PanamaLey 81 de 2019, sensitive personal data
Ley 81 de 2019, arts. 4(11), 8, 13 and 20 (sensitive personal data)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric
- Audit expectation
- none
What it requires
- Do not transfer sensitive personal data (data touching a person's intimate sphere, or whose misuse could enable discrimination or serious risk, including racial or ethnic origin, religious or philosophical belief, union affiliation, political opinion, health, sexual orientation, or genetic or biometric data) unless the data subject gave explicit authorization or a narrow statutory exception applies.
- Take a data subject's consent to processing sensitive health data only when it is prior, irrefutable and express, a higher bar than ordinary consent.
- Process a patient's health data, as a health establishment or medical professional, only within your own care of that patient, and keep it confidential under professional secrecy.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 4(11), 8, 13 and 20 define sensitive data, require prior, irrefutable and express consent for sensitive health data, limit the transfer of sensitive data and allow health establishments to process their patients' data. A consent standard is a condition of processing, and none of these articles requires a log or record. The register of transfers in Article 31 sits in an article the row does not cite.
- Kind
- None
- As of
What this law does
Article 4(11) defines a sensitive datum as one touching a person's intimate sphere, or whose misuse could cause discrimination or a serious risk, naming racial or ethnic origin, religious, philosophical or moral belief, union affiliation, political opinion, health, sexual orientation, and genetic or biometric data among the enumerated examples.
Article 13 bars transferring sensitive data at all, except with the data subject's explicit authorization, to safeguard the life of a data subject who cannot consent, for the recognition or defense of a right in a judicial proceeding, or for a historical, statistical or scientific purpose that first dissociates the data subject's identity.
Article 8 requires consent to processing sensitive health data to be prior, irrefutable and express, a heightened standard above the ordinary consent article 6 sets. Article 20 lets a public or private health establishment or medical professional collect and process the health data of its own patients, subject to professional secrecy and this Law.
When LexLint raises it
When your app profile says your app processes biometric data, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .