MoldovaMoldova Law No. 195/2024, special categories, a child's consent and conviction data
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Obligation class
- Prohibition, Consent, Biometric, Age verification
- Audit expectation
- none
What it requires
- Obtain explicit consent or another enumerated exception before processing biometric data, including facial images, of a person in Moldova for unique identification.
- Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, nor genetic data or data concerning health, sex life or sexual orientation, unless one of the article 9(2) cases applies.
- Where you offer an information society service directly to a child, make reasonable efforts to verify that the holder of parental responsibility gave or authorised the consent, taking available technology into account.
- Process personal data relating to criminal convictions and offences only as article 10 permits.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 8 to 10 set the age of consent for information society services, the ban on special categories of data with its exceptions, and the limit on conviction data. Article 8(2) asks the controller to make reasonable efforts to verify that a parent or guardian authorised a young child's consent, which is an effort standard and not a duty to keep or produce a record of the check. Article 10(2) keeps a comprehensive register of criminal convictions under public authority, which is a state register and not a controller's log. The articles state no duty to create, keep or produce a log or record. The record duties of Articles 7(1), 30 and 33(5) sit outside the cited articles. Article 3, the territorial scope clause, is not cited by this row and is not invoked by Articles 8 to 10, so no hook is recorded.
- Kind
- None
- As of
What this law does
Article 8 fixes the conditions on which a child's consent to an information society service offered directly to a child is lawful, and requires the controller to make reasonable efforts to verify that the holder of parental responsibility gave or authorised it, taking available technology into account.
Article 9(1) prohibits processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and the processing of genetic data, of biometric data for the purpose of uniquely identifying a natural person, and of data concerning health or a natural person's sex life or sexual orientation; the law names facial images as a qualifying example of biometric data, so biometric material derived from an ordinary recording is not carved out of the prohibition.
Article 9(2) lifts that prohibition only in the cases it lists, beginning with the data subject's explicit consent to one or more specified purposes and running through employment and social security law, vital interests, the legitimate activities of a not-for-profit body confined to its members, data manifestly made public by the data subject, legal claims, substantial public interest, occupational medicine and health or social care provided under a duty of secrecy, public health, and archiving, research or statistics.
Article 10 governs the processing of personal data relating to criminal convictions and offences. Article 89(1) enters the Law into force on the expiry of 24 months from the date of its publication in the Official Gazette of the Republic of Moldova. The Law's front matter dates that publication , so these provisions bind from .
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .