Cape Verde

Article 9 criminalises, through a computer system: producing child pornography with the purpose of disseminating it (2 to 8 years' imprisonment, paragraph 1); offering or making it available (1 to 5 years, paragraph 2); disseminating or transmitting it (1 to 5 years, paragraph 3); obtaining it for oneself or another (1 to 4 years, paragraph 4); and possessing it in any way (1 to 4 years, paragraph 5).

Paragraph 6 defines child pornography for these purposes as any pornographic material that visually represents: (a) a person under 14 years of age, or an incapable person, for exhibitionist purposes or involved in sexually explicit conduct; (b) a person 14 to 18 years of age involved in sexually explicit conduct; or (c) any representation, by any means, of a child under 18 performing real or simulated explicit sexual activities, or any representation of a child's sexual organs for a predominantly sexual purpose.

Paragraph 6(c)'s inclusion of a simulated representation reaches a computer-generated, AI-synthesised, or otherwise fabricated depiction of a child in sexually explicit activity on the same terms as a depiction of a real child, without requiring that an actual child be shown or that the material derive from a real event. Paragraph 6(d) sets a reduced penalty of up to three years' imprisonment where the victim depicted is 14 to 18 years of age.

Article 9 binds any person ("Quem"), not only an online service or platform. The Law was approved by the Assembleia Nacional on 25 January 2017, promulgated by the President of the Republic on 3 March 2017, and published in the Boletim Oficial of 20 March 2017; its own Article 33 provides that it enters into force 30 days after publication.

Article 2 applies the law to processing of personal data wholly or partly by automated means and to manual filing systems, reaching a controller established in Cabo Verde, a controller to whom Cabo Verdean law applies by international public law, or a controller outside the territory using equipment located there other than for transit, and separately to video surveillance and other capture, processing, and dissemination of sound and images permitting identification of a person.

Article 8 prohibits processing personal data revealing philosophical, ideological or political beliefs, religion, political party or trade union affiliation, racial or ethnic origin, or health and sex life including genetic data, unless the data subject has expressly consented with a guarantee of non-discrimination, or another legal authorization applies.

Article 14 gives every person the right not to be subject to a decision producing legal effects or significantly affecting them that is based solely on automated processing intended to evaluate personal aspects such as work performance, creditworthiness, reliability, or conduct, subject to Article 14(2)'s exceptions for contract-related automated decisions with safeguards.

Article 19 conditions transfer of personal data to a foreign state on the CNPD's assessment that the state ensures an adequate level of protection, and Article 20 permits the CNPD to authorize a transfer to a state that does not meet that standard where the data subject has given unequivocal consent or another enumerated derogation applies.

Article 23 requires the controller to notify the CNPD before carrying out an automated processing operation, subject to simplification or exemption the CNPD may grant, including for a filing system open to public consultation. Article 24 requires the CNPD's prior authorization for processing of the most sensitive data categories, data on credit and solvency, combination of personal data across filing systems, and use of data for a purpose other than that for which it was collected.

Article 31 entitles a person who has suffered damage from an unlawful processing operation or another act incompatible with the law to compensation from the controller, who may be exempted in whole or in part on proving he is not responsible for the fact giving rise to the damage.

Offences are backed by a graduated schedule: Article 33 fines the offence of omitting the Article 23 or 24 notification or authorisation, or providing false information in it, from CVE 50,000 to 500,000 for a single individual and from CVE 300,000 to 3,000,000 for a group of people or an entity without legal personality, doubled to the maximum for data subject to Article 24 prior authorisation; Article 34 fines other listed omissions from CVE 100,000 to 1,000,000.

Articles 40 to 44 create crimes for intentional non-compliance with the notification and authorisation duties (up to one year's imprisonment or a fine of up to 120 days, doubled to the maximum for Article 8 and 9 data), undue access to prohibited personal data (up to one year's imprisonment or a fine of up to 120 days, doubled for security-rule violations or a benefit obtained), invalidation or destruction of personal data (up to two years' imprisonment or a fine of up to 240 days), qualified non-compliance after CNPD notification, and violation of professional secrecy (imprisonment from six months to three years or a fine of 80 to 200 days).

Article 45 makes an attempt of any of these crimes always punishable.

Article 6(1) punishes with imprisonment of up to one year or a fine of up to 120 days anyone who, intentionally and without legal permission or without being authorised for that purpose by the owner or another rights holder of the system or part of it, in any way accesses a computer system.

Article 6(2) punishes the same conduct where a person produces, sells, distributes, disseminates, or introduces into one or more computer systems a device, program, executable set of instructions, code, or other computer data intended to produce that unauthorised access.

Article 6(3) raises the penalty to up to three years' imprisonment or a fine where the access is achieved through violation of security rules, and Article 6(4) raises it to one to five years' imprisonment where the agent thereby learns a commercial or industrial secret or legally protected confidential data, or obtains a considerably high patrimonial benefit or advantage.

Article 6(5) makes an attempt punishable, and Article 6(6) makes criminal proceedings for the base offences under paragraphs 1, 3 and 5 dependent on a complaint. Article 2 defines a computer system as any device or interconnected set of devices carrying out automated processing of computer data, together with the network supporting communication between them and the data stored, processed, retrieved, or transmitted by them.

The Law was approved by the Assembleia Nacional on 25 January 2017, promulgated by the President of the Republic on 3 March 2017, and published in the Boletim Oficial of 20 March 2017; its own Article 33 provides that it enters into force 30 days after publication.

Article 10(a) provides that news of the day and reports of different events given simply for information, however disclosed, may not be protected, placing bare news reporting entirely outside the Law's subject matter.

Article 62(1) permits, without authorization from the author and without compensation, several uses of works already lawfully published or disclosed, provided the authenticity and integrity of the title and the author's name are respected: alínea (c) covers reproduction of works included in news reports, filmed or televised, or of works permanently exhibited in public places or in places where representatives of social communication bodies have access; alínea (f) covers citation of short excerpts of another author's work, in written, audio, or visual form, when justified for scientific, critical or didactic reasons or for information, as long as those excerpts are not so extensive as to lessen interest in the work.

Article 62(2) separately permits an author who reproduces his own articles or letters published in newspapers or periodicals in argument with another person to also reproduce the replies of his adversary, binding the latter to the same right. Article 4 confines related (neighbouring) rights to performers, producers of phonograms and videograms, and broadcasting organisations, so the Law creates no press-publisher right.

Article 8(b) protects a database as a compilation where its selection or arrangement is an intellectual creation. Article 64(c) excludes reproduction of all or a significant part of a database from the private-use exception at Article 62(1)(l), rather than creating a separate sui generis database right. Article 139 revoked the prior copyright statute, Law No. 101/IV/90 of December 29, and Article 140 provides that the Law enters into force immediately.

The Law was published in the Boletim Oficial I Série No. 17 Supplement of April 27, 2009, the date WIPO Lex also records as the date of entry into force.