Malabo Convention art. 14(5) — the second country where the automated-decision bar arrives only by treaty
Binds Anyone processing personal data in Namibia, on the Convention's own scope article. Art. 9(1) reaches (a) any collection, processing, transmission, storage or use of personal data by a natural person, the State, local communities and public or private corporate bodies; (b) any automated or non-automated processing of data contained in or meant to be part of a file; and (c) processing carried out in the territory of a State Party or by a controller using means situated on that territory. There is no size, sector or turnover threshold — enterprise, SME and public body alike — and no national supervisory authority stands between the rule and the party it binds, because Namibia has not established one. Hiring, credit scoring and insurance underwriting all sit inside the wording: the bar catches any decision producing legal effects or significantly affecting a person to a substantial degree where it rests solely on automated processing «intended to evaluate certain personal aspects». Two Namibian instruments were checked and neither supplies a competing rule. Article 13(1) of the Constitution gives a right against interference with the privacy of homes, correspondence or communications save as in accordance with law and as necessary in a democratic society — a privacy right, not a data-processing regime, with no automated-decision content. And the Data Protection Bill, drafted in successive versions since 2013 and most recently circulated as the Data Protection Bill 2023, does contain a solely-automated-decision provision with consent and contract exceptions and a human-intervention safeguard — but it has not been enacted. The Ministry of Information and Communication Technology indicated in August 2025 that the Bill was in its final stages and would be tabled between September and October 2025; as at this check no enactment has been traced, and until it is gazetted the Convention is the only automated-decision rule in force in Namibia. When the Bill does pass, art. 144's «unless otherwise provided by ... Act of Parliament» means this row must be superseded rather than duplicated.. Namibia has no data-protection statute in force, and an automated-decision prohibition binds there anyway. Article 14(5) of the African Union Convention on Cyber Security and Personal Data Protection, adopted at Malabo on 27 June 2014, provides that «a person shall not be subject to a decision which produces legal effects concerning him/her or significantly affects him/her to a substantial degree, and which is based solely on automated processing of data intended to evaluate certain personal aspects relating to him/her». Namibia never signed the Convention: on the African Union's own status list its signature column is empty, and it acceded on 25 January 2019, depositing its instrument with the Chairperson of the African Union Commission on 1 February 2019. Reception into domestic law is more direct here than in Mozambique. Article 144 of the Constitution of the Republic of Namibia, in Chapter 21, provides that «unless otherwise provided by this Constitution or Act of Parliament, the general rules of public international law and international agreements binding upon Namibia under this Constitution shall form part of the law of Namibia» — automatic incorporation, with no publication precondition of the kind Mozambique's art. 18 imposes, and Namibia is conventionally described as one of the more thoroughly monist constitutions on the continent for exactly this clause. The qualification to read carefully is «under this Constitution»: art. 63(2)(e) gives the National Assembly the power and function «to agree to the ratification of or accession to international agreements which have been negotiated and signed in terms of Article 32(3)(e)», so incorporation runs through the National Assembly's agreement to accession, not through the executive act alone. The other qualification is the opening words — «unless otherwise provided by this Constitution or Act of Parliament» — which means a future Namibian Data Protection Act could displace art. 14(5) rather than merely supplement it. As in Mozambique, the Convention forbids without ever explaining: art. 16 lists eight information items (a) to (h) and art. 17 four access items, and none of them is an automated-decision or logic item; art. 18 gives objection on legitimate grounds and art. 19 rectification, blocking and erasure. There is no right to human intervention and no right to contest, and no exception of any kind — no contract limb, no consent limb, no legal-authorisation limb.
Force since 8 June 2023, on the Convention's own entry-into-force clause rather than on anything Namibian. Art. 36 provides that the Convention «shall enter into force thirty (30) days after the date of the receipt by the Chairperson of the Commission of the African Union of the fifteenth (15th) instrument of ratification», and there is no separate per-State entry-into-force clause, so a party that deposited before the fifteenth is bound from the collective date and not from its own deposit. On the African Union's status list of 8 July 2024 the fifteenth deposit is Mauritania's, on 9 May 2023; thirty days later is 8 June 2023. Namibia's accession on 25 January 2019 and deposit on 1 February 2019 both precede that comfortably — Namibia is the sixth deposit in date order — so the treaty's own date governs. The same list records 21 signatures, 16 ratifications and 16 deposits out of 55 African Union member states. Confidence is medium, and the reason is domestication rather than dating, exactly as for the Mozambique row this one is modelled on. Article 14 speaks in two registers within a single article: para. 1 is addressed to governments — «State Parties shall undertake to prohibit any data collection and processing revealing racial, ethnic and regional origin...» — a duty to legislate discharged only by passing a law, and art. 8(1) frames the whole personal-data chapter the same programmatic way, as a commitment «to establishing a legal framework». Para. 5 is not drafted that way at all: it states, in the passive and addressed to nobody in particular, a rule about what may be done to a person, and so reads as self-executing where its own para. 1 does not. No Namibian court has been shown to apply it, no domestic instrument repeats it, and no supervisory authority exists to enforce it. What is stronger here than in Mozambique is the reception clause itself: art. 144 incorporates without requiring publication, where Mozambique's art. 18 conditions entry into the domestic order on official publication. What is weaker is that art. 144 is expressly subject to being overridden by an Act of Parliament, and an Act of Parliament on precisely this subject is pending.
Stated maximum penalty — None stated. The Malabo Convention attaches no fine, no imprisonment and no administrative sanction to art. 14(5). Its sanctioning provisions run in the other direction: art. 12(2)(h) empowers the national protection authority to impose administrative and monetary sanctions on data controllers, leaving the amounts to national law, and Namibia has neither established that authority nor legislated any amounts. No monetary range is recorded here rather than one imported from a peer jurisdiction. A Namibian data subject subjected to a solely automated decision therefore has a rule in force and no statutory remedy attached to it; the available routes are constitutional — art. 13 privacy, art. 18 administrative justice, and art. 25 enforcement of fundamental rights before the courts — and none of them is a data-protection penalty. This will change on enactment of the Data Protection Bill, which carries its own enforcement machinery; until then the entry is deliberately silent on quantum. Impact tier: all entities.