MadagascarDecree No. 2023-1541, sensitive personal data
Décret n° 2023-1541, arts. 59-61 (données sensibles)
In force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Security, Licensing, Biometric
- Audit expectation
- none
What it requires
- Do not process sensitive data (racial origin, biometric, genetic, political opinion, religious or other belief, trade union, health or sex-life data) except in a case article 18 of Law No. 2014-038 permits.
- Keep sensitive data adequate, relevant and limited to what the purposes of the processing require.
- Reinforce the security of sensitive-data processing through pseudonymization or encryption.
- Before processing sensitive data, ask the CMIL for authorization, stating the public interest pursued, the type of sensitive data and the person concerned, and do not begin until the CMIL notifies its authorization.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Articles 59 to 61 prohibit processing sensitive data outside the cases of article 18 of the Act, reinforce security and require the CMIL's prior authorization. They state no duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
Article 59 of Decree No. 2023-1541 defines sensitive data as data revealing racial origin, biometric data, genetic data, political opinions, religious or other convictions, trade union membership and data on health or sex life. Article 59 prohibits all processing of sensitive data, because of the risk of discrimination and of harm to personal freedoms. Article 60 allows sensitive data to be processed only in a case that article 18 of Law No. 2014-038 provides.
Article 60 requires sensitive data to be adequate, relevant and limited to what the purposes of the processing require. Article 60 requires the security measures for processing sensitive data to be reinforced through pseudonymization or encryption.
Article 61 requires the controller to ask the CMIL beforehand for authorization to process sensitive data, stating the public interest pursued, the type of sensitive data and the person concerned, and bars starting the processing before the CMIL notifies its authorization.
When LexLint raises it
When your app profile says your app processes biometric data, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .