Loi 001-2021/AN art. 15 — a two-limb bar with no exception, backed by art. 19's reasoning and artificial-intelligence disclosure right and by art. 31's prior authorisation for predictive-AI decision support
Binds Responsables du traitement and sous-traitants within the scope of the Law, whose art. 6 states that information and communication technologies are at the service of the human person and must not harm human identity, private life, individual and collective freedoms or human rights generally. Art. 4 excludes temporary copies made for technical transmission and access purposes, which must be erased once their purpose is achieved, and processing for purely literary, artistic or journalistic purposes carried out in accordance with the ethical rules of those professions, the security measures protecting journalistic sources and the moderation rules applicable to discussion forums operated by news publishers. Prior formalities are a standing precondition: art. 30 sets the declaration regime and art. 31 the prior-authorisation regime, which covers offence and conviction data in the private sector, interconnection of files in either sector, national-identification-number processing in either sector, biometric processing in the private sector, public-interest processing including for historical, statistical or scientific purposes, decision-support processing involving an appraisal of human conduct or profiling or resting on predictive artificial-intelligence techniques, and transfers abroad. The first limb of art. 15 binds the courts themselves; the second binds every administrative and private decision-maker, irrespective of size or sector. Art. 78 makes the sanctions in arts. 63 to 75 applicable to all files, automated or not, whose use does not fall exclusively within the exercise of the right to private life. Impact tier: all entities.. Article 15 of Loi n° 001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel is Burkina Faso's operative automated-decision rule, closing Chapitre 1 of Titre II on fundamental principles immediately before the chapter on the rights of the data subject. Its first limb bars any judicial decision involving an appraisal of human conduct from having as its foundation an automated processing of information giving a definition of the profile or the personality of the person concerned and intended to evaluate certain aspects of their personality. Its second bars any administrative or private decision involving an appraisal of human conduct from having as its sole foundation an automated processing of information giving a definition of the profile or the personality of the person concerned. Like Côte d'Ivoire's art. 25 and Mali's art. 2, the Law states no exception whatever — no contract carve-out, no consent exception, no legal-authorisation exception and no opportunity to present observations. Two neighbouring provisions do the work that the exception clause does elsewhere. Article 19 gives every person the right to know and to contest the information and the reasoning used in processing, automated or not, whose results are relied on against them, and adds that where that processing falls within artificial intelligence the criteria and the nature of the personal data founding it must be indicated to the person from the point of collection. Article 31 goes further than any other row on the tracker by putting the technology itself behind a licence: processing that assists administrative or private decision-making, involves an appraisal of human conduct, gives a definition of the profile or the personality of the person concerned, or rests on artificial-intelligence techniques for predictive purposes, may not be implemented without prior authorisation from the Commission de l'informatique et des libertés. That is a permissioning gate on predictive AI, not merely a constraint on the resulting decision. There is no right to obtain human intervention or a fresh non-automated decision, and the art. 16 information list stops at identity, purposes, categories, whether answers are compulsory, recipients, access, rectification, suppression and objection rights, retention period, foreign transfers and the means of giving or withdrawing consent.
Supersession: art. 82 abrogates Loi n° 010-2004/AN du 20 avril 2004 portant protection des données à caractère personnel, the statute this sweep originally targeted, which is therefore no longer operative and is not tracked. Art. 83 is a bare execution clause — "La présente loi sera exécutée comme loi de l'Etat" — and there is no commencement article and no deferral of art. 15. The date recorded is the date printed at the foot of the enacted text, "Ainsi fait et délibéré en séance publique à Ouagadougou, le 30 mars 2021", the Assemblée nationale having deliberated in its sitting of that day. Confidence is medium and the reason is specific to Burkina Faso: laws there are promulgated by presidential decree, and neither the promulgation decree for Loi n° 001-2021/AN nor the date of the Journal officiel carrying it could be established from any official host this run — cil.bf serves a maintenance page on every path, legiburkina.bf, jo.gov.bf and sgg.gov.bf do not resolve, and the CIL's own document tree returns 404 live. Entry into force can therefore only be 30 March 2021 or later. Art. 81 is transitional and not a deferral of art. 15: processing already created and governed by art. 30 is subject only to declaration, the CIL may by special decision apply art. 31 to it subject to a prorogation of not more than one year granted by decree in Council of Ministers on the supervisory authority's opinion, and from the date of entry into force all processing had one year to meet the Law's prescriptions, failing which it is deemed implemented without the corresponding declaration or authorisation. Art. 80 preserves the mandates of CIL members already appointed. Source: the enacted text as published by the CIL itself, retrieved from the Internet Archive capture of 10 July 2025 of the CIL's own document store, the live path having 404'd during the site's maintenance outage; an archived copy of a document served by the official host satisfies Primary Source First on the same basis as ng-ndpa-s37. Coverage symmetry against the fifteen African rows already tracked: art. 15 takes the wider ECOWAS Supplementary Act A/SA.1/01/10 art. 42 drafting shared with Côte d'Ivoire's art. 25 and Niger's art. 52 — the second limb is tied to an appraisal of human conduct rather than to legal or significant effects — and, like Côte d'Ivoire and Mali, states no exception at all. Its art. 19 is materially identical to the third and fourth paragraphs of Niger's art. 52, including the artificial-intelligence disclosure duty at collection; since Burkina Faso's Law predates Niger's by twenty months, Burkina Faso is the source of that drafting on the tracker and Niger the follower. Two rows therefore carry an express artificial-intelligence clause, not one. Burkina Faso goes one step beyond Niger in art. 31 by making predictive-AI decision-support processing subject to prior authorisation, which is the only ex ante licensing gate on artificial intelligence in any data-protection statute on the tracker. The four-way African lineage picture: GDPR art. 22 = ke-dpa-s35, ng-ndpa-s37, rw-law058-2021-art21; UK Data Protection Act 1998 s. 12 = gh-dpa-s41, tz-pdpa-s36, ug-dppa-s27; Directive 95/46/EC art. 15 = ma-loi0908-art11, dz-loi1807-art11, sn-loi200812-art48, ci-loi2013450-art25, ne-loi202259-art52, bj-code-num-art401, ml-loi2013015-art2 and now bf-loi0012021-art15; Directive-family statute with the automated-decision article absent = Tunisia's Loi organique 2004-63.
Stated maximum penalty — Art. 79 is the entire criminal chapter and creates no offence of its own: breaches of the Law are punished by the Penal Code in its provisions dealing with offences in computing matters and by means of information and communication technologies, so no criminal figure is attributed to art. 15 here. Everything operative is administrative and belongs to the CIL. Art. 63 lets the CIL, following the verification and inspection missions under art. 57 and without prejudice to criminal proceedings, impose a warning, a mise en demeure, an injunction to cease the processing carried out, blocking of certain personal data, a flat-rate fine, or withdrawal of the authorisation. Art. 65 fixes the flat-rate fine by reference to turnover rather than to a currency ceiling, which is unique among the Francophone rows: proportionate to the gravity of the failures and the advantages drawn from them, it is one per cent of pre-tax turnover for the last closed financial year on a first failure and five per cent on recidivism, recovered as a debt due to the State. Arts. 67 to 75 then set specific CIL fines: 5,000,000 to 10,000,000 francs CFA for obstructing the CIL's action in three specified ways; 5,000,000 to 20,000,000 francs CFA for processing without the prior formalities prescribed by the Law, which is the provision that reaches a failure to obtain the art. 31 prior authorisation for decision-support or predictive-artificial-intelligence processing; 5,000,000 to 20,000,000 francs CFA for processing without the precautions needed to preserve data security and 1,000,000 to 10,000,000 francs CFA for communicating data to unauthorised third parties or intentionally accessing files without authorisation; 5,000,000 to 100,000,000 francs CFA for purpose diversion; 5,000,000 to 100,000,000 francs CFA for fraudulent, unfair or unlawful collection, and for health-research processing in breach of art. 36; 2,000,000 to 5,000,000 francs CFA for processing despite a legitimately founded objection; 10,000,000 to 100,000,000 francs CFA for keeping sensitive data in computerised memory without express agreement, and for offence, conviction or security-measure data outside the permitted cases; 5,000,000 to 20,000,000 francs CFA for retaining identifiable data beyond the declared or authorised period, except for State processing; and 5,000,000 to 20,000,000 francs CFA for unauthorised divulgation harming honour, consideration or the intimacy of private life, reduced to 2,000,000 to 5,000,000 francs CFA where committed by imprudence or negligence. Art. 15 is named in none of them, so the route to it is the art. 63 general list including the art. 65 turnover-based flat-rate fine. Art. 76 lets the CIL order confiscation of the material media carrying the data or their erasure, even where the media do not belong to the sanctioned person, and, where it sanctions under arts. 67 to 75, ban the controller from managing any processing personally or through an intermediary for up to two years. Art. 77 lets it order publication of the decision or extracts in one or more newspapers at the sanctioned person's expense. Art. 64 requires sanctions to rest on a report by a CIL member designated by the President, notified to the controller, who may file observations and be represented or assisted at a hearing, requires decisions to be reasoned and notified, and makes sanction decisions appealable to the competent administrative court. Art. 66 lets the President of the CIL, or the person whose rights and freedoms are violated, apply in référé for any measure necessary to safeguard those rights, under astreinte, where the infringement of the Chapitre 2 rights is serious and immediate, and preserves compensation for moral or material damage.