Code du numérique art. 209 — the logic behind the decision must be disclosed, but no decision is ever forbidden
Binds Responsables de traitement — controllers — and their representatives, with sous-traitants (processors) reached through the same Titre. Art. 184 fixes the scope in four limbs and it is unusually wide: the Titre catches the collection, processing, transmission, storage and use of personal data by l'Etat, la Province, Entités Territoriales Décentralisées et Déconcentrées, legal persons of public or private law and natural persons; processing automated or not of data contained in or intended for a file; «le traitement de données mis en œuvre sur le territoire national ou à l'étranger» — processing implemented on the national territory or abroad, with no establishment, targeting or means limb to narrow it; and processing concerning public security, defence, the investigation and prosecution of criminal offences or State security, subject to derogations laid down by other legislation in force. Art. 185 excludes processing by a natural person in the exclusive framework of personal or domestic activities provided the data are not intended for systematic communication to third parties or for dissemination; temporary copies made in the technical activities of transmission and of providing access to a computer network for automatic, intermediate and transitory storage; and processing by competent authorities for the prevention and detection of criminal offences, investigations and prosecutions or the execution of criminal penalties. Impact tier: all entities — art. 209 attaches to every controller subject to the Titre with no employee-count, turnover, sector or high-risk-system threshold, and because the disclosure duty is triggered by the existence of automated decision-making including profiling rather than by a legal-effects threshold, a scoring or profiling deployer owes it even where the DPIA trigger in art. 245 would not bite.. Article 209 of Ordonnance-loi n° 23/010 du 13 mars 2023 portant Code du numérique is the Democratic Republic of the Congo's automated-decision provision, and it is the mirror image of Angola's. The DRC's data-protection Titre is GDPR-template — it carries a délégué à la protection des données, a portability right, and a data-protection impact assessment — but it took the transparency half of the GDPR's automated-decision package and left the prohibition behind. Under art. 209, the natural person whose personal data are processed may ask the controller for, among other things, «l'existence d'une prise de décision automatisée, y compris un profilage, et, au moins en pareils cas, des informations utiles concernant la logique sous-jacente, ainsi que l'importance et les conséquences prévues de ce traitement pour la personne concernée» — the existence of automated decision-making, including profiling, and at least in such cases meaningful information about the underlying logic as well as the significance and the envisaged consequences of that processing for the data subject. The same limb is repeated twice more as an up-front duty rather than an on-request one: art. 220 requires the controller or its representative to give it to the data subject at the latest at the moment of collection, whatever the means and medium employed, and art. 235 requires it where the data were not collected from the data subject. Art. 245 then makes «l'évaluation systématique et approfondie d'aspects personnels concernant des personnes physiques, qui est fondée sur un traitement automatisé, y compris le profilage, et sur la base de laquelle sont prises des décisions produisant des effets juridiques à l'égard d'une personne physique ou l'affectant de manière significative de façon similaire» the first named trigger for a mandatory data-protection impact assessment. What is absent is the GDPR art. 22 analogue. Nothing in the Titre gives a right not to be subject to a decision based solely on automated processing, and there is no human-intervention right and no right to contest the decision after the fact. The rights section, Chapitre VI Section 1, runs from art. 209 through the general opposition right in art. 213 — a right exercisable «à tout moment, pour des motifs légitimes» against processing as such, not against automated decisions as a category — and never reaches a prohibition. Nor is profiling gated ex ante: art. 187 lists the processing operations needing prior authorisation from the Autorité de protection des données — genetic and medical data and research on them, offence and conviction data, national identification numbers and other identifiers of the same nature including telephone numbers, biometric data, and public-interest processing — and automated decision-making and profiling are on none of those limbs; art. 186 leaves them in the ordinary prior-declaration regime. So the DRC and Angola between them bracket the two halves of the GDPR provision: Angola forbids the decision and never makes anyone disclose the logic, the DRC compels disclosure of the logic three times over and never forbids the decision. Impact tier: all entities.
Force, and the date is exact. Art. 390, the final article, provides «La présente ordonnance-loi entre en vigueur à la date de sa promulgation» — the Ordonnance-loi enters into force on the date of its promulgation — and the instrument closes «Fait à Kinshasa, le 13 mars 2023», signed by President Félix-Antoine Tshisekedi Tshilombo and countersigned by Prime Minister Jean-Michel Sama Lukonde Kyenge, so entry into force is 13 March 2023 with no vacatio legis and no phased application. Art. 389 abrogates all earlier provisions contrary to the Ordonnance-loi. Art. 388 carries the only transition: digital-service providers operating on titles obtained before the Ordonnance-loi had six months from entry into force — to 13 September 2023 — to bring themselves into conformity; that window is long closed and it did not defer art. 209 for anyone else. Supersession: none. Text read in the certified copy of the Ordonnance-loi issued by the Cabinet of the President of the Republic — the last page carries the stamp «Pour copie certifiée conforme à l'originale, Le 13 mars 2023, Le Cabinet du Président de la République, Guylain NYEMBO MBWIZYA, Directeur de Cabinet» — which is the same 175-page file the Autorité de régulation publishes on are.gouv.cd (the ARE download page states 45.30 MB against the 47,498,251 bytes of the copy read, i.e. the same file). That satisfies Primary Source First on the same footing as the Angola, Chad and Equatorial Guinea copies. Two independent renderings of the same instrument were used and cross-checked against each other: the certified scan, which is image-only (Flate-wrapped DCTDecode page streams, no text layer) and was read as page images; and a born-digital rendering whose text layer covers arts. 186 to 390 contiguously with no missing article heading, which was used for full-text search. Coverage of the read: arts. 184 scope and 185 exclusions verbatim; art. 186 prior declaration and art. 187 prior authorisation in full; arts. 209 and 210 verbatim in the scan, including the logic-disclosure indent of art. 209(2); arts. 212 and 213 verbatim; arts. 219, 220, 235 and 245 in the text layer; the enforcement chain at arts. 255 to 258; and arts. 383 to 390 verbatim in the scan. The negative finding — no art. 22 analogue — rests on both renderings: a normalised full-text search of arts. 186-390 returns no «ne pas faire l'objet d'une décision», no «décision individuelle», and no occurrence of «automatis» outside the seven hooks listed here, and the rights-section pages were additionally read as images to guard against the lossy-text-layer failure mode that parked Cabo Verde. Confidence high: the disclosure limb was read verbatim in a certified government copy, the entry-into-force clause is explicit and dated on its face, and the sanction route was traced through arts. 255-257 rather than assumed. No AI-specific statute is in force in the DRC and the data-protection Titre neither defines nor separately regulates artificial-intelligence systems; its automated-decision hooks are the three disclosure limbs and the DPIA trigger.
Stated maximum penalty — 8,000,000 to 200,000,000 Congolese francs, but only on the second step — the enforcement chain runs through a mise en demeure and the fine attaches to defying it, not to the underlying breach. Art. 255 lists the manquements under the Titre, among them unfair collection, communication of personal data to an unauthorised third party, collection of sensitive, strategic, offence-related or national-identification-number data without meeting the legal conditions, collection or use of personal data having the consequence of seriously infringing fundamental rights or the intimacy of the data subject's private life, and obstructing an on-site inspection by the services of the Autorité de protection des données. Art. 256 then gives the Autorité a warning against a controller that fails to comply with the obligations flowing from the Titre, and lets it put the controller on formal notice — mise en demeure — to end the established breach within a fixed period «qui ne peut excéder huit jours», not exceeding eight days. Art. 257 is the sanction: where the controller does not comply with the mise en demeure, the Autorité may, respecting the adversarial principle, order (1) payment of eight million to two hundred million Congolese francs where the violation had no serious impact on the State and/or the data subjects; (2) payment of 5% of its annual turnover excluding tax for the closed financial year where the violation led to the death or attempted murder of one or more persons; or (3) an injunction to cease the processing of personal data where the violation endangered national security and safety and/or led to a mass crime or genocide. The turnover limb is drafted to homicide and mass-atrocity outcomes rather than to data-protection gravity, which is unusual and means that in the ordinary case — an undisclosed scoring model — the exposure is the capped 8M-200M CDF band, not a percentage of turnover. Art. 257 also reserves the State's right to bring criminal proceedings against the controller and to claim damages. Art. 258 makes the sanction pronounced by the Autorité appealable. Separately, art. 310 sets the penalties for cybercrime offences as servitude pénale, fine and special confiscation, and art. 311 makes the maximum fine for legal persons five times that for natural persons; those are the cybercrime Livre, not the data-protection Titre, and do not attach to art. 209.