In “13.” of the APEC Privacy Framework it says that even those exceptions of the
principles
relating to national sovereignty, national security, public safety and public policy should be:
a) limited and proportional to meeting the objectives to which the exceptions relate; and,
b) (i) made known to the public; or,
(ii) in accordance with law.
However, in the related commentary it is stated that “although recognizing the
importance of governmental respect for privacy, this Framework is not intended to
impede governmental activities authorized by law when taken to protect national
security, public safety, national sovereignty or other public policy”.
According to paragraph 4 OECD Privacy Framework, exceptions to these guidelines can be provided for purposes of national sovereignty, national security and
public policy. These exceptions should be as few as possible and should be made
known to the public.
The ECOWAS Supplementary Act states that “any processing of data related to
public security, defence, investigation and prosecution of criminal offences or State
security, subject to such exemptions as are defined by specific provisions stipulated
in other legal texts in force” shall be subject to its scope (article 3). In article 6 it says
that
Personal data processing that is carried out on behalf of the State, a public establishment or
local authority, or a body incorporated under private law and running a public service, shall
be decided upon by a legislative or regulatory Act passed subsequent to the reasoned opinion
of the data protection authority.
Such processing shall concern:
1) National security, defence or public security; [. . .].
5.2 Requirements
Relevant ECOWAS provisions:
Article 7: Formalities of requests for opinions and authorizations
Requests for opinions, notifications, and other requests for authorization must specify:
1) The identity and address of the data controller or, if the latter is not established on the
territory of an ECOWAS or UEMOA Member State, those of his duly mandated
representative;
2) The purpose(s) for which the data is intended to be processed, as well as general
description of its functions;
3) The expected combinations or other forms of linkage with other processes;
4) The type of personal data processed, its origin, and the categories of data subjects
covered by the processing;
5) The period of preservation of the processed data;
UN Regulations
539
principles
relating to national sovereignty, national security, public safety and public policy should be:
a) limited and proportional to meeting the objectives to which the exceptions relate; and,
b) (i) made known to the public; or,
(ii) in accordance with law.
However, in the related commentary it is stated that “although recognizing the
importance of governmental respect for privacy, this Framework is not intended to
impede governmental activities authorized by law when taken to protect national
security, public safety, national sovereignty or other public policy”.
According to paragraph 4 OECD Privacy Framework, exceptions to these guidelines can be provided for purposes of national sovereignty, national security and
public policy. These exceptions should be as few as possible and should be made
known to the public.
The ECOWAS Supplementary Act states that “any processing of data related to
public security, defence, investigation and prosecution of criminal offences or State
security, subject to such exemptions as are defined by specific provisions stipulated
in other legal texts in force” shall be subject to its scope (article 3). In article 6 it says
that
Personal data processing that is carried out on behalf of the State, a public establishment or
local authority, or a body incorporated under private law and running a public service, shall
be decided upon by a legislative or regulatory Act passed subsequent to the reasoned opinion
of the data protection authority.
Such processing shall concern:
1) National security, defence or public security; [. . .].
5.2 Requirements
Relevant ECOWAS provisions:
Article 7: Formalities of requests for opinions and authorizations
Requests for opinions, notifications, and other requests for authorization must specify:
1) The identity and address of the data controller or, if the latter is not established on the
territory of an ECOWAS or UEMOA Member State, those of his duly mandated
representative;
2) The purpose(s) for which the data is intended to be processed, as well as general
description of its functions;
3) The expected combinations or other forms of linkage with other processes;
4) The type of personal data processed, its origin, and the categories of data subjects
covered by the processing;
5) The period of preservation of the processed data;
UN Regulations
539