San MarinoSan Marino Law No. 171, special categories of personal data
Legge 21 dicembre 2018 n. 171, articolo 8 (categorie particolari di dati personali)
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Obligation class
- Prohibition, Consent, Biometric
- Audit expectation
- none
What it requires
- Obtain explicit consent or another Article 8(2) exception before capturing or storing a biometric identifier of a person in San Marino; Article 8(1) prohibits processing biometric data absent one.
- Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, nor genetic data or data concerning health, sex life or sexual orientation, unless one of the article 8(2) cases applies.
- Where you rely on the not-for-profit body ground, confine the processing to the body's members or regular contacts and do not disclose the data outside it without the data subject's consent.
- Where you rely on the health-care ground, process only by or under the responsibility of a professional bound by an obligation of secrecy.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 8 prohibits processing special categories of personal data (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and biometric data, health and sex life or orientation) and lists the exceptions in comma 2. It requires no log, register or record and names no audit or party who may ask for one. The article carries no scope clause, so the hook is empty.
- Kind
- None
- As of
What this law does
Article 8(1) prohibits processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and the processing of genetic data, of biometric data, and of data concerning health or a natural person's sex life or sexual orientation.
Article 8(2) lifts that prohibition only in the cases it lists, which mirror the General Data Protection Regulation (GDPR)'s: the data subject's explicit consent to one or more specified purposes; obligations and rights in the field of employment, social security and social protection law; the vital interests of the data subject or another person where the data subject is incapable of consenting; processing in the course of the legitimate activities of a foundation, association or other not-for-profit body with a political, philosophical, religious or trade union aim, confined to its members and not disclosed onward without consent; data manifestly made public by the data subject; legal claims and courts acting judicially; substantial public interest; preventive or occupational medicine and the provision of health or social care by or under the responsibility of a professional bound by secrecy; public health; and archiving in the public interest, scientific or historical research or statistics.
Article 2(1)(p) defines biometric data as personal data obtained from specific technical processing relating to the physical, physiological or behavioral characteristics of a natural person that allow or confirm unique identification, such as facial images or fingerprint data. Law 171/2018 was approved by the Great and General Council on and promulgated by the Captains Regent on , the date carried in the law's own official title.
Article 129 provides that the law enters into force on the fifteenth day after its legal publication. The Bollettino Ufficiale records its publication on , so the law entered into force on .
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .