Cabo Verde

Article 9 criminalises, through a computer system: producing child pornography with the purpose of disseminating it (2 to 8 years' imprisonment, paragraph 1); offering or making it available (1 to 5 years, paragraph 2); disseminating or transmitting it (1 to 5 years, paragraph 3); obtaining it for oneself or another (1 to 4 years, paragraph 4); and possessing it in any way (1 to 4 years, paragraph 5).

Paragraph 6 defines child pornography for these purposes as any pornographic material that visually represents: (a) a person under 14 years of age, or an incapable person, for exhibitionist purposes or involved in sexually explicit conduct; (b) a person 14 to 18 years of age involved in sexually explicit conduct; or (c) any representation, by any means, of a child under 18 performing real or simulated explicit sexual activities, or any representation of a child's sexual organs for a predominantly sexual purpose.

Paragraph 6(c)'s inclusion of a simulated representation reaches a computer-generated, AI-synthesised, or otherwise fabricated depiction of a child in sexually explicit activity on the same terms as a depiction of a real child, without requiring that an actual child be shown or that the material derive from a real event. Paragraph 6(d) sets a reduced penalty of up to three years' imprisonment where the victim depicted is 14 to 18 years of age.

Article 9 binds any person ("Quem"), not only an online service or platform. The Law was approved by the Assembleia Nacional on 25 January 2017, promulgated by the President of the Republic on 3 March 2017, and published in the Boletim Oficial of 20 March 2017; its own Article 33 provides that it enters into force 30 days after publication. It was published in Boletim Oficial n.º 13, I Série, of 20 March 2017. No notice stating the day on which the thirty days ended has been located.

Article 27(1) requires the controller to notify a personal data breach to the CNPD within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights, freedoms and guarantees of individuals. Where the notification cannot be made within 72 hours, Article 27(2) requires the controller to state the reasons for the delay.

Under Article 27(3) the notification is confidential and must at least describe the nature of the breach, its likely consequences and the measures the controller has taken or proposes. Article 27(5) requires the controller to document every personal data breach, with its facts, effects and remedial measures, so that the CNPD can verify compliance. Article 27(6) requires a processor to notify the controller of any personal data breach it becomes aware of, without undue delay.

Article 28(1) requires the controller to communicate to the data subject, without undue delay, a breach likely to result in a high risk to the data subject's rights, freedoms and guarantees. Article 28(2) requires that communication to describe the nature of the breach in clear and plain language and to include the likely consequences and the measures taken or proposed.

Article 28(3) dispenses the communication where appropriate protection measures were applied to the affected data, where later measures make the high risk no longer likely, or where it would involve disproportionate effort, in which case the controller must inform data subjects by an equally effective means such as a public communication.

Article 28(4) lets the CNPD, where the controller has not communicated the breach and the CNPD considers the risk high, require the controller to do so or dispense it on those grounds. Lei n.º 121/IX/2021 entered into force thirty days after its own publication on 17 March 2021.

Article 7 permits processing only where the data subject has unambiguously consented or where processing is necessary for a contract to which the data subject is party, a legal obligation, the data subject's vital interests where the data subject is physically or legally unable to consent, a public interest task or the exercise of public authority, or the legitimate interest of the controller or of a third party to whom the data is disclosed that does not override the data subject's interests, rights, freedoms and guarantees.

Article 12 subjects the interconnection of personal data, where no legal provision already establishes it, to the authorization of the CNPD, requested by the controller or jointly by the controllers concerned, and requires the interconnection to be necessary and adequate for the controllers' legal or statutory purposes and legitimate interests, to avoid discrimination or any reduction of the data subjects' fundamental rights, freedoms and guarantees, to take account of the type of data interconnected, and to carry adequate security measures.

In the text republished in 2013, Article 10 gave that authorization to the Comissão Parlamentar de Fiscalização. Lei n.º 121/IX/2021 amended the article to name the CNPD.

Article 24 requires the controller to put in place technical and organizational measures appropriate to protect personal data against accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure or access, at a level of security suited to the risks of the processing and the nature of the data, and to choose a processor offering sufficient guarantees about those measures.

Article 33 bars anyone acting under the authority of the controller or processor, and the processor itself, from processing personal data they can access except on the controller's instructions, unless legal obligations require otherwise, and Article 34 binds controllers and anyone who learns of the data in the course of their functions to professional secrecy, including after those functions end.

Article 39 requires the controller or its representative to notify the CNPD before carrying out a wholly or partly automated processing operation or set of operations serving one or more related purposes, and Article 40 additionally requires the CNPD's authorization, unless a legal act already authorizes it, for processing of the data referred to in points (a) and (c) of Article 8(1) and in Article 11(2), credit and solvency data, interconnection of personal data under Article 12, and use of personal data for purposes other than those for which it was collected.

Article 43 requires processing that must be authorized or notified, and is not the subject of a legal act, to appear in a CNPD register open to consultation by anyone, and requires a controller exempt from notification to give anyone who asks, in an appropriate manner, at least the particulars listed in Article 42(1).

The law itself entered into force thirty days after its publication, following approval by the Assembleia Nacional on 20 December 2000 and enactment by the President on 10 January 2001. The Law appears in the Boletim Oficial da República de Cabo Verde, I Série, n.º 2, of 22 January 2001.

Article 26(1) requires the controller, taking account of the state of the art, the cost of implementation and the nature, scope, context and purposes of the processing and its risks to individuals, to apply appropriate technical and organizational measures, such as pseudonymization, both when it determines the means of processing and when it processes, so as to implement the data protection principles effectively.

Article 26(2) requires the controller to apply measures ensuring that, by default, only the personal data necessary for each specific purpose are processed, as to the amount collected, the extent of processing, the storage period and accessibility. Article 26(2) also requires those measures to ensure that, by default, personal data are not made available without human intervention to an indefinite number of individuals. Lei n.º 121/IX/2021 entered into force thirty days after its own publication on 17 March 2021.

Article 29(1) requires a controller whose processing, in particular using new technologies, is likely to result in a high risk to individuals' rights and freedoms to carry out, before starting the processing and notifying it to the CNPD, an impact assessment of the envisaged processing operations on the protection of personal data.

Article 29(2) makes an assessment mandatory in particular for a systematic and extensive evaluation of personal aspects of individuals based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based, for large-scale processing of the special categories of data in Article 8(1) or of data on criminal convictions and offences in Article 11, and for large-scale systematic monitoring of publicly accessible areas.

Article 29(4) requires the controller to seek the advice of the data protection officer, where one has been designated, when carrying out the assessment. Article 29(7) requires the assessment to contain at least a systematic description of the envisaged processing and its purpose, an assessment of its necessity and proportionality, an assessment of the risks to data subjects' rights and freedoms, and the measures envisaged to address those risks.

Article 29(8) requires the controller, where necessary, to seek the views of data subjects or their representatives on the intended processing, without prejudice to the protection of commercial or public interests or the security of processing operations. Article 29(9) requires the controller, where necessary, to review whether the processing is carried out in accordance with the assessment, at least when the risk represented by the processing operations changes.

Article 29(10) requires the controller, when notifying the processing, to communicate the result of the assessment to the CNPD. Lei n.º 121/IX/2021 entered into force thirty days after its own publication on 17 March 2021.

Article 30(1) requires the controller and the processor to designate a data protection officer where the processing is carried out by a public authority or body other than the courts and the public prosecutor acting in their procedural capacity, where their core activities require regular and systematic monitoring of data subjects on a large scale, or where their core activities consist of large-scale processing of the special categories of data in Article 8 or of data on criminal convictions and offences in Article 11.

Article 30(4) requires the officer to be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practice and the ability to perform the tasks in Article 32. Article 30(6) requires the controller to communicate the officer's contact details to the CNPD. Article 31(1) requires the controller and the processor to involve the officer properly and in good time in all issues relating to the protection of personal data.

Article 31(2) requires them to support the officer with the resources necessary to perform the tasks and maintain expert knowledge, and with access to personal data and processing operations. Article 31(3) requires them to ensure that the officer receives no instructions regarding the exercise of the tasks, that the officer is not dismissed or penalized for performing them, and that the officer reports directly to the highest management level.

Article 31(6) allows the officer to perform other tasks and duties and requires the controller and the processor to ensure that these do not result in a conflict of interests.

Article 32(1) sets the officer's minimum tasks: to inform and advise the controller, the processor and the staff who process data of their obligations, to monitor compliance with the law and with the controller's policies, to advise on the impact assessment and monitor its performance, to cooperate with the CNPD and to act as its contact point. Lei n.º 121/IX/2021 entered into force thirty days after its own publication on 17 March 2021.

Article 6 requires personal data to be processed lawfully, transparently and in good faith, collected for determined, explicit and legitimate purposes, kept adequate, relevant and limited to the minimum necessary for those purposes, kept accurate and up to date, and kept identifiable for no longer than those purposes require, with the CNPD able to authorize further processing and longer retention for public-interest archiving, scientific or historical research or statistical purposes where the controller has a legitimate interest, the data subject's rights do not prevail and adequate safeguards apply.

Article 24(4) requires processing carried out by a processor to be governed by a contract or other legal act that binds the processor to the controller and provides, among other things, that the processor acts only on the controller's instructions and sets out the subject matter and duration of the processing, its nature and purpose, the categories of personal data and the controller's obligations and rights.

Article 24(6) bars a processor from engaging another processor unless the controller has first given specific authorization in writing. Lei n.º 121/IX/2021 amended Articles 6 and 15 of Law No. 133/V/2001. Lei n.º 121/IX/2021 entered into force thirty days after its own publication on 17 March 2021.

Article 35 permits transfer of personal data undergoing or intended for processing only in compliance with this law and other applicable data protection legislation and, for a transfer abroad, to a country that ensures an adequate level of protection, which Article 35(2) assesses in light of all the circumstances of the transfer, and leaves it for the CNPD to decide whether a foreign State ensures that adequate level.

Article 36 lets the CNPD permit a transfer to a country that does not ensure an adequate level of protection where the data subject has unambiguously consented, or where the transfer is necessary for a contract between the data subject and the controller or for pre-contractual steps at the data subject's request, for a contract in the data subject's interest between the controller and a third party, for an important public interest or a legal claim, or to protect the data subject's vital interests, or is made from a public register open to consultation by the general public or a person who can show a legitimate interest.

Article 36 also lets the CNPD authorize a transfer or set of transfers to a country without an adequate level of protection where the controller presents sufficient guarantees for the protection of privacy and fundamental rights and freedoms, in particular through appropriate contractual clauses. The law itself entered into force thirty days after its publication, following approval by the Assembleia Nacional on 20 December 2000 and enactment by the President on 10 January 2001. The Law appears in the Boletim Oficial da República de Cabo Verde, I Série, n.º 2, of 22 January 2001.

Article 23(1) gives every person the right not to be subject to a decision that produces legal effects concerning them or significantly affects them, taken solely on the basis of automated processing of their personal data, including profiling.

Paragraph 2 admits such a decision by legal authorization or where a person consents to being subject to it, provided it occurs in the course of entering into or performing a contract, and on condition that the person's request to enter into or perform the contract has been satisfied or that adequate measures guarantee their legitimate interests and their chance to put their point of view, in particular their right of representation and expression.

Lei n.º 121/IX/2021 added the right not to be subject to a decision based on profiling. Lei n.º 121/IX/2021 entered into force thirty days after its own publication on 17 March 2021.

Article 23(3) permits a decision that produces legal effects concerning a person, or significantly affects them, taken solely on the basis of automated processing, when the CNPD authorizes it and measures guaranteeing the data subject's legitimate interests are taken. The law itself entered into force thirty days after its publication, following approval by the Assembleia Nacional on 20 December 2000 and enactment by the President on 10 January 2001. The Law appears in the Boletim Oficial da República de Cabo Verde, I Série, n.º 2, of 22 January 2001.

Article 18(1) gives a data subject the right to receive the personal data concerning them that they provided to a controller, in a structured, commonly used and machine-readable format, and the right to transmit that data to another controller without hindrance from the controller to which it was provided. Article 18(1) applies that right where the processing is based on consent, or on a contract, and is carried out by automated means.

Article 18(2) gives the data subject the right to have the personal data transmitted directly between controllers where that is technically possible. Article 18(3) makes the right of portability inapplicable to processing necessary for a task carried out in the public interest or for the exercise of official authority vested in the controller. Article 18(4) provides that the right of portability does not prejudice the rights and freedoms of third parties.

Lei n.º 121/IX/2021 added the right to data portability to the law. Lei n.º 121/IX/2021 entered into force thirty days after its own publication on 17 March 2021.

Article 13(4) requires the data subject to be informed, when their data is collected over open networks and unless they already know it, that their personal data may circulate without security conditions and risk being seen and used by unauthorized third parties. Article 14(5) lets the data subject exercise access to health data, including genetic data, through a doctor of their own choosing.

Article 20(b) and (c) let a data subject object, on request and free of charge, to processing for direct marketing or any other form of prospecting, and object without cost to a first disclosure of the data to third parties for those purposes or to its use on behalf of third parties. The law itself entered into force thirty days after its publication, following approval by the Assembleia Nacional on 20 December 2000 and enactment by the President on 10 January 2001. The Law appears in the Boletim Oficial da República de Cabo Verde, I Série, n.º 2, of 22 January 2001.

Article 13(1) requires the controller or its representative to provide a data subject, from whom data is collected, with at least the controller's identity and address, the contact details of the data protection officer where there is one, the categories of data processed, the purposes and legal basis of the processing, the recipients or categories of recipients, whether replying is mandatory or voluntary and the consequences of not replying, and the existence and conditions of the rights of access, rectification, erasure and objection, unless the data subject already knows them.

Article 13(3) requires that information, where the data is not collected from the data subject, to be given at the time the data is recorded or, if disclosure to a third party is planned, no later than the first disclosure, unless the processing is authorized by law or giving the information is impossible or would take disproportionate effort.

Article 14(1) gives a data subject the right to obtain from the controller, freely and without restriction, at reasonable intervals and without excessive delay or cost, confirmation of whether data concerning them is processed together with the purposes, categories of data and recipients, a copy of the data on request, communication in intelligible form of the data and any available information on its source, knowledge of the logic behind automated decisions, including profiling, and notification to third parties of any rectification, erasure or destruction.

Article 20(a) lets a data subject object at any time, on compelling and legitimate grounds relating to their particular situation, to processing based on a public interest task or on the legitimate interest of the controller or a third party, in which case the controller must stop processing unless it shows compelling legitimate grounds that override the data subject's interests, rights and freedoms or the processing serves a legal claim.

Lei n.º 121/IX/2021 added the controller's address, the categories of data processed and the legal basis of the processing to the information a controller must give a data subject. Lei n.º 121/IX/2021 added the possibility of asking for a copy of one's personal data when exercising the right of access. Lei n.º 121/IX/2021 entered into force thirty days after its own publication on 17 March 2021.

Article 37 has the supervision of personal data protection follow up, evaluate and control the activities of legally competent organs or services processing personal data, safeguarding the Constitution, this Law, and the fundamental rights, freedoms and guarantees of citizens. Article 45 has the CNPD help draft codes of conduct and declare whether a submitted draft complies with the data protection laws and regulations in force.

Article 46 lets any person seek judicial recourse for a violation of the rights this law guarantees, in addition to a complaint to the CNPD, and Article 47 entitles a person who suffers damage from an unlawful processing operation or another act that breaches data protection legislation or regulation to compensation from the controller, who may be exempted in whole or in part on proving that the fact that caused the damage is not attributable to them.

Article 49 fines an entity that negligently fails the Article 39 notification duty, gives false information, or notifies without observing Article 41, CVE 50,000 to CVE 500,000 for an individual or CVE 300,000 to CVE 3,000,000 for a legal person or entity without legal personality, doubled for data subject to Article 40 prior authorization, and Article 50 fines another listed omission, including failing to designate a representative under Article 2(4) or to observe the obligations in Articles 6, 13, 14, 20, 23, 25 and 33 and Article 43(3), from CVE 100,000 to CVE 1,000,000, doubled for a failure to meet the obligations in Articles 7, 8, 11, 12, 35 or 36.

Article 59 makes it a crime, punishable by up to one year's imprisonment or a fine of up to 120 days and doubled for the data referred to in Articles 8 and 11, to intentionally omit a required CNPD notification or authorization request, give false information in one, divert or use personal data incompatibly with the purpose of collection, or promote or carry out an illegal interconnection of personal data, among other listed acts.

Article 61 makes erasing, destroying, damaging, suppressing or modifying personal data without authorization so as to make it unusable or impair its usability a crime punishable by up to two years' imprisonment or a fine of up to 240 days, doubled for particularly serious damage.

Article 62 makes failing to interrupt, cease or block processing after notice, refusing without just cause to cooperate with the CNPD, or failing to erase or destroy personal data after notice or once its retention period under Article 6 has elapsed, punishable as qualified disobedience.

Article 63 makes violating the duty of professional secrecy over personal data a crime punishable by imprisonment from six months to three years or a fine of eighty to two hundred days, increased by half for a civil servant, a financial advantage motive, or endangering another person's reputation, honor or private life.

Article 69 allows a temporary or permanent prohibition of processing, blocking, erasure or destruction of data, publication of the sentence at the convicted party's expense, or a public warning or censure of the controller to be ordered in addition to a fine or penalty. The law itself entered into force thirty days after its publication, following approval by the Assembleia Nacional on 20 December 2000 and enactment by the President on 10 January 2001. The Law appears in the Boletim Oficial da República de Cabo Verde, I Série, n.º 2, of 22 January 2001.

Article 38 establishes the CNPD as an independent administrative authority operating within the National Assembly. Lei n.º 41/VIII/2013 gave the provision, then numbered Article 22, this wording. Lei n.º 41/VIII/2013 entered into force thirty days after its publication. The act appears in the Boletim Oficial da República de Cabo Verde, I Série, n.º 48, of 17 September 2013.

Article 60 makes it a crime, punishable by up to one year's imprisonment or a fine of up to 120 days, to access personal data to which access is barred without due authorization or justification, with the penalty doubled where the access was achieved by violating a technical security rule, let the offender or a third party learn personal data, or gave a benefit or financial advantage, and prosecutable only on complaint.

Articles 64 to 67 make it a crime to copy, transfer or assign personal data without legal provision or consent, to use personal data incompatibly with the purpose of collection, to promote or carry out an illegal interconnection of data, and to insert false personal data, punishable by up to one or two years' imprisonment or by fines of up to 120 or 240 days. Lei n.º 121/IX/2021 entered into force thirty days after its own publication on 17 March 2021.

Article 11(1) restricts central registers on persons suspected of illegal activities, criminal and administrative offences, and decisions applying penalties, security measures, fines or additional penalties to public services with that legal competence, observing the procedural and data protection rules set by law. Article 11(3) limits processing for police investigation purposes to what preventing a concrete danger or prosecuting a particular offence requires.

Article 25 requires the controllers of the data referred to in Article 8(1), Article 8(4) and (5) and Article 11(1) to take adequate additional information security measures, including controlling entry to processing premises, controlling who may read, copy or alter data carriers, and controlling use of the automated processing systems and access to the data, and requires systems to separate health and sex life data, including genetic data, logically from other personal data.

The law itself entered into force thirty days after its publication, following approval by the Assembleia Nacional on 20 December 2000 and enactment by the President on 10 January 2001. The Law appears in the Boletim Oficial da República de Cabo Verde, I Série, n.º 2, of 22 January 2001.

Article 8 prohibits processing personal data relating to political, philosophical or ideological convictions or positions, religious faith, party or trade union membership, racial or ethnic origin, genetic data, biometric data, data relating to private life, health, sex life or sexual orientation, except where the data subject has expressly consented with guarantees of non-discrimination and adequate security measures, the law authorizes it with the same guarantees, the processing is statistical and not individually identifiable, or the CNPD authorizes it for an important public interest or the controller's legitimate interests with those guarantees.

Article 8 further permits that processing where it is necessary to protect the vital interests of the data subject or another person and the data subject is unable to consent, is carried out with consent by a nonprofit political, philosophical, religious or trade union body only for its own members' or regular contacts' data, concerns data the data subject has manifestly made public, is necessary for a legal claim, or is necessary for public health reasons with suitable and specific safeguards.

Article 8 additionally permits processing health, sex life and sexual orientation data, including genetic data, for preventive medicine, assessing an employee's capacity to work, medical diagnosis, health or social care or treatment, or management of health and social care systems, provided a health professional bound by professional secrecy, or another person under an equivalent secrecy obligation, carries it out, it has been notified to the CNPD, and adequate information security measures are in place.

Article 8 also bars profiling that leads to discrimination against individuals on the basis of those special categories. Article 11(2) lets the CNPD authorize the processing of personal data on suspected illegal activities, criminal and administrative offences, convictions, security measures, fines, additional penalties and disciplinary offences when it is necessary for the controller's legitimate purposes and the data subject's rights do not prevail.

Lei n.º 121/IX/2021 added biometric data and sexual orientation to the categories Article 8 lists. Lei n.º 121/IX/2021 entered into force thirty days after its own publication on 17 March 2021.

Article 6(1) punishes with imprisonment of up to one year or a fine of up to 120 days anyone who, intentionally and without legal permission or without being authorised for that purpose by the owner or another rights holder of the system or part of it, in any way accesses a computer system.

Article 6(2) punishes the same conduct where a person produces, sells, distributes, disseminates, or introduces into one or more computer systems a device, program, executable set of instructions, code, or other computer data intended to produce that unauthorised access.

Article 6(3) raises the penalty to up to three years' imprisonment or a fine where the access is achieved through violation of security rules, and Article 6(4) raises it to one to five years' imprisonment where the agent thereby learns a commercial or industrial secret or legally protected confidential data, or obtains a considerably high patrimonial benefit or advantage.

Article 6(5) makes an attempt punishable, and Article 6(6) makes criminal proceedings for the base offences under paragraphs 1, 3 and 5 dependent on a complaint. Article 2 defines a computer system as any device or interconnected set of devices carrying out automated processing of computer data, together with the network supporting communication between them and the data stored, processed, retrieved, or transmitted by them.

The Law was approved by the Assembleia Nacional on 25 January 2017, promulgated by the President of the Republic on 3 March 2017, and published in the Boletim Oficial of 20 March 2017; its own Article 33 provides that it enters into force 30 days after publication. It was published in Boletim Oficial n.º 13, I Série, of 20 March 2017. No notice stating the day on which the thirty days ended has been located.

Article 15 requires the public administration and the operators of critical infrastructure, public or private, to take appropriate and proportionate technical and organisational measures to manage the risks to the security of the networks and information systems they use. Article 17 requires the operators of essential services to take appropriate and proportionate technical and organisational measures to manage the risks to the security of the networks and information systems they use.

Article 17 requires the operators of essential services to carry out internal audits every year and to send each report within 15 days of completing the audit.

Article 12 defines digital service providers as the providers of an online marketplace service, an online search engine service, a cloud computing service and other services operating in the digital economy. Article 19 requires a digital service provider to identify and take appropriate and proportionate technical and organisational measures to manage the risks to the security of the networks and information systems it uses to offer digital services.

Article 19 requires those measures to take account of the security of systems and facilities, incident handling, business continuity management, monitoring, auditing and testing, and compliance with international standards.

Article 16 requires the public administration and the operators of critical infrastructure to notify the Centro Nacional de Cibersegurança of incidents with a relevant impact on the security of the networks and information systems, within the period that separate regulation sets. Article 18 requires the operators of essential services to notify the Centro of incidents with a relevant impact on the continuity of the essential services they provide, within the period that separate regulation sets.

Article 33 provides that Articles 16 to 28 take effect 180 days after the Centro Nacional de Cibersegurança is installed.

Article 20 requires a digital service provider to notify the Centro Nacional de Cibersegurança of incidents with a substantial impact on the provision of its digital services, in the shortest period possible for handling the data. Article 31 requires a digital service provider to tell the Centro immediately when it starts its activity, once the Centro has been installed.

Article 10(a) provides that news of the day and reports of different events given simply for information, however disclosed, may not be protected, placing bare news reporting entirely outside the Law's subject matter.

Article 62(1) permits, without authorization from the author and without compensation, several uses of works already lawfully published or disclosed, provided the authenticity and integrity of the title and the author's name are respected: alínea (c) covers reproduction of works included in news reports, filmed or televised, or of works permanently exhibited in public places or in places where representatives of social communication bodies have access; alínea (f) covers citation of short excerpts of another author's work, in written, audio, or visual form, when justified for scientific, critical or didactic reasons or for information, as long as those excerpts are not so extensive as to lessen interest in the work.

Article 62(2) separately permits an author who reproduces his own articles or letters published in newspapers or periodicals in argument with another person to also reproduce the replies of his adversary, binding the latter to the same right. Article 4 confines related (neighbouring) rights to performers, producers of phonograms and videograms, and broadcasting organisations, so the Law creates no press-publisher right.

Article 8(b) protects a database as a compilation where its selection or arrangement is an intellectual creation. Article 64(c) excludes reproduction of all or a significant part of a database from the private-use exception at Article 62(1)(l), rather than creating a separate sui generis database right. Article 139 revoked the prior copyright statute, Law No. 101/IV/90 of December 29, and Article 140 provides that the Law enters into force immediately.

The Law was published in the Boletim Oficial I Série No. 17 Supplement of April 27, 2009, the date WIPO Lex also records as the date of entry into force.