EgyptEgypt Personal Data Protection Law, Sensitive Personal Data and a child's data
Law No. 151 of 2020, Article 12 (Sensitive Personal Data and a child's data)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Licensing, Consent, Biometric, Age verification
- Audit expectation
- none
What it requires
- Obtain a Personal Data Protection Center license before collecting, storing, transferring, or processing any Sensitive Personal Data, including a biometric, health, genetic, financial, religious, political, or criminal-record identifier, or any data relating to a child.NIST Privacy FrameworkGV.PO-P5
- Obtain a parent or legal guardian's consent before processing a child's personal data, and do not condition a child's participation in a game, competition, or activity on personal data beyond what participation requires.NIST Privacy FrameworkCT.PO-P1
- Obtain the Data Subject's explicit written consent before any dealing with their Sensitive Personal Data, outside the cases a law authorises, on top of the Center's licence.NIST Privacy FrameworkCT.PO-P1
- Treat any data relating to a child as Sensitive Personal Data in every case, whatever its subject matter.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 12 bars handling Sensitive Personal Data, including any data relating to a child, without a Center licence and the Data Subject's explicit written consent (a guardian's for a child). It names no log, register or proof of consent and gives the Center no inspection or production power. The Controller and Processor record duties are in annexed Articles 4(9) and 5(9), which this row does not cite. The law is in Arabic; the English wording is the ILO NATLEX translation.
- Kind
- None
- As of
What this law does
Article 12 prohibits a Controller or Processor, natural or juristic, from collecting, transferring, storing, saving, processing or disclosing Sensitive Personal Data except under a licence issued by the Personal Data Protection Center. Outside the cases a law authorises, the Controller or Processor must also obtain the Data Subject's explicit written consent.
Where any of those activities concerns a child's data, the legal guardian's consent must be obtained instead, and a child's participation in a game, competition or any other activity may not be made conditional on submitting more of the child's Personal Data than participation needs.
Article 1 defines Sensitive Personal Data as data revealing psychological, mental, physical or genetic health, biometric data, financial data, religious beliefs, political opinions or criminal record, and makes any data relating to a child sensitive in every case.
Article 7 of the promulgating law brings the annexed Personal Data Protection Law into force three months after the day following its publication in the Official Gazette, and the law was issued at the Presidency on , so these provisions have bound since .
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, handles health records, provides financial services or processes personal data.
Back to the example · Lint your app
Page updated .