Loi n° 2017-020 art. 19 — the pre-GDPR bar with no exception at all, and a judicial limb the others do not have
Binds Every controller within art. 3, which sets four cumulative reaches: any processing of personal data carried out by a natural person, by the State, by local authorities, or by legal persons of public or private law; any automated or non-automated processing of data contained in or intended to figure in a file, excepting the processing at art. 4; any processing implemented by a controller on Mauritanian territory or anywhere Mauritanian law applies; and any processing implemented by a controller, established on Mauritanian territory or not, that has recourse to processing means situated on the national territory. That last limb is the means-in-territory test rather than the GDPR's targeting test, so a foreign controller computing an automated decision on Mauritanian infrastructure is caught while one scoring Mauritanian residents entirely from abroad may not be. No size or sector threshold applies — enterprise, SME, public body and individual controllers alike. The first paragraph of art. 19 binds a different addressee entirely: the courts, and by extension anyone submitting automated behavioural assessment into judicial proceedings. Hiring sits inside the second paragraph only where the outcome produces legal effects — the termination or refusal of a contract of employment does; a ranked shortlist on its own is harder to place, and the Law gives no gloss. Two neighbouring articles matter for scope: art. 12 prohibits collection and processing revealing racial, ethnic, linguistic or regional origin, filiation, political opinions, religious or philosophical convictions, trade-union membership, sexual life, genetic data or health data, subject to the art. 13 exceptions, so a profiling model drawing on those inputs fails at art. 12 before art. 19 is reached; and art. 18 requires prior consent for direct marketing by any means of communication.. Article 19 of Loi n° 2017-020 du 22 juillet 2017 sur la protection des données à caractère personnel is two paragraphs, and the first has no counterpart in any other row on the tracker. It provides that «aucune décision de justice impliquant une appréciation sur le comportement d'une personne, ne peut avoir pour fondement un traitement automatisé des données à caractère personnel destiné à évaluer certains aspects de sa personnalité» — no judicial decision involving an assessment of a person's conduct may be founded on automated processing of personal data intended to evaluate certain aspects of their personality. That is a rule addressed to courts, not to controllers, and it bars algorithmic input into sentencing, bail and any other judicial appraisal of behaviour outright. The second paragraph is the general bar: «aucune décision, produisant des effets juridiques à l'égard d'une personne, ne peut être prise sur le seul fondement d'un traitement automatisé des données à caractère personnel destiné à définir le profil de l'intéressé ou à évaluer certains aspects de sa personnalité» — no decision producing legal effects with respect to a person may be taken on the sole basis of automated processing intended to define that person's profile or to evaluate certain aspects of their personality. This is art. 2 of France's Loi n° 78-17 in its pre-2018 wording, carried across whole, and it is the pre-GDPR shape in three respects. It has no exception limb of any kind — no contract, no consent, no legal authorisation, nothing — so on its face it is as absolute as art. 14(5) of the Malabo Convention. It has no profiling definition; «définir le profil» does the work as an ordinary-language phrase. And its threshold is narrower than the modern one: it catches decisions producing «effets juridiques» only, with no «significantly affects» limb, so a purely commercial automated refusal with no legal effect falls outside the second paragraph even where it would be caught in Zambia, Mauritius or under the Convention. There is no explanation limb anywhere in the Law. The art. 53 right of access runs to five items — information allowing the person to know and where appropriate contest the processing, confirmation, communication of the data in accessible and intelligible form, purposes and categories and recipients, and envisaged third-country transfers — and none of them is a logic item; the information duty at collection runs to nine items ending at the right to ask to be removed from the file, and carries no automated-decision item either. There is no right to human intervention and no right to contest the decision as such. Mauritania is the Angola shape at a different latitude: the machine decision is forbidden and never has to be explained.
Dated 22 July 2017 and published in the Journal Officiel de la République Islamique de Mauritanie no. 1400 of 15 November 2017, which is the date printed in the running head of every page of the official text. Article 101 is the standard promulgation formula — «La présente loi sera exécutée comme loi de l'Etat et publiée au Journal Officiel de la République Islamique de Mauritanie» — signed at Nouakchott on 22 July 2017 by President Mohamed Ould Abdel Aziz, Prime Minister Yahya Ould Hademine and the Minister for Employment, Vocational Training and Information and Communication Technologies. There is no deferred commencement clause and no proclamation power, so the law date is carried here, consistent with how every other Francophone row on the tracker is dated. Two qualifications keep this row at medium rather than high confidence, and neither is about the text of art. 19. First, arts. 99 and 100 create a transitional regime that runs from a compound trigger: «à compter de la date d'entrée en vigueur de la présente loi et de la mise en place effective de l'Autorité de Protection des Données à caractère personnel», existing processing had three years to conform where operated for the State, a public establishment, a local authority or a private legal person managing a public service, and two years otherwise, with art. 100 deeming unregularised processing to have been carried on without declaration or authorisation. The Autorité de Protection des Données à caractère personnel was not stood up in 2017 — its members were sworn in years later — so the transitional clock started late, and while art. 19 is a prohibition rather than a formality subject to régularisation, an enforcement action grounded on the pre-authority period would meet that argument. Second, the currency. The fines in this Law are stated in ouguiyas as they stood in 2017; Mauritania redenominated on 1 January 2018 at ten old ouguiya (MRO) to one new ouguiya (MRU), so every figure in the Law reads ten times larger than its present-day equivalent unless converted. Mauritania deposited its instrument of ratification of the Malabo Convention on 9 May 2023, and that deposit is the fifteenth — it is the instrument that triggered art. 36 and brought the Convention into force for every party on 8 June 2023. So Mauritania is both bound by art. 14(5) and the reason art. 14(5) binds anyone. Where the two diverge they diverge very little: neither art. 19 nor art. 14(5) admits any exception, and the only real gap is that the Convention adds a «significantly affects to a substantial degree» limb that art. 19's «effets juridiques» threshold does not reach.
Stated maximum penalty — Administrative only, and no criminal penalty attaches to art. 19. The penal section, arts. 84 to 98, was read article by article: art. 84 obstruction of the Authority, art. 85 processing without the prior formalities, art. 86 processing subject to an art. 77, 78 or 79 measure, art. 87 collection by fraudulent, unfair or unlawful means, art. 88 processing without the required security measures, art. 89 processing despite the person's opposition, art. 90 storing sensitive data without express consent, arts. 91 to 94 retention beyond purpose, diversion of purpose and breach of confidentiality. None of them names art. 19 and no article of the Law cross-refers to it, so a solely-automated decision is not, on its own, an offence in Mauritania. What does reach it is art. 80: for breaches of the legal and regulatory provisions on personal data, and beyond the measures at arts. 77 to 79 (warning, mise en demeure, provisional or definitive withdrawal of authorisation, interruption of processing for up to three months, blocking of data), the Authority may impose pecuniary sanctions proportionate to the gravity of the breach — on a first breach not exceeding ten million ouguiyas, and on a repeat breach within five years of a previous sanction becoming final not exceeding fifty million ouguiyas or, for an undertaking, 5% of pre-tax turnover for the last closed financial year. Read in post-redenomination currency those ceilings are MRU 1,000,000 and MRU 5,000,000 respectively. Article 82 permits publication of the sanction at the sanctioned party's expense; art. 83 gives a right of appeal to the Cour Suprême. Article 96 makes legal persons other than the State, local authorities and public establishments criminally liable for offences under the Law committed on their behalf, and art. 97 sets corporate fines at five times the natural-person maximum, with dissolution available — but that machinery hangs off the penal articles, which art. 19 is not among. Impact tier: all entities.