LesothoData Protection Act, 2011, sensitive personal information
Data Protection Act, 2011, ss. 29-37 (sensitive personal information)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://lesotholii.org/akn/ls/act/2012/5/eng@2012-02-22In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent
- Audit expectation
- none
What it requires
- Do not process personal information concerning a child who is subject to parental control, or a data subject's spiritual, religious or philosophical beliefs, race or ethnic origin, trade union membership, political affiliation, health, sexual life, or criminal behaviour, unless a listed exemption applies.NIST Privacy FrameworkCT.PO-P1
- Obtain prior parental consent before processing personal information under the parental control exemption, and rely on consent, legal necessity, or Commission authorisation for another listed exemption to the prohibition.NIST Privacy FrameworkCT.PO-P1
- Where you process a data subject's health or sexual life information under a listed exemption and are not otherwise bound by a confidentiality duty, treat the information as confidential unless required by law or your duties to disclose it.NIST Privacy FrameworkPR.DS-P5
- Do not supply personal information about a data subject's spiritual, religious or philosophical beliefs, race, trade union membership, or political affiliation to a third party without the data subject's consent, even where a listed exemption lets you process it.NIST Privacy FrameworkCT.PO-P1
- Apply to the Data Protection Commission for authorisation before processing sensitive personal information in the public interest, and comply with any conditions the Commission imposes on that authorisation.NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 29 prohibits processing a child's information and information on beliefs, race or ethnic origin, trade union membership, political affiliation, health, sexual life or criminal behaviour unless the Act permits it, and sections 30 to 37 set the exemptions for each category. None of them requires a log, register or record or names a check of one. The row has no scope clause among its cited provisions.
- Kind
- None
- As of
What this law does
Section 29 prohibits a data controller from processing personal information concerning a child who is subject to parental control, or a data subject's spiritual, religious or philosophical beliefs, race or ethnic origin, trade union membership, political affiliation, health, sexual life or criminal behaviour, unless the Act specifically permits it.
Biometric identifiers are separately defined in the Act as a technique of personal identification based on physical characteristics including fingerprinting, DNA analysis, retinal scanning and voice recognition, but they are not among the categories section 29 lists, so they carry no heightened restriction beyond the Act's general lawfulness, purpose limitation and security duties.
Sections 30 to 35 exempt specific processing of each listed category, including processing by a spiritual or religious organisation of its own members' beliefs, processing necessary to identify a data subject or comply with the law for race, processing by a trade union of its own members for the union's aims, processing by a political institution of its own members for the institution's aims, and processing by a medical professional, healthcare institution, insurer, school, or correctional or pension body for health or sexual life, each subject to a confidentiality obligation.
Personal information processed under the spiritual, religious, race, trade union or political exemptions may not be supplied to a third party without the data subject's consent.
Section 36 lifts the prohibition more generally where processing is carried out with prior parental consent for a child subject to parental control, where it is necessary to establish, exercise or defend a legal right, to comply with an obligation of international public law, where the Commission has authorised it in the public interest under section 37, where the data subject consents, or where the data subject has deliberately made the information public.
Section 37 lets the Commission authorise a data controller to process personal information where the public interest in the processing substantially outweighs the interference with the data subject's privacy, or where the processing carries a clear benefit to the data subject or a third party that substantially outweighs that interference, subject to any conditions the Commission imposes.
When LexLint raises it
When your app profile says your app serves under-18s, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .