MontenegroLaw on Personal Data Protection, special categories of data
Law on Personal Data Protection, arts. 9(7)-(9), 12-14 (special categories of data)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Prohibition, Biometric
- Audit expectation
- none
What it requires
- Do not process special categories of data, meaning data on racial or ethnic origin, political opinion, religious or philosophical belief, trade union membership, health or sex life, unless one of the exceptions in Article 13 applies, starting with the person's explicit consent.
- Process a child's personal data in a manner that is in the best interest of the child, under Article 12.NIST Privacy FrameworkGV.PO-P2
- Distinctively designate and protect special categories of data against unauthorised access, under Article 13.NIST Privacy FrameworkID.IM-P6NIST Privacy FrameworkPR.AC-P4
- Do not process personal data relating to criminal offences, imposed criminal or misdemeanor penalties or security measures except by, or under the supervision of, the competent state authority, and only with the safeguards the law requires, under Article 14.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P6Data elements within the data actions are inventoried.
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 9(7) to (9) define special categories of data, Article 12 requires a minor's data to be processed in the minor's best interest, Article 13 limits special-category processing to listed cases and requires those data to be marked and protected, and Article 14 limits processing of criminal-offence data to or under a competent state body. Marking and protecting data is a safeguard and not a duty to create, keep or produce a log or record. The record duties of Article 19, Article 24(3) and Article 26 sit outside the cited articles. Article 5, the territorial scope clause, is not cited by this row, so no hook is recorded.
- Kind
- None
- As of
What this law does
Article 9 defines special categories of personal data as data relating to racial or ethnic origin, political opinion, religious or philosophical belief, trade union membership, health or sex life. Article 9 defines biometric data generically, without enumerated examples, as data on physical or physiological characteristics that every natural person has, that are specific, unique and unchangeable, and from which identity can be established directly or indirectly.
Article 12 requires personal data concerning minors to be processed in accordance with the law, in a manner that is in the best interest of the minor.
Article 13 permits processing special categories of data only with the person's explicit consent, where necessary for employment under the law governing employment relations with adequate safeguards, for detecting, preventing or diagnosing illness and treating the person or managing health services when a health worker or another person under a secrecy duty processes the data, to protect the vital interests of the person or of another who cannot consent, or in other cases a law prescribes, where the person has manifestly made the data public or processing is necessary to exercise or protect their legal interests before a court or other body, or in the lawful activity of a non-governmental organization, association or other non-profit body with political, philosophical, religious or trade-union aims, for its members and persons in regular contact only and without disclosure absent their consent.
Article 13 requires special categories of data to be distinctively designated and protected against unauthorized access. Article 14 confines the processing of personal data on criminal offences, imposed criminal and misdemeanor penalties or security measures to the competent state authority or its supervision, with safeguards required by law. The Law as first enacted came into force on and has applied since . The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app serves under-18s, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .