AlgeriaLoi n° 18-07 relative à la protection des personnes physiques, catégories de données sensibles et biométriques
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Obligation class
- Prohibition, Consent, Biometric
- Audit expectation
- none
What it requires
- Do not process data revealing racial or ethnic origin, political opinions, religious or philosophical convictions or trade-union membership, nor health data including genetic data, unless the data subject gave express consent, a public interest or legal provision authorises it, or the ANPDP authorised it.NIST Privacy FrameworkCT.PO-P1
- Where you process genetic data as a doctor or biologist for preventive medicine, diagnosis or care, or process data a person has manifestly made public, or process sensitive data to establish or defend a legal claim, rely on the specific article 18 ground rather than express consent.NIST Privacy FrameworkCT.PO-P1
- If you are the judicial authority, a body legally empowered to investigate offences, a judicial auxiliary or the prison administration processing personal data under Title V bis for the prevention or detection of offences, investigations, inquiries, criminal prosecutions or the execution of sentences, put in place technical and organisational measures giving an appropriate level of protection for sensitive and biometric data.NIST Privacy FrameworkPR.DS-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 18 prohibits the processing of sensitive data and lists the cases in which it is allowed. Article 45 bis 7, inserted by Law n° 25-11, asks the controller or processor for security measures suited to sensitive and biometric data and names no log or record. The register and the operations log of articles 41 bis 2 and 41 bis 3 are in another row, and article 45 bis 3, which refers to them, is not cited here, so they are not read into this one. The provisions cited here contain no scope clause, so no territorial hook is recorded.
- Kind
- None
- As of
What this law does
Article 18 prohibits processing sensitive data, defined at article 3 as data revealing racial or ethnic origin, political opinions, religious or philosophical convictions or trade-union membership, or relating to health including genetic data; that list was left unchanged by loi n° 25-11.
The prohibition lifts only for a public-interest reason indispensable to the controller's legal or statutory functions, the data subject's express consent, a legal provision authorising it, or the ANPDP's own authorisation, and article 18 separately authorises the processing of sensitive data to defend a person's vital interests where they cannot consent, by a non-profit political, philosophical, religious or trade-union body confined to its own members, over data manifestly made public by the data subject, to establish or defend a legal claim, or of genetic data by a doctor or biologist for preventive medicine, diagnosis or care.
Loi n° 25-11 of defined biometric data at article 3 as personal data resulting from specific technical processing relating to a natural person's physical, physiological or behavioural characteristics that allow or confirm their unique identification, but did not add biometric data to article 18's sensitive-data list.
The only operative duty loi n° 25-11 attaches to biometric data is article 45 bis 7, which requires the controller or processor to put in place technical and organisational measures giving an appropriate level of protection for processing of sensitive and biometric data.
That article sits inside the new Title V bis Chapter 4, which article 45 bis confines to personal-data processing for the prevention or detection of offences, investigations, inquiries, criminal prosecutions, or the execution of sentences, carried out only by the judicial authority, a body legally empowered to investigate offences, a judicial auxiliary, or the prison administration.
Existing data controllers had one year from the installation of the Autorité nationale de protection des données à caractère personnel (ANPDP) to comply, which Algeria's state press agency reported took place on , placing that compliance deadline on .
When LexLint raises it
When your app profile says your app processes biometric data, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .