ArgentinaLey 25.326, sensitive data categories and health data
Ley 25.326, arts. 7-8 (sensitive data categories and health data)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Access restriction
- Audit expectation
- none
What it requires
- Do not require a person to provide sensitive data (racial or ethnic origin, political opinions, religious, philosophical, or moral convictions, union membership, or health or sexual-life information).NIST Privacy FrameworkCT.PO-P1
- Collect and process sensitive data only for a reason of general interest authorized by law, or for statistical or scientific purposes where the data subject cannot be identified.NIST Privacy FrameworkCT.PO-P1
- Do not form a file, bank, or registry whose purpose is to store information that directly or indirectly reveals sensitive data, unless it is a membership registry a church, religious association, or political or union organization keeps of its own members.NIST Privacy FrameworkCT.PO-P1
- Process a person's criminal or administrative-offense record only if you are a competent public authority acting under the applicable laws and regulations.NIST Privacy FrameworkCT.PO-P1
- As a health establishment or health professional, collect and process a patient's physical or mental health data under the rules of professional secrecy.NIST Privacy FrameworkPR.DS-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 7 and 8 limit the collection and processing of sensitive and health data to reasons of general interest set by law, bar files whose purpose is to reveal sensitive data, and keep health data under professional secrecy. Article 7(3) lets churches and political and union bodies keep a register of their members, which is a permission and not a duty. No log or record duty and no audit is named.
- Kind
- None
- As of
What this law does
Article 7.1 bars requiring any person to provide sensitive data, defined in article 2 as data revealing racial or ethnic origin, political opinions, religious, philosophical, or moral convictions, union membership, or health or sexual-life information; article 7.2 permits collecting and processing it only for reasons of general interest authorized by law, or for statistical or scientific purposes where the data subject cannot be identified.
Article 7.3 bars forming a file, bank, or registry whose purpose is to store information that directly or indirectly reveals sensitive data, but excepts a membership registry the Catholic Church, a religious association, or a political or union organization keeps of its own members. Article 7.4 confines processing of a person's criminal or administrative-offense record to the competent public authorities acting under the applicable laws and regulations.
Article 8 lets a public or private health establishment, or a health professional, collect and process a patient's physical or mental health data under the rules of professional secrecy. The Act's closed sensitive-data list names no biometric identifier, so a faceprint, fingerprint, or voiceprint falls within the Act's general rules rather than this heightened regime.
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .