ColombiaLey 1581 de 2012, Sensitive Categories and Children's Data
Ley 1581 de 2012, arts. 5-7 (Datos Sensibles y Menores)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric, Age verification
- Audit expectation
- none
What it requires
- Before processing sensitive personal data, including data revealing racial or ethnic origin, political opinion, religious or philosophical belief, union or human rights organization membership, health, sexual life, or biometric data, obtain the data subject's explicit authorization; processing sensitive personal data is otherwise prohibited.NIST Privacy FrameworkCT.PO-P1
- Process sensitive personal data without the data subject's explicit authorization only where it protects the data subject's vital interest and they cannot consent, where a not for profit political, philosophical, religious or union body processes it about its own members without disclosing it to third parties, where it is needed to establish, exercise or defend a right in a judicial proceeding, or where it serves a historical, statistical or scientific purpose and the data subject's identity is suppressed.NIST Privacy FrameworkCT.PO-P1
- Do not process a child's or adolescent's personal data unless it is data of a public nature, and provide children, adolescents and their guardians with information and training on the risks of improper processing and on the safe, responsible use of their personal data.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 5 to 7 define sensitive data, prohibit its processing outside five exceptions and bar the processing of children's data other than data of a public nature. They state no duty to create, keep or produce a log or record. The article 9 authorization record and the article 12 notice record sit in other rows and are not read into this one. The articles cited here contain no scope clause, so no territorial hook is recorded.
- Kind
- None
- As of
What this law does
Article 5 defines sensitive data as data that affects a person's privacy or whose misuse can generate discrimination, expressly naming racial or ethnic origin, political opinion, religious or philosophical belief, union or human rights organization membership, health, sexual life, and biometric data.
Article 6 prohibits processing sensitive data unless the data subject gives explicit authorization, the processing protects the data subject's vital interest and they cannot consent, a not for profit political, philosophical, religious or union body processes it about its own members without disclosing it to third parties, the processing establishes, exercises or defends a right in a judicial proceeding, or the processing serves a historical, statistical or scientific purpose and suppresses the data subject's identity.
Article 7 bars processing a child's or adolescent's personal data unless the data is of a public nature, and assigns the State and educational entities the task of informing and training legal representatives, guardians, children and adolescents about the risks of improper processing and the safe, responsible use of their personal data.
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .