MauritaniaLoi n° 2017-020, Autorité de Protection des Données et sanctions
Loi n° 2017-020 du 22 juillet 2017, arts. 64-98 (Autorité de Protection des Données et sanctions)
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Cooperate with the Authority's on-site inspections, and take all measures needed to facilitate its work rather than opposing its action.
- Comply with an Authority warning or formal notice within the period it sets, or face suspension or definitive withdrawal of your processing authorization and a pecuniary fine of up to ten million ouguiya for a first breach, or up to fifty million ouguiya or five percent of turnover for a repeat breach within five years.
- Expect the Authority to interrupt your processing, lock the data, or ban the processing without prior formal notice where it creates an urgent risk to rights and freedoms.
- Expect a sanction the Authority imposes to be published, at your own expense, on the Authority's president's decision.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
One to two months' imprisonment and a fine of 50,000 to 500,000 ouguiya, or either penalty alone, for processing personal data, even negligently, without completing the prior formalities this law requires (art. 85). Separate criminal tiers punish obstructing the Authority's own inspections, one to three months and 100,000 to 1,000,000 ouguiya (art. 84), and unlawfully recording or keeping sensitive personal data without the person's express consent, fifteen days to one month and 50,000 to 500,000 ouguiya (art. 90). Prosecution of an unlawful-disclosure offence under art. 94 requires the victim's own complaint.
Penalty structure
Article 80 caps a repeated breach, within five years of a prior final sanction, at 50,000,000 ouguiya or, for a company, 5% of the last closed financial year's turnover excluding tax; the text does not state in terms whether the higher or the applicable one of the two governs a corporate violator; the higher of the two is the reading applied here. A first breach is capped separately, and lower, at 10,000,000 ouguiya under the same article. This is the Authority's own administrative pecuniary sanction; the criminal fine tiers under arts. 84, 85 and 90 run far lower, from 50,000 to 1,000,000 ouguiya. Amounts are stated in ouguiya as denominated in the statute's 2017 text, before Mauritania's 2018 currency redenomination (ten old ouguiya became one new ouguiya).
- Rule
- Higher of
- As of
- Currency
- MRO
- Fixed cap
- 50,000,000
- Turnover percentage cap
- 5
Who enforces it
Enforcement body
Autorité de Protection des Données à caractère personnel
Settledness
- As of
- Open questions
- Does article 80's 5%-of-turnover ceiling for a corporate violator replace the 50,000,000 ouguiya cap, or does the higher (or the lower) of the two govern?
What it makes you log
Who may demand the log
Regulator
Logging duty
Articles 64 to 98 create the Authority and set its composition, missions, powers and sanctions. Article 73, point 2(d) lets it order verifications of any processing and obtain copies of any document or medium, and article 76 lets its agents demand all documents in any medium, take copies, access programs and data, ask for the transcription of any processing, and draw up a record of the checks and visits. That is a power to inspect and to demand production, not a duty on a controller to keep a record, so no logging duty is stated; the Authority acts when it chooses to. Article 73, point 4 has the Authority keep a public register of processing, which is its own register and not a log the controller keeps. Article 84 makes obstructing the Authority by hiding or destroying documents an offence. No period for keeping any record is stated, and the articles contain no territorial clause, so the hook is empty.
- Kind
- None
- As of
What this law does
Article 64 creates the Autorité de Protection des Données à caractère personnel as an independent public legal person with financial and management autonomy, attached to the Prime Minister, charged with ensuring processing complies with the law and checking that information and communication technologies do not threaten public freedoms or privacy.
Articles 65 through 69 fix the Authority's composition and member appointment by decree, its staff, a four year once renewable mandate, incompatibility with government membership or business leadership, and replacement rules, and articles 70 and 71 bind members to an oath and give them full immunity for opinions expressed in office, free from any authority's instructions.
Article 72 requires ministers, public authorities, and public or private company directors alike to take all measures to facilitate the Authority's work and bars them from opposing its action except where the law provides otherwise.
Article 73 lists the Authority's missions, including receiving prior formalities and complaints, notifying the public prosecutor of offences and suing to enforce the law, ordering verifications, sanctioning a controller under articles 77 and following, answering opinion requests, approving codes of conduct, keeping a public register of processing, advising controllers, setting the conditions for and authorizing cross border transfers, proposing legislative improvements, cooperating internationally, publishing its authorizations, and reporting annually to the Prime Minister, Parliament, and the Minister for electronic communications.
Articles 74 through 76 let the Authority's agents and sworn officers inspect premises used for processing, with the territorially competent prosecutor informed beforehand, and demand and copy any document useful to their mission.
Article 77 lets the Authority warn a controller and give formal notice to end a breach within a set period, and article 78 lets it, after a contradictory procedure, provisionally or definitively withdraw an authorization or impose a pecuniary fine under article 80 where the controller does not comply.
Article 79 lets the Authority, in an emergency threatening rights and freedoms, order the interruption of a processing operation, the locking of data, or a temporary or definitive ban on a processing that violates the law, and article 83 lets any Authority sanction or decision be appealed to the Supreme Court.
Article 80 caps a pecuniary sanction at ten million ouguiya for a first breach, rising to fifty million ouguiya, or, for a company, five percent of the last closed financial year's turnover excluding tax, for a repeated breach within five years of a prior final sanction. Article 82 lets the Authority's president order a sanction published at the sanctioned party's own expense.
Articles 84 through 94 set criminal offences and penalties, including for obstructing the Authority's own inspections, processing personal data without completing the law's prior formalities, collecting personal data by fraudulent or unlawful means, and processing a person's data despite their valid objection, notably to commercial prospecting, and articles 96 through 98 extend criminal liability to a legal person and require the public prosecutor to notify the Authority's president of every prosecution.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .