Loi n° 2022-59, données sensibles, de santé et biométriques

Loi n° 2022-59, arts. 42-50 (données sensibles, de santé, génétiques et biométriques)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

Do not process data revealing racial, ethnic or regional origin, political opinions, religious or philosophical beliefs, trade-union membership, sex life, health, genetic or biometric data, social measures, or criminal or administrative sanctions, unless the data subject made it manifestly public themselves, gave written consent, or another listed exception applies.
Obtain the HAPDP's prior authorization before any processing of biometric data, and ensure it responds to a specific, justified necessity with safeguards under this law.
Process health data only for the listed purposes, such as preventive medicine, diagnosis, care administration, public health, safeguarding vital interests, administering social-protection benefits, a legal claim, or ethics-committee-approved research, and restrict that processing to medical professionals or persons bound by professional secrecy.
Limit the exchange of health data between health professionals to what coordination or continuity of care strictly requires, and anonymize health data before sharing it or publishing research drawn from it.
Do not treat an insurer or an employer as an authorized recipient of health data unless a law or regulation specifically allows it.
Process genetic data only to establish a genetic link in litigation, identify a person in a criminal investigation, for prevention, diagnosis or treatment of the data subject or a biological relative, or for scientific research, and only with the data subject's or their legal representative's consent.
Restrict processing of data on offences, convictions and security measures to courts, public authorities acting within their powers, and legal professionals acting strictly within their assigned duties.

What it reaches

Obligation class

Prohibition, Consent, Biometric

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 42 prohibits processing data revealing racial, ethnic or regional origin, filiation, political opinions, religious or philosophical beliefs, trade-union membership, sex life, health, morals, genetic or biometric data, social measures, or criminal or administrative sanctions, except where the data subject made it manifestly public themselves, gave written consent, the processing is necessary to establish, exercise or defend a legal claim, or the processing serves the legitimate, members-only activities of a non-profit association.

Article 43 permits collecting and processing health data only for preventive medicine, medical diagnosis, care or health-service administration by a health professional, public-health protection or humanitarian action, safeguarding vital interests where consent cannot be obtained, administering social-protection benefits, a legal claim, or research approved by the National Health Research Ethics Committee, and restricts that processing to physicians or persons bound by professional secrecy.

Article 44 limits the exchange of health data between health professionals to what coordinating or continuing care requires, article 45 bars an insurer or an employer from receiving health data unless a law or regulation specifically authorises it, article 46 conditions health data processing for medical research on the data subject's consent and prior transparent information, and article 47 requires health data to be anonymised before sharing or publication and hosted in Niger where it permits identification.

Article 48 restricts processing genetic data to establishing a genetic link in litigation, identifying a person in a criminal investigation, prevention, diagnosis or treatment of the data subject or a biological relative, or scientific research, and conditions it on the data subject's or their legal representative's consent.

Article 49 requires the HAPDP's prior authorisation before any processing of biometric data, on top of the particular, justified necessity and safeguards the Act demands of it, and article 50 restricts processing data on offences, convictions and security measures to courts, public authorities acting within their powers, and legal auxiliaries acting strictly within their assigned duties.

The Act names no separate rule conditioning a minor's data on a parent's or guardian's consent; a minor's status functions only as a ground for erasure under article 73.

When LexLint raises it

crawls_web
trains_models
processes_biometrics
serves_minors
handles_health_records

Read the law

Loi n 2022-59 du 16 decembre 2022, version consolidee, Haute Autorite de Protection des Donnees a Caractere Personnel

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app