Lesotho

Section 23(1) requires a data controller, on reasonable grounds to believe a data subject's personal information has been accessed or acquired by an unauthorised person, to notify the Commission and the data subject unless the data subject's identity cannot be established.

Section 23(2) requires that notification to be made as soon as reasonably possible after discovery of the compromise, taking into account the legitimate needs of law enforcement and any measures reasonably necessary to determine the scope of the compromise and restore the integrity of the controller's information system.

Section 23(3) requires the controller to delay notification to the data subject where the Lesotho Mounted Police Service, the National Security Service or the Commission determines that notification would impede a criminal investigation.

Section 23(4) requires the notification to the data subject to be in writing, delivered by post, email, a prominent website posting, publication in the news media, or another method the Commission directs, and section 23(5) requires it to contain enough information for the data subject to take protective measures, including the identity of the unauthorised person if known.

Section 23(6) lets the Commission direct a data controller to publicise a compromise where the Commission has reasonable grounds to believe publicity would protect an affected data subject.

The Data Protection Act, 2011 (Act No. 5 of 2012) establishes the Data Protection Commission and applies to a data controller domiciled or having its principal place of business in Lesotho, and to a controller outside Lesotho that uses automated or non-automated means in Lesotho or uses such means only for forwarding personal information (s. 3), subject to exemptions for purely personal or household activity, de-identified information, specified State national security, defence or public safety functions, and journalistic, artistic or literary expression necessary to reconcile privacy with freedom of expression (s. 4).

Personal information may be processed only where the data subject gives explicit consent, the processing is necessary for a contract, a legal obligation, the data subject's legitimate interests, a public body's public law duty, or the legitimate interests of the controller or a third party, and personal information must be adequate, relevant and not excessive for the purpose for which it is processed (ss. 15-16).

A data controller must collect personal information directly from the data subject except in listed circumstances, and must collect it for a specified, explicit and legitimate purpose and not further process it in a way incompatible with that purpose (ss. 17-18).

Records of personal information may not be retained longer than a prescribed period absent a listed ground, and a data controller must destroy, delete or de-identify a record as soon as reasonably practicable once no longer authorised to retain it, in a manner that prevents its reconstruction (s. 19).

A data controller must take appropriate, reasonable technical measures to secure the integrity of personal information against loss, damage, unauthorised destruction and unlawful access, and govern any agent who processes information on its behalf by a written contract requiring the same confidentiality and security measures (ss. 20-22).

A data controller must take reasonably practicable steps to keep personal information complete, accurate, not misleading and up to date, and must ensure the Act's principles are complied with (ss. 24, 28). The further processing of personal information for historical, statistical or research purposes is exempt from every principle except security safeguards and information quality, provided the data controller establishes appropriate safeguards against other use (s. 38).

A data controller must notify the Commission of its processing of personal information before processing it and again whenever material particulars change, the Commission may issue, approve, amend or revoke codes of conduct, and the Minister may make regulations to give effect to the Act (ss. 53-54, 56).

A person already processing personal information when the Act commenced had two years, extendable to three by the Minister, to bring that processing into conformity with the Act and notify the Commission (s. 57).

Section 52 bars a data controller in Lesotho from transferring personal information about a data subject to a third party in a foreign country unless the recipient is subject to a law, code of conduct or contract that effectively upholds processing principles substantially similar to the Act's, including onward-transfer protections.

The prohibition also does not apply where the data subject consents to the transfer, where the transfer is necessary for the performance of a contract between the data subject and the controller or for pre-contractual measures the data subject requested, or where the transfer is necessary for a contract concluded in the data subject's interest between the controller and a third party.

The prohibition additionally does not apply where the transfer is for the data subject's benefit and it is not reasonably practicable to obtain the data subject's consent, or where it would be reasonably practicable and the data subject would likely give it.

Section 51 bars a decision that has a legal effect on a person, or that significantly affects them, from being based solely on automated processing of their personal information intended to profile their personality or habits. The bar does not apply to a decision taken in connection with a contract, where either the data subject's contractual request has been met or appropriate measures let the data subject make representations about the decision.

It also does not apply to a decision governed by a law or code that specifies appropriate measures protecting data subjects' legitimate interests.

Section 25 requires a data controller that collects personal information directly from a data subject to take reasonably practicable steps, before or as soon as practicable after collection, to make the data subject aware of the information being collected, the controller's name and address, the purpose of collection, whether the supply of the information is mandatory, the consequences of not providing it, and the existence of the rights of access and rectification.

Section 26 gives a data subject who proves their identity the right to request free confirmation of whether a controller holds personal information about them and to request that information, including the identity of third parties who have had access to it, and gives a right to written reasons and a right to challenge those reasons where a request is denied.

Section 27 gives a data subject a free right to have inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained personal information corrected or deleted, requires the controller to answer the request within 14 days, and requires the controller to tell every party the changed information had been disclosed to within 7 working days where a correction affects a decision about the data subject.

Section 50 entitles a data subject to require a controller by notice to cease, or not begin, processing their personal data for direct marketing, and lets the Commission order compliance where the controller fails to observe that notice.

Section 39 lets a person submit a complaint to the Commission alleging a contravention of the Act or, where an approved code of conduct applies, a grievance about a determination under that code, and sections 40 to 45 give the Commission power to investigate, conciliate, decline to act on specified grounds, and inform the parties of the outcome.

Section 43 lets the Commission summon witnesses, administer oaths, receive evidence, and apply to the Magistrate Court for a warrant to enter and search premises where there are reasonable grounds to suspect a contravention or offence.

Section 46 lets the Commission serve a data controller found to have contravened the Act with an enforcement notice requiring it to take specified steps or stop processing personal information within a stated period, and sections 47 to 48 let the controller apply to cancel or vary the notice or appeal it to a court. Section 49 lets a data subject bring a civil action for damages against a data controller in a court having jurisdiction for breach of any provision of the Act.

Section 55 makes it an offence, on conviction, to hinder, obstruct or unlawfully influence the Commission, breach confidentiality rules made under the Act, obstruct execution of a warrant, or violate the Act's provisions without reasonable cause, punishable by a fine not exceeding M50,000 or imprisonment not exceeding five years, or both, with a juristic person's sentence served by its Chief Executive Officer.

Section 29 prohibits a data controller from processing personal information concerning a child who is subject to parental control, or a data subject's spiritual, religious or philosophical beliefs, race or ethnic origin, trade union membership, political affiliation, health, sexual life or criminal behaviour, unless the Act specifically permits it.

Biometric identifiers are separately defined in the Act as a technique of personal identification based on physical characteristics including fingerprinting, DNA analysis, retinal scanning and voice recognition, but they are not among the categories section 29 lists, so they carry no heightened restriction beyond the Act's general lawfulness, purpose limitation and security duties.

Sections 30 to 35 exempt specific processing of each listed category, including processing by a spiritual or religious organisation of its own members' beliefs, processing necessary to identify a data subject or comply with the law for race, processing by a trade union of its own members for the union's aims, processing by a political institution of its own members for the institution's aims, and processing by a medical professional, healthcare institution, insurer, school, or correctional or pension body for health or sexual life, each subject to a confidentiality obligation.

Personal information processed under the spiritual, religious, race, trade union or political exemptions may not be supplied to a third party without the data subject's consent.

Section 36 lifts the prohibition more generally where processing is carried out with prior parental consent for a child subject to parental control, where it is necessary to establish, exercise or defend a legal right, to comply with an obligation of international public law, where the Commission has authorised it in the public interest under section 37, where the data subject consents, or where the data subject has deliberately made the information public.

Section 37 lets the Commission authorise a data controller to process personal information where the public interest in the processing substantially outweighs the interference with the data subject's privacy, or where the processing carries a clear benefit to the data subject or a third party that substantially outweighs that interference, subject to any conditions the Commission imposes.

Section 62(2) makes it an offence for a person who either lawfully or unlawfully gains access to a computer or electronic storage device owned by another to (a) extract from it information which he or she has no reasonable cause to believe the owner would allow to be extracted, or (b) interfere with the device or the information it contains, without the owner's consent and with no reasonable ground to believe such consent would be given, intending to secure an advantage for themselves or cause damage to the electronic data or programmes.

The offence is framed around the owner's likely consent to the extraction rather than around defeating a technical access control, so its application to a person who reads or collects data from a genuinely public, unauthenticated web page, where the owner has made the content available to any visitor, is unsettled; no reported Lesotho case construes section 62 in that context.

Section 62 is not among the sections listed in the Code's penalty Schedule, so under section 109(3) a court convicting a person under section 62 imposes such penalty as another law provides or, absent one, such penalty as it thinks fit having regard to the offence's gravity and the Sentencing Guidelines issued by the Chief Justice, rather than a fixed statutory cap.

Section 3 grants copyright protection to original literary, artistic and scientific works by the sole fact of their creation, and section 2's closed list of "literary, artistic and scientific" works does not extend to a table, compilation, or database as such, so Lesotho has no sui generis database right and no separate compilation-specific protection; a database is protected, if at all, only to the extent its selection or arrangement of content is itself an original literary or artistic work.

Section 5(c) excludes "mere communications of facts and data" from protection altogether, so bulk collection of unadorned factual data is outside the scope of copyright from the start.

The Order enacts no text-and-data-mining exception of any kind, so large-scale automated reproduction of copyrighted expression (as opposed to bare facts) for AI-training purposes falls to be justified, if at all, under the ordinary "Free use" exceptions in section 9, none of which is framed around automated or machine collection.

A person whose economic rights under section 7 are infringed, including by unauthorized reproduction beyond a section 9 exception, may seek an interdict and damages under section 36, and separately faces criminal liability under section 37(1) for violating the rights the Order protects. Section 1 provides that the Order comes into operation on a date to be appointed by the Minister by notice in the Gazette, and no such commencement notice has been located.

Section 5 excludes "rules or decisions of courts and administrative bodies," "news of the day published, broadcast or publicly communicated by any other means," and "mere communications of facts and data" from copyright protection, so a factual news report as such is never a protected work in the first place.

Section 9(a)(ii), the Order's "Free use" provision, permits, without the author's consent and without payment, the inclusion of quotations from a protected work in another work, with mention of source and author, "including quotations from newspaper articles and periodicals in the form of press summaries," provided the quotation is compatible with fair practice and its extent does not exceed what the purpose justifies.

Section 11(c) permits reproducing in the press, or communicating to the public, an article published in a newspaper or periodical on a current economic, political or religious topic (or a broadcast or cable-distributed work of the same character), unless the article or work was accompanied by an express condition prohibiting such use, and provided the source is clearly indicated when so used.

Section 11(d) separately permits, for the purpose of reporting a current event, the reproduction or making available to the public of a work to the extent justified by the informatory purpose.

Section 11(g) permits reproducing in the press, or communicating to the public, a political speech delivered in public, a speech delivered during legal proceedings, or a public lecture, address or sermon, provided the use is exclusively for current information, while the author retains the right to publish a collection of such works. None of these provisions creates a publisher-side neighbouring right; the Order's own neighbouring-rights part (ss.

24-30) reaches only performers, producers of phonograms, and broadcasting organisations. Section 1 provides that the Order comes into operation on a date to be appointed by the Minister by notice in the Gazette, and no such commencement notice has been located.