MaliLoi n° 2013-015, sensitive data and offence records
Loi n° 2013-015, arts. 9-10 (sensitive data and offence records)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Access restriction
- Audit expectation
- none
What it requires
- Do not process sensitive data (data relating to religious, philosophical, political, or union opinions or activities; sexual life or racial origin; health; social measures; prosecutions; or penal or administrative sanctions) unless the Autorité de Protection des Données à Caractère Personnel has defined appropriate safeguards for it and one of the listed conditions applies, such as necessity to safeguard the life of the data subject or a third party who cannot consent.
- Limit any processing of personal data relating to offences and convictions to a court or public authority acting within its legal powers, a judicial auxiliary acting for the strict needs of duties the law assigns it, or another legal person handling, for the strict needs of managing contentious matters, offences of which it was itself the victim.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 9 forbids processing sensitive data except where the Autorité's safeguards are met, and Article 10 limits processing of offence and conviction data to courts and public authorities, auxiliaries of justice and, for their own litigation, other legal persons. Neither article requires the controller to keep a log, register or record, and neither names a review of one.
- Kind
- None
- As of
What this law does
Article 3(11) defines sensitive data as data relating to religious, philosophical, political, or union opinions or activities, sexual life or racial origin, health, social measures, prosecutions, or penal or administrative sanctions, and article 9 prohibits any processing of it outright, given the risks of discrimination and harm to persons' rights and freedoms.
Article 9 permits sensitive data to be processed by derogation only where the Autorité de Protection des Données à Caractère Personnel has defined appropriate safeguards for the processing, and only where the processing is necessary to safeguard the life of the data subject or a third party where the data subject cannot give consent because of a legal incapacity or a material impossibility, is carried out by a non-profit religious, philosophical, political, or union association or body solely to manage its own members, or is necessary to establish, exercise, or defend a right in court.
Article 10 confines any processing of personal data relating to offences and convictions to courts and public authorities managing a public service and acting within their legal powers, judicial auxiliaries acting for the strict needs of the duties the law assigns them, and other legal persons handling, for the strict needs of managing contentious matters, offences of which they were themselves the victim.
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .