Express consent for sensitive personal information
In force since .
A sensitive categories rule binding private bodies.
- Audit expectation
- none
What it requires
- Treat personal information as sensitive when, due to its nature, in particular a medical, biometric or otherwise intimate nature, or the context of its use or communication, it carries a high level of reasonable expectation of privacy.
- Obtain the person's express consent, not an inferred or bundled one, before using sensitive personal information for a new purpose or communicating it to a third person.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Sections 12 and 13 require the person's express consent to use or communicate sensitive personal information (and consent otherwise, subject to the listed exceptions) and define sensitive and de-identified information. Neither section tells the enterprise to record, prove or keep evidence of the consent; the rules on what consent must look like are in section 14, which the row cites only as a range and which also names no record. The record of a communication (s 3.5) and the one-year retention of information used for a decision (s 11) are in sections this row does not cite, so they are not borrowed. The sections bind any person carrying on an enterprise and state no territorial hook.
- Kind
- None
- As of
What this law does
Personal information is sensitive, for the purposes of this Act, if due to its nature, in particular its medical, biometric or otherwise intimate nature, or the context of its use or communication, it entails a high level of reasonable expectation of privacy.
Consent to use sensitive personal information for a purpose other than the one for which it was collected, and consent to communicate sensitive personal information to a third person, must each be given expressly rather than being inferred from conduct or a general privacy notice.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .