Processes personal data, in Monaco

Loi n. 1.565 du 3 decembre 2024 relative a la protection des donnees a caractere personnel, Journal de Monaco n. 8725, arts. 1, 3-6, 9, 21-36, 58-63, 78-87 (scope, lawful basis, and controller and processor obligations) · Read the law's page

• Establish one of the lawful bases Article 5 lists, such as consent, contract necessity, a legal obligation, vital interests, an important public interest ground, or legitimate interest, before processing personal data of a person in Monaco.
• Take consent only as a free, specific, informed and unambiguous act, present a bundled consent request separately from other terms, and do not make consent a condition of a good or service unless the processing is indispensable to providing it.
• Build data protection by design and by default into a processing operation, so that by default only the personal data necessary for each specific purpose is processed, collected, retained, or made accessible.
• Keep a written record of your processing activities covering the particulars Article 27 lists, and make it available to the Authority on request, unless you are an undertaking of fewer than 50 employees in Monaco whose processing is occasional, low risk, and free of sensitive or criminal record data.
• Designate a data protection officer wherever you are a public body, your core activities require large scale regular and systematic monitoring, or your core activities involve large scale processing of sensitive or criminal record data, and let that officer report to top management free of instructions.
• Carry out a data protection impact assessment before processing likely to create a high risk to a person's rights and freedoms, such as large scale profiling with legal effects, large scale sensitive data processing, large scale public area surveillance, or large scale use of a digital identifier, and consult the Authority first where the assessment still shows a high risk you cannot mitigate.
• Take appropriate technical and organisational security measures, including pseudonymisation and encryption, proportionate to the risk of destruction, loss, alteration, or unauthorised disclosure of or access to the personal data you process.
• Get the Minister of State's prior authorisation before installing a video surveillance system in a place open to the public or filming a public way, and do not keep recorded images for more than 30 days.

Loi n. 1.565 du 3 decembre 2024, art. 32 (personal data breach notification) · Read the law's page

• Notify the Authority of a personal data breach as soon as possible and, where feasible, within 72 hours of becoming aware of the breach, unless it is unlikely to create a risk to the rights and freedoms of the persons concerned, and give the reasons for the delay when you notify later than that.
• Communicate a personal data breach to the affected person as soon as possible, in clear language, when it is likely to create a high risk to their rights and freedoms.
• As a processor, notify the controller of a personal data breach as soon as you become aware of it.
• Describe in the notification to the Authority the nature of the breach, including where possible the categories and approximate number of affected persons and records, a contact point, the likely consequences, and the measures taken or proposed to address it.
• Document every personal data breach, its facts, its effects, and the remedial steps you took, and expect the Authority to be able to require you to communicate the breach to the affected person if you have not already done so.

Loi n. 1.565 du 3 decembre 2024, arts. 10-18, 20 (rights of the data subject) · Read the law's page

• Act on a data subject's rights request concisely, understandably, and in an easily accessible form, in clear and plain language, with particular care where the information is meant for a minor, and answer within one month of receipt, extendable by two months for a complex or repeated request.
• Tell a person, at the point you collect their data, who you are, the purposes and legal basis of the processing, any legitimate interest relied on, the categories of data, the retention period or the criteria for setting one, whether a reply from them is mandatory, the right to withdraw consent, the recipients, how to exercise their rights, the right to complain to the Authority, whether automated decision making including profiling is in use, and any transfer outside Monaco and its safeguards.
• Answer an access request with confirmation of processing, a copy of the data in an intelligible form, and the Article 12 information, in the electronic form the person asks for where they submit the request electronically.
• Correct inaccurate or incomplete personal data without delay on request, including by adding a supplementary statement.
• Erase personal data without delay on request in the listed cases, such as withdrawn consent with no other legal basis, a successful objection, data no longer necessary for its purpose, unlawfully processed data, or data collected from a minor for an information society service, and tell any third party you disclosed it to that it must be erased too.
• Restrict processing on request in the listed cases, keep the data stored but otherwise untouched without the person's consent while the restriction lasts, and tell the person before you lift it.
• Notify every recipient the data were disclosed to of a rectification, erasure, or restriction, unless that is impossible or would take disproportionate effort.
• Stop processing a person's data for direct marketing, including any profiling tied to it, the moment they object, and flag that right to them clearly and separately no later than the first communication.
• Give a person their data in a structured, commonly used, machine readable format on request, and transmit it directly to another controller where that is technically possible.
• Let a deceased person's ascendant, descendant to the second degree, surviving spouse, cohabitant, or registered partner exercise the access, rectification, erasure, restriction, objection, and portability rights over that person's data where they show an interest.

Loi n. 1.565 du 3 decembre 2024, arts. 2, 6-8, 77 (sensitive data, biometric data and minors) · Read the law's page

• Do not process sensitive data, meaning data revealing political, religious, philosophical, or trade union opinions, racial or ethnic origin, genetic data, biometric data used to identify a person uniquely, or data about health, sex life, or sexual orientation, unless one of the listed exceptions applies.
• Where you rely on a person's explicit consent to process their sensitive data, keep evidence that the consent was specific, informed, and given by a clear positive act, since a law can also bar that prohibition from ever being lifted by consent alone.
• As an employer, use a biometric identifier only where it is strictly necessary to control access to the workplace or to the devices and applications your employees use for their duties, and only for that purpose.
• Where you process personal data of a minor for an information society service on the basis of consent and the minor is under 15, take consent from the minor together with the authorisation of whoever holds parental authority, and make reasonable efforts to verify that the authorisation genuinely came from a parent or guardian.
• As an administrative or judicial authority acting in the exercise of your public powers, do not process genetic or biometric data for authentication or identity control without first obtaining the Authority's opinion, and store the raw biometric data separately from any template derived from it.
• Do not interconnect data from the judicial criminal record with any other file or processing operation.
• Put safeguards in place to prevent discrimination or another risk to a person's rights and freedoms wherever an exception lets you process their sensitive data on a public interest, medical, or archival, research, or statistical ground.

Loi n. 1.565 du 3 decembre 2024, arts. 37-57, 102-106 (supervisory authority, sanctions and right to reparation) · Read the law's page

• Comply with the Authority's formal notice to bring processing into conformity or to satisfy a data subject's rights request, within the period it sets, since noncompliance can draw a daily penalty of up to 10,000 euros that does not apply to the State or the Commune.
• Cooperate with the Authority's checks and investigations, giving its members, agents, and sworn investigators the information, documents, and premises access they need, since only national security secrecy, attorney client privilege, journalistic source secrecy, and individual medical secrecy channelled through a designated physician can be raised against them.
• Expect a person to be able to complain to the Authority about your processing and separately bring a court claim before the Tribunal de Premiere Instance, and expect a nonprofit body active in personal data protection to be able to do the same on that person's behalf.
• Pay a person material or moral damages for the harm a violation of this law caused them, whether you are the controller or the processor, jointly and severally with any other controller or processor that took part in the same processing.
• Expect an administrative fine of up to 5,000,000 euros or 2 percent of worldwide annual turnover, whichever is higher, for the narrower obligations Article 53 lists, rising to up to 10,000,000 euros or 4 percent of turnover for the core violations Article 54 lists, none of which apply to the State or the Commune.
• Expect a report to the Procureur General and possible prosecution under Penal Code Article 308-7 alongside, never instead of, an administrative fine, for conduct such as failing to keep a processing register, negligently failing to secure data, or collecting sensitive data outside a legal exception.

Loi n. 1.565 du 3 decembre 2024, arts. 96-101 (transfer of personal data) · Read the law's page

• Before transferring personal data outside Monaco, confirm that the destination country, territory, or international organisation has an adequate level of protection, and treat every European Union member state as meeting that standard.
• Absent an adequacy finding, rely on an appropriate safeguard, such as an executory international commitment, standard clauses the Authority has approved, binding corporate rules the Authority has approved, an approved certification mechanism, or an approved code of conduct.
• Absent both an adequacy finding and a safeguard, transfer personal data only under a listed exception, such as the person's informed explicit consent, an important public interest ground, a legal claim, a public register meant to inform the public, or contract necessity, and tell the Authority where you rely on a rare, non repetitive transfer touching a limited number of people instead.
• Get the Authority's authorisation before a transfer that rests on ad hoc contractual clauses or particular safeguards outside articles 97 to 99, and treat its silence for two months, renewable once, as a refusal.
• Do not treat a foreign court's or authority's order to transfer or disclose personal data out of Monaco as enforceable unless an international agreement between that state and Monaco provides for it.