African Union Legal Instrument
5.
P a g e | 16
Personal data processing undertaken on behalf of the Government, a public
institution, a local community, a private corporate body operating a public service,
shall be in accordance with a legislative or regulatory act enacted after an
informed advice of the protection authority.
Such data processing is related to:
6.
a)
State security, defence or public security;
b)
Prevention, investigation, detection or prosecution of criminal offences, or
execution of criminal convictions or security measures;
c)
Population survey;
d)
Personal data directly or indirectly revealing racial, ethnic or regional origin,
affiliation, political, philosophical or religious beliefs or trade union
membership of persons, or data concerning health or sex life.
Requests for opinion, declarations and applications for authorization shall
indicate:
a)
The identity and address of the data controller or, where he/she is not
established in the territory of a State Party of the African Union, the identity
and address of his/her duly mandated representative;
b)
The purpose(s) of the processing and a general description of its functions;
c)
The interconnections envisaged or all other forms of harmonization with
other processing activities;
d)
The personal data processed, their origin and the category of persons
involved in the processing;
e)
Period of conservation of the processed data;
f)
The service or services responsible for carrying out the processing as well
as the category of persons who, due to their functions or service
requirements, have direct access to registered data;
g)
The recipients authorized to receive data communication;
h)
The function of the person or the service before which the right of access is
to be exercised;
i)
Measures taken to ensure the security of processing actions and of data;
j)
Indication regarding use of a sub-contractor;