Burkina FasoPersonal Data Protection Law, sensitive personal data categories
Loi n°001-2021/AN, arts. 5, 12, 30-31, 35 (données sensibles)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Prohibition, Biometric
- Audit expectation
- none
What it requires
- Obtain the data subject's express consent before collecting or processing sensitive personal data, including data about health, biometric or genetic characteristics, sex life, racial or ethnic origin, political, philosophical, religious or trade union opinions or activity, morals, or criminal investigations, prosecutions, convictions and administrative or safety measures, unless a specific statutory exception applies.NIST Privacy FrameworkCT.PO-P1
- Obtain a Commission de l'informatique et des libertés (CIL) authorization before processing genetic or biometric data in the private sector, including for health research, and before processing personal data about offenses, convictions or safety measures in the private sector.NIST Privacy FrameworkGV.PO-P5
- Restrict any processing of personal data about offenses, convictions or safety measures to a court or public authority acting within its legal powers, a public body managing a public service after the CIL's concurring opinion, or a legal auxiliary acting strictly within duties assigned to it.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 12 bars collecting or processing the listed sensitive categories without the data subject's express consent, Article 30 requires a legislative or regulatory act taken after the CIL's opinion for certain public processing, Article 31 requires a CIL authorization and Article 35 limits who may process offence and conviction data. None asks the controller for a log or record, and the cited articles carry no territorial clause.
- Kind
- None
- As of
What this law does
Article 5 defines sensitive personal data (données sensibles) to include health, biometric and genetic data, sexual life, racial or ethnic origin, political, philosophical or religious opinions or activities, trade union membership, morals, and data about criminal investigations, prosecutions, convictions, and administrative or safety measures.
Article 12 bars collecting or processing that data without the data subject's express consent, subject to a statutory exception, and lets a separate law bar such processing even where the data subject consents.
Article 30 requires a legislative or regulatory act, taken after the CIL's opinion, before a public body, a public establishment, a territorial authority, or a private entity managing a public service processes sensitive personal data under that fourth category, on top of the same requirement for state security, criminal justice, or census processing.
Article 31 requires the CIL's prior authorization before the private sector processes genetic or biometric data, including for health research, before it processes data about offenses, convictions or safety measures, and before it processes biometric data specifically.
Article 35 restricts who may process personal data about offenses, convictions and safety measures to courts and public authorities acting within their legal powers, a public body managing a public service after the CIL's concurring opinion, and legal auxiliaries strictly for the duties assigned to them.
When LexLint raises it
When your app profile says your app processes biometric data, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .