Law No. 133/V/2001 on the Protection of Personal Data

Article 2 applies the law to processing of personal data wholly or partly by automated means and to manual filing systems, reaching a controller established in Cabo Verde, a controller to whom Cabo Verdean law applies by international public law, or a controller outside the territory using equipment located there other than for transit, and separately to video surveillance and other capture, processing, and dissemination of sound and images permitting identification of a person.

Article 8 prohibits processing personal data revealing philosophical, ideological or political beliefs, religion, political party or trade union affiliation, racial or ethnic origin, or health and sex life including genetic data, unless the data subject has expressly consented with a guarantee of non-discrimination, or another legal authorization applies.

Article 14 gives every person the right not to be subject to a decision producing legal effects or significantly affecting them that is based solely on automated processing intended to evaluate personal aspects such as work performance, creditworthiness, reliability, or conduct, subject to Article 14(2)'s exceptions for contract-related automated decisions with safeguards.

Article 19 conditions transfer of personal data to a foreign state on the CNPD's assessment that the state ensures an adequate level of protection, and Article 20 permits the CNPD to authorize a transfer to a state that does not meet that standard where the data subject has given unequivocal consent or another enumerated derogation applies.

Article 23 requires the controller to notify the CNPD before carrying out an automated processing operation, subject to simplification or exemption the CNPD may grant, including for a filing system open to public consultation. Article 24 requires the CNPD's prior authorization for processing of the most sensitive data categories, data on credit and solvency, combination of personal data across filing systems, and use of data for a purpose other than that for which it was collected.

Article 31 entitles a person who has suffered damage from an unlawful processing operation or another act incompatible with the law to compensation from the controller, who may be exempted in whole or in part on proving he is not responsible for the fact giving rise to the damage.

Offences are backed by a graduated schedule: Article 33 fines the offence of omitting the Article 23 or 24 notification or authorisation, or providing false information in it, from CVE 50,000 to 500,000 for a single individual and from CVE 300,000 to 3,000,000 for a group of people or an entity without legal personality, doubled to the maximum for data subject to Article 24 prior authorisation; Article 34 fines other listed omissions from CVE 100,000 to 1,000,000.

Articles 40 to 44 create crimes for intentional non-compliance with the notification and authorisation duties (up to one year's imprisonment or a fine of up to 120 days, doubled to the maximum for Article 8 and 9 data), undue access to prohibited personal data (up to one year's imprisonment or a fine of up to 120 days, doubled for security-rule violations or a benefit obtained), invalidation or destruction of personal data (up to two years' imprisonment or a fine of up to 240 days), qualified non-compliance after CNPD notification, and violation of professional secrecy (imprisonment from six months to three years or a fine of 80 to 200 days).

Article 45 makes an attempt of any of these crimes always punishable.