ComorosLaw on the Protection of Personal Data, sensitive personal data
Loi n° 14-029/AU, arts. 6-8, 43(b)-(d) (sensitive personal data)
In force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric
- Audit expectation
- none
What it requires
- Do not collect or process data revealing political, philosophical or religious opinions, trade union membership, or health or sexual life data, without the data subject's express consent, unless a listed exception applies, such as safeguarding a life the data subject cannot consent to protect.NIST Privacy FrameworkCT.PO-P1
- Process data on offenses, convictions or security measures only as a court, a public authority, a body managing a public service, a legal auxiliary acting within your legal duties, or another legal person managing a dispute over an offense of which you were the victim.NIST Privacy FrameworkCT.PO-P1
- Obtain the Commission's prior authorization and submit to its control before processing biometric data needed to verify a person's identity, data on a person's health or condition, or data on offenses and convictions.NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 6 forbids collecting or processing political, philosophical, religious, trade-union, health and sex-life data without the person's express consent and lets religious, philosophical, political and trade-union groups keep a register of their members if they choose, Article 7 lists the exceptions, Article 8 limits who may process offence and conviction data, and Article 43(b) to (d) subjects biometric, health and offence data to the Commission's prior authorisation. An express consent is a condition of the processing and the text does not say it must be recorded, and an authorisation is a permission from the Commission. None of the articles requires a log, register or record of the controller's own processing. The articles have no territorial clause. The Comoros text cited is the law as deliberated and adopted by the Assemblee de l'Union on , reproduced by ANADEN; no promulgation or Official Gazette copy was read.
- Kind
- None
- As of
What this law does
Article 6 bars collecting or processing data revealing political, philosophical or religious opinions, trade union membership, or health or sexual life data without the data subject's express consent, though a religious, philosophical, political or trade union body may keep an automated membership register free of that bar, and the Commission may allow a further exception for reasons of public interest.
Article 7 lifts the article 6 bar where the data subject has expressly consented and consent may lawfully remove the bar, where processing safeguards a human life the data subject cannot consent to protect, where a non profit, religious, philosophical or trade union body processes data limited to its own members and regular contacts, where the processing establishes, exercises or defends a right in court, or where the processing serves individual therapeutic or medical follow up or health research.
Article 8 restricts processing of data on offenses, convictions or security measures to courts, public authorities and bodies managing a public service acting within their legal duties, legal auxiliaries for the strict needs of the missions the law entrusts to them, and other legal persons for the strict needs of managing disputes over offenses of which they were the victim.
Articles 43(b) to (d) require the Commission's prior authorization and control before processing biometric data needed to verify a person's identity, data on a person's health or condition, or data on offenses and convictions, because of the particular risk such processing poses to privacy and fundamental rights. The Law names no day for its entry into force, and no promulgation decree or commencement notice for it has been located.
When LexLint raises it
When your app profile says your app processes biometric data, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .