Angola

Article 198(2) punishes with imprisonment of two to ten years a person who produces child pornography to be spread through an information system, or who offers, makes available, disseminates, or transmits it through an information system.

Article 198(5)(a) defines 'child pornography' for this purpose as any material that visually or aurally represents a minor under 18, or a person, real or virtual, appearing to be a minor under 18, engaged in sexually explicit conduct or conduct that incites such conduct. Because the definition expressly reaches a 'virtual' person merely appearing to be a minor, the offence covers a wholly synthetic, AI-generated depiction with no real child involved, not only material derived from a real child.

Article 198(1) separately punishes conduct that exposes a minor under 18 to obscene material or uses or procures a minor for pornographic photography, film, or recording. Article 198(3) punishes acquiring, possessing, or facilitating access to child-pornography material by any means with imprisonment of one to five years. Article 198(4) raises the penalty to three to ten years where the actor makes a profession or profit of the conduct described.

Article 3 subjects to the law any processing of personal data by any person or entity in the public, private, or cooperative sector, including a controller not established in Angola who uses means located there.

Article 12 requires the data subject's unequivocal, express consent before most processing, or notification to the APD, unless the processing falls under one of Article 12's enumerated exceptions such as contract performance, a legal obligation, vital interests, a public interest mission, or the controller's legitimate interest.

Article 16 conditions processing of credit and solvency data on the data subject's consent or the APD's authorisation unless the information comes from a publicly accessible source, and requires the data subject to be notified within sixty days once their data enters a debtor file.

Articles 18 to 20 require notification to the APD, or the recipient's consent, before sending postal or electronic marketing messages or recording a call for commercial purposes, and require the sender to let the recipient object to further messages at any time free of charge.

Articles 21 to 24 allocate responsibility for communicated data between the discloser, a fellow controller, a subcontractor acting on the discloser's behalf and instructions, or a third party, and require the APD's authorisation for interconnecting personal data held in different files unless a legal provision already permits it.

Article 30 requires technical and organisational measures adequate to the risks presented by the processing and the nature of the data, documented in a security procedures record, and Article 32 binds a data controller and anyone who learns of the data in the course of their duties to professional secrecy, including after those duties end.

Articles 35 to 38 require notification to the APD, or its authorisation where notification is not enough, before processing personal data, fix the particulars a notification or authorisation request must contain, and require processing subject to authorisation or notification to appear in a public APD register.

Articles 39 to 43 apply this law to the public sector subject to further rules on creating, modifying and eliminating files and on inter-agency data sharing, and to the private and cooperative sectors subject to further legislation for specific activities. Article 67 enters the law into force on the date of its publication, following approval by the National Assembly on 24 May 2011 and promulgation by the President on 8 June 2011, so these provisions bind today.

Article 33 subjects the international transfer of personal data to a country that ensures a level of protection at least equal to this law's to notification to the APD, which decides whether a state provides that level by weighing the nature of the data, the purpose and duration of the processing, the destination country, and the legal, professional and security rules in force there.

Article 34 conditions transfer of personal data to a country that does not ensure an adequate level of protection on the APD's authorisation, granted only where the data subject has given unequivocal, express and written consent, an international treaty or agreement to which Angola is party applies, the transfer answers a humanitarian aid request, the transfer is necessary for a contract with or for the benefit of the data subject, the transfer serves an important public interest or a legal claim, the transfer protects the data subject's vital interests where they cannot consent, the data originates from a publicly accessible source, or the recipient contractually guarantees the transferred data an adequate level of protection on terms the APD sets.

Article 34 also lets a group of companies satisfy the adequate protection requirement for transfers between them through binding uniform internal rules on privacy and data protection.

Article 25 requires the controller to give a data subject at least the controller's identity and address, the purposes of processing and the file created for it, the recipients or categories of recipients, whether replying is mandatory or voluntary and the consequences of not replying, and the existence and conditions of the rights of access, rectification, updating, elimination and objection, at the time of collection or, where the data came from elsewhere, at the latest thirty days after collection, in language that is clear, precise and objective for a minor or a person with special needs.

Article 25 treats the right to information as fulfilled, for data collected over open networks, by publishing an easily accessible privacy policy carrying that same information together with a warning that personal data may circulate on the network without security guarantees and risk being seen or used by unauthorised third parties.

Article 26 gives a data subject the right to obtain from the controller, freely and without restriction, delay or excessive cost, confirmation of whether their data are processed, the purposes and categories of that processing, the recipients, the specific data itself, and any available information on its origin, and lets a data subject exercise access to health or sex-life data, including genetic data, through a doctor of their choice.

Article 27 lets a data subject object at any time, on compelling and legitimate grounds tied to their particular situation, to processing carried out under Article 12's public-interest or legitimate-interest grounds, obliging the controller to exclude their data from that processing once the objection is justified.

Article 28 requires the controller to rectify, update or eliminate a data subject's personal data within sixty business days of a request where its processing does not comply with this law, and to notify any recipient the data were previously disclosed to of the correction, update or elimination, unless that is demonstrably impossible.

Article 29 gives a data subject the right not to be subject to a decision that produces legal effects on them or significantly affects them, taken solely on automated processing evaluating personal aspects such as professional capacity, creditworthiness, trustworthiness or conduct, unless the decision is taken in forming or performing a contract at the data subject's request with safeguards for their legitimate interests including a right of representation and expression, or the APD has authorised it with safeguards for the data subject.

Article 44 establishes the Agência de Protecção de Dados as a public legal person with administrative, financial and asset autonomy, composed of seven members, three designated by the President of the Republic including the Agency's President, three elected by the National Assembly, and one judicial magistrate elected by the Superior Council of Judicial Magistracy, and gives it functions including supervising this law, issuing guidance, deciding complaints, registering and publishing processing files, cooperating internationally, exercising its sanctioning function, and reporting annually to the Executive.

Article 46 lets the APD stimulate, register, and reject codes of conduct that conflict with this law. Article 47 lets any person pursue an administrative or judicial remedy for a breach of this law's rules in addition to a complaint to the APD, and makes an APD decision appealable through administrative litigation. Article 48 entitles a person who suffers moral or patrimonial harm from misuse of their personal data to seek judicial reparation, with the judge setting the harm's value.

Article 51 fines a violation of Articles 14 to 17, 20, 30, 31 or 32 from USD 75,000 to USD 150,000, and a violation of Articles 6 to 11's principles, the consent requirement, or Articles 18, 19 and 21 to 24 from USD 65,000 to USD 130,000, tripling the applicable limits for a company, corporation or unincorporated association, and makes both attempt and negligence punishable.

Article 55 makes omitting a required APD authorisation request, giving false information in a notification or authorisation request, an illegal data interconnection, or missing an APD compliance deadline a crime punishable by three to eighteen months' imprisonment or a corresponding fine, doubled for Article 13 to 16 sensitive data.

Article 56 makes unauthorised access to personal data whose access is barred to the actor a crime punishable by six months to two years' imprisonment or a corresponding fine, aggravated for defeating security rules or for a benefit, and prosecuted only on complaint.

Article 57 makes erasing, destroying, damaging, suppressing or modifying personal data without authorisation a crime punishable by eighteen months to three years' imprisonment or a corresponding fine, doubled for particularly serious damage, or up to two years for negligence. Article 58 makes failing to interrupt, cease or block processing after APD notice, or otherwise disobeying an APD requirement, a crime punishable by up to three years' imprisonment or a corresponding fine.

Article 59 makes violating the duty of professional secrecy over personal data a crime punishable by up to eighteen months' imprisonment or a corresponding fine, rising to two years for a public official, a financial-gain motive, or harm to the data subject's reputation, honour or privacy.

Article 61 lets a court add, alongside a fine, a temporary or permanent processing ban, an order to block, erase or destroy data, or publication of the conviction at the convicted party's expense in a widely circulated periodical.

Article 13 subjects the processing of sensitive data, defined as philosophical or political convictions, party or union membership, religious faith, private life, racial or ethnic origin, and health and sex life including genetic data, to a legal provision that permits it or to the APD's authorisation, which the APD may grant only where the data subject or their legal representative has given unequivocal, express and written consent, a nonprofit political, philosophical, religious or trade union body processes only its own members' or regular contacts' data with their consent, the data subject was physically or legally unable to consent and processing protects vital interests, the data subject has manifestly made the data public, the processing serves the establishment, exercise or defence of a right in judicial proceedings, or the processing is indispensable to a public authority's legal or statutory functions including judicial, police or administrative investigation.

Article 13 further requires sensitive data processed under a legal provision to be notified to the APD and carried out with guarantees of non-discrimination and special security measures.

Article 14 permits processing of health and sex-life data, including genetic data, only with the data subject's or their legal representative's unequivocal, express and written consent or the APD's authorisation, unless the processing serves preventive medicine, medical diagnosis, consented medical care, health-service management or statistics, a medical emergency, or the public interest, and only through a health professional bound by professional secrecy.

Article 15 permits processing of data on persons suspected of illicit activities, criminal offences, contraventions, and applicable penalties, security measures, fines or accessory sanctions only by a public authority, under a legal provision cleared with the APD's prior opinion or under the APD's own authorisation, and limits processing for police investigation purposes to what a determined offence's prevention or repression requires.

Article 17 subjects the installation of video surveillance systems and other means of capturing, processing and disseminating sound and images that permit identifying people, including electronic road surveillance systems, to Article 13's regime, and requires the controller to post notice at any location carrying such a system of its existence, of the capture of sound and image, and of the controller's name, address, phone number and email.

Article 438(1) punishes any person who, without authorisation, accesses all or part of an information system of which they are not the holder, with imprisonment of up to two years or a fine of up to 240 days.

Article 438(2) raises the penalty to imprisonment of two to eight years where the access is achieved by defeating security measures, or is directed at a 'serviço protegido' (a service whose access is conditional on a subscription or other prior individual authorisation, as Lei n.º 7/17 art. 4(a) defines the term).

Article 438(3) applies the same heavier tier where the actor learns a commercial or industrial secret or confidential data protected by law, or obtains a benefit or advantage of elevated value. Article 438(4) extends the base penalty to a person who, without due authorisation, processes individually identifiable data or transmits it to a third party for a purpose other than the one authorised.

Article 437 defines 'sistema informático' broadly as any device or set of interconnected devices that automates the processing of computer data, together with the network supporting communication between them.

The offence draws no distinction based on whether the accessed system or page is public and unauthenticated, so a plain reading exposes web crawling that accesses a system without the holder's authorisation, regardless of whether a technical barrier was defeated, though the enhanced tier under Article 438(2) requires either a security-measure violation or a conditional-access service.

Lei n.º 7/17 (Lei de Protecção das Redes e Sistemas Informáticos) imposes separate security and data-retention duties on network operators, but its own Article 44 states that, for information systems and data, subsidiarily the legal regime provided by the criminal legislation and criminal procedure legislation in force applies, referring unauthorised-access liability back to this Penal Code article rather than creating a second offence.

Article 12 requires the body responsible for promoting the information society, and every provider, operator and service provider of information-society-system services, to guarantee the security of any device or set of devices, and the network supporting communication between them, that stores, processes, retrieves, receives or transmits data in execution of a computer program.

Article 13 requires the entity responsible for management, or the operators and service providers, of a computer infrastructure to apply the measures and techniques needed to secure and protect the assets essential to that infrastructure's proper functioning. Article 14 requires an internet operator or service provider to promote user registration and to carry out the measures and instruments needed to anticipate, detect, react to and recover from security risk situations on its networks.

Article 18 extends this Law's measures and techniques to computer programs, without stating a separate support-period, update or vulnerability-disclosure-channel duty for the program itself, and Article 19 requires database use to follow technical rules and specialised procedures adequate to protect access, storage, file duplication, treatment and the recovery of automated information.

Article 4(ff) defines the bound information-society-service class as broadly as the EU's information-society-service concept: any service normally provided at a distance, by electronic means, at the individual request of a recipient, excluding television and radio broadcasting, automatic note or ticket dispensing, and payment-gated road, parking or similar access even where an electronic device controls or verifies the payment.

Article 15(1) requires a provider, operator or service provider of cyberspace, before starting its activity, to submit an accident-and-incident management plan to the entity that regulates data protection and to the body responsible for promoting the information society, for use in a computer emergency, and Article 15(2) requires alerts and warnings to be disseminated in the event of an attack, computer theft or any computer incident.

Article 16(1) requires the relevant services to be equipped with devices capable of issuing an alert on an event or a request, and of sending a technical report on a compromised server, widely disseminated malicious code, a software vulnerability or anything an intrusion-detection system or event log identifies, and Article 16(2) ties that reactive service to the central work of the CERT-equivalent Equipa de Monitorização e Respostas aos Incidentes Informáticos (Computer Incident Monitoring and Response Team).

Article 40 leaves that team's own organisation and functioning, which would be the natural place a reporting channel and clock could sit, to a separate decree ("diploma próprio") not located here, and Article 41 requires the team to maintain institutional cooperation with public and private bodies. Unlike the General Data Protection Regulation (GDPR)'s 72-hour or the Cyber Resilience Act's 24-hour clock, no article reviewed here states a deadline for any of these notifications.

Article 51(1) permits, independent of the author's authorisation and without any remuneration, several uses of an already-lawfully-disclosed work provided its title and the author's name are stated and its genuineness and integrity respected. Alínea (e) of that article covers quoting short fragments of another's work, in written, sound, or visual form, where justified on scientific, critical, didactic, or informational grounds.

Alínea (c) of the same article covers reproducing works included in filmed or televised current-events reports, or works permanently exhibited in a public place. Article 51(2) excludes several categories from the private-reproduction exception at alínea (d) of the same article, including at alínea (c) reproducing the whole or an important part of a database in digital form.

Article 45 gives the holder of a database's patrimonial right the exclusive right to authorise or prohibit reproduction, translation, adaptation, or distribution of the database's structure. WIPO Lex records that the Law entered into force 30 days after its 31 July 2014 publication, per the Law's own Article 95 on entry into force.

Article 92's repeal clause revokes Lei n.º 4/90, de 10 de Março, the prior copyright statute, applying the new Law to any dispute not yet finally decided to the extent that benefits the author.