LexLint.ioBeta

Know the law your code answers to.

Law / Republic of the Congo

Law No. 29-2019, rights of the data subject

Loi n° 29-2019, articles 46 à 62 (droits de la personne concernée)

In force.

A data subject rights rule binding public and private bodies.

Obligation class
Data subject rights, Disclosure
Audit expectation
none

What it requires

  • At collection, give the data subject your identity, the purposes and categories of data, the recipients, whether a reply is obligatory or optional and the consequences of not replying, their right to be removed from the file, their rights of access and rectification, the retention period, and any transfer envisaged to a third country.NIST Privacy FrameworkCM.AW-P1
  • Answer a written access request with the information needed to know and contest the processing, confirmation of whether their data is processed, the data and its known origin, the purposes and categories of recipients, and any transfer envisaged to a third country.NIST Privacy FrameworkCT.DM-P1
  • Give a data subject their personal data in a structured, commonly used, machine-readable format, and transmit it directly to another controller where technically possible.NIST Privacy FrameworkCT.DM-P2
  • Let a data subject object to processing of their personal data on legitimate grounds, and tell them, before their data is first communicated to or used by a third party for prospecting, of their free right to object to it.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P1
  • Answer a request for rectification, completion, updating, blocking or erasure of inaccurate, incomplete, ambiguous, outdated or unlawfully processed personal data within one month of registering it, free of charge.NIST Privacy FrameworkCT.PO-P3
  • Let a minor consent alone to processing of their personal data for an information-society service from age sixteen; below that age, take consent jointly from the minor and the holder or holders of parental authority, and write the information addressed to the minor in clear, simple terms.NIST Privacy FrameworkCT.PO-P1

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
  • CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
  • CT.DM-P1Data elements can be accessed for review.
  • CT.DM-P2Data elements can be accessed for transmission or disclosure.
  • CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
FINOS AIGF

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Logging duty

Article 60 requires a controller that is asked in writing to rectify, complete, update, block or delete data to justify, free of charge and within one month, that it carried out the operations, and places the burden of proof on the controller if the request is contested. Article 61 repeats the duty for heirs. A controller can only show it did so from a record of the request and of what was done; the Law names no log, register or retention period. Articles 46 to 59 and 62 set notice, access, portability, objection and the age of digital consent, and state no record duty.

Kind
Implicit
As of
Provision
Article 60 (the controller justifies that it carried out a correction, completion, update, blocking or deletion)
Trigger
personal_data_processing

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 46 requires the controller, when collecting personal data directly from the data subject, to give them, at the latest at collection, the controller's identity, the purposes of the processing, the categories of data concerned, the recipients or categories of recipients, whether a reply is obligatory or optional and the consequences of not replying, the right to be removed from the file, the rights of access and rectification, the retention period, and any transfer envisaged to a third country.

Article 50 gives a data subject who proves their identity the right to demand, in writing, the information needed to know and contest the processing, confirmation of whether their personal data is processed, the data itself and any available information on its origin, the purposes of the processing and the categories of recipients, and any transfer envisaged to a third country.

Article 56 gives a data subject the right to receive the personal data they provided in a structured, commonly used, machine-readable format, and to transmit it to another controller, and Article 57 gives the right to have it transmitted directly between controllers where technically possible.

Article 59 lets a data subject object to processing of their personal data on legitimate grounds, and gives them the right to be told, before their data is first communicated to a third party or used on a third party's behalf for prospecting, and to be expressly offered a free right to object to that communication or use.

Article 60 lets a data subject who proves their identity demand rectification, completion, updating, blocking or erasure of personal data concerning them that is inaccurate, incomplete, ambiguous, out of date, or whose collection, use, communication or retention is prohibited, and requires the controller to justify, free of charge, that it has carried out the requested operation within one month of registering the request.

Article 62 lets a minor consent alone to processing of their personal data for the offer of information-society services from the age of sixteen; below that age, the processing is lawful only if consent is given jointly by the minor and the holder or holders of parental authority over them, and the controller must write information addressed to the minor in clear, simple terms the minor can readily understand.

Article 101 requires the Law's publication in the Journal Officiel de la République du Congo and its execution as law of the State, and it was signed at Brazzaville on . The Journal Officiel de la République du Congo published the Law in its No. 45-2019 issue of Thursday, , and no provision of the Law defers its own entry into force to a later date, though no source stating the day on which the Law came into force has been located.

When LexLint raises it

When your app profile says your app sends automated outreach, serves under-18s or processes personal data.

Back to the example  ·  Lint your app

Page updated .