Loi n° 2014-038 art. 3 — the wide automated-decision bar stated as a founding principle, with no exception and a 5% turnover catch-all behind it
Binds Responsables de traitement, on the terms of the art. 5 scope: the Law applies to any processing of personal data, automated or not, contained or intended to be contained in files, carried out in whole or in part on Malagasy territory, excluding processing for exclusively personal activities and processing for the sole purposes of journalism or literary or artistic expression. Art. 6 fixes the applicable-law rules. The prior-formality regime runs through Chapitre VI: art. 43 sets the declaration channel and art. 44 the categories reserved to a regulatory act, with art. 76 providing that processing governed by art. 44 and already created is subject only to a declaration. Neither profiling nor automated decision-making appears as a category attracting prior authorisation, so Madagascar, like Guinea and Togo and unlike Burkina Faso and Niger, imposes no ex ante gate on the processing art. 3 governs. The art. 3 bar itself binds two distinct classes of decision-maker with no size or sector threshold: under its first limb the courts, and under its second every administrative and private decision-maker appraising human conduct. Art. 52 provides for a délégué à la protection des données who exercises their functions independently, receives no instructions from the controller and may not be sanctioned for exercising them. Impact tier: all entities.. Article 3 of Loi n° 2014-038 du 9 janvier 2015 sur la protection des données à caractère personnel is Madagascar's operative automated-decision rule, and it is placed as a founding principle rather than as an operative duty: it sits in Chapitre premier, Dispositions générales, immediately after art. 2, which declares that data processing must serve every person and respect human identity, human rights, privacy and individual and public liberties, and immediately before art. 4, which creates the Commission Malagasy de l'Informatique et des Libertés. The article has two unnumbered paragraphs. The first: no judicial decision involving an appraisal of human conduct may have as its foundation an automated processing of personal data intended to define the profile of the person concerned or to evaluate certain aspects of their personality. The second: no administrative and private decision involving an appraisal of human conduct may have as its sole foundation an automated processing of data intended to define the profile of the person concerned or to evaluate certain aspects of their personality. Three features of the drafting matter. The judicial limb does not carry the word "seul", while the second limb of the same article does, so a court appraising conduct may not rest on such a processing at all, whatever else it also relies on. The second limb takes the wide trigger — any administrative and private decision involving an appraisal of human conduct — rather than the narrow Directive 95/46/EC trigger confined to decisions producing legal effects, which is what Congo-Brazzaville, Gabon, Togo, Morocco and Algeria use. And the Law supplies no carve-out whatever: no contract exception, no consent exception, no legal-authorisation exception, and no opportunity to present observations. Madagascar therefore joins Côte d'Ivoire, Mali, Burkina Faso and Guinea in barring the conduct outright rather than deeming some decisions outside it. The Law does create a logic right, but it is narrower than the bar it accompanies: the third indent of the art. 23 access right entitles a data subject to the information enabling them to know and to contest the logic underlying an automated processing where a decision has been taken on its foundation and produces legal effects in their regard. Art. 3's own second limb is not limited to legal effects, so a decision appraising conduct without legal effects is barred by art. 3 while falling outside the art. 23 logic right. There is no human-review right, no right to a fresh non-automated decision, and the Law carries no definition of profiling.
The Law carries no commencement article. Its final provision, art. 78, is a bare publication and execution clause — the present Law shall be published in the Journal Officiel and executed as a law of the State — and nothing in the text defers art. 3 or any other article. The date recorded here, 9 January 2015, is the date of promulgation stamped in the signature block at Antananarivo over the signature of President Rajaonarimampianina Hery Martial, and it is the date by which the Law is universally cited, including in the ILO NATLEX record. The Law is numbered for 2014 and promulgated in 2015 because it was adopted by the National Assembly in 2014 and cleared by the Haute Cour Constitutionnelle first: the preamble recites décision n° 02-HCC/D3 du 07 janvier 2015, two days before promulgation. Confidence is medium for one reason only, and it is the same reason as for Morocco, Algeria and Togo: because art. 78 attaches publication rather than force, the operative date depends on the Malagasy general publication-to-force rule, which was not verified against a primary source, and the Journal Officiel issue and date for the Law could not be established from an official source. If Malagasy law makes force turn on Journal Officiel publication rather than on promulgation, the true date is later than the one recorded here by the length of the publication lag, and the row would need amending. Art. 76 is transitional and is not a deferral of art. 3: all processing implemented before entry into force had one year from publication to conform, on a sectoral timetable fixed by the Commission and published in the Journal Officiel, a period long since closed. Art. 77 leaves application modalities to regulatory texts. The Law abrogates nothing expressly and names no predecessor statute, so nothing is superseded on the tracker. Text read end to end — all 78 articles, from the exposé des motifs to the signature block — in the edition published by the Unité de Gouvernance Digitale, the Malagasy State's digital-governance unit, which serves the full statutory text as HTML and credits CNLEGIS, the State's legislative database, as its source. No AI-specific statute or guidance is in force in Madagascar.
Stated maximum penalty — Art. 3 is not an offence, and none of the penal articles reaches it — but the administrative route does, because art. 55 is a general catch-all. Art. 55 provides that the Commission Malagasy de l'Informatique et des Libertés may pronounce against a controller, in the event of a breach of one or more of the provisions of the present Law and after a contradictory procedure, a warning, a mise en demeure, a pecuniary sanction, and the further measures the article lists, with pecuniary sanctions doubled on recidivism. Because art. 55 is drafted against "une ou plusieurs des dispositions de la présente loi" without enumeration, it reaches art. 3 on its face. Art. 59 caps the pecuniary sanction: its amount must be proportionate to the gravity of the breaches and to the advantages derived from them, and it may not exceed 5 per cent of pre-tax turnover for the last closed financial year — the same ceiling as Côte d'Ivoire, Niger and Burkina Faso, and below Guinea's 7 per cent. Art. 57 allows any sanction decision to be coupled with an injunction to make, within a time limit the Commission sets, any modification or deletion it judges useful. Art. 58 requires the sanction to rest on a report notified to the controller, who may file written and oral observations and be represented or assisted, and provides that sanction decisions may be appealed to the Conseil d'Etat. Art. 60 makes sanction decisions public, allows the identity of natural persons to be anonymised, and lets the Commission order their insertion in publications or newspapers at the sanctioned person's expense. The penal articles, by contrast, are a closed list of named offences and none of them names art. 3: art. 61 punishes obstruction of the Commission with six months to two years' imprisonment and a fine of 800,000 to 8,000,000 Ariary; art. 62 failure to observe prior formalities, six months to two years and 200,000 to 2,000,000 Ariary; art. 63 unlawful processing of sensitive data, offence files or the national identification number by reference to arts. 14, 15, 17 and 18, two to five years and 800,000 to 8,000,000 Ariary; art. 64 breach of the art. 15 security measures; art. 65 unfair collection, two to five years and 1,000,000 to 10,000,000 Ariary; art. 66 misuse of purpose; art. 67 disregard of a founded rectification or objection request; art. 68 breach of the art. 27 information duty; art. 69 breach of the art. 23 access right; art. 70 over-retention; and art. 71 disclosure harming the person's standing or private life, two to five years and 1,000,000 to 10,000,000 Ariary. Art. 72 allows erasure of the data to be ordered in any of those cases and art. 73 requires the Procureur de la République to notify the Commission's president of prosecutions.