Article 29', Principle of choice of data processor Where processing is camed out on behalf of a data controller, the laller must choose a data processor providing sufficient guarantees, It is the responsibility of the data controller as well as the data processor to ensure compliance with the security measures defined in this Supplementary Act Article 30: Specific principles Within the ECOWAS space, it is prohibited to obtain and process data that reveals the rac'laI, ethnic or regional origin, parentage, po[rlical opinions, religious or philosophical beliefs, trade union membership, sexual life, genetic data or more generally data on tha state of health of a data subject. Article 31: Exceptions The prohibition stipulated under (Article 30) shall not apply in the following instances: 1) processing of personal data relateing to data manifestly made public by the data subject; 2) the data subject has given his wrttten consent, on whatever medium, to such processing, and in line with texts in force; 3) processing of personal data is necessary to protect the vital interests of the data subject or another person where the data subject is physically or legally incapable of giving consent; 4) processing, in particular of genetic data, is necessary for establishing, exercising or defending a legal right; 5) where legal proceedings or a criminal investigation is underway; 6) processing of personal data is necessary for reasons of public interest, in particular for histOrical, staUstical or scientific purposes; 7) for the performance of a contract to which the data subject is a party or for the application of pre-contractual measures adopted at the request of the data subject prior to entering into a contract; 8) the processing is necessary for compliance wrth any legal or regulatory obligation to which the data controller is subject; 9) the processing is necessary for the implementation of a public interest mission or is carried out by a public authority or is assigned by a public authortty to the data controller or to a third party to whom iJ1e data is disclosed; - 12-