Law No. 29-2019, rights of the data subject

Article 13 bars a decision producing legal effects for a natural person from resting solely on automated processing intended to define the person's profile or evaluate aspects of their personality, unless the decision arises from concluding or performing a contract on which the person had a chance to comment, or it grants the person's own request.

Article 46 requires the controller, when collecting personal data directly from the data subject, to give them, at the latest at collection, the controller's identity, the purposes of the processing, the categories of data concerned, the recipients or categories of recipients, whether a reply is obligatory or optional and the consequences of not replying, the right to be removed from the file, the rights of access and rectification, the retention period, and any transfer envisaged to a third country.

Article 50 gives a data subject who proves their identity the right to demand, in writing, the information needed to know and contest the processing, confirmation of whether their personal data is processed, the data itself and any available information on its origin, the purposes of the processing and the categories of recipients, and any transfer envisaged to a third country.

Article 56 gives a data subject the right to receive the personal data they provided in a structured, commonly used, machine-readable format, and to transmit it to another controller, and Article 57 gives the right to have it transmitted directly between controllers where technically possible.

Article 59 lets a data subject object to processing of their personal data on legitimate grounds, and gives them the right to be told, before their data is first communicated to a third party or used on a third party's behalf for prospecting, and to be expressly offered a free right to object to that communication or use.

Article 60 lets a data subject who proves their identity demand rectification, completion, updating, blocking or erasure of personal data concerning them that is inaccurate, incomplete, ambiguous, out of date, or whose collection, use, communication or retention is prohibited, and requires the controller to justify, free of charge, that it has carried out the requested operation within one month of registering the request.

Article 62 lets a minor consent alone to processing of their personal data for the offer of information-society services from the age of sixteen; below that age, the processing is lawful only if consent is given jointly by the minor and the holder or holders of parental authority over them, and the controller must write information addressed to the minor in clear, simple terms the minor can readily understand.

Article 101 requires the Law's publication in the Journal Officiel de la République du Congo and its execution as law of the State, and it was signed at Brazzaville on 10 October 2019. The Journal Officiel de la République du Congo published the Law in its No. 45-2019 issue of Thursday, 7 November 2019, and no provision of the Law defers its own entry into force to a later date.