NigerLoi n° 2022-59, données sensibles, de santé et biométriques
Loi n° 2022-59, arts. 42-50 (données sensibles, de santé, génétiques et biométriques)
In force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric
- Audit expectation
- none
What it requires
- Do not process data revealing racial, ethnic or regional origin, political opinions, religious or philosophical beliefs, trade-union membership, sex life, health, genetic or biometric data, social measures, or criminal or administrative sanctions, unless the data subject made it manifestly public themselves, gave written consent, or another listed exception applies.NIST Privacy FrameworkCT.PO-P1
- Obtain the HAPDP's prior authorization before any processing of biometric data, and ensure it responds to a specific, justified necessity with safeguards under this law.NIST Privacy FrameworkGV.PO-P5
- Process health data only for the listed purposes, such as preventive medicine, diagnosis, care administration, public health, safeguarding vital interests, administering social-protection benefits, a legal claim, or ethics-committee-approved research, and restrict that processing to medical professionals or persons bound by professional secrecy.NIST Privacy FrameworkCT.PO-P1
- Limit the exchange of health data between health professionals to what coordination or continuity of care strictly requires, and anonymize health data before sharing it or publishing research drawn from it.NIST Privacy FrameworkCT.PO-P2NIST Privacy FrameworkCT.DP-P2
- Do not treat an insurer or an employer as an authorized recipient of health data unless a law or regulation specifically allows it.NIST Privacy FrameworkCT.PO-P2
- Process genetic data only to establish a genetic link in litigation, identify a person in a criminal investigation, for prevention, diagnosis or treatment of the data subject or a biological relative, or for scientific research, and only with the data subject's or their legal representative's consent.NIST Privacy FrameworkCT.PO-P1
- Restrict processing of data on offences, convictions and security measures to courts, public authorities acting within their powers, and legal professionals acting strictly within their assigned duties.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CT.DP-P2Data are processed to limit the identification of individuals (e.g., de-identification privacy techniques, tokenization).
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 42 to 50 limit when sensitive, health, genetic, biometric and offence data may be processed. Article 42 allows processing on the data subject's written consent in any medium, which is a condition of processing and states no record; article 47 requires health data that identifies a person to be hosted in Niger and bars keeping research data in identifiable form beyond the research, which limit the data and not a log; article 49 puts biometric processing under the HAPDP's prior authorisation, a filing. The register of operations (article 64) and the HAPDP's powers sit in articles this row does not cite.
- Kind
- None
- As of
What this law does
Article 42 prohibits processing data revealing racial, ethnic or regional origin, filiation, political opinions, religious or philosophical beliefs, trade-union membership, sex life, health, morals, genetic or biometric data, social measures, or criminal or administrative sanctions, except where the data subject made it manifestly public themselves, gave written consent, the processing is necessary to establish, exercise or defend a legal claim, or the processing serves the legitimate, members-only activities of a non-profit association.
Article 43 permits collecting and processing health data only for preventive medicine, medical diagnosis, care or health-service administration by a health professional, public-health protection or humanitarian action, safeguarding vital interests where consent cannot be obtained, administering social-protection benefits, a legal claim, or research approved by the National Health Research Ethics Committee, and restricts that processing to physicians or persons bound by professional secrecy.
Article 44 limits the exchange of health data between health professionals to what coordinating or continuing care requires, article 45 bars an insurer or an employer from receiving health data unless a law or regulation specifically authorises it, article 46 conditions health data processing for medical research on the data subject's consent and prior transparent information, and article 47 requires health data to be anonymised before sharing or publication and hosted in Niger where it permits identification.
Article 48 restricts processing genetic data to establishing a genetic link in litigation, identifying a person in a criminal investigation, prevention, diagnosis or treatment of the data subject or a biological relative, or scientific research, and conditions it on the data subject's or their legal representative's consent.
Article 49 requires the HAPDP's prior authorisation before any processing of biometric data, on top of the particular, justified necessity and safeguards the Act demands of it, and article 50 restricts processing data on offences, convictions and security measures to courts, public authorities acting within their powers, and legal auxiliaries acting strictly within their assigned duties.
The Act names no separate rule conditioning a minor's data on a parent's or guardian's consent; a minor's status functions only as a ground for erasure under article 73. Article 113, the closing article, orders publication in the Journal Officiel and execution as a law of the State, but names no day of the Law's own entry into force, and no commencement notice has been located in the Journal Officiel.
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .