2)
- Trigger
- consent_or_optout
- personal_data_processing
What this law does
Article 195 prohibits processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, refugee or stateless status, trade union membership, sex life, or more generally a person's state of health, and lifts that prohibition only for data the data subject manifestly made public, the data subject's explicit consent to specific purposes, safeguarding vital interests where the data subject cannot consent, an important public interest, a public-interest mission carried out by or assigned by a public authority, execution of public-statistics legislation, and preventive or occupational medicine carried out under a health professional's supervision.
Further paragraphs the scan does not number require a controller unable to answer a data subject's request within the ordinary period to notify the requester by the next day and to answer within eight days at the latest, and let the Data Protection Authority correspond directly with a controller to obtain the information a judicial inquiry or a national-security investigation needs.
Article 206 requires a controller processing the categories this run of articles covers to designate, by function, the staff with access to the data, keep that list available to the Data Protection Authority, bind those staff to confidentiality by a legal, statutory or contractual duty, and state the legal basis for the processing whenever it informs the data subject or files its declaration.
Article 247 makes processing a minor's personal data for a direct offer of information-society services lawful only where the holder of parental responsibility over the minor has consented, and requires the controller to verify, taking available technology into account, that the consent was given or authorized by that holder.
Article 390 enters the ordinance-law into force on the date of its own promulgation, and it was signed at Kinshasa on by President Félix-Antoine Tshisekedi Tshilombo.
When LexLint raises it
When your app profile says your app handles health records, serves under-18s or processes personal data.
Back to the example · Lint your app
Page updated .