3) Data processing by an association or any non-prafrt and fa'ith-based,
philosophical or trade union body, where such data correspond 10 the
object of the association or body, and only concem their members and
are not to be disclosed to third parties.
Article 12:
Types of processing to be executed after authorization
The following shall be subject to authorisation from the data protection
authority:
1) ProcesSing of pef1ional data relating to genetic data and health
research;
2) Processing of personal data relating to offences, sentences, or
security measures;
3) Processing of personal data for the purpose of combining files, as
defined under Arflele 37 of this Supplementary Act;
4) Processiflg relating to a national identification number or any such
other identification:
5) Processing of personal data that includes biometric data;
6) Processing of pef1ioflal data for reasons of public iflterest, in particular
for historical, statistical or scientific purposes.
Article 13:
Referral to the protection Authorlty
Application may be submitted to the data protection Authority by any ifldividual
acting on his own behalf, through his lawyer or by .my other duly-authorized
indiVidual or legal entity.
CHAPTER IV
INSTITUTIONAL FRAMEWORK FOR THE PROTECTION
OF PERSONAL DATA
Article 14:
Establishment
1) Within the ECOWAS space, each Member State shall establish Its own data
protection Authority. AflY State that does not have shall be encouraged to
establish one.
2) The data protection Authority shall be an indepefldenl admiflistrative Authority
responsible for ensuring that personal data is processed in compliance with
the provisions of this Supplementary Act.
- 7-