Republic of the CongoLaw No. 29-2019, sanctions
Loi n° 29-2019, articles 92 à 98 (sanctions administratives et pénales)
In force.
An enforcement supervision rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Expect the national commission to issue a warning, or a formal notice fixing a period to remedy a failure to meet the Law's obligations, before any sanction follows.
- Expect the commission, after adversarial procedure, to withdraw an authorization, ban processing for up to three months or permanently, order you to cease processing, or impose an administrative fine of one million to one hundred million CFA francs, where you do not comply with its formal notice.
- Expect the commission, in an emergency, to order the interruption of processing or the locking of data for up to three months, or a temporary or permanent prohibition, where the processing violates rights and freedoms.
- Expect the commission's sanctions and decisions to be open to appeal before the Supreme Court.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article 98 provides that infringement of the Law's provisions is punished under the Penal Code and under Law No. 27-2020 on combating cybercrime; that cybercrime law's Chapter 6 (Articles 12 to 22) separately criminalises processing without the required formalities, undeclared or unauthorised processing, processing of special-category data, and unlawful data collection, each with imprisonment of one to five years and a fine of one million to ten million CFA francs.
Penalty structure
Article 93 empowers the commission to impose, in addition to a warning, compliance order, temporary suspension of up to three months, or a definitive withdrawal of authorization or ban on processing, an administrative fine of one million (1,000,000) to one hundred million (100,000,000) CFA francs, recovered under State debt-recovery law. Criminal penalties for the same conduct are set separately by the Penal Code and Law No. 27-2020 on combating cybercrime (see the criminal exposure note).
- Rule
- Fixed only
- As of
- Minimum
- 1,000,000
- Currency
- XAF
- Fixed cap
- 100,000,000
Who enforces it
Enforcement body
The national commission for the protection of personal data the Law establishes and empowers to receive declarations, grant authorizations, and impose sanctions
What it makes you log
Logging duty
Articles 92 to 98 let the commission warn, give notice to comply, withdraw an authorization, ban processing, order cessation, fine between 1,000,000 and 100,000,000 CFA francs, publish its sanctions, and send criminal offences to the penal code and the cybercrime law. They set no duty on a controller to keep a log or record, and no power to demand one; the commission's own report under Article 95 is its procedure, not a record kept by the regulated party.
- Kind
- None
- As of
What this law does
Article 92 lets the national commission issue a warning to a controller failing to meet the Law's obligations, or a formal notice to remedy a breach within a period the commission fixes.
Article 93 lets the commission, where the controller does not comply with that formal notice and after adversarial procedure, order a provisional withdrawal of authorization or a provisional ban on processing not exceeding three months, a definitive withdrawal of authorization or ban on processing, an injunction to cease processing subject to the declaration regime or the article 32 and 33 exemptions, or an administrative fine of one million to one hundred million CFA francs, recovered under the legislation on the recovery of State debts.
Article 94 lets the commission, in an emergency where a processing operation or the exploitation of personal data violates rights and freedoms, order, after adversarial procedure, the interruption of the processing or the locking of the data concerned for up to three months, or a temporary or permanent prohibition of processing contrary to the Law.
Article 95 requires the commission's sanctions to rest on a report by one of its members, notified to the controller, who may submit observations and be represented or assisted. Article 96 lets the commission's president make its sanctions public and order their publication, at the sanctioned person's expense, in the publications, newspapers or media the president designates. Article 97 opens a right of appeal against the commission's sanctions and decisions before the Supreme Court.
Article 98 provides that breach of the Law's provisions is separately punished under the Penal Code and under Law No. 27-2020 on combating cybercrime, whose own Chapter 6 criminalises processing without the required formalities, unlawful or undeclared processing, and processing of special-category data, each with imprisonment of one to five years.
Article 101 requires the Law's publication in the Journal Officiel de la République du Congo and its execution as law of the State, and it was signed at Brazzaville on . The Journal Officiel de la République du Congo published the Law in its No. 45-2019 issue of Thursday, , and no provision of the Law defers its own entry into force to a later date, though no source stating the day on which the Law came into force has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .