Bosnia and HerzegovinaLaw on the Protection of Personal Data of Bosnia and Herzegovina, special categories, criminal-conviction data and children's consent
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric, Age verification
- Audit expectation
- none
What it requires
- Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union affiliation, genetic data, biometric data for unique identification, health data, or data about a person's sex life or sexual orientation, unless a listed exception in Article 11 applies, such as the person's explicit consent.
- Process personal data about a criminal conviction or offence only under the supervision of a public authority or where a special law authorizes it with safeguards for the person's rights, and keep any register of criminal convictions exclusively under a public authority's control, under Article 12.
- Treat a child's consent to an information-society service offered directly to them as lawful only from age 16, and below that age obtain or verify the consent of a parent, adoptive parent, or guardian, making reasonable efforts to confirm it given available technology, under Article 10.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 10 to 12 require reasonable efforts to verify a parent's or guardian's consent for a child under 16 (Article 10(2)), prohibit special-category processing outside the listed exceptions (Article 11) and confine criminal-conviction processing to a public authority's supervision or a special law (Article 12). None of them asks a controller to make, keep or produce a record, and Article 12's sentence that the register of criminal convictions is kept under a public authority's control is about who holds a state register, not a record duty of a controller. The duty to demonstrate consent sits in Article 9(1), outside this row.
- Kind
- None
- As of
What this law does
Article 11 prohibits processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union affiliation, and processing genetic data, biometric data for uniquely identifying a person, health data, or data about a person's sex life or sexual orientation, unless one of the listed exceptions in Article 11(2) applies, chief among them the person's explicit consent, employment or social-security law, a vital interest, or a substantial public interest carried by a proportionate law.
Article 11(4) lets a specific law add further conditions, including limitations, on processing genetic, biometric or health data. Article 12 confines processing personal data about a criminal conviction, offence or related security measure to the supervision of a public authority or to a special law with safeguards, and keeps a register of criminal convictions exclusively under a public authority's control.
Article 10 makes a child's consent to an information-society service offered directly to them lawful from age 16, and below that age lawful only where a parent, adoptive parent or guardian gives or approves it, with the controller required to make reasonable efforts to verify that consent given available technology.
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .