Loi 2008-12 art. 48 — no decision with legal effects on the sole basis of automated profiling, and no judicial appraisal of conduct founded on one at all
Binds Responsables du traitement within the scope of art. 2, which subjects to the Law any collection, processing, transmission, storage and use of personal data by a natural person, by the State, by local authorities or by legal persons of public or private law; any processing, automated or not, of data contained in or intended to form part of a file, save the processing excluded by art. 3; any processing implemented by a controller on Senegalese territory or in any place where Senegalese law applies; and any processing implemented by a controller, established in Senegal or not, that resorts to means of processing situated on Senegalese territory, excluding means used only for transit. In that last case the controller must designate a representative established on Senegalese territory, without prejudice to actions that may be brought against the controller itself. Prior formalities are a standing precondition: declaration to the Commission de Protection des Données Personnelles is the default, art. 20 puts health, offence, interconnection, national-identifier, biometric and public-interest processing under prior authorisation, and art. 21 requires a regulatory act taken after the reasoned opinion of the Commission for State, public-establishment, local-authority and public-service processing touching State security, defence, public safety, criminal enforcement, the population census and sensitive data. The first paragraph of art. 48 binds the courts themselves; the second binds any controller taking a decision with legal effects, irrespective of size or sector. Impact tier: all entities.. Article 48 of Loi n° 2008-12 du 25 janvier 2008 portant sur la protection des données à caractère personnel is Senegal's operative automated-decision rule. It sits in Chapitre III among the substantive processing obligations, between the direct-marketing prohibition in art. 47 and the cross-border-transfer regime in art. 49, and it has three paragraphs. The first is absolute and addressed to the courts: no judicial decision involving an appraisal of a person's conduct may have as its foundation an automated processing of personal data intended to evaluate certain aspects of that person's personality — there is no consent, contract or safeguards exception to this limb. The second is the general rule: no decision producing legal effects with regard to a person may be taken on the sole basis of an automated processing of personal data intended to define the profile of the person concerned or to evaluate certain aspects of their personality. The third supplies the only relief and operates by deeming rather than by exemption: decisions taken in the course of the conclusion or the performance of a contract and for which the person concerned has been put in a position to present their observations, and decisions satisfying the requests of the person concerned, are not regarded as taken on the sole basis of an automated processing. The Law carries no definition of profiling, no right to know the logic underlying an automated processing — the art. 58 information list stops at identity, purposes, categories, recipients, whether answering is compulsory, the right to be removed from the file, the existence of access and rectification rights, the retention period and any envisaged foreign transfers — and no right to obtain human intervention or a fresh non-automated decision. The safeguard it names is an opportunity to present observations, and it exists only inside the contractual deeming clause.
The Law contains no commencement article and, in the copy published by the Commission de Protection des Données Personnelles, no publication clause either: the text runs from the exposé des motifs to art. 78, which reserves the application measures for the digitised national identity card to a separate regulation, and stops there. The date recorded is therefore the date the Law itself bears, 25 January 2008. Confidence is medium, and for a reason one step weaker than Morocco's and Algeria's: not only was the Senegalese general publication-to-force rule not read against a primary source, but the date of the Journal officiel de la République du Sénégal carrying the Law could not be established at all, because no Senegalese gazette host resolved this run — jo.gouv.sn and www.jo.gouv.sn both fail to resolve over http and https. Entry into force can therefore only be that date or later. Art. 77 is transitional and not a deferral of art. 48: from the date of entry into force, processing operations carried out for the State, a public establishment, a local authority or a private-law body managing a public service had two years to conform and all other processing had one year, periods that closed in 2010 and 2009 respectively; art. 76 subjects already-created public-sector processing to declaration only, under art. 18. Décret n° 2008-721 du 30 juin 2008 was taken for the application of the Law; no date claim is drawn from it here. Supersession, re-checked 24 August 2026 against three independent official records and found negative. First, the CDP's own legislation index at cdp.sn/legislation/textes-legislatifs is a JavaScript-only single-page application — it serves a 457-byte shell to any non-executing client, which is why it previously read as a dead stub — and when rendered it carries exactly seven legislative texts: Loi n° 2008-12 du 25 janvier 2008 sur la protection des données à caractère personnel, Loi n° 2008-10 (LOSI), Loi n° 2008-08 (transactions électroniques), Loi n° 2008-11 (cybercriminalité), Loi n° 2008-41 du 20 août 2008 (cryptologie), and the two Lois n° 2016-29 and n° 2016-30 du 08 novembre 2016 — and those two amend the Code pénal (Loi 65-60) and the Code de procédure pénale (Loi 65-61) respectively, not Loi 2008-12. There is no text «modifiant et complétant» Loi n° 2008-12 anywhere in the regulator's own index, and Loi 2008-12 is still listed first as the governing statute. Second, the text itself was re-read end to end this run from the PDF the CDP serves out of its own document store: it opens «LOI n° 2008-12 du 25 janvier 2008 portant sur la Protection des données à caractère personnel», carries no «modifiée» marker, and still runs from the exposé des motifs to art. 78, with art. 48 in its three-paragraph form, art. 75 referring infringements to the Code pénal and the cybercrime law, and art. 77 carrying the two-year and one-year transitional periods — so the article this entry describes is verbatim the article in force. Third, the legislative record of the Assemblée nationale for the XVᵉ législature (2024-2029) at assemblee.sn shows no data-protection bill tabled or adopted; the only digital-sector statute in the 2026 session is Projet de loi n° 25/2026 relatif à la protection des Infrastructures d'Information Critiques (IIC) et à la sécurité numérique, adopted unanimously on 20 August 2026 by 127 votes, whose subject-matter is network and system security, operator duties and an Autorité nationale de Cybersécurité — not automated decision-making — and which is not yet promulgated, so it cannot yet displace anything; it is carried as a watch item rather than a supersession. Senegal therefore does NOT have Algeria's defect: art. 48 stands unrepealed and unamended. What is still missing is gazette-level confirmation, and that is a reachability problem rather than a doubt about the text: jo.gouv.sn has no A record at all and www.jo.gouv.sn resolves to 160.0.177.62 but refuses TCP on both 80 and 443 from this egress, so the Journal officiel issue and date carrying the Law still cannot be established, and confidence stays medium for that reason alone. Note also that assemblee-nationale.sn, the obvious guess for the parliament, is a dead host serving a MikroTik RouterOS login page; the live parliamentary site is assemblee.sn, linked from primature.sn. Source, re-verified 26 August 2026. The signed link into the CDP's own document store that this entry carried since 24 August 2026 is dead for every client, not merely for this egress: the store is a Supabase project and the project itself is now restricted, so both the signed object path and its public equivalent answer HTTP 402 with «Service for this project is restricted due to the following violations: exceed_cached_egress_quota». That is a hosting-quota failure at the regulator's end and it takes the whole of cdp.sn's document content with it. The source_url therefore reverts to the Commission de Protection des Données Personnelles' own legislation page, which is the regulator's publication of the Law, is live, and is the page from which a fresh document link is generated in a JavaScript-capable client; it serves a 457-byte shell to a non-executing client because it is a single-page application, which is the reason it was once mistaken for a dead stub. The text was nonetheless read end to end again this run, from the copy of the Law published by the Association francophone des autorités de protection des données personnelles, the association of francophone data-protection authorities of which the CDP is a member, at afapdp.org/wp-content/uploads/2018/05/Senegal-texte-de-loi-2008.pdf. Art. 48 in that copy is verbatim the article this entry describes: «Aucune décision de justice impliquant une appréciation sur le comportement d'une personne ne peut avoir pour fondement un traitement automatisé des données à caractère personnel destiné à évaluer certains aspects de sa personnalité» — then the legal-effects limb over «un traitement automatisé des données à caractère personnel destiné à définir le profil de l'intéressé ou à évaluer certains aspects de sa personnalité» — then the deeming clause for decisions «prises dans le cadre de la conclusion ou de l'exécution d'un contrat et pour lesquelles la personne concernée a été mise à même de présenter ses observations» and those «satisfaisant les demandes de la personne concernée». That copy adds one thing the CDP's copy did not carry: a promulgation formula, «La présente loi sera exécutée comme loi de l'Etat. Fait à Dakar, le 25 Janvier 2008», signed by President Abdoulaye Wade and Prime Minister Cheikh Hadjibou Soumaré, which corroborates the date the entry records. It still carries no commencement article and no Journal officiel number or date, so the gazette gap is unchanged and confidence stays medium. The gazette itself remains unreachable: jo.gouv.sn has no A record, www.jo.gouv.sn resolves to 160.0.177.62 and was retried on 26 August 2026 over plain HTTP, over HTTP/1.1 without h2 in the ALPN offer, and by IP with an explicit Host header, all three timing out; senegalservices.sn, the state service portal that also carries the Law, resolves to 160.0.176.112 and resets the TLS connection at ClientHello on every TLS version offered; and the ILO's NATLEX record for the Law, which would carry the gazette citation, is behind a JavaScript interstitial that answers 403. Coverage symmetry against the twelve African rows already tracked: art. 48 belongs to the Directive 95/46/EC art. 15 line, and within that family Senegal is the closest match to Morocco's art. 11 and Algeria's art. 11 anywhere in Africa — the three share the same three-paragraph shape, the same absolute judicial limb, the same legal-effects threshold on the second limb, and the same contractual deeming clause conditioned on an opportunity to present observations. That makes the Francophone family split cleanly in two: Senegal, Morocco and Algeria keep the Directive's own drafting, while Côte d'Ivoire's art. 25 and Niger's art. 52 take the wider ECOWAS Supplementary Act A/SA.1/01/10 art. 42 drafting, in which the second limb reaches any administrative or private decision appraising human conduct and the legal-effects threshold disappears. Senegal predates the Supplementary Act by two years, which is consistent with that split. The four-way African lineage picture is unchanged: GDPR art. 22 = ke-dpa-s35, ng-ndpa-s37, rw-law058-2021-art21; UK Data Protection Act 1998 s. 12 = gh-dpa-s41, tz-pdpa-s36, ug-dppa-s27; Directive 95/46/EC art. 15 = ma-loi0908-art11, dz-loi1807-art11, ci-loi2013450-art25, ne-loi202259-art52 and now sn-loi200812-art48; Directive-family statute with the automated-decision article absent = Tunisia's Loi organique 2004-63. Source re-verified 27 August 2026, and the citation now reaches primary text again. The reversion to the CDP's legislation index made on 26 August 2026 was the best available then, but it is not primary text: cdp.sn was rebuilt as a Vite/React single-page application whose server answers 200 with the same 457-byte shell to every path, so the index page proves nothing to a non-executing client and carries no law. Reading that application's own bundle (cdp.sn/assets/index-D_qEA75k.js) exposes the six legislative texts it renders as a hard-coded array: the entry for Loi n° 2008-12 points at a signed object in the Supabase project sppsyrftszniuaicadvk, which still answers HTTP 402 «exceed_cached_egress_quota», and the Internet Archive holds no capture of that object — so the regulator's current document store is unusable from any client, not merely this one. The Commission's previous Drupal site, however, served the Law from its own domain at www.cdp.sn/sites/default/files/protection.pdf, and the Internet Archive holds that file from 21 July 2024: 318,186 bytes, content-type application/pdf, and it is the Commission's own copy, not a third party's. It was extracted and read this run. It opens «LOI n° 2008-12 du 25 janvier 2008 portant sur la Protection des données à caractère personnel», carries no «modifiée» marker, runs from the exposé des motifs to art. 78 with no promulgation clause — exactly the copy this entry has always described — and art. 48 reads verbatim: «Aucune décision de justice impliquant une appréciation sur le comportement d'une personne ne peut avoir pour fondement un traitement automatisé des données à caractère personnel destiné à évaluer certains aspects de sa personnalité», then «Aucune décision produisant des effets juridiques à l'égard d'une personne ne peut être prise sur le seul fondement d'un traitement automatisé des données à caractère personnel destiné à définir le profil de l'intéressé ou à évaluer certains aspects de sa personnalité», then the deeming clause for decisions «prises dans le cadre de la conclusion ou de l'exécution d'un contrat et pour lesquelles la personne concernée a été mise à même de présenter ses observations» and those «satisfaisant les demandes de la personne concernée». Art. 77's two-year and one-year transitional periods and art. 78's identity-card reservation are also present as described. The source_url therefore moves to that archived capture of the regulator's own file, which is the same remedy applied to the Central African Republic in commit bc8ef0f: an archived copy of the publisher's own document beats a live page that contains no document. The supersession check is independently reconfirmed by the same bundle — the array of legislative texts the CDP publishes contains Lois 2008-12, 2008-10, 2008-08, 2008-11, 2008-41 and 2016-29/2016-30, the last two amending the Code pénal and the Code de procédure pénale, and nothing «modifiant» Loi 2008-12. Gazette-level confirmation is still absent for the same reachability reason and confidence stays medium: retried 27 August 2026, jo.gouv.sn still has no A record and www.jo.gouv.sn still times out on TCP over both HTTP/1.1 and HTTPS from this egress. Malabo Convention overlay, added 13 September 2026 under the per-country structure decision on AIL-240. Senegal deposited its instrument of ratification of the African Union Convention on Cyber Security and Personal Data Protection (adopted at Malabo, 27 June 2014) on 16 August 2016, and the Convention entered into force on 8 June 2023 under its art. 36 — thirty days after Mauritania's deposit, the fifteenth. Senegal's deposit is the earliest of the sixteen. Art. 14(5) of the Convention states the same solely-automated-decision bar as art. 48 and admits no exception of any kind — no contract limb, no consent limb, no legal-authorisation limb. Art. 48's first two limbs are at least as strict as the treaty, and the judicial limb is stricter, but its third limb is not: the deeming clause, under which a decision taken in the conclusion or performance of a contract and for which the person was put in a position to present their observations, and a decision satisfying the person's own request, are treated as not taken on the sole foundation of automated processing. That is a route out of the prohibition that art. 14(5) does not open, and the opportunity to present observations — the only safeguard art. 48 names — has no counterpart in the Convention either. The national statute is carried here as the operative rule, because it is the instrument that has a supervisory authority behind it and a penalty attached to it, and the Convention runs behind it as a stricter parallel rule. This is recorded as a divergence rather than resolved: neither instrument repeals or qualifies the other, Senegal has not legislated the Convention into domestic law by a separate instrument, and the domestic reception question — whether art. 14(5) is directly effective in Senegal, as arts. 18 and 144 of the Mozambican and Namibian constitutions respectively make it there — has not been separately verified for Senegal and is not asserted here. A controller relying on an exception the statute grants therefore stands on solid statutory ground and unresolved treaty ground. Watch re-polled 13 September 2026 under AIL-263 and the position is unchanged: Projet de loi n° 25/2026 relatif à la protection des Infrastructures d'Information Critiques et à la sécurité numérique is still not promulgated and its text is still not published anywhere reachable, so the art. 75 referral to Loi n° 2008-11 sur la cybercriminalité, on which this entry's penalty field rests, is not yet disturbed. Three independent official records were read. First, the CDP's legislation index — read this run by fetching the single-page application's own bundle rather than rendering it, because the index is a hard-coded array inside cdp.sn/assets/index-D_qEA75k.js — still carries the same seven legislative texts, the newest of which remains Loi n° 2016-30, and nothing on critical information infrastructure. Second, the Assemblée nationale's own record was enumerated gap-free from 19 August to 12 September 2026 through the Laravel API behind assemblee.sn at api.assemblee.sn: the law appears exactly once, as the adoption announcement of 20 August 2026 (publication 2728), whose updated_at is still 20 August 2026 23:52 UTC, and no later publication mentions it, so no transmission or promulgation notice has been posted. Third, the Conseil des ministres communiqués published by the Gouvernement du Sénégal at primature.sn are current to 10 September 2026, and their «Textes législatifs et réglementaires» section — which does report exactly this class of item, as the 29 July 2026 communiqué shows by adopting the two application decrees for the private-security regulator CRASP — mentions neither the law, nor its promulgation, nor any Autorité nationale de Cybersécurité, three weeks after adoption. Two candidate sources were tested and ruled out rather than left implicit: the gazette substitute at primature.sn/publications/lois-et-reglements/lois-et-decrets ceilings at Décret n° 2024-1982 du 13 septembre 2024 and that host's Drupal search returns no results even for control terms, so neither can carry a negative; and ancs.sn, the obvious guess for the Autorité nationale de Cybersécurité, is the Alliance nationale des Communautés pour la Santé, an unrelated health NGO.
Stated maximum penalty — Senegal is the only row on the tracker whose data-protection statute creates no offences of its own. Art. 75, the whole of Chapitre VI, provides that infringements of the Law's provisions are laid down and punished by the Penal Code and by the law relating to cybercrime — Loi n° 2008-11 du 25 janvier 2008 sur la cybercriminalité, adopted the same day — so no penalty figure can be attributed to art. 48 from the data-protection statute itself, and none is asserted here. The route that reaches art. 48 within the Law is administrative and runs through the Commission de Protection des Données Personnelles. Art. 29 lets the Commission issue a warning to a controller that does not respect the obligations arising under the Law and a formal notice (mise en demeure) to end the failures within a period it fixes. Art. 30 provides that if the controller does not comply with the formal notice the Commission may, after an adversarial procedure, pronounce provisional withdrawal of the authorisation granted for three months, at the expiry of which the withdrawal becomes definitive, and a pecuniary fine of 1,000,000 to 100,000,000 francs CFA, recovered under the legislation on recovery of State debts. Art. 31 adds an urgency power where the implementation of a processing or the exploitation of personal data entails a violation of rights and freedoms: after an adversarial procedure the Commission may order interruption of the processing for a maximum of three months, blocking of certain processed data for a maximum of three months, or temporary or definitive prohibition of a processing contrary to the Law. Art. 32 makes the Commission's sanctions and decisions appealable to the Conseil d'Etat. Arts. 25 to 28 supply the inspection powers, exercisable on professional premises under the Code de Procédure Pénale with the Procureur de la République informed in advance, requiring authorisation from the President of the Regional Court where the occupier objects, and recorded in an adversarial procès-verbal.