KosovoLaw No. 06/L-082 on Protection of Personal Data, special categories, children and criminal-offence data
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Obligation class
- Prohibition, Consent, Biometric, Age verification
- Audit expectation
- none
What it requires
- Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to uniquely identify a person, health data, or data about sex life or sexual orientation, unless a listed Article 8(2) exception applies, most commonly the data subject's explicit consent.NIST Privacy FrameworkCT.PO-P1
- Where you rely on an Article 8(2) exception, protect special categories of personal data with heightened, classified safeguards against unauthorised access and use.NIST Privacy FrameworkPR.AC-P4
- Confine any processing of personal data about a person's criminal convictions or offences, or related security measures, to what an official authority controls under the relevant law.NIST Privacy FrameworkCT.PO-P1
- Treat sixteen as the age at which a child may consent to an information-society service directly, and obtain or verify consent or authorisation from a parent or holder of parental responsibility below that age, making reasonable and ongoing efforts, using available technology, to confirm that consent when the child is between fourteen and sixteen.NIST Privacy FrameworkCT.PO-P1
- Treat an identifier your system derives from a photograph or video of a person in Kosovo, such as a faceprint, as covered biometric data under Article 3(1)(20); the definition names visual images and fingerprint, iris, retina, facial-feature and DNA data as examples and excludes nothing that is recording-derived.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 7 to 9 limit special-category data, a child's consent for information-society services and criminal-offence data. Article 7(2) asks the controller to make reasonable efforts to verify that a parent gave or authorized the child's consent, which is a verification step and says nothing about keeping a record of it. Article 8(2)(4) and the written-consent wording elsewhere state a condition of processing, not a record. Article 9 says a comprehensive register of convictions is kept only under an official authority, which is a rule about who may hold such a register, not a duty on a controller. The row imposes no log or record duty. The proof-of-consent rule is Article 6(1), which this row does not cite.
- Kind
- None
- As of
What this law does
Article 8(1) prohibits processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, health data, or data concerning sex life or sexual orientation.
Article 8(2) lifts that prohibition only under the listed conditions, running from the data subject's explicit consent through employment, social security and social protection law, vital interests, the legitimate activities of a non-profit body processing only its own members' data, data manifestly made public by the data subject, legal claims, substantial public interest, preventive or occupational medicine, public health, and archiving, scientific, historical or statistical purposes.
Article 8(4) requires special categories of personal data to be given heightened protection and to be classified to prevent unauthorised access and use. Article 3, paragraph 1, item 25 separately defines sensitive personal data to include ethnic or racial origin, political or philosophical views, religious affiliation, trade union membership, health data, sex life data, and any entry in or removal from a criminal or misdemeanour record.
The same item adds that biometric characteristics also count as sensitive personal data where they enable identifying a data subject in relation to any of those circumstances.
Article 3, paragraph 1, item 20 defines biometric data as all personal data resulting from specific processing relating to the physical, psychological or behavioural characteristics of a natural person that allows or confirms that person's unique identification, naming visual images and fingerprint, iris, retina, facial-feature and DNA data as examples.
Article 9 confines processing of personal data concerning criminal convictions and criminal offences, or related security measures, to the control of an official authority under the relevant law, and keeps any comprehensive register of criminal convictions solely under an official authority's control.
Article 7 sets the threshold for a child's own consent to an information-society service at sixteen years, and requires the controller to make reasonable efforts, using available technology, to verify that consent was given or authorised by the holder of parental responsibility below that age.
A separate paragraph directs continuing efforts to verify parental or guardian consent specifically between fourteen and sixteen years, without stating how that duty relates to the sixteen-year threshold the same article sets.
When LexLint raises it
When your app profile says your app serves under-18s, handles health records, processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .