Lesotho

The Data Protection Act, 2011 (Act No. 5 of 2012) establishes the Data Protection Commission and provides for principles regulating the processing of personal information, applying to a data controller domiciled or having its principal place of business in Lesotho, and to a controller outside Lesotho that uses automated or non-automated means in Lesotho or uses such means only for forwarding personal information (s. 3), subject to exemptions for purely personal or household activity, de-identified information, specified State national-security, defence or public-safety functions, and journalistic, artistic or literary expression necessary to reconcile privacy with freedom of expression (s. 4).

A data controller must give a data subject notice of the information being collected and its purpose before or as soon as practicable after collection (s. 25), and may not process spiritual, religious or philosophical beliefs, race or ethnic origin, trade union membership, political affiliation, health, sexual life or criminal behaviour unless a listed exemption applies (s. 29); biometric identifiers are defined in the Act (s. 2) but are not among this enumerated list, so they carry no heightened processing restriction beyond the Act's general lawfulness and security duties.

A data subject may request access to, and free of charge challenge the correctness of, personal information a controller holds about them (ss. 26-27). Where there are reasonable grounds to believe a data subject's personal information has been accessed or acquired by an unauthorised person, the data controller must notify the Commission and, unless the data subject cannot be identified, the data subject as well (s. 23(1)).

Notification to the data subject may be delayed where the Lesotho Mounted Police Service, the National Security Service or the Commission determines that it would impede a criminal investigation (s. 23(3)).

A person may not be subjected to a decision with a legal or significant effect on them based solely on automated processing intended to profile their personality or habits, except where taken in connection with a contract at the data subject's request or under another law with safeguards in place (s. 51).

Transferring personal information outside Lesotho requires the foreign recipient to be subject to a law, code of conduct or contract that effectively upholds substantially similar processing principles, or another listed condition such as the data subject's consent (s. 52). Enforcement combines the Commission's complaint-investigation-and-enforcement-notice process (ss.

39-48) with a data subject's own civil action for damages for breach of any provision of the Act (s. 49), and a criminal offence, on conviction, for hindering the Commission, breaching confidentiality rules, obstructing execution of a warrant, or violating the Act's provisions without reasonable cause, carrying a fine of up to M50,000 or imprisonment of up to five years, or both, with the sentence served by the Chief Executive Officer where the offender is a juristic person (s. 55).

Section 62(2) makes it an offence for a person who either lawfully or unlawfully gains access to a computer or electronic storage device owned by another to (a) extract from it information which he or she has no reasonable cause to believe the owner would allow to be extracted, or (b) interfere with the device or the information it contains, without the owner's consent and with no reasonable ground to believe such consent would be given, intending to secure an advantage for themselves or cause damage to the electronic data or programmes.

The offence is framed around the owner's likely consent to the extraction rather than around defeating a technical access control, so its application to a person who reads or collects data from a genuinely public, unauthenticated web page, where the owner has made the content available to any visitor, is unsettled; no reported Lesotho case construes section 62 in that context.

Section 62 is not among the sections listed in the Code's penalty Schedule, so under section 109(3) a court convicting a person under section 62 imposes such penalty as another law provides or, absent one, such penalty as it thinks fit having regard to the offence's gravity and the Sentencing Guidelines issued by the Chief Justice, rather than a fixed statutory cap.

Section 3 grants copyright protection to original literary, artistic and scientific works by the sole fact of their creation, and section 2's closed list of "literary, artistic and scientific" works does not extend to a table, compilation, or database as such, so Lesotho has no sui generis database right and no separate compilation-specific protection; a database is protected, if at all, only to the extent its selection or arrangement of content is itself an original literary or artistic work.

Section 5(c) excludes "mere communications of facts and data" from protection altogether, so bulk collection of unadorned factual data is outside the scope of copyright from the start.

The Order enacts no text-and-data-mining exception of any kind, so large-scale automated reproduction of copyrighted expression (as opposed to bare facts) for AI-training purposes falls to be justified, if at all, under the ordinary "Free use" exceptions in section 9, none of which is framed around automated or machine collection.

A person whose economic rights under section 7 are infringed, including by unauthorized reproduction beyond a section 9 exception, may seek an interdict and damages under section 36, and separately faces criminal liability under section 37(1) for violating the rights the Order protects.

Section 1 provides that the Order comes into operation on a date to be appointed by the Minister by notice in the Gazette, and no such commencement notice has been located, so no commencement day is recorded even though the Order, as the sole copyright statute located, is treated as the current law.

Section 5 excludes "rules or decisions of courts and administrative bodies," "news of the day published, broadcast or publicly communicated by any other means," and "mere communications of facts and data" from copyright protection, so a factual news report as such is never a protected work in the first place.

Section 9(a)(ii), the Order's "Free use" provision, permits, without the author's consent and without payment, the inclusion of quotations from a protected work in another work, with mention of source and author, "including quotations from newspaper articles and periodicals in the form of press summaries," provided the quotation is compatible with fair practice and its extent does not exceed what the purpose justifies.

Section 11(c) permits reproducing in the press, or communicating to the public, an article published in a newspaper or periodical on a current economic, political or religious topic (or a broadcast or cable-distributed work of the same character), unless the article or work was accompanied by an express condition prohibiting such use, and provided the source is clearly indicated when so used.

Section 11(d) separately permits, for the purpose of reporting a current event, the reproduction or making available to the public of a work to the extent justified by the informatory purpose.

Section 11(g) permits reproducing in the press, or communicating to the public, a political speech delivered in public, a speech delivered during legal proceedings, or a public lecture, address or sermon, provided the use is exclusively for current information, while the author retains the right to publish a collection of such works. None of these provisions creates a publisher-side neighbouring right; the Order's own neighbouring-rights part (ss.

24-30) reaches only performers, producers of phonograms, and broadcasting organisations. Section 1 provides that the Order comes into operation on a date to be appointed by the Minister by notice in the Gazette, and no such commencement notice has been located, so no commencement day is recorded even though the Order, as the sole copyright statute located, is treated as the current law.