Sao Tome and PrincipeLei n.º 03/2016, sensitive categories and suspect records
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2023. Publisher's page: https://www.nadpa-rapdp.org/sites/default/files/2020-11/Law_3_2016_protection_of_personal_data.pdfIn force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Security, Access restriction
- Audit expectation
- none
What it requires
- Before processing a sensitive category of data (political, religious, trade-union or philosophical affiliation, racial or ethnic origin, private life, health, sex life, or genetic data), obtain the holder's explicit authorization, rely on a specific legal provision, or obtain NAPPD authorization for an important public interest.NIST Privacy FrameworkCT.PO-P1
- Where you process health or sex-life data, including genetic data, for preventive medicine, diagnosis, care or health-service management, do so only through a health professional or another person bound by professional secrecy, notify NAPPD of the processing, and secure it with appropriate information-security measures.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkGV.PO-P5NIST Privacy FrameworkPR.DS-P5
- Obtain NAPPD's authorization before processing sensitive personal data under the important-public-interest ground.NIST Privacy FrameworkGV.PO-P5
- Maintain a central record of persons suspected of unlawful activity, a criminal offense or an administrative offense, and of penalties, security measures, fines or ancillary sanctions, only where you are a public service with specific legal competence to do so, and limit any processing for police investigation to what a specific danger or offense requires.NIST Privacy FrameworkCT.PO-P1
- Put in place the special safety measures the Law requires of a controller that processes sensitive data under Article 7(2) or keeps records of suspected unlawful activity under Article 8: control of premises entry, data-carrier handling, unauthorized disclosure, system access, transmission, and data-entry logging, and keep health and sex-life data logically separated from other personal data.NIST Privacy FrameworkPR.AC-P4NIST Privacy FrameworkPR.AC-P2NIST Privacy FrameworkCT.DM-P8
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance with policy and incorporating the principle of data minimization.
- PR.AC-P2Physical access to data and devices is managed.
- PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-018Agent Authority Least Privilege Framework
3 more
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-023Agentic System Credential Protection Framework
- AIR-DET-001AI Data Leakage Prevention and Detection
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
What the log must hold
Event time, Actor identity
Logging duty
Article 16(1)(g) makes a controller that processes sensitive data under Article 7(2) or keeps suspect records under Article 8 ensure that the data entered can be recorded as to when and by whom (control of introduction). The period for the record is left to the sector regulations and no figure is stated, so no retention is coded. The central records of Article 8(1) are a data set about offenders kept by public services, not a log of the controller's own processing. Article 16(2) lets the National Agency waive certain security measures. The articles cited here contain no territorial scope clause.
- Kind
- Explicit
- As of
- Provision
- Article 16(1)(g) (control of introduction: the personal data entered, when and by whom, can be recorded)
- Trigger
- personal_data_processing
What this law does
Article 7(1) defines a sensitive category as data on philosophical or political belief, membership of a political or trade-union association, religious belief, private life, racial or ethnic origin, health or sex life, including genetic data; biometric identifiers as such are not named among these categories.
Article 7(2) permits processing this data only under a legal or organic provision that expressly authorizes it, NAPPD's authorization for an important public interest indispensable to its own attributions, or the holder's explicit authorization, and Article 7(3) adds narrower grounds: protecting the vital interests of a person unable to consent, processing by a political, philosophical, religious or trade-union body about its own members with their consent, data the holder has manifestly made public, or a judicial defense.
Article 7(4) permits processing health or sex-life data, including genetic data, for preventive medicine, diagnosis, care or health-service management only through a health professional or another person bound by secrecy, notified to NAPPD under Article 21, and secured by appropriate information-security measures.
Article 8 restricts the central record of persons suspected of unlawful activity, a criminal offense or an administrative offense, and of the penalties, security measures, fines or ancillary sanctions imposed on them, to a public service with specific legal competence, and limits processing for police investigation to what a specific danger or offense requires.
Article 16 requires the controllers covered by Articles 7(2) and 8 to take special safety measures: controlling entry to their premises, preventing unauthorized reading, copying, alteration or removal of data carriers, preventing unauthorized disclosure or alteration, controlling system access and data transmission, logging who enters data and when, and keeping health and sex-life data logically separate from other personal data; NAPPD may also require encryption where transmission over the Article 7 network would otherwise put the holders' rights at risk.
Article 47 defers the Law's own entry into force to general law without stating a day.
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .