Republic of the Congo

Article 74 requires the controller, in the case of a personal-data breach, to notify the national commission without undue delay and, where possible, within seventy-two hours of becoming aware of it, unless the breach is not likely to create a risk to the rights and freedoms of natural persons, and to accompany a notification made after that deadline with the reasons for the delay; the processor notifies the controller of any personal-data breach without undue delay after becoming aware of it.

Article 75 fixes what the notification to the commission must contain: the nature of the breach, including where possible the categories and approximate number of data subjects and of personal-data records concerned, the name and contact details of the data protection officer or another contact point, the likely consequences, and the measures taken or proposed to remedy the breach and mitigate its adverse effects, communicated in stages without further undue delay where they cannot all be given at once.

Article 76 requires the controller to document every personal-data breach, its effects and the remedial measures taken, so the commission can verify compliance. Article 77 requires the controller, where a personal-data breach is likely to create a high risk to the rights and freedoms of a natural person, to communicate the breach to the data subject without undue delay, in clear and simple terms, and to give at least the information Article 75 requires.

Article 78 excuses that communication where the controller had applied protective measures, such as encryption, rendering the affected data unintelligible, where later measures mean the high risk is no longer likely to materialise, or where it would take disproportionate effort, in which case a public communication of equal effect is made instead.

Article 101 requires the Law's publication in the Journal Officiel de la République du Congo and its execution as law of the State, and it was signed at Brazzaville on 10 October 2019. The Journal Officiel de la République du Congo published the Law in its No. 45-2019 issue of Thursday, 7 November 2019, and no provision of the Law defers its own entry into force to a later date, though no source stating the day on which the Law came into force has been located.

Article 2 applies the Law to the collection, processing, transmission, storage or use of personal data by a natural person, the State, decentralised administrative entities, or a legal person of public or private law, whether the controller is established on Congolese territory or uses processing means located there.

Article 3 excludes only processing by a natural person for exclusively personal or domestic activities, where the data is not destined for systematic communication to third parties or dissemination, and temporary copies made for the technical transmission of, and access to, a digital network.

Article 5 conditions processing on the data subject's consent, unless the processing is necessary to comply with a legal obligation, perform a public-interest mission or exercise public authority, perform a contract to which the data subject is party, or safeguard the data subject's vital interests or fundamental rights.

Articles 6 to 10 state the Law's principles: processing is lawful, fair and transparent; personal data is kept no longer than its purpose requires; the data is accurate and updated where necessary; the data subject is given the transparency information the Law requires; and processing is kept confidential, in particular where it involves transmission over a network.

Article 11 requires the controller to choose a processor offering sufficient technical and organisational security guarantees and to govern the engagement by a written contract confining the processor to the controller's instructions, and Article 12 confines anyone who accesses personal data under the controller's or the processor's authority to processing on the controller's instructions alone.

Articles 33 to 36 require most processing to be declared to the national commission, Article 37 requires the commission's prior authorization instead for processing bearing on genetic data or health research, offence, conviction or security-measure data, a file interconnection, a national identification number, or biometric data, and Article 40 requires a decree of the President of the Republic, after the commission's reasoned opinion, for processing carried out on behalf of the State, a public establishment, a decentralised administrative entity, or a private-law legal person managing a public service.

Article 63 requires the controller to keep processing confidential, and Article 64 requires precautions appropriate to the nature of the data and the risks the processing presents to preserve data security. Articles 67 to 69 require a written register of processing activities, made available to the commission on demand, and Article 70 requires cooperation with the commission on request.

Article 79 requires a data protection impact assessment before a type of processing likely to create a high risk to the rights and freedoms of natural persons, and Articles 83 to 91 require the designation of a data protection officer, on the conditions Article 83 sets, given the position Article 87 prescribes and the tasks Article 90 lists.

Article 101 requires the Law's publication in the Journal Officiel de la République du Congo and its execution as law of the State, and it was signed at Brazzaville on 10 October 2019. The Journal Officiel de la République du Congo published the Law in its No. 45-2019 issue of Thursday, 7 November 2019, and no provision of the Law defers its own entry into force to a later date, though no source stating the day on which the Law came into force has been located.

Article 23 bars a cross-border transfer of personal data unless the third country offers a sufficient level of protection for the privacy and fundamental rights and freedoms of the persons the transferred data does or may concern, measured against the security measures applied, the characteristics of the processing (including its purposes and duration), and the nature, origin and destination of the data, and requires the controller to inform the national commission of any such transfer in advance.

Article 24 lets a controller transfer personal data to a third country that does not meet the article 23 condition where the transfer is a one-off, non-massive transfer and the data subject has expressly consented to it, or the transfer is necessary to protect that person's life, safeguard the public interest, allow the establishment, exercise or defence of a legal claim, or perform a contract between the controller and the data subject.

Article 25 lets the national commission authorize a transfer or a set of transfers to a third country that does not offer a sufficient level of protection where the controller offers sufficient guarantees for the privacy, fundamental rights and freedoms of the data subjects and the exercise of their corresponding rights, on a duly reasoned request from the controller.

Article 101 requires the Law's publication in the Journal Officiel de la République du Congo and its execution as law of the State, and it was signed at Brazzaville on 10 October 2019. The Journal Officiel de la République du Congo published the Law in its No. 45-2019 issue of Thursday, 7 November 2019, and no provision of the Law defers its own entry into force to a later date, though no source stating the day on which the Law came into force has been located.

Article 13 bars a decision producing legal effects for a natural person from resting solely on automated processing intended to define the person's profile or evaluate aspects of their personality. A parallel first sentence restricts a court decision the same way, but that clause binds only courts. The prohibition does not apply to a decision made in concluding or performing a contract on which the person had a chance to comment, or to a decision that grants the person's own request. No source stating the day on which the Law came into force has been located.

Article 46 requires the controller, when collecting personal data directly from the data subject, to give them, at the latest at collection, the controller's identity, the purposes of the processing, the categories of data concerned, the recipients or categories of recipients, whether a reply is obligatory or optional and the consequences of not replying, the right to be removed from the file, the rights of access and rectification, the retention period, and any transfer envisaged to a third country.

Article 50 gives a data subject who proves their identity the right to demand, in writing, the information needed to know and contest the processing, confirmation of whether their personal data is processed, the data itself and any available information on its origin, the purposes of the processing and the categories of recipients, and any transfer envisaged to a third country.

Article 56 gives a data subject the right to receive the personal data they provided in a structured, commonly used, machine-readable format, and to transmit it to another controller, and Article 57 gives the right to have it transmitted directly between controllers where technically possible.

Article 59 lets a data subject object to processing of their personal data on legitimate grounds, and gives them the right to be told, before their data is first communicated to a third party or used on a third party's behalf for prospecting, and to be expressly offered a free right to object to that communication or use.

Article 60 lets a data subject who proves their identity demand rectification, completion, updating, blocking or erasure of personal data concerning them that is inaccurate, incomplete, ambiguous, out of date, or whose collection, use, communication or retention is prohibited, and requires the controller to justify, free of charge, that it has carried out the requested operation within one month of registering the request.

Article 62 lets a minor consent alone to processing of their personal data for the offer of information-society services from the age of sixteen; below that age, the processing is lawful only if consent is given jointly by the minor and the holder or holders of parental authority over them, and the controller must write information addressed to the minor in clear, simple terms the minor can readily understand.

Article 101 requires the Law's publication in the Journal Officiel de la République du Congo and its execution as law of the State, and it was signed at Brazzaville on 10 October 2019. The Journal Officiel de la République du Congo published the Law in its No. 45-2019 issue of Thursday, 7 November 2019, and no provision of the Law defers its own entry into force to a later date, though no source stating the day on which the Law came into force has been located.

Article 92 lets the national commission issue a warning to a controller failing to meet the Law's obligations, or a formal notice to remedy a breach within a period the commission fixes.

Article 93 lets the commission, where the controller does not comply with that formal notice and after adversarial procedure, order a provisional withdrawal of authorization or a provisional ban on processing not exceeding three months, a definitive withdrawal of authorization or ban on processing, an injunction to cease processing subject to the declaration regime or the article 32 and 33 exemptions, or an administrative fine of one million to one hundred million CFA francs, recovered under the legislation on the recovery of State debts.

Article 94 lets the commission, in an emergency where a processing operation or the exploitation of personal data violates rights and freedoms, order, after adversarial procedure, the interruption of the processing or the locking of the data concerned for up to three months, or a temporary or permanent prohibition of processing contrary to the Law.

Article 95 requires the commission's sanctions to rest on a report by one of its members, notified to the controller, who may submit observations and be represented or assisted. Article 96 lets the commission's president make its sanctions public and order their publication, at the sanctioned person's expense, in the publications, newspapers or media the president designates. Article 97 opens a right of appeal against the commission's sanctions and decisions before the Supreme Court.

Article 98 provides that breach of the Law's provisions is separately punished under the Penal Code and under Law No. 27-2020 on combating cybercrime, whose own Chapter 6 criminalises processing without the required formalities, unlawful or undeclared processing, and processing of special-category data, each with imprisonment of one to five years.

Article 101 requires the Law's publication in the Journal Officiel de la République du Congo and its execution as law of the State, and it was signed at Brazzaville on 10 October 2019. The Journal Officiel de la République du Congo published the Law in its No. 45-2019 issue of Thursday, 7 November 2019, and no provision of the Law defers its own entry into force to a later date, though no source stating the day on which the Law came into force has been located.

Article 4 defines special categories of personal data as genetic data, data concerning minors, data relating to offences, criminal convictions or security measures, and biometric data, and reaches, so far as they are processed for what they reveal, personal data revealing ethnic origin, filiation, political opinions, religious or philosophical beliefs, trade union membership, sex, or data relating to health or sex life.

Article 14 prohibits collecting or processing personal data revealing ethnic or regional origin, filiation, political opinions, religious or philosophical beliefs, trade union membership, sex life, genetic data, or more generally data relating to a natural person's state of health.

Article 15 lifts that prohibition only where the data was manifestly made public by the data subject, the data subject gave written consent, the processing is necessary to protect vital interests, or it is necessary to establish, exercise or defend a legal claim; genetic data itself may then be processed only to verify a genetic link for a person's identification, or for the prevention or repression of a specific criminal offence, in the administration of proof in court.

Article 16 confines processing of data relating to offences, convictions or security measures to courts, public authorities and legal persons managing a public service acting within their legal remit, and to legal auxiliaries acting for the strict needs of a mission the law entrusts to them.

Article 17 permits processing personal data for health purposes only on one of its listed grounds, including the data subject's consent, data the data subject manifestly made public, the protection of vital interests, a purpose fixed by or under the law, and the promotion and protection of public health, and Article 18 requires health data to be collected from the data subject directly, unless collecting it from another source is necessary for the processing's purpose or the data subject cannot supply it.

Article 37 requires the commission's prior authorization before processing personal data bearing on genetic data or health research, offence, conviction or security-measure data, or biometric data. Article 101 requires the Law's publication in the Journal Officiel de la République du Congo and its execution as law of the State, and it was signed at Brazzaville on 10 October 2019.

The Journal Officiel de la République du Congo published the Law in its No. 45-2019 issue of Thursday, 7 November 2019, and no provision of the Law defers its own entry into force to a later date, though no source stating the day on which the Law came into force has been located.

Article 7 punishes, by one to five years' imprisonment and a fine of five million to ten million CFA francs, or either penalty, fraudulently introducing or attempting to introduce data into an information system. Article 8 punishes, with the same penalties, fraudulently intercepting or attempting to intercept, by technical means, data of an information system during its non-public transmission to, from or within an information system.

Article 17 punishes, by one to five years' imprisonment and a fine of one million to ten million CFA francs, or either penalty, collecting personal data by fraudulent, unfair or unlawful means.

Article 22 punishes, with the same penalties, a person who holds personal data in the course of recording, classifying, transmitting or otherwise processing it and diverts that information from the purpose defined by the personal-data laws and regulations, by the data-protection commission's decision authorizing the automated processing, or by the prior declarations for that processing.

Article 1 states the Law's object as defining and punishing offences linked to information and communication technology, completing the Penal Code. Article 2 applies the Law to any person, of any nationality, who commits an offence through information and communication technology in the Republic of the Congo.

Article 4 punishes, by six months to three years' imprisonment and a fine of one million to ten million CFA francs, or either penalty, fraudulently accessing or attempting to access all or part of an information system, and separately punishes fraudulently procuring or attempting to procure an advantage by entering a system. Article 5 punishes the same range of penalties for fraudulently remaining or attempting to remain connected to all or part of an information system.

Article 6 punishes, by one to five years' imprisonment and a fine of five million to ten million CFA francs, or either penalty, hindering or attempting to hinder the functioning of an information system. Article 54 separately punishes, by two to five years' imprisonment and a fine of two million to thirty million CFA francs, installing a backdoor to data or an information system without the legitimate user's authorization.

Article 63 punishes, by six months to five years' imprisonment and a fine of four hundred thousand to five million CFA francs, or either penalty, fraudulently copying or attempting to copy computer data to a third party's prejudice. Article 109 provides that the Law is to be published in the Journal Officiel and executed as a law of the State, without stating a separate commencement date, and no source stating the day on which the Law came into force has been located.

Article 12 subjects the information systems and electronic communications networks of public bodies to a mandatory and periodic security audit, except those of the ministries in charge of national defence and public security and those of diplomatic and consular missions. Article 12 also subjects to the same mandatory and periodic audit the systems and networks of the bodies on a list to be fixed by regulation.

Article 13 leaves the nature of the audit, its periodicity and the follow-up of the recommendations in the audit report to be fixed by regulation. Article 14 provides that when a body does not carry out the mandatory audit the agency warns it, the body must audit within three months of the warning, and after that period the agency must appoint an expert to carry out the audit at the body's expense.

Article 15 binds the public and private bodies covered by the Law to collaborate with the agency and the audit experts and to put at the agency's disposal all documents and files relating to IT security. Article 16 provides that the audit is carried out by experts, individuals or companies, previously approved by the agency.

Article 20 requires those who run electronic communications networks, in the text's words the "opérations des réseaux", and the providers of electronic communications services to take all useful technical and administrative measures to guarantee the security of the services they offer.

Article 20 requires them to inform users of the dangers of using their networks, of the particular security-violation risks such as denial of service, abnormal re-routing, unusual traffic and ports, passive and active eavesdropping and intrusions, and where applicable of the lack of technical means to secure their communications.

Article 4 requires anyone who uses information systems and networks, whether a citizen, a business, an organization or a public authority, to take adequate measures to protect against and prevent any risk to third parties arising from that use.

Article 4 makes anyone who develops, owns, supplies, manages, maintains or uses information systems and networks responsible and accountable for their security, and bound to review and assess continuously its own security policies, practices, measures and procedures. Article 5 requires the same persons to do everything possible to prevent, detect and respond to security incidents.

Article 6 requires users and holders of information systems and networks to exchange the information they hold on threats to and vulnerabilities of those networks and systems in an appropriate manner. Article 8 requires anyone who makes or holds information systems to carry out risk assessments. Article 9 requires the protective measures and solutions adopted to be both technical and non-technical and proportionate to the value of the information in the organization's systems and networks.

Article 10 provides that security management is based on risk assessment. Article 11 requires users and holders of information systems and networks to guarantee their security constantly in the face of evolving risks. Article 39 provides that infractions of the Law are provided for and punished by the penal code and by the law relating to the fight against cybercrime.

Article 2 excludes from the Law the information systems and electronic communications networks used for national defence and security.

Article 18 requires every operator of an information system or an electronic communications network, whether a public body or a private organisation, to inform the agency without delay of any attack, intrusion or other disturbance likely to impede the operation of another information system or electronic communications network. Article 18 also requires the operator to comply with the measures the agency decides in order to end those disturbances.

Article 19 lets the agency order the isolation of the information system or electronic communications network concerned until the disturbances cease. Article 19 requires the minister in charge of information and communication technologies to be informed without delay of that isolation. Article 2 excludes from the Law the information systems and electronic communications networks used for national defence and security.

Article 39 provides that infractions of the Law are provided for and punished by the penal code and by the law relating to the fight against cybercrime.

Loi n°4-2010 defines a child as any human being under eighteen who has not otherwise reached majority by special provision (article premier). Article 38 gives the child a right of access to diversified and objective information and prohibits media from disseminating information that could compromise the child's development.

The article requires media to promote children's books, to protect childhood in audiovisual programming, and to protect the child against pornography, harmful information, and scenes of violence disseminated through video clubs, internet sites, advertising, and other documents that could harm the child's harmonious development. No age-verification mechanism or enforcement body specific to this duty appears in the law's text.

Article 109 makes a breach of article 38 punishable by a fine of 500,000 to 1,500,000 CFA francs, with imprisonment of one to twelve months on a repeat offense.

Article 14 excludes laws, judicial and administrative decisions, their official translations, and news of the day published, broadcast, or communicated to the public, from the Law's field of application, so bare news is never a protected work regardless of who first reported it.

Article 33(1)(b) permits, without the author's consent, inserting quotations from a lawfully published work into another work, in the original language or in translation, provided the quotation conforms to fair practice, is limited to what its purpose justifies, and names the source and the author, and the provision expressly extends to quotations of newspaper articles and periodicals in the form of press reviews.

Article 33(2) permits reproducing a lawfully published newspaper or periodical article on a current economic, political, or religious topic, or a broadcast work of the same character, in the press, or communicating it to the public, provided the source is clearly indicated; this use is not licit if the article, at the time of its publication, or the broadcast work, at the time of its broadcast, carried an express reservation that such use is prohibited.

Article 107 provides that the Law is to be executed as a law of the State and published in the Journal Officiel, without stating a separate commencement date, and no source stating the day on which the Law came into force has been located.