MonacoLoi sur la Protection des Données Personnelles, données sensibles et mineurs
Loi n. 1.565 du 3 decembre 2024, arts. 2, 6-8, 77 (sensitive data, biometric data and minors)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric, Age verification
- Audit expectation
- none
What it requires
- Do not process sensitive data, meaning data revealing political, religious, philosophical, or trade union opinions, racial or ethnic origin, genetic data, biometric data used to identify a person uniquely, or data about health, sex life, or sexual orientation, unless one of the listed exceptions applies.NIST Privacy FrameworkCT.PO-P1
- Where you rely on a person's explicit consent to process their sensitive data, keep evidence that the consent was specific, informed, and given by a clear positive act, since a law can also bar that prohibition from ever being lifted by consent alone.NIST Privacy FrameworkCT.PO-P1
- As an employer, use a biometric identifier only where it is strictly necessary to control access to the workplace or to the devices and applications your employees use for their duties, and only for that purpose.NIST Privacy FrameworkCT.PO-P1
- Where you process personal data of a minor for an information society service on the basis of consent and the minor is under 15, take consent from the minor together with the authorisation of whoever holds parental authority, and make reasonable efforts to verify that the authorisation genuinely came from a parent or guardian.NIST Privacy FrameworkCT.PO-P1
- As an administrative or judicial authority acting in the exercise of your public powers, do not process genetic or biometric data for authentication or identity control without first obtaining the Authority's opinion, and store the raw biometric data separately from any template derived from it.NIST Privacy FrameworkGV.PO-P5NIST Privacy FrameworkCT.DP-P1
- Do not interconnect data from the judicial criminal record with any other file or processing operation.NIST Privacy FrameworkCT.DP-P1
- Put safeguards in place to prevent discrimination or another risk to a person's rights and freedoms wherever an exception lets you process their sensitive data on a public interest, medical, or archival, research, or statistical ground.NIST Privacy FrameworkID.RA-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.RA-P5Risk responses are identified, prioritized, and implemented.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DP-P1Data are processed to limit observability and linkability (e.g., data actions take place on local devices, privacy-preserving cryptography).
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
Where processing rests on consent, Article 6 requires the controller to be able to demonstrate that the person gave it by a clear positive act, which cannot be shown without a record of the consent. Article 7 prohibits processing sensitive data subject to listed exceptions, Article 8 bars interconnecting the criminal record with any other file, and Article 77 sets the Authority's opinion and safeguards for public-authority genetic and biometric processing; none of those names a record. The articles name no regulator access or audit, and the row cites no scope clause.
- Kind
- Implicit
- As of
- Provision
- Article 6, first paragraph
- Trigger
- consent_or_optout
What this law does
Article 2 defines sensitive data as data revealing political, religious, philosophical, or trade union opinions or affiliations, racial or ethnic origin, genetic data, biometric data used to uniquely identify a person, or data about health, sex life, or sexual orientation, and defines biometric data broadly enough to include a facial image or fingerprint data.
Article 7 opens by prohibiting the processing of sensitive data outright, then lists the exceptions that lift the ban, including the person's explicit consent, vital interests, a religious or political body's own members, data the person has manifestly made public, a legal claim, an important public interest ground set by Monegasque law, preventive or occupational medicine and public health, archiving, research, or statistics, and a narrow employer exception for biometric data strictly necessary to control access to the workplace and to the devices and applications employees use for their duties.
Article 6 sets a separate consent floor for a minor using an information society service, and where the minor is under 15 the processing is lawful only with consent from the minor together with the authorisation of whoever holds parental authority.
Article 77 adds a narrower rule reaching only administrative and judicial authorities acting in the exercise of their public powers, requiring the Authority's opinion before they process genetic or biometric data for authentication or identity control, and requiring organisational safeguards such as storing raw biometric data separately from any template derived from it. Article 8 bars any interconnection between the judicial criminal record and any other file or processing operation.
Reading the statute did not surface a general private sector biometric identifier statute of the kind Illinois or Washington enact; Monaco instead treats biometric and genetic data as one item within its ordinary special category regime.
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .