MadagascarLaw No. 2014-038, sensitive personal data
Loi n° 2014-038, arts. 18-19 (données sensibles)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric, Access restriction
- Audit expectation
- none
What it requires
- Do not process sensitive data, including racial origin, biometric, genetic, political opinion, religious or other belief, trade union, health, or sex-life data, unless one of the law's listed exceptions applies, such as the data subject's express consent.NIST Privacy FrameworkCT.PO-P1
- Where an exception permits sensitive data to be processed, put in place the safeguards the law or the CMIL requires for that exception.NIST Privacy FrameworkID.RA-P5
- Restrict processing personal data about offenses, convictions, or safety measures to a court, a public authority managing a public service acting within its legal powers, or a legal auxiliary acting within the strict needs of a legally assigned mission.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 18 and 19 prohibit processing sensitive data, set the exceptions and limit processing of offence and conviction data to courts, public authorities and legal auxiliaries. They state no duty to create, keep or produce a log or record. The register of processing duty sits in Articles 43 and 51, which are not cited on this row.
- Kind
- None
- As of
What this law does
Article 18 bars all processing of sensitive data because of the risk of discrimination and harm to a person's freedoms, and defines sensitive data to include racial origin, biometric data, genetic data, political opinions, religious or other convictions, trade union membership, and data concerning health or sex life.
It then lists the exceptions under which sensitive data may be processed with appropriate safeguards the law or the CMIL defines: the data subject's express consent unless the law bars lifting the prohibition that way, safeguarding the life of the data subject or a third party where the data subject cannot consent, processing by a nonprofit religious, philosophical, political, or trade union body limited to its own members or regular contacts, establishing, exercising, or defending a legal right, preventive medicine, medical diagnosis, care, or health-service management carried out by a health professional or another person bound by professional secrecy, public-interest health research the patient has not opposed, data the data subject has made public, and a public interest the law or the CMIL authorizes under article 46.
Article 19 restricts processing personal data relating to offenses, convictions, and safety measures to courts and public authorities managing a public service acting within their legal powers, and to legal auxiliaries for the strict needs of the missions the law assigns them.
When LexLint raises it
When your app profile says your app processes biometric data, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .