Burkina Faso

Article 1 states the act's purpose as protecting a natural person's fundamental rights and freedoms in the processing of their personal data. Articles 2 and 3 apply it to automated and non-automated processing alike, including electronic communications data, and bind a controller established in Burkina Faso or one processing from Burkina Faso's territory without being established there.

Article 4 excludes only purely personal or domestic activity, temporary technical transit copies, and journalism carried out under professional ethical rules, leaving publicly available personal data within scope. Articles 6 and 7 require collection, recording, processing, storage and transmission to be lawful, fair and non-fraudulent.

Article 8 limits processing to the determined, explicit and legitimate purposes the data were collected for, and Article 9 requires collected data to be accurate and, where necessary, updated. Article 10 requires the controller to implement appropriate technical and organizational measures to preserve the security and confidentiality of the data, including protection against accidental or unlawful destruction, loss, alteration, disclosure or unauthorized access.

Article 11 requires a controller that uses a processor to choose one offering sufficient guarantees of protection and to sign an agreement fixing the authorized processing operations and the data's fate at the end of the contract.

Article 13 requires the controller's prior consent for processing, subject to exceptions covering manifestly public data, a vital interest, medical care, a court proceeding, a public interest ground, contractual necessity, a legal obligation, a public authority's mission, and a non-profit organization's activities limited to its own members.

Articles 23 to 25 hold every person handling the data to the controller's or processor's authority and instructions, and bound retention to the processing's purpose subject to an archival, historical, statistical or research exception the CIL approves.

Articles 26 to 33 set the prior-formality regime of a normal declaration, a simplified declaration, a request for the CIL's opinion, or its authorization depending on the category of processing, and let a controller optionally designate a data protection officer.

Articles 30 and 31 require a legislative or regulatory act taken after the CIL's opinion before a public body processes data for state security, criminal justice, the census, or payroll and tax administration, and a CIL authorization before interconnecting personal data files or processing a national identification number. Article 41 bounds any interconnection to a legitimate legal or statutory objective that does not discriminate against or reduce the rights of the people concerned.

Articles 36 and 37 require the CIL's authorization, given after the Health Research Ethics Committee's concurring opinion, before processing personal data for health research, anonymization of the data before transmission wherever the research's purpose allows it, and national hosting of any health data that still permits identification.

Article 31 requires the CIL's prior authorization before any transfer of personal data to a foreign country.

Article 42 bars a controller from transferring personal data to a foreign country or an international organization unless that country or organization assures a level of protection adequate to the protection Burkina Faso itself assures for privacy and fundamental rights and freedoms, and requires the controller, before any external transfer, to obtain the CIL's authorization, sign a data confidentiality and reversibility clause with the receiving party to let data migrate back fully at the end of the contract, and put in place technical and organizational security measures covering encryption, availability, confidentiality, integrity and resilience.

Article 43 assesses the adequacy of a destination's protection against the nature of the data, the purpose and duration of the processing, the countries of origin and final destination, the general and sectoral legal rules in force there, and the professional rules and security measures observed, and lets that adequacy also rest on an international convention Burkina Faso has joined or on ad hoc or standardized safeguards the CIL has approved, which the CIL can withdraw if exceptional circumstances in the destination country raise a risk of unauthorized access by local authorities.

Article 44 lets a transfer to a country without an adequate level of protection proceed only under a listed exception, including the data subject's specific, free, informed and unambiguous consent given after being told of the risks, contractual necessity, a vital interest, an exceptional-circumstances decree taken after the CIL's concurring opinion, an overriding legitimate interest the law provides for, a one-off and non-massive transfer necessary for an important public interest or a legal claim, a one-off transfer from a public register open to consultation, judicial mutual assistance, a bilateral or multilateral agreement Burkina Faso has joined, or the CIL's express and reasoned authorization of a contract carrying adequate contractual clauses or internal rules.

Article 14 bars unsolicited direct marketing addressed to a person who has not given prior consent, and gives every person the right to be informed before their data is first used, disclosed to a third party, or used on a third party's behalf, and to be expressly asked for consent.

Article 15 bars a court decision assessing human behavior from resting on an automated processing that profiles the person, and bars an administrative or private decision assessing human behavior from resting solely on such automated processing.

Article 16 requires the controller to proactively tell the data subject, no later than collection, its identity, the processing's purposes, the categories of data, the recipients, the rights of access, rectification, erasure and objection, the retention period, any transfer abroad, and how to give or withdraw consent, subject to a narrow exception for data collected to establish a state security, defense or public safety offense.

Article 17 gives the data subject a right of access by consultation or copy, lets a deceased adult's spouse, children or a designated heir exercise it unless the deceased objected to posthumous access to medical data, and lets a minor's parent or legal representative exercise it, directly or through a doctor for medical data, while keeping the minor informed.

Article 18 requires the data subject to route a request concerning state security, defense, public safety, intelligence, judicial police or administrative police processing through the CIL's indirect access procedure rather than directly to the controller.

Article 19 gives every person the right to know and contest the information and reasoning behind an automated or non-automated processing decision applied against them, and where the processing relies on artificial intelligence, the right to be told the criteria and the nature of the personal data behind it from the moment of collection. Article 20 gives a person the right to object to processing of their data for legitimate reasons, unless the controller shows an overriding legitimate ground.

Article 21 lets a person demand rectification, completion, updating, locking or erasure of inaccurate, incomplete, ambiguous, outdated or unlawfully processed data, requires the controller to justify compliance within two months and notify any third party the data reached, and puts the burden of proof on the controller if the request is disputed.

Article 22 gives a person a right to be forgotten, letting them obtain removal of personal data about their past private life that was collected and made public on a website, whether or not a search engine indexes it. Article 31 requires the CIL's prior authorization before an administrative or private decision-support tool assesses human behavior, profiles a person, or relies on artificial intelligence techniques for predictive purposes.

Article 45 creates the Commission de l'informatique et des libertés (CIL) as an independent administrative authority with administrative and management autonomy, charged with policing the use of information and communication technologies in personal data processing.

Article 46 sets the CIL's composition at nine members drawn from the Conseil d'Etat, the Cour de Cassation, the National Assembly, human-rights associations, information-technology professional associations, and the President of Faso.

Articles 47 to 55 fix the members' five-year renewable mandate, their irremovability except on listed grounds, the President's status and permanent duties, incompatibilities with government office or a technology-industry role, an oath before the Ouagadougou Court of Appeal, their functional immunity, and the CIL's budget and financing rules, including a bar on borrowed funds.

Article 56 lists the CIL's attributions, including issuing individual and regulatory decisions and sector recommendations, ordering exceptional security measures, warning offenders and referring infractions to the public prosecutor, receiving complaints and petitions, authorizing foreign transfers, and advising public authorities and the government.

Article 57 lets the CIL send members, agents or experts to verify and control any processing on site, and Article 58 bars anyone the CIL is investigating from obstructing its action. Article 61 requires the CIL to submit an annual public report on its mission to the President of Faso and the President of the National Assembly.

Article 63 lists the CIL's administrative sanctions: a warning, a formal notice, an order to stop the processing, the locking of certain data, a forfeitary fine, and withdrawal of authorization. Article 65 sets that forfeitary fine at one percent of the controller's tax-exclusive turnover for the last closed financial year on a first violation, rising to five percent on a repeat violation, proportioned to the gravity of the breach and the advantage gained from it.

Article 66 lets the CIL's president or a person whose rights are violated seek urgent court relief for a serious and immediate violation, and lets a data subject or their representative seek damages for the moral or material harm suffered.

Articles 67 to 75 set a schedule of fixed-range fines for specific violations, running from one million to one hundred million francs CFA depending on the violation, including a reduced fine for an unauthorized disclosure caused by imprudence or negligence, though the act's own text does not state how this fixed-range schedule relates to the Article 65 percentage formula.

Article 76 lets the CIL confiscate or order the erasure of the data's physical media and bar a sanctioned controller from managing any processing for up to two years, and Article 77 lets it order publication of its decision at the offender's expense. Article 79 refers violations of the act to the Penal Code's own provisions on information-technology and communications-technology offenses.

Article 5 defines sensitive personal data (données sensibles) to include health, biometric and genetic data, sexual life, racial or ethnic origin, political, philosophical or religious opinions or activities, trade union membership, morals, and data about criminal investigations, prosecutions, convictions, and administrative or safety measures.

Article 12 bars collecting or processing that data without the data subject's express consent, subject to a statutory exception, and lets a separate law bar such processing even where the data subject consents.

Article 30 requires a legislative or regulatory act, taken after the CIL's opinion, before a public body, a public establishment, a territorial authority, or a private entity managing a public service processes sensitive personal data under that fourth category, on top of the same requirement for state security, criminal justice, or census processing.

Article 31 requires the CIL's prior authorization before the private sector processes genetic or biometric data, including for health research, before it processes data about offenses, convictions or safety measures, and before it processes biometric data specifically.

Article 35 restricts who may process personal data about offenses, convictions and safety measures to courts and public authorities acting within their legal powers, a public body managing a public service after the CIL's concurring opinion, and legal auxiliaries strictly for the duties assigned to them.

Burkina Faso's general computer-misuse title, added to the Penal Code by Loi n°025-2018/AN. Article 711-1 punishes intentionally and without right accessing all or part of a computer system, with a heavier penalty where the access results in the suppression, modification, or alteration of the system's data; Article 711-2 separately punishes unauthorized continued presence in a system, on the same escalating structure.

Article 711-3 punishes hindering or falsifying a system's operation; Article 711-4 the unauthorized introduction of data; Article 711-5 the unauthorized interception of non-public data transmissions; Article 711-6 the unauthorized damaging, deletion, alteration, or suppression of data.

Article 711-10 punishes producing, selling, or possessing a device, program, password, or access code intended to commit any of the above offenses, but carves out production, sale, or possession that does not aim to commit an offense, such as authorized testing or protecting a computer system.

Article 711-12 punishes taking a person's digital identity or using their identifying data to disturb them or harm their honor, private life, or property, and Article 711-13 separately punishes intentionally and without right reproducing, extracting, or copying computer data belonging to another. The title does not define "without right" for a public, unauthenticated web page specifically, and no Burkinabe court decision construing Articles 711-1 to 711-13 in that context was located.

Burkina Faso's copyright statute, which repealed and replaced the 1999 literary and artistic property law. Article 10 excludes official legislative, administrative, or judicial texts and their official translations, the news of the day, and mere facts and data from copyright protection outright.

Article 22 lists the private-copy exception's limits and expressly excludes reproducing the whole or a substantial part of a database from it, which means a database is treated as a protected compilation whose substantial reproduction the rights holder can otherwise prevent; there is no separate sui generis database right of the EU kind.

Article 23 lets a person, once a work has been lawfully disclosed and its author and source are clearly credited, make short critical, polemical, pedagogical, scientific, or informational quotations and analyses, compile press reviews, and reproduce or broadcast, even in full and in original or translated form, current political, social, economic, or religious news articles and public speeches for current-events informational purposes.

None of these exceptions is framed as a text-and-data-mining carve-out, and nothing in the Law addresses AI training specifically.

Article 10 excludes official legislative, administrative, or judicial texts and their official translations, the news of the day, and mere facts and data from copyright protection outright: a bare fact, or the news of the day as such, is never a protected work under Burkinabe law, whichever outlet reports it first.

Article 23 separately lets any person, once a work has been lawfully disclosed, and provided the author's name and source are clearly credited, make short critical, polemical, pedagogical, scientific, or informational quotations and analyses, compile press reviews, and reproduce or broadcast, even in full and in original or translated form, current political, social, economic, or religious news articles and public speeches delivered before political, administrative, judicial, or academic assemblies, for current-events informational purposes.

The exception is not capped at a headline-length or short-extract threshold and is not confined to the press industry; whether it reaches a systematic aggregator's reproduction of headlines and snippets, as opposed to a traditional press review or a broadcaster's current-events report, has not been tested in a reported Burkinabe decision.

Burkina Faso has no separate press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, no recognized hot-news or misappropriation doctrine distinct from ordinary copyright and unfair-competition law, and no located case law on hyperlinking or framed display.