TogoLoi n° 2019-014, données sensibles
Loi n° 2019-014 du 29 octobre 2019, arts. 8, 21-25 (sensitive personal data)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2020. Publisher's page: https://numerique.gouv.tg/wp-content/uploads/2020/01/Loi-n-2019-014-du-29-octobre-2019-relative-a-la-protection-des-donnees-a-caractere-pers…In force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric
- Audit expectation
- none
What it requires
- Obtain the Instance's prior authorization before processing genetic data, health research data, biometric data, or data on criminal offenses, convictions or security measures.NIST Privacy FrameworkGV.PO-P5
- Do not collect or process data revealing racial or ethnic origin, filiation, political, religious or philosophical opinions, trade union membership, sex life, or health or genetic data, unless a listed exception applies, such as the data subject's written consent or a vital interest that prevents them from consenting.NIST Privacy FrameworkCT.PO-P1
- Process data on criminal offenses, convictions or security measures only as a court, a public authority, a body managing a public service, or a legal auxiliary acting within your legal duties.NIST Privacy FrameworkCT.PO-P1
- Process health data only on one of the law's listed grounds, keep it under the supervision of a health professional bound by professional secrecy, and collect it directly from the data subject except where collection elsewhere is necessary for the processing or the data subject cannot provide it themselves.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 8 makes biometric, genetic, health research and offence data processing wait for the Instance's authorization, and Articles 21 to 25 ban sensitive data processing subject to exceptions, one of which is written consent. Written consent is a condition of lawful processing, and none of these articles requires a log, a register or proof of consent to be kept. The Law has no scope clause in the cited articles.
- Kind
- None
- As of
What this law does
Article 8 requires the Instance's prior authorization before processing genetic data, health research data, biometric data, or data on criminal offenses, convictions or security measures. Article 21 prohibits collecting or processing data revealing racial or ethnic origin, filiation, political opinions, religious or philosophical convictions, trade union membership, sex life, genetic data, or health data.
Article 22 lifts that prohibition where the data was manifestly made public by the data subject, where the data subject gave written consent, where the processing safeguards a vital interest the data subject cannot consent to protect, or on a short further list including a judicial, public interest, historical, statistical or scientific purpose.
Article 23 restricts processing of data on offenses, convictions or security measures to courts, public authorities, bodies managing a public service, and legal auxiliaries acting within their legal duties.
Article 24 makes health data processing lawful only on a listed ground such as the data subject's consent, requires it to be carried out under the supervision of a health professional bound by professional secrecy, and requires the data to be collected directly from the data subject except where collection elsewhere is necessary or the data subject cannot provide it.
Article 97, the closing article, provides that the law is executed as a law of the State but names no day of its own entry into force, and no commencement notice has been located in the Journal officiel.
When LexLint raises it
When your app profile says your app processes biometric data, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .