Processes biometric data, in Monaco

Loi n. 1.565 du 3 decembre 2024, arts. 2, 6-8, 77 (sensitive data, biometric data and minors) · Read the law's page

• Do not process sensitive data, meaning data revealing political, religious, philosophical, or trade union opinions, racial or ethnic origin, genetic data, biometric data used to identify a person uniquely, or data about health, sex life, or sexual orientation, unless one of the listed exceptions applies.
• Where you rely on a person's explicit consent to process their sensitive data, keep evidence that the consent was specific, informed, and given by a clear positive act, since a law can also bar that prohibition from ever being lifted by consent alone.
• As an employer, use a biometric identifier only where it is strictly necessary to control access to the workplace or to the devices and applications your employees use for their duties, and only for that purpose.
• Where you process personal data of a minor for an information society service on the basis of consent and the minor is under 15, take consent from the minor together with the authorisation of whoever holds parental authority, and make reasonable efforts to verify that the authorisation genuinely came from a parent or guardian.
• As an administrative or judicial authority acting in the exercise of your public powers, do not process genetic or biometric data for authentication or identity control without first obtaining the Authority's opinion, and store the raw biometric data separately from any template derived from it.
• Do not interconnect data from the judicial criminal record with any other file or processing operation.
• Put safeguards in place to prevent discrimination or another risk to a person's rights and freedoms wherever an exception lets you process their sensitive data on a public interest, medical, or archival, research, or statistical ground.

Loi n. 1.565 du 3 decembre 2024, arts. 37-57, 102-106 (supervisory authority, sanctions and right to reparation) · Read the law's page

• Comply with the Authority's formal notice to bring processing into conformity or to satisfy a data subject's rights request, within the period it sets, since noncompliance can draw a daily penalty of up to 10,000 euros that does not apply to the State or the Commune.
• Cooperate with the Authority's checks and investigations, giving its members, agents, and sworn investigators the information, documents, and premises access they need, since only national security secrecy, attorney client privilege, journalistic source secrecy, and individual medical secrecy channelled through a designated physician can be raised against them.
• Expect a person to be able to complain to the Authority about your processing and separately bring a court claim before the Tribunal de Premiere Instance, and expect a nonprofit body active in personal data protection to be able to do the same on that person's behalf.
• Pay a person material or moral damages for the harm a violation of this law caused them, whether you are the controller or the processor, jointly and severally with any other controller or processor that took part in the same processing.
• Expect an administrative fine of up to 5,000,000 euros or 2 percent of worldwide annual turnover, whichever is higher, for the narrower obligations Article 53 lists, rising to up to 10,000,000 euros or 4 percent of turnover for the core violations Article 54 lists, none of which apply to the State or the Commune.
• Expect a report to the Procureur General and possible prosecution under Penal Code Article 308-7 alongside, never instead of, an administrative fine, for conduct such as failing to keep a processing register, negligently failing to secure data, or collecting sensitive data outside a legal exception.