Loi 2019-014 art. 27 — a judicial limb, a legal-effects limb and a contract carve-out: the Directive 95/46 shape, not the wider ECOWAS one
Binds Responsables du traitement within the scope of art. 2, which subjects to the Law any collection, processing, transmission, storage and use of personal data by a natural person, the State, local authorities or legal persons of public or private law; any processing, automated or not, of data contained in or intended to form part of a file; any processing implemented by a controller on Togolese territory or anywhere Togolese law applies; any processing by a controller established or not in Togo that resorts to means of processing situated on Togolese territory other than for mere transit; and any processing concerning public security, defence, investigation and prosecution of criminal offences or State security, subject to the Law's own derogations. Art. 3 excludes processing by a natural person in the exclusive course of personal or domestic activities where the data are not intended for systematic communication to third parties or dissemination, and temporary copies made in the technical activities of transmission and network access. The formalities are graduated: art. 5 dispenses some processing entirely, art. 6 makes declaration to the Instance de protection the default and provides that only receipt of the récépissé confers the right to implement the processing, art. 7 lets the Instance publish simplified or exempting norms, art. 8 requires prior authorisation for six categories — genetic data and health research, offence and conviction data, file interconnection, national identification numbers, biometric data and public-interest processing — and art. 9 requires a reasoned opinion before regulatory acts for State, public-establishment and public-service processing. Profiling and automated decision-making appear in none of the art. 8 authorisation categories, so unlike Burkina Faso and Niger, Togo imposes no ex ante gate on the processing art. 27 governs. The art. 27 bar binds the courts under its first limb and every decision-maker taking a decision producing legal effects under its second, irrespective of size or sector. Impact tier: all entities.. Article 27 of Loi n° 2019-014 du 29 octobre 2019 relative à la protection des données à caractère personnel is Togo's operative automated-decision rule. It is headed "Du fondement d'une décision de justice" and sits in Chapitre III on the rights of the data subject, between the art. 26 direct-marketing prohibition and the art. 28 cross-border-transfer article, in three unnumbered paragraphs. The first: no judicial decision involving an appraisal of a person's conduct may have as its sole foundation an automated processing of personal data intended to evaluate certain aspects of their personality. The second: no decision producing legal effects with respect to a person may be taken on the sole foundation of an automated processing of personal data intended to define the profile of the person concerned or to evaluate certain aspects of their personality. The third is a deeming carve-out: decisions taken in the context of the conclusion or the performance of a contract, and for which the data subject has been put in a position to present their observations, and decisions satisfying the data subject's requests, are not taken on the sole foundation of an automated processing. Two features place Togo away from its Francophone West African neighbours and alongside Morocco and Algeria. First, the second limb is drafted on the Directive 95/46/EC art. 15 model — its trigger is a decision producing legal effects — and not on the wider ECOWAS Supplementary Act model used by Côte d'Ivoire, Burkina Faso and Niger, whose second limb reaches any administrative or private decision appraising human conduct whatever its effects. Second, the judicial limb carries the word "seul": unlike Côte d'Ivoire's art. 25, Burkina Faso's art. 15 and Guinea's art. 27, a Togolese judicial decision is barred only where the automated processing is its sole foundation. Togo does supply the exception clause that Côte d'Ivoire, Mali and Burkina Faso omit, and it is the Moroccan and Algerian one: contract decisions with an opportunity to present observations, plus decisions satisfying the data subject's own requests. The Law creates no right to know the logic of an automated processing — the art. 39 access right runs to information enabling the data subject to know and to contest the processing, confirmation, communication of the data and their origin, purposes, categories, recipients and envisaged transfers, and nothing more — and no right to obtain human intervention or a fresh non-automated decision. The Law carries no definition of profiling.
Art. 97, the final article, is a bare execution clause — "La présente loi est exécutée comme loi de l'Etat" — and the Law contains no commencement article and defers nothing. The date recorded here, 29 October 2019, is the date carried in the Law's own title and citation and is also the date of the Journal officiel de la République togolaise, 64e année, n° 26 ter, in which it was published. Confidence is medium, and the reason is specific and is recorded here rather than smoothed over: the signature block of the enacted text reads "Fait à Lomé, le 30 octobre 2019" over the signatures of President Faure Essozimna Gnassingbé and Prime Minister Selom Komi Klassou, one day AFTER the date of the gazette issue that carries it. The discrepancy is on the face of the gazette itself and is consistent with the Togolese practice of numbered "ter" special issues, but it means the promulgation date and the publication date cannot both be right as printed, and the Togolese general publication-to-force rule was not read against a primary source either, so it could not be confirmed whether force attaches on publication or after a jour franc. Anyone relying on a one-day margin around 29-30 October 2019 should read the gazette page directly. Art. 96 abrogates all prior contrary provisions but names no statute, so no predecessor is superseded on the tracker. Art. 95 is transitional and is not a deferral of art. 27: from entry into force, processing for the State, a public establishment, a local authority or a private legal person managing a public service had two years to conform and all other processing had one year, periods that closed in 2021 and 2020 respectively; art. 94 additionally reduced pre-existing public-sector processing to a declaration under art. 6. Coverage symmetry against the Francophone rows already tracked: Togo is the seventh member of the Directive 95/46/EC art. 15 family on the tracker and it splits that family further. Morocco's art. 11, Algeria's art. 11 and now Togo's art. 27 take the narrow legal-effects trigger with a contract carve-out; Côte d'Ivoire's art. 25, Mali's art. 2, Burkina Faso's art. 15 and Niger's art. 52 take the wider ECOWAS trigger reaching any administrative or private decision appraising human conduct. Togo is a founding ECOWAS member and its Law postdates the ECOWAS Supplementary Act A/SA.1/01/10 by nine years, yet it did not take the Supplementary Act's wider drafting — which is why each statute in this block is read article by article rather than inferred from membership. Text read page by page in the Journal officiel de la République togolaise of 29 October 2019 as published by the Government of Togo's own gazette service, including arts. 2, 3, 5 to 9, 26 to 28, 38 to 41, 70 to 73, 79 to 93 and 94 to 97.
Stated maximum penalty — No criminal offence attaches to art. 27. The Law's penal chapter is arts. 79 to 93 and every one of its fifteen offences names its own conduct — failure to observe the prior formalities, disregard of a provisional withdrawal of authorisation, disregard of simplified or exempting norms, unauthorised processing of identification data, failure of security measures, fraudulent processing, disregard of the right to object, unlawful processing of sensitive data, of offence data and of health-research data, breach of the retention period, processing of data kept beyond it, diversion of purpose, unauthorised disclosure, and obstruction of the Instance de protection — and none of them reaches an automated decision. Those offences run from three months to five years' imprisonment and from 100,000 to 25,000,000 francs CFA, or one of the two penalties. The route that does reach art. 27 is administrative. Art. 70 lets the Instance de protection des données à caractère personnel issue a warning to a controller not respecting the obligations arising under the Law and a mise en demeure to cease the failures within a period it fixes. Art. 71 provides that where the controller does not comply with that mise en demeure the Instance may, after an adversarial procedure, pronounce a provisional withdrawal of the authorisation for three months which becomes definitive if no corrective measures follow, and a fine which may not exceed 100,000,000 francs CFA, recovered under the legislation on the recovery of State debts. Art. 72 adds urgent measures where implementation of a processing entails a violation of rights and freedoms: interruption of the processing for up to three months, blocking of certain data for up to three months, an injunction to bring the processing into conformity which may carry an astreinte of up to 5,000,000 francs CFA per day except where the State is the controller, and a formal reprimand. Art. 73 adds conservatory measures where a processing is implemented without the prior formalities, including the affixing of seals by a huissier at the controller's expense.