Lei 133/V/2001 art. 23.º — the Lusophone prohibition rewritten to the GDPR's shape, and the second the regulator can licence
Binds Responsáveis pelo tratamento — controllers — with subcontratantes (processors) bound through art. 24(3)-(6) of the republished text. The scope article is the clearest break with the other two Lusophone rows: Lei 121/IX/2021 replaced art. 2 with a GDPR art. 3-shaped reach rather than the Lei 67/98 «means situated in national territory» test that Angola and São Tomé still use. Art. 2(1) applies the Law to processing by wholly or partly automated means and to non-automated processing of personal data contained in or intended for files. Art. 2(2) then reaches processing carried out (a) in the context of the activities of an establishment of a controller or processor, public or private, situated in national territory, irrespective of whether the processing occurs inside or outside the territory; (b) outside national territory in a place where Cabo Verdean law applies by force of international law; and (c) by a controller or processor not established in national territory that processes the personal data of data subjects who are in national territory, where the processing activities relate to the offering of goods or services to those data subjects, irrespective of whether a payment is required, or to the monitoring of their behaviour where that behaviour takes place in national territory. A foreign scoring, credit or hiring-assessment operator that has no presence in Cabo Verde but profiles people who are there is therefore inside art. 23. Art. 2(3) adds video surveillance and other capture and diffusion of sounds and images allowing identification, where the controller is domiciled or seated in national territory or uses a network access provider established there; art. 2(4) obliges a controller covered by extraterritoriality or immunity to designate a representative established in national territory, communicated to the CNPD. Impact tier: all entities — art. 23 carries no employee-count, turnover, sector or high-risk-system threshold, and the art. 5(1)(j) profiling definition expressly names professional performance and economic situation, which puts hiring and credit-scoring deployers squarely in scope. Art. 40 separately makes the processing of personal data relating to the credit and solvency of data subjects subject to prior authorisation by the CNPD, so a credit-scoring operator meets an ex ante gate as well as art. 23.. Article 23.º of Lei n.º 133/V/2001, de 22 de janeiro, in the consolidated text republished by Lei n.º 121/IX/2021, de 17 de março, is Cabo Verde's automated-decision provision, and it is the third Lusophone row on the tracker after Angola and São Tomé e Príncipe. All three descend from Portugal's Lei 67/98, but Cabo Verde is the one that has been rewritten since the GDPR, and the rewrite shows. Under art. 23(1), «qualquer pessoa tem o direito de não ficar sujeita a uma decisão que produza efeitos na sua esfera jurídica ou que a afete de modo significativo, tomada exclusivamente com base num tratamento automatizado dos seus dados pessoais, incluindo a definição de perfis» — any person has the right not to be subject to a decision producing effects in their legal sphere or significantly affecting them, taken exclusively on the basis of automated processing of their personal data, including profiling. The 2021 amendment cut the evaluative limb that Angola and São Tomé still carry — the requirement that the processing be «destinado a avaliar determinados aspectos da sua personalidade, designadamente a sua capacidade profissional, o seu crédito, a confiança de que é merecedora ou o seu comportamento» — and put profiling in its place. So Cabo Verde's bar no longer asks what the processing was for: any solely automated decision over the legal-effects-or-significant-effect threshold is caught, evaluative or not, which makes it wider than either of its Lusophone siblings and puts it in the same shape as the GDPR's own art. 22. «Definição de perfis» is then defined in art. 5(1)(j) in GDPR art. 4(4) terms — any automated processing that uses personal data to evaluate certain personal aspects of a natural person, in particular to analyse or predict aspects concerning their professional performance, economic situation, health, personal preferences, interests, reliability or conduct. The ways out are three. Art. 23(2) permits the decision under a legal authorisation, or with the person's consent where it occurs in the conclusion or performance of a contract and either their own request to conclude or perform was satisfied or adequate measures exist guaranteeing the defence of their legitimate interests and their ability «expor o seu ponto de vista, designadamente o seu direito de representação e expressão» — to express their point of view, namely their right of representation and expression. Art. 23(3) then carries the limb that until now stood alone on the tracker as Angola's: «pode ainda ser permitida a tomada de uma decisão nos termos do número 1, quando autorizadas pela CNPD e desde que sejam tomadas medidas de garantia a defesa dos interesses legítimos do titular dos dados» — the decision may further be permitted where the Comissão Nacional de Proteção de Dados authorises it, provided measures guaranteeing the defence of the data subject's legitimate interests are taken. Both clauses descend from art. 13(3) of Portugal's Lei 67/98, so the regulator-licence route is a shared Lusophone inheritance rather than an Angolan invention, and Cabo Verde and Angola are the two jurisdictions on the tracker whose supervisory authority can licence an otherwise-prohibited automated decision case by case. On disclosure Cabo Verde is the most generous of the three: art. 14(1)(c) gives the data subject, on request and without excessive delay or cost, «o conhecimento da lógica subjacente ao tratamento automatizado dos dados que lhe digam respeito, no que se refere às decisões automatizadas, incluindo a definição de perfis, referida no número 1 do artigo 23.º» — knowledge of the logic underlying the automated processing of their data as regards automated decisions including profiling, cross-referring art. 23(1) by name. São Tomé gives the «razões», the reasons; Angola gives nothing at all. What Cabo Verde does not give is a notice duty: the art. 13 information list, which the same 2021 law rewrote and extended to the contacts of the data protection officer and the legal basis of the processing, carries no automated-decision item and no logic item, so the right is reactive — invocable only by someone who already suspects a machine decided. There is no right to obtain human intervention and no right to contest the decision after the fact. Impact tier: all entities.
Force. The date carried here is the date on which the current wording of the automated-decision rule took effect. Lei n.º 121/IX/2021, de 17 de março — the second amendment to the general legal regime for the protection of the personal data of natural persons approved by Lei n.º 133/V/2001, de 22 de janeiro, as amended by Lei n.º 41/VIII/2013, de 17 de setembro — was approved by the Assembleia Nacional on 11 February 2021, promulgated by President Jorge Carlos de Almeida Fonseca on 1 March 2021, signed on 8 March 2021 and published in the Boletim Oficial da República de Cabo Verde, I Série, n.º 28, de 17 de março de 2021, at pp. 884-907. Its art. 6 (Entrada em vigor) provides «a presente lei entra em vigor trinta dias após a sua publicação», thirty days after publication, which puts the amended text in force on 16 April 2021. The obligation itself is older and continuous: art. 2 of the 2021 Law amends art. 14.º of Lei 133/V/2001, which is the article the republication in its art. 5 renumbers as art. 23.º of the consolidated text, and the parent Law's own art. 71 (Entrada em vigor) used the identical thirty-day formula against publication on 22 January 2001, so the first Cabo Verdean automated-decision bar has been in force since 21 February 2001. What the 2021 Law changed is substantive and is why the later date is carried: it replaced nos. 1 and 2 of the article outright, dropping the Lei 67/98 evaluative limb and inserting «incluindo a definição de perfis» together with the new art. 5(1)(j) profiling definition, while leaving no. 3 — the CNPD authorisation route — untouched, which the amending text marks by reproducing it as «3. []». Supersession is therefore recorded rather than duplicated: this row supersedes nothing on the tracker, and the pre-2021 wording is not published as a separate entry. One divergence inside the single gazette issue is recorded rather than resolved: in the amending body at art. 2, the new art. 14(1) reads «tomada exclusivamente com base num tratamento automatizado, incluindo a definição de perfis», while the republished consolidated text at art. 23(1) reads «tomada exclusivamente com base num tratamento automatizado dos seus dados pessoais, incluindo a definição de perfis». The republished text governs — art. 5(1) of the amending Law provides that the modifications are inserted into Lei 133/V/2001 by substitution and art. 5(2) republishes the Law in its new text together with the amending Law — and it is the republished wording that is quoted in this entry, with the amending-body wording noted so the difference is not silently smoothed over. Art. 4 of the amending Law separately revokes art. 48.º of the 2001 Law. Transitional: art. 70 of the republished text gave processing existing in manual files at entry into force a six-month window for conformity with arts. 8, 11, 13 and 14 — art. 23 is not in that list and binds without a transitional window. No AI-specific statute is in force in Cabo Verde and the Law does not define artificial intelligence. Text read in full in the copy of the Boletim Oficial pages published by the Comissão Nacional de Proteção de Dados, the supervisory authority the Law creates — the file is the gazette typesetting itself, carrying the BO running heads, page numbers 884-907 and the kiosk.incv.cv watermark, not a re-keyed edition. Coverage of the read: the amending Law arts. 1-6 in full, including the enumeration of amended articles and the entry-into-force and republication clauses; and in the republished consolidated text, art. 2 scope, art. 5 definitions, arts. 13 information, 14 access and 23 automated individual decisions verbatim, art. 24 security and processors, arts. 39-41 notification and prior control, arts. 47-58 civil liability and the administrative infractions with their coimas, and arts. 59-71 the criminal subsection, accessory sanctions, transitional provisions and entry into force. Confidence high: art. 23 and art. 14(1)(c) were read verbatim in the gazette text, both entry-into-force clauses are explicit thirty-day formulas against dated publications, and the fine attaching to art. 23 was traced to the enumerated list in art. 50(1)(b) rather than assumed.
Stated maximum penalty — 100,000$00 to 1,000,000$00 Cabo Verdean escudos, and the fine reaches art. 23 by name. Art. 50 (Outras infrações) of the republished text makes it an administrative infraction punishable with a coima of a minimum of 100,000$00 and a maximum of 1,000,000$00 for entities that fail to observe the obligations established in arts. 6.º, 13.º, 14.º, 20.º, 23.º, 25.º, 33.º and 43.º(3), or that fail to designate a representative under art. 2(4). Art. 23 — the automated-decision bar — and art. 14 — the access right carrying the logic-disclosure limb — are both inside that enumerated list, which puts Cabo Verde with São Tomé e Príncipe, where art. 32(1) also names the automated-decision article, and against Angola, where art. 29 appears in neither art. 51 contravention list and enforcement has to run through a complaint, a judicial reparation claim or the crime of qualified disobedience. Art. 50(2) doubles the limits where the obligations in arts. 7, 8, 11, 12, 35 and 36 are the ones breached. Art. 52(1) makes negligence always punishable in the art. 50 infractions and art. 52(2) makes attempt punishable in arts. 49 and 50, so an operator cannot answer an art. 23 charge by saying the profiling was inadvertent. The neighbouring band is higher but does not reach art. 23: art. 49 punishes negligent failure to notify the CNPD, or maintaining network access for non-compliant controllers after notification, with 50,000$00 to 500,000$00 for a natural person and 300,000$00 to 3,000,000$00 for a legal person or entity without legal personality, doubled under art. 49(2) where the data are subject to prior control under art. 40. Application of the coimas belongs under art. 56 to the president of the CNPD on the Commission's prior deliberation, and that deliberation is an enforceable title if not challenged in the legal period; art. 58 gives the proceeds to the CNPD; art. 57 makes clear that paying the coima does not dispense the infringer from performing the omitted duty. Alongside the coimas, art. 69 allows accessory sanctions — temporary or definitive prohibition of the processing, blocking, erasure or total or partial destruction of the data, publicity of the condemnatory decision at the convicted party's expense in the most widely circulated periodical of the comarca for not less than 30 days, and public warning or censure of the controller. The criminal subsection sits behind that and does not reach art. 23 directly: art. 59 punishes with up to one year's imprisonment or a fine up to 120 days the intentional omission of a notification or authorisation request under arts. 39 and 40, false information in one, diversion or use of data incompatibly with the purpose of collection, unlawful interconnection, failure to comply within a deadline fixed by the CNPD, and maintaining network access after being notified not to; arts. 60-61 punish undue access and the vitiation or destruction of data; art. 62 makes it qualified disobedience to fail, after notification, to interrupt, cease or block processing, to refuse the CNPD the cooperation demanded, or to fail to erase or destroy data — so once the CNPD orders an art. 23 profiling operation stopped, defying that order is a crime. Arts. 64-67, added by the 2021 amendment, create the further offences of diversion of data, use of data incompatibly with the purpose of collection, unlawful interconnection and insertion of false data. Art. 51(1) provides that where the same act is both a crime and an administrative infraction, the agent is always punished as for the crime.