Mali

Article 1 requires the Malian State to protect the personal data of every natural or legal, public or private person, and article 2 prohibits basing a decision producing legal effects for someone solely on an automated processing intended to profile them or assess aspects of their personality.

Article 5 subjects to the Act any processing of personal data by the State, territorial authorities, incorporated bodies, and private natural or legal persons, and any processing implemented by a controller established or not on Malian territory, excluding only means used solely for transit.

Article 6 excludes just two categories from the Act's scope: processing by a natural person for exclusively personal or domestic activities not intended for systematic communication to third parties or dissemination, and temporary technical copies made for network transmission.

Article 7 requires personal data to be collected and processed fairly and lawfully, for determined, explicit, and legitimate purposes, and article 8 requires the controller to take every precaution useful to preserve data security, including preventing deformation, damage, or unauthorized third-party access.

Article 9 prohibits processing sensitive data (data relating to religious, philosophical, political, or union opinions or activities, sexual life or racial origin, health, or social measures, prosecutions, or criminal or administrative sanctions) unless the Autorité de Protection des Données à Caractère Personnel has approved a derogation meeting one of three conditions: necessity to safeguard the life of the data subject or a third party where consent cannot be given, implementation by a non-profit religious, philosophical, political, or union body solely to manage its own members, or necessity to establish, exercise, or defend a legal right.

Article 11 conditions transfer of personal data to a foreign country on the Autorité recognizing that the destination State ensures a sufficient level of protection, or on the Autorité deciding that the transfer and the recipient's processing guarantee a sufficient level of protection, including through contractual clauses or internal rules.

Articles 12 through 19 give a person the right to obtain a free copy of data concerning them, to have inaccurate, incomplete, or unlawfully processed data rectified, completed, updated, blocked, or deleted, to be informed at collection of the controller's identity, the purpose of processing, the categories of data, and their rights, and to object, for legitimate reasons, to a processing of their data or to its communication to third parties for prospecting purposes.

Articles 20 through 52 establish the Autorité as an independent administrative authority empowered to set data-processing norms, authorize interconnections and transfers, receive complaints, inspect processing operations, and impose administrative sanctions, and article 57 requires a controller to declare to the Autorité the processing operations it intends to carry out for a given purpose.

Article 4 punishes anyone who accesses or attempts to access, fraudulently, all or part of an information system, with imprisonment of two months to one year and a fine of 200,000 to 5,000,000 CFA francs, or either penalty, and raises the penalty to two months to two years' imprisonment and a fine of 1,000,000 to 10,000,000 CFA francs where the access results in deleting or altering data or impairing the system's operation.

Article 5 punishes fraudulently remaining or attempting to remain in all or part of an information system on the same terms.

Article 3 defines fraudulent access as any irregular mode of penetration of an automated data-processing system, a definition that does not itself require defeating a technical security measure, so whether it reaches a person who reads a public, unauthenticated page without circumventing any access control turns on how 'irregular' is construed rather than on a stated security-measure element.

Article 10 excludes official legislative, administrative, or judicial texts and their official translations, the news of the day, and mere facts and data from copyright protection outright: a bare fact, or the news of the day as such, is never a protected work under Malian law, whichever outlet reports it first.

Article 27(a) separately authorizes, once a work has already been lawfully made accessible to the public, analyses and short quotations conforming to fair practice and justified by a scientific, critical, educational, or informational purpose, including citations and borrowings of periodical-press articles in the form of press reviews, provided the borrowing is used in its original or translated form and is accompanied by the source and the author's name.

Because the press-review borrowing is introduced by 'y compris' (including) inside the same sentence as the general 'courtes citations' (short quotations) rule, it does not on its own text extend to a full or near-full reproduction of a news article the way a broader press-review carve-out would.

Article 9(b) separately protects a compilation such as a database as a copyright work where the selection, coordination, or arrangement of its contents constitutes an intellectual creation, without creating a distinct sui generis database right.