TunisiaOrganic Act on the Protection of Personal Data, sensitive categories and minors
Loi organique n° 2004-63, arts. 13-15, 28, 62-65 (catégories particulières et mineurs)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric, Age verification
- Audit expectation
- none
What it requires
- Do not process personal data about a person's criminal offences, their detection, prosecution, penalties, preventive measures or judicial record.NIST Privacy FrameworkCT.PO-P1
- Do not process data revealing racial or genetic origin, religious, political, philosophical or trade union opinions, or health, unless the person gives express written consent, the data is already manifestly public, or the processing serves a historical, scientific or vital-interest purpose.NIST Privacy FrameworkCT.PO-P1
- Get the INPDP's separate authorization, decided within thirty days, before processing a special category of data under article 14, except health data.NIST Privacy FrameworkGV.PO-P5
- Process a child's personal data only with the guardian's consent and the family court's authorization, which can be withdrawn at any time, and apply that same rule wherever the Act requires a child's consent to collection, communication, transfer abroad, research disclosure or video recording.NIST Privacy FrameworkCT.PO-P1
- Process health data only through a physician or someone otherwise bound to professional secrecy, and only for a purpose article 62 lists such as the person's consent, a legal duty, public health protection, the person's own treatment, or health research.NIST Privacy FrameworkCT.PO-P1
- Get the INPDP's authorization before a physician shares health data with a research body, and never keep or use health data beyond the time its purpose requires.NIST Privacy FrameworkGV.PO-P5NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 13 and 14 prohibit processing of offence-related and sensitive data, with exceptions that include the person's express consent given by any means leaving a written trace (Article 14); Article 15 requires the INPDP's authorization; Article 28 requires a guardian's consent and the family judge's authorization for a child; Articles 62 to 65 set the conditions for health data. A consent required in a form that leaves a written trace is a condition of processing, and none of these articles asks anyone to keep or produce a record. The access record of Article 19 sits outside the articles this row cites and is recorded on the comprehensive row.
- Kind
- None
- As of
What this law does
Article 13 prohibits processing personal data about a person's criminal offences, their detection, prosecution, penalties, preventive measures or judicial record, with no exception stated in the Act.
Article 14 prohibits processing data revealing, directly or indirectly, racial or genetic origin, religious, political, philosophical or trade union opinions, or health, unless the person gives express consent in a form leaving a written trace, the data has become manifestly public, or the processing is necessary for historical or scientific purposes or to safeguard the person's vital interests; article 15 requires the INPDP's separate authorization for that processing, other than health data, which the INPDP must grant or refuse within thirty days, with silence counting as refusal.
Article 28 requires a child's personal data to be processed only with the guardian's consent and the family court judge's authorization, lets the judge order the processing even without the guardian's consent where the child's best interest requires it, and lets the judge withdraw that authorization at any time; the Act cross-references this same regime wherever the data subject is a child, including marketing consent, collection from third parties, communication to third parties, transfer abroad, disclosure of research results and video recording consent.
Article 62 permits processing health data beyond article 14's general exception where the person consents (subject to the article 28 regime for a child), the processing serves a purpose the law or regulations set, it serves public health protection or disease research, it benefits or is medically necessary for the person's own health, or it is scientific research in the health field.
Article 63 confines processing of health data to physicians or others bound by professional secrecy, and lets a physician share it with a research body only on the INPDP's authorization, decided within one month. Article 64 caps that processing at the time necessary for its purpose, and article 65 lets the INPDP set the precautions a health data authorization must carry and bar the data's dissemination outright.
When LexLint raises it
When your app profile says your app serves under-18s, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .