Art. 14 – The processing of personal data is considered legitimate if the person concerned gives his
express consent.
However, there may be exceptions to this requirement of consent when the responsible person of
the processing is duly authorized and the processing is necessary;
-
Either for the compliance with a legal obligation to which the responsible person of the
processing is subject;
-
or for the execution of a task in the public interest or in the exercise of official authority
vested in the responsible person of the processing or the third party to whom the data are
disclosed;
-
or for the execution of a contract to which the concerned person is a party or the execution
of pre-contractual measures taken in the application;
-
or for safeguarding the interests or fundamental rights and freedoms of the concerned
person;
Art. 15 – The collection, recording, processing, storage, transmission and file interconnection of
personal data must be made in a lawful and fair manner.
Art 16 – the data must be collected for specified, explicit and legitimate purposes and cannot be
further processed in a way incompatible with its aims.
They must be adequate, relevant and not excessive in relation to the purposes for which they are
collected and further processed.
They must be kept for a period that does not exceed the period necessary for the purposes for which
they were collected or processed.
Beyond the period required, the data can be subject of a conservation only for responding specifically
to processing for historical, statistical or research purposes under the law.
Art 17 – The collected data must be accurate and, where necessary, kept up to date.
All reasonable measures shall be taken to ensure that inaccurate or incomplete data, with regard to
the purposes for which they were collected and subsequently processed, are erased or rectified.
Art 18 – The principle of transparency requires a mandatory and clear information from the
responsible person on the processing of the personal data.
Art 19 – The personal data must be processed confidentially and shall be protected especially when
the processing of these data include transmission of data over a network.
Art 20 – When the processing of personal data is carried out on behalf of the person responsible for
the processing, he must choose a subcontractor providing sufficient guarantees for the protection
and privacy of data security.
It is the responsibility of the person responsible for the processing as well as the sub-contractor to
ensure compliance with this Law.
Art 21 – Is prohibited and punishable by a term of imprisonment of ten to twenty years and a fine of
20 million to 40 million CFA francs, the proceeds made from the collection and any data processing
revealing racial , ethnic or regional affiliation , political opinions , religious or philosophical beliefs,