Senegal

Article 2 subjects to the Act any collection, processing, transmission, storage or use of personal data by a natural person, the State, local authorities, or a public or private legal person, and article 3 exempts only a person's exclusive personal or domestic processing and transient technical transmission copies.

Article 33 makes a data subject's consent the general basis for lawful processing, with derogations for a legal obligation, a public interest or official mission, performance of a contract, or safeguarding the data subject's vital interests. Articles 34 through 37 require collection and processing to be lawful, fair and non fraudulent, limited to determined and legitimate purposes, kept accurate and updated, and carried out under a duty of transparency toward the data subject.

Article 38 requires processing to be confidential and secured under article 71, and article 39 requires a controller using a sub processor to choose one offering sufficient guarantees and to bind it by a written contract limited to the controller's own instructions.

Outside the exemptions article 17 lists, article 18 requires a controller to declare its processing to the CDP and wait for the CDP's certificate of receipt before implementing it, and articles 22 through 24 set what a declaration or authorization request must state and the two month period the CDP has to decide it.

Article 20 requires the CDP's prior authorization before processing genetic data or health related research data, data on criminal offences or convictions, an interconnection of files, a national identification number or other general purpose identifier, biometric data, or a public interest historical, statistical or scientific treatment, and articles 53 through 57 set the interconnection authorization procedure.

Article 45 admits processing for journalism, research or artistic or literary expression carried out under the professional rules of those activities, and article 46 leaves the press laws and the Penal Code's own right of reply and privacy protections in place.

Article 71 requires precautions appropriate to the nature of the data, article 72 bars keeping data longer than its purpose needs except for historical, statistical or scientific treatment, article 73 restricts an electronic certification provider to collecting data directly from the person concerned and using it only to issue and keep the certificate, and article 74 requires a controller to keep data usable whatever technical medium stores it.

Article 49 bars transferring personal data to a country that does not ensure a sufficient level of protection for privacy and fundamental rights and freedoms, and requires the controller to notify the CDP before any such transfer.

Article 49 also requires the CDP, before any processing of data coming from abroad, to verify that the controller ensures a sufficient level of protection, judged by the security measures applied, the processing's characteristics, and the nature, origin and destination of the data.

Article 50 lets a controller transfer data to a country that does not meet that standard where the transfer is a one off, non massive transfer made with the person's express consent, or is necessary to protect the person's life, the public interest, a legal claim, or a contract.

Article 51 lets the CDP authorize a transfer or set of transfers to an inadequate country on a duly motivated request where the controller offers sufficient guarantees for privacy, fundamental rights and freedoms, and the exercise of the corresponding rights.

Article 58 requires a controller collecting data directly from the person to tell them, at the latest when collecting it, who is responsible for the processing, its purpose, the categories of data, the recipients, whether a reply is mandatory or optional and the consequences of not replying, their right to be removed from the file, their access and rectification rights, the retention period, and any transfer abroad.

Article 59 requires that same information to be given, when data is not collected from the person, at the time it is recorded or, if disclosure is planned, no later than the first disclosure, while article 60 exempts data used for state security, defence, public security, criminal enforcement, or an important economic or financial interest of the State.

Article 61 requires a controller accessing or writing information on a user's terminal equipment by electronic transmission to tell the user its purpose and how to object, unless the access only enables the communication or is strictly necessary for a service the user expressly requested.

Articles 62 and 63 give a person a written right to access their data, its origin and purpose, and a copy on payment of no more than the reproduction cost, and article 64 lets them refer a suspected mismatch between the data disclosed and the data actually processed to the CDP for verification.

Article 65 lets a patient's access right be exercised through a physician they designate, article 66 lets a controller resist manifestly abusive requests while carrying the burden of proving abuse, and article 67 routes access to a state security, defence or public security processing through a CDP member who investigates and decides what can be disclosed.

Article 68 gives a person the right to object, for legitimate reasons, to processing of their data, to be told before their data is first disclosed to or used by a third party for prospecting, and to object to that disclosure or use free of charge, and article 47 separately bars sending a person direct marketing communications by any means before they have expressed prior consent to receive them.

Article 69 lets a person demand that inaccurate, incomplete, ambiguous, outdated, or unlawfully processed data about them be corrected, completed, updated, blocked, or deleted, requires the controller to prove compliance within one month at no cost, and requires the controller to notify any third party the data was disclosed to.

Article 48 bars a judicial decision assessing a person's conduct from resting on automated processing that evaluates aspects of their personality, and bars any decision producing legal effects from resting solely on automated profiling, except a contractual decision where the person could make observations or a decision granting their own request.

Article 5 creates the Commission de Protection des Données à Caractère Personnel, the CDP, as an independent administrative authority charged with ensuring processing complies with the Act, informing data subjects and controllers of their rights and duties, and checking that information and communication technologies do not threaten public freedoms or privacy.

Article 6 sets its eleven members, drawn from the Presidency, the National Assembly, the Senate, employer organizations, the Conseil d'Etat, the Cour de Cassation, the bar, human rights organizations, and the head of the State computing agency, appointed by decree, with a government commissioner who attends without voting.

Article 8 gives members a four year, once renewable term, bars removal except by resignation or an impediment the CDP itself finds, and binds them to professional secrecy, while article 12 gives them full immunity for opinions expressed in office and bars any authority from instructing them.

Article 16 lists the CDP's missions, including receiving declarations, complaints and petitions, referring offences to the public prosecutor without delay, ordering verifications, sanctioning a controller under articles 29 through 32, answering opinion requests, approving codes of conduct, keeping a public register of processing, advising controllers, authorizing cross border transfers, proposing legislative improvements, cooperating internationally, publishing its authorizations, and reporting annually to the President of the Republic and the President of the National Assembly.

Articles 25 through 27 let CDP members and sworn agents inspect premises used for processing, subject to a regional court's authorization if the occupant objects, and demand and copy any document useful to their mission, and article 28 requires an adversarial record of every inspection.

Article 29 lets the CDP warn a controller and give formal notice to end a breach within a set period, and article 30 lets it, after a contradictory procedure, provisionally or definitively withdraw an authorization and impose a pecuniary fine of one million to one hundred million CFA francs where the controller does not comply.

Article 31 lets the CDP, in an emergency threatening rights and freedoms, order the interruption of a processing operation, the locking of data, or a temporary or definitive ban on a processing that violates the Act, each after a contradictory procedure, and article 32 lets any CDP sanction or decision be appealed to the Conseil d'Etat. Article 75 refers violations of the Act to the Penal Code and the cybercrime law rather than setting its own criminal penalties.

Article 40 prohibits collecting or processing data revealing racial, ethnic or regional origin, filiation, political opinion, religious or philosophical belief, trade union membership, sexual life, genetic data, or health, and article 41 lifts that prohibition only where the person has made the data public, given written consent, needs the processing to protect a vital interest they cannot otherwise consent to, needs it for a legal claim, an open judicial or criminal proceeding, a public interest historical, statistical or scientific motive, a contract, a legal obligation, a public mission, or the internal activity of a nonprofit body with a political, philosophical, religious or trade union purpose.

Article 42 restricts processing data on offences, criminal convictions or security measures to courts, public authorities and public service bodies acting within their legal remit, and to legal auxiliaries strictly for the missions the law assigns them.

Article 43 makes processing health data lawful only on one of eight listed grounds, including the person's consent, data they have made public, protecting vital interests, a legal purpose, public health promotion including screening, preventing a real danger or a specific offence, a legal claim, or preventive medicine and care under a health professional bound by professional secrecy.

Article 44 requires health data to be collected from the person themselves unless collecting it elsewhere is necessary for the processing or the person cannot supply it themselves. Article 20 also requires the CDP's prior authorization before processing genetic data or health related research data, data on offences, convictions or security measures, or biometric data, so these categories carry a registration burden on top of article 40's prohibition and article 42's restriction.

Article 431-8 punishes anyone who fraudulently accesses or attempts to access all or part of a computer system, and anyone who fraudulently obtains an advantage for himself or another by accessing one, with a prison term of six months to three years and/or a fine of 1,000,000 to 10,000,000 CFA francs; article 431-9 punishes fraudulently maintaining a presence in a system with the same penalty.

Unlike a neighbouring statute that limits the offense to access gained by infringing a security measure, article 431-8's English text carries no such express trigger, so whether reading a public, unauthenticated page without defeating any access control satisfies 'fraudulently accesses' has not been settled by a reported Senegalese decision.

Article 431-10 separately punishes obstructing or distorting a computer system's operation, with a prison term of one to five years and a fine of 5,000,000 to 10,000,000 CFA francs. Article 431-12 punishes fraudulently intercepting non-public data transmissions with the same range of penalties.

Article 44 lets any person make analyses of and short quotations from a work already lawfully disclosed, without the author's consent, provided the author's name and the work's title are mentioned and the quotation is compatible with fair practice.

Article 45(1) separately lets any person reproduce or communicate, for information purposes and without the author's consent, articles on current political, social or economic topics and speeches made at political, judicial, administrative or religious gatherings or public meetings, provided the author's name and the source are mentioned. Article 45(2) extends the same information-purpose freedom to reproducing or communicating a work seen or heard while reporting a current event.

Neither branch of article 45 states a short-extract or headline-only limit the way article 44 does for quotations, and none of the sources located records a reported Senegalese decision testing whether a systematic aggregator's reproduction of headlines and snippets, as distinct from a traditional press review or a single current-events report, falls within either exception.

Senegal has no separate press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, no recognized hot-news or misappropriation doctrine distinct from ordinary copyright and unfair-competition law, and no located case law on hyperlinking or framed display.

Article 8(3) protects a database as a copyright work only where its selection or arrangement of contents is itself an original creation, and Senegal has no sui generis database right and no text-and-data-mining exception or machine-readable opt-out mechanism.