Ley de Protección de Datos Personales, datos sensibles
Ley Núm. 1/2016, art. 10 (datos sensibles)
In force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent
As of .
What it requires
- Process personal data relating to race, tribe or ethnicity, health, sex life, or religious, political or union creed only with the data subject's express written consent, unless the processing is in a file specially established for a political party, religious confession, trade union or similar association, or another Article 10 exception applies (Article 10).
- Include personal data on the commission of criminal or administrative offences only in the files of the bodies of the General State Administration, in the cases their governing rules provide (Article 10).
These lines are LexLint's reading of the law's text, as of .
What this law does
Article 10 allows personal data relating to race, tribe or ethnicity, health, sex life, or religious, political or union creed to be obtained or processed only with the data subject's express written consent, except in files specially established for that purpose and linked to political parties, religious confessions, trade unions and similar associations or foundations.
Article 10 allows personal data on the commission of criminal or administrative offences to be included only in the files of the competent bodies of the General State Administration, in the cases their governing rules provide. Article 10 permits processing where necessary for medical prevention or diagnosis, healthcare or medical treatment, or the management of health services, provided a health professional bound by professional secrecy carries it out.
Article 10 also permits that processing where necessary to safeguard the vital interest of the data subject or another person who is physically or legally unable to consent. Article 41 classes as a very serious infraction processing or transferring data on freedom of conscience, political affiliation or ideology, health, sex life, race, tribe or ethnicity, or religion without the data subject's express written consent.
When LexLint raises it
When your app profile says your app crawls the web, trains models or handles health records.