NicaraguaLey No. 787, Ley de Protección de Datos Personales, sensitive categories of data
Ley No. 787, arts. 3(g), 7(l), 8 (sensitive categories of data)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Publisher's page: http://legislacion.asamblea.gob.ni/normaweb.nsf/9e314815a08d4a6206257265005d21f9/e5d37e9b4827fc06062579ed0076ce1dIn force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Access restriction
- Audit expectation
- none
What it requires
- Process sensitive personal data (racial or ethnic origin, political affiliation, religious or philosophical belief, union membership, health or sex life, criminal record, or financial and credit information) only on a general-interest ground recognized by law, the data subject's consent, or a judicial order.
- Do not create a data file that stores sensitive personal data except as this Act provides, even though a commercial company or nonprofit association may still keep a file of its own members' data.
- Process a person's criminal record or administrative infraction data only if you are a competent public authority acting within your own powers.
- Where you are a hospital, clinic, health center, or health professional, limit the health data you process to a patient's physical or mental health information, and process it under professional secrecy.
- Disclose a company's commercial data about its customers, suppliers, or human resources only with the data subject's consent, under an express law of social interest, or by judicial order.
- Do not compel a data subject to supply their sensitive personal data, except where this Act's own exceptions apply.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 3(g), 7(l) and 8 define sensitive data, bar data files that store it except as the Act provides, and limit who may process it and on what ground. A consent or a court order is a condition of processing; none of the three provisions says to keep a record of it. The row cites no scope clause, so no territorial hook is listed.
- Kind
- None
- As of
What this law does
Article 3, item g, defines sensitive personal data as any information revealing racial or ethnic origin, political affiliation, religious, philosophical, or moral belief, union membership, health or sex life, criminal record or administrative infractions, or economic or financial information, including credit and financial information and any other information that could motivate discrimination, with no reference to biometric or genetic data.
Article 7, item l, bars creating a data file that stores sensitive data, except as this Act provides, though a commercial company or nonprofit association may still keep its own members' data.
Article 8 divides personal data into categories: sensitive personal data may be obtained and processed only for reasons of general interest stated in the law, with the data subject's consent, or by judicial order, and data about criminal record or administrative infractions may be processed only by the competent public authorities within their own powers; health data held by a public or private hospital, clinic, or health center, and by health professionals, is limited to a patient's physical or mental health data and processed under professional secrecy; and commercial data on a company's customers, suppliers, and human resources, kept for advertising purposes or as reserved commercial or business information, may be disclosed only with the data subject's consent, by express law of social interest, or by judicial order.
Article 17, item e, gives every data subject the right not to be compelled to supply sensitive personal data, except as this Act's own exceptions provide.
When LexLint raises it
When your app profile says your app handles health records, provides financial services or processes personal data.
Back to the example · Lint your app
Page updated .