Congo

Article 2 applies the Law to the collection, storage and any other use of personal data by a natural person, the State, decentralised administrative entities, or a legal person of public or private law, whether the controller is established in Congo or uses processing means located there.

Article 3 excludes only processing by a natural person for exclusively personal or domestic activities (where the data is not systematically communicated to third parties or disseminated) and processing concerning public security, defence, or the investigation of offences.

Article 5 conditions processing on the data subject's consent, unless the processing is necessary to comply with a legal obligation, perform a public-interest mission, protect vital interests, or another enumerated ground applies; a minor may consent alone from age sixteen, and jointly with a parent below that age (Article 15 area).

Articles 33 to 39 require most processing to be declared to the commission, with prior authorization required for processing of genetic data, health research data, offence or conviction data, an interconnection of files, a national identification number, or biometric data (Article 37).

Article 4 defines special categories of personal data as genetic data, data concerning minors, data on offences, convictions or security measures, and biometric data, and Article 14 separately restricts processing of data revealing ethnic or regional origin, political opinions, religious or philosophical beliefs, trade union membership, sex life, or health. Articles 46 to 61 give the data subject rights to information, access, portability, rectification and objection.

Articles 23 to 25 permit cross-border transfer only to a country the commission finds offers a sufficient level of protection, subject to derogations for consented, one-off, non-massive transfers or a commission-approved guarantee. Articles 74 to 78 require the controller to notify the commission of a personal-data breach within seventy-two hours where feasible, and to communicate a high-risk breach to the affected person.

Article 93 empowers the commission to warn, order compliance, suspend processing for up to three months, withdraw authorization, or impose an administrative fine of one million to one hundred million CFA francs, with recourse to the Supreme Court (Article 97). Article 98 provides that breach of the Law's provisions is separately punished under the Penal Code and under the law on combating cybercrime.

Article 1 states the Law's object as defining and punishing offences linked to information and communication technology, completing the Penal Code. Article 2 applies the Law to any person, of any nationality, who commits an offence through information and communication technology in the Republic of the Congo.

Article 4 punishes, by six months to three years' imprisonment and a fine of one million to ten million CFA francs, or either penalty, fraudulently accessing or attempting to access all or part of an information system, and separately punishes fraudulently procuring or attempting to procure an advantage by entering a system. Article 5 punishes the same range of penalties for fraudulently remaining or attempting to remain connected to all or part of an information system.

Article 6 punishes, by one to five years' imprisonment and a fine of five million to ten million CFA francs, or either penalty, hindering or attempting to hinder the functioning of an information system. Article 54 separately punishes, by two to five years' imprisonment and a fine of two million to thirty million CFA francs, installing a backdoor to data or an information system without the legitimate user's authorization.

Article 63 punishes, by six months to five years' imprisonment and a fine of four hundred thousand to five million CFA francs, or either penalty, fraudulently copying or attempting to copy computer data to a third party's prejudice. Article 109 provides that the Law is to be published in the Journal Officiel and executed as a law of the State, without stating a separate commencement date.

Article 14 excludes laws, judicial and administrative decisions, their official translations, and news of the day published, broadcast, or communicated to the public, from the Law's field of application, so bare news is never a protected work regardless of who first reported it.

Article 33(1)(b) permits, without the author's consent, inserting quotations from a lawfully published work into another work, in the original language or in translation, provided the quotation conforms to fair practice, is limited to what its purpose justifies, and names the source and the author, and the provision expressly extends to quotations of newspaper articles and periodicals in the form of press reviews.

Article 33(2) permits reproducing a lawfully published newspaper or periodical article on a current economic, political, or religious topic, or a broadcast work of the same character, in the press, or communicating it to the public, provided the source is clearly indicated; this use is not licit if the article, at the time of its publication, or the broadcast work, at the time of its broadcast, carried an express reservation that such use is prohibited.

Article 107 provides that the Law is to be executed as a law of the State and published in the Journal Officiel, without stating a separate commencement date.