Lei 3/2016 art. 13.º — the Lusophone prohibition without Angola's regulator escape hatch, and with a right to the reasons
Binds Responsáveis pelo tratamento — controllers — with subcontratantes (processors) bound through art. 17, which forbids anyone acting under the authority of the controller or processor, and the processor itself, from processing personal data without the controller's instructions save under legal obligation. Art. 3(1) applies the Law to processing by wholly or partly automated means and to non-automated processing of personal data contained in or intended for manual files. Art. 3(2) sets four territorial limbs: processing by a controller headquartered in São Tomé e Príncipe; processing in the context of the activities of a controller established in São Tomé e Príncipe even where that controller is not headquartered in national territory; processing outside national territory in a place where São Tomé law applies by force of public or private international law; and processing by a controller not established in São Tomé e Príncipe that resorts, for the processing, to means situated in national territory. Art. 3(3) makes that last limb wide in the same terms Angola uses — a controller is deemed to resort to means in São Tomé territory where the processing operations are carried out with means situated in national territory or where the personal data are hosted on means so situated, the mere use of such means for the collection, recording or transit of personal data in national territory being enough — and art. 3(4) then obliges that controller to designate a representative established in São Tomé e Príncipe. A foreign scoring, credit or hiring-assessment operator that merely hosts on São Tomé infrastructure is therefore inside art. 13 and owes a local representative. Impact tier: all entities — art. 13 carries no employee-count, turnover, sector or high-risk-system threshold, and its named evaluation grounds (professional capacity, credit, trustworthiness, conduct) put hiring and credit-scoring deployers squarely in scope.. Article 13.º of Lei n.º 3/2016 — Lei de Protecção de Dados Pessoais is São Tomé e Príncipe's automated-decision provision, and it is the second Lusophone row on the tracker after Angola. Both descend from Portugal's Lei 67/98 and the operative sentence is close to word-for-word: under art. 13(1), «qualquer pessoa tem o direito de não ficar sujeita a uma decisão que produza efeitos na sua esfera jurídica ou que a afecte de modo significativo, tomada exclusivamente com base num tratamento automatizado de dados destinado a avaliar determinados aspectos da sua personalidade, designadamente a sua capacidade profissional, o seu crédito, a confiança de que é merecedora ou o seu comportamento» — any person has the right not to be subject to a decision producing effects in their legal sphere or significantly affecting them, taken exclusively on the basis of automated processing intended to evaluate certain aspects of their personality, namely their professional capacity, their credit, their trustworthiness or their conduct. Where the two Lusophone rows part company is on the way out and on what the data subject gets to see. São Tomé keeps only the two statutory exceptions of the parent law — art. 13(2)(a), a decision taken in the conclusion or performance of a contract, conditioned on the person's own request having been satisfied or on adequate measures guaranteeing their legitimate interests, expressly their right of representation and expression; and art. 13(2)(b), a decision authorised by a law that lays down measures guaranteeing the data subject's rights and legitimate interests. There is no third route: nothing lets the Agência Nacional de Protecção de Dados Pessoais licence an otherwise-prohibited decision, which is exactly the limb Angola carries as art. 29(3) and Cabo Verde as art. 23(3) — São Tomé is the one member of the Lusophone group that dropped the regulator-licence route of art. 13(3) of Portugal's Lei 67/98. In the other direction São Tomé is the more generous of the pair, because art. 11(1)(c) gives the data subject the right to obtain from the controller «o conhecimento das razões subjacentes ao tratamento automatizado dos dados que lhe digam respeito» — knowledge of the reasons underlying the automated processing of data concerning them. The parent Portuguese provision speaks of the lógica subjacente, the underlying logic; São Tomé's drafters wrote razões, reasons, which on its face asks for the grounds of the processing rather than the mechanics of the model, and it is drafted as an access right exercisable on request rather than as a notice duty — the art. 10 information list carries no automated-decision item at all. Angola's Lei 22/11 has no equivalent of either. So among the three African rows added this month the shape is: São Tomé prohibits the decision and lets the data subject ask why the machine processed them, Angola prohibits the decision and never lets them ask, and the Democratic Republic of the Congo never prohibits it but compels disclosure of the underlying logic three times over. Impact tier: all entities.
Force. The Law was approved by the Assembleia Nacional in São Tomé on 15 February 2016, promulgated by President Manuel do Espírito Santo Pinto da Costa on 18 March 2016, and published in the Diário da República n.º 39 de 10 de Maio de 2016 at pp. 285-299 — the gazette number and date run in the running head of every page of the text read. The date carried here is that publication date, and it is the one point in the entry that is not exact to the day: art. 47.º (Entrada em vigor) says only «a presente lei entra em vigor nos termos legais», deferring to the general rule on the entry into force of diplomas rather than fixing a date or a vacatio period on its face, so the operative date is the publication date or a small number of days after it. Applying Deadline Specificity strictly, that residual is stated rather than papered over: no primary text of the São Tomé rule on entry into force of diplomas was located in this pass, secondary accounts point to the five-day PALOP vacatio inherited from Base LXXIX of Lei 5/72, and that account has not been verified against primary text and is not relied on here. Ten years on, nothing on the tracker turns on the difference. Art. 45 sets the only transition and it does not touch art. 13: processing existing in manual files at entry into force was given two years for conformity with arts. 7, 8, 10 and 11. Supersession: none — no successor or amending law was found, and no AI-specific statute is in force in São Tomé e Príncipe. Text read in full in the copy of the Diário da República pages published by the Red Iberoamericana de Protección de Datos, the network of Ibero-American data-protection authorities of which the São Tomé Agência Nacional de Protecção de Dados Pessoais is a member; the file is the gazette typesetting itself, carrying the DR running heads, page numbers 285-299 and the closing signature block, not a re-keyed edition. Coverage of the read: arts. 2 principles, 3 scope and 4 definitions; the whole of Capítulo III on data-subject rights, arts. 10 information, 11 access, 12 opposition, 13 automated individual decisions and 14 compensation, verbatim; arts. 16-18 on sensitive-data authorisations, processors and professional secrecy; the whole enforcement chain — arts. 30-35 administrative infractions and their fines, arts. 36-41 the criminal section, arts. 42-43 accessory penalties; art. 44 on the Agência; and arts. 45-47 the transitional and final provisions. Confidence high on the substance: art. 13 and art. 11(1)(c) were read verbatim in the gazette text and the fine attaching to art. 13 was traced to the enumerated list in art. 32(1) rather than assumed. The Agência Nacional de Protecção de Dados Pessoais, whose organic law art. 44 leaves to the Assembleia Nacional, does exist and is operational — it is a listed member of the African Network of Data Protection Authorities and of the Rede Lusófona de Protecção de Dados, where it leads the video-surveillance working group — so unlike Equatorial Guinea's never-created Órgano Rector, the enforcement route in art. 35 has an addressee. Revisited 31 Aug 2026 to identify the rule behind art. 47.º's «nos termos legais», and the residual is now named rather than left open, though the date is not moved. The applicable instrument is not the pre-independence Base LXXIX of Lei n.º 5/72 recorded above as an unverified account, but Decreto n.º 51/77, a post-independence São-tomense instrument which fixes entry into force «em São Tomé no 5.º [dia], após a sua publicação no Diário da República; no Príncipe no 8.º dia, após a sua publicação no Diário da República». Two things follow. First, the construction is the same named-day form found in Cabo Verde's Lei n.º 87/VII/2011 and in the Spanish Código Civil art. 2.1, not the elapsed-term form that moved Paraguay, so there is no midnight question. Second, entry into force in São Tomé e Príncipe is split by island: on that text, publication on 10 May 2016 puts Lei n.º 3/2016 in force on 15 May 2016 in São Tomé and on 18 May 2016 in Príncipe. Those dates are recorded as the better-sourced reading and are not adopted into the date field, because the wording of Decreto n.º 51/77 was read in the LegisPalop database of PALOP legislation rather than in the Diário da República itself, and a decade-old lifecycle-force row should not trade a labelled imprecision for an unverified precision. The date carried remains the publication date of 10 May 2016. If the text of Decreto n.º 51/77 is ever read in the gazette, this row moves to 15 May 2016 and the Príncipe date belongs in the note. Malabo Convention overlay, added 13 September 2026 under the per-country structure decision on AIL-240. São Tomé e Príncipe deposited its instrument of ratification of the African Union Convention on Cyber Security and Personal Data Protection (adopted at Malabo, 27 June 2014) on 15 February 2024, and the Convention entered into force on 8 June 2023 under its art. 36 — thirty days after Mauritania's deposit, the fifteenth. The date needs care on this row, because São Tomé's deposit is the only one of the sixteen that post-dates the Convention's own entry into force on 8 June 2023. Art. 36 fixes the collective date and adds no per-State entry-into-force clause, so the day from which the Convention binds São Tomé is not derivable from the instrument itself; on the earliest defensible reading it is the deposit of 15 February 2024, and no more precise date is asserted here. On substance, art. 14(5) states the same bar as art. 13.º and admits no exception of any kind, where São Tomé keeps the parent law's two: art. 13.º(2)(a), a decision taken in the conclusion or performance of a contract, conditioned on the person's own request having been satisfied or on adequate measures guaranteeing their legitimate interests, expressly the right of representation and expression; and art. 13.º(2)(b), a decision authorised by a law laying down safeguard measures. Both are routes the Convention does not open. The national statute is carried here as the operative rule, because it is the instrument that has a supervisory authority behind it and a penalty attached to it, and the Convention runs behind it as a stricter parallel rule. This is recorded as a divergence rather than resolved: neither instrument repeals or qualifies the other, São Tomé e Príncipe has not legislated the Convention into domestic law by a separate instrument, and the domestic reception question — whether art. 14(5) is directly effective in São Tomé e Príncipe, as arts. 18 and 144 of the Mozambican and Namibian constitutions respectively make it there — has not been separately verified for São Tomé e Príncipe and is not asserted here. A controller relying on an exception the statute grants therefore stands on solid statutory ground and unresolved treaty ground. Source moved off a non-government host, 14 September 2026, closing the last citation in the non-government source_url audit. The citation this row had carried since it was created was the copy published by the Red Iberoamericana de Protección de Datos at redipd.org — a network of data-protection authorities, not a São-tomense publisher — and a binding-status row whose only authority is a third-party copy is the defect the audit was opened to clear. The Law is now cited to the Agência Nacional de Protecção de Dados Pessoais, the supervisory authority art. 44.º of this Law provides for, which published the gazette issue itself on its own host at www.anpdp.st/docs_comprimidos/legislacao_nacional/dr39_lei3_2016_proteccao_de_dados_pessoais.pdf — the filename carries the gazette's own identifier, DR n.º 39. That live official URL, recorded here alongside the archived one, now answers HTTP 404: the ANPDP replaced its PHP site with a single-page application some time after 26 June 2024, and the whole docs_comprimidos tree went with it, including the English version at legislacao_nacional/law3_2016.pdf; the replacement serves a 1,070-byte Vite shell whose bundle exposes only authentication and form-platform routes and no legislation route at all. The source_url therefore points at the Internet Archive's capture of the regulator's own file, which is the remedy already applied to the Central African Republic in commit bc8ef0f and to Senegal on this tracker. Two captures of that file exist, 22 May 2022 and 21 April 2024; they are byte-identical (MD5 6a9237ebf02893ba3e995bffac97bd64, 283,230 bytes), so the ANPDP served one stable file for at least the two years to its last capture, and the 2024 capture is the one cited. The file is the gazette typesetting, not a re-keyed edition, and it was read end to end this run: page 1 is the Diário da República cover for «Terça feira, 10 de Maio de 2016 Número 39», with the Assembleia Nacional summary line for Lei n.º 03/2016, and every subsequent page carries the running head «N.º 39 – 10 de Maio de 2016 SÃO TOMÉ E PRÍNCIPE - DIÁRIO DA REPÚBLICA» over page numbers running 285 to 299, sixteen pages in all. Every load-bearing claim in this row was re-verified against it: art. 13.º(1) verbatim as quoted above; the two exceptions in art. 13.º(2)(a) and (b) verbatim; art. 32.º(1) enumerating arts. 5.º, 10.º, 11.º, 12.º, 13.º, 16.º, 17.º and 25.º n.º 3 at the 25.000.000,00 to 50.000.000,00 dobra band, so the fine reaching art. 13 is enumerated rather than inferred; art. 35.º(1) placing the application of those fines with the ANPDP; art. 44.º reserving the ANPDP's organic law and staff table to the Assembleia Nacional; art. 45.º giving manual files two years for arts. 7.º, 8.º, 10.º and 11.º; and art. 47.º reading only «A presente Lei entra em vigor nos termos legais», above the Assembleia Nacional's approval at São Tomé on 15 February 2016 under President José da Graça Diogo and the promulgation of 18 March 2016 by President Manuel do Espírito Santo Pinto da Costa. Nothing in the substance of this row moved: the retired redipd.org file extracts to exactly the same 52,884 characters over the same sixteen pages as the ANPDP file, so the two are the same gazette scan re-saved, and what was defective was the provenance of the citation rather than the text behind it. One thing is upgraded rather than merely re-verified. The existence and operation of the Agência, recorded above from its membership of the African Network of Data Protection Authorities and of the Rede Lusófona de Protecção de Dados, now rests on primary text: the same ANPDP legislation directory holds Diário da República n.º 40 de 6 de Abril de 2017, pp. 650-660, carrying Lei n.º 7/2017 — Organização e Funcionamento da Agência Nacional de Protecção de Dados Pessoais, approved by the Assembleia Nacional on 15 February 2017 and promulgated on 22 March 2017 by President Evaristo do Espírito Santo Carvalho — which is the art. 44.º organic law, enacted. It was read this run and it corroborates the supersession finding from the other direction: it amends and repeals nothing in Lei n.º 3/2016, and instead cites it as the law in force throughout, referring to its arts. 5.º, 9.º, 11.º, 16.º, 18.º, 20.º, 21.º, 22.º, 23.º and 25.º by number, while art. 4.º(1)(h) empowers the ANPDP to fix, by sector, the maximum periods for compliance with the controller obligations arising under arts. 11.º to 13.º — a procedural power over the timing of art. 13, not a power over its content. Ruled out this run, so that an archived citation is not mistaken for a search that was not run: no live São-tomense host publishes this Law. parlamento.st and www.parlamento.st refuse TCP, and the Internet Archive's holdings for the Assembleia Nacional stop in 2009, seven years before this Law; diario.gov.st, the obvious gazette host, refuses TCP, and dre.gov.st — the Diário da República electronic address the government portal itself links — has no A record; gov.st answers but is a news portal with no legislation section; stp.gov.st, the Governo portal, exposes a Strapi document API at backstp.gov.st whose entire corpus is seven documents across four types (Decreto-Lei, Comunicado, Programa, Decreto), none of them this Law; financas.gov.st answers 403 to every client; inic.gov.st, which serves national ICT strategy documents, returns HTTP 500 on every path including its own viewdoc.php; the Banco Central's legislation page at bcstp.st carries three financial statutes only; the Tribunal de Contas' legislation page carries no law files; and presidencia.st and ager.st publish no legislation at all.
Stated maximum penalty — 25,000,000 to 50,000,000 dobras, and the notable point is that the fine reaches art. 13 directly. Art. 32(1) enumerates by article number the provisions whose breach is an administrative infraction at that band — arts. 5, 10, 11, 12, 13, 16, 17 and 25(3) — so both the automated-decision prohibition in art. 13 and the right to know the reasons underlying automated processing in art. 11 are inside the sanctioned list. That is the opposite of Angola, where art. 29 appears in neither art. 51 contravention list and enforcement has to run through a complaint, a judicial reparation claim or the crime of qualified disobedience. Art. 32(2) sets a higher band, 45,000,000 to 90,000,000 dobras, for breach of arts. 6, 7, 8, 9, 19 and 20. Art. 31 sets the notification-failure band — 50,000,000 to 120,000,000 dobras for a natural person, 100,000,000 to 200,000,000 for a group without legal personality, and 250,000,000 to 500,000,000 for a legal person — doubled under art. 31(2) where the data are subject to prior control, and art. 34(1) makes negligence always punishable there. All amounts are as written in the 2016 text and are nominal dobras of that date; São Tomé e Príncipe redenominated its currency after the Law was passed, so the figures need conversion before they are quoted as a present-day exposure, and no conversion is asserted here because none was verified against primary text in this pass. Art. 35 gives the application of the fines to the Agência Nacional de Protecção de Dados Pessoais and makes its decision an enforceable title where it is not challenged in the legal period. Alongside the fines, art. 42 allows accessory penalties — temporary or definitive prohibition of the processing, blocking, erasure or total or partial destruction of the data, publicity of the conviction under art. 43 at the convicted party's expense in a widely circulated Portuguese-language periodical for not less than 30 days, and public warning or censure of the controller by the Agência. The criminal section sits behind that: art. 36 punishes intentional failure to notify or to seek authorisation, false information in a notification, diversion or use of personal data incompatibly with the purpose determining their collection, and unlawful interconnection, with up to one year's imprisonment or a fine up to 120 days; art. 37 punishes undue access and art. 38 the vitiation or destruction of data with up to two years; art. 39 makes it qualified disobedience to fail, after notification, to interrupt, cease or block processing, or to refuse the Agência the cooperation demanded of one; art. 40 punishes breach of professional secrecy with up to two years, aggravated by half where the agent is a public official or acted for gain; and art. 41 makes attempt always punishable. Under art. 33(1), where the same act is both a crime and an administrative infraction, the agent is always punished as for the crime.