Mali

Article 1 has the Malian State assure every natural or legal, public or private person the protection of their personal data, without distinction of race, origin, colour, sex, age, language, religion, wealth, birth, opinion, nationality, or another such ground, and article 4 applies the Act to every processing of personal data carried out wholly or partly on national territory.

Article 5 subjects to the Act any processing by the State, territorial authorities, incorporated public bodies, and private natural or legal persons, any processing a controller carries out whether or not established on Malian territory, excluding only means used solely for transit, and processing concerning public security, national defence, or the investigation and prosecution of criminal offences, subject to this Act's own derogations or to specific provisions of other texts.

Article 6 excludes only two categories from the Act's scope: processing a natural person carries out in the exclusive context of personal or domestic activities, provided the data are not destined for systematic communication to third parties or dissemination, and temporary copies made for the technical activities of transmitting and providing access to a digital network.

Article 7 requires personal data to be collected and processed fairly, lawfully, and without fraud, for determined, explicit, and legitimate purposes, never used for other purposes, kept adequate, proportionate, and relevant to those purposes, accurate and updated where necessary, and kept in a form permitting identification of the persons concerned for no longer than those purposes require.

Article 8 requires the controller to take every precaution useful to preserve data security, including preventing deformation, damage, or unauthorized third-party access, requires a processor to offer sufficient guarantees of security and confidentiality, and states that this requirement does not relieve the controller of its own duty to see that those measures are respected.

Article 57 requires a controller to declare to the Autorité de Protection des Données à Caractère Personnel the processing operations it intends to carry out for a given purpose, and lets the Autorité impose an administrative sanction where that declaration was omitted in bad faith.

Article 11 lets a controller transfer personal data to a foreign State only where the Autorité de Protection des Données à Caractère Personnel has found that the destination State ensures a sufficient level of protection for persons, whether because of its own internal legislation or commitments made at the international level, and that those measures are actually applied, or where the Autorité has decided that the transfer and the recipient's processing of the data guarantee a sufficient level of protection for privacy and for persons' fundamental freedoms and rights, including because of contractual clauses or internal rules the recipient is subject to.

Article 2 bars any decision producing legal effects for a person from being based solely on an automated processing meant to profile them or evaluate aspects of their personality.

Article 12 gives every person the right to obtain from a controller, free of charge and without delay, communication in an understandable form of all data concerning them and any information available on its origin, together with the information and reasoning used in any automated processing whose results are used against them, and lets the Autorité order appropriate measures where data risk being concealed or made to disappear.

Article 13 gives a person who proves their identity the right to have inaccurate, incomplete, ambiguous, outdated, or unlawfully processed data rectified, completed, updated, blocked, or deleted, requires the controller to justify, free of charge and within thirty days of a written request, that it has done so, puts the burden of proof on the controller in case of dispute, and requires the controller to notify any third party the data were transmitted to of the corrections made.

Article 14 routes an access or rectification request to the Autorité, rather than to the controller directly, where the processing concerns State security, defence, or public security, and has the Autorité designate one of its members to investigate and secure the necessary corrections.

Articles 15 and 16 require a controller, whether or not the data are collected directly from the person concerned, to give that person, at collection or on transmission, the controller's identity, the purposes of the processing, the categories of data, the recipients or categories of recipients, whether answering is obligatory or optional and the consequences of not answering, the right to ask to no longer appear in the file, the rights of access and rectification, the retention period, and any transfer of the data abroad that is envisaged; article 17 exempts processing the State carries out for State security, national defence, public security, or the execution of criminal sentences, and processing necessary to prevent, investigate, establish, or prosecute an offence or to protect an important economic or financial interest of the State, to the extent the limitation is necessary.

Article 18 requires a controller to clearly and completely inform anyone using electronic communication networks of the purpose of any action to access or write information to their connection terminal equipment and of the means available to object to it, except where the access or writing is solely to enable the electronic communication or is strictly necessary to supply an online communication service the user expressly requested.

Article 19 gives every person the right to object, for legitimate reasons, to processing of data concerning them, the right to be informed before their data are first communicated to or used on behalf of third parties for prospecting purposes, and the right to be told, free of charge, of their right to object to that communication or use.

Article 20 creates the Autorité de Protection des Données à Caractère Personnel (APDP) as an independent administrative authority, and articles 21 through 52 set its fifteen-member composition, its bureau, its sessions, and the resources the State must give it.

Article 31 charges the Autorité with setting the norms and purposes for collecting, processing, or retaining personal data, authorizing interconnections and transfers, informing and advising data subjects and controllers of their rights and duties, receiving complaints, carrying out the checks necessary for lawful processing, imposing administrative sanctions for a controller's breach of its obligations, referring to the Procureur de la République without delay any offence involving fraudulent manipulation of personal data that comes to its knowledge, keeping the public register of processing operations, and advising on any bill or decree touching personal-data protection.

Article 34 lets the Autorité receive and investigate complaints and decide on information or on-site inspection missions, and article 37 bars anyone from opposing the Autorité's action and requires them to take every measure useful to facilitate its work. Article 56 lets the Autorité's President refer any user in breach of the Act to the Procureur de la République, or file a complaint before the competent courts, for the criminal sanctions the law in force provides.

Article 61 lists the administrative sanctions the Autorité may impose: a warning to a controller acting in good faith who failed to observe administrative formalities, a formal notice to a controller at fault to bring it into compliance, an order to cease processing activities, and withdrawal of a controller's approval where the Autorité finds it necessary; article 62 lets the Autorité use any technical means at its disposal to enforce its decision, article 63 requires an administrative sanction decision to be reasoned on pain of nullity and notified to the party concerned, and article 67 lets the Autorité settle any pecuniary sanction with the offender at the offender's request, within the scales the law fixes.

Article 60 leaves civil action to the conditions the Code de Procédure Civile, Commerciale et Sociale and the Régime Général des Obligations set. Article 64 states that, besides the pecuniary sanctions of articles 65 to 67, custodial criminal sanctions also apply to these offences, and article 58 refers the classification of offences and applicable penalties to the Penal Code.

Article 65 fines the most serious violations, including unauthorized disclosure of or access to personal data affecting fundamental rights, individual freedoms, or privacy, purpose diversion, fraudulent collection, unauthorized health-research processing, unlawfully retaining offence or conviction data, and obstructing the Autorité's investigations, five million to twenty million CFA francs, and article 66 fines security-safeguard failures and storing racial, ethnic, or political, philosophical, religious, or union opinion data without the person's prior consent two million five hundred thousand to ten million CFA francs.

Article 3(11) defines sensitive data as data relating to religious, philosophical, political, or union opinions or activities, sexual life or racial origin, health, social measures, prosecutions, or penal or administrative sanctions, and article 9 prohibits any processing of it outright, given the risks of discrimination and harm to persons' rights and freedoms.

Article 9 permits sensitive data to be processed by derogation only where the Autorité de Protection des Données à Caractère Personnel has defined appropriate safeguards for the processing, and only where the processing is necessary to safeguard the life of the data subject or a third party where the data subject cannot give consent because of a legal incapacity or a material impossibility, is carried out by a non-profit religious, philosophical, political, or union association or body solely to manage its own members, or is necessary to establish, exercise, or defend a right in court.

Article 10 confines any processing of personal data relating to offences and convictions to courts and public authorities managing a public service and acting within their legal powers, judicial auxiliaries acting for the strict needs of the duties the law assigns them, and other legal persons handling, for the strict needs of managing contentious matters, offences of which they were themselves the victim.

Article 4 punishes anyone who accesses or attempts to access, fraudulently, all or part of an information system, with imprisonment of two months to one year and a fine of 200,000 to 5,000,000 CFA francs, or either penalty, and raises the penalty to two months to two years' imprisonment and a fine of 1,000,000 to 10,000,000 CFA francs where the access results in deleting or altering data or impairing the system's operation.

Article 5 punishes fraudulently remaining or attempting to remain in all or part of an information system on the same terms.

Article 3 defines fraudulent access as any irregular mode of penetration of an automated data-processing system, a definition that does not itself require defeating a technical security measure, so whether it reaches a person who reads a public, unauthenticated page without circumventing any access control turns on how 'irregular' is construed rather than on a stated security-measure element.

Article 10 excludes official legislative, administrative, or judicial texts and their official translations, the news of the day, and mere facts and data from copyright protection outright: a bare fact, or the news of the day as such, is never a protected work under Malian law, whichever outlet reports it first.

Article 27(a) separately authorizes, once a work has already been lawfully made accessible to the public, analyses and short quotations conforming to fair practice and justified by a scientific, critical, educational, or informational purpose, including citations and borrowings of periodical-press articles in the form of press reviews, provided the borrowing is used in its original or translated form and is accompanied by the source and the author's name.

Because the press-review borrowing is introduced by 'y compris' (including) inside the same sentence as the general 'courtes citations' (short quotations) rule, it does not on its own text extend to a full or near-full reproduction of a news article the way a broader press-review carve-out would.

Article 9(b) separately protects a compilation such as a database as a copyright work where the selection, coordination, or arrangement of its contents constitutes an intellectual creation, without creating a distinct sui generis database right.