El SalvadorLey para la Protección de Datos Personales, sensitive personal data and children
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric
- Audit expectation
- none
What it requires
- Do not compel a person to provide sensitive personal data (data touching physical or moral characteristics, or facts of private life whose misuse could cause discrimination or gravely harm honor or privacy, including religious belief, ethnic origin, political or union affiliation, sexual preference, health, or biometric or genetic information); take it only with the data subject's express and unequivocal consent after telling them of their right to withhold it.NIST Privacy FrameworkCT.PO-P1
- Obtain a sensitive data subject's consent in writing, by an autograph signature or its equivalent, and apply the Progressive Exercise of Faculties principle to a child's consent to provide their personal data.NIST Privacy FrameworkCT.PO-P1
- Process health data, as a health establishment or professional, only for a patient under your care and only for prevention, diagnosis, treatment or health service management, under professional secrecy.NIST Privacy FrameworkCT.PO-P1
- Collect or process sensitive personal data only where this Law authorizes it, another statute authorizes it for a general interest, you have a legal mandate, or the purpose is statistical or scientific and the data have been dissociated from the data subject.NIST Privacy FrameworkCT.PO-P1
- Do not create a database of sensitive personal data in violation of this Law.NIST Privacy FrameworkCT.PO-P1
- Guarantee the best interests of a child or adolescent in any processing of their data, and inform both the child and their parent or guardian, in clear and age appropriate language, before exercising the child's rights.NIST Privacy FrameworkGV.PO-P2NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
Article 26 requires every consent, including the written consent it demands for sensitive data in its last paragraph, to be recorded by physical, electronic or other technological means, so a controller processing sensitive data must hold a record of the consent. Articles 4(g), 37, 38, 39 and 42 define sensitive data and limit when it may be processed, and add no further record, audit or retention duty. Article 27(d) on demonstrating consent is not cited by this row and is coded on the general row. The cited articles contain no territorial scope clause.
- Kind
- Implicit
- As of
- Provision
- Article 26, first paragraph (consent recorded by physical, electronic or other technological means), which also carries the signed written consent for sensitive data in its last paragraph
- Trigger
- consent_or_optout
What this law does
Article 4(g) defines sensitive personal data as data touching a person's physical or moral characteristics or facts of their private life whose misuse could cause discrimination or gravely harm their honor, personal or family privacy, or image, naming religious belief, ethnic origin, political affiliation, union affiliation, sexual preference, physical and mental health, and biometric or genetic information among the enumerated examples.
Article 26's last paragraph requires a responsible party to obtain a sensitive data subject's written consent, by an autograph signature or its equivalent, a heightened standard above the ordinary consent article 26's first paragraph sets, and its second paragraph applies the Progressive Exercise of Faculties principle to a child's consent to provide personal data.
Article 37 bars compelling anyone to provide sensitive personal data, conditions its processing on the data subject's express and unequivocal consent after being told of the right to withhold it, and excuses that consent only to safeguard the life of an incapacitated data subject or another person, or where a health professional or an equivalently bound person processes health data for prevention, diagnosis, treatment, or health service management under professional secrecy.
Article 38 limits collecting and processing sensitive personal data to cases this Law authorizes, cases of general interest another statute authorizes, a legal mandate, or statistical or scientific purposes once the data have been dissociated from the data subject. Article 39 lets a health establishment or health professional collect and treat a patient's physical or mental health data, respecting professional secrecy, patient rights legislation, and this Law.
Article 42 requires every kind of processing to guarantee the best interests of children and adolescents, to inform both the child and their parents or guardians of the processing before exercising the child's rights, and to present that information in clear, simple, age appropriate language.
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .