Loi n° 29-2019 art. 13 — the Directive-shaped bar whose fine arrives only if the controller defies the formal notice
Binds Responsables de traitement and, through art. 12, anyone acting under their authority with access to personal data. The prior-formality regime runs through arts. 32 to 40: art. 32 and art. 33 carry the dispensations from formalities that art. 93 later cross-refers to, arts. 33 to 36 set the declaration regime, and art. 40 governs processing authorised by regulatory act, for which art. 94 requires the Commission to inform the Government so that it may take measures to end an established violation, the Government having fifteen days to report back on the action taken. Neither profiling nor automated decision-making is listed as a category attracting prior authorisation, so Congo imposes no ex ante gate on the processing art. 13 governs. Art. 82 provides for prior consultation of the Commission and arts. 90 and 91 for a data protection officer who must have due regard, in performing their tasks, to the risk associated with processing operations having regard to their nature, scope, context and purposes. The art. 13 bar binds the courts under its first limb and, under its second, every decision-maker whose decision produces legal effects in regard to a natural person, with no size or sector threshold. Impact tier: all entities.. Article 13 of Loi n° 29-2019 du 10 octobre 2019 portant protection des données à caractère personnel is the Republic of the Congo's operative automated-decision rule. It closes Chapitre 1 of Titre II on the principles governing processing, immediately after art. 12, which provides that a person acting under the authority of the controller and having access to personal data may process them only on the controller's instruction, and immediately before art. 14, which governs sensitive data. It has three unnumbered paragraphs and follows the Directive 95/46/EC art. 15 template closely. The first: no judicial decision involving an appraisal of the conduct of a natural person may have as its foundation an automated processing of personal data intended to evaluate certain aspects of their personality. The second: no decision producing legal effects in regard to a natural person may be taken on the sole foundation of an automated processing of personal data intended to define the profile of the person concerned or to evaluate certain aspects of their personality. The third is a deeming clause rather than a true exception: decisions taken in the context of the conclusion or performance of a contract, and for which the person concerned was put in a position to present their observations, and decisions satisfying the requests of the person concerned, are not regarded as taken on the sole foundation of an automated processing. As in Guinea, Madagascar and Gabon, the judicial limb omits the word "seul" that the second limb carries, so a Congolese court appraising conduct may not rest on such a processing at all. The second limb takes the narrow Directive trigger confined to decisions producing legal effects, which places Congo with Gabon, Togo, Senegal, Morocco and Algeria rather than with the wide-trigger group. What distinguishes this row from every other Francophone entry is the thinness of what surrounds it. The Law creates no right to know the logic underlying an automated processing — the words logique, raisonnement and profilage appear nowhere in it — no human-review right, no right to a fresh non-automated decision, and no definition of profiling. Art. 13 is a bare prohibition with a deeming clause and nothing else.
The Law carries no commencement article. Art. 101, its final provision, is a bare publication and execution clause — the present Law shall be published in the Journal officiel de la République du Congo and executed as a law of the State — and nothing in the text defers art. 13. The date recorded here is the date of publication of the gazette in which the Law appears: Journal officiel de la République du Congo n° 45-2019, whose issue date, printed on the running heads of the issue, is Thursday 7 November 2019. The Law itself is dated 10 October 2019 at Brazzaville, over the signatures of President Denis Sassou-Nguesso, Prime Minister Clément Mouamba, the Minister of Justice Aimé Ange Wilfrid Bininga and the Minister of Posts, Telecommunications and the Digital Economy Léon Juste Ibombo, and it is by that promulgation date that it is universally cited. The gazette date is preferred here over the promulgation date because art. 101 attaches publication rather than promulgation, which is the same choice made for Togo. Confidence is medium because the Congolese general publication-to-force rule was not verified against a primary source: if force runs from promulgation rather than from publication the operative date is 10 October 2019, four weeks earlier, and if the general rule adds a clear-days delay after publication it is later. Both candidate dates are long past, so the lifecycle of this row is unaffected either way. Art. 100 is transitional and is not a deferral of art. 13, which is a prohibition rather than a conformance duty: from entry into force, all data processing had to meet the Law's prescriptions within two years where operated for the State, a public establishment, a decentralised administrative entity or a private-law legal person managing a public service, and within one year for everyone else, so the outer conformance window closed in November 2021 on the date recorded here. Art. 99 subjects already-created public-sector processing to a declaration only. The Law abrogates nothing expressly and names no predecessor statute, so nothing is superseded on the tracker. Text read in the Journal officiel itself, published by the Secrétariat général du Gouvernement, covering the whole of the Law from art. 1 to the signature block, including the definitions, the arts. 12 to 14 principles, the arts. 32 to 40 formalities, the arts. 90 and 91 data-protection-officer provisions and the arts. 92 to 101 sanctions and final chapters. No AI-specific statute or guidance is in force in the Republic of the Congo.
Stated maximum penalty — The route to art. 13 is administrative, it is two-step, and the fine is not available for the breach itself. Art. 92 gives the Commission a catch-all first step: it may pronounce a warning against a controller not respecting the obligations flowing from the present Law, and a mise en demeure to cause the breaches concerned to cease within the time limit it fixes. Because that is drafted against the Law's obligations generally rather than against an enumerated list, it reaches art. 13. Art. 93 then supplies the teeth, but only conditionally: if the controller does not comply with the mise en demeure addressed to them, the Commission may, after a contradictory procedure, pronounce a provisional withdrawal of the authorisation granted or a provisional prohibition of processing not exceeding three months, a definitive withdrawal of the authorisation or a definitive prohibition of processing, an injunction to cease the processing where it falls under the declaration regime or benefits from the arts. 32 and 33 dispensations, and a pecuniary fine of one million to one hundred million francs CFA, recovered in accordance with the legislation on the recovery of State debts. A controller that breaches art. 13 and then complies with the resulting mise en demeure is therefore exposed to no fine at all. Art. 94 supplies an urgency track independent of that sequence: where the implementation of a processing or the exploitation of personal data entails a violation of rights and liberties, the Commission may, after a contradictory procedure, decide the interruption of the processing for a maximum of three months, the locking of certain data for a maximum of three months, or the temporary or definitive prohibition of a processing contrary to the Law. Art. 95 requires sanctions to rest on a report by a designated member, notified to the controller, who may file observations and be represented or assisted; art. 96 allows sanctions to be made public and inserted in publications at the sanctioned person's expense; art. 97 opens recourse against the Commission's sanctions and decisions to the Cour suprême. On the penal side the Law creates no offence of its own: art. 98 provides simply that infringements of the provisions of the present Law are provided for and repressed by the Penal Code and by the law on combating cybercrime, which places Congo with Senegal and Burkina Faso as a statute that refers all criminal enforcement out to other instruments.