Libya

Article 73 requires a public entity or an authentication service provider to obtain a person's explicit consent before collecting their personal data, and confines any collection to the purpose of issuing, maintaining, or facilitating a certificate, absent the person's further explicit consent to a different purpose.

Article 74 lists narrow grounds on which collecting, disclosing, providing, or processing personal data is otherwise legitimate without that consent, including a criminal investigation, a court decision, a tax assessment, or protecting a person's vital urgent interest.

Article 75 binds the authentication service provider to follow appropriate procedures to ensure the confidentiality of personal data in its custody, and bars disclosing, transferring, declaring, or publishing it without the data subject's prior consent.

Article 78 requires due consideration of an appropriate level of protection before personal data is transferred outside Libya, naming six factors: the nature of the personal data, the source of the information, the purposes and duration of the processing, the destination country and its international commitments and applicable law, the relevant rules in that country, and the security measures taken to protect the data there.

The provision states a multi factor due consideration test rather than a prior authorization requirement, an adequacy finding, or a localization mandate.

Article 76 requires any person who controls personal data by virtue of their work in electronic transactions to give the data subject, before processing, a special notification identifying who is responsible for the processing and the nature, purpose, methods, and locations of the processing.

Article 77 requires the authentication service provider to let the person whose data was collected access and update it, including all personal data sites related to them, through appropriate technological means. Article 79 bars sending electronic documents to a person who has explicitly refused them, bars processing personal data against the data subject's explicit refusal, and bars processing that causes harm to, or infringes the rights or freedoms of, the person the data was collected from.

Article 79 also bars using personal data for a purpose other than the one agreed to without the data subject's consent, echoing article 73's purpose limitation from the data subject's own side.

The law's definitions article names the National Authority for Information Security and Safety as its Authority, and article 27 makes that Authority responsible for accrediting and monitoring the electronic authentication processes and sites through which the entities chapter seven binds collect personal data.

Article 80 bars providing authentication services without a license from that Authority, alongside a further list of prohibited acts concerning forged or misused electronic signatures, records, and authentication certificates.

Article 81 punishes an act listed in article 70 or article 80, which includes the unlicensed provision of authentication services, with imprisonment of not less than one year and a fine of between three thousand and ten thousand dinars, rising to a fine of not less than ten thousand dinars where the act disrupts a government, military, security, or banking transaction.

Article 82 extends the same penalties to the legal representative of a legal person whose failure to perform their duties contributed to the offence, and makes the legal person jointly liable for any financial penalty or compensation where the offence was committed on its behalf.

Article 81's penalty is stated for the offences article 80 lists rather than the personal data restrictions article 79 states, so the text does not clearly arm a separate criminal penalty for a breach of the personal data duties themselves, and no provision gives the Authority or any other body a stated power to investigate or hear a complaint about such a breach.

Article 11 of Law No. 5 of 2022 makes accessing a computer system, information system, information network, or website unlawful only where its protection measures are intentionally breached, wholly or partially, without authorization or in violation of an authorization.

Article 12 punishes unauthorized access with up to one year's imprisonment or a fine of 100 to 500 Libyan dinars, rising to at least one year and 500 to 5,000 dinars where the access deletes, alters, discloses, or copies data or disables or defaces a system, and to imprisonment and a fine of no less than 10,000 dinars where the access disables an information system or disrupts a network's operation.

Article 10 separately prohibits influencing an electronic system, network, or record by obtaining, disclosing, transmitting, or publishing a password, code, or other confidential data with intent to gain an unauthorized benefit or harm another.

Article 13 punishes intercepting an information system to obtain digital data with at least one year's imprisonment and a fine of 1,000 to 5,000 dinars, and article 14 punishes possessing or distributing a device or program prepared to reveal passwords or access codes or to break protection measures with at least one year's imprisonment and a fine of 1,000 to 10,000 dinars.

Article 2 of Law No. 9 of 1968 lists the categories of work an author is protected in, covering written, artistic, dramatic, musical, photographic, and similar works, but article 4 excludes a collection comprising various works, such as an anthology, from protection as such, without affecting the copyright each contained work carries on its own; Libya has no separate sui generis database or compilation right.

Article 4 also excludes a collection of official documents, such as statutes, decrees, and judgments, from protection unless it is itself characterized by innovation or an original arrangement. The law predates networked computing and states no text-and-data-mining exception and no machine-readable reservation mechanism.

Article 13 of Law No. 9 of 1968 permits analyses and short quotations from a published work where intended for criticism, discussion, education, or information, provided the author's name, if known, and the source are given.

Article 14 lets a newspaper or periodical publish a quotation, a summary, or a short statement from another's work or novel without the author's permission, and copy an article on political, economic, scientific, or religious discussion of public interest at a given time, as long as the source publication has not indicated that copying is strictly prohibited, but bars copying a scientific, literary, or artistic article, serial, or short story wholesale without permission; the source and author's name must always be given.

The same article states that the law's protection does not extend to daily events and other occurrences having the nature of ordinary news. Article 15 lets a newspaper or broadcaster publish or broadcast, as news and without the author's permission, a speech, lecture, or talk delivered at an open meeting of a legislative or administrative body or at a scientific, literary, political, social, or religious meeting addressed to the public.

Article 17 permits copying a short quotation, or a limited extract of a graphic, sculptural, or photographic work, in a school, literature, history, science, or art book, with the source and author's name always given.