AlbaniaLaw No. 124/2024, special categories of personal data, criminal records and children's data
Law No. 124/2024, Arts. 8(6), 9, 10 (special categories, criminal records and children's data)
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Obligation class
- Prohibition, Consent, Biometric, Age verification
- Audit expectation
- none
What it requires
- Do not process sensitive data, meaning racial or ethnic origin, political opinions, religious or philosophical belief, trade union membership, genetic data, biometric data, health records, or sexual orientation, unless a listed exception applies, such as the data subject's explicit consent to a specified purpose.NIST Privacy FrameworkCT.PO-P1
- Treat a facial image or other biometric identifier as sensitive data requiring one of Article 9's listed exceptions before you may process it; the definition names a facial image as an example, so a derived faceprint is covered and the definition is not confined to a raw recording.NIST Privacy FrameworkCT.PO-P1
- Do not process sensitive data about race or ethnic origin unless the processing ensures justice and equality on that ground and carries appropriate safeguards, and put appropriate technical and security safeguards in place before relying on any Article 9 exception.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkPR.DS-P5
- Process the personal data of a minor for the online delivery of goods or services only where the minor is at least 16, and where the minor is younger, obtain consent given or authorized by a parent or legal custodian.NIST Privacy FrameworkCT.PO-P1
- Process criminal records only under the control of the competent authority or where a law specifically authorizes it, with adequate protection for the rights and freedoms of the data subject.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 9 prohibits the processing of sensitive data except in listed cases, Article 10 confines the processing of criminal records to the control of the competent authority or a specific legal authorization, and Article 8(6) sets the age of consent for a minor online. None of them requires a log or a record. The criminal status register in Article 10 is kept under the control of the Ministry of Justice, which is a state register and not a duty on a controller. The duty in Article 8(1) to be able to demonstrate consent is not among the sections this row cites.
- Kind
- None
- As of
What this law does
Article 5(28) defines sensitive data as a special category revealing racial or ethnic origin, political opinions, religious belief or philosophical views, trade union membership, genetic data, biometric data, health records, or a person's sexual orientation.
Article 5(24) defines biometric data as personal data from specific technical processing of a person's physical, physiological, or behavioral characteristics that allows or confirms unique identification, naming a facial image as an example, so a derived faceprint counts and the definition is not confined to a raw recording.
Article 9(1) prohibits the processing of sensitive data outright, and Article 9(2) permits it only in the listed cases, beginning with the data subject's explicit consent to a specified purpose. Article 9(3) bars processing sensitive data about race or ethnic origin unless it ensures justice and equality on that ground and carries appropriate safeguards, and Article 9(4) permits every listed exception only where appropriate technical and security safeguards are in place.
Article 10 confines the processing of criminal records to the control of the competent authority or a specific legal authorization, with adequate protection for the data subject's rights and freedoms. Article 8(6) makes consent based processing of a minor's personal data for the online delivery of goods or services legitimate only where the minor is at least 16, and where the minor is younger, requires consent given or authorized by a parent or legal custodian.
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .