DR-Congo: prospects for the data protection authority
Since March 13, 2023, the Democratic Republic of Congo (hereinafter DR-Congo) has implemented regulations in the digital field, through Ordinance-Law No. 23/010, called the Digital Code. An important part of this new legislation addresses the crucial issue of personal data protection. These provisions are detailed in Title III of the Digital Code.
The relevance of legislation on the protection of personal data often depends on the supervisory authority associated with it. This supervisory authority plays an essential role in ensuring that the rules established in this area are respected, with the aim of protecting the people concerned. In other words, the strength of this legislation is measured by the power of its supervisory body, thus guaranteeing effective protection of personal data.
In order to guarantee compliance with these regulations, the Congolese legislator provides for the establishment of a supervisory authority for the protection of personal data called the Data Protection Authority or “APD”. It is important to note that at the time of writing this note, this control body has not yet been created. However, we will examine here the powers provided for, as well as the sanctioning powers recognized to it.
The skills of the data protection authority in DR Congo
The functioning of the Congolese Data Protection Authority (APD) is largely inspired by its European and African counterparts. Its main mission is to monitor compliance with the protection of personal data in order to safeguard the privacy of those whose data is hosted in DR Congo. However, its particularity lies in its competence, that of also controlling the processing of public data.
This entity will have the status of an independent administrative authority, with legal personality, enjoying administrative and financial autonomy. Among the skills assigned to it, the most notable include the ability to provide opinions and make recommendations on the processing of personal and public data. This aims to inform data subjects as well as data controllers of their rights and obligations.
A distinctive feature of this authority is the reporting system for the processing of personal data. In other words, data controllers must submit declarations to this authority before processing certain personal data. This differs from the accountability system, which allows the implementation of processing without requiring a prior declaration to the supervisory authority.
The APD also has the power to take legal action and conduct investigations into violations of personal and public data. However, all these actions must have a repressive or corrective purpose. Consequently, the APD is empowered to impose sanctions in the event of non-compliance with the rules relating to personal and public data.
Powers and Sanctions of the Data Protection Authority
A certain number of administrative measures are recognized by this authority. In particular, it may issue warnings against a data controller. In addition, it has the power to issue formal notice to put an end to the breach, and the deadline for compliance cannot exceed eight days.
The APD may also impose financial sanctions against a data controller who does not comply with the provisions of the Digital Code regarding data protection. These sanctions can include a payment of eight million to two hundred million Congolese francs. In the event of a violation resulting in the death or attempted murder of one or more people, a fine equivalent to 5% of its annual turnover may be imposed. In addition, it has the power to issue an injunction to cease the processing of personal data if the violation has endangered national security and safety and/or led to a mass crime or genocide.
Although the data protection supervisory body is not yet operational, its establishment represents a significant step towards the establishment of a solid regulatory framework. This initiative aims to find a balance between digital innovation and the protection of individual rights, requiring careful monitoring to assess its impact on the Congolese digital landscape.
