Bolivia

Article 56 requires operators of public networks and providers of telecommunications and information and communication technology services to guarantee the inviolability and secrecy of communications, and equally the protection of users' personal data and privacy, except what is contemplated in telephone directories, invoices, and other matters established by regulation.

Article 57 is an interpretation rule directing that, where doubt exists in applying sector regulation between a user and a provider, the rule favouring the user applies; it does not itself impose a data-security or organisational-measures duty.

Article 56 of the Reglamento para el Desarrollo de Tecnologías de Información y Comunicación, approved by Decreto Supremo No. 1793, sets a general set of personal-data-processing principles to guarantee personal data and its computer security.

Collecting, processing, blocking, cancelling, transferring, consulting, or interconnecting personal data, in the public and private sectors in all its forms, requires the data subject's prior knowledge and express consent, revocable for justified cause though not retroactively.

A person asked for personal data must be told beforehand that it will be processed, the purpose of collecting and registering it, its potential recipients, the identity and address of the party responsible for the processing, and the possibility of exercising rights of access, rectification, updating, cancellation, objection, and revocation.

Data may not be used for purposes other than those stated when collected, and may only be used, communicated, or transferred to a third party with the data subject's consent or a competent court's written order.

The party responsible for the processing, public or private, must adopt the technical and organisational measures necessary to secure the personal data and prevent its alteration, loss, or unauthorised processing, calibrated to the state of technology, the nature of the stored data, and the risks the data faces.

The Reglamento's own scope article states that it applies to natural or legal persons, public or private, engaged in activities or services related to digital certification, e-government, free software, and electronic commerce, so this chapter sits structurally within the Reglamento's title on digital-certificate holders even though its own text states the processing principles broadly, for the public and private sectors in all their forms.

Article 130 lets any individual or collective person who believes they are unduly or illegally prevented from knowing, objecting to, or obtaining the deletion or rectification of data registered by any physical, electronic, magnetic, or computer-based medium, in public or private files or data banks, file the Acción de Protección de Privacidad where that data affects their fundamental right to personal or family privacy, image, honour, or reputation; the action does not lie to lift press confidentiality.

Article 131 routes the action through the same procedure as the Acción de Amparo Constitucional and lets the competent court order the disclosure, deletion, or rectification of the challenged data, with an automatic review before the Tribunal Constitucional Plurinacional.

Article 363 ter, inserted alongside article 363 bis by Ley No. 1768, punishes whoever, without being authorized, appropriates, accesses, uses, modifies, suppresses, or disables data stored on a computer or any computer medium, causing harm to the owner of the information, with prestación de trabajo (a community-service sentence, one of the Código Penal's four principal penalties) of up to one year or a fine of up to two hundred day-fines (días multa).

Because it turns on acting sin estar autorizado (without authorization), this is the article that would reach a scraper who defeats an access control to appropriate or use data it was not authorized to take. Like article 363 bis, it was listed among the norms Ley No. 1005 purported to abrogate in 2017, but Ley 1005 was itself abrogated by Ley No. 1027 before Ley 1005's eighteen-month deferred entry into force elapsed, so article 363 ter was never actually displaced.

Article 363 bis, inserted into the Código Penal's new computer-crimes chapter by Ley No. 1768, punishes whoever, intending to obtain an undue benefit for themselves or a third party, manipulates a computer data processing or transfer so that it produces an incorrect result or avoids a process whose result would have been correct, causing a property transfer to a third party's detriment, with reclusión (imprisonment) of one to five years and a fine of sixty to two hundred day-fines (días multa).

Ley No. 1005, Código del Sistema Penal, promulgated 15 December 2017, listed Ley 1768 among the norms it abrogated. Ley 1005's own transitory provisions state that the Code's rules would enter into force eighteen months after publication. Ley No. 1027 abrogated Ley 1005 in its entirety on 25 January 2018, about six weeks later and well inside that eighteen-month period, so article 363 bis was never actually displaced.

Article 24 of Ley No. 1322, in the Título VI chapter on limitations to copyright, permits quoting an author, meaning the inclusion in one's own work of short fragments of others' works, provided the quoted work has already been divulged, its source and author are credited, and the inclusion is made as a citation or for its analysis, commentary, or critical judgment, for teaching or research purposes, in accordance with honest practices and to the extent the pursued purpose justifies, without becoming abusive.

The neighbouring articles in the same chapter, 25 and 26, address a state compulsory-use power over works of great cultural value after a period out of print and heirs' inability to block republication after five years of inaction, neither of which reaches news reproduction or aggregation.

The Law contains no separate press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, no recognized hot-news or misappropriation doctrine distinct from ordinary copyright law, and no located case law on hyperlinking or framed display; whether article 24's quotation exception reaches a systematic aggregator's reproduction of headlines and snippets, rather than quotation for the teaching, research, analysis, or critical-commentary purposes the article names, has not been tested in a reported Bolivian decision.