ChadLoi n°007/PR/2015, traitement des catégories particulières de données (données sensibles et biométriques)
Loi n°007/PR/2015 du 10 février 2015, arts. 16-25
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://arcep.td/sites/default/files/Loi-N%C2%B007-PR-2015.pdfIn force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Biometric
- Audit expectation
- none
What it requires
- Do not process biometric data, or data revealing racial or ethnic origin, filiation, political opinion, religious or philosophical belief, trade-union membership, sex, health, or sexual life, unless the data subject gives explicit written consent or a listed statutory exception applies.NIST Privacy FrameworkCT.PO-P1
- Where processing genetic data or data revealing health-related secrets, use a unique patient identifier distinct from other identification numbers, and interconnect it with another identifying number only with ANSICE's express authorization.NIST Privacy FrameworkCT.DP-P1
- Process a minor's personal data only in keeping with the representation rules the law sets for the exercise of the minor's own rights.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DP-P1Data are processed to limit observability and linkability (e.g., data actions take place on local devices, privacy-preserving cryptography).
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 16 to 25 forbid processing biometric, genetic, health, sexual-life and other special-category data, and data on offences and litigation, except on listed grounds, chiefly the data subject's explicit written consent on paper or in electronic form. The written form is a condition of lawful processing, and no clause makes the controller keep, show or produce a record of that consent. Articles 17 and 23 bind health professionals and persons authorized under article 21 to professional secrecy, article 20 requires a unique patient identifier, and article 24 sets representation rules for minors. None of these articles requires a log or a record, and none names a territorial hook, so the hook is empty.
- Kind
- None
- As of
What this law does
Article 16 prohibits processing biometric data and personal data revealing racial or ethnic origin, filiation, political opinion, religious or philosophical belief, trade-union membership, sex, health, or sexual life, unless the data subject gives explicit written consent (withdrawable at any time, at no cost), or the processing falls within a listed exception: a labour-law obligation, protecting the data subject's or another's vital interest, a human-rights association's activity authorized by ANSICE, a social-security purpose, establishing or defending a legal claim, data the data subject has manifestly made public, historical, statistical, or scientific research on conditions ANSICE sets, public-statistics law, preventive medicine or health-service administration under a health professional's supervision, or another important public-interest ground a law permits.
Article 17 confines the processing it covers to cases of the data subject's written consent or of necessity for preventing a concrete danger or repressing a specific criminal offence, and then only under a health professional's responsibility, binding that professional and their staff to professional secrecy.
Article 18 separately prohibits processing genetic data and personal data revealing health-related secrets, subject to a similarly structured list of exceptions, and article 20 requires that any such processing use a unique patient identifier distinct from other identification numbers, interconnectable with another identifying number only with ANSICE's express authorization.
Article 24 confines processing a minor's personal data to the representation rules the law sets for the exercise of a minor's own rights.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .