Tunisia

Article premier declares the protection of personal data a fundamental, constitutionally guaranteed right, and article 2 applies the Act to both automated and non-automated processing carried out by a natural or legal person, with article 3 exempting processing for a strictly personal or family purpose not communicated to a third party.

Article 7 requires a prior declaration to the INPDP before any processing, deemed accepted if the INPDP does not object within one month, and article 8 requires the INPDP's prior authorization for the processing listed elsewhere in the Act.

Article 14 prohibits processing data revealing racial or genetic origin, religious, political, philosophical or trade-union views, or health, unless the person gives express consent in a form leaving a written trace, the data has become manifestly public, or the processing is necessary for historical or scientific purposes or to safeguard the person's vital interests, with article 15 requiring the INPDP's separate authorization for that processing (except health data).

Article 27 requires the person's express, written consent before processing, and article 31 requires advance written notice of the processing's purpose, its recipients, the person's access and objection rights, the retention period, and the destination country of any transfer.

Articles 32 to 43 give the data subject a right of access, rectification, and objection, enforceable before the INPDP, and articles 51 and 52 require the INPDP's prior authorization before any transfer of personal data abroad, conditioned on the destination country assuring an adequate level of protection. Article 50 separately bars any transfer of personal data abroad capable of harming public security or Tunisia's vital interests, regardless of that authorization. Article 20 makes the data controller and processor civilly liable for a breach of the Act's provisions.

Article 16 punishes anyone who knowingly accesses or remains illegally in a computer system, in whole or in part, and imposes the same penalty on anyone who knowingly exceeds the limits of an access right they have been granted; an attempt is also punishable. The offence carries three months to one year of imprisonment and a fine of 10,000 dinars.

Because the offence's trigger is illegal access or exceeding a granted access right, reading a public, unauthenticated page that defeats no access control falls outside a plain reading of the provision. Article 37 repeals the former articles 199 bis and 199 ter of the Penal Code, which the decree-loi's Chapter III offences supersede.

Article premier extends copyright to every original literary, scientific or artistic work but states that protection covers expressions and does not extend to official legislative, administrative or judicial texts and their official translations, or to the news of the day or miscellaneous facts that have the character of simple press information; a bare fact or news item is therefore never a protected work under Tunisian law, whichever outlet reports it first.

Article 11 separately authorises quotations and borrowings taken from a work already lawfully made accessible to the public, including quotations and borrowings from articles in the form of press reviews, on condition that they conform to fair practice and are justified by a scientific, educational or informational purpose, used in their original version or in translation, and accompanied by mention of the source and the author's name where it appears in the source.

The exception is not capped at a headline-length or short-extract threshold and is not confined to the press industry; whether it reaches a systematic aggregator's reproduction of headlines and snippets, as opposed to a traditional press review, has not been tested in a located Tunisian decision.

Article 51 arms a rightholder with civil damages for a breach of copyright or related rights, and article 52 sets a criminal fine of 1,000 to 50,000 dinars, doubled on repeat offence with up to twelve months' imprisonment added, for exploiting a protected work without the required authorization.