Côte d'IvoireLaw No. 2013-450 on the Protection of Personal Data, sensitive categories of personal data
Loi n° 2013-450, arts. 7, 21 (sensitive categories of personal data)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.artci.ci/images/stories/pdf-english/lois_english/loi_2013_450_english.pdfIn force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric
- Audit expectation
- none
What it requires
- Obtain ARTCI's prior authorization before processing genetic or medical data and related scientific research, an offense, conviction or court-imposed security measure, or biometric data.NIST Privacy FrameworkGV.PO-P5
- Do not process personal data revealing a person's racial, ethnic or regional origin, political opinion, religious or philosophical belief, trade-union membership, sex life, or genetic data concerning health, unless a listed exception applies.NIST Privacy FrameworkCT.PO-P1
- Where an exception permits processing that data, obtain ARTCI's authorization and design and carry out the processing under its supervision.NIST Privacy FrameworkGV.PO-P5
- Confine processing under the non-profit exception to the body's own members or to people with regular contact related to its purposes, and do not disclose the data to a third party without their consent.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 7 makes processing of genetic, medical, offence and biometric data subject to the Protection Body's prior authorization, and Article 21 prohibits processing of the special categories it lists, with exceptions that are authorized and supervised in their design and implementation by the Protection Body. Neither article requires the person responsible to make, keep or produce a log or record, names an audit of one, or sets a period for one. The sections cited here carry no territorial clause, so the hook is empty; Article 3 is read on the row that cites it.
- Kind
- None
- As of
What this law does
Article 7 requires ARTCI's prior authorization before processing personal data relating to genetic or medical data and to related scientific research, to an offense, a conviction or a security measure imposed by a court, or to biometric data.
Article 21 prohibits, subject to narrow exceptions, any processing that reveals a person's racial, ethnic or regional origin, political opinion, religious or philosophical belief, trade-union membership, sex life, or, more generally, genetic data concerning health.
The prohibition does not apply where the data were manifestly made public by the person concerned, where processing genetic or health data is necessary to protect a vital interest and the person cannot consent, where genetic data is necessary to establish, exercise or defend a legal claim, where a judicial proceeding or a criminal investigation is under way, or where the processing serves the legitimate, membership-only activities of a foundation, association or other non-profit body with a political, philosophical, religious, fraternal or trade-union purpose.
Every case the exceptions permit remains subject to the Protection Body's authorization and supervision of its design and implementation. No commencement notice for the Act has been located in the Official Gazette.
When LexLint raises it
When your app profile says your app processes biometric data, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .