Malabo Convention art. 14(5) — the automated-decision bar that binds by treaty, in a country with no data-protection law
Binds Anyone processing personal data in Mozambique. The Convention's scope article, art. 9(1), reaches (a) any collection, processing, transmission, storage or use of personal data by a natural person, the State, local communities and public or private corporate bodies; (b) any automated or non-automated processing of data contained in or meant to be part of a file; (c) any processing of data undertaken in the territory of a State Party; and (d) processing relating to public security, defence, research, criminal prosecution or State security, subject to exceptions in other extant laws. Art. 9(2) excludes purely personal or household processing not systematically communicated to third parties, and temporary technical copies made for network transmission. The territorial hook at art. 9(1)(c) is a processing-in-territory test, narrower than the GDPR art. 3 targeting test Cabo Verde adopted in 2021 and narrower than the Democratic Republic of the Congo's art. 184, which reaches processing carried out abroad; a foreign scoring or hiring-assessment operator with no processing activity in Mozambique is not obviously caught. Impact tier: all entities — art. 14(5) carries no employee-count, turnover, sector or high-risk-system threshold, and its «intended to evaluate certain personal aspects» trigger is the classical Directive 95/46/EC art. 15(1) formula that reaches credit scoring, hiring assessment and conduct profiling alike. The practical qualification is enforcement rather than scope. Almost all of the Convention's machinery is routed through a «national protection authority»: art. 10(2) makes processing subject to a declaration before it, art. 10(4) makes genetic, health-research, offence, file-interconnection, national-identifier and biometric processing subject to its prior authorisation, art. 12 gives it audit and sanctioning powers, and art. 14(6)(b) makes it the gate for third-country transfers. Mozambique has not established one. The Autoridade Nacional de Proteção de Dados is to be created by the Proposta de Lei approved by the Council of Ministers on 3 March 2026 and still before the Assembleia da República. Until it exists, the substantive rule at art. 14(5) stands without an administrative enforcer, and the realistic routes are constitutional (art. 71 of the Constitution restricts the use of informatics for recording and processing individually identifiable data) and ordinary civil liability.. Mozambique has no national data-protection statute, and yet a solely-automated-decision prohibition binds there — it arrives by treaty rather than by legislation. Article 14(5) of the African Union Convention on Cyber Security and Personal Data Protection, adopted at Malabo on 27 June 2014, provides that «a person shall not be subject to a decision which produces legal effects concerning him/her or significantly affects him/her to a substantial degree, and which is based solely on automated processing of data intended to evaluate certain personal aspects relating to him/her». Mozambique signed on 29 June 2018, ratified on 2 December 2019 by Resolução n.º 5/2019 of the Assembleia da República, and deposited its instrument with the Chairperson of the African Union Commission on 21 January 2020. Under art. 18 of the Constitution of the Republic of Mozambique, validly approved and ratified international treaties are in force in the Mozambican legal order after official publication and for as long as they bind the State internationally, with the same rank as infra-constitutional acts of the Assembly and the Government — so the Convention is domestic law in Mozambique, not merely an international undertaking. The drafting of art. 14 is the thing to read closely, because the same article speaks in two registers. Paragraph 1 is addressed to governments: «State Parties shall undertake to prohibit any data collection and processing revealing racial, ethnic and regional origin...» — a duty to legislate, discharged only by passing a law. Paragraph 5 is not framed that way at all. It states a rule about what may be done to a person, in the passive voice, addressed to nobody in particular, and it therefore reads as self-executing in a way paragraph 1 does not. That split inside one article is why this row is carried at medium confidence rather than high: the obligation is real and its wording is direct, but no Mozambican court has been shown to apply it and no domestic instrument repeats it. What the Convention conspicuously does not do is explain. The bar has no exceptions — no contract limb, no consent limb, no legal-authorisation limb, unlike art. 15(2) of Directive 95/46/EC from which it descends and unlike every Lusophone and Francophone row on the tracker — so on its face it is the most absolute automated-decision prohibition tracked anywhere. But art. 16, the right to information, lists eight items (a)-(h) — identity, purposes, categories, recipients, removal, access and rectification, retention period, proposed transfers — and none of them is an automated-decision or logic item. Art. 17, the right of access, lists four items and carries neither. Art. 18 gives a right to object on legitimate grounds; art. 19 gives rectification, blocking and erasure. There is no right to obtain human intervention, no right to contest the decision, and no logic disclosure anywhere in the Convention. Mozambique is therefore the Angola shape reached by a different road: the machine decision is forbidden and never has to be explained. Impact tier: all entities.
Force since 8 June 2023, and the date is computed from the instrument rather than taken from a summary. Art. 36 (Entry into Force) provides that the Convention «shall enter into force thirty (30) days after the date of the receipt by the Chairperson of the Commission of the African Union of the fifteenth (15th) instrument of ratification». There is no separate per-State entry-into-force clause, so the Convention entered into force on the same day for every State that had already deposited, Mozambique included. On the African Union's own status list (dated 8 July 2024, the depositary's record), the deposits in chronological order are Senegal 16/08/2016, Mauritius 14/03/2018, Guinea 16/10/2018, Namibia 01/02/2019, Ghana 03/06/2019, Rwanda 21/11/2019, Mozambique 21/01/2020, Angola 11/05/2020, Congo 23/10/2020, Zambia 24/03/2021, Togo 19/10/2021, Cape Verde 05/02/2022, Niger 16/03/2022, Côte d'Ivoire 03/04/2023, Mauritania 09/05/2023 and São Tomé & Príncipe 15/02/2024. Mauritania is the fifteenth; thirty days after 9 May 2023 is 8 June 2023, which is the date carried here. Mozambique's own dates on that list are signature 29/06/2018, ratification 02/12/2019 and deposit 21/01/2020 — all three earlier than entry into force, which is why the treaty's date governs and not the deposit. The ratifying instrument is Resolução n.º 5/2019 of the Assembleia da República, whose subject the Imprensa Nacional de Moçambique — the state printer that publishes the Boletim da República — records verbatim in its catalogue as ratifying the African Union Convention on Cybersecurity and Personal Data Protection adopted at the 23rd Ordinary Session in Malabo on 27 June 2014. Secondary Mozambican legal commentary dates that Resolução to 20 June 2019 and places it in Boletim da República I Série n.º 119; the Imprensa Nacional catalogue page itself interleaves citations across adjacent items and attributes a 2023 Boletim reference to this 2019 Resolução, so the gazette page number is not asserted here and the Resolução's own text was not read. That gap does not touch the date carried, which comes from art. 36 and the depositary's list, nor the substance, which comes from the Convention text. Confidence medium, and the reason is domestication rather than dating: art. 8(1) frames the Convention's personal-data chapter as a commitment by each State Party «to establishing a legal framework», which is an argument that the chapter as a whole is programmatic, while art. 14(5) is drafted as a directly-worded rule and art. 18 of the Constitution receives ratified treaties into the domestic order with statutory rank. No national implementing law exists, no supervisory authority exists, and no penalty attaches. What Mozambique does have is not a substitute. Lei n.º 3/2017, de 9 de Janeiro (Lei de Transacções Electrónicas) carries a personal-data chapter at arts. 63-65 — accuracy and purpose limitation, notice on indirect collection, security, access, reasoned refusal and objection at art. 63(6), a bar on cross-institution sharing at art. 64, and a designated responsible individual at art. 65 — and none of it touches automated decisions or profiling; the words «perfil» and «perfis» do not occur in the Law, and every occurrence of «automatizado» is the UNCITRAL automated-message-system vocabulary of arts. 35, 37 and 40 about contract formation, input errors and automated calling systems, not about decisions taken on people. INTIC, the national ICT institute, publishes the same enumeration of the country's current data-protection framework — Constitution art. 71, Lei 3/2017 arts. 63-65, Decreto n.º 67/2017 on e-government interoperability, and the regulation on intermediate electronic service providers — and none of those instruments regulates automated decision-making. Watch item: the Proposta de Lei establishing the Regime Jurídico de Proteção de Dados Pessoais was approved by the Council of Ministers at its 6th ordinary session on 3 March 2026 and sent to the Assembleia da República; it creates the ANPD and, if gazetted, will supersede this row's basis with a domestic one. Two further Mozambican laws were published in the Boletim da República on 1 July 2026 and take effect on 29 September 2026 — Lei n.º 13/2026 on cybersecurity and Lei n.º 14/2026 on cybercrime — neither of which has been read in full here and neither of which is claimed to carry an automated-decision or AI obligation. Coverage symmetry: art. 14(5) binds all sixteen States that have deposited, and eleven of them already carry a national row on the tracker (Senegal, Guinea, Ghana, Rwanda, Angola, Congo-Brazzaville, Togo, Cabo Verde, Niger, Côte d'Ivoire, São Tomé e Príncipe), where the national statute is the operative rule and this treaty is background. The four remaining parties — Mauritius, Namibia, Zambia and Mauritania — are not yet tracked and are recorded as a follow-up coverage gap; Namibia in particular has no national data-protection statute and is expected to be the same shape as this row. Guinea-Bissau is a closed negative on the same sweep: it signed the Convention on 31 January 2015 but has never ratified it, has no data-protection law and no data-protection authority, and the legislation index of ARN, its national regulator, lists only the 2013 telecommunications decrees.
Stated maximum penalty — None stated, and that is the honest answer rather than an unresearched one. The Malabo Convention attaches no fine, no imprisonment and no administrative sanction to art. 14(5). Its sanctioning provisions run the other way: art. 12(2)(h) empowers the national protection authority to impose administrative and monetary sanctions on data controllers, but leaves the amounts to national law, and Mozambique has neither designated an authority nor set amounts. The Convention's own penal content sits in Chapter III on cybercrime — offences against computer systems and computerised data — and does not reach the automated-decision rule. Nor does domestic Mozambican law supply a figure: Lei n.º 3/2017's Chapter X on inspection and contraventions attaches to that Law's own duties, not to the Convention's, and art. 14(5) has no counterpart in it. The practical consequence for a deployer is that art. 14(5) is a rule of conduct without a tariff: the exposure is a civil claim, a constitutional challenge under art. 71 of the Constitution, or the retrospective risk that the pending Proposta de Lei, once enacted, gives the new Autoridade Nacional de Proteção de Dados both a domestic prohibition and a penalty band to apply. This entry deliberately records no monetary range rather than importing one from a peer jurisdiction.