LebanonLaw No. 81/2018, Part V, penal provisions and supervision
Law No. 81/2018 Arts. 102 and 106 to 109 (penal provisions and the court remedy), with the Ministry of Economy and Trade's role under Arts. 95 to 98
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Licensing
- Audit expectation
- none
What it requires
- Expect a fine of one million to thirty million Lebanese Pounds and imprisonment of three months to three years, or one of those two penalties, for processing personal data without a filed permit or a prior licence, for collecting or processing it outside the Section II rules, or for disclosing personal data under processing to unauthorized persons, even negligently.
- Expect a fine of one million to fifteen million Lebanese Pounds for refusing to answer a person's access or correction request within ten working days, or for answering it incorrectly or imperfectly.
- Expect both fines and prison terms to rise by one third to one half where the act recurs.
- Expect the owner of the personal data, or any of their heirs, to bring you before the competent courts, in particular the Magistrate of Summary Justice, to compel the right of access and correction.
- Note that prosecution for disclosing data to unauthorized persons and for refusing an access or correction request starts only on the complaint of the injured party, and ends if that party waives the personal right before the judgment becomes final.
- Deal with the Ministry of Economy and Trade for a permit and with the Minister of Public Health, the Minister of Justice, or the Minister of National Defence and the Minister of Interior and Municipalities for a licence: Law 81/2018 creates no independent data protection authority.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Processing personal data without filing a permit or obtaining a prior licence, collecting or processing personal data outside the Section II rules, or disclosing personal data under processing to unauthorized persons even negligently, is punished with a fine of one million to thirty million Lebanese Pounds and imprisonment of three months to three years, or with one of those two penalties (Art. 106). Refusing to answer an access or correction request within ten working days, or answering it incorrectly or imperfectly, is punished with a fine of one million to fifteen million Lebanese Pounds (Art. 107). Both rise by one third to one half on recurrence (Art. 108), and prosecution for the disclosure offence and the refusal offence requires a complaint by the injured party (Art. 109).
Penalty structure
Art. 106 sets the top Part V fine at thirty million Lebanese Pounds, with imprisonment of three months to three years available alongside or instead of it, for unlicensed or unpermitted processing, for processing outside the Section II rules, and for disclosing personal data to unauthorized persons. Art. 107 sets a lower ceiling of fifteen million Lebanese Pounds for refusing or botching an access or correction response. Art. 108 raises both by one third to one half on recurrence, so a repeat offence under Art. 106 reaches forty-five million Lebanese Pounds. The law states no turnover-based penalty and no administrative fine, and the figures are nominal 2018 Lebanese Pounds, unindexed.
- Rule
- Fixed only
- As of
- Currency
- LBP
- Fixed cap
- 30,000,000
Who enforces it
Enforcement body
Ministry of Economy and Trade, which receives permits under Art. 95 and publishes the register under Art. 98; licences under Art. 97 are issued by the Minister of National Defence and the Minister of Interior and Municipalities, the Minister of Justice, or the Minister of Public Health according to the category of data. Law No. 81/2018 establishes no independent data protection authority.
What it makes you log
Logging duty
Articles 106 to 109 set fines and imprisonment, raised by one third to one half on recurrence, for processing without a permit or licence, for collecting or processing outside the Section II rules, for disclosing personal data to unauthorized persons and for failing to answer an access or correction request. Article 102 lets the data owner or an heir go to the competent courts, in particular the Magistrate of Summary Justice, to secure access and correction. Articles 95 to 98 give the Ministry of Economy and Trade its permit and public-list role. None of these provisions asks for a log or a record, or for a review of one.
- Kind
- None
- As of
What this law does
Article 106 punishes three things with a fine of one million to thirty million Lebanese Pounds and imprisonment of three months to three years, or with one of those two penalties: processing personal data without filing a permit or obtaining a prior licence before starting work, collecting or processing personal data outside the rules of Section II, and disclosing personal data under processing to unauthorized persons, even negligently.
Article 107 punishes a processing officer who refuses to answer a person's access or correction request within ten working days, or answers it incorrectly or imperfectly, with a fine of one million to fifteen million Lebanese Pounds.
Article 108 raises the penalties and fines by one third to one half where the act recurs, and Article 109 makes prosecution for the disclosure offence and for the refusal offence turn on a complaint by the injured party, the general right lapsing with the personal right where the waiver comes before the judgment becomes final.
Article 102 gives the owner of the personal data, or any of their heirs, access to the competent courts and in particular to the Magistrate of Summary Justice to enforce the right of access and correction, which is a procedural remedy rather than a general claim for damages.
Supervision itself is administrative and not independent: Law 81/2018 creates no data protection authority, and the permit function sits with the Ministry of Economy and Trade under Article 95, the licence function with the Minister of National Defence and the Minister of Interior and Municipalities, the Minister of Justice and the Minister of Public Health under Article 97, and the public register of permits and licences with the Ministry under Article 98.
Article 136 makes the law effective three months after its publication in the Official Gazette, so these provisions bind today.
When LexLint raises it
When your app profile says your app handles health records, provides telecom services or processes personal data.
Back to the example · Lint your app
Page updated .