Added logged 19 Aug 2026
Four African Union Convention parties join the tracker in one pass, and the pass answered a structural question that opened it. When Mozambique was added on art. 14(5) of the Malabo Convention, four further parties were recorded as bound and untracked — Namibia, Zambia, Mauritius and Mauritania — with the worry that four more per-country treaty rows would be a pattern rather than a one-off, and that the Convention might belong on the tracker as a single African Union regional row instead. Reading the four national statutes dissolved the worry. Three of the four have their own automated-decision bar in national law, so they are ordinary national rows on the same footing as the eleven Convention parties already tracked, and the treaty runs behind them as background rather than as the operative rule. Only Namibia is the Mozambique shape. The pattern is two treaty rows, not five.
Zambia joins with zm-dpa2021-s62. Section 62(1) of the Data Protection Act, 2021 (Act No. 3 of 2021) bars any decision based solely on automated processing, including profiling, producing legal effects concerning the data subject or similarly affecting them, with three exceptions at s. 62(2) — contract necessity, authorisation by any written law, explicit consent — and, where one is relied on, a s. 62(3) safeguard duty carrying the full triad the Convention omits: human intervention on the part of the controller, the right to express a point of view, and the right to contest the decision. Section 62(4) adds a separate bar on automated processing of sensitive personal data absent express consent, public interest or statutory permission with safeguards. The explanation limb is reactive only — s. 58(2)(d) gives access to information about the basic logic involved in any automatic processing in case of automated decision making, while the s. 64 duty to inform at direct collection runs (a) to (f) and carries no automated-decision item — so a Zambian controller must explain when asked and need not volunteer that a machine decided. Section 57 is the sleeper: notification to the Commissioner of any third-party agreement allowing that third party to trade on a data subject's profile.
The Zambian date and the Zambian penalty both had to be traced rather than assumed. Section 1 is a bare enabling clause and the 24 March 2021 assent date on the face of the Act is not the operative date; the appointing instrument is Statutory Instrument No. 22 of 2021, the Data Protection Act (Commencement) Order, 2021, made by the Minister of Transport and Communication on 31 March 2021, whose para. 2 brings the Act into operation on the date of publication of the Order — published 1 April 2021, which is the date carried. On penalty, the Act penalises by Part: s. 18(1) covers Part IV at up to one hundred million penalty units or 2% of turnover, and s. 55(1) covers Part VIII at 2% of turnover or two million penalty units. Section 62 sits in Part IX, and Part IX has no equivalent clause. Section 77, the general penalty, reaches only a person who commits an offence for which no specified penalty is provided, so it presupposes an offence rather than creating one. No offence attaches to s. 62. The commonly repeated figure of a fine plus three years' imprisonment for automated-decision breaches in Zambia is s. 77 misapplied; the real remedies are a s. 68 complaint to the Commissioner, a s. 69 appeal to the High Court and s. 72 compensation.
Mauritius joins with mu-dpa2017-s38, and it is the fullest automated-decision regime of any Convention party. Section 38(1) of the Data Protection Act 2017 (Act 20/2017) carries the GDPR right in GDPR order, with the three exceptions at s. 38(2) and the controller's own safeguard duty at s. 38(5) confined to the contract and explicit-consent limbs — the legal-authorisation route being policed instead by the safeguards the authorising law must itself lay down. Section 38(3) goes further than GDPR art. 22(4): automated processing intended to evaluate certain personal aspects shall not be based on special categories of personal data at all, with no consent or substantial-public-interest escape. The explanation duty runs three times over: proactively at s. 23(1)(g) with the logic involved and the significance and envisaged consequences, reactively at s. 37(2)(h) inside the right of access, and again at s. 38(4), which requires the s. 23 information to state the existence of processing for such a decision and its envisaged effects whenever an exception is used. Section 34(2)(a) makes an impact assessment mandatory beforehand. And unlike Zambia, the penalty reaches it: s. 43(1) catches «any person who commits an offence under this Act for which no specific penalty is provided or who otherwise contravenes this Act» — a fine not exceeding 200,000 rupees and imprisonment not exceeding 5 years, drafted with «and» rather than «or» between them, which on a literal reading makes both cumulative. The Act binds the State under s. 3(1) and treats each Ministry as separate from every other under s. 3(2). In force since 15 January 2018 by Proclamation No. 3 of 2018, not the 8 December 2017 passage, the 22 December 2017 assent or the 23 December 2017 gazetting.
Mauritania joins with mr-loi2017020-art19, and its first paragraph has no counterpart anywhere else on the tracker. Article 19 of Loi n° 2017-020 du 22 juillet 2017 opens by barring any judicial decision involving an assessment of a person's conduct from being founded on automated processing intended to evaluate certain aspects of their personality — a rule addressed to courts, cutting off algorithmic input into sentencing, bail and every other judicial appraisal of behaviour. Its second paragraph is the general bar, and it is art. 2 of France's Loi n° 78-17 in its pre-2018 wording carried across whole: no exception limb of any kind — no contract, no consent, no legal authorisation — no profiling definition, and an «effets juridiques» threshold with no «significantly affects» limb, so a purely commercial automated refusal falls outside it where it would be caught in Zambia, Mauritius or under the Convention. There is no logic item anywhere: the art. 53 right of access runs to five items and the information duty at collection to nine, and neither carries one, and there is no right to human intervention and none to contest. Mauritania is the Angola shape at a different latitude — the machine decision is forbidden and never has to be explained. Scope under art. 3 is the means-in-territory test rather than the GDPR's targeting test. The penal articles, arts. 84 to 98, were read one by one and none of them names art. 19 or cross-refers to it, so no criminal penalty attaches; what reaches it is art. 80, letting the Autorité de Protection des Données à caractère personnel impose pecuniary sanctions proportionate to gravity, up to ten million ouguiyas on a first breach and fifty million or 5% of pre-tax turnover on a repeat within five years. Those figures predate the 1 January 2018 redenomination at ten old ouguiya to one new, so in present-day currency they are MRU 1,000,000 and MRU 5,000,000. The row is carried at medium confidence for two reasons that are not about the text of art. 19: the transitional regime at arts. 99 and 100 runs from a compound trigger, entry into force and the effective establishment of the Authority, and the Authority was stood up years late; and every figure in the Law is denominated in the old currency.
Namibia joins with na-malabo-art14-5, and it is the Mozambique shape exactly — the obligation arrives by treaty because there is no statute for it to arrive by. Namibia never signed the Convention; it acceded on 25 January 2019 and deposited on 1 February 2019, and its signature column on the African Union's status list is empty. Reception is more direct than in Mozambique: art. 144 of the Constitution provides that unless otherwise provided by the Constitution or an Act of Parliament, the general rules of public international law and international agreements binding upon Namibia under the Constitution shall form part of the law of Namibia — automatic incorporation with no publication precondition, where Mozambique's art. 18 conditions entry into the domestic order on official publication. Two qualifications cut the other way and keep the row at medium confidence alongside the same self-executing question art. 14 raises inside itself: the phrase «under this Constitution» routes incorporation through art. 63(2)(e), the National Assembly's power to agree to ratification of or accession to international agreements, and the opening words make art. 144 expressly subject to displacement by an Act of Parliament — an Act of Parliament on precisely this subject being pending. The Data Protection Bill, drafted in successive versions since 2013 and most recently circulated as the Data Protection Bill 2023, carries its own solely-automated-decision provision with consent and contract exceptions and a human-intervention safeguard; the Ministry of Information and Communication Technology said in August 2025 it was in its final stages and would be tabled between September and October 2025. It has not been enacted, and until it is the Convention is the only automated-decision rule in force in Namibia. When it passes, this row is superseded rather than duplicated. Article 13 of the Constitution was checked and ruled out: it gives a privacy right against interference with homes, correspondence and communications, and no data-processing regime.
The dating of all four is anchored the same way, and it is worth restating because it is counter-intuitive. Art. 36 of the Convention brings it into force thirty days after the depositary receives the fifteenth instrument of ratification, and there is no separate per-State entry-into-force clause — so a party that deposited earlier is bound from the collective date, not from its own deposit. The fifteenth deposit is Mauritania's, on 9 May 2023, which puts the Convention in force on 8 June 2023 for all sixteen parties, Mauritius (deposited 2018), Namibia (2019) and Zambia (2021) included. Mauritania is therefore both bound by art. 14(5) and the reason art. 14(5) binds anyone.
Where a national statute and the Convention both apply and diverge, the national statute is carried as the operative rule and the treaty is recorded behind it. The divergence is real and it is not academic: art. 14(5) admits no contract, consent or legal-authorisation exception, while s. 62(2) in Zambia and s. 38(2) in Mauritius admit all three. A controller relying on explicit consent in Lusaka or Port Louis is on solid statutory ground and unresolved treaty ground. That tension is recorded rather than resolved. With these four, all sixteen States that have deposited an instrument of ratification of the Convention now carry a row — Angola, Cabo Verde, Congo, Côte d'Ivoire, Ghana, Guinea, Mauritania, Mauritius, Mozambique, Namibia, Niger, Rwanda, São Tomé and Príncipe, Senegal, Togo and Zambia. The coverage gap opened by the Mozambique row is closed. What remains open is a structure question rather than a data one: whether the Convention should additionally exist as a single African Union regional row alongside the fourteen national-statute rows and the two treaty-only rows, or whether per-country rows remain the right shape now that the treaty-only cases have turned out to be two rather than five.
142 -> 146 obligations / 51 -> 55 regions / 85 -> 89 countries.