BelarusLaw of the Republic of Belarus On Personal Data Protection, special personal data
Law No. 99-Z, arts. 1, 8 (special personal data)
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Obligation class
- Consent, Prohibition, Biometric
- Audit expectation
- none
What it requires
- Do not process special personal data, meaning data on race or nationality, political opinions, trade union membership, religious or other beliefs, sex life or health, administrative or criminal records, or biometric or genetic data, without the personal data subject's consent, unless a listed exception applies, such as the data having been publicly disclosed by the subject, a labor relations purpose, or medical care by a bound professional, under Article 8.NIST Privacy FrameworkCT.PO-P1
- Treat an image from which fingerprints, palmprints, iris or face features can be read as biometric personal data, not only a directly captured template, under the Article 1 definition.
- Adopt a set of measures against the risks processing poses to a personal data subject's rights and freedoms before relying on any Article 8 exception to process special personal data.NIST Privacy FrameworkID.RA-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 1 defines special personal data and Article 8 prohibits processing it without consent, except in listed cases, and permits it only when measures against the risks to data subjects have been adopted. No clause requires a log, register or record to be kept or produced. The cited articles state no territorial scope clause.
- Kind
- None
- As of
What this law does
Article 1 defines special personal data as personal data related to race or nationality, political opinions, trade union membership, religious or other beliefs, sex life or health, administrative or criminal records, and biometric and genetic personal data, with biometric personal data itself defined as information characterizing the physiological and biological particularities of an individual used for unique identification, naming fingerprints, palmprints, iris, and face features and their image as examples.
This definition is not confined to a directly captured biometric template, and reaches an image from which those features can be read.
Article 8 prohibits processing special personal data without the personal data subject's consent, except in the listed cases, including where the personal data subject has made the special personal data publicly disclosed himself, for labor relations, for medical care by a professional bound to patient confidentiality, for the administration of justice, or for national security, anti corruption or anti money laundering purposes, and permits processing in those cases only where a set of measures against the risks it poses to personal data subjects' rights and freedoms has been adopted.
When LexLint raises it
When your app profile says your app processes biometric data, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .