related to the access, use and transmission of data punishable with a penalty of
6 months to 3 years of imprisonment, if other is not applicable. For the misuse of
function for purposes alien to the mission of the organ, a disciplinary sanction that
can lead to the agent dismissal from service is available.
4 The International Dimension of Data Protection
4.1 The Territorial Scope of Rules on Data Protection
The scope is defined by article 2 of the Data Protection Act defining a basic level of
application by taking the place of the establishment of the controller as the criteria,
under which it is applicable when the data processing is carried out in the context of
the activities of an establishment of a controller situated within the national territory
as specified by International Law and article 6 of the Constitution.
4.2 The Applicability of Data Protection Rules to Foreign
Entities
Article 2 of the Data Protection Act also defines that data protection rules are
applicable outside national territory in areas where, under International Law, Cape
Verdean Law applies, namely under International Law of the Sea, International Air
Law and International Diplomatic Law. The same article includes an exception
under its number three, permitting the application of data protection rules to foreign
entities, namely to a controller that makes use of automated or other types of
equipment situated in Cape Verde, except in the case that such use has only the
purpose of transit. So, the extraterritoriality of the Cape Verdean data protection
rules application is very limited, not providing for a very clear protection in cases
where controllers are not established in the national territory.
4.3 The Specific Conditions Applicable to the Transfer
of Personal Data to a Foreign Jurisdiction
The general rule of the Law establishes both substantive and procedural conditions
for the transfer of data to a foreign jurisdiction, respectively that the country has an
adequate level of data protection, assessed in light of all circumstances surrounding a
data transfer or a set of data transfers, in particular the “nature of the data, the
purpose and duration of the proposed processing, the country of origin and country
of final destination, the rules of law, both general and sectoral, in force in the State in
Data Protection in the Internet: Cape Verde’s National Report
107
6 months to 3 years of imprisonment, if other is not applicable. For the misuse of
function for purposes alien to the mission of the organ, a disciplinary sanction that
can lead to the agent dismissal from service is available.
4 The International Dimension of Data Protection
4.1 The Territorial Scope of Rules on Data Protection
The scope is defined by article 2 of the Data Protection Act defining a basic level of
application by taking the place of the establishment of the controller as the criteria,
under which it is applicable when the data processing is carried out in the context of
the activities of an establishment of a controller situated within the national territory
as specified by International Law and article 6 of the Constitution.
4.2 The Applicability of Data Protection Rules to Foreign
Entities
Article 2 of the Data Protection Act also defines that data protection rules are
applicable outside national territory in areas where, under International Law, Cape
Verdean Law applies, namely under International Law of the Sea, International Air
Law and International Diplomatic Law. The same article includes an exception
under its number three, permitting the application of data protection rules to foreign
entities, namely to a controller that makes use of automated or other types of
equipment situated in Cape Verde, except in the case that such use has only the
purpose of transit. So, the extraterritoriality of the Cape Verdean data protection
rules application is very limited, not providing for a very clear protection in cases
where controllers are not established in the national territory.
4.3 The Specific Conditions Applicable to the Transfer
of Personal Data to a Foreign Jurisdiction
The general rule of the Law establishes both substantive and procedural conditions
for the transfer of data to a foreign jurisdiction, respectively that the country has an
adequate level of data protection, assessed in light of all circumstances surrounding a
data transfer or a set of data transfers, in particular the “nature of the data, the
purpose and duration of the proposed processing, the country of origin and country
of final destination, the rules of law, both general and sectoral, in force in the State in
Data Protection in the Internet: Cape Verde’s National Report
107