DjiboutiDigital Code, Book I: sensitive categories of personal data and the minor's consent
Code Numérique, Livre Premier, Arts. 59 et 62 (consentement du mineur et données sensibles)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric, Age verification
- Audit expectation
- none
What it requires
- Do not process sensitive personal data (racial or ethnic origin, political or philosophical opinions, religious opinions or beliefs, trade-union membership, genetic data, biometric data used to uniquely identify a person, or health data) without the data subject's express consent or another statutory ground.
- Let a minor consent alone to an information-society service's processing of their personal data only from age 16, obtain the consent of the person holding parental authority below that age, and make reasonable efforts to verify it given the technology available.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 59 asks the controller to make reasonable efforts to verify that a minor's consent was given or authorized by the holder of parental responsibility, and Article 62 prohibits processing the listed sensitive categories subject to exceptions, among them the data subject's express and explicit consent. Neither article requires a record of the verification or of the consent to be made or kept, and neither names an inspection of one. The general duty to be able to demonstrate consent is in Article 58, which this row does not cite, so it is not borrowed here. The row's scope clause (Article 4) is not cited, so the row names no territorial hook.
- Kind
- None
- As of
What this law does
Article 59 lets a minor consent alone to an information-society service's processing of their personal data only from age 16, requires the consent of the person holding parental authority below that age, and requires the controller to make reasonable efforts to verify that consent given the technology available.
Article 62 prohibits processing personal data revealing, directly or indirectly, racial or ethnic origin, political or philosophical opinions, religious opinions or beliefs, or trade-union membership, and prohibits processing genetic data, biometric data processed to uniquely identify a natural person, or data concerning health, subject to exceptions including the data subject's express and explicit consent to one or more specific purposes, data the data subject has manifestly made public, and vital-interest or public-health grounds.
The Code's own definition of biometric data names facial images, fingerprint data, voiceprints, DNA and iris data as qualifying examples of a characteristic that allows or confirms unique identification, so a voiceprint or a faceprint derived from an ordinary recording is not carved out of the Article 62 prohibition. The Digital Code, including Book I, was adopted by the National Assembly on and signed by the President of the Republic on .
The Digital Code states no day of entry into force. Under Article 1 of the Civil Code (Loi n° 003/AN/18/8ème L), a law comes into force on the day it fixes or, failing that, on the day after its publication in the Journal Officiel, publication meaning the earliest publication, whether by the National Printing Office (Imprimerie Nationale) or by electronic means. The Digital Code appears in edition n° 04 of the Journal Officiel dated .
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .