EthiopiaPersonal Data Protection Proclamation, sensitive personal data and minors
Proclamation No. 1321/2024, arts. 9-11 (sensitive personal data and minors)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric, Age verification
- Audit expectation
- none
What it requires
- Do not process sensitive personal data, including genetic or biometric data, unless a listed exception applies, such as the data subject's specific written consent.NIST Privacy FrameworkCT.PO-P1
- Process a minor's personal data only with the consent or authorization of a parent, guardian, or tutor, or where necessary to the minor's vitally important interest, and never for marketing, profiling, or merging of profiles.NIST Privacy FrameworkCT.PO-P1
- Do not process sensitive personal data in respect of race or ethnic origin unless the processing ensures justice and equality with regard to race or ethnic origin and is carried out with appropriate safeguards for the data subject's rights and freedoms.NIST Privacy FrameworkCT.PO-P1
- Where an exception does permit sensitive personal data to be processed, put appropriate technical and security safeguards in place first.NIST Privacy FrameworkPR.DS-P5
- Make reasonable efforts to verify the age of a data subject, and that consent was given or authorized by the minor's parent or guardian, taking available technology into account.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
What the log must hold
Age assurance result, Consent or opt-out state
Logging duty
Articles 9 to 11 name no log or register. Article 11 puts the burden of proof on the controller that a minor's data is processed in the minor's interests and requires reasonable efforts to verify age and parental consent, which a controller can show only from a record; so the duty is implicit. Article 9(2)(a) requires written consent for sensitive personal data but does not say it is kept. The record duty in Article 46 is not cited by this row. These articles have no scope clause.
- Kind
- Implicit
- As of
- Provision
- Article 11(1) (the controller bears the burden of proof) and Article 11(3) (reasonable efforts to verify a data subject's age and a parent's or guardian's consent)
- Trigger
- age_assurance
- consent_or_optout
What this law does
Article 9(1) prohibits the processing of sensitive personal data outright, and article 9(2) permits it only in the listed cases: the data subject's written consent, specific to the purpose and given before the processing, unless a law bars the data subject from lifting the prohibition; protecting the life or health of the data subject or another person where the data subject cannot express consent; the lawful non-commercial objectives of public organizations; medical treatment carried out by a medical treatment institution; and the protection of lawful rights and interests in court or other public proceedings, or processing by a not-for-profit body with a political, philosophical, religious or trade union aim that relates solely to its members and is not disclosed outside it without consent.
Article 9(3) bars processing sensitive personal data in respect of race or ethnic origin unless it ensures justice and equality on those grounds and carries appropriate safeguards, and article 9(4) permits the listed cases only where appropriate technical and security safeguards are in place. Article 10 lets a Regulation add further categories of sensitive personal data.
Article 11 requires a minor's personal data to be processed in a manner that protects and advances the minor's rights and best interests, with the burden of proof on the data controller, and makes that processing lawful only where consent is given or authorized by the minor's parent, guardian or tutor, or where the processing is necessary to the minor's vitally important interest; the data controller must make reasonable efforts to verify the data subject's age and that the consent came from a parent or guardian, taking available technology into account, and processing a minor's personal data for marketing, profiling or merging of profiles is not allowed at all.
Article 70 enters the Proclamation into force on the date of its publication in the Negarit Gazeta, and it was signed at Addis Abeba on the 24th day of July 2024, so these provisions bind today.
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, handles health records, sends automated outreach, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .