Article 29',
Principle of choice of data processor
Where processing is camed out on behalf of a data controller, the laller must
choose a data processor providing sufficient guarantees, It is the responsibility of
the data controller as well as the data processor to ensure compliance with the
security measures defined in this Supplementary Act
Article 30:
Specific principles
Within the ECOWAS space, it is prohibited to obtain and process data that
reveals the rac'laI, ethnic or regional origin, parentage, po[rlical opinions, religious
or philosophical beliefs, trade union membership, sexual life, genetic data or
more generally data on tha state of health of a data subject.
Article 31:
Exceptions
The prohibition stipulated under (Article 30) shall not apply in the following
instances:
1) processing of personal data relateing to data manifestly made public
by the data subject;
2) the data subject has given his wrttten consent, on whatever medium,
to such processing, and in line with texts in force;
3) processing of personal data is necessary to protect the vital interests
of the data subject or another person where the data subject is
physically or legally incapable of giving consent;
4) processing, in particular of genetic data, is necessary for establishing,
exercising or defending a legal right;
5) where legal proceedings or a criminal investigation is underway;
6) processing of personal data is necessary for reasons of public interest,
in particular for histOrical, staUstical or scientific purposes;
7) for the performance of a contract to which the data subject is a party or
for the application of pre-contractual measures adopted at the request
of the data subject prior to entering into a contract;
8) the processing is necessary for compliance wrth any legal or
regulatory obligation to which the data controller is subject;
9) the processing is necessary for the implementation of a public interest
mission or is carried out by a public authority or is assigned by a public
authortty to the data controller or to a third party to whom iJ1e data is
disclosed;
- 12-