Republic of the CongoLaw No. 29-2019, special categories of personal data
In force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric, Licensing
- Audit expectation
- none
What it requires
- Do not collect or process personal data revealing ethnic or regional origin, filiation, political opinions, religious or philosophical beliefs, trade union membership, sex life, genetic data, or a person's state of health, unless one of the article 15 grounds applies.NIST Privacy FrameworkCT.PO-P1
- Process genetic data itself only to verify a genetic link for a person's identification, or for the prevention or repression of a specific criminal offence, in the administration of proof in court.NIST Privacy FrameworkCT.PO-P1
- Process personal data relating to offences, convictions, or security measures only if you are a court, a public authority, a legal person managing a public service acting within its legal remit, or a legal auxiliary acting for the strict needs of a mission the law entrusts to it.NIST Privacy FrameworkCT.PO-P1
- Process personal data for health purposes only on one of the article 17 grounds, and collect health data from the data subject directly unless collecting it from another source is necessary for the processing's purpose or the data subject cannot supply it themselves.NIST Privacy FrameworkCT.PO-P1
- Obtain the national commission's prior authorization before processing personal data bearing on genetic data or health research, offence, conviction or security-measure data, or biometric data.NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 4, 14 to 19 and 37 define the special categories of data, forbid processing most of them subject to the Article 15 derogations, limit offence data to courts, public authorities and legal auxiliaries, regulate health data and journalism processing, and make processing of genetic, health-research, offence, interconnection, national-identifier, biometric and public-interest data wait for the commission's authorization. None of them requires a log, register or record to be kept. The register duty sits in Articles 67 to 69, which this row does not cite.
- Kind
- None
- As of
What this law does
Article 4 defines special categories of personal data as genetic data, data concerning minors, data relating to offences, criminal convictions or security measures, and biometric data, and reaches, so far as they are processed for what they reveal, personal data revealing ethnic origin, filiation, political opinions, religious or philosophical beliefs, trade union membership, sex, or data relating to health or sex life.
Article 14 prohibits collecting or processing personal data revealing ethnic or regional origin, filiation, political opinions, religious or philosophical beliefs, trade union membership, sex life, genetic data, or more generally data relating to a natural person's state of health.
Article 15 lifts that prohibition only where the data was manifestly made public by the data subject, the data subject gave written consent, the processing is necessary to protect vital interests, or it is necessary to establish, exercise or defend a legal claim; genetic data itself may then be processed only to verify a genetic link for a person's identification, or for the prevention or repression of a specific criminal offence, in the administration of proof in court.
Article 16 confines processing of data relating to offences, convictions or security measures to courts, public authorities and legal persons managing a public service acting within their legal remit, and to legal auxiliaries acting for the strict needs of a mission the law entrusts to them.
Article 17 permits processing personal data for health purposes only on one of its listed grounds, including the data subject's consent, data the data subject manifestly made public, the protection of vital interests, a purpose fixed by or under the law, and the promotion and protection of public health, and Article 18 requires health data to be collected from the data subject directly, unless collecting it from another source is necessary for the processing's purpose or the data subject cannot supply it.
Article 37 requires the commission's prior authorization before processing personal data bearing on genetic data or health research, offence, conviction or security-measure data, or biometric data. Article 101 requires the Law's publication in the Journal Officiel de la République du Congo and its execution as law of the State, and it was signed at Brazzaville on .
The Journal Officiel de la République du Congo published the Law in its No. 45-2019 issue of Thursday, , and no provision of the Law defers its own entry into force to a later date, though no source stating the day on which the Law came into force has been located.
When LexLint raises it
When your app profile says your app processes biometric data, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .