Processes biometric data, in Niger

Loi n° 2022-59, arts. 42-50 (données sensibles, de santé, génétiques et biométriques) · Read the law's page

• Do not process data revealing racial, ethnic or regional origin, political opinions, religious or philosophical beliefs, trade-union membership, sex life, health, genetic or biometric data, social measures, or criminal or administrative sanctions, unless the data subject made it manifestly public themselves, gave written consent, or another listed exception applies.
• Obtain the HAPDP's prior authorization before any processing of biometric data, and ensure it responds to a specific, justified necessity with safeguards under this law.
• Process health data only for the listed purposes, such as preventive medicine, diagnosis, care administration, public health, safeguarding vital interests, administering social-protection benefits, a legal claim, or ethics-committee-approved research, and restrict that processing to medical professionals or persons bound by professional secrecy.
• Limit the exchange of health data between health professionals to what coordination or continuity of care strictly requires, and anonymize health data before sharing it or publishing research drawn from it.
• Do not treat an insurer or an employer as an authorized recipient of health data unless a law or regulation specifically allows it.
• Process genetic data only to establish a genetic link in litigation, identify a person in a criminal investigation, for prevention, diagnosis or treatment of the data subject or a biological relative, or for scientific research, and only with the data subject's or their legal representative's consent.
• Restrict processing of data on offences, convictions and security measures to courts, public authorities acting within their powers, and legal professionals acting strictly within their assigned duties.

Loi n° 2022-59, protection des données à caractère personnel, du 16 décembre 2022, telle que modifiée par la Loi n° 2023-31 du 4 juillet 2023 et les Ordonnances n° 2024-16 du 26 avril 2024 et n° 2024-29 du 24 juin 2024, arts. 2-5, 29-41, 64-67 et 77-86 (objet, champ d'application, formalités, principes directeurs et outils de conformité) · Read the law's page

• Obtain the data subject's express prior consent before processing their personal data, unless the processing is necessary for a legal obligation, a public-interest or official mission, performance of a contract, or safeguarding the data subject's own vital interests or fundamental rights.
• Collect personal data only for determined, explicit and legitimate purposes, and do not process it later in a way incompatible with those purposes or keep it longer than the purposes require.
• Keep personal data adequate, relevant and accurate, update it where necessary, and correct or erase it once you find it inaccurate or incomplete.
• Collect, record, process, store and transmit personal data lawfully, fairly and without fraud.
• Keep personal data confidential and implement technical and organizational measures against unauthorized access, loss or damage, including pseudonymization, encryption, and data protection by design and by default.
• Complete a prior declaration, authorisation request or advisory request with the HAPDP before implementing a processing operation, and obtain its prior authorisation for genetic, medical, biometric, interconnected, unique-identifier or sensitive-category processing.
• Keep a register of processing operations recording the collection, modification, consultation, disclosure, transfers, interconnection and deletion of personal data, and make it available to the HAPDP on request.
• Carry out a privacy impact assessment before implementing a sensitive or high-risk processing operation the HAPDP requires one for.
• Appoint a data-protection correspondent within your organization and notify the appointment to the HAPDP; a public-sector controller appoints a focal point instead.
• Where two or more controllers jointly determine the purposes and means of processing, define transparently each one's role toward data subjects, who may exercise their rights against each of them.
• Choose a processor that offers sufficient security and confidentiality guarantees, govern its processing under a written confidentiality contract, and hold it to the same obligations that bind you.