BeninLoi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, données sensibles et mineurs
Loi n°2017-20 du 20 avril 2018, Livre V, arts. 394-404, 407 et 446 (données sensibles et mineurs)
In force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric, Age verification
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Do not process sensitive personal data, including racial or ethnic origin, political opinions, religion or beliefs, trade union membership, genetic data, biometric data used to uniquely identify a person, health data, or data about a person's sex life or sexual orientation, unless a listed exception applies, such as the data subject's explicit consent or data the person has manifestly made public.NIST Privacy FrameworkCT.PO-P1
- Verify that a minor is at least sixteen years old before processing their personal data in connection with an information society service offered directly to them, and otherwise obtain the consent of the holder of parental responsibility, making reasonable efforts to verify that consent given the technology available.NIST Privacy FrameworkCT.PO-P1
- Obtain the Autorité's prior authorization before processing personal data covered by Article 394, personal data processed for journalism, research, artistic, or literary purposes under Article 397, a national identification number, or biometric data.NIST Privacy FrameworkGV.PO-P5
- Do not process personal data about criminal convictions or related security measures except where the law specifically authorizes you to, such as a legal or regulatory obligation, or where it is necessary to manage your own contentious proceedings.NIST Privacy FrameworkCT.PO-P1
- Designate the categories of staff with access to sensitive personal data, keep that list available to the Autorité, and bind them to confidentiality by a legal, statutory, or contractual obligation.NIST Privacy FrameworkPR.AC-P4
- Where sensitive personal data is processed solely on the data subject's written consent, tell the data subject beforehand the reasons for the processing and the categories of staff who will access the data, in addition to the standard information notice.NIST Privacy FrameworkCM.AW-P1
- Do not rely on written consent alone to process sensitive personal data where you are the data subject's present or prospective employer, or where the data subject depends on you in a way that prevents them from freely refusing consent, unless the processing grants them a benefit.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
The controller, and any processor, designates the categories of persons who may access data under Articles 394 and 395, describes each category's function, and keeps that list available to the Autorité. The clause names no log of individual accesses and no period for keeping the list. Article 395 allows a complete register of criminal convictions to be kept only under public authority control, which restricts who may hold one and is not a duty to make a record. The row cites no territorial clause.
- Kind
- Implicit
- As of
- Provision
- Article 402, points 1 and 2 (a list of the categories of persons with access to the sensitive data, with a description of their function, kept available to the Autorité)
- Trigger
- personal_data_processing
What this law does
Article 394 prohibits processing personal data revealing racial or ethnic origin, political opinions, religion or beliefs, trade union membership, genetic data, biometric data used to uniquely identify a person, health data, or data about a person's sex life or sexual orientation, subject to listed exceptions such as the data subject's explicit consent or data the person has manifestly made public.
Article 395 confines processing of personal data about criminal convictions and related security measures to courts, public authorities, and other bodies the law specifically authorizes, and bars a complete register of criminal convictions except under the control of a public authority.
Article 402 requires a controller processing the data Articles 394 and 395 cover to designate the categories of staff with access to it, keep that list available to the Autorité, and bind those staff to confidentiality. Article 403 requires a controller relying solely on the data subject's written consent for that data to tell them beforehand the reasons for the processing and the categories of staff who will access it.
Article 404 bars relying on that consent where the controller is the data subject's present or prospective employer, or where the data subject depends on the controller in a way that prevents freely refusing consent, unless the processing grants the data subject a benefit. Article 407 requires the Autorité's prior authorization before processing the data Article 394 or Article 397 covers, a national identification number, or biometric data.
Article 446 makes processing a minor's personal data in connection with an information society service offered directly to them lawful once the minor is at least sixteen years old, and otherwise requires the consent of the holder of parental responsibility, verified as far as available technology allows. The Digital Code states no day of entry into force, and no Journal officiel publication of it and no other source stating the day it came into force has been located.
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .