3) Data processing by an association or any non-prafrt and fa'ith-based, philosophical or trade union body, where such data correspond 10 the object of the association or body, and only concem their members and are not to be disclosed to third parties. Article 12: Types of processing to be executed after authorization The following shall be subject to authorisation from the data protection authority: 1) ProcesSing of pef1ional data relating to genetic data and health research; 2) Processing of personal data relating to offences, sentences, or security measures; 3) Processing of personal data for the purpose of combining files, as defined under Arflele 37 of this Supplementary Act; 4) Processiflg relating to a national identification number or any such other identification: 5) Processing of personal data that includes biometric data; 6) Processing of pef1ioflal data for reasons of public iflterest, in particular for historical, statistical or scientific purposes. Article 13: Referral to the protection Authorlty Application may be submitted to the data protection Authority by any ifldividual acting on his own behalf, through his lawyer or by .my other duly-authorized indiVidual or legal entity. CHAPTER IV INSTITUTIONAL FRAMEWORK FOR THE PROTECTION OF PERSONAL DATA Article 14: Establishment 1) Within the ECOWAS space, each Member State shall establish Its own data protection Authority. AflY State that does not have shall be encouraged to establish one. 2) The data protection Authority shall be an indepefldenl admiflistrative Authority responsible for ensuring that personal data is processed in compliance with the provisions of this Supplementary Act. - 7-