Timor-LesteConstitution of Timor-Leste, Section 38(3) (Sensitive categories of personal data)
Section 38(3) (sensitive categories), Constitution of Timor-Leste (2002)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Prohibition
- Audit expectation
- none
What it requires
- Obtain the person's consent before processing data on their private life, political or philosophical convictions, religious faith, party or trade union membership, or ethnical origin.
- Do not rely on a legitimate-interest, contract or public-task basis for those categories: the Constitution prohibits processing them without consent and states no alternative.
- Do not treat biometric, genetic or health data as covered by this bar, since Section 38(3) does not name them; a voiceprint or faceprint is reached by the Section 38(1) access right instead.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 38(3) prohibits processing personal data on private life, political and philosophical convictions, religious faith, party or trade union membership and ethnical origin without the consent of the person concerned. Consent is a condition of processing, and the section does not require anyone to keep or produce a record of it. The section has no territorial or other scope clause.
- Kind
- None
- As of
What this law does
Section 38(3) prohibits processing personal data on private life, political and philosophical convictions, religious faith, party or trade union membership, and ethnical origin without the consent of the person concerned. Consent is the only basis the provision states, so there is no legitimate-interest, contract or public-task route to processing those categories.
The list is closed and does not name biometric data, genetic data or health data, so a voiceprint or faceprint falls under the Section 38(1) access right rather than under this consent bar.
When LexLint raises it
When your app profile says your app operates a social platform, reuses other publishers' content, serves under-18s or processes personal data.
Back to the example · Lint your app
Page updated .