Djibouti

Article 1's definitions chapter defines child pornography as any visual representation of sexually explicit conduct, including a photograph, film, video, or image, whether manufactured or produced by electronic, mechanical, or other means, where a minor is involved in the production, and expressly includes a digital image, a computer image, or a computer-generated image in which a minor is engaged in sexually explicit conduct, as well as a visual representation created, adapted, or modified so that a minor appears to engage in such conduct.

Article 595 punishes anyone who produces, records, offers, makes available, distributes, or transmits, by means of an information system, an image or representation bearing the character of child pornography, with imprisonment of 2 to 7 years and a fine of 14,000,000 to 70,000,000 Djiboutian francs. Article 596 punishes procuring, importing, or exporting such an image or representation with imprisonment of 6 months to 5 years and a fine of 35,000,000 to 350,000,000 francs.

Article 597 punishes possessing such an image or representation, or facilitating a minor's access to pornographic material, with the same penalties as Article 596. Article 598 punishes habitually consulting an online public communication service that makes such an image or representation available, with 10 years' imprisonment and a fine of up to 17,500,000 francs.

Because the Article 1 definition already reaches a computer-generated image without requiring a real child to have been depicted, these offences bind an AI system's output on the same terms as a photograph or video.

Article 3 applies the book to automated and manual processing of personal data carried out by the State, a local authority, a public or private legal person, or a natural person. Article 4 extends it extraterritorially to a controller or processor not established in Djibouti that offers goods or services to, or monitors the behaviour of, persons in Djibouti.

Article 5 exempts only purely domestic or personal processing not intended for onward communication, and temporary technical copies made for network transmission. Article 54 sets the lawfulness, fairness, transparency, purpose-limitation and minimisation principles, and Article 57 requires an express, unambiguous, free, specific and informed consent wherever consent is the ground relied on.

Article 59 lets a minor consent alone to an information-society service's processing of their personal data only from age 16, and requires parental consent below that age, which the controller must make reasonable efforts to verify given the technology available.

Article 62 prohibits processing racial or ethnic origin, political or philosophical opinions, religious opinions or beliefs, trade-union membership, genetic data, biometric data used to uniquely identify a person, or health data, subject to ten enumerated exceptions including express consent, data the person has manifestly made public, and vital-interest or public-health grounds.

Article 65 bars a decision producing legal effects on a person, or significantly affecting them, from resting solely on automated processing of their personal data, including profiling, unless the decision is authorised by law with appropriate safeguards, or rests on explicit consent or contract performance together with the right to human intervention, to express a point of view, and to contest the decision.

Articles 14 and 15 require the controller to notify the CNDP of a personal-data breach without undue delay and at latest within 72 hours of becoming aware of it, and to notify the affected individual without undue delay where the breach is likely to result in a high risk to their rights and freedoms, unless the data was rendered unintelligible, the risk has been neutralised, or notification would require disproportionate effort.

Articles 66 to 73 subject processing to a prior declaration, a simplified declaration, or the CNDP's prior authorisation depending on its risk category. Articles 99 to 102 bar transferring personal data to a country or international organisation outside Djibouti unless the CNDP has found its level of protection adequate, or the controller relies on an alternative safeguard the CNDP authorises.

Article 104 establishes the CNDP as an independent administrative authority, and Article 135 arms it to impose an administrative sanction of up to 70,000,000 Djiboutian francs or, for an enterprise, 5% of worldwide annual turnover excluding tax for the last closed financial year, whichever is higher, plus a daily penalty payment of up to 35,000,000 Djiboutian francs for continued non-compliance with a formal notice.

Chapter 6 (Articles 140 to 156) separately criminalises non-compliance with the prior-formalities regime, unauthorised processing of the national identification number, processing sensitive or offence-related data outside the statutory grounds, fraudulent collection, misuse of purpose, unauthorised transfer, disregarding an objection, failing to secure or notify a breach, retaining data beyond its legal duration, and unauthorised disclosure, most of these punishable by 5 to 10 years' imprisonment and a fine of 7,000,000 to 35,000,000 Djiboutian francs, with narrower tiers for the national-identification-number offence (5 years and 4,000,000 francs) and for a negligent unauthorised disclosure (5 years and a fixed 7,000,000 francs).

Article 555 punishes anyone who has accessed or attempted to fraudulently access all or part of an information system with a maximum of three years' imprisonment and a maximum fine of 10,000,000 Djiboutian francs, or either penalty alone. Article 556 punishes fraudulently remaining, or attempting to remain, within all or part of a system after having entered it fraudulently, with the same maximum penalties.

Article 557 raises both offences to a maximum of five years' imprisonment and a maximum fine of 25,000,000 francs where the fraudulent access or continued presence results in the deletion or modification of data held in the system. Article 558 separately punishes fraudulently introducing, or attempting to introduce, data into an information system, with a maximum of five years' imprisonment and a maximum fine of 25,000,000 francs or either penalty alone.

Article 559 punishes disrupting, altering or falsifying, or attempting to disrupt, alter or falsify, the operation of an information system on the same terms as Article 558. Each offence is drafted around unauthorised access or interference with a system rather than around the reading of a page that requires no authorisation, so a scraper confined to public, unauthenticated pages is not on the face of these articles caught by them.

Article 8(b) provides that protection shall not apply to news of the day or to miscellaneous facts having the character of mere items of press information, published, broadcast, or communicated to the public, placing bare news reporting entirely outside the Law's subject matter.

Article 54 permits, without the author's consent, several uses of a protected work that has been lawfully published; alínea (b) covers the inclusion of non-substantial quotations from another work, including quotations from newspaper articles and periodicals in the form of press summaries, provided the quotations are compatible with fair practice, their extent does not exceed what the purpose justifies, and the source and the author's name are named in the citing work.

Article 4 extends protection to the authors of anthologies or collections of works, expressions of folklore, or data such as databases that, by reason of the selection or arrangement of their contents, constitute intellectual creations, without creating a separate sui generis database right.

Title 2 (Articles 60 and following) confines neighbouring rights to performers and phonogram producers, and a later Title extends comparable protection to broadcasting organisations, so the Law creates no publisher-side right of the kind the European Union's Digital Single Market Directive Article 15 creates.

Article 116 reserves traditional knowledge, genetic resources, folklore, and the Internet for a future decree to supplement the Law, acknowledging that the Law as enacted does not itself address online use. Article 117 repealed the prior copyright statute, Law No. 114/AN/96 of September 3, 1996.

Article 118 provides that the Law is implemented as a State Law and published in the Official Gazette upon its enactment; WIPO Lex records both promulgation and entry into force on July 23, 2006, the date of enactment itself.