Zimbabwe

Every data controller or processor must ensure personal data is processed necessarily, fairly and lawfully (s. 8), collected for specified and legitimate purposes (s. 9), and, for sensitive data (including data revealing race, political opinion, religion, trade union membership, sex life, and health, genetic, or criminal history), only with the data subject's written consent, withdrawable at any time (s. 11).

Genetic data, biometric data and health data may not be processed at all unless the data subject has given written consent (s. 12). A data controller must notify the Authority of a security breach within 24 hours of discovering it (s. 19). A data subject has the right to be informed, to access their data, to object to processing, and to correct or delete false or misleading data (s. 14).

Transferring personal data outside Zimbabwe requires an adequate level of protection in the recipient's country or the transfer to be solely for tasks within the controller's competence (s. 28).

Any data controller, representative, agent or assignee who contravenes sections 11 (sensitive data), 13 (duties of controller), 18(4) (security), 24 (accountability) or 28 (transborder transfer) is guilty of an offence, liable to a fine not exceeding level 11 or imprisonment not exceeding seven years, or both (s. 33(2)); a member of staff of the Authority, or any expert, contractor or sub-contractor who violates the Act is liable to a fine not exceeding level 7 or imprisonment not exceeding two years, or both (s. 33(1)). The Act does not describe a private civil right of action for a data subject in the text reviewed.

Made under section 32 of the Cyber and Data Protection Act, this statutory instrument requires any person who decides the means, purpose or outcome of processing, decides what data to collect or from whom, or obtains commercial gain from processing personal information, to hold a data controller licence from the Authority (ss. 3-4), tiered by the number of data subjects processed (s. 6), and to appoint a certified data protection officer (s. 12).

A data controller must notify the Authority of processing activities, any intended cross-border transfer, and any processing of biometric or genetic data (s. 10(2)), must obtain parental or guardian consent before processing a child's personal information and may not subject a child's data to automated decision-making affecting the child's rights (s. 10(5)).

Personal data breaches must be reported to the Authority within 24 hours of the controller becoming aware of them, and, where the breach is likely to result in a high risk to individuals' rights and freedoms, affected data subjects must also be informed within 72 hours (s. 17).

Data controllers processing personal data only for personal, family or household affairs, law enforcement, or journalistic, historical or archival purposes are exempt from licensing, though the latter two must still register with the Authority (s. 8).

Section 163 (Hacking) makes it an offence for a person who knows or suspects they must obtain prior authority to access data, a computer programme, a data storage medium, or a computer system, to intentionally and unlawfully secure access without that authority, liable to a fine not exceeding level 10 or imprisonment not exceeding five years, or both, rising to level 14 or ten years in aggravating circumstances.

Section 163A (Unlawful acquisition of data) penalises intercepting a private data transmission, overcoming or circumventing a protective security measure to prevent access, or acquiring data within or transmitted to or from a computer system, at a fine not exceeding level 14 or imprisonment not exceeding five years, or both (ten years aggravated); possessing data known to have been unlawfully acquired is a separate, identically punished offence.

Section 163B (Unlawful interference with data or a data storage medium) and section 163C (Unlawful interference with a computer system) penalise damaging, deleting, altering, blocking access to, or otherwise interfering with computer data or the functioning of a computer or information system, at up to level 10 or five years for data interference (level 14 or ten years aggravated) and up to level 14 or ten years for system interference (twenty years aggravated).

Section 163D (Unlawful disclosure of a data code) penalises communicating an access code or password to a person not authorised to use it, or creating, altering or destroying such a code, at a fine not exceeding level 12 or imprisonment not exceeding ten years, or both, unless the act is authorised by law.

Section 163E (Unlawful use of data or devices) penalises acquiring, possessing, or supplying an access code, password, or programme designed to commit an offence under the Act, at up to level 12 or ten years, and assembling or using malicious software to damage data or systems, at up to level 10 or five years (level 12 or ten years aggravated).

None of these sections defines "unlawfully" or "authority" by reference to a public, unauthenticated web page; each turns on whether the accused knew or suspected they lacked authority, or overcame a protective security measure, to access or acquire the data.

Where the Board of Censors has approved a film, film advertisement, or public entertainment subject to a condition that it not be exhibited or given to persons of a specified age or sex, no person of that specified age or sex may be present at the place where it is being exhibited or given, subject to a defence for a person present in the course of employment or outside the admitted area (s. 27(1)).

A person who contravenes this is liable to a fine not exceeding level four or imprisonment not exceeding three months, or both (s. 27(2)). Separately, where the Board has imposed such a condition, the person in charge of the place or premises must cause the relevant restriction to be prominently displayed, and no person may publish or exhibit an advertisement of the film or entertainment unless the restriction is published or exhibited with it (s. 28(1)).

The age at which admission is restricted is set by the Board's approval condition for each film, advertisement or entertainment rather than fixed by the Act itself at a single statutory number.

Section 30(1) provides that the copyright in a lecture, address, speech or other similar work delivered in public is not infringed by its reproduction in the press or a broadcast for the purpose of information, and section 30(2) provides that the copyright in an article published in a newspaper or periodical, or a broadcast, on a current economic, political, or religious topic is not infringed by reproduction in the press or in a broadcast or cable programme, if the right of reproduction has not been expressly reserved and sufficient acknowledgement is given; neither exception applies where it conflicts with a normal exploitation of the work or unreasonably prejudices the copyright owner's legitimate interests (s. 30(3)).

Section 29 excuses fair dealing for the purposes of criticism or review of a work, or of reporting current events, subject to sufficient acknowledgement, except where the work is used to report current events by means of an audio-visual work, a sound recording, a broadcast, or a programme-carrying signal, and except that using a photograph to report current events is never fair dealing.

Section 31 excuses a quotation from a literary or musical work, including a quotation from an article in a journal that summarises the work, where the quotation is compatible with fair practice, does not exceed the extent justified by the purpose, and is sufficiently acknowledged.

The Act's neighbouring-rights provisions protect performers, producers of sound recordings, and broadcasting organisations rather than a print or online news publisher as such, so no publisher-side neighbouring right exists, and the Act contains no text-and-data-mining exception, no reference to hyperlinking or framing, and no compelled-bargaining mechanism.