Benin

Article 576 of the Digital Code, within Livre VI's cybercriminality title, punishes publishing on the internet, by any means, a montage made with a person's words or image without their consent, by five years' imprisonment and a fine of 25,000,000 CFA francs, cumulatively rather than as alternative penalties.

The prohibition does not reach a montage where it is evident that it is a montage, or where this is expressly stated, which functions as a safe harbor tied to disclosure rather than an affirmative duty to label synthetic content. The provision is not limited to AI-generated media by its own terms: a manually edited composite of a person's words or image falls within it just as a synthetic one does.

The Digital Code states no day of entry into force, and no Journal officiel publication of it and no other source stating the day it came into force has been located.

Article 427 requires a controller to notify the Autorité de Protection des Données Personnelles (APDP) and the affected person without delay of any security breach that has affected their personal data, and requires a processor to warn the controller without delay of any breach affecting data it processes on the controller's behalf.

The notification must describe the nature of the breach, including where possible the categories and approximate number of affected data subjects and personal data records, the contact point for more information, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects.

Article 427 excuses notice to the affected person only where the controller had already applied protective measures such as encryption that make the data unintelligible, where later measures removed the high risk, or where it would take disproportionate effort and the controller makes an equally effective public communication instead. The Book states no fixed number of hours or days for either notification, so both run only from becoming aware of the breach and without delay.

The Digital Code states no day of entry into force, and no Journal officiel publication of it and no other source stating the day it came into force has been located.

Benin's comprehensive personal-data statute, deliberated and adopted by the National Assembly on 13 June 2017 and promulgated by the President on 20 April 2018 after two Constitutional Court conformity decisions, repealing the earlier Loi n°2009-09 du 24 mai 2009.

Articles 379 to 382 set the Book's object and its material and territorial scope, reaching collection, processing, transmission, storage, and use of personal data by a natural person, the State, local governments, and other public or private bodies, subject only to a narrow exclusion for purely personal or domestic processing not intended for communication or diffusion to third parties.

Article 383 requires personal data to be processed lawfully, fairly, and transparently, for determined and legitimate purposes, kept accurate, and retained no longer than those purposes require. Articles 384 and 385 add the transparency and confidentiality and security principles that run through the rest of the Book.

Article 386 requires a controller to choose a processor offering sufficient security and confidentiality guarantees and to fix the processor's obligations in a written contract, Article 387 lists the controller's own accountability duties, and Article 388 requires joint controllers to allocate their respective obligations by a transparent arrangement made available to data subjects.

Articles 389 and 390 make consent the ordinary basis for lawful processing, subject to exceptions for a legal obligation, a public interest task, a contract, or safeguarding vital interests, and set the conditions a valid consent must meet, including that it be freely given, specific, and withdrawable at any time. Article 393 requires that any interconnection of files serve a legitimate legal or statutory objective and respect the relevance of the data interconnected.

Articles 405 to 414 require a controller to declare each processing to the Autorité de Protection des Données Personnelles (APDP) before implementing it, or to obtain the Autorité's prior authorization for the higher risk categories it lists, subject to the simplified declarations and exemptions the Autorité may grant.

Article 424 requires data protection by design and by default, including pseudonymization and data minimization, so that only the data necessary to a specific purpose is processed by default. Articles 425 and 426 require confidential processing and appropriate technical and organizational security measures, including pseudonymization, encryption, and regular testing of their effectiveness.

Articles 428 and 429 require a data protection impact assessment before a processing likely to create a high risk to individuals' rights and freedoms, followed by prior consultation with the Autorité where the risk cannot be mitigated. Articles 430 to 432 require a data protection officer for a public body, or for large scale monitoring or large scale sensitive data processing, and set that officer's independence and functions.

Article 433 bars keeping personal data in identifiable form beyond what its purpose requires, and Article 435 requires a written record of processing activities available to the Autorité on request. The Digital Code states no day of entry into force, and no Journal officiel publication of it and no other source stating the day it came into force has been located.

Article 391 permits transferring personal data to a third country or an international organization only once the Autorité has found that the destination assures a level of data protection equivalent to this Book, weighing the rule of law, the data protection rules, and the available remedies there, and requires the Autorité's prior authorization before any actual transfer takes place.

Article 392 lets a transfer proceed despite an inadequate destination where the data subject has expressly consented, the transfer is necessary to perform or negotiate a contract with or for the data subject, it serves an important public interest or a legal claim, it protects vital interests, it comes from a public register open to consultation, or the Council of Ministers has authorized it by decree on the Autorité's opinion after the controller shows sufficient privacy safeguards.

Article 435 requires a controller's register of processing activities to identify every transfer of personal data to a third country or international organization, including its identity and, where relied on, the documents evidencing appropriate safeguards. The Digital Code states no day of entry into force, and no Journal officiel publication of it and no other source stating the day it came into force has been located.

Article 401 bars a decision producing legal effects for a person, or significantly affecting them, from resting solely on automated processing, including profiling, of data meant to evaluate aspects of their personality. A parallel first paragraph restricts a court decision the same way, but that clause binds only courts.

The prohibition does not apply where the decision is authorized by a contract or a legal provision that contains appropriate safeguards and at least lets the person put forward their point of view. Article 437, point 9 requires the controller, on the data subject's dated and signed request, to disclose useful information about the logic underlying an Article 401 decision and about the significance and expected consequences of that processing for them.

The Digital Code states no day of entry into force, and no Journal officiel publication of it and no other source stating the day it came into force has been located.

Article 415 requires a controller to tell a data subject, no later than when their data is collected, the controller's identity, the purposes of the processing, the recipients, whether the automated decision making Article 401 addresses is in use, the retention period, and the data subject's rights of objection, access, rectification, and erasure.

Article 416 requires the same information within a reasonable time and at most thirty days after obtaining data that was not collected from the data subject, or at the first communication or disclosure of it if that comes sooner. Article 437 lets a data subject demand confirmation of whether their data is processed, the purposes and categories involved, the recipients, and any envisaged transfer to a third country, answered within sixty days.

Article 438 gives a data subject a right to receive, in a structured, commonly used, and machine readable format, personal data they provided under a consent or a contract, and to have it transmitted directly to another controller where technically possible.

Article 440 lets a data subject object at any time, on legitimate grounds, to processing of their data, and object free of charge and without any justification where the processing is for direct marketing, charitable, or political prospecting.

Article 441 lets a data subject demand rectification, completion, updating, blocking, or erasure of personal data that is inaccurate, incomplete, ambiguous, outdated, irrelevant, or unlawfully processed, and requires the controller to pass the correction on to anyone the data was disclosed to.

Article 443 requires a controller who made a data subject's personal data public to take reasonable steps, including technical measures, to tell third parties processing that data of an erasure request, unless the processing serves free expression, a legal obligation, an important public health reason, archiving, research, or statistical purposes, or a legal claim.

Article 447 lets an incapacitated adult's rights under this Book be exercised by a cohabiting spouse or partner, or in order, an adult child, a parent, or a sibling, or a court appointed guardian, involving the data subject as far as their understanding allows. The Digital Code states no day of entry into force, and no Journal officiel publication of it and no other source stating the day it came into force has been located.

Article 462 creates the Autorité de Protection des Données Personnelles (APDP) to oversee this Book and privacy generally in Benin, and Article 463 makes it an independent administrative body with legal personality that receives no instruction from any administrative or political authority.

Article 448 lets a data subject complain to the Autorité about a processing they consider violates this Book, Article 449 gives them an effective judicial remedy against the Autorité if it does not act within ninety days, Article 450 gives them the same remedy against the controller or processor, and Article 451 lets anyone who suffered material or moral harm from a violation of this Book seek reparation from the controller or processor, with joint liability where more than one took part in the same processing.

Article 452 lets the Autorité warn a controller and give formal notice to end a violation within a period of no more than eight days.

Article 454 lets the Autorité, once a controller ignores that notice, impose a pecuniary sanction, an order to stop processing, a withdrawal of authorization, or a lock on the data concerned, and Article 455 caps that pecuniary sanction at fifty million CFA francs for a first violation, rising to one hundred million CFA francs, or five percent of the controller's last closed financial year turnover excluding tax up to that same figure, for a violation repeated within five years.

Article 459 lets the Autorité make a sanction public, and Articles 486 to 489 let it demand information, cooperation, and access to premises in the course of its investigations.

Article 460 makes obstructing the Autorité, processing without required prior formalities or security measures, unlawfully collecting or misappropriating personal data, an unauthorized cross border transfer, and disregarding a data subject's rectification, objection, information, or access rights into offenses, and Article 461 punishes them with six months to ten years' imprisonment and a fine of ten million to fifty million CFA francs, or either penalty alone, reduced to a fine only of five million to fifty million CFA francs for a negligent failure to complete prior formalities.

Elsewhere in the Code, Article 514 fines an unsolicited electronic message sent without an unsubscribe link, Article 515 punishes using a person's or entity's identity to deceive message recipients or website users into disclosing personal or confidential data with five years' imprisonment and a twenty five million CFA franc fine, and Article 516 punishes using personal data or confidential information obtained that way to embezzle public or private funds with ten years' imprisonment and a one hundred million CFA franc fine.

Loi n°2020-35 du 06 janvier 2021 later amended three articles of the Code, including Article 464 within this Titre's composition rules for the Autorité, and the amending law's own content beyond that is not established here. The Digital Code states no day of entry into force, and no Journal officiel publication of it and no other source stating the day it came into force has been located.

Article 394 prohibits processing personal data revealing racial or ethnic origin, political opinions, religion or beliefs, trade union membership, genetic data, biometric data used to uniquely identify a person, health data, or data about a person's sex life or sexual orientation, subject to listed exceptions such as the data subject's explicit consent or data the person has manifestly made public.

Article 395 confines processing of personal data about criminal convictions and related security measures to courts, public authorities, and other bodies the law specifically authorizes, and bars a complete register of criminal convictions except under the control of a public authority.

Article 402 requires a controller processing the data Articles 394 and 395 cover to designate the categories of staff with access to it, keep that list available to the Autorité, and bind those staff to confidentiality. Article 403 requires a controller relying solely on the data subject's written consent for that data to tell them beforehand the reasons for the processing and the categories of staff who will access it.

Article 404 bars relying on that consent where the controller is the data subject's present or prospective employer, or where the data subject depends on the controller in a way that prevents freely refusing consent, unless the processing grants the data subject a benefit. Article 407 requires the Autorité's prior authorization before processing the data Article 394 or Article 397 covers, a national identification number, or biometric data.

Article 446 makes processing a minor's personal data in connection with an information society service offered directly to them lawful once the minor is at least sixteen years old, and otherwise requires the consent of the holder of parental responsibility, verified as far as available technology allows. The Digital Code states no day of entry into force, and no Journal officiel publication of it and no other source stating the day it came into force has been located.

Benin's general computer-misuse title, part of the cybercriminality and cybersecurity Book of the Digital Code.

Article 507 punishes intentionally and without right accessing or remaining present in all or part of a computer system with one to five years' imprisonment and a fine of 500,000 to 1,000,000 CFA francs, or either penalty alone; the aggravated form committed with fraudulent intent, and exceeding one's lawful power of access to a computer system with fraudulent intent or intent to harm, are each punished at two to five years' imprisonment and a fine of 500,000 to 2,000,000 CFA francs, or either penalty alone.

Where any of these three forms results in the suppression, obtaining, or modification of the system's data, or an alteration of the system's operation, the penalty just described is doubled; where instead any of the three is committed in violation of the system's own security measures, the offense draws a separate, harsher penalty of ten to twenty years' imprisonment (réclusion criminelle) and a fine of 5,000,000 to 500,000,000 CFA francs (Art. 507).

Article 508 separately punishes intercepting, divulging, using, altering, or misappropriating computer data during its non-public transmission; Article 509 punishes causing an interruption of a computer system's normal operation; Article 510 punishes damaging, deleting, deteriorating, altering, or suppressing computer data; Article 511 punishes producing, selling, obtaining for use, importing, exporting, distributing, or otherwise making available a device, including computer data or computer programs, principally designed or adapted to permit the commission of one or more offenses in Title I of this Book; Article 512 punishes falsifying computer data by introducing, modifying, altering, or erasing it.

Two liability exemptions sit earlier in the same Book: a provider of a search engine or content index is not liable for its search results, provided it does not originate the transmission, does not select its recipient, and does not select or modify the information in it (Article 505); and an online host is not liable for information stored at a user's request, provided that either it promptly informs the police or judicial services when it learns of specific illegal information or activity, taking only measures that prevent access until they decide, or it promptly removes or disables access after receiving a removal injunction from those services, the exemption not applying where the recipient of the service acts under the host's authority or control (Article 506).

The title does not define "without right" for a public, unauthenticated web page specifically, and no Beninese court decision construing these articles in that context was located. The Digital Code states no day of entry into force, and no Journal officiel publication of it and no other source stating the day it came into force has been located.

Benin's copyright statute, adopted by the National Assembly on 9 August 2005 and again on 12 January 2006 after a Constitutional Court conformity decision, promulgated on 5 April 2006.

Article 9 excludes official legislative, administrative, or judicial texts and their official translations, the news of the day, and ideas, procedures, systems, methods, concepts, principles, discoveries, or bare data from copyright protection outright, whether or not those are stated, described, explained, illustrated, or incorporated in a work.

Article 8 separately protects, as works, collections of works, folklore expressions, or bare facts or data, such as encyclopedias, anthologies, and databases, whether reproduced on a machine-readable medium or any other form, when the selection, coordination, or arrangement of their contents constitutes an intellectual creation; the protection reaches only that selection, coordination, or arrangement, and not the underlying facts or data themselves, and there is no separate sui generis database right of the EU kind.

Piracy of literary and artistic works, meaning reproduction without the prior authorization of the copyright or related-rights holders and the collective management body, is a criminal offense punished under Art. 108 to 110 by three months to two years' imprisonment and a fine of 500,000 to 10,000,000 CFA francs, or either penalty alone, without prejudice to damages. Loi n° 2005-30 was promulgated at Cotonou on 5 April 2006 after the Constitutional Court's conformity decision.

Its text fixes no commencement day, and no Journal officiel issue carrying it and no other source stating the day it came into force has been located.

A vendor of an information and communication technology product must have an independent security expert, accredited by the ministry in charge of electronic communications, carry out a vulnerability test and a security assurance evaluation of the product. The vendor must then inform consumers of every vulnerability detected in the product, along with the solution recommended to remedy it.

The Digital Code states no day of entry into force, and no Journal officiel publication of it and no other source stating the day it came into force has been located.

Article 1er defines an operator as any natural or legal person operating an electronic communications network or providing an electronic communications service. Article 599 requires operators to put in place qualified systems for detecting events.

Article 599 provides that the ministry in charge of electronic communications issues the qualifications of the detection systems, which cover events likely to affect the security of operators' information systems, and of the service providers that run them. Article 600 requires operators to submit their information systems to checks of their level of security and of their compliance with security rules, carried out by the national information-systems security agency.

Article 600 puts the cost of the checks on the operator. Article 601 punishes with a fine of 10,000,000 CFA francs the omission to keep in good condition the protection devices previously established. Article 603 lets the national information-systems security agency obtain from operators the identity, postal address and email address of users or holders of vulnerable, threatened or attacked information systems, in order to alert them.

Article 239 applies when a licensed or authorized operator fails to meet the obligations set by the applicable laws and regulations, the decisions of the regulatory authority and the conditions of its licence. Article 239 provides for a penalty of 0.1% to 4% of consolidated turnover for the last financial year, doubled for a repeat breach, set by reasoned decision according to the gravity of the breach.

Article 308 requires qualified and non-qualified trust service providers to take the technical and organisational measures necessary to prevent and manage the risks to the security of the trust services they provide. Article 308 requires the security measures of trust service providers to keep the level of security proportionate to the degree of risk. Article 308 provides that measures are in particular taken to prevent and limit the consequences of incidents.

Article 308 provides that measures are also taken to inform the parties concerned of the harmful effects of security-related incidents. Article 317 creates a control body for trust service providers, attached to the ministry in charge of electronic communications. Article 318 requires qualified trust service providers to undergo, at least every 24 months, an audit carried out at their own expense by a conformity assessment body.

Article 318 requires qualified trust service providers to send the conformity assessment report to the control body within three working days of receiving it. Article 319 lets the control body subject qualified trust service providers to an audit, or ask for a conformity assessment, at any time and at their expense. Article 321 lets the control body withdraw the qualified status of the provider or service concerned, taking into account the scale, duration and consequences of a breach.

Article 309 requires qualified and non-qualified trust service providers to notify the control body, and where applicable other bodies concerned, as soon as possible and at the latest within 24 hours of becoming aware of it, of any breach of security or loss of integrity having a significant impact on the trust service provided or on the personal data kept in it.

Article 310 requires a trust service provider to notify a user of the trust service of a breach of security or loss of integrity as soon as possible where it is liable to harm that user. Article 310 lets the control body that received a notification concerning a foreign State inform the competent authorities or control bodies of that State.

Article 310 provides that the control body informs the public of a breach of security or loss of integrity, or requires the trust service provider to do so, whenever it finds that the public interest requires it.

Article 9 excludes official legislative, administrative, or judicial texts and their official translations, the news of the day, and ideas, procedures, systems, methods, concepts, principles, discoveries, or bare data from copyright protection outright: a bare fact, or the news of the day as such, is never a protected work under Beninese law, whichever outlet reports it first.

Article 16 lets the press, broadcasting, or television reproduce, for informational purposes and subject to naming the author and source, political, economic, or socio-cultural articles published in original or translated form, and public speeches delivered before political, judicial, administrative, or religious assemblies or at public political gatherings and official ceremonies, but only where the copyright holder has not expressly reserved the reproduction right.

Article 17 separately lets a photographer, filmmaker, or sound or visual broadcaster, when covering a current event, lawfully record, reproduce, and communicate to the public the literary works encountered in the course of that coverage, to the extent justified by the informational purpose.

Neither exception is capped at a headline-length or short-extract threshold, and neither is confined to the press industry; whether either reaches a systematic aggregator's reproduction of headlines and snippets, as opposed to a traditional press outlet's own reporting, has not been tested in a reported Beninese decision.

Benin has no separate press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, no recognized hot-news or misappropriation doctrine distinct from ordinary copyright and unfair-competition law, and no located case law on hyperlinking or framed display. Loi n° 2005-30 was promulgated at Cotonou on 5 April 2006 after the Constitutional Court's conformity decision.

Its text fixes no commencement day, and no Journal officiel issue carrying it and no other source stating the day it came into force has been located.