Mauritius

A controller must notify the Commissioner of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, giving reasons for any later notification, and a processor must notify the controller without undue delay.

Where a breach is likely to result in a high risk to a data subject's rights and freedoms, the controller must also communicate it to the data subject without undue delay, unless the affected data was rendered unintelligible (for example by encryption), the risk has been neutralised by later measures, or individual communication would involve disproportionate effort and a public communication is made instead.

The Data Protection Act 2017 establishes the Data Protection Office, headed by the Data Protection Commissioner, and requires every controller or processor to process personal data lawfully, fairly and transparently, only for an explicit and legitimate purpose.

Processing must rest on one of a listed set of grounds, including the data subject's consent, contractual necessity, a legal obligation, or the controller's legitimate interests, and a contravention of this lawful-processing duty is itself an offence. No person may process the personal data of a child below 16 unless the child's parent or guardian has consented, and the controller must make a reasonable effort to verify that consent, taking into account available technology.

A controller or processor may transfer personal data to another country only where it has given the Commissioner proof of appropriate safeguards, the data subject has given explicit informed consent, the transfer is necessary for a contract or legal claim, or another listed condition applies. The Commissioner may require a person transferring data to demonstrate the effectiveness of its safeguards and may prohibit, suspend or condition a transfer to protect data subjects' rights.

Every data subject has a right of access to their personal data, and a right to rectification, erasure or restriction of processing and to object to processing.

Section 38 gives a data subject a right not to be subject to a decision based solely on automated processing, including profiling, that produces a legal effect or significantly affects them, subject to exceptions for contractual necessity, a law with safeguards, or the data subject's explicit consent, and any automated processing intended to evaluate personal aspects of an individual must not be based on special categories of personal data.

Where the Commissioner considers that a controller or processor has contravened, is contravening, or is about to contravene the Act, the Commissioner may serve an enforcement notice requiring specified steps within a specified period, with a right of appeal.

Unlawfully disclosing personal data outside the purpose for which it was collected, or without the controller's or processor's prior authority, is a separate offence, and any offence for which no specific penalty is provided, or any other contravention of the Act, carries a general penalty.

Special categories of personal data, defined to include racial or ethnic origin, political opinion, religious or philosophical belief, trade union membership, physical or mental health, sexual orientation, and genetic or biometric data uniquely identifying a person, may be processed only on a specific ground: the general lawful-processing test plus a not-for-profit body's legitimate activity with appropriate safeguards, data manifestly made public by the data subject, or necessity for a legal claim, healthcare, carrying out an obligation or exercising a right of the controller or the data subject, or protecting vital interests.

Health data processed for preventive or occupational medicine or healthcare must be handled by or under a person bound by professional secrecy.

Section 7 makes it an offence for a person to gain unauthorised access to any program or data held in a computer system, carrying a fine of up to 1,000,000 rupees and penal servitude of up to 10 years. Access is unauthorised where the person is not entitled to control access of that kind and has not been authorised by someone who is. A related offence, unauthorised modification of computer data under section 11, carries the same fine but penal servitude of up to 20 years.

The Act repealed and replaced the Computer Misuse and Cybercrime Act 2003, defining the unauthorised-access offence in substantially the same terms; because the trigger is unauthorised access rather than defeating a security measure, whether reading a public, unauthenticated page without any such access falls within the offence has not been tested by a Mauritian court.

Sections 16 to 22 permit reproduction or quotation of a work without the copyright owner's authorisation only within narrow bounds: private reproduction for personal use (excluding a database in digital form or a computer programme except as separately provided), quotation compatible with fair practice but only for caricature, parody or pastiche, utilisation for scientific research or teaching illustration, reprographic reproduction for face-to-face teaching or by libraries and archives, and reproduction or broadcasting of short excerpts for reporting current events.

There is no text-and-data-mining-specific exception. A person who, without authorisation, publishes, distributes, reproduces or communicates a work to the public for commercial gain commits an offence under section 56, liable on a first conviction to a fine not exceeding 300,000 rupees and imprisonment not exceeding 2 years, rising on a second or subsequent offence to a fine not exceeding 500,000 rupees and imprisonment not exceeding 8 years.

The Act protects a database only where it is original by reason of the selection or arrangement of its contents, as a compilation work, and confers no separate sui generis database right.

Section 21 permits, without the author's or copyright owner's authorisation, the reproduction in a newspaper or periodical, or the broadcasting or other communication to the public, of an article published in a newspaper or periodical on current economic, political or religious topics, unless the right to authorise that reproduction, broadcasting or communication is expressly reserved by the author or owner on the copies or in connection with the broadcast, and separately permits reproducing and broadcasting short excerpts of a work seen or heard in reporting current events, to the extent justified by that purpose, in each case subject to indicating the source and the author's name so far as practicable.

Section 18 permits quotation from a lawfully published work compatible with fair practice, but only where used for the purpose of caricature, parody or pastiche.