Senegal

Article 20 makes the purpose of a planned processing and the nature of the data collected decide which regime applies to it. Article 24 has the CDP issue a receipt once a declaration meets the Act, and the processing may then be carried out under the declarant's responsibility. Article 32 forbids any processing of personal data when the person's consent has not been obtained. Article 63 requires the controller to ensure the confidentiality, availability and accuracy of the data collected.

Article 64 lets a controller have data processed by a processor where the protection of the data is guaranteed, but the controller remains responsible for lawful use and communication of the data. Article 65 requires the controller to take security measures protecting systems and networks against accidental or unauthorized destruction of data, technical errors, and falsification, theft or unlawful use of data.

Article 66 requires personal data to be destroyed, erased, deleted or archived when the retention period set for a processing ends. The decree was signed at Dakar on 30 June 2008. The decree was published in Journal officiel n° 6443 of 20 December 2008, according to the ILO NATLEX record. Article 76 charges the Prime Minister and the ministers with applying the decree, which is to be published in the Journal officiel.

Article 2 subjects to the Act any collection, processing, transmission, storage or use of personal data by a natural person, the State, local authorities, or a public or private legal person, and article 3 exempts only a person's exclusive personal or domestic processing and transient technical transmission copies.

Article 33 makes a data subject's consent the general basis for lawful processing, with derogations for a legal obligation, a public interest or official mission, performance of a contract, or safeguarding the data subject's vital interests. Articles 34 through 37 require collection and processing to be lawful, fair and non fraudulent, limited to determined and legitimate purposes, kept accurate and updated, and carried out under a duty of transparency toward the data subject.

Article 38 requires processing to be confidential and secured under article 71, and article 39 requires a controller using a sub processor to choose one offering sufficient guarantees and to bind it by a written contract limited to the controller's own instructions.

Outside the exemptions article 17 lists, article 18 requires a controller to declare its processing to the CDP and wait for the CDP's certificate of receipt before implementing it, and articles 22 through 24 set what a declaration or authorization request must state and the two month period the CDP has to decide it.

Article 20 requires the CDP's prior authorization before processing genetic data or health related research data, data on criminal offences or convictions, an interconnection of files, a national identification number or other general purpose identifier, biometric data, or a public interest historical, statistical or scientific treatment, and articles 53 through 57 set the interconnection authorization procedure.

Article 45 admits processing for journalism, research or artistic or literary expression carried out under the professional rules of those activities, and article 46 leaves the press laws and the Penal Code's own right of reply and privacy protections in place.

Article 71 requires precautions appropriate to the nature of the data, article 72 bars keeping data longer than its purpose needs except for historical, statistical or scientific treatment, article 73 restricts an electronic certification provider to collecting data directly from the person concerned and using it only to issue and keep the certificate, and article 74 requires a controller to keep data usable whatever technical medium stores it. Loi n° 2008-12 was promulgated on 25 January 2008.

It was published in Journal officiel n° 6406 of 3 May 2008. The law's final articles state no day of its own for its entry into force.

Under article 2 of Loi n° 70-14 du 6 février 1970, a promulgated law that does not postpone its entry into force becomes executory on the third day after the Journal officiel issue carrying it is deposited at the General Secretariat in the Cap-Vert region and the communes of Diourbel, Kaolack, Saint-Louis and Thiès, and on the fifth day in the rest of the territory. Article 17 of Loi n° 2021-21 du 2 mars 2021 abrogates Loi n° 70-14, as modified by Loi n° 71-07 du 21 janvier 1971. No official record of the day on which the law became executory has been located.

Article 42 requires the controller to refer a transfer to the CDP before the first transfer of data to a third country. Article 42 requires the declaration to state the names and addresses of the sender and the recipient, the name and full description of the file, the categories of data, the people concerned and their approximate number, the recipient's purpose, the mode and frequency of the transfers, and the date of the first transfer.

Article 42 requires any change to the declared information to be declared to the CDP within fifteen working days. Article 43 allows one joint declaration for a transfer within a group of undertakings, or to several recipients for the same categories of data and the same purposes. Article 44 has the CDP draw up and make available a list of States whose personal data legislation is equivalent, and states that publishing the list does not relieve the controller of any responsibility.

The decree was signed at Dakar on 30 June 2008. The decree was published in Journal officiel n° 6443 of 20 December 2008, according to the ILO NATLEX record. Article 76 charges the Prime Minister and the ministers with applying the decree, which is to be published in the Journal officiel.

Article 49 bars transferring personal data to a country that does not ensure a sufficient level of protection for privacy and fundamental rights and freedoms, and requires the controller to notify the CDP before any transfer to a third country.

Article 49 also requires the CDP, before any processing of data coming from abroad, to verify that the controller ensures a sufficient level of protection, judged by the security measures applied, the processing's characteristics, and the nature, origin and destination of the data.

Article 50 lets a controller transfer data to a country that does not meet that standard where the transfer is a one off, non massive transfer made with the person's express consent, or is necessary to protect the person's life, the public interest, a legal claim, or a contract.

Article 51 lets the CDP authorize a transfer or set of transfers to an inadequate country on a duly motivated request where the controller offers sufficient guarantees for privacy, fundamental rights and freedoms, and the exercise of the corresponding rights. Loi n° 2008-12 was promulgated on 25 January 2008. It was published in Journal officiel n° 6406 of 3 May 2008. The law's final articles state no day of its own for its entry into force.

Under article 2 of Loi n° 70-14 du 6 février 1970, a promulgated law that does not postpone its entry into force becomes executory on the third day after the Journal officiel issue carrying it is deposited at the General Secretariat in the Cap-Vert region and the communes of Diourbel, Kaolack, Saint-Louis and Thiès, and on the fifth day in the rest of the territory. Article 17 of Loi n° 2021-21 du 2 mars 2021 abrogates Loi n° 70-14, as modified by Loi n° 71-07 du 21 janvier 1971. No official record of the day on which the law became executory has been located.

Article 46 requires a questionnaire used to collect data to state the identity of the controller or its representative, the purpose, whether answers are mandatory or optional, and the rights of access, objection, rectification and deletion.

Article 48 lets any person obtain information on the data held about them by a signed and dated written access request addressed to the controller, its representative in Senegal or its agents, or to the processor, which passes it to one of them where applicable. Article 50 requires the controller's response to an access request to be in writing.

Article 54 grants consultation of the data of a deceased person where the requester shows an interest and no overriding interest of relatives or third parties opposes it. Article 57 gives the CDP four months from notification to rule on any request for access to information.

Articles 58 to 60 require the controller to ask the person whether they wish to exercise the right to object, when collecting data in writing, when collecting it otherwise than in writing, and when the data were not obtained from the person. Article 61 lets a person object without any justification where the data are to be used by the controller for prospecting, notably commercial prospecting.

Article 62 requires the controller or the CDP to inform a person in writing of the steps taken on their request to rectify or delete data. The decree was signed at Dakar on 30 June 2008. The decree was published in Journal officiel n° 6443 of 20 December 2008, according to the ILO NATLEX record. Article 76 charges the Prime Minister and the ministers with applying the decree, which is to be published in the Journal officiel.

Article 58 requires a controller collecting data directly from the person to tell them, at the latest when collecting it, who is responsible for the processing, its purpose, the categories of data, the recipients, whether a reply is mandatory or optional and the consequences of not replying, their right to be removed from the file, their access and rectification rights, the retention period, and any transfer abroad.

Article 59 requires that same information to be given, when data is not collected from the person, at the time it is recorded or, if disclosure is planned, no later than the first disclosure, while article 60 exempts data used for state security, defence, public security, criminal enforcement, or an important economic or financial interest of the State.

Article 61 requires a controller accessing or writing information on a user's terminal equipment by electronic transmission to tell the user its purpose and how to object, unless the access only enables the communication or is strictly necessary for a service the user expressly requested.

Articles 62 and 63 give a person a written right to access their data, its origin and purpose, and a copy on payment of no more than the reproduction cost, and article 64 lets them refer a suspected mismatch between the data disclosed and the data actually processed to the CDP for verification.

Article 65 lets a patient's access right be exercised through a physician they designate, article 66 lets a controller resist manifestly abusive requests while carrying the burden of proving abuse, and article 67 routes access to a state security, defence or public security processing through a CDP member who investigates and decides what can be disclosed.

Article 68 gives a person the right to object, for legitimate reasons, to processing of their data, to be told before their data is first disclosed to or used by a third party for prospecting, and to object to that disclosure or use free of charge, and article 47 separately bars sending a person direct marketing communications by any means before they have expressed prior consent to receive them.

Article 69 lets a person demand that inaccurate, incomplete, ambiguous, outdated, or unlawfully processed data about them be corrected, completed, updated, blocked, or deleted, requires the controller to prove compliance within one month at no cost, and requires the controller to notify any third party the data was disclosed to. Loi n° 2008-12 was promulgated on 25 January 2008. It was published in Journal officiel n° 6406 of 3 May 2008.

The law's final articles state no day of its own for its entry into force. Under article 2 of Loi n° 70-14 du 6 février 1970, a promulgated law that does not postpone its entry into force becomes executory on the third day after the Journal officiel issue carrying it is deposited at the General Secretariat in the Cap-Vert region and the communes of Diourbel, Kaolack, Saint-Louis and Thiès, and on the fifth day in the rest of the territory.

Article 17 of Loi n° 2021-21 du 2 mars 2021 abrogates Loi n° 70-14, as modified by Loi n° 71-07 du 21 janvier 1971. No official record of the day on which the law became executory has been located.

Article 48's second sentence bars any decision that produces legal effects for a person from resting solely on automated processing of personal data designed to profile the person or evaluate aspects of their personality, and its third sentence excludes from that bar a decision taken in connection with a contract where the person had the chance to make observations, and a decision that simply grants the person's own request.

A first sentence in the same article separately and unconditionally bars a judicial decision from resting on that kind of processing at all; that sentence binds courts only and is not part of this right. Loi n° 2008-12 was promulgated on 25 January 2008. It was published in Journal officiel n° 6406 of 3 May 2008. The law's final articles state no day of its own for its entry into force.

Under article 2 of Loi n° 70-14 du 6 février 1970, a promulgated law that does not postpone its entry into force becomes executory on the third day after the Journal officiel issue carrying it is deposited at the General Secretariat in the Cap-Vert region and the communes of Diourbel, Kaolack, Saint-Louis and Thiès, and on the fifth day in the rest of the territory. Article 17 of Loi n° 2021-21 du 2 mars 2021 abrogates Loi n° 70-14, as modified by Loi n° 71-07 du 21 janvier 1971. No official record of the day on which the law became executory has been located.

Article 11 opens the register of personal data processing to the public, except for information concerning State security, defence or public safety. Article 13 requires every inspection, on site or on summons, to be decided by a CDP decision naming the controller, the rapporteur and other inspectors, and the object and duration of the operation. Article 15 requires the competent public prosecutor to be informed of an inspection at the latest twenty-four hours before an on-site inspection.

Article 16 requires a procès-verbal, an official record, of every inspection, stating its nature, day, hour and place. Article 67 requires the formal notice to state the breaches found and to set the period within which the controller must have ended them. Article 68 lets the CDP impose a pecuniary sanction on any controller that has not met its obligations, except where the processing is carried out by the State or by a private-law legal person managing a public service.

Article 74 requires a controller facing any sanction other than a warning to be told the date of the CDP session and its right to be heard, with a summons reaching it at least fifteen days beforehand, or eight days in an emergency. Article 75 requires every sanction decision to state its legal and factual grounds and the means and time limits of appeal, and requires publication of the decision in the Journal officiel within one month of the day the sanction becomes final.

The decree was signed at Dakar on 30 June 2008. The decree was published in Journal officiel n° 6443 of 20 December 2008, according to the ILO NATLEX record. Article 76 charges the Prime Minister and the ministers with applying the decree, which is to be published in the Journal officiel.

Article 5 creates the Commission de Protection des Données à Caractère Personnel, the CDP, as an independent administrative authority charged with ensuring processing complies with the Act, informing data subjects and controllers of their rights and duties, and checking that information and communication technologies do not threaten public freedoms or privacy.

Article 6 sets its eleven members, drawn from the Presidency, the National Assembly, the Senate, employer organizations, the Conseil d'Etat, the Cour de Cassation, the bar, human rights organizations, and the head of the State computing agency, appointed by decree, with a government commissioner who attends without voting.

Article 8 gives members a four year, once renewable term, bars removal except by resignation or an impediment the CDP itself finds, and binds them to professional secrecy, while article 12 gives them full immunity for opinions expressed in office and bars any authority from instructing them.

Article 16 lists the CDP's missions, including receiving declarations, complaints and petitions, referring offences to the public prosecutor without delay, ordering verifications, sanctioning a controller under articles 29 through 32, answering opinion requests, approving codes of conduct, keeping a public register of processing, advising controllers, authorizing cross border transfers, proposing legislative improvements, cooperating internationally, publishing its authorizations, and reporting annually to the President of the Republic and the President of the National Assembly.

Articles 25 through 27 let CDP members and sworn agents inspect premises used for processing, subject to a regional court's authorization if the occupant objects, and demand and copy any document useful to their mission, and article 28 requires an adversarial record of every inspection.

Article 29 lets the CDP warn a controller and give formal notice to end a breach within a set period, and article 30 lets it, after a contradictory procedure, provisionally or definitively withdraw an authorization and impose a pecuniary fine of one million to one hundred million CFA francs where the controller does not comply.

Article 31 lets the CDP, in an emergency threatening rights and freedoms, order the interruption of a processing operation, the locking of data, or a temporary or definitive ban on a processing that violates the Act, each after a contradictory procedure, and article 32 lets any CDP sanction or decision be appealed to the Conseil d'Etat. Article 75 refers violations of the Act to the Penal Code and the cybercrime law rather than setting its own criminal penalties.

Loi n° 2008-12 was promulgated on 25 January 2008. It was published in Journal officiel n° 6406 of 3 May 2008. The law's final articles state no day of its own for its entry into force.

Under article 2 of Loi n° 70-14 du 6 février 1970, a promulgated law that does not postpone its entry into force becomes executory on the third day after the Journal officiel issue carrying it is deposited at the General Secretariat in the Cap-Vert region and the communes of Diourbel, Kaolack, Saint-Louis and Thiès, and on the fifth day in the rest of the territory. Article 17 of Loi n° 2021-21 du 2 mars 2021 abrogates Loi n° 70-14, as modified by Loi n° 71-07 du 21 janvier 1971. No official record of the day on which the law became executory has been located.

Article 33 sets out what a request for an opinion or authorization to process genetic data or medical research data must contain, including the identity and qualifications of the controller and the research lead, the research protocol, and any earlier scientific or ethical opinions.

Article 36 requires people received in establishments or centers for prevention, diagnosis and care, whose data are transmitted for processing for medical research, to be informed by handing them a document or by another appropriate means. Article 37 requires data to be made anonymous or coded before the controller communicates them to a third party for later historical, statistical or scientific processing.

Article 38 bars making the results of historical, statistical or scientific processing public in a form that identifies the person, unless the person expressly consented or the data published are limited to data the person manifestly made public. Article 40 disapplies Articles 37 and 38 for processing concerning public security, defence, the investigation and prosecution of criminal offences, or State security. The decree was signed at Dakar on 30 June 2008.

The decree was published in Journal officiel n° 6443 of 20 December 2008, according to the ILO NATLEX record. Article 76 charges the Prime Minister and the ministers with applying the decree, which is to be published in the Journal officiel.

Article 40 prohibits collecting or processing data revealing racial, ethnic or regional origin, filiation, political opinion, religious or philosophical belief, trade union membership, sexual life, genetic data, or health, and article 41 lifts that prohibition only where the person has made the data public, given written consent, needs the processing to protect a vital interest they cannot otherwise consent to, needs it for a legal claim, an open judicial or criminal proceeding, a public interest historical, statistical or scientific motive, a contract, a legal obligation, a public mission, or the internal activity of a nonprofit body with a political, philosophical, religious or trade union purpose.

Article 42 restricts processing data on offences, criminal convictions or security measures to courts, public authorities and public service bodies acting within their legal remit, and to legal auxiliaries strictly for the missions the law assigns them.

Article 43 makes processing health data lawful only on one of eight listed grounds, including the person's consent, data they have made public, protecting vital interests, a legal purpose, public health promotion including screening, preventing a real danger or a specific offence, a legal claim, or preventive medicine and care under a health professional bound by professional secrecy.

Article 44 requires health data to be collected from the person themselves unless collecting it elsewhere is necessary for the processing or the person cannot supply it themselves. Article 20 also requires the CDP's prior authorization before processing genetic data or health related research data, data on offences, convictions or security measures, or biometric data, so these categories carry a registration burden on top of article 40's prohibition and article 42's restriction.

Loi n° 2008-12 was promulgated on 25 January 2008. It was published in Journal officiel n° 6406 of 3 May 2008. The law's final articles state no day of its own for its entry into force.

Under article 2 of Loi n° 70-14 du 6 février 1970, a promulgated law that does not postpone its entry into force becomes executory on the third day after the Journal officiel issue carrying it is deposited at the General Secretariat in the Cap-Vert region and the communes of Diourbel, Kaolack, Saint-Louis and Thiès, and on the fifth day in the rest of the territory. Article 17 of Loi n° 2021-21 du 2 mars 2021 abrogates Loi n° 70-14, as modified by Loi n° 71-07 du 21 janvier 1971. No official record of the day on which the law became executory has been located.

Article 431-11 punishes, by one to five years' imprisonment and/or a fine of 5,000,000 to 10,000,000 CFA francs, fraudulently inputting or attempting to input data into a computer system. Article 431-12 punishes, by one to five years' imprisonment and/or a fine of 5,000,000 to 10,000,000 CFA francs, fraudulently intercepting or attempting to intercept, by technical means, non-public transmissions of computerized data to, from or within a computer system.

Article 431-13 punishes, by one to five years' imprisonment and/or a fine of 5,000,000 to 10,000,000 CFA francs, fraudulently damaging, deleting, tampering with, altering or modifying computerized data, or attempting to do so.

Article 431-8 punishes anyone who fraudulently accesses or attempts to access all or part of a computer system, and anyone who fraudulently obtains an advantage for himself or another by accessing one, with a prison term of six months to three years and/or a fine of 1,000,000 to 10,000,000 CFA francs; article 431-9 punishes fraudulently maintaining a presence in a system with the same penalty.

Unlike a neighbouring statute that limits the offense to access gained by infringing a security measure, article 431-8's English text carries no such express trigger, so whether reading a public, unauthenticated page without defeating any access control satisfies 'fraudulently accesses' has not been settled by a reported Senegalese decision.

Article 431-10 separately punishes obstructing or distorting a computer system's operation, with a prison term of one to five years and a fine of 5,000,000 to 10,000,000 CFA francs. Article 431-12 punishes fraudulently intercepting non-public data transmissions with the same range of penalties. Loi n° 2008-11 was promulgated on 25 January 2008. It was published in Journal officiel n° 6406 of 3 May 2008. The law's final articles state no day of its own for its entry into force.

Under article 2 of Loi n° 70-14 du 6 février 1970, a promulgated law that does not postpone its entry into force becomes executory on the third day after the Journal officiel issue carrying it is deposited at the General Secretariat in the Cap-Vert region and the communes of Diourbel, Kaolack, Saint-Louis and Thiès, and on the fifth day in the rest of the territory. Article 17 of Loi n° 2021-21 du 2 mars 2021 abrogates Loi n° 70-14, as modified by Loi n° 71-07 du 21 janvier 1971. No official record of the day on which the law became executory has been located.

Article 16 of the Code requires operators to take all appropriate measures to ensure the integrity of their networks and to guarantee the continuity of the services provided. Article 16 requires operators to take the technical and organisational measures necessary to ensure the security of their network and services at a level adapted to the existing risk. Operators must comply with the technical security prescriptions the government authority may issue.

Where there is a particular risk of breach of the security of their networks, operators must inform subscribers of that risk, of any means of remedying it and of its cost. The Code defines an operator as any legal person operating an electronic communications network open to the public or providing an electronic communications service to the public. The Autorité de Régulation des Télécommunications et des Postes may sanction the failings it finds in respect of the Code's provisions.

The Autorité de Régulation may pronounce pecuniary sanctions against defaulting operators and providers of services. A penalty may not exceed three percent of the turnover achieved in Senegal in the preceding financial year, and may be doubled on a repeat breach in the same year. The National Assembly adopted the Code on 28 November 2018.

Article 16 of the Code requires an operator, as soon as it becomes aware of it, to inform the Minister of the Interior of any breach of security or loss of integrity having a significant impact on the operation of its networks or services. Where the breach of security or loss of integrity results or may result from a computer attack, the operator must also inform the authority competent for the defence of information systems.

Once the operator has analysed the causes and consequences of the breach or loss, it must report to the government authority, and to the defence authority where that authority was informed, on the measures taken to avoid a recurrence. Where it is in the public interest to disclose the facts, the Minister of the Interior may inform the public or ask the operator concerned to do so.

The Autorité de Régulation des Télécommunications et des Postes may sanction the failings it finds in respect of the Code's provisions. A penalty may not exceed three percent of the turnover achieved in Senegal in the preceding financial year, and may be doubled on a repeat breach in the same year.

Article 44 lets any person make analyses of and short quotations from a work already lawfully disclosed, without the author's consent, provided the author's name and the work's title are mentioned and the quotation is compatible with fair practice.

Article 45(1) separately lets any person reproduce or communicate, for information purposes and without the author's consent, articles on current political, social or economic topics and speeches made at political, judicial, administrative or religious gatherings or public meetings, provided the author's name and the source are mentioned. Article 45(2) extends the same information-purpose freedom to reproducing or communicating a work seen or heard while reporting a current event.

Neither branch of article 45 states a short-extract or headline-only limit the way article 44 does for quotations, and none of the sources located records a reported Senegalese decision testing whether a systematic aggregator's reproduction of headlines and snippets, as distinct from a traditional press review or a single current-events report, falls within either exception.

Senegal has no separate press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, no recognized hot-news or misappropriation doctrine distinct from ordinary copyright and unfair-competition law, and no located case law on hyperlinking or framed display.

Article 8(3) protects a database as a copyright work only where its selection or arrangement of contents is itself an original creation, and Senegal has no sui generis database right and no text-and-data-mining exception or machine-readable opt-out mechanism. Loi n° 2008-09 was promulgated on 25 January 2008. It was published in Journal officiel n° 6407 of 10 May 2008. The law's final articles state no day of its own for its entry into force.

Under article 2 of Loi n° 70-14 du 6 février 1970, a promulgated law that does not postpone its entry into force becomes executory on the third day after the Journal officiel issue carrying it is deposited at the General Secretariat in the Cap-Vert region and the communes of Diourbel, Kaolack, Saint-Louis and Thiès, and on the fifth day in the rest of the territory. Article 17 of Loi n° 2021-21 du 2 mars 2021 abrogates Loi n° 70-14, as modified by Loi n° 71-07 du 21 janvier 1971. No official record of the day on which the law became executory has been located.