Cabo VerdeLaw No. 133/V/2001 on the Protection of Personal Data, undue access and data diversion crimes
Lei n.º 133/V/2001 de 22 de Janeiro, arts. 60 and 64 to 67 as republished by Lei n.º 121/IX/2021, de 17 de Março (acesso indevido e crimes contra os dados pessoais)
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Prohibition
As of .
What it requires
- Do not access personal data barred to you without due authorization or justification, on pain of up to one year's imprisonment or a fine of up to 120 days, doubled where achieved by defeating security rules, where it let you or a third party learn personal data, or for a benefit.
- Do not copy, transfer or assign personal data without legal provision or consent, use it incompatibly with the purpose of collection, promote an illegal interconnection of data, or insert false personal data to obtain an undue advantage or cause harm, on pain of up to one or two years' imprisonment or a fine of up to 120 or 240 days.
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Access to barred personal data without due authorization or justification draws up to one year's imprisonment or a fine of up to 120 days, doubled for a security rule violation, knowledge of the data or an obtained benefit (Article 60); and diversion of data, incompatible use, illegal interconnection and insertion of false data draw up to one or two years' imprisonment or fines of up to 120 or 240 days (Articles 64 to 67). These are day fine terms; the statute does not itself state the escudo value of a day fine unit.
What this law does
Article 60 makes it a crime, punishable by up to one year's imprisonment or a fine of up to 120 days, to access personal data to which access is barred without due authorization or justification, with the penalty doubled where the access was achieved by violating a technical security rule, let the offender or a third party learn personal data, or gave a benefit or financial advantage, and prosecutable only on complaint.
Articles 64 to 67 make it a crime to copy, transfer or assign personal data without legal provision or consent, to use personal data incompatibly with the purpose of collection, to promote or carry out an illegal interconnection of data, and to insert false personal data, punishable by up to one or two years' imprisonment or by fines of up to 120 or 240 days. Lei n.º 121/IX/2021 entered into force thirty days after its own publication on .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions or is a listed company.