AndorraLQPD, special categories, children and criminal-offence data
Llei 29/2021, arts. 8-10 (special categories, children and criminal-offence data)
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Obligation class
- Prohibition, Consent, Biometric, Age verification
- Audit expectation
- none
What it requires
- Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union affiliation, or process genetic data, biometric data used to uniquely identify a person, health data, or data about sex life or sexual orientation, unless a listed Article 9(2) exception applies, most commonly the data subject's explicit consent.
- Confine any processing of personal data about a person's criminal convictions or offences, or related security measures, to what is strictly necessary and authorised by law or supervised by a public authority with adequate safeguards.
- Treat sixteen as the age at which a minor may consent to an information-society service directly, and obtain or verify consent or authorisation from a legal representative below that age, using available technology to confirm it.
- Treat an identifier your system derives from a photograph of a person in Andorra, such as a faceprint, as covered biometric data under Article 4(17); the definition names facial images, dactyloscopic data and iris patterns as examples and excludes nothing that is recording-derived.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 8(1) makes a controller verify, with the technology available, that a legal representative gave or authorised the consent of a child under sixteen. That is a check made when the consent is taken; the clause does not ask the controller to keep or produce a record of it. Article 9 is a prohibition with listed exceptions, and Article 10 limits processing of criminal-offence data and reserves a complete register of convictions to the competent public authorities, a data set rather than a log of the controller's own processing. None of the three requires a person to make, keep or produce a log or record. Article 7(1), the controller's duty to be able to show consent, sits outside the articles this row cites and is coded on the general row.
- Kind
- None
- As of
What this law does
Article 9(1) prohibits processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union affiliation, and processing genetic data, biometric data for the purpose of uniquely identifying a natural person, health data, or data concerning sex life or sexual orientation.
Article 9(2) lifts that prohibition only under the listed circumstances, running from the data subject's explicit consent through employment and social security law, vital interests where the data subject is a person receiving support measures for exercising legal capacity, the legitimate activities of a non-profit body processing only its own members' data, data manifestly made public by the data subject, legal claims, essential public interest, preventive or occupational medicine, public health, and archiving, scientific, historical or statistical purposes.
Article 9(3) lets sectoral rules add requirements, conditions or limitations on the security and confidentiality of processing special categories of personal data. Article 4(17) defines biometric data as personal data obtained from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person that allow or confirm that person's unique identification, naming facial images, dactyloscopic data and iris patterns as examples.
Article 10 confines processing of personal data about criminal convictions and offences, or related security measures, to what is strictly necessary and authorised by law or supervised by public authorities with adequate safeguards, and keeps any comprehensive register of such data solely under the competent public authorities' control.
Article 8 sets the threshold for a minor's own consent to an information-society service at sixteen years, requiring a legal representative's consent or authorisation below that age and a controller's verification of that representative consent using available technology.
Whether a voiceprint falls inside Article 9's special-category restriction is not established by the law's own text: the biometric-data definition's core clause covers behavioural characteristics used for unique identification, but its illustrative examples name facial images, dactyloscopic data and iris patterns and do not name voice.
When LexLint raises it
When your app profile says your app serves under-18s, handles health records, processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .