Processes personal data, in Andorra

LQPD, Llei 29/2021 del 28 d'octubre, arts. 1-2, 4-7, 11-14, 27-35, 38-41 (general provisions, lawful basis, controller and processor obligations, DPIA, the Data Protection Officer, and other general processing rules) · Read the law's page

• Establish a lawful basis under Article 6 before processing personal data of a person in Andorra, and apply the Article 5 principles of lawfulness, purpose limitation, data minimisation, accuracy, storage limitation and security throughout.
• Designate a representative established in Andorra if you are a controller or processor not domiciled there or not constituted under Andorran law but use processing means located in Andorran territory.
• Apply data protection by design and by default, keep a written record of your processing activities unless you employ fewer than fifty workers and none of the high-risk, non-occasional or special-category exceptions apply, and block rather than delete personal data pending any liability claim when you rectify or erase it.
• Carry out a data protection impact assessment before high-risk processing such as systematic automated evaluation with legal effects, large-scale special-category processing, or large-scale systematic monitoring of a publicly accessible area, and consult the Agency first where the assessment shows a risk you have not mitigated.
• Appoint a Data Protection Officer if you are a public authority, or if your core activities involve automated decisions with legal effects, large-scale special-category processing, or large-scale processing that could seriously affect a large number of data subjects, and notify the Agency of that officer's contact details within ten working days of appointment.
• Put appropriate technical and organisational security measures in place, proportionate to the risk, before and during processing.
• Do not treat academic, artistic, literary or professional journalistic expression as exempt from this law's core principles, only from the specific articles Article 12 lists, including the special-categories, criminal-offence-data and cross-border-transfer rules.

Llei 29/2021, arts. 15-24, 26 (rights of the data subject) · Read the law's page

• Answer an access, rectification, erasure, restriction, portability or objection request within one month of receipt, extendable by two further months for complex or numerous requests, and tell the data subject about any extension within the first month.
• Tell a data subject, at the point you collect or first obtain their personal data, your identity, the purposes and legal basis of processing, the recipients, any transfer to a third country, the storage period, and their rights.
• Give a data subject a copy of their personal data on request, along with the purposes, categories, recipients, storage period and other Article 18 information, free of charge for the first copy.
• Correct inaccurate or incomplete personal data on request without undue delay, and pass the correction on to recipients the data were disclosed to.
• Erase personal data on request without undue delay where it is no longer necessary, consent is withdrawn with no other lawful basis, the data subject objects with no overriding ground, it was processed unlawfully, a legal obligation requires erasure, or it was collected under the child information-society-service consent rule, and de-reference it if you operate a search engine indexing it.
• Restrict processing on request while accuracy is contested, in place of erasure where the data subject prefers restriction, where you no longer need the data but the data subject does for legal claims, or while an objection is being verified.
• Give a data subject their data in a structured, commonly used, machine-readable format and transmit it to another controller on request where processing rests on consent or a contract and is automated.
• Stop processing personal data for direct marketing, including related profiling, as soon as a data subject objects, and bring that right to their attention explicitly and separately no later than the first communication with them.
• If you provide internet access as a service, offer transparent terms free of technical or economic discrimination and inform users of their rights, per Article 21's digital-rights guarantee.

Llei 29/2021, arts. 36-37 (personal data breach notification) · Read the law's page

• Notify the Andorran Data Protection Agency of a personal data breach without undue delay and, where possible, within seventy-two hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.
• Justify the reasons for the delay if notifying the Agency after that seventy-two-hour period.
• As a data processor, notify the data controller without delay of a personal data breach you become aware of.
• Communicate a personal data breach to the affected data subject without undue delay where the breach is likely to result in a high risk to their rights and freedoms, unless an Article 37(3) exception applies.
• Describe in the Agency notification the nature of the breach, the categories and approximate number of data subjects and records affected where possible, a contact point, the likely consequences, and the measures taken or proposed, supplying information in phases without undue delay where it cannot all be given at once.
• Document every personal data breach, its facts, effects and remedial measures, so the Agency can verify your compliance.

Llei 29/2021, arts. 42-45 (transfers of personal data to third countries or international organisations) · Read the law's page

• Before transferring personal data to a country or international organisation outside Andorra, confirm the destination offers an adequate level of protection under Article 43, or put appropriate safeguards in place under Article 44, such as standard data-protection clauses or binding corporate rules.
• Where no adequacy finding or appropriate safeguard applies, transfer personal data only under an Article 45(1) derogation, such as the data subject's informed explicit consent or contractual necessity, or, failing that, only under Article 45(2)'s narrow compelling-legitimate-interest exception, informing the Agency and the data subject.
• Expect the Agency's adequacy and safeguards assessment to weigh the destination's rule of law and human rights record, its data protection and professional rules and security measures, and whether data subjects there have effective, enforceable rights and redress.
• Document in your processing register the assessment and safeguards behind any transfer you make under Article 45(2).

Llei 29/2021, arts. 46-74 (the Andorran Data Protection Agency, its powers, infractions and sanctions) · Read the law's page

• Expect a data subject to be able to lodge a complaint with the Agency electronically or in person, and a representative body, organisation or non-profit association active in data-subject-rights protection to be able to lodge it and pursue judicial remedies on their behalf.
• Cooperate with an Agency investigation, including giving inspectors access to your premises, equipment, processing means and any information they request.
• Comply with a corrective order the Agency issues, which can include a warning, a reprimand, an order to fulfil a data subject's rights request, an order to bring processing into compliance, a temporary or definitive limitation or ban on processing, or an order suspending data flows to a third country.
• Expect an administrative fine set according to the nature, gravity and duration of an infringement, intent or negligence, mitigating measures you took, your degree of cooperation with the Agency, and prior infringements, ranging from five hundred euros for a minor infringement to one hundred thousand euros for a very serious one.
• Expect the total fine for several infringements arising from the same or related processing to be capped at the amount set for the single most serious infringement.
• Expect joint and several liability with every other controller or processor involved in the same processing for compensating a person's material or non-material damage from an infringement of this law, unless you prove you bear no responsibility for it.
• Expect a claim for compensation to be brought within one year of a final declaration of liability, before the competent Andorran courts.
• Expect the Agency to refer signs of criminal conduct arising during a sanctioning procedure to the competent court and suspend the administrative procedure while that referral is pending.

Llei 29/2021, arts. 8-10 (special categories, children and criminal-offence data) · Read the law's page

• Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union affiliation, or process genetic data, biometric data used to uniquely identify a person, health data, or data about sex life or sexual orientation, unless a listed Article 9(2) exception applies, most commonly the data subject's explicit consent.
• Confine any processing of personal data about a person's criminal convictions or offences, or related security measures, to what is strictly necessary and authorised by law or supervised by a public authority with adequate safeguards.
• Treat sixteen as the age at which a minor may consent to an information-society service directly, and obtain or verify consent or authorisation from a legal representative below that age, using available technology to confirm it.
• Treat an identifier your system derives from a photograph of a person in Andorra, such as a faceprint, as covered biometric data under Article 4(17); the definition names facial images, dactyloscopic data and iris patterns as examples and excludes nothing that is recording-derived.