Processes personal data, in Niger

Loi n° 2022-59, arts. 42-50 (données sensibles, de santé, génétiques et biométriques) · Read the law's page

• Do not process data revealing racial, ethnic or regional origin, political opinions, religious or philosophical beliefs, trade-union membership, sex life, health, genetic or biometric data, social measures, or criminal or administrative sanctions, unless the data subject made it manifestly public themselves, gave written consent, or another listed exception applies.
• Obtain the HAPDP's prior authorization before any processing of biometric data, and ensure it responds to a specific, justified necessity with safeguards under this law.
• Process health data only for the listed purposes, such as preventive medicine, diagnosis, care administration, public health, safeguarding vital interests, administering social-protection benefits, a legal claim, or ethics-committee-approved research, and restrict that processing to medical professionals or persons bound by professional secrecy.
• Limit the exchange of health data between health professionals to what coordination or continuity of care strictly requires, and anonymize health data before sharing it or publishing research drawn from it.
• Do not treat an insurer or an employer as an authorized recipient of health data unless a law or regulation specifically allows it.
• Process genetic data only to establish a genetic link in litigation, identify a person in a criminal investigation, for prevention, diagnosis or treatment of the data subject or a biological relative, or for scientific research, and only with the data subject's or their legal representative's consent.
• Restrict processing of data on offences, convictions and security measures to courts, public authorities acting within their powers, and legal professionals acting strictly within their assigned duties.

Loi n° 2022-59, arts. 51-52 (part) et 68-76 (droits des personnes concernées) · Read the law's page

• Give the data subject information about the processing no later than the time you collect their data.
• Let a data subject access their data directly, on-site or by copy, and answer their request; where direct access is impossible for processing touching state security, defence or public safety, route the request through the HAPDP instead.
• Correct, complete, update, lock or erase inaccurate, incomplete, ambiguous or outdated data within one month of a request from the person or a deceased person's heirs.
• Do not use a person's data for direct marketing without their prior consent, and stop processing their data for direct marketing, free of charge, as soon as they object, telling them of that right before you first use or disclose their data for that purpose.
• Erase a person's data on request where consent is withdrawn, the processing purpose has lapsed, the processing is unlawful, or the data concerns a minor, unless a listed retention ground applies.
• Where you have made a person's data public online, take reasonable steps, including technical measures, to tell any third party processing that data to remove links to it, or any copy or reproduction, on the person's request (the right to digital erasure).
• Let a person obtain a temporary freeze on the use of some of their data on request (the right to restriction of processing).
• Give a person a copy of their data in a structured, commonly used, machine-readable electronic format on request, and do not oppose the person transmitting their data to another controller, as far as the state of technology allows.
• Let a person know and contest the information and reasoning used in any processing of their data, automated or not, whose results are used against them, and, where the processing involves artificial intelligence, tell them the criteria and the nature of the personal data behind it from the point of collection.

Loi n° 2022-59, arts. 62-63 (transfert des données vers un autre État) · Read the law's page

• Before transferring personal data to another State, confirm that State ensures a sufficient level of protection for privacy and fundamental rights and freedoms, weighing its data-protection laws and regulations, the existence of a protection authority, applicable international conventions, or HAPDP-approved safeguards.
• Before any transfer, implement technical and organisational security measures, including encryption and measures for availability, confidentiality, integrity and system resilience, and obtain the HAPDP's authorisation for the transfer.
• Expect the HAPDP to be able to withdraw its transfer authorisation at any time if exceptional circumstances arise in the destination country.
• Where the destination State does not ensure adequate protection, transfer personal data only on the data subject's specific, free, informed and unambiguous consent after telling them the risks, or under another listed ground such as a vital or public interest, a law or treaty applied after the HAPDP's opinion, or a HAPDP-approved contract or binding corporate rules.

Loi n° 2022-59, arts. 83 et 86 (notification des violations de données à caractère personnel) · Read the law's page

• Notify the HAPDP of a personal data breach without delay after becoming aware of it, and justify to the HAPDP any notification made outside that timeframe.
• Notify the affected person of a personal data breach as soon as possible when it is likely to create a high risk to their rights and freedoms; you need not notify the person where it is reasonable to believe the breach creates no such risk.
• As a data processor, notify the controller of a personal data breach as soon as possible and no later than 72 hours after becoming aware of it.

Loi n° 2022-59, arts. 87-110 (contrôle, sanctions administratives, dispositions pénales et recours) · Read the law's page

• Comply with a HAPDP warning or formal notice to end a violation within the deadline it sets, or risk provisional or definitive withdrawal of your processing authorisation and a pecuniary sanction.
• Expect the HAPDP to be able to order the interruption of a persistent unlawful processing operation, the locking of the data concerned, or a temporary or permanent ban on the processing, after a contradictory procedure.
• Expect a pecuniary sanction proportional to the seriousness of the violation, capped at 100,000,000 CFA francs, rising to 200,000,000 francs, or, if you are a company, to 5 percent of your previous financial year's turnover excluding tax up to 500,000,000 francs, for a repeat violation within two years.
• Expect criminal liability on top of any pecuniary sanction for specific violations such as illicit processing of sensitive data, purpose diversion, unauthorised disclosure, fraudulent collection, unlawful retention, or obstructing a data subject's rights or the HAPDP, punished by imprisonment and a fine reaching, for the most serious offences, five years and 50,000,000 francs.
• Give a control agent the HAPDP assigns access to the premises and installations where you carry out processing, other than a private home, to verify your compliance.
• Let a data subject complain to the HAPDP, including after an unanswered complaint to you, and expect a judicial remedy independent of that complaint, including urgent injunctive relief for a serious and immediate violation of their rights.

Loi n° 2022-59, protection des données à caractère personnel, du 16 décembre 2022, telle que modifiée par la Loi n° 2023-31 du 4 juillet 2023 et les Ordonnances n° 2024-16 du 26 avril 2024 et n° 2024-29 du 24 juin 2024, arts. 2-5, 29-41, 64-67 et 77-86 (objet, champ d'application, formalités, principes directeurs et outils de conformité) · Read the law's page

• Obtain the data subject's express prior consent before processing their personal data, unless the processing is necessary for a legal obligation, a public-interest or official mission, performance of a contract, or safeguarding the data subject's own vital interests or fundamental rights.
• Collect personal data only for determined, explicit and legitimate purposes, and do not process it later in a way incompatible with those purposes or keep it longer than the purposes require.
• Keep personal data adequate, relevant and accurate, update it where necessary, and correct or erase it once you find it inaccurate or incomplete.
• Collect, record, process, store and transmit personal data lawfully, fairly and without fraud.
• Keep personal data confidential and implement technical and organizational measures against unauthorized access, loss or damage, including pseudonymization, encryption, and data protection by design and by default.
• Complete a prior declaration, authorisation request or advisory request with the HAPDP before implementing a processing operation, and obtain its prior authorisation for genetic, medical, biometric, interconnected, unique-identifier or sensitive-category processing.
• Keep a register of processing operations recording the collection, modification, consultation, disclosure, transfers, interconnection and deletion of personal data, and make it available to the HAPDP on request.
• Carry out a privacy impact assessment before implementing a sensitive or high-risk processing operation the HAPDP requires one for.
• Appoint a data-protection correspondent within your organization and notify the appointment to the HAPDP; a public-sector controller appoints a focal point instead.
• Where two or more controllers jointly determine the purposes and means of processing, define transparently each one's role toward data subjects, who may exercise their rights against each of them.
• Choose a processor that offers sufficient security and confidentiality guarantees, govern its processing under a written confidentiality contract, and hold it to the same obligations that bind you.