Senegal

Article 33 makes a data subject's consent the general basis for lawful processing, with derogations for a legal obligation, a public-interest or official mission, performance of a contract, or safeguarding the data subject's vital interests.

Article 40 prohibits collecting or processing data revealing racial, ethnic or regional origin, filiation, political opinion, religious or philosophical belief, trade-union membership, sexual life, genetic data, or health, subject to article 41's exceptions for data the person has manifestly made public, written consent, vital-interest necessity, and several public-interest grounds.

Articles 58 through 69 give the data subject a right to be informed at collection, a right of access to and a copy of their data, a right to object to processing for legitimate reasons (including direct marketing), and a right to have inaccurate, incomplete, or unlawfully held data rectified or deleted.

Article 49 bars transferring personal data to a country that does not ensure a sufficient level of protection unless the controller first notifies the CDP, and article 50 permits a transfer to a country without such protection only where it is a one-off, non-massive transfer made with the person's express consent or is necessary to protect life, the public interest, a legal claim, or a contract.

Article 71 requires a controller to take precautions appropriate to the nature of the data, including access controls, audit trails, and security copies, but neither article 71 nor any other provision located requires notifying the CDP or the affected person of a security breach. Article 75 states that violations of the Act are punished under the Penal Code and the law on cybercrime.

That cybercrime law, Loi n° 2008-11, in turn sets prison terms of one to seven years and fines of 500,000 to 10,000,000 CFA francs for most of the processing offenses it creates against Loi n° 2008-12's duties, a lower six-months-to-five-years and 300,000-to-5,000,000-franc tier for negligent unlawful disclosure, and requires the victim's own complaint before prosecuting an unlawful-disclosure offense.

Article 431-8 punishes anyone who fraudulently accesses or attempts to access all or part of a computer system, and anyone who fraudulently obtains an advantage for himself or another by accessing one, with a prison term of six months to three years and/or a fine of 1,000,000 to 10,000,000 CFA francs; article 431-9 punishes fraudulently maintaining a presence in a system with the same penalty.

Unlike a neighbouring statute that limits the offense to access gained by infringing a security measure, article 431-8's English text carries no such express trigger, so whether reading a public, unauthenticated page without defeating any access control satisfies 'fraudulently accesses' has not been settled by a reported Senegalese decision.

Article 431-10 separately punishes obstructing or distorting a computer system's operation, with a prison term of one to five years and a fine of 5,000,000 to 10,000,000 CFA francs. Article 431-12 punishes fraudulently intercepting non-public data transmissions with the same range of penalties.

Article 44 lets any person make analyses of and short quotations from a work already lawfully disclosed, without the author's consent, provided the author's name and the work's title are mentioned and the quotation is compatible with fair practice.

Article 45(1) separately lets any person reproduce or communicate, for information purposes and without the author's consent, articles on current political, social or economic topics and speeches made at political, judicial, administrative or religious gatherings or public meetings, provided the author's name and the source are mentioned. Article 45(2) extends the same information-purpose freedom to reproducing or communicating a work seen or heard while reporting a current event.

Neither branch of article 45 states a short-extract or headline-only limit the way article 44 does for quotations, and none of the sources located records a reported Senegalese decision testing whether a systematic aggregator's reproduction of headlines and snippets, as distinct from a traditional press review or a single current-events report, falls within either exception.

Senegal has no separate press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, no recognized hot-news or misappropriation doctrine distinct from ordinary copyright and unfair-competition law, and no located case law on hyperlinking or framed display.

Article 8(3) protects a database as a copyright work only where its selection or arrangement of contents is itself an original creation, and Senegal has no sui generis database right and no text-and-data-mining exception or machine-readable opt-out mechanism.