Processes personal data, in San Marino

Legge 21 dicembre 2018 n. 171, articoli 1-7, 9-11 e 23-44 (principi, basi giuridiche e obblighi del titolare) · Read the law's page

• Establish a lawful basis before processing personal data of a person in San Marino under Law 171/2018.
• Take consent only where you can demonstrate the data subject gave it, and for an information society service offered to a child, only on the terms article 7 sets.
• Build data protection into the design of your processing and make it the default, and keep records of your processing activities.
• Implement technical and organisational measures giving a level of security appropriate to the risk, and cooperate with the Data Protection Authority in the performance of its tasks.
• Carry out a data protection impact assessment before processing likely to result in a high risk, and consult the Data Protection Authority beforehand where the assessment shows that risk remains.
• Designate a data protection officer where the law requires one, give them the position article 39 prescribes, and let them carry out the tasks article 40 lists.
• Where you engage a processor, govern the engagement as article 29 requires, and settle each party's responsibilities in an arrangement where you are a joint controller.

Legge 21 dicembre 2018 n. 171, articoli 12-21 (diritti dell'interessato) · Read the law's page

• Give a data subject, at collection, your identity and contact details, the purposes and legal basis of the processing, the recipients, any transfer abroad, the retention period and their rights, and where the data came from elsewhere, its source and the categories concerned.
• Answer a request for access, rectification, erasure, restriction or portability, and notify every recipient the data was disclosed to of a rectification, erasure or restriction you carry out.
• Stop processing personal data for direct marketing as soon as the data subject objects, including the profiling related to it.

Legge 21 dicembre 2018 n. 171, articoli 34-35 (violazione dei dati personali) · Read the law's page

• Notify the Data Protection Authority without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in San Marino, under Article 34.
• Communicate the breach to the affected data subject without undue delay where it is likely to result in a high risk to their rights and freedoms, in clear and plain language.
• As a processor, notify the controller without undue delay after becoming aware of a personal data breach.
• Describe in the notification the nature of the breach, including where possible the categories and approximate number of data subjects and of records concerned, the contact point, the likely consequences and the measures taken, and document every breach, its effects and the remedial action.

Legge 21 dicembre 2018 n. 171, articoli 45-50 (trasferimenti verso paesi terzi) · Read the law's page

• Rely on an EU adequacy decision, a bilateral treaty, an appropriate safeguard such as binding corporate rules or standard clauses, or a narrow derogation before transferring personal data of a person in San Marino outside the country, under Articles 45 to 50.
• Apply the same conditions to an onward transfer from the destination country or organisation to another one, not only to the first transfer out.
• Where you rely on a derogation in article 50 instead, use one the article lists, and where that is the data subject's explicit consent, inform them of the possible risks of the transfer first.

Legge 21 dicembre 2018 n. 171, articoli 51-75 (Autorita Garante, rimedi e sanzioni) · Read the law's page

• Expect a data subject to be able to complain to the San Marino Data Protection Authority, to challenge its measures and to seek judicial protection before the Administrative Judge, alongside a claim for compensation against you.
• Answer the Authority's requests for information and documents, and expect verifications, including the special verifications article 63 provides for.
• Expect joint and several liability where more than one controller or processor is involved in the same infringing processing, and expect to have to prove you are not responsible for the event that caused the damage in order to be exempted.
• Do not publish or disseminate news or images identifying a child involved in legal proceedings.

Legge 21 dicembre 2018 n. 171, articolo 8 (categorie particolari di dati personali) · Read the law's page

• Obtain explicit consent or another Article 8(2) exception before capturing or storing a biometric identifier of a person in San Marino; Article 8(1) prohibits processing biometric data absent one.
• Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, nor genetic data or data concerning health, sex life or sexual orientation, unless one of the article 8(2) cases applies.
• Where you rely on the not-for-profit body ground, confine the processing to the body's members or regular contacts and do not disclose the data outside it without the data subject's consent.
• Where you rely on the health-care ground, process only by or under the responsibility of a professional bound by an obligation of secrecy.