Côte d'Ivoire

Article 2 states the Act's purpose as governing the protection of personal data, and article 3 subjects to it any collection, processing, transmission, storage or use of personal data by a natural person, the State, local authorities, or a public or private corporation, whether the processing is automated or not, excluding under article 4 only an individual's strictly personal or household processing and a network operator's temporary technical copies.

Article 5 makes ordinary processing subject to a prior declaration to ARTCI as the Autorité de Protection, and article 6 lets the declaration be replaced by an internal correspondent for most processing, though never before a cross-border transfer. Article 7 also requires the Authority's prior authorization before processing on a national identification number or a data set of public-interest research value.

Article 9 lists what a declaration or an application for authorization must contain, including the identity of the person responsible, the purpose, the categories of data and their origin, the retention period, the recipients, the office where access is exercised, the security measures planned, and any subcontractor or cross-border transfer, and article 11 gives the Authority one month, extendable by a further month, to decide, with silence read as a rejection open to appeal.

Article 12 lets the person responsible designate a correspondent for the protection of personal data to oversee compliance independently.

Article 14 makes processing legitimate where the person concerned gives express consent, subject to listed exceptions for a legal obligation, a public-interest task, a contract, or the person's vital interests, and articles 15 to 20 require processing to be lawful and fair, limited to specified and legitimate purposes, kept no longer than those purposes require, accurate, transparent, confidential, and carried out through a subcontractor who gives sufficient guarantees.

Article 22 prohibits direct marketing using a person's personal data without their consent. Article 27 authorizes the interconnection of files only for a legitimate purpose and bars it from causing discrimination or a reduction of rights.

Articles 39 to 41 require the processing to stay confidential, require precautions against distortion, damage or unauthorized access, and list the technical safeguards to install, including preventing unauthorized access to the installations and to the data, guarding against use for money laundering or terrorist financing, and keeping backup copies.

Article 42 requires an annual compliance report to the Authority, article 43 sets the retention period by reference to the Authority's rules for the type of processing, and article 44 requires the data to remain exploitable regardless of the support used. The Act states no separate data-breach notification duty running to the Authority or to the persons affected. No commencement notice for the Act has been located in the Official Gazette.

Article 7 makes the transfer of personal data to a third country subject to ARTCI's prior authorization before implementation. Article 26 conditions that transfer on the destination state affording a level of protection of privacy, freedoms and fundamental rights equivalent to or higher than Côte d'Ivoire's with regard to the processing concerned, and requires the person responsible for the processing to obtain the Protection Body's permission before any actual transfer.

The transfer of personal data to a third country remains subject to the Protection Body's regular monitoring in light of its purpose. No commencement notice for the Act has been located in the Official Gazette.

Article 25 bars an administrative or private decision that assesses a person's behavior or personality from resting solely on automated processing of their personal data. A parallel first sentence restricts a court decision the same way, but that clause binds only courts and carries no 'solely' qualifier. No commencement notice for the Act has been located in the Official Gazette.

Article 28 requires the person responsible for the processing to give the person concerned, at the latest when the data are collected, their identity, the purpose, the categories of data, the recipients, the possibility of refusing to appear on the file, the existence of the rights of access and rectification, the retention period, and the possibility of a transfer to a third country.

Article 29 gives a person the right to obtain confirmation of whether their data are being processed, the data themselves and their origin, and the purposes, categories and recipients of the processing, and lets the Protection Body exercise that access on the person's behalf where direct access is impossible.

Article 30 gives a person the right to object to processing on legitimate grounds relating to their situation, to object at no cost to processing for prospecting purposes, and to be told before their data are first disclosed to a third party for prospecting and given the right to object to that disclosure free of charge.

Article 31 gives a person the right to have inaccurate, incomplete, ambiguous or outdated personal data rectified, completed, updated, deleted or locked, and article 32 extends that right to a deceased person's successors.

Article 33 gives a person the right to erasure of their personal data and to the end of its distribution, including data made available while they were a minor, where it is no longer necessary, where consent is withdrawn or the retention period has lapsed with no other legal ground, where the processing lacks a legal ground, or for any other legitimate reason, and articles 34 to 36 require the person responsible to tell any third party the data were disclosed to that the person concerned seeks removal of every link, copy or reproduction, to carry out the erasure without delay unless a listed ground for retention applies, and to establish mechanisms implementing that right and periodically reviewing the need to keep data.

Article 38 gives a person the right to receive their data in a structured, commonly used electronic format and, where the processing rests on consent or a contract, to have it forwarded to another system. No commencement notice for the Act has been located in the Official Gazette.

Article 46 entrusts the mission of personal-data Protection Body to ARTCI, the independent administrative body regulating telecommunications and information and communication technologies, and article 47 gives it the power to receive declarations and grant or withdraw authorizations, receive and resolve claims and complaints, audit any processing through sworn officers, impose administrative and pecuniary penalties, maintain a public directory of processing, authorize cross-border transfers, and issue guidelines for the processing and protection of personal data.

Article 48 bars a cryptologic service provider or a person responsible for processing from invoking professional secrecy against the Protection Body. Article 49 lets the Protection Body issue a warning or a formal notice to stop a deficiency within a set time, and article 50 lets it, after an adversarial procedure, order the interruption of a processing, the locking of some of the data, or a temporary or permanent prohibition where a processing violates human freedoms.

Article 51 lets the Protection Body, after hearing the person responsible or their subcontractor, withdraw an authorization temporarily or finally or impose a financial penalty proportionate to the seriousness of the breach and the benefit derived from it, capped at 10 million CFA francs for a first failure and, for a repeated failure within five years, at 100 million CFA francs or, for a company, 5 percent of the prior financial year's turnover excluding tax up to a maximum of 500 million CFA francs, without prejudice to any criminal penalty.

Article 45 punishes obstructing the Protection Body, by opposing its members' tasks, refusing or concealing information or documents it requests, or supplying inconsistent information, with imprisonment of one month to two years and a fine of 1 million to 10 million CFA francs, and requires the prosecutor or investigating judge to be told without delay of any such obstruction. No commencement notice for the Act has been located in the Official Gazette.

Article 7 requires ARTCI's prior authorization before processing personal data relating to genetic or medical data and to related scientific research, to an offense, a conviction or a security measure imposed by a court, or to biometric data.

Article 21 prohibits, subject to narrow exceptions, any processing that reveals a person's racial, ethnic or regional origin, political opinion, religious or philosophical belief, trade-union membership, sex life, or, more generally, genetic data concerning health.

The prohibition does not apply where the data were manifestly made public by the person concerned, where processing genetic or health data is necessary to protect a vital interest and the person cannot consent, where genetic data is necessary to establish, exercise or defend a legal claim, where a judicial proceeding or a criminal investigation is under way, or where the processing serves the legitimate, membership-only activities of a foundation, association or other non-profit body with a political, philosophical, religious, fraternal or trade-union purpose.

Every case the exceptions permit remains subject to the Protection Body's authorization and supervision of its design and implementation. No commencement notice for the Act has been located in the Official Gazette.

Article 4 punishes by one to two years' imprisonment and a fine of 5 million to 10 million CFA francs anyone accessing or attempting to access all or part of an information system, and article 5 separately punishes fraudulently remaining within all or part of an information system on the same terms.

Article 6 punishes hindering or distorting the functioning of an information system, article 7 punishes introducing data into it, and articles 8 to 10 punish intercepting, altering or fabricating computer data, each with escalating imprisonment terms of up to ten years and fines of up to 60 million CFA francs.

Article 26 separately punishes theft of information, defined as fraudulently becoming aware of, copying, or removing the physical medium carrying information within an information system, by five to ten years' imprisonment and a fine of 3 million to 5 million CFA francs, rising to ten to twenty years and 5 million to 10 million CFA francs where an aggravating circumstance listed in article 27 is present, and article 30 raises the minimum to ten years where the system or data was protected by a secret access code.

None of these articles conditions the offense on defeating a technical security measure, so whether they reach a scraper reading a public, unauthenticated page is not addressed by the text. No commencement notice for the Act has been located in the Official Gazette.

Article 8 protects, as an original work, a collection of works or of mere data or facts, such as an encyclopedia, anthology or database, where the choice, coordination or arrangement of its contents constitutes an original work; the same article states that this protection does not extend to a database's own content or to a computer program used to create, operate or consult it.

Article 10 separately excludes ideas, methods, procedures, concepts or information as such, official legislative, administrative or judicial texts, and mere data and facts as such, from copyright protection altogether. Together the two articles give Côte d'Ivoire compilation-only protection for a database's selection or arrangement, with no separate sui generis database right of the kind the European Union recognises, and with the underlying content always open to reuse.

Article 138 makes any infringement of the moral or economic rights the Act defines a criminal offense, punishable by one to ten years' imprisonment and a fine of 500,000 to 5,000,000 CFA francs, or either penalty alone.

Article 97 requires every operator to take all the measures needed to secure its networks and the communications carried on them and to guarantee the continuity of the services it provides. Article 97 requires those measures to be technical and organizational and suited to the existing risk in light of the security standards in force. Article 97 has the Autorité de Régulation define the minimum security level that operators must implement.

Article 99 lets the Autorité de Régulation commission an audit after a security incident that had a significant impact on an operator's networks and services. Article 137 names the Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire (ARTCI) as the Autorité de Régulation of electronic communications.

Article 211 caps the financial sanction for a breach at 3% of the operator's turnover excluding tax for the last closed financial year, and at 5% for a new violation of the same obligation.

Article 3 subjects every public-sector information system and an enumerated set of private-sector categories, a telecommunications or ICT company, a telecommunications or internet service provider, a company whose information system connects through Côte d'Ivoire's public telecommunications networks, a company that automatically processes its customers' personal data in providing its service, an electronic-transactions company, an ARTCI-approved service provider, and an electronic-archiving or record-keeping provider, to a mandatory periodic security audit.

Article 4 sets a three-year certification audit cycle, with a further mandatory periodic audit eighteen months after a certificate issues. Article 20 caps the financial penalty for failing to complete the audit at 300,000,000 CFA francs, doubled on a repeat breach. Ordonnance n°2024-950 of 30 October 2024 repeals Article 50 of Loi n°2013-546 du 30 juillet 2013 relative aux transactions électroniques.

ARTCI's own security-audit page states that the audit of information-systems security in Côte d'Ivoire is governed by Article 50 of that Loi n°2013-546. The Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI) states that it is empowered to audit and certify the information systems of legal entities established in Côte d'Ivoire under Décret n°2021-917. ANSSI states that the mandatory audit takes place every three years and is carried out by audit providers that ANSSI approves.

Article 1 adopts the Référentiel Général de Sécurité des Systèmes d'Information (RGSSI) and the Plan de Protection des Infrastructures Critiques (PPIC) as annexes to this décret. The RGSSI states that it draws heavily on ISO 27001:2013 and ISO 27002:2013. Article 2 requires every public body and private enterprise to comply with the RGSSI and the PPIC. Décret n°2021-917 Article 14 anchors that compliance duty to the same population its own Article 3 lists.

The PPIC requires an organization the State has designated and notified as a critical-infrastructure operator or manager to renew a complete risk analysis of its critical infrastructure at least every six months. The same organization must also designate a cybersecurity focal point who liaises with ARTCI, a sector cybersecurity officer, and CI-CERT.

Article 98 requires an operator, as soon as it is aware of one, to inform the Autorité de Régulation of any security incident having a significant impact on the operation of its networks or services. Article 98 requires an operator facing a particular and significant threat of a security incident to inform the subscribers concerned of the threat and of any protective or corrective measure they can take.

Article 98 requires the operator to comply with the technical requirements the Autorité de Régulation sets to remedy the incident or prevent its spread. Article 98 requires the operator, once it has analyzed the causes and consequences of the incident, to report them to the Autorité de Régulation together with the measures taken to prevent a recurrence.

Article 98 judges the significance of an incident by, among other parameters, the number of users affected, the duration of the incident and the geographic extent of the area affected. Article 211 caps the financial sanction for a breach at 3% of the operator's turnover excluding tax for the last closed financial year, and at 5% for a new violation of the same obligation.

Article 16 requires every public or private organization to inform ARTCI immediately of any attack, intrusion or other disruption likely to impede its information system's proper functioning. Article 17 empowers ARTCI to take all measures it deems necessary to stop a disruption it identifies.

The Plan de Protection des Infrastructures Critiques names CI-CERT, alongside ARTCI and a sector cybersecurity officer, as one of the competent authorities a designated critical-infrastructure operator's cybersecurity focal point liaises with. Since the creation of ANSSI on 30 October 2024, the staff of CI-CERT, the national incident-response centre, belong to ANSSI. ANSSI publishes an online incident-declaration form for every kind of entity.

Article 10 excludes ideas, methods, procedures, concepts or information as such, official legislative, administrative or judicial texts and their official translations, and mere data and facts as such, from copyright protection outright, so a bare fact or the news of the day as such is never a protected work under Ivorian law, whichever outlet reports it first.

Article 25 separately lets any person, once a work has been disclosed, make analyses, press reviews and short quotations justified by a critical, polemical, educational, scientific or informational purpose, and use a literary, artistic or scientific work to illustrate teaching, in each case provided the use is not abusive, carries no lucrative purpose, and credits the author's name and the source.

Article 26 lets a literary work seen or heard during a current event be reproduced and made accessible to the public, by short extracts and for an informational purpose, on the occasion of a report of that event, by photography, audiovisual means or broadcast, again subject to crediting the author and source, and provided reproduction or broadcasting rights were not expressly reserved.

Neither article is capped at a headline-length threshold beyond its own critical, educational or informational-purpose test, and neither is confined to the press industry; whether either reaches a systematic aggregator's reproduction of headlines and snippets, as opposed to a traditional press review or a broadcaster's current-events report, has not been tested in a reported Ivorian decision.

Côte d'Ivoire has no separate press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, no recognized hot-news or misappropriation doctrine distinct from ordinary copyright and unfair-competition law, and no located case law on hyperlinking or framed display.