African Union Legal Instrument P a g e | 21 b) Data collection shall be adequate, relevant and not excessive in relation to the purposes for which they are collected and further processed; c) Data shall be kept for no longer than is necessary for the purposes for which the data were collected or further processed; d) Beyond the required period, data may be stored only for the specific needs of data processing undertaken for historical, statistical or research purposes under the law. Principle 4: Principle of accuracy of personal data Data collected shall be accurate and, where necessary, kept up to date. Every reasonable step must be taken to ensure that data which are inaccurate or incomplete, having regard to the purposes for which they were collected or for which they are further processed, are erased or rectified Principle 5: Principle of transparency of personal data processing The principle of transparency requires mandatory disclosure of information on personal data by the data controller. Principle 6: Principle of confidentiality and security of personal data processing a) Personal data shall be processed confidentially and protected, in particular where the processing involves transmission of the data over a network; b) Where processing is undertaken on behalf of a controller, the latter shall choose a processor providing sufficient guarantees. It is incumbent on the controller and processor to ensure compliance with the security measures defined in this Convention. Article 14: Specific principles for the processing of sensitive data 1. State Parties shall undertake to prohibit any data collection and processing revealing racial, ethnic and regional origin, parental filiation, political opinions, religious or philosophical beliefs, trade union membership, sex life and genetic information or, more generally, data on the state of health of the data subject. 2. The prohibitions set forth in Article 14.1 shall not apply to the following categories where: a) Processing relates to data which are manifestly made public by the data subject; b) The data subject has given his/her written consent, by any means, to the processing and in conformity with extant texts;