Handles health records, in Benin

Loi n°2017-20 du 20 avril 2018, Livre V, arts. 394-404, 407 et 446 (données sensibles et mineurs) · Read the law's page

• Do not process sensitive personal data, including racial or ethnic origin, political opinions, religion or beliefs, trade union membership, genetic data, biometric data used to uniquely identify a person, health data, or data about a person's sex life or sexual orientation, unless a listed exception applies, such as the data subject's explicit consent or data the person has manifestly made public.
• Verify that a minor is at least sixteen years old before processing their personal data in connection with an information society service offered directly to them, and otherwise obtain the consent of the holder of parental responsibility, making reasonable efforts to verify that consent given the technology available.
• Obtain the Autorité's prior authorization before processing personal data covered by Article 394, personal data processed for journalism, research, artistic, or literary purposes under Article 397, a national identification number, or biometric data.
• Do not process personal data about criminal convictions or related security measures except where the law specifically authorizes you to, such as a legal or regulatory obligation, or where it is necessary to manage your own contentious proceedings.
• Designate the categories of staff with access to sensitive personal data, keep that list available to the Autorité, and bind them to confidentiality by a legal, statutory, or contractual obligation.
• Where sensitive personal data is processed solely on the data subject's written consent, tell the data subject beforehand the reasons for the processing and the categories of staff who will access the data, in addition to the standard information notice.
• Do not rely on written consent alone to process sensitive personal data where you are the data subject's present or prospective employer, or where the data subject depends on you in a way that prevents them from freely refusing consent, unless the processing grants them a benefit.