Cabo VerdeLaw No. 133/V/2001 on the Protection of Personal Data, sensitive data categories
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Security
- Audit expectation
- none
What it requires
- Do not process personal data relating to political, philosophical or ideological convictions or positions, religious faith, party or trade union membership, racial or ethnic origin, genetic data, biometric data, data relating to private life, health, sex life or sexual orientation, unless the data subject has expressly consented with guarantees of non-discrimination and adequate security measures, the law authorizes it with the same guarantees, the processing is statistical and not individually identifiable, the CNPD authorizes it, or another of the law's listed grounds is met.NIST Privacy FrameworkCT.PO-P1
- Process health, sex life and sexual orientation data, including genetic data, only through a health professional or other person bound by professional secrecy, only for preventive medicine, work-capacity assessment, medical diagnosis, health or social care or health system management, and only once notified to the CNPD, with adequate information security measures.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkGV.PO-P5
- Process data on suspected illegal activities, criminal and administrative offences, convictions, security measures, fines, additional penalties or disciplinary offences under the CNPD's authorization, which is available where the processing is necessary for your legitimate purposes and does not override the data subject's rights, observing data protection and information security rules.NIST Privacy FrameworkGV.PO-P5
- Do not use profiling that leads to discrimination against individuals on the basis of the special categories of personal data.NIST Privacy FrameworkID.RA-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.RA-P2Data analytic inputs and outputs are identified and evaluated for bias.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 8 bars the processing of the special categories and lists the conditions that lift the bar, and Article 11(2) lets the CNPD authorize processing of data on offences and convictions. The only formality either names is a notification to the CNPD (Article 8(4)) or the CNPD's authorization (Article 11(2)). Neither requires the controller to keep a log or a record, and the consent record of Article 9(1) sits in a section this row does not cite. The cited sections state no territorial hook.
- Kind
- None
- As of
What this law does
Article 8 prohibits processing personal data relating to political, philosophical or ideological convictions or positions, religious faith, party or trade union membership, racial or ethnic origin, genetic data, biometric data, data relating to private life, health, sex life or sexual orientation, except where the data subject has expressly consented with guarantees of non-discrimination and adequate security measures, the law authorizes it with the same guarantees, the processing is statistical and not individually identifiable, or the CNPD authorizes it for an important public interest or the controller's legitimate interests with those guarantees.
Article 8 further permits that processing where it is necessary to protect the vital interests of the data subject or another person and the data subject is unable to consent, is carried out with consent by a nonprofit political, philosophical, religious or trade union body only for its own members' or regular contacts' data, concerns data the data subject has manifestly made public, is necessary for a legal claim, or is necessary for public health reasons with suitable and specific safeguards.
Article 8 additionally permits processing health, sex life and sexual orientation data, including genetic data, for preventive medicine, assessing an employee's capacity to work, medical diagnosis, health or social care or treatment, or management of health and social care systems, provided a health professional bound by professional secrecy, or another person under an equivalent secrecy obligation, carries it out, it has been notified to the CNPD, and adequate information security measures are in place.
Article 8 also bars profiling that leads to discrimination against individuals on the basis of those special categories. Article 11(2) lets the CNPD authorize the processing of personal data on suspected illegal activities, criminal and administrative offences, convictions, security measures, fines, additional penalties and disciplinary offences when it is necessary for the controller's legitimate purposes and the data subject's rights do not prevail.
Lei n.º 121/IX/2021 added biometric data and sexual orientation to the categories Article 8 lists. Lei n.º 121/IX/2021 entered into force thirty days after its own publication on .
When LexLint raises it
When your app profile says your app handles health records, processes biometric data, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .