MaliLoi n° 2013-015, the Autorité, supervision, and sanctions
Loi n° 2013-015, arts. 20-56, 58-67 (the Autorité, supervision, and sanctions)
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Do not obstruct the Autorité de Protection des Données à Caractère Personnel's action, and take every measure useful to facilitate its work, including its information and on-site inspection missions.
- Expect a warning, a formal notice, an order to cease processing, or withdrawal of your approval where the Autorité finds you at fault, each decision reasoned and notified to you, followed by referral to the Procureur de la République or a criminal complaint where the conduct is also a criminal offence.
- Comply with an administrative sanction decision; the Autorité may use any technical means at its disposal to enforce it, though it may agree to settle a pecuniary sanction with you at your request, within the scales the law fixes.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Article 64 states that, besides the pecuniary sanctions set at articles 65 to 67, custodial criminal sanctions also apply to these offences; article 58 refers the classification of offences and the applicable penalties to the Penal Code, so the Act itself does not state a term of imprisonment.
Penalty structure
Article 65 sets a fine of 5,000,000 to 20,000,000 CFA francs for the most serious violations (unauthorized disclosure of or access to personal data affecting fundamental rights or privacy, purpose diversion, fraudulent collection, unauthorized health-research processing, unlawfully retaining criminal-record data, and obstructing the Autorité's investigations). Article 66 separately sets a fine of 2,500,000 to 10,000,000 CFA francs for security-safeguard failures and for storing racial, ethnic, or political, philosophical, religious, or union opinion data without the person's prior consent.
- Rule
- Fixed only
- As of
- Minimum
- 5,000,000
- Currency
- XOF
- Fixed cap
- 20,000,000
Who enforces it
Enforcement body
Autorité de Protection des Données à Caractère Personnel (APDP)
Settledness
- As of
- Open questions
- Which provisions of the Code pénal fix the custodial penalties for the offences that Articles 65 and 66 fine, given that Article 58 refers the classification of offences and their penalties to the Code pénal and the Act states no term of imprisonment?
- Which conditions of the Code de Procédure Civile, Commerciale et Sociale and the Régime Général des Obligations govern the civil action that Article 60 preserves for a person harmed by a breach of the Act?
What it makes you log
Logging duty
Articles 20 to 56 and 58 to 67 set up the Autorité and its supervision and sanctions. The only duty on a controller is not to oppose the Autorité's action and to facilitate its task (Article 37), which asks for no log or record. The records these articles do mention are the Autorité's own: minutes of its decisions (Article 44), receipts for requests and complaints (Article 46) and the public list of declared processing (Articles 31 and 33). The Autorité may order information or on-site inspection missions (Article 34) and holds all means of control over public bodies' data (Article 55), a power exercised at its own discretion, so the audit is on request, performed by the regulator, and produces no report owed by the controller. The declaration of processing sits in Article 57, which this row does not cite.
- Kind
- None
- As of
What this law does
Article 20 creates the Autorité de Protection des Données à Caractère Personnel (APDP) as an independent administrative authority, and articles 21 through 52 set its fifteen-member composition, its bureau, its sessions, and the resources the State must give it.
Article 31 charges the Autorité with setting the norms and purposes for collecting, processing, or retaining personal data, authorizing interconnections and transfers, informing and advising data subjects and controllers of their rights and duties, receiving complaints, carrying out the checks necessary for lawful processing, imposing administrative sanctions for a controller's breach of its obligations, referring to the Procureur de la République without delay any offence involving fraudulent manipulation of personal data that comes to its knowledge, keeping the public register of processing operations, and advising on any bill or decree touching personal-data protection.
Article 34 lets the Autorité receive and investigate complaints and decide on information or on-site inspection missions, and article 37 bars anyone from opposing the Autorité's action and requires them to take every measure useful to facilitate its work. Article 56 lets the Autorité's President refer any user in breach of the Act to the Procureur de la République, or file a complaint before the competent courts, for the criminal sanctions the law in force provides.
Article 61 lists the administrative sanctions the Autorité may impose: a warning to a controller acting in good faith who failed to observe administrative formalities, a formal notice to a controller at fault to bring it into compliance, an order to cease processing activities, and withdrawal of a controller's approval where the Autorité finds it necessary; article 62 lets the Autorité use any technical means at its disposal to enforce its decision, article 63 requires an administrative sanction decision to be reasoned on pain of nullity and notified to the party concerned, and article 67 lets the Autorité settle any pecuniary sanction with the offender at the offender's request, within the scales the law fixes.
Article 60 leaves civil action to the conditions the Code de Procédure Civile, Commerciale et Sociale and the Régime Général des Obligations set. Article 64 states that, besides the pecuniary sanctions of articles 65 to 67, custodial criminal sanctions also apply to these offences, and article 58 refers the classification of offences and applicable penalties to the Penal Code.
Article 65 fines the most serious violations, including unauthorized disclosure of or access to personal data affecting fundamental rights, individual freedoms, or privacy, purpose diversion, fraudulent collection, unauthorized health-research processing, unlawfully retaining offence or conviction data, and obstructing the Autorité's investigations, five million to twenty million CFA francs, and article 66 fines security-safeguard failures and storing racial, ethnic, or political, philosophical, religious, or union opinion data without the person's prior consent two million five hundred thousand to ten million CFA francs.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .