Art. 14 – The processing of personal data is considered legitimate if the person concerned gives his express consent. However, there may be exceptions to this requirement of consent when the responsible person of the processing is duly authorized and the processing is necessary; - Either for the compliance with a legal obligation to which the responsible person of the processing is subject; - or for the execution of a task in the public interest or in the exercise of official authority vested in the responsible person of the processing or the third party to whom the data are disclosed; - or for the execution of a contract to which the concerned person is a party or the execution of pre-contractual measures taken in the application; - or for safeguarding the interests or fundamental rights and freedoms of the concerned person; Art. 15 – The collection, recording, processing, storage, transmission and file interconnection of personal data must be made in a lawful and fair manner. Art 16 – the data must be collected for specified, explicit and legitimate purposes and cannot be further processed in a way incompatible with its aims. They must be adequate, relevant and not excessive in relation to the purposes for which they are collected and further processed. They must be kept for a period that does not exceed the period necessary for the purposes for which they were collected or processed. Beyond the period required, the data can be subject of a conservation only for responding specifically to processing for historical, statistical or research purposes under the law. Art 17 – The collected data must be accurate and, where necessary, kept up to date. All reasonable measures shall be taken to ensure that inaccurate or incomplete data, with regard to the purposes for which they were collected and subsequently processed, are erased or rectified. Art 18 – The principle of transparency requires a mandatory and clear information from the responsible person on the processing of the personal data. Art 19 – The personal data must be processed confidentially and shall be protected especially when the processing of these data include transmission of data over a network. Art 20 – When the processing of personal data is carried out on behalf of the person responsible for the processing, he must choose a subcontractor providing sufficient guarantees for the protection and privacy of data security. It is the responsibility of the person responsible for the processing as well as the sub-contractor to ensure compliance with this Law. Art 21 – Is prohibited and punishable by a term of imprisonment of ten to twenty years and a fine of 20 million to 40 million CFA francs, the proceeds made from the collection and any data processing revealing racial , ethnic or regional affiliation , political opinions , religious or philosophical beliefs,