Data Protection Act 2021 s. 62 — the GDPR-shaped automated-decision bar that no offence backs
Binds Every data controller processing personal data in Zambia. Section 3(1) applies the Act «to the processing of personal data performed wholly or partly by automated means and to any processing otherwise than by electronic means», and s. 3(2) carves out only processing by an individual for personal use — there is no small-entity threshold, no turnover floor and no public/private split, so the bar reaches enterprise, SME and public body alike. Two structural features widen the practical reach well beyond the text of s. 62. First, s. 19(1) makes it an offence to control or process personal data at all without registering as a data controller or data processor, so the population subject to s. 62 is a registered and enumerated one. Second, s. 70(1) requires a data controller to process and store personal data on a server or data centre located in the Republic, with ministerial carve-outs under s. 70(2) and a hard localisation rule for sensitive personal data under s. 70(3) — which means an automated decision about a Zambian data subject is, as a matter of the same statute, expected to be computed on infrastructure inside Zambia. The hiring case is squarely in scope: the s. 2 definition of profiling names «performance at work» first among the aspects it covers, and an automated sift producing a hiring outcome is a decision that at least «similarly affects» the candidate. Credit and insurance scoring fall the same way. What is not in scope is a decision with a human materially in the loop — s. 62(1) catches only decisions «based solely on» automated processing, and the Act supplies no gloss on what degree of human review defeats that.. Section 62(1) of the Data Protection Act, 2021 (Act No. 3 of 2021) provides that «a data subject shall not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning that data subject or similarly affects that data subject». The drafting is GDPR art. 22 read through a Commonwealth pen: it is framed as a prohibition on the outcome rather than as a right the data subject must assert, and its three ways out at s. 62(2) are the familiar ones — (a) necessary for entering into, or performance of, a contract between the data subject and a data controller; (b) authorised by any written law; (c) based on the data subject's explicit consent. Where an exception is used, s. 62(3) requires the controller to implement suitable measures to safeguard the data subject's rights, freedoms and legitimate interests, «including the right to obtain human intervention on the part of the data controller for purposes of enabling the data subject to express the data subject's point of view and contest the decision» — so Zambia carries the full human-intervention, point-of-view and contest triad that the Malabo Convention itself omits. Section 62(4) then adds a separate rule that has no GDPR counterpart in that position: automated data processing shall not be undertaken where the processing involves sensitive personal data unless the data subject has expressly consented, the processing is in the public interest, or it is permitted by any written law with suitable safeguards in place. «Profiling» is defined in s. 2 in GDPR terms — any form of automated processing consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, including analysis or prediction of performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. The explanation limb is reactive rather than proactive. Section 58(2)(d) gives a data subject who is already being processed the right to access «information about the basic logic involved in any automatic processing of data relating to the data in case of automated decision making» — but the s. 64 duty to inform at the point of direct collection runs (a) to (f) and carries no automated-decision item at all, so a Zambian controller must explain the logic when asked and need not volunteer that the decision is automated in the first place. Section 57 is the sleeper: a data controller or data processor «shall notify the Data Protection Commissioner of any third party agreement that allows the third party to trade on the profile of a data subject» — a registration duty on profile-trading that sits in Part VIII and is separate from the s. 62 bar.
In force since 1 April 2021, and the date comes from the commencement instrument rather than from the Act. Section 1 of the Act is a bare enabling clause — «This Act may be cited as the Data Protection Act, 2021, and shall come into operation on the date appointed by the Minister by statutory instrument» — so the assent date of 24 March 2021 that appears on the face of Act No. 3 of 2021 is not the operative date and must not be carried as one. The appointing instrument is Statutory Instrument No. 22 of 2021, the Data Protection Act (Commencement) Order, 2021, made under s. 1 by M. L. Kafwaya, Minister of Transport and Communication, signed at Lusaka on 31 March 2021 and reference MTC.64/9/35. Its para. 2 reads: «The Data Protection Act, 2021, shall come into operation on the date of publication of this Order». The Order was published in the Statutory Instruments of 1st April, 2021 — the date printed in the running head of the gazette pages carrying it — so the whole Act, s. 62 included, has been in force since 1 April 2021. There is no phased or sectioned commencement: SI 22 of 2021 appoints one date for the entire Act, unlike the Mauritian scheme next door, where s. 58(2) of the Data Protection Act 2017 expressly allows different dates for different sections. Zambia deposited its instrument of ratification of the Malabo Convention on 24 March 2021, three months after ratifying on 15 December 2020, so from 8 June 2023 the country is bound both by its own s. 62 and by art. 14(5) of the Convention. The two do not say the same thing, and where they diverge the national statute is the operative rule while the treaty runs behind it: s. 62(2) permits a solely automated decision on the contract, written-law and explicit-consent limbs, and art. 14(5) permits none of the three. Nothing in the Act repeals or qualifies the Convention, and Zambia has not legislated the Convention into domestic law by a separate instrument, so a controller relying on a s. 62(2) exception is in a position that is lawful under the statute and unresolved under the treaty. That tension is recorded rather than resolved here.
Stated maximum penalty — None attaches to s. 62 itself, and tracing that took reading the offence architecture rather than the summaries. The Act penalises by Part, not globally: s. 18(1) makes a body corporate that contravenes Part IV liable to a fine not exceeding one hundred million penalty units or two per cent of annual turnover of the preceding financial year, whichever is higher, and s. 55(1) does the same for Part VIII at two per cent of turnover or two million penalty units, whichever is higher, with s. 55(2) putting a natural person at up to one million penalty units or ten years. Section 62 sits in Part IX (Rights of the Data Subject), and Part IX has no equivalent clause — no section in the Act declares a contravention of Part IX an offence. Section 77, the general penalty, reaches only «a person who commits an offence under this Act for which a specified penalty is not provided», so it presupposes an offence and cannot manufacture one; the widely repeated figure of a fine plus up to three years' imprisonment for automated-decision breaches is s. 77 misapplied. What a data subject actually has is civil and administrative: s. 68, a complaint to the Data Protection Commissioner, whose functions under s. 4(2)(i) include receiving and investigating complaints; s. 69, an appeal to the High Court within thirty days of the Commissioner's decision; and s. 72, compensation from the controller or processor as determined by a court of competent jurisdiction for damage suffered from an infringement of a right under the Act. A profile-trading agreement not notified under s. 57 is likewise unpenalised on its own terms. Impact tier: all entities.