Madagascar

Article 65 states that prior declaration of computerized processing consists in informing the CMIL of the intention to process, and that the processing starts after a declaration receipt is obtained. Article 66 allows the register of computerized processing to take a physical or electronic form.

Article 66 requires the register to hold the names and contact details of the controller, any subcontractor and the data protection officer, the purposes, the CMIL's opinions and authorizations, the categories of data subjects, data and recipients, any transfers abroad, the retention period and the security measures. Article 67 requires the legal representative of a public-law legal entity to address the request for the CMIL's binding opinion on public-sector processing.

Article 68 requires a controller whose processing presents the risks that article 46 of Law No. 2014-038 specifies to ask the CMIL beforehand for authorization, and to justify that the interest of the processing prevails over the fundamental rights and freedoms of the data subject. Under article 68 the processing may begin only after the CMIL notifies its authorization.

Article 69 requires the receipt of a simplified declaration of conformity to carry the name of the declarant and the norm declared. Article 72 requires the designation of the data protection officer to rest on professional qualities in computing and data protection.

Article 73 requires the notification of the officer's designation to the CMIL to state the identity and professional contact details of the controller, the identity and professional contact details of the officer, and the date of designation. Article 74 requires a controller that plans to revoke its data protection officer to inform the CMIL by any written means eight days before the revocation, giving the serious ground that article 54 of Law No. 2014-038 requires.

Article 1 states that the law protects the rights of persons regarding the processing of personal data, and article 2 requires that information technology serve every person and respect human dignity, human rights, privacy, and individual or public freedoms, recognizing a right to the protection of personal data for everyone.

Article 5 applies the law to any automated or non-automated processing of personal data contained in or intended to be included in files, carried out in whole or in part on Malagasy territory, excluding only purely personal activity and processing for the sole purposes of journalism or literary or artistic expression. Article 6 reaches a controller established on Malagasy territory and a controller established elsewhere who uses means of processing located there, other than for mere transit.

Articles 7 to 13 define personal data, processing, a controller, a subcontractor acting on the controller's instructions, a recipient, the data subject, and consent as a free, specific, and informed manifestation of will.

Article 14 requires personal data to be collected and processed fairly, lawfully, and without fraud for determined, explicit, and legitimate purposes, barring later use for another purpose without the data subject's consent or a purpose the law itself sets, and requires it to be adequate, relevant, accurate, and kept no longer than those purposes need, subject to an exception for archival, historical, statistical, or scientific retention under safeguards the law or the CMIL defines.

Article 15 requires the controller to take precautions appropriate to the data's nature and the risks involved to preserve its security, protecting processing and data against accidental or unlawful destruction, accidental loss, alteration, disclosure, or unauthorized access. Article 16 lets processing be subcontracted only on the controller's instructions and only to a subcontractor offering sufficient guarantees to implement the required security measures.

Article 17 requires the data subject's consent or one of five alternative lawful grounds: a legal obligation, safeguarding the data subject's life, a public-service mission, performance of a contract, or the controller's or recipient's legitimate interest, subject to the data subject's own rights and interests.

Article 21 requires a provider of electronic-certification services to collect the personal data needed to issue and store signature certificates directly from the data subject, unless the data subject expressly consents otherwise. Article 43 makes declaring a processing operation to the CMIL a precondition of implementing it, with the operation then entered in a register the controller's data protection officer keeps.

Articles 44 to 46 set the corresponding formalities: public-sector processing needs a regulatory act adopted after the CMIL's reasoned favorable opinion, private-sector processing needs a prior declaration for which a receipt issues without delay, and processing presenting a particular risk to rights and freedoms or to privacy needs the CMIL's prior authorization.

Articles 47 to 49 let the CMIL publish simplified-declaration or exemption norms for the most common categories of processing, require it to rule on a declaration or authorization request within two months, renewable once, with silence read as a refusal, and fix what a declaration or request must contain, including the controller's identity, the processing's purposes, any interconnection with other processing, the data categories and their retention period, the recipients, the security measures, and any subcontractor used.

Article 51 requires every controller to designate a data protection officer who keeps the processing register current, is consulted before any new processing begins, advises the CMIL when in doubt, receives requests and complaints from data subjects, tells the controller of any breach found before referring it to the CMIL if the controller does not fix it, and produces an annual activity report.

Article 52 exempts a controller who has designated a data protection officer from the ordinary declaration formalities, except where the processing needs the CMIL's authorization, and articles 53 and 54 require the officer to be independent, free of conflicting duties, bound to confidentiality, and removable only for serious cause after the CMIL is told.

Article 62 requires a controller to send the CMIL a prior request to transfer data abroad, justifying a sufficient and appropriate level of data protection and enforceable rights and effective legal remedies for the data subject, and bars starting the transfer before the CMIL notifies its authorization. Article 62 defines appropriate contractual clauses as those agreed between the controller in the sending country and the controller in the receiving country.

Article 62 defines the adoption of internal rules as integrating provisions into administrative arrangements between public authorities that give data subjects enforceable and effective rights. Article 63 requires the recipient of transferred data to ask the CMIL before transferring it abroad again, attaching the original controller's written agreement and the appropriate safeguards of the preceding article, and bars the onward transfer before the CMIL notifies its agreement.

Article 20 bars a controller from transferring personal data to a foreign State unless that State's legislation assures a level of protection for people similar to what this law assures, a level assessed against every circumstance of the transfer, including the data's nature, the purpose and duration of the processing, the countries of origin and final destination, and the third country's general or sector rules of law, professional rules, and security measures.

Absent a similar level of protection, the CMIL may still authorize the transfer where the controller offers sufficient guarantees for privacy and fundamental rights and freedoms, which may rest on appropriate contractual clauses or binding internal rules.

By way of exception to those paragraphs, a transfer to a country that does not assure a similar level of protection may still go ahead where the data subject has unambiguously consented to the transfer after being informed there is no similar level of protection, where the transfer is necessary to perform or negotiate a contract with the data subject or a contract in the data subject's interest with a third party, where it is necessary or legally required to safeguard an important public interest or to establish, exercise, or defend a legal right, where it safeguards the data subject's vital interest, or where it comes from a public register open to public consultation under legislative or regulatory provisions and the legal conditions for consulting it are met.

Article 20 also bars a recipient from transferring the data onward to a foreign country again without the agreement of the original controller and of the CMIL.

Article 56 of Decree No. 2023-1541 requires a data subject to exercise the right of objection with the controller before turning to the CMIL, by a request made orally, in writing or by email that names the data to be deleted and the legitimate reason for the objection. The controller must rule on the objection within eight days of the request, and its silence after that period counts as a refusal.

To contest an objection, the controller must show that the processing meets legitimate and compelling grounds. Article 57 lets a data subject ask the CMIL to order the measures needed to prevent concealment or disappearance of the data after an access request. The CMIL notifies the measures it orders to the controller with a deadline for carrying them out and a duty to report on them.

Article 58 requires a request for indirect access or rectification, where the processing concerns State security, defense or public security, to come with a copy of the requester's identity document and any useful document.

Article 22 gives a person with a legitimate reason the right to object at any time and free of charge to processing of personal data concerning them, gives an unqualified right to object to processing for prospecting purposes, and lets the CMIL judge a disputed reason's legitimacy, though the right does not apply where the processing meets a legal obligation or where the act authorizing the processing has expressly excluded it.

Article 23 gives every person the right to know whether they are concerned by a processing operation and, on proof of identity, to obtain the purposes, the categories of data processed, the recipients, the data itself in an intelligible form and its origin, and enough information to understand and contest automated logic behind a decision with legal effects, free of charge and without delay, and, for health data, directly or through a doctor the person designates; these access rights do not apply to processing concerning public security or the detection and prosecution of offenses, which article 26 governs instead.

Article 24 lets the controller refuse a manifestly abusive request, judged by its number or its repetitive or systematic character, with the burden of proving abuse on the controller who received it.

Article 25 gives a person the right to have inaccurate, incomplete, ambiguous, outdated, or unlawfully held, used, disclosed, or retained data rectified, completed, updated, blocked, or erased free of charge, and requires the controller to notify any third party the data were disclosed to of the changes made.

Article 26 substitutes an indirect procedure through a CMIL member drawn from the judiciary for the ordinary access and rectification rights where the processing concerns State security, defense, or public security.

Article 27 requires the controller to make sure the person data are collected from is told the controller's identity, the purpose of the processing, whether supplying the information is mandatory or optional, the data categories, the recipients, the rights of objection, access, and rectification and how to exercise them, and, where relevant, the transfers made and their article 20 safeguards, and requires equivalent clear notice, including the means to object, before storing or reading information on a user's terminal equipment for electronic communications, unless that access serves only to carry the communication or is strictly necessary for a service the user expressly requested; where data were not collected from the person, the same information is due when the data are recorded or, if disclosure to a third party is planned, by the first such disclosure at the latest.

Article 3's second sentence bars an administrative or private decision that assesses a person's conduct from resting solely on automated processing designed to profile the person or evaluate aspects of their personality. A first sentence in the same article separately bars any judicial decision from resting on that kind of processing at all; that sentence binds courts only and does not reach a private controller, so it is not part of this right.

Article 4 of Decree No. 2023-1541 makes the CMIL the independent administrative authority in charge of protecting personal data and monitoring its processing, with regulatory and sanctioning power. Article 6 empowers the CMIL to order controllers to give it any useful information on the computer files they use, and to carry out information and inspection missions on site or online.

Article 75 requires the mission order for an on-site inspection to state the identity of the CMIL members and agents authorized to inspect, the address of the premises and the object of the mission. Article 76 gives the controller eight days from receipt of the record of an inspection mission to send its observations to the CMIL.

Article 77 gives the controller thirty days from receipt of the CMIL's investigation report on a breach that may lead to administrative sanctions to send written and oral observations, after which the observations are inadmissible. Article 78 requires the CMIL's President to summon the controller to a session of the deliberative body at least fifteen days before it rules, by registered letter with acknowledgment of receipt or equivalent electronic means.

Article 79 requires a controller to carry out the CMIL's injunction within the period the CMIL sets and to prove it in writing when that period expires.

Article 4 subjects compliance with the law's principles to the oversight of an independent Authority named the Commission Malagasy de l'Informatique et des Libertés (CMIL). Article 28 creates that Commission, charges it with seeing that processing operations comply with the law, and gives it regulatory and sanctioning power.

Articles 29 to 42 set the Commission's structure and operation: its members are appointed by decree in the Council of Ministers for a four-year term renewable once, are bound to professional secrecy and take an oath before the Supreme Court, enjoy immunity for opinions and acts within their mandate, receive no instruction from any authority, publish an annual activity report to the President, the Prime Minister, Parliament, and the Minister of Justice, face incompatibilities with government membership or a conflicting management role, and must recuse themselves from a matter touching an organization they were tied to in the past thirty-six months.

The Commission informs people and controllers of their rights and obligations, receives processing declarations and gives the opinions or authorizations the law requires, controls how processing is created and carried out, publishes simplified norms and exemptions, makes recommendations, sets model rules for information-system security, and receives complaints, and its administrative decisions are open to appeal before the Conseil d'Etat.

Article 50 lets Commission members and agents on a control mission, authorized by a mission order the president signs, access professional premises between six in the morning and seven at night, access files, processing, and equipment without restriction, take copies of any information, and collect statements, subject to a written record given to the controller and, where the premises' occupant objects, the authorization of the competent tribunal's president.

Article 55 lets the Commission, after an adversarial procedure, sanction a controller who breaches one or more provisions of the law with a warning, an injunction to stop processing or withdrawal of an authorization granted, or a monetary sanction, and lets it order urgent interruption or the locking of data for up to three months where a rights violation is occurring, with every sanction recorded in a register and a repeat offense doubling a monetary sanction.

Article 59 caps a monetary sanction at five percent of the pre-tax turnover of the last closed financial year, proportioned to the seriousness of the breach and the advantage drawn from it. Article 60 lets the Commission publish its sanction decisions, anonymizing a natural person's identity where it chooses, at the sanctioned person's expense.

Articles 61 to 71 criminalize specific breaches of the law, each punished by six months' to five years' imprisonment together with a fine ranging from 200,000 to 10,000,000 Ariary depending on the offense; unlawfully collecting personal data by fraudulent or unfair means (art. 65) and disclosing data in a way that harms a person's reputation or privacy (art. 71) each carry two to five years' imprisonment and a fine of 1,000,000 to 10,000,000 Ariary.

Article 72 lets a court order the erasure of the data involved in the offense, which Commission members and agents are empowered to verify.

Article 59 of Decree No. 2023-1541 defines sensitive data as data revealing racial origin, biometric data, genetic data, political opinions, religious or other convictions, trade union membership and data on health or sex life. Article 59 prohibits all processing of sensitive data, because of the risk of discrimination and of harm to personal freedoms. Article 60 allows sensitive data to be processed only in a case that article 18 of Law No. 2014-038 provides.

Article 60 requires sensitive data to be adequate, relevant and limited to what the purposes of the processing require. Article 60 requires the security measures for processing sensitive data to be reinforced through pseudonymization or encryption.

Article 61 requires the controller to ask the CMIL beforehand for authorization to process sensitive data, stating the public interest pursued, the type of sensitive data and the person concerned, and bars starting the processing before the CMIL notifies its authorization.

Article 18 bars all processing of sensitive data because of the risk of discrimination and harm to a person's freedoms, and defines sensitive data to include racial origin, biometric data, genetic data, political opinions, religious or other convictions, trade union membership, and data concerning health or sex life.

It then lists the exceptions under which sensitive data may be processed with appropriate safeguards the law or the CMIL defines: the data subject's express consent unless the law bars lifting the prohibition that way, safeguarding the life of the data subject or a third party where the data subject cannot consent, processing by a nonprofit religious, philosophical, political, or trade union body limited to its own members or regular contacts, establishing, exercising, or defending a legal right, preventive medicine, medical diagnosis, care, or health-service management carried out by a health professional or another person bound by professional secrecy, public-interest health research the patient has not opposed, data the data subject has made public, and a public interest the law or the CMIL authorizes under article 46.

Article 19 restricts processing personal data relating to offenses, convictions, and safety measures to courts and public authorities managing a public service acting within their legal powers, and to legal auxiliaries for the strict needs of the missions the law assigns them.

Article 3 defines fraudulent access as intentionally accessing all or part of an information system without a legitimate excuse or justification, or beyond one. Article 4 defines fraudulent continued presence in the same terms, for remaining connected to or continuing to use a system.

Article 6 punishes fraudulent access or continued presence alone with a fine of 100,000 to 10,000,000 Ariary; where the access or continued presence damaged, erased, altered, or suppressed data, or impeded or altered the system's functioning, the penalty rises to six months' to five years' imprisonment together with the same fine range.

Article 3's definition of fraudulent access nowhere requires infringing a security measure or other technical protection, so its trigger, an intentional access without a legitimate excuse or justification, reads broader on its face than a standard limited to defeating one. The National Assembly adopted the law on 19 June 2014.

Article 41, the closing article, orders publication in the Journal Officiel and execution as a law of the State but names no day of the law's own entry into force, and no commencement notice has been located in the Journal Officiel.

Article 6 extends copyright protection to authors of anthologies or compilations of diverse works or expressions of folklore, and to databases under the terms of article 7, without prejudice to the rights of the authors of the original works included.

Article 7 defines a database as a compilation of data or other information, or of extracts of works, or of entire works, in electronic or other form, and confines protection to the selection and arrangement of the materials rather than to the underlying data or works themselves; where the compilation is of works, the compilation and the constituent works are protected independently, and where it is a compilation of information, only the compilation itself is protected.

This is a copyright-style protection of the compiler's selection and arrangement of materials, not a right created independently of any originality in that selection or arrangement.

Article 164 requires credit institutions to comply with the cybersecurity regulation in force. Article 164 has the Commission de Supervision Bancaire et Financière (CSBF) ensure that each credit institution defines a cybersecurity policy and strategy, sets up the means to prevent, manage and mitigate cyber-risks, delimits the cybersecurity roles of its board, general management and internal control body, and keeps a crisis management plan that its board and the CSBF approve.

Article 61 lets the CSBF impose pecuniary sanctions in addition to or instead of its disciplinary sanctions, with the amount set by decree of the Minister of Finance.

Article 51 requires an electronic money institution to guarantee the protection of data during its transmission or its storage. Article 51 requires the institution to ensure that a technical system or platform is in place that secures the protection, integrity, authenticity and confidentiality of the data and the security of transactions. Article 52 requires the institution to assign users a personal means of identification that lets them access the services provided in a secure way.

Article 92 requires an electronic money institution to warn the user of any major incident linked to disruptions of the service. Article 108 lets the CSBF, once an institution has not complied with an injunction, impose sanctions that run from a warning to the withdrawal of the licence.

Article 44 permits using analyses and short quotations lawfully published in another work, without the author's authorization and without payment, on condition of naming the source and the author.

Article 46(1) separately permits reproducing and distributing by press, or broadcasting or cable-communicating to the public, an economic, political, or religious article published in a newspaper or periodical, or a broadcast work of the same character, in cases where the right to reproduce or so communicate it has not been expressly reserved, again on condition of naming the source and the author where the author's name appears there.

Article 115, in the book on related (neighbouring) rights, separately exempts press reviews from the rights it grants to performers, phonogram producers, and broadcasting organisations. The article 46 reproduction exception can be defeated by the rightsholder's express reservation of the reproduction or communication right.