Privacy & Data Protection Notice
The National Commission for the Missing and Forcibly Disappeared respects the privacy of individuals and families and handles the personal information and data it receives confidentially and in accordance with Law No. 105/2018, the Book of Regulations for the Management of the Central Records of Missing and Forcibly Disappeared Persons, and the Commission’s applicable data-protection frameworks and procedures.
The Commission is responsible for determining the purposes and means of processing personal data under its responsibility, within the limits of its legal mandate. The Book of Regulations provides the regulatory framework governing the protection, processing and security of personal data held by the Commission.
Why does the Commission collect and process information?
The Commission collects and processes information necessary to carry out its humanitarian mandate under Law No. 105/2018, particularly to clarify the fate and whereabouts of missing and forcibly disappeared persons, verify and cross-check information, support tracing and identification processes, and communicate with families.
Processing is not based on consent alone. Depending on the circumstances, personal data may be processed because this is necessary for the Commission to perform its obligations under Law No. 105/2018, to serve the public interest associated with clarifying the fate of missing and forcibly disappeared persons, for other purposes permitted by the applicable regulatory framework, or on the basis of the data subject’s consent where required.
What information may the Commission process?
Depending on the circumstances of each case, this may include:
- information about a missing or forcibly disappeared person and the circumstances, place and date of disappearance;
- information about family members and other persons who may have relevant information;
- contact information;
- documents, photographs, statements and other information relevant to tracing or identification;
- sensitive personal data; and
- where applicable, biological, biometric or genetic data related to identification processes.
Sensitive, biological, biometric and genetic data are subject to additional safeguards appropriate to their nature and the risks associated with their processing.
Confidentiality and who may access information
The Commission treats personal information and data confidentially.
Access is limited to authorized persons and to the information necessary for them to perform their assigned functions. Access is governed by need-to-know and least-privilege principles , with additional controls applying to sensitive and restricted information.
How does the Commission protect information?
The Commission applies technical, organizational and procedural safeguards designed to protect the confidentiality and integrity of information and reduce the risk of loss, misuse, unauthorized access or unauthorized disclosure.
Depending on the system and nature of the information, safeguards include restricted and role-based access, data minimization, logging and review of access and activity where applicable, and enhanced protection for sensitive, biometric and genetic information.
The Commission does not publish technical or operational security details where doing so could weaken the protection of its systems or data.
Can information be shared with other organizations?
Certain tracing or identification processes may require cooperation with competent authorities, specialized institutions, laboratories or other organizations working with the Commission within the framework of its mandate.
Information is not shared or transferred automatically or merely because another organization requests it. External transfers are subject to purpose limitation, documentation and data-protection safeguards and may require a written agreement and a Data Protection Impact Assessment depending on the nature and risks of the processing.
Integrated Data Management System ( iDMS )
The Commission uses the Integrated Data Management System ( iDMS ) to manage data and case information concerning missing and forcibly disappeared persons within the scope of the system’s use.
The International Commission on Missing Persons ( ICMP ) provides the technical infrastructure and hosting for iDMS . NCMFD remains responsible for data governance, determining the purposes of processing and managing access permissions. ICMP does not exercise independent Data Controller authority over the data managed by NCMFD.
Where data is hosted or processed outside Lebanon, the Commission applies appropriate contractual and organizational safeguards to protect confidentiality, integrity and security and to prevent unauthorized use or transfer.
What about consent?
Where processing is based on the consent of the data subject, consent must be freely given, specific and informed, and the purpose for which the information will be used must be explained before consent is obtained.
Where processing is based on consent, the data subject may withdraw that consent in accordance with the applicable rules. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and certain information may continue to be processed where another applicable legal basis permits this.
How long is information retained?
The Commission retains information for as long as necessary to carry out its mandate and meet its legal and regulatory obligations.
Because tracing and identification processes may continue over long periods, case records may require long-term retention. The continued need to retain case records is subject to periodic review in accordance with the Commission’s applicable rules and procedures.
What rights do you have regarding your personal data?
Under the Book of Regulations and the Commission’s applicable procedures, data subjects may contact the Commission to exercise rights relating to their personal data.
Depending on the circumstances and applicable conditions, these include rights to:
- request information about personal data being processed, the purposes of processing and certain information concerning its sharing, retention and protection;
- request correction or completion of inaccurate personal data;
- request deletion in circumstances permitted by the applicable rules;
- request restriction or suspension of certain processing;
- request access to certain data provided to the Commission or its transfer where technically possible and legally permissible; and
- object, in specified circumstances, to decisions resulting from automated processing that significantly affect the person.
The Book of Regulations establishes these rights and the conditions governing their exercise.
Are these rights absolute?
No. Certain requests may be restricted where necessary to protect the rights or privacy of other persons, protect confidential sources, safeguard ongoing tracing activities, or where continued processing is necessary for the Commission to fulfil its mandate and legal obligations.
For example, the Commission may in certain circumstances refuse deletion where continued processing is necessary to clarify the fate or whereabouts of a missing person, subject to the conditions set out in the Book of Regulations.
Requests concerning personal data are handled in accordance with a do-no-harm approach , taking into account the rights of the requester, the rights and safety of other persons, source protection and the integrity of ongoing tracing work.
What happens if there is a personal data breach?
The Commission maintains procedures for identifying, assessing and responding to information-security incidents and personal-data breaches, including assessing the nature of the incident and potential risks to affected persons and taking appropriate containment and corrective measures.
The Commission also assesses whether the applicable rules require affected persons or competent authorities to be notified, depending on the nature of the incident and the risks involved.
Processing Activities Requiring a Data Protection Impact Assessment (DPIA)
The National Commission for the Missing and Forcibly Disappeared conducts a Data Protection Impact Assessment (DPIA) before undertaking processing activities that, by their nature, scope or purpose, may present a high risk to the protection of personal data and the rights of data subjects.
Under the Book of Regulations for the Management of the Central Records of Missing and Forcibly Disappeared Persons, a DPIA is required, in particular, in the following cases:
- transfer of personal data to a third party;
- systematic and comprehensive assessment of personal aspects relating to individuals based on automated processing, including profiling, where decisions based on that assessment produce legal effects concerning the data subject or similarly significantly affect them;
- processing of a large volume of sensitive personal data.
A DPIA is intended to identify potential risks before processing begins, assess the necessity and proportionality of the proposed processing in relation to its intended purpose, and identify the measures and safeguards required to mitigate risks and protect personal data and the rights of data subjects.
The Commission may also conduct a DPIA in other circumstances where the nature, scope, context or risks of a processing activity indicate that a prior assessment is warranted.
How can you contact us about your personal data?
Data subjects may contact the Commission to ask how their personal data is handled or to submit a request concerning their rights under the applicable legal and regulatory framework.
Email: info@ncmfd.org.lb
Tel: +961 71 096 643
Address: Saab Building, Ground Floor, Sodeco , Achrafieh, Lebanon
The Book of Regulations requires the Commission to provide clear means for data subjects to communicate with it and exercise their rights.