According to paragraph 4 OECD Privacy Framework, exceptions to the guidelines can be provided for purposes of national sovereignty, national security and
public policy. These exceptions should be as few as possible and should be made
known to the public.
According to article 30 ECOWAS Supplementary Act, it is prohibited to obtain
and process specific types of data. But there are exceptions in article 31:
The prohibition stipulated under (Article 30) shall not apply in the following instances:
1) processing of personal data relating to data manifestly made public by the data subject;
2) the data subject has given his written consent, on whatever medium, to such processing,
and in line with texts in force;
3) processing of personal data is necessary to protect the vital interests of the data subject or
another person where the data subject is physically or legally incapable of giving
consent;
4) processing, in particular of genetic data, is necessary for establishing, exercising or
defending a legal right;
5) where legal proceedings or a criminal investigation is underway;
[. . .].
4.2 Interception of Communication Data
4.2.1 Legislation Regarding the Purpose of Investigation, Detection
and Prosecution of Crimes
This matter is only addressed by article 6 of the ECOWAS Privacy Framework:
Personal data processing that is carried out on behalf of the State, a public establishment or
local authority, or a body incorporated under private law and running a public service, shall
be decided upon by a legislative or regulatory Act passed subsequent to the reasoned opinion
of the data protection Authority. Such processing shall concern:
1) National security, defence or public security;
2) The prevention, investigation, detection or prosecution of criminal offences or the
application of criminal sentences or security measures;
[. . .].
4.2.2 Requirements
Article 7 of the ECOWAS Privacy Framework regulates the formalities of requests
for opinions and authorizations:
Requests for opinions, notifications, and other requests for authorization must specify:
1) The identity and address of the data controller or, if the latter is not established on the
territory of an ECOWAS or UEMOA Member State, those of his duly mandated
representative;
UN Regulations
537
public policy. These exceptions should be as few as possible and should be made
known to the public.
According to article 30 ECOWAS Supplementary Act, it is prohibited to obtain
and process specific types of data. But there are exceptions in article 31:
The prohibition stipulated under (Article 30) shall not apply in the following instances:
1) processing of personal data relating to data manifestly made public by the data subject;
2) the data subject has given his written consent, on whatever medium, to such processing,
and in line with texts in force;
3) processing of personal data is necessary to protect the vital interests of the data subject or
another person where the data subject is physically or legally incapable of giving
consent;
4) processing, in particular of genetic data, is necessary for establishing, exercising or
defending a legal right;
5) where legal proceedings or a criminal investigation is underway;
[. . .].
4.2 Interception of Communication Data
4.2.1 Legislation Regarding the Purpose of Investigation, Detection
and Prosecution of Crimes
This matter is only addressed by article 6 of the ECOWAS Privacy Framework:
Personal data processing that is carried out on behalf of the State, a public establishment or
local authority, or a body incorporated under private law and running a public service, shall
be decided upon by a legislative or regulatory Act passed subsequent to the reasoned opinion
of the data protection Authority. Such processing shall concern:
1) National security, defence or public security;
2) The prevention, investigation, detection or prosecution of criminal offences or the
application of criminal sentences or security measures;
[. . .].
4.2.2 Requirements
Article 7 of the ECOWAS Privacy Framework regulates the formalities of requests
for opinions and authorizations:
Requests for opinions, notifications, and other requests for authorization must specify:
1) The identity and address of the data controller or, if the latter is not established on the
territory of an ECOWAS or UEMOA Member State, those of his duly mandated
representative;
UN Regulations
537