﻿1 July 2017 
OFFICIAL JOURNAL OF THE REPUBLIC OF NIGER 
OFFICIAL PART 
Law n° 2017-28 of 03 May 2017, on the protection of personal data. 
Having regard to the Constitution of 25 November 2010 
The Council of Ministers heard, 
LOIS 
- Consent of the data subject: any manifest-tation of express, unequivocal, free, specific and informed will- by which the data subject or his legal representative, legal or conventional accepts that its data of a per-are subject to manual or electronic processing; Secret conventions: all unpublished keys, necessary-The National Assembly deliberated and adopted, to the implementation of a means or provision of The President of the Republic promulgates the law whose cryptology content for encryption operations or decrypts-follow lie; Preliminary chapter: Definitions - Correspondent : the person designated by the structure processing of personal data and Article 1: Definitions of the legal instrurnents of which can be addressed to any person concerned by a question-ECOWAS, the African Union or the International Union related action; Telecommunications prevail for undefined terrns 
by this Act. IE-mail: any message, in the form of text, of sound or image, removed by a public network of-For the purposes of this Act, : nication, stored on a server on the network or in the equipment . .Cryptology activity: any activity with the recipient's teminal purpose, until it recovers: production, use, import, exportalon or count-Cryptology: the science of protection and mercialization of cryptology means; information security including for confidentiality, - Accreditation: formal recognition by an organization authentication, integrity and non-repudiation; approved that the product or system evaluated can up to un - Cybercrime: any criminal offence committed in specified level; the means or on an electronic communications network - Secure electronic archiving of all modali- or cornputer system ; conservation and management of archives for - 1Recipient of processing of personal data to guarantee their legal value for as long as necessary; personnel: any person entitled to receive a communication-- Violation of human dignity: any violation, except data, ether than the data subject, the-.to life, integrity or freedom, which has the effect of processing, the processor and persons who, due to essential to treat the person as a thing, as an ani- their functions, are responsible for processing data; wrong or as a donkey to which would be denied any right 
. Protection authority: the independent administrative authority-!in charge of ensuring that the processing of the data personal character are set in accordance with the-provisions of this Act; - 'Encryption: any technique that involves transforming digital data in an unintelligible format using means of cryptology ; 
- Code of conduct: the charter of use developed by the responsible for the processing in order to establish the correct use of computer resources, intemet and comrnunicationselec-structure concerned and approved by the Authority protection ; . 1E-commerce: economic activity through-what a person offers or insures, rernotely and by way electronic, the provision of goods ct the provision of services ; Also within the scope of e-commerce, the service provision activities such as online 'information, commercial communications, search, access and data recovery tools, access a communication or information hosting nehvork, even if they are not paid by those who receive them; - Electronic communication: any broadcast, trans-mission or reception of signs, signals, writings, images, sound or video by electromagnetic, optical or any other means ; 
- Document: the result of a series of letters, character-figures or any other signs or symbols which intelligible meaning, whatever their means of transmission ; - Personal data: any information of regardless of its support, y including sound and image, relating to a natural person tifieciden- identifiable directly or indirectly, to an identification number or more specific elements, specific to its physical, physiological, genetic, psychological identity-chic, cultural, social or economic; 
Computerized data: any representation of facts, information or concepts in a form that lends itself to a computer processing, including a prograrn such as having a function performed by an information system ; - Subscriber data: any information, under forrn of computer data or in any other form,- naked by a service provider and relating to subscribers of its services, other than traffic or traffic data- held and allowing to establish on the basis of a contract or an arran-gement of services; 
- Traffic data: any data relating to communication through an information system, 'pro- as an element of the chain of communication-cation, indicating origin, destination, route, time, date, size and duration of communication or type of service underlying ; 


OFFICIAL GAZETTE OF NIGER 
,Sensitive data: all personal data-nel relating to religious, philosophical opinions or activities, political, trade union, sexual or racial life, health, measures "of a social nature, prosecution, criminal sanctions or administrative; 
- lElectronic data interchange (EDI): any trans- information of an electronic system to another putting in an agreed standard to structure information; 
- Writes any sequence of letters, characters, 
1 July 2017 
fThird country: any non-ECOWAS member State; - Data subject: any natural person who the purpose of personal data processing ; Cryptology service : any operation aimed at the copper, on behalf of oneself or others, means of cryptology; Cryptology service provider: anyone, physical or moral, which provides a cryptology service; 
- frorn or from Child pornography: any data, whatever 
the any other signs or symbols that has an intelligible meaning, na ure or form, visually representing a child of whatever their media and methods of transmission; under 18 years of age engaging in explicit acts or images - Personal data file: while- representing a child under the age of 15 engaged in compor-seems structured data accessible according to- whether sexual and explicit ; this set is centralized, decentralized or Direct prospecting - : any sending of messages, regardless of a functional or geographical way, allowing to identify either the medium or the nature in particular commercial, political or 
specified person; - Service provider: any legal entity that furnishes-nit to the public of electronic communication services or IT services ; 
- Information: any element of knowledge likely to be represented using conventions fear used, con- served, Pr'cessed In'rrnati°n c an be exPressed ZI,erciec7a.acgoaullnct7:trirnnaUZZfdPe7cPelerUboercca.rlii;' in electronic, visual, sound, digital form, etc. ; 
charitable, intended to promote, direct, or indirectly, goods, services or the image of a person selling goods, services or goods or providing services ; - Racism and xenophobia in ICT : all written, any image or other representation of ideas or theories that advocates or encourages hatred, discrimination or 
or religion, to the extent that the latter serves as a pretext for - Infrastructure : the facilities of any of its elements or that incites such acts; information technologies, neMorks, services and assets that, in - Data controller : the natural person or moral, case of stop or destruction, can have serious consequences public orri pvate, any other organization or association health, safety or economic and social well-being ics-who, alone or jointly with others, makes the decision to toyens or the continuous operation of state services; collect and process personal data and deterrnine-- Interconnection of personal data: undermines the purposes ; any connection mechanism consisting in the linking - Electronic signature: any data resulting frorn of data processed for a specific purpose with other the use of a reliable identification process guaranteeing its link donations- for the same or different purposes, or linked with the deed elies'attache; by a or multiple data controllers 
- SMS: the English-Saxon meaning " short message ser-- Identity: the postal or geographical address, the number vice " (in French : short message service); of telephone and any other access number, inforrnation relating to the location, billing and location of the - Subcontractor : any natural or legal person, pu-communication equipment ; private, any other organization or association that deals with data on behalf of the controller - Electronic message: any information created, sent, received or stored by electronic or optical means or - Monitoring: any activity involving means similar means, including but not limited to technical or electron c means for detecting, observing, computerized data exchange (EDI), electronic messaging- copy or record movements, images, words, writings, or that, telegraph, telex and fax ; the state of a fixed or movable object or person; - Minor: anyone under the age of eighteen - Information system or computer system: any .in accordance with the Criminal Code; isolated or not, any set of interconnected devices-in whole or in part, automated donation processing-- :Means of cryptology : the set of scientific tools-bom in execution of a prograrn; ques and techniques (hardware or software) that allow to encrypt and / or decipher. It is also meant by means decryptology - Third party any natural or legal person, public or any hardware or software designed or modified to transform private, any other organization or association other than the person data, whether written or signals, using conven- data controller, the processor and the- which, placed under the secret or non-secret agreements ; direct authority of the person responsible for the trafficking-of the processor, are entitled to process the data ; 
- Electronic means of payment: means allowing its holder to carry out electronic payment transactions - 'Processing of personal data: any operation or set online; of operations performed or not performed using automated or non-automated processes, and applied to data, such as - Non-repudiation: right not to challenge the authenti-the collection, exploitation, registration, organization, conser-city of secure or encrypted information; vation, adaptation, modification, extraction, backup, - 'Digital forgetfulness: refers to the duty to take the copy, yuttsttttytiutt, use, communication by transmitted-provisions that are required to delete or return the data to sion, dissemination or any other form of provision, rap-personal character unavailable when it is no longer necessaryto interconnection, locking, encryption, where no legitimate purpose justifies their preservation; the erasure destruction of personal data. 


1 July 2017  OFFICIAL GAZETTE OF THE REPUBLIC OF NIGER 
Chapter II: Purpose and scope Art. 2 The purpose of this law is to regulate the protection of personal data. Art. 3: Are subject to the provisions of this law : - any collection, any processing, any transmission, any storage and any use of personal data by a natural person, the State, local authorities, persons-legal instruments of public or private law; - any automated or non-autornated processing of data contained or called to appear in a file ; - any data processing implemented in the territory national; 
- any data processing concerning public security-ithat, the defence, investigation and prosecution of criminal offences of the State, subject to the derogations defined by the specific provisions laid down by other legislation in vi-gUeUr. Art 4: Are excluded from the scope of this law : 
Art. 7: prior authorization of the :protection before installation : - the processing of personal data relating to on genetic, medical and scientific research-that in these areas ; 
- the processing of personal data relating to on data relating to offences, convictions or the measures imposed by the courts ; - the processing of a national identification number-or any other identifier of the same nature, in particular phone numbers ; - the processing of personal data includes:- both biometric data ; 
- the processing of personal data having a public interest grounds in particular for historical purposes, statistical-ques or scientific; - the transfer of personal data envisaged to destination in a third country. The request for authorization is submitted by the head of the - data processing by a person or its legal representative. in the exclusive context of his personal activities or provided, however, that the data are not the r'cx authorization is not responsible for dc,t inc., to a third party or to liars. dissemination; Art. 8: For the most common categories of treatment of - temporary copies made in the course of personal data activities, in particular those whose implementation transmission and provision of access to a network is not likely to infringe on privacy or digital, for automatic, intermediate and tran storage- to freedoms, the Protection Authority establishes and publishes nostrils to allow other recipients of the and proc.ures intended to simplify or exonerate the responsible 
service the best possible access to the transmitted information. Chapter III: Formalities necessary for the treatment of personal data Art. 5: The processing of personal data is subject to prior declaration to the protec Authority- of personal data. 
The declaration shall include the undertaking that the treatment satisfies the-made to the requirements of the law. 
The Protection Authority shall issue a receipt in response to the declaration, if applicable, by electronic means. Applicant can put in processing upon receipt of its receipt. He is not exempt from any of his responsibilities. Treatments under the sarne organization and having identical or related purposes may be subject to a single statement. The information required under the declaration-are provided for each of the treatments only in the measure they are his own. Art. 6: Are exempt from the formalities of prior declaration: - the processing of data used by a physical person-that in the exclusive framework of his personal activities, domes. family ques; - the processing of data concerning a physical person-the publication of which is prescribed by a legal provision or regulatory; 
the processing of the prior declaration obligation. Art. 9: The request for an opinion, the declaratiOn and the request for self-are addressed to the Protection Authority and contain at least the following particulars: 
- identity, domicile, postal or geographical address of the controller or if the controller is not established on the national territory, those of its mandated representative, and if it is a legal entity, its corporate name, registered office, the identity of its legal representative, its IM number-registration in the register of trade and movable credit, its tax retum number; 
- the purpose(s) of the processing and the description general functions; 
- the proposed interconnections or any other forms of linking with other treatmentS ; - the personal data processed, their origin and the categories of persons concern. by the processing ; 
ia retention period of the processed data; - or the service (s) responsible for implementing the-as well as the categories of persons who, because of their functions or for service purposes, have direct access data collected; 
- recipients entitled to receive communication from data process. ; 
- the processing of data for the sole purpose of maintaining - the function of the person or service with whom a register intended for private use only; exercise the right of access; - the processing for which the controller has designated a cor- - measures taken to ensure the safety of trafficking-responsible for the protection of the personal data in charge, the pro ection and confidentiality of the data processed ; to ensure, in an independent manner, compliance - with indication of the use of a subcontractor or transfer provided for in this law, except where a transfer of data to personal data destined for a third country. to a third country is envisaged. 


OFFICIAL JOURNAL OF THE REPUBLIC OF NIGER 1 July 2017 
In the event of a change in the particulars listed above, Chapter IV: Guiding principles for the processing of donations-the person responsible for the processing shall inform, without personal births delay, the- national city for the protection of personal data. Art. 14: The processing of personal data is The conditions for the submission of the application for authorization considered legitimate if the data subject gives express-and the procedures for granting authorizations are fixed by decree consent-taken in the Council of Ministers. 'However, it may be this requirement of consent 
The Protection Authority may, by decision, require conditions to be met.- additional information for submitting the application for authorisation-procedures for granting authorisations. 
Art. 10: The declaration or application for authorization may be addressed to the Protection Authority by electronic, postal or by any other means against delivery of an acknowledgement of receipt. 
Art. 11: The Protection Authority shall decide within a period of time one month from receipt of the declaration or request for authorization. However, this period may be extended by a additional month on reasoned decision of the Supervisory Authoriry-tection. 
where the controller is duly authorised and that treatment is necessary: - or compliance with a legal obligation to which the-sand treatment is subject ; - or the performance of a mission in the public interest or- the exercise of public authority vested in the responsible-or the third party to whom the data are communicated.- quees; - or to the performance of a contract to which the person-,. is a party to or the execution of pre-contractual measures taken at his request; 
The lack of a response from the Protection Authority within the time limit - or to safeguard the interests or rights and freedoms imputed amounts to a rejection of the fundamental declaration or request of the data subject. authorization. In this case, the data controller may r.x(Trrrnnapplication for jurisdiction. Art. 15: Collection, registration, processing, storage-kage, the transmission and i interconnection of data files to cz,:ict,:they must be done in a lawful and fair manner. ,Art. 16: The data must collect be collected for purposes determined, explicit and legitimate and cannot be processed incompatible with these purposes. They must be adequate, relevant and not excessive to of the purposes for which they are collected and processed later. 
of of of stay 1-f — procedures for the processing of personal data in accordance with the provisions of this Law are fixed by decree adopted in the Coma of Ministers. 
Art. 12: The data protection correspondent in carac-;ere the personnel is a person with re qualifications- view to carry out such missions. It keeps a list of treats-immediately accessible to any person in and 
shall not be subject to any sanction by the They must be kept for a period not exceeding of the employer, as a result of the completion of its tasks-not the period necessary for the purposes for which they were sions. collected or processed ; after this required period, the data may not be subject to conservation only in order to meet The designation of the correspondent by the data controller- specifically to a treatment to historical, statistical tins it shall be notified to the Protection Authority. It Aso or research under the legal provisions. scope, if any, to the knowledge of the bodies represented-of the staff. ,Art. 17: The data collected must be accurate and, if necessary, updates. All reasonable steps must be taken The Profile and the remuneration conditions correspondent a of the for inaccurate or incomplete data, with regard to fina-the protection of data of a character make the habit of a lily they are collected processed later, order of the Minister responsible for information technology and be erased or rectified. communication, on a proposal from the Protection Authority. 
Art. 18: The principle of transparency implies an-In the event of a breach of his duties, the- mandatory and clear information from the controller dant is relieved of his duties on request, or after consul - relating to personal data. protection Authority. 
,Art. 13: Processing of personal 
Art. 19: Personal data must be processed-data and be protected, especially when-
on behalf of the State, of a legal person of law that the processing of these data involves transmissions of public or private law managing a public service, are authorized data in a network. ,by decree, after reasoned opinion of the Protection Authority. Year. 20: When processing personal data-These treatments relate to nel is set up on behalf of the controller, he must choose a subcontractor who provides suf guarantees-- national defence or security for the protection and confide_ntiality of this data. public; li is responsible for processing and sub-processing-- prevention, research, discovery or prosecution to ensure compliance with the provisions of this Act. criminal offences or the execution of criminal convictions or sgrete measures ; Art. 21: Processing of personal data rea-published for journalistic, research, artistic expression or - the population census ; literary is allowed when it is implemented for the sole purpose 
- the treatment of wages, pensions, taxes and other liquidation. 
of literary and artistic expression or exercise, in a professional capacity-of the journalistic or research activity, with due respect for ethical rules of these professions. 


1 July 2017  OFFICIAL GAZETTE OF THE REPUBLIC OF NIGER 9 Art. 22: The provisions of this Law do not obstruct- I - the confirmation that personal data the provisions of the lawS relating to the press concerning are or are not the subject of this processing ; the audiovisual sector and the penal code which provide - the comrnunication of the personal data which the conditions for exercising the right of reply and which prevent, as well as any information available as to the ori-limit, repair and, where appropriate, suppress harm to life ginedecelle-ci; the reputation of natural persons. Art. 23: No decision ofjustice, implying an- on the behavior of a natural person, can not have for the basis of automat. processing of personal data staff designed to assess certain aspects of his personality. No administrative or private decision, involving a PA-preciation on a human behavior, can not have for alone basis automated processing of personal data- sonnet giving a definition of the profile or personality of interested. 
Art. 24: The data controller cannot be authorised to transfer personal data to a third country that if this State provides a higher or equivalent level of protection- privacy, fundamental rights and freedoms of persons- with regard to the processing of such data make the object. 
,Before any transfer of personal data, to third countries, the controller must pr.:Ale:nut obtain the auterization of the Protection Authority. 
Transfer of personal data to countries third party is subject to regular supervision by the Protection Authority with regard to their purpose. Art. 25: The interconnection of files is allowed only if it enables the attainment of present legal or statutory objectives.- both a legitimate interest for the data controllers. 
It cannot result in discrimination or reduction rights, freedoms and guarantees for data subjects, and be accompanied by inappropriate security measures and account of the principle of relevance of data first disclosed to third interconnection. 
Chapter V: Rights and exceptions to per rights-sounds concerned 
- information relating to the purposes of the processing, categories of personal data processed and intended for-categories of recipients to whom the data are communicate. 
In case of impossibility of access to the data subject, the 'right access may be exercised by the Data Protection Authority who has the power to investigate the matter and who can order the rectification, erasure or locking of donations-not in accordance with this law. 
The Data Protection Authority communicates to the per-:sounds concerned about the outcome of his investigations. 
The controller may object to requests of the :same person, in particular by their number, their repetitiveor systematic. In case of tales- tation, the burden of proof of rnanifestly abusive character of requests is the responsibility of the person with whom they are address. 
Va.,- 213: All rig.t . - object, for legitimate reasons relating to his situation specific, to the fact that personal data concern it-treatment, except in the case of provisions expressly providing for the processing. In case of opposition-legitimate, the processing initiated by the data controller processing may not relate to the data in question ; 
- oppose, on his request and free of charge, the treatment data concerning it for prospecting purposes; - must be informed before data conceming it is received parties or used pour lc account of third parties for prospecting purposes and to see each other, expressed- grant the right to oppose, free of charge, the said community-nication or use. 
A Art. 29: Any natural person, justifying his rt. 26: The olle contrr is obliged to provide the erson whose data are ocessed at most identity, may require the data controller to 0909, p pr,  rectified, completed, updated, locked or deleted-late, when collecting and whatever the means and supports the personal data concerning him, which are employees, the following information : inaccurate, incomplete, equivocal, outdated, or whose collection, - its identity and, where applicable, that of its representative the use, communication or storage is prohibited. dtiment mandated; Art. 30: The beneficiaries of a deceased person, justitying - the determined purpose (s) of the processing to which deleuridentitep can, if elements brought to their data are intended ; knowledge allow them to assurne that the personal data concerning, subject to treatment have not been updated.- • the categories of data concerned; to require the data controller to take into account the-- the recipient (s)at which the data are superseded the death and proceeds to the updates that must be the 
ceptibles to be communicated; consequence. When the beneficiaries so request, the person in charge of the treatment must justify, at no cost to the applicant, that he has pro-assigned to the transactions required under the preceding paragraph. Art. 3, The data  ty subject has the right to obtain from the re'spons- - the possibili of any transfer of data to destination processing sand erasure of personal from a third country. data and the cessation of the dissemination of such data, in Art. 27: Any natural person whose data to carac- in particular with regard to personal data tem subject to processing may request under that the data subject had made available when it form of questions and obtain from the data controller : was a minor, or for one of the following reasons : . information to know and challenge the - the data is no longer necessary for the purposes treatment; for which they have been collected or processed ; 
the ability to refuse to appear on the file in question; - the existence of a right of access to data concerning the 'right to rectify these data 


10 
OFFICIAL JOURNAL OF THE REPUBLIC  NIGER 1 July 2017  
- the person concerned has withdrawn the consent on which I Where the data subject has provided the data is based on the processing or when the personal authorized retention period that the processing is based on consent or on has expired and there is no other legal reason for the processing of a contract, it has the right to transmit these data data; and any information it has provided that is automated processing system to another - the data subject objects to the processing of donations- stored by one automated in an electronic format that is commonly used, of a personal nature concerning her when there is no motif legal audit treatment; without the data controller to whom the data is processed-terc staff are removed to prevent It. - the processing of the data does not comply with the provisions of the-provisions of this Act; 
- for any other legitimate reason. Art. 32: When the controller has made public the personal data of the data subject, it subordinates takes all reasonable steps, including technical, with regard to the data published under its res- responsibility, with a view to informing the tiers that process the said donation-a data subject asks them to delete all links to such personal data, or any copy or repro-duction of it. 
Where the controller has authorised a third par, to publish personal data of the person concerned- born, he is deemed responsible for this publication and takes all appropriate measures to implement the right to be forgotten cterasure of personal data ,Year. 33: responsible for processing proceeds to erasure .without delay, except when the storage of data at camel,: staff is required - exercise of the right to freedom of expression; - or on grounds of general interest in the field of public health; - or in accordance with the law ; 
- or compliance with a legal obligation to keep personal data provided for by current legislation a to which the controller is subject. Art. 34: The data controller sets up mocha- appropriate mechanisms to ensure compliance with the right to digital forgeffulness ct to erasure of data with character per-sonal or periodically the need to keep these data, in accordance with the provisions of this ioi. 
When the erasure is effected, the controller- no further processing of this data is carried out at carac-fere personnel. Art. 35: The Data Protection Authority shall adopt ensure that when using a milking system-measures and guidelines to clarify: of data, authorized persons cannot - the conditions for the removal of links to these data access only to data subject to their authorization; copies or reproductions thereof - ensure that the identity of existing in accessi electronic communication services-third-party data may be transmitted by third-party-bles to the public; transmission lations 
The Data Protection Authority may specify the format electronic, as well as technical standards, terms and conditions procedures for the transmission of personal data. 
Chapter VI: Obligations of managers and their 
Art. 37: The processing of personal data is confidential. It is carried out exclusively by persons who act under the authority of the controller and only on his instructions, 
Art. 38: The data controller is obliged to take any precautions regarding the nature of the data and, in particular, to prevent them from being deformed, damaged, or unauthorized third parties have access to it. When the treatment is put in on behalf of the of the ,es,Irr,.,1iir processing, the latter choose subcontractor who provides sufficient guarantees with regard to security measures is technique of organization relating to the treatments to be carried out. li responsibility of the data controller and the data processor ensure compliance with these measures. 
Art. 39: The data controller is obliged to prevent unauthorized persons from accessing the ins-tallations used for data processing ; - that data carriers can be read, copied, modified or moved by an unauthorized person; - prevent unauthorized entry of any data in the information system, as well as any taking of knowledge-any unauthorized modification or erasure of donation-registered births: 
- prevent that data processing systems then-sent etre by unauthorized persons using ins-data transmission tallations 
- prevent treatment systems from being used for the purpose of money laundering and terrorism; 
- the conditions and criteria applicable to the limitation 
tcmcrit of treatment- personal data. ,guarantee that can be ascertained a posteriori the identity of persons who had access to av information system Art. 36: When personal data are collected- containing personal data, the nature of donations-Stream a processing automates in a structured shape and neck- born that have been introduced, modified, altered, copied, deleted the data subject has the right to obtain or read in the systems, the irne at which such data was of the data controller a copy of the data subject manipulated; automated processing in a structured electronic format cmpt:chcr tthat, during the communication of data which is commonly used, and which allows the reuse of and the transport of data carriers, the data can be read, these data of the data subject. unauthorized copying, modification, alteration or deletion; 
- save the data by making copies of security protect
1erjuly 2017 OFFICIAL JOURNAL OF THE REPUBLIC OF NIGER ii 
The data controller must ensure that appropriate - a doctor appointed by the Order of Doctors; technical and organizational measures to ensure protection of the data it processes against accidental destruction- an 'CT exPen aPPnintaa bY the °Tana °T . Hign .T accidental loss, alteration, dissemination or unauthorized - • access, in particular where the processing involves data The members of the HAPD are appointed by decree issued in transmissions in a network, as well as against Council of Ministers. any other form of unlawful processing. The term of office of the members of the HAPD is five (5) years Art. 40: The controller is required to establish a renewable once. annual report on behalf of the With the exception of the President, the members of the HAPD shall not exercim-data on compliance with the provisions announc. in Article 41 one hundred not their permanent function. of this Act. 
Art. 41: Personal data are stored during a set by the Data Protection Authority function of the purposes of each type of processing for which thry have been collect. in accordance with the texts in force. 
Art. 42: The controller is obliged to take any measures necessary to ensure that data of a- sonnet processed can be operated regardless of the medium technique used. Chapter VII: The Data Protection Authority to personal character Art. 43: A High authority for the protection of donations is created-bom in personei for short the "EHPAD". The HAPD is an independent administrative authoriry.- to ensure that the processing of personal data in a.ordance with the provisions of this Act. 
The HAPD establish rules of procedure that specify, notam- the rules on proceedings, investigation and presentation of files. 
The rules relating to the organization and functioning of the HAPD are fixed by decree. Art. 44: The President of the Republic appoints the President of the High Authority among its members. 
The President of the HAPD is assisted by a vice-president elected by the members of the HAPD. I 41President of the HAPD is the authorising officer of the budget, he-quc rules of public accounting 
The HAPD has services under the authority of its su.essor President. 
Members of the HAPD are irremovable for the duration of their rnandate. Membership cannot be terminated, in the event of resignation or impediment found by the HAPD under the conditions provided for by decree. Members of the HAPD are subject to professional secrecy in accordance with the texts in force. 
Mernbership of the HAPD is incompatible with the as a member of the Government, of company executives, ownership of shares in companies in the IT or telecommunications sector-tions. 
Art. 46: Members of the HAPD are subject to secrecy profussionnei in accordance with the laws in force. 
Members of the HAPD enjoy full immunity for opinions expressed in the exercise of their function. In the exercise of their attribution, the members of ia HAPD do not receive-wind of instruction frorn no authority. HAPD mernbers receive benefits including amount is fixed in the Council of Ministers. 
Art. 47: Any member of the HAPD must inform the latter of the direct or indirect interests which it holds or comes to hold, functions performed or is to be performed and any mandate holds or comes to hold within a legal entity, The case the HAPD makes all arrangements for assu- the independence and impartiality of its rnembers. A code of 'conduct is set up by the HAPD for this purpose. If during the term of office, the President or a member of the HAPD ceases to perform his duties, he is proceeded to his replacement under the conditions provided for by this Law. The mandate of the o designated and is limit. to the remaining period. Article 48: Members of the High Authority, before their entry It has, in addition, a staff made available by in office lend before the sitting in audience The state and may resort to the recruitment of agents in accordance with the solemn oath, the content of which is as follows: "solemnly jejure provisions of the Labor Code. 
Art 45: The HAPD is composed of nine (09) choi mernbers-sis, due to their legal and/or technical competence, as well let it be: 
- a person appointed by the President of the Republic; - one (1) representative of the Prime Minister ; one (1) member representing the National Assembly ; - one (1) magistrate member of the Council of State appointed on Art. 50: A Government Comrnissioner appointed by the proposal of the First President of the Council of State ; Prime Minister sits on the High Authority, The- one (1) - magistrate rnember of the Court of Cassation designated saire of the Government is summoned to all sessions of the on the proposal of the First President of the Court of Cassation ; High authority under the conditions that the members of this one. It informs the High Authority on the guidelines of the Gou-- one (1) lawyer appointed by the Niger Bar Association; vemonent eton the reasons of the administration concerning the - one (1) representative of advocacy organizations but does not take part in the vote. of the chosen man speaks collective; 
to properly and faithfully fulfill my function as a member of the HAPD, en toute independance impartiolite defog. worthy and ,keep the deliberations secret". Art. 49: The other agents chosen by the HAPD shall-the Court of Appeal of Niarney in these terms " Jejure to properly and faithfully fulfill my duties as an agent of the High Personal Data Protection Authority independance and impartialite, to keep the secret of deliberations-tions". 


12 OFFICIAL GAZETTE OF THE REPUBLIC OF NIGER 
1 July 2017 
Art. 5, The protection authority shall ensure that the use of I The controller acting in the context of the CA-information and communication technologies does not complement its missions, may not oppose the Authority of or does not pose a threat to freedoms and life protection, professional secrecy to which it is subject. private for the user located on the whole of the national territorry. Art. 53: The protection Authority may rule in respect of Acetitreelle Is Loaded: data controllers the following measures 
- to inform the persons concerned and those responsible processing of their rights and obligations ; 
- to respond to any request for an opinion relating to a trade-of personal data - establish rules of procedure that specify, in particular, rules relating to deliberations, investigation, and presen-tation of files ; 
- to receive declarations and grant authorizations for the implementation of processing of character per-or withdraw them in the cases provided for this law - to receive statements and complaints relating to the; processing of personal data and infuse the authors of the suite granted to them; 
- to inform, without delay, the competent judicial authority of offences which it becomes aware of in the course of its missions; 
- a warning to the controller who does not comply with the obligations under this Act 
- a formal notice to stop breaches ob-served within the tirneframe it sets. 
Art. 54: When the implementation of a data processing caractin jviolation of human rights and freedoms-tes, the Protection Authority after an adversarial procedure, can decide : 
- of the interruption of the implementation of the treatment ; 
- the blocking of certain personal data 
- temporary or permanent prohibition of processing contrary to the provisions of this Law. Article 55: The Protection Authority may, after hearing the controller or processor who does not comply - to determine the necessary guarantees and measures provided for by this law and the implementation of the en appropriate for the protection of personal data ccuicore queddressed to him, pronounce against him, without-- to pronounce through sworn agents. to veri- bons information concerning any processing of personal data- - Ic retrartprovisional authorisation granted; sonnet; - the final withdrawal of the authorisation ; 
- to impose administrative and monetary penalties with respect to data controllers who do not comply provisions of this Act ; 
- to update and make available to the public for consulta-a directory for the processing of personal data; - to advise individuals and organizations that make the-of personal data or which tests or experiments in this field; 
to give its opinion on any draft legal text in relation to the protection of freedoms and privacy ; cee has 
- monetary penalties. 
The amount of the monetary penalty is proportional to the the seriousness of the shortcomings and the benefits derived from this-just. 
The amount of this penalty may not exceed the sum of 10,000,000 CFA francs. 
In case of repeated default within five years from the date on which the previously imposed monetary penalty- -become final, it cannot exceed 100,000,000 francs CFA or, in rthe case of an undertaking, it may not exceed 5% of the 
- develop rules of conduct relating to the treatment / calculation of duty-free fees last financial year ended protection of personal data I SOO. 000,000 CFA francs. 
- to participate in scientific research activities, training and study related to data protection at personal character, and in general, freedoms and life deprive; 
These administrative and monetary penalties are applied without prejudice to criminal sanctions. Art. 56: The procedure for withdrawing the authorisation and recouping- of the monetary penalty are fixed by decree issued in - to authorize certain conditions, fixed by decree taken Council of Ministers. Council of Ministers, cross-border transfers of data to Chapter VIII: Criminal sanctions Art. 57: Is prohibited and punishable by imprisonment of three(3) to five (5) years and a fine of 20,000,000 to 40,000,000 of CFA francs, made to proceed with the collection and any processing data that reveal racial, ethnic or regional origin, is political views, religious beliefs or philosophical, union membership, sex life, donations- genetic or more generally related to the state of health of the person concerned. 
caracti,repersonnel: 
- to make proposals that could simplify and develop the legislative and regulatory framework for trafficking-of personal data - dematrcenplace of cooperation with auto-riiCS of personal data, other countries; - to participate in international negotiations by matii:re protection of personal data - to establish and deliver an annual of activities to the-president of the Republic and the President of the National Assembly. Art. 52: The cryptology service provider cannot op-to the Protection Authority, the professional secrecy to which it is submitted in accordance with the legal provisions or convention-nelles. 
iThis prohibition does not apply : - when processing personal data of data clearly made public by the data subject ; 


1 July 2017  OFFICIAL GAZETTE OF THE REPUBLIC OF NIGER 13 
- when processing genetic or related data Law n° 2017-39 of 24 May 2017, authorizing the ratification of the the state of health is necessary to safeguard the vital interests of Protocol A/P2 / 1 / 03 on the irnplernentation of the data subject or another person in the case of the compensation for loss of revenue suffered by MEM states-the person concerned is physically or legally incapacitated by ECOWAS as a result of trade liberalization. dique to give consent ; 
- when processing, including genetic data, is necessary for the establishment, exercise or defence of a legal rights of the data subject ; - when a court proceeding or criminal investigation is open. In this case, the processing of personal data- nel is prosecuted only for the establishment of the facts or for the manifestation of truth; - when processing is carried out as part of the activities of the- legitimate interests of a foundation, association or any other non-profit organization and apolitical, philosophical, reli-gieuse, mutualist or trade union. However, the treatment should relate only to members of thisorganisme wouldpersonswiththecontacts for its purpose and that the data are not communicated to the-to third parties without the consent of the data subjects. All these cases of processing of personal data are authorized and controlled in their design and implementation cruvre by Protection authority Art. 58: Is prohibited punishable by imprisonment from one(i)to five (Wears and from 1,000,000 to 10,000,0001k CFA francs, direct prospecting using any rneans of communication-nication using, in whatever forrn, the data to be-t. staff of a natural person who has not expressed prior consent to receive such surveys. Art. 59: Is punished with imprisonment of one (1) 5911h 19 two (2) years and from 1,000,000 to 10,000,000 CFA francs fine, anyone acting on the action of the data protection authority: - or by opposing the exercise of duties under Arti members or their authorised agents, pursuant to the provisions of this act ; soitto communicate its members or agents information and documents relevant to their submission, or in concealing said docurnents, or making them disappear; - or by providing information that is not consistent with the content of the recordings as it was at the mo-:the request has been made or which do not content in a directly accessible forrn. 
The Procurator of the Republic or the investigating judge-tent is inform., without delay, and takes all appropriate measures.- to prosecute the perpetrator or accomplice. Chapter IX: Transitional and final provisions Art. 60: Data processors 
Having regard to the Constitution of 25 November 2010 ; The Council of Ministers heard, The National Assembly deliberated and adopted, The President of the Republic prOmulgates the law whose content fol. 
,Article 1: Ratification of the Protocol is authorized A/P2 / 1 / 03 on the application of compensation procedures loss of income suffered by ECOWAS member States as a result of trade liberalization. 
Art. 2: This law is published in the Official Journal of the IRepublic of Niger and executed as state law. Done at Niamey, 24 May 2017 The President of the Republic Issoufou Mahamadou The Prirne Minister Brigi Rafini 
The Minister for Foreign Affairs, cooperation, African integration and Nig,rialS outside 
Ibrahim Yacoubou 
Law n° 2017-40 of 24 May 2017, authorizing ratification of the Additional Protocol A/P/SP1 / 7 / 93 supplementing-cle 7 of the Protocol on the free movement of persons, the Right of Residence and Establishment, adopted 30 June 1989 in Ouagadougou (Burkina Faso). 
Having regard to the Constitution of 25 November 2010: The Council of Ministers heard, The National Assembly deliberat. and adopted, The President of the Republic promulgates the Id, the content of which follow : 
Article 1: Ratification of the AD Protocol is authorised- a / P/SP1 / 7 / 93 supplementing the provisions of Article 7 of the Protocol on the free movement of persons, the right to residence and settlement, adopted on 30 June 1989 in Ouagadou-gou (Burkina Faso). Art. 2: This law is published in the Official Journal of the staff have a period of six months, from the date of Republic of Niger and ex.uted as state law. the entry into force of this law, to comply with with its provisions. Done at Niamey, 24 May 2017 Art. 6, This law which repels all previous provisions- The President of the Republic is published in the Official Gazette of the Republic of Issoufou Maharnadou Niger and executed as state law. Done at Niamey, 03 May 2017 The President of the Republic lssoufou Mahamadou The Prime Minister Brigi Rafini 
The Minister of Justice, guard of seals Marou Tinder 
The Prime Minister Brigi Rafini 
The Minister for Foreign Affairs, cooperation, African integration and Nigerians outside 
Ibrahim Yacoubou