PeruLey 29733, sensitive personal data and minors
Ley No. 29733, arts. 2.5, 13.3, 13.6, 14.6 (sensitive data and children)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Biometric, Age verification
- Audit expectation
- none
What it requires
- For sensitive data (biometric data that by itself identifies a person, racial or ethnic origin, income, political, religious, philosophical or moral opinions, union affiliation, or health or sex-life information), obtain the titleholder's consent in writing, in addition to the general consent requirements, and do not process it without that written consent unless a law authorizes processing without it on important public-interest grounds.NIST Privacy FrameworkCT.PO-P1
- Process health data without consent only where necessary, in a risk situation, for the titleholder's medical or surgical prevention, diagnosis, or treatment at a health establishment or by a health-sciences professional observing professional secrecy, for a public-interest or public-health reason the Ministry of Health has qualified as such, or for an epidemiological or similar study using an adequate dissociation procedure.NIST Privacy FrameworkCT.PO-P1
- Let a child or adolescent exercise their data-protection rights through their legal representative, and apply any special measure the regulation sets for processing a minor's personal data.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 2.5, 13.3, 13.6 and 14.6 define sensitive data, leave the special rules for children and adolescents to the regulation, require consent to processing sensitive data to be given in writing, and exempt certain health processing from consent. A consent that must be given in writing is a condition of processing, and none of the four provisions asks the titleholder to keep a log, register or proof or gives the Authority a power to demand one. The regulation's rules on children are outside the row.
- Kind
- None
- As of
What this law does
Article 2.5 defines sensitive data as personal data made up of biometric data that by itself can identify the titleholder, data on racial and ethnic origin, income, political, religious, philosophical, or moral opinions or convictions, union affiliation, and information related to health or sex life.
Article 13.6 requires written consent for processing sensitive data, in addition to the general consent requirements article 13.5 states, and permits processing without it only where a law authorizes it and the processing serves important public-interest grounds.
Article 14.6 lets health data be processed without consent where necessary, in a risk situation, for the titleholder's medical or surgical prevention, diagnosis, or treatment, carried out at a health establishment or by a health-sciences professional observing professional secrecy, or where a public-interest or public-health reason the Ministry of Health has qualified as such applies, or for an epidemiological or similar study using an adequate dissociation procedure.
Article 13.3 defers special measures for processing children's and adolescents' personal data to the regulation, and in the meantime requires children and adolescents to exercise the rights the Law grants through their legal representatives, subject to exceptions the regulation may set having regard to the child's or adolescent's best interest.
When LexLint raises it
When your app profile says your app processes biometric data, handles health records, serves under-18s or processes personal data.
Back to the example · Lint your app
Page updated .