Crawls the web, in Gabon

Loi n°1/87, art. 5 (recueils et compilations), du 29 juillet 1987 instituant la protection du droit d'auteur et des droits voisins · Read the law's page

• Do not reproduce a collection or database whose choice or arrangement of contents is an original intellectual creation without the rightsholder's authorization; Gabon has no sui generis database right, so an unoriginal, purely factual collection is not itself protected.

Loi N° 027/2023 du 11 juillet 2023, Titre III, Chapitre III, Section 2, arts. 28-35 · Read the law's page

• This binds any operator of an information system with effects in Gabon, a term Law No. 027/2023 defines without a sector or size gate as an organised set of resources that collects, groups, classifies, processes or disseminates information, and separately binds any person whose activity is to offer users access to an information system.
• Take all technical and administrative measures necessary to guarantee the security of the services you offer, including a standardised system to identify, evaluate, treat and continuously manage the risks affecting your information systems' security.
• Deploy technical mechanisms addressing threats to your systems' continuous availability, integrity, authentication, resistance to repudiation by third-party users, data confidentiality and physical security, and have those mechanisms cleared for conformity with the competent administrative authority's cybersecurity policy.
• If your activity is to offer users access to an information system, inform them of the danger of using an unsecured system, the need for a parental-control device, the particular risks of a security breach, and the existence of a technical means to restrict access to certain services, and offer them at least one such means.
• Retain your systems' connection and traffic data for ten years, and submit your networks and information systems to a mandatory, periodic security audit on terms a regulation sets.
• Comply within six months of the law's entry into force; Article 98 does not itself state what sanction follows a late or missing compliance with this duty.

Loi n°001/2011 du 25 septembre 2011 relative à la protection des données à caractère personnel, telle que modifiée et complétée par la loi n°025/2023 du 9 juillet 2023, Journal Officiel n°218 bis du 15 juillet 2023, articles 1 à 6, 70 à 73, 78 à 90, 111 à 141, 164 à 167, 175 à 187 et 215 à 221 · Read the law's page

• Collect and process personal data fairly and lawfully, only for determined, explicit and legitimate purposes, and keep it accurate, adequate and no longer than those purposes need.
• Have a lawful basis for processing, such as the data subject's consent, a legal obligation, a public-service mission, contract performance, or a legitimate interest that does not override the data subject's own rights and freedoms.
• Where you rely on consent, be able to demonstrate it was given and present the request clearly and separately from other terms; never treat acceptance of general terms of use or a pre-checked box as consent, and in an electronic transaction take it through an unambiguous act such as a checkbox.
• Let the data subject withdraw consent at any time without affecting the lawfulness of processing already carried out, and tell them of that right before they consent.
• Declare an automated personal-data processing activity to the APDPVP before carrying it out and wait for the Authority's receipt before starting, unless a simplified or exempt category applies; processing touching a more sensitive category instead needs the APDPVP's prior authorization or a ministerial or Council-of-Ministers decree.
• Keep processing confidential, bind everyone who processes the data under your authority to a signed written undertaking, and impose the same security and confidentiality guarantees on any processor by contract.
• Implement technical and organizational security measures adapted to the risk, including pseudonymization and encryption, and regularly test, assess and evaluate their effectiveness.
• Keep a written or electronic register of your processing activities, and require the same of any processor, naming the controller, purposes, data categories, recipients, transfers and retention periods, and produce it to the APDPVP on request; an organization of fewer than ten employees is exempt unless the processing is not occasional, carries a risk to rights and freedoms, or touches sensitive or criminal-offence data.
• Designate a data protection officer, notify the APDPVP of the designation, and give the officer the office, resources and independence to advise you, monitor compliance, and liaise with the APDPVP, where you are a public authority, carry out large-scale systematic monitoring, or process sensitive or criminal-offence data at scale.
• Carry out a data protection impact assessment, the study the law says must be carried out whenever processing is likely to create a high risk to the rights and freedoms of the people concerned.
• Before deploying an artificial-intelligence system, a facial-recognition or other biometric-identification system, a drone or other connected object, an electronic-signature or digital-identity service, or a national or sectoral identifier system that processes personal data, file the declaration or notice the applicable norme or decree requires with the APDPVP.
• Comply with the law from the date of its publication.

Loi n°027/2023 du 11 juillet 2023 portant réglementation de la cybersécurité et de la lutte contre la cybercriminalité en République Gabonaise, chapitre Ier (art. 49-61) · Read the law's page

• Do not access or remain in a computer system without authorization, whether or not the system is protected by a technical measure, and do not exceed an access you were granted.
• Do not intercept data fraudulently, by technical means, during its non-public transmission to, from or within a computer system, including the electromagnetic emissions from a system carrying such data.
• Do not hinder the operation of a computer system, or fraudulently introduce, alter, delete, or extract the data it holds.
• Do not knowingly use data you know was obtained through one of these offences.