Law / 
Central African Republic
Loi n° 24.001 portant protection des données à caractère personnel, données sensibles et mineurs
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric
- Audit expectation
- none
What it requires
- Get a data subject's explicit consent, and apply extra security and organisational safeguards, before processing a sensitive category of data such as racial origin, biometric or genetic data, health data, or political, religious, or trade union information.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkPR.DS-P5
- Get authorisation from a holder of parental responsibility before processing a minor's personal data, including for a direct offer of information society services to a child.NIST Privacy FrameworkCT.PO-P1
- Do not process sensitive data at all unless a listed derogation applies: the person's express consent unless a law bars it, safeguarding a life, a non profit body's own member processing for its religious, philosophical, political, or trade union purpose, establishing or defending a legal claim, health care or public interest health research, data the person made public, a law authorizing a public interest purpose, or a labor law right or obligation.NIST Privacy FrameworkCT.PO-P1
- Restrict processing of data about a person's offences, convictions, or safety measures to courts and public authorities acting within their legal powers, and to legal auxiliaries strictly for the duties assigned to them by law.NIST Privacy FrameworkCT.PO-P1
- When a processing activity involves sensitive data or a particularly vulnerable person's data, put additional organizational and technical safeguards in place and give that person heightened information before you process it.NIST Privacy FrameworkPR.DS-P5NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
The articles this row cites bar the processing of sensitive data except under listed derogations (explicit consent, safeguarding a life, a legal claim, health care and others), require authorization by a holder of parental responsibility before a minor’s data is processed, and require extra organizational and technical safeguards and heightened information for sensitive or vulnerable-person data. The controller must check that consent for a child was given or authorized by the holder of parental responsibility; that is a check made when the consent is taken, and the text does not ask the controller to keep or produce a record of it. None of these articles requires a person to make, keep or produce a log or record. The register of processing is in the data protection delegate article, coded on the general row.
- Kind
- None
- As of
What this law does
Loi n° 24.001 defines sensitive data as personal data relating to religious, philosophical, or political opinions or activities, sexual life or orientation or racial life, health, including genetic or biometric data, social measures, prosecutions, and criminal or administrative sanctions. A minor's data may be processed only where consent for it is given or authorized by a holder of parental responsibility over the child, including for a direct offer of information society services to children.
Where a processing activity engages sensitive data or the data of a particularly vulnerable person, including a minor, the controller must take every additional appropriate organizational and technical measure to protect the person concerned, and consent must in every case be explicit and require an affirmative act.
Processing sensitive data is otherwise prohibited because of the risk of discrimination or of harming a person's freedoms, covering data revealing racial origin, biometric and genetic data, political opinions, religious or other convictions, trade union membership, and health or sexual life.
By derogation, sensitive data may be processed with appropriate safeguards where the person concerned has given express consent unless a law says otherwise, where processing is necessary to safeguard the life of the person concerned or a third party who cannot consent, where it is carried out by a non profit religious, philosophical, political, or trade union body about its own members without third party disclosure, where it is necessary to establish, exercise, or defend a legal claim, where it serves preventive medicine, diagnosis, care, or health service management by a health professional, where the data were made public by the person concerned, where a law authorizes it for a public interest purpose, or where a labor law right or obligation requires it.
Data about a person's offences, convictions, and safety measures may be processed only by courts and public authorities acting within their legal powers, and by legal auxiliaries strictly for the duties the law assigns them. The Act states that it takes effect from its date of promulgation.
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .