LebanonLaw No. 81/2018, Part V, health, genetic identity and sexual-life data
Law No. 81/2018, Arts. 91 and 97(3) (health, genetic identity and sexual-life data)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Licensing
- Audit expectation
- none
What it requires
- Do not collect or process data that reveals, directly or indirectly, the health status, genetic identity or sexual life of a person in Lebanon.NIST Privacy FrameworkCT.PO-P1
- Rely on one of the four exceptions only: the person made the data public or explicitly agreed to the processing and no legal impediment applies, the processing is necessary to establish a medical diagnosis or provide medical treatment by a healthcare professional, a right is being proved or defended before a court, or you hold a licence under Article 97.NIST Privacy FrameworkCT.PO-P1
- Apply to the Minister of Public Health for that licence before processing health, genetic-identity or sexual-life data, and treat silence for two months from the application as a refusal.NIST Privacy FrameworkGV.PO-P5
- Treat a voiceprint, a faceprint or any other biometric identifier as ordinary personal data under the Article 95 permit rule: Lebanon's special-category list names only health status, genetic identity and sexual life, and the act sets no heightened biometric standard.
- Treat a child's personal data as ordinary personal data as well, since the act sets no age threshold, no parental-consent rule and no children's design duty.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 91 prohibits collecting or processing data that reveals health status, genetic identity or sexual life outside four exceptions, and Article 97(3) subjects that processing to a licence issued by decision of the Minister of Public Health on application. The licence is a prior authorization, and neither article asks for a log or a record, or for a review of one.
- Kind
- None
- As of
What this law does
Article 91 prohibits collecting or processing any data that reveals, directly or indirectly, the health status, genetic identity or sexual life of the person concerned, and admits four exceptions and no others: the person made the data public or explicitly agreed to its processing and no legal impediment stands in the way; the collection or processing is necessary to establish a medical diagnosis or to provide medical treatment by a healthcare professional; a right is being proved or defended before a court; or a licence has been obtained under Article 97.
Article 97(3) is that licence, issued for cases of health, genetic identity or sexual life of persons by a decision of the Minister of Public Health, and Article 97 gives the Minister two months from the application, after which the licence is deemed implicitly denied.
That list is the whole of Lebanon's special-category law: it names no biometric data, no racial or ethnic origin, no political opinion, no religious belief and no trade union membership, and the act contains no rule at all about a child's personal data, so a voiceprint, a faceprint or a minor's data is governed by the ordinary permit regime of Articles 94 to 96 rather than by a heightened standard.
Article 136 makes the law effective three months after its publication in the Official Gazette, so these provisions bind today.
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .