MaldivesMaldives Personal Data Protection Bill, special categories of personal data
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric, Age verification
- Audit expectation
- none
What it requires
- A Controller must not process special categories of personal data, which include biometric data used to identify a person uniquely, genetic data and health data, unless one of the instances section 17 lists applies, such as the data subject's explicit consent to one or more specified purposes.
- A Controller relying on legitimate interest must weigh the position of a child, whose interests and fundamental rights section 16 treats as a particular reason that interest is overridden.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 17 bars processing of special categories of personal data except in listed instances (explicit consent, employment, public record, vital interests, health care, public interest, legal claims) and section 56 defines the categories. Neither section requires a log, a record of the consent or any other record, and neither names an audit or a person who may inspect. The consent-demonstration duty in section 19(a) sits outside the cited sections.
- Kind
- None
- As of
What this law does
Section 17 would prohibit the processing of special categories of personal data except in the instances it lists, beginning with the data subject's explicit consent to one or more specified purposes.
The Bill's definition of Special Categories of Personal Data would take in personal data revealing racial or ethnic origin, political opinions or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, and data concerning a natural person's sex life or sexual orientation.
Section 16 would treat a child's position as a reason the interests and fundamental rights of the data subject override a legitimate interest relied on for processing. The Bill's own text carries no Act number and no record of ratification or gazette publication. The Bill was submitted to the People's Majlis on .
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s or handles health records.
Back to the example · Lint your app
Page updated .