Comoros

Article 462 punishes with one to five years' imprisonment and a fine of 7,000,000 to 10,000,000 Comorian francs whoever produces, records, offers, makes available, disseminates, or publishes, through an information system or a data-storage medium, an image or a representation of a pornographic, erotic, or morally offensive character.

Its second paragraph separately punishes with two to seven years' imprisonment and a fine of 5,000,000 to 7,000,000 Comorian francs whoever produces, records, counterfeits, or distributes a counterfeit image, video image, or representation of that character that harms a person's dignity, through the same means.

Article 463 punishes, with two to five years' imprisonment and a fine of 5,000,000 to 10,000,000 Comorian francs, procuring, importing, or exporting an image or a representation of a child-pornographic, erotic character through an information system, and article 464 punishes intentional possession of the same at one to three years and 2,000 to 4,000,000 Comorian francs.

None of these articles limits the offending material to a photograph of a real person; the chapter's own definitions section (article 449) defines a covered representation broadly, as any representation of facts, information, or concepts in a form amenable to computerized processing, so a computer-generated or otherwise synthetic image or representation of the kind these articles describe falls within the same wording used for a captured one.

Article 1 applies the law to any automated processing of personal data held in a digitized or manual file, and article 5 requires data to be collected and processed lawfully and fairly, for determined and legitimate purposes, kept accurate and up to date, and not retained beyond the period the purpose requires.

Article 41 requires processing carried out by a public or private body to be declared to the Commission before it is implemented, or entered in a register kept by a person the controller designates, and article 42 exempts general accounting, payroll, supplier management, and a non profit association's membership processing from that duty.

Articles 43(a) and 43(e) to (g) require the Commission's prior authorization for processing bearing a national identification number or a national census, processing concerning state security, defense or public safety or the investigation and prosecution of offenses, an interconnection of files serving different purposes, and processing that could exclude a person from a right, a benefit or a contract, and article 44 gives the Commission two months to decide on such a request, with silence counting as approval outside the article 17 state security procedure.

Articles 45 and 46 fix what a declaration must state, including the controller's identity, the processing's purposes, the data and its retention period, who may access it, and the security measures taken. Article 49 requires an electronic certification provider to collect personal data directly from the data subject and to use it only for the purpose for which it was collected, unless the data subject expressly consents otherwise.

Article 50 requires the controller to take precautions appropriate to the data and to the risks the processing presents, and article 51 confines a sub processor to the controller's instructions under a contract addressing security and confidentiality.

Article 52 requires the controller to notify the Commission without delay of any change to the declared processing or of its discontinuation, and article 53 allows retention beyond the article 5 period only for historical, statistical or scientific purposes, with the data subject's express consent, or with the Commission's authorization.

Article 9 bars a controller from transferring personal data to a foreign state unless that state ensures a sufficient level of protection for privacy and fundamental rights and freedoms, judged by the protections and security measures in force there and by the nature, origin and destination of the data and the purpose and duration of the processing.

Article 43(h) requires the Commission's prior authorization for a processing operation that provides for personal data to be transferred to another state, including where the transfer is grounded on contractual clauses or internal rules said to guarantee a sufficient level of protection.

Article 10 gives a data subject the right to object, on legitimate grounds, to processing of their personal data, and article 11 gives them a further right, free of charge and without needing to state a reason, to object to their data being used for commercial, charitable or political prospecting.

Article 12 requires a controller collecting data directly from the data subject to disclose its identity, the processing's purpose, whether answering is mandatory, the recipients, and how the rights of objection, access and rectification are exercised.

Article 13 gives a person the right to ask a body running a listed automated processing whether it holds data concerning them, and article 14 gives the holder of that right of access communication of the information in clear language and a copy on payment of a scale fee the Commission sets, subject to a response delay or the disregard of manifestly abusive requests the Commission may grant.

Article 15 lets a data subject demand correction, completion, updating, locking or erasure of data that is inaccurate, incomplete, ambiguous, outdated, or unlawfully collected, used, disclosed or retained, and requires notice to any third party the data was disclosed to.

Article 16 lets a file be completed or corrected, even on the controller's own initiative, on the Commission's favorable opinion, and article 18 lets access to medical information be exercised only through a physician the data subject designates.

Article 48 requires a controller to tell a network communication user, clearly and completely, the purpose of accessing or storing information in their terminal equipment and the means available to object to it, and requires information under article 14 to be given to a data subject the data was not collected from at the latest by the data's first communication to a third party.

Article 19 creates the Commission Nationale de l'Informatique et des Libertés (CNIL) as the body charged with protecting personal data and controlling its processing, and article 20 gives it its own legal personality, administrative and management autonomy, and independence from every administrative and political authority.

Article 21 lists the Commission's missions, including informing and advising controllers and data subjects of their rights and obligations, controlling the creation of processing, receiving and answering complaints, alerting the public prosecutor to violations amounting to criminal offenses, and proposing legislative improvements. Articles 23 to 30 fix the Commission's nine member composition, their nomination, oath, five year renewable term, incompatibilities, and professional secrecy.

Article 39 bars ministers, public authorities, and public or private enterprise directors from obstructing the Commission's action and requires them to take useful measures to facilitate its mission, and article 47 lets Commission members and agents access the premises where processing is carried out, subject to judicial authorization if the controller objects, and requires a report of the visit.

Article 54 lets the Commission issue a warning or a formal notice fixing a deadline of up to eight days to end a violation, and article 55 lets it, where the controller does not comply, impose a pecuniary sanction, an injunction to stop the processing, withdrawal of an authorization, or a data lock, after a contradictory procedure under articles 56 to 59; article 60 lists what counts as a serious violation, including unlawful collection of sensitive, offense related or national identification data and obstructing the Commission's inspection.

Article 63 lets an injured person seek damages before the competent court, and article 65 punishes every offense article 64 lists, including obstructing the Commission, processing without required formalities, and unauthorized disclosure harming a person's privacy, with five to ten years' imprisonment and a fine of 10,000,000 to 35,000,000 Comorian francs, or either penalty alone, extending the same penalties to complicity and attempt.

Article 6 bars collecting or processing data revealing political, philosophical or religious opinions, trade union membership, or health or sexual life data without the data subject's express consent, though a religious, philosophical, political or trade union body may keep an automated membership register free of that bar, and the Commission may allow a further exception for reasons of public interest.

Article 7 lifts the article 6 bar where the data subject has expressly consented and consent may lawfully remove the bar, where processing safeguards a human life the data subject cannot consent to protect, where a non profit, religious, philosophical or trade union body processes data limited to its own members and regular contacts, where the processing establishes, exercises or defends a right in court, or where the processing serves individual therapeutic or medical follow up or health research.

Article 8 restricts processing of data on offenses, convictions or security measures to courts, public authorities and bodies managing a public service acting within their legal duties, legal auxiliaries for the strict needs of the missions the law entrusts to them, and other legal persons for the strict needs of managing disputes over offenses of which they were the victim.

Articles 43(b) to (d) require the Commission's prior authorization and control before processing biometric data needed to verify a person's identity, data on a person's health or condition, or data on offenses and convictions, because of the particular risk such processing poses to privacy and fundamental rights.

Article 451 of Chapter 4's Section 2 (Infractions spécifiques aux technologies de l'information et de la communication) punishes with one to two years' imprisonment and a fine of 500,000 to 5,000,000 Comorian francs whoever accesses or attempts to access, fraudulently, all or part of an information system.

Article 452 separately punishes fraudulently remaining or attempting to remain within all or part of a system, and articles 453 through 459 punish fraudulently hindering, corrupting, intercepting, altering, or forging data, or knowingly using fraudulently obtained data, or obtaining an advantage by any of those means.

None of these articles carries a public-page or authorization-test exception, so the chapter reads as a general unauthorized-access regime rather than one written with automated collection of published web content in mind.

Article 479 conditions access to internet service from a cybercafé on prior identification of the user, which the cybercafé operator must carry out under conditions a decree sets.

Article 480 bars a minor under eighteen from accessing a cybercafé unless accompanied by an adult authorized by the minor's parents or guardian, and limits a minor's internet access there to exclude pornographic, violent, racist, or degrading websites and, generally, any website offending human dignity or inciting lawlessness.

The same article requires every person offering online communication-service access to inform subscribers of the existence of technical means to restrict or select the services they reach, and to offer at least one such means.

Article 481 punishes an internet-access provider that does not comply with article 480's obligations with six to twelve months' imprisonment, and article 482 punishes anyone who does not comply with the information-and-filtering-tools obligation with a fine of 1,000,000 to 10,000,000 Comorian francs.

Article 41 lists what an author of a divulged work may not prohibit once it has been made public, including, on condition that the author's name and the source are clearly indicated, analyses and short quotations justified by the critical, polemical, pedagogical, scientific, or informational character of the work into which they are incorporated, and press reviews.

It also permits, for current-events information, the full or partial dissemination by press or broadcasting of public speeches delivered before political, administrative, judicial, or academic assemblies, and public meetings of a political, administrative, judicial, or academic character.

WIPO Lex lists this 1957 statute as Comoros's current main copyright and related-rights law, with no later Comorian act shown as having replaced it; nothing in the text or in WIPO Lex's record addresses a press-publisher neighbouring right, a compelled-bargaining charge, a hot-news doctrine, linking or framing, or a text-and-data-mining reservation.