SurinameDraft Law on the Protection of Privacy and Personal Data, special categories, children and criminal data
Arts. 7-9 Wet Bescherming Privacy en Persoonsgegevens
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric, Age verification
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Process a child's personal data based on consent only where the child is at least sixteen, or where a legal representative has consented for a younger child after you take reasonable steps to verify that; never process a child's personal data in a way inconsistent with the child's interest.NIST Privacy FrameworkCT.PO-P1
- Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data about a person's sexual behaviour or orientation, unless a listed exception applies, such as the data subject's explicit consent.NIST Privacy FrameworkCT.PO-P1
- Take particular care when you do process the data listed above, so it does not cause unfair discrimination, prejudice, or other harm to the data subject.NIST Privacy FrameworkID.RA-P5
- Process personal data about a criminal conviction or offence only under the supervision of an official authority, or where a specific law permits it with appropriate safeguards; keep a comprehensive register of convictions only under such supervision.NIST Privacy FrameworkCT.PO-P1
- If you are not an official authority and you process criminal conviction data for an employment law purpose, keep an internal policy document explaining your procedures for complying with the article 5 principles and your retention and erasure policy for that data, and make it available to the Commissioner on request.NIST Privacy FrameworkGV.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.RA-P5Risk responses are identified, prioritized, and implemented.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 9(2) lets a controller that is not an official authority process criminal-conviction and offence data for an employment-law purpose only if it has an internal policy document that explains its procedures for complying with the article 5 principles and its policy on keeping and erasing that data, and the controller makes the document available to the Commissioner on request. A written policy states rules and is not a record of processing, access or decisions, so the duty is none; the Commissioner's right to the document is the check on request. The article sets no period for keeping the document and names no log. Article 9(1) allows a comprehensive register of convictions to be kept only under the supervision of an official authority, which limits who may keep one and is not a duty to keep a record. Article 7(1) asks a controller to make reasonable efforts to verify that a child's legal representative consented, and article 8 prohibits special categories with listed exceptions; neither asks for a record. The text is a draft bill.
- Kind
- None
- As of
What this law does
Article 7 sets the age at which a child's own consent to processing is valid at sixteen; below that age, processing based on consent is lawful only where a legal representative gave it, the controller must take reasonable steps to verify that, and a child's personal data may never be processed in a way inconsistent with the child's interest.
Article 8(1) prohibits processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and prohibits processing genetic data, biometric data, health data, or data concerning a person's sexual behaviour or orientation, subject to the exceptions article 8(2) lists, such as the data subject's explicit consent or processing necessary to protect vital interests.
Article 8(3) requires particular care in processing that data so it does not cause unfair discrimination, prejudice, or other harm to the data subject. The bill defines biometric data as personal data resulting from specific technical processing of a natural person's physical, physiological or behavioural characteristics that allows or confirms that person's unique identification, expressly including facial images, blood type, fingerprints, DNA analysis, retinal scans, and voice recognition.
Article 9(1) allows processing personal data about a criminal conviction or offence only under the supervision of an official authority, or where a specific law permits it with appropriate safeguards, and reserves a comprehensive register of convictions to supervision by an official authority; article 9(2) lets a controller that is not an official authority process such data for an employment-law purpose only if it keeps an internal policy document, available to the Commissioner on request, explaining its article 5 compliance procedures and its retention and erasure policy for that data.
The bill remains under consideration before De Nationale Assemblee, with no enactment timeline.
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .