Sao Tome and Principe

Article 3 applies the Law to processing personal data by automated means, wholly or partly, and to non-automated processing of data held in or intended for a manual file, reaching a controller established in Sao Tome and Principe, one whose activities are carried out there, one whose processing falls under São Toméan law by public or private international law, or one using means located in the country, in which case it must designate a representative there and notify NAPPD of that designation; it also reaches video surveillance and other capture of sound or image that identifies a person, and it exempts only a private individual's exclusively personal or domestic activity that is not meant for systematic communication or diffusion.

Article 5 requires personal data to be treated lawfully and in good faith, collected for specified, explicit and legitimate purposes tied to the controller's activity, kept adequate, relevant, not excessive, accurate and updated, and preserved in identifiable form no longer than those purposes need.

Article 6 permits processing only with the holder's unequivocal authorization or on one of the Law's specific grounds: contract performance, a legal obligation, the holder's vital interests, a public-interest mission, or the controller's own legitimate interest weighed against the holder's rights.

Article 9 subjects interconnecting personal data to NAPPD's authorization unless a legal or organic provision already authorizes it, and requires it to serve a legitimate purpose, avoid a discriminatory effect, and carry appropriate security measures.

Article 15 requires appropriate technical and organizational measures against accidental or unlawful destruction, loss, unauthorized alteration, disclosure or access, a subcontractor chosen for sufficient guarantees and bound by contract to the controller's instructions and the same measures, and that contract recorded in a document with legally recognized probative value; Article 17 bars a subcontractor or anyone else with access to personal data from processing it beyond the controller's instructions except under a legal obligation, and Article 18 binds anyone who learns personal data in the course of their duties to professional secrecy, including after those duties end.

Article 21 requires the controller or its representative to notify NAPPD in writing at least eight days before starting a wholly or partly automated processing operation, and Article 22 requires NAPPD's prior authorization before processing credit or solvency data, interconnecting personal-data files, or using collected data for a purpose other than the one it was collected for.

Articles 23 and 24 fix what a notification or authorization request, and any NAPPD record of it, must state, including the controller's identity, the processing's purposes, the categories of data and recipients, the retention period, how a holder can access or correct their data, any planned interconnection or transfer abroad, and a description of the security measures applied.

Article 25 registers non-exempt processing with NAPPD for public consultation and requires a controller exempt from notification to give any person who asks, at minimum, its identity, the processing's purposes, and the holder's rights of access and rectification. Article 47 defers the Law's own entry into force to general law without stating a day.

Article 19 permits transferring personal data outside Sao Tome and Principe only under this Law and only where the destination legal order ensures an adequate level of protection, assessed against the nature of the data, the purpose and duration of the processing, the countries of origin and destination, and the rules of law, professional rules and security measures in force there, with NAPPD alone deciding whether a legal order meets that standard.

Article 20 lets a transfer to a legal order without adequate protection proceed, on notice to NAPPD, where the holder has unequivocally authorized it or under a listed derogation: contract necessity involving the holder, an important public interest or a judicial right to declare, exercise or defend, the holder's vital interests, or a public register open to consultation; NAPPD may also authorize such a transfer where the controller shows sufficient contractual safeguards for privacy and fundamental rights. Article 47 defers the Law's own entry into force to general law without stating a day.

Article 13 gives every person the right not to be subject to a decision that affects their legal situation or affects it in a meaningful way, based solely on automated data processing that assesses aspects of their personality such as their professional capacity, credit, trustworthiness or behavior.

Paragraph 2 allows such a decision where it is taken in connection with entering into or performing a contract, on condition that the person's own request for the contract has been met or appropriate measures safeguard their legitimate interests, in particular their right of representation and expression, or where a law authorizing it establishes measures guaranteeing their legitimate rights and interests. Article 47 defers the Law's own entry into force to general law without stating a day.

Article 10 gives the data holder the right to be told, at collection, the controller's identity, the purposes of the processing, the recipients or categories of recipients, whether a response is obligatory and the consequences of not responding, and the existence and conditions of the rights of access and rectification, and requires that information by the time of registration or before the first communication to a third party where the data were not collected from the holder directly; it excuses the duty where a law provides otherwise, for security or criminal-investigation reasons, or where informing the holder is impossible or disproportionate for statistical, historical or scientific processing, with NAPPD notified in that case.

Article 11 gives the holder free, undue-delay-free access at reasonable intervals to confirmation of whether their data is processed, the purposes, categories and recipients, the data itself in an intelligible form, its origin, the reasoning behind an automated-processing decision about them, and rectification, erasure or blocking of non-compliant data, with third parties who received the data told of any correction; access to health data, including genetic data, runs through a physician of the holder's choosing, and access concerning security or criminal matters runs through the competent authority or NAPPD.

Article 12 gives the holder the right to object, for weighed and legitimate reasons tied to their situation, to continued processing, and an unconditional, free right to stop processing of their data for direct marketing or other commercial solicitation, exercised before the data is first communicated to a third party for that purpose. Article 47 defers the Law's own entry into force to general law without stating a day.

Article 14 gives a person who suffered damage from unlawful processing, or from any other act breaching this Law or its regulations, the right to compensation from the controller, who is exonerated only by proving the damaging act is not attributable to it.

Article 27 preserves a data holder's right to complain to NAPPD alongside administrative or judicial recourse for a violation of this Law, and Article 28 makes a court decision on that violation appealable, on an urgent, breach-only basis, to the Court of last instance.

Articles 31 and 32 set administrative fines for a legal, natural or unincorporated-group violator, up to 1,000,000,000 Dobras, doubled for data subject to Article 22 prior checking, for negligently failing to notify NAPPD of processing under Article 21(1) and (5), giving false information, notifying in breach of Article 23, or, after NAPPD gives notice, maintaining access to open data transmission networks for controllers that do not comply with this Law, and a separate, lower fine of 25,000,000 to 90,000,000 Dobras for breaching another listed provision.

Article 34(1) makes negligence always punishable in the administrative offenses of Article 31, and Article 34(2) makes an attempt always punishable in the administrative offenses it refers to in Articles 32 and 33.

Articles 36 to 40 punish, with imprisonment or a day-fine doubled for Article 7 or 8 data, intentionally omitting a required NAPPD notification or authorization, providing false information in one, diverting or misusing personal data, illegally interconnecting personal data, unauthorized access to personal data, damaging or destroying personal data without authorization, defying a NAPPD order to stop, block or destroy processing, and breaching professional secrecy over personal data.

Article 41 makes an attempt always punishable in these crimes. Article 42 lets NAPPD or a court add an accessory penalty, a temporary or permanent ban on processing, publication of the conviction, or NAPPD's public warning or censure, and Article 43 requires a conviction to be advertised in a widely circulated Portuguese-language periodical and by public notice for at least 30 days.

Article 44 has the National Assembly approve NAPPD's own organic law and the status of its members, guaranteeing their independence, and gives NAPPD its own technical and administrative support. Article 47 defers the Law's own entry into force to general law without stating a day.

Article 7(1) defines a sensitive category as data on philosophical or political belief, membership of a political or trade-union association, religious belief, private life, racial or ethnic origin, health or sex life, including genetic data; biometric identifiers as such are not named among these categories.

Article 7(2) permits processing this data only under a legal or organic provision that expressly authorizes it, NAPPD's authorization for an important public interest indispensable to its own attributions, or the holder's explicit authorization, and Article 7(3) adds narrower grounds: protecting the vital interests of a person unable to consent, processing by a political, philosophical, religious or trade-union body about its own members with their consent, data the holder has manifestly made public, or a judicial defense.

Article 7(4) permits processing health or sex-life data, including genetic data, for preventive medicine, diagnosis, care or health-service management only through a health professional or another person bound by secrecy, notified to NAPPD under Article 21, and secured by appropriate information-security measures.

Article 8 restricts the central record of persons suspected of unlawful activity, a criminal offense or an administrative offense, and of the penalties, security measures, fines or ancillary sanctions imposed on them, to a public service with specific legal competence, and limits processing for police investigation to what a specific danger or offense requires.

Article 16 requires the controllers covered by Articles 7(2) and 8 to take special safety measures: controlling entry to their premises, preventing unauthorized reading, copying, alteration or removal of data carriers, preventing unauthorized disclosure or alteration, controlling system access and data transmission, logging who enters data and when, and keeping health and sex-life data logically separate from other personal data; NAPPD may also require encryption where transmission over the Article 7 network would otherwise put the holders' rights at risk.

Article 47 defers the Law's own entry into force to general law without stating a day.

Article 75(1) excludes from the reproduction right a temporary act of reproduction that is transient or accessory, is an integral and essential part of a technological process, and whose sole purpose is to enable a network transmission between third parties by an intermediary or a lawful use with no independent economic significance; browsing and temporary storage that enable a transmission system's effective functioning are lawful on the same terms, provided the intermediary does not modify the transmission's content or interfere with a technology's lawful use as recognized by market practice.

Article 75(2) permits, without the author's consent, a regular selection of periodical press articles as a press review. It also permits the fixation or communication of short excerpts from a work when their use in reporting a current event is justified for information purposes. It further permits inserting citations or summaries of another's work in support of one's own views or for criticism, discussion, or teaching.

It also permits reproducing or communicating an already-accessible current-affairs article on an economic, political, or religious topic, unless its reproduction right has been expressly reserved. Article 76 conditions this free use on naming the author and publisher where possible, and on paying equitable remuneration to the author and publisher in the cases the article specifies.

No text-and-data-mining-specific exception, and no AI-training-specific rule, is stated separately from this general free-use framework, and the Code predates that concept. Infringing outside these exceptions is punished under article 197.

Article 3(1)(b) protects summaries and compilations of works, whether protected or not, such as collections, encyclopaedias, and anthologies, as original works only where the choice or arrangement of their contents constitutes an intellectual creation, and article 3(1)(c) extends the same standard to systematic or annotated compilations of official texts (conventions, laws, regulations, and administrative or judicial decisions).

The Code names no database as such and creates no separate sui generis right in an unoriginal, purely factual collection of data, so a compilation that is not itself an original creation is not protected against reproduction under this article. Article 7(1)(a) additionally excludes news of the day and reports of various events disclosed merely as simple information from copyright protection altogether, whatever their protected status otherwise.

Infringing a protected compilation is punished under the Code's own penalty provisions (article 197), which punish, with the same terms, unauthorized use of a counterfeit or usurped work under article 199. Article 229 puts the Code into force on the date of its publication, which the Diário da República issue carrying it dates to 17 April 2017.

Article 7(1)(a) excludes news of the day and reports of various events disclosed as simple information from copyright protection altogether, so a purely factual news item carries no copyright to begin with. For material that is protected, article 75(2)(c) permits, without the author's consent, a regular selection of periodical press articles in the form of a press review.

Article 75(2)(d) permits fixing, reproducing, or communicating short excerpts of a work when their use in reporting a current event is justified for information purposes. Article 75(2)(g) permits inserting citations or summaries of another's work in support of one's own views or for criticism, discussion, or teaching.

Article 75(2)(l) permits reproducing or communicating an already-accessible current-affairs article on an economic, political, or religious topic, or a broadcast work or material of like character, unless its reproduction or broadcast right has been expressly reserved. Article 76 conditions this free use on naming the author and publisher where possible and, for some of these uses, paying equitable remuneration.

None of these provisions states a length limit or a headline-only threshold, and no reported São Toméan decision testing whether a systematic aggregator's reproduction of headlines and snippets, as distinct from a traditional press review, falls within either exception has been located.

Sao Tome and Principe has no separate press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, no recognized hot-news or misappropriation doctrine distinct from ordinary copyright law, and no case law on hyperlinking or framed display has been located.

Article 3(1)(b) protects a compilation as a copyright work only where its selection or arrangement of contents is itself an original creation, and the Code creates no sui generis database right and no text-and-data-mining exception or machine-readable opt-out mechanism. Article 229 puts the Code into force on the date of its publication, which the Diário da República issue carrying it dates to 17 April 2017.