African Union Legal Instrument
P a g e | 21
b)
Data collection shall be adequate, relevant and not excessive in relation to
the purposes for which they are collected and further processed;
c)
Data shall be kept for no longer than is necessary for the purposes for which
the data were collected or further processed;
d)
Beyond the required period, data may be stored only for the specific needs
of data processing undertaken for historical, statistical or research purposes
under the law.
Principle 4: Principle of accuracy of personal data
Data collected shall be accurate and, where necessary, kept up to date. Every
reasonable step must be taken to ensure that data which are inaccurate or incomplete,
having regard to the purposes for which they were collected or for which they are further
processed, are erased or rectified
Principle 5: Principle of transparency of personal data processing
The principle of transparency requires mandatory disclosure of information on personal
data by the data controller.
Principle 6: Principle of confidentiality and security of personal data processing
a)
Personal data shall be processed confidentially and protected, in particular
where the processing involves transmission of the data over a network;
b)
Where processing is undertaken on behalf of a controller, the latter shall
choose a processor providing sufficient guarantees. It is incumbent on the
controller and processor to ensure compliance with the security measures
defined in this Convention.
Article 14:
Specific principles for the processing of sensitive data
1.
State Parties shall undertake to prohibit any data collection and processing
revealing racial, ethnic and regional origin, parental filiation, political opinions,
religious or philosophical beliefs, trade union membership, sex life and genetic
information or, more generally, data on the state of health of the data subject.
2.
The prohibitions set forth in Article 14.1 shall not apply to the following categories
where:
a)
Processing relates to data which are manifestly made public by the data
subject;
b)
The data subject has given his/her written consent, by any means, to the
processing and in conformity with extant texts;