MauritaniaLoi n° 2017-020, catégories sensibles de données
Loi n° 2017-020 du 22 juillet 2017, arts. 12-16, 37 (catégories sensibles de données)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric
- Audit expectation
- none
What it requires
- Before collecting or processing data revealing racial, ethnic, linguistic, or regional origin, political opinion, religious or philosophical belief, trade union membership, sexual life, genetic data, or health, confirm one of the Act's ten listed exceptions applies.NIST Privacy FrameworkCT.PO-P1
- Process data on criminal offences, convictions, or security measures only if you are a court, a public authority, a public-service body, or a legal auxiliary acting within your legal mission.NIST Privacy FrameworkCT.PO-P1
- Process health data only on one of the Act's listed grounds, such as the person's own consent or a public-health necessity, and collect it from the person themselves unless collecting it elsewhere is necessary or they cannot supply it.NIST Privacy FrameworkCT.PO-P1
- Get the Authority's prior authorization before processing genetic data, health-related research data, data on criminal offences or convictions, or biometric data.NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 12 to 16 prohibit processing the listed sensitive categories except on the grounds article 13 lists, limit offence data to courts, public authorities and legal auxiliaries (article 14), and set the grounds for health data (article 15) and its collection from the person (article 16). Article 13, point 2 accepts the person's written consent in any form, which is a condition of processing and states no record to keep. Article 37 requires the Authority's prior authorization for genetic, health research, offence, biometric and national-identifier processing, a filing with the Authority and not a record the controller keeps. None of these provisions requires a person to make, keep or produce a log or record.
- Kind
- None
- As of
What this law does
Article 12 prohibits collecting or processing data revealing racial, ethnic, linguistic or regional origin, filiation, political opinion, religious or philosophical belief, trade union membership, sexual life, genetic data, or health, and article 13 lifts that prohibition only on the ten grounds it lists, including data the person has made public, their written consent, a vital interest they cannot otherwise consent to, a legal claim, an open judicial or criminal proceeding, a public interest historical, statistical or scientific motive, a contract, a legal obligation, a public mission, or the internal activity of a nonprofit body with a political, philosophical, religious or trade union purpose.
Article 14 restricts processing data on offences, criminal convictions or security measures to courts, public authorities and public service bodies acting within their legal remit, and to legal auxiliaries strictly for the missions the law assigns them.
Article 15 makes processing health data lawful only on one of eight listed grounds, including the person's consent, data they have made public, protecting vital interests, a legal purpose, public health promotion such as screening, preventing a certain danger or a specific offence, a legal claim, or preventive medicine and care.
Article 16 requires health data to be collected from the person themselves unless collecting it elsewhere is necessary for the processing or the person cannot supply it themselves. Article 37 also requires the Authority's prior authorization before processing genetic data or health related research data, data on offences, convictions or security measures, or biometric data, so these categories carry a registration burden on top of article 12's prohibition and article 14's restriction.
When LexLint raises it
When your app profile says your app processes biometric data, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .