CambodiaCambodia's Draft Law on Personal Data Protection, sensitive personal data
Draft Law on Personal Data Protection, article 14 (sensitive personal data)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://data.opendevelopmentcambodia.net/en/dataset/792fc94d-1a84-49cc-bad3-9b420f99b70f/resource/03e9c060-9bc8-42d5-80a6-8db777f61d1c/downl…A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Obligation class
- Prohibition, Consent, Biometric
- Audit expectation
- none
What it requires
- A data controller must not process sensitive personal data, which includes a facial image, fingerprints, or another biometric identifier, genetic data, health data, and data revealing racial origin, political opinions, religious or philosophical beliefs, or trade union membership, unless it also meets one of nine listed conditions, such as the data subject's explicit consent.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 14 of the draft prohibits processing of sensitive personal data unless the processing has a legal basis under Article 7 and one of nine further conditions applies (explicit consent, employment or social-security obligations, vital interests, a not-for-profit body's members, data made public by the data subject, legal claims, substantial public interest, preventive or occupational medicine, or archiving and research). It requires suitable safeguards in some of those cases and states no log, record or audit. The records duty is in Article 18, which this row does not cite. The row is a draft (Final Version, ). English: sensitive data may not be processed unless an exception applies.
- Kind
- None
- As of
What this law does
Article 14 would prohibit the processing of sensitive personal data unless a data controller both has a legal basis under article 7 and meets one of nine additional listed conditions, beginning with the data subject's explicit consent.
The glossary defines sensitive personal data as personal data revealing racial origin, political opinions, religious or philosophical beliefs, or trade union membership, biometric data, genetic data, health data, and data concerning a natural person's sex life or sexual orientation.
It defines biometric data as personal data resulting from technical processing relating to an individual's physical, physiological, or behavioural characteristics from which they can be identified, giving a facial image or fingerprints as examples. The draft's own final page carries an unsigned, undated National Assembly signature block. The Ministry of Post and Telecommunications' own website confirmed on that the draft remained at a pre-legislative validation-workshop stage.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .