Makes public services decisions, in Monaco

Loi n. 1.565 du 3 decembre 2024 relative a la protection des donnees a caractere personnel, Journal de Monaco n. 8725, arts. 1, 3-6, 9, 21-36, 58-63, 78-87 (scope, lawful basis, and controller and processor obligations) · Read the law's page

• Establish one of the lawful bases Article 5 lists, such as consent, contract necessity, a legal obligation, vital interests, an important public interest ground, or legitimate interest, before processing personal data of a person in Monaco.
• Take consent only as a free, specific, informed and unambiguous act, present a bundled consent request separately from other terms, and do not make consent a condition of a good or service unless the processing is indispensable to providing it.
• Build data protection by design and by default into a processing operation, so that by default only the personal data necessary for each specific purpose is processed, collected, retained, or made accessible.
• Keep a written record of your processing activities covering the particulars Article 27 lists, and make it available to the Authority on request, unless you are an undertaking of fewer than 50 employees in Monaco whose processing is occasional, low risk, and free of sensitive or criminal record data.
• Designate a data protection officer wherever you are a public body, your core activities require large scale regular and systematic monitoring, or your core activities involve large scale processing of sensitive or criminal record data, and let that officer report to top management free of instructions.
• Carry out a data protection impact assessment before processing likely to create a high risk to a person's rights and freedoms, such as large scale profiling with legal effects, large scale sensitive data processing, large scale public area surveillance, or large scale use of a digital identifier, and consult the Authority first where the assessment still shows a high risk you cannot mitigate.
• Take appropriate technical and organisational security measures, including pseudonymisation and encryption, proportionate to the risk of destruction, loss, alteration, or unauthorised disclosure of or access to the personal data you process.
• Get the Minister of State's prior authorisation before installing a video surveillance system in a place open to the public or filming a public way, and do not keep recorded images for more than 30 days.

Loi n. 1.565 du 3 decembre 2024, art. 19 (automated individual decisions) · Read the law's page

• Do not base a decision that produces legal effects for a person or significantly affects them solely on automated processing, including profiling, unless a listed exception applies, and where it does, guarantee at least the right to obtain human intervention, express a view, and contest the decision.

Loi n. 1.565 du 3 decembre 2024, arts. 10-18, 20 (rights of the data subject) · Read the law's page

• Act on a data subject's rights request concisely, understandably, and in an easily accessible form, in clear and plain language, with particular care where the information is meant for a minor, and answer within one month of receipt, extendable by two months for a complex or repeated request.
• Tell a person, at the point you collect their data, who you are, the purposes and legal basis of the processing, any legitimate interest relied on, the categories of data, the retention period or the criteria for setting one, whether a reply from them is mandatory, the right to withdraw consent, the recipients, how to exercise their rights, the right to complain to the Authority, whether automated decision making including profiling is in use, and any transfer outside Monaco and its safeguards.
• Answer an access request with confirmation of processing, a copy of the data in an intelligible form, and the Article 12 information, in the electronic form the person asks for where they submit the request electronically.
• Correct inaccurate or incomplete personal data without delay on request, including by adding a supplementary statement.
• Erase personal data without delay on request in the listed cases, such as withdrawn consent with no other legal basis, a successful objection, data no longer necessary for its purpose, unlawfully processed data, or data collected from a minor for an information society service, and tell any third party you disclosed it to that it must be erased too.
• Restrict processing on request in the listed cases, keep the data stored but otherwise untouched without the person's consent while the restriction lasts, and tell the person before you lift it.
• Notify every recipient the data were disclosed to of a rectification, erasure, or restriction, unless that is impossible or would take disproportionate effort.
• Stop processing a person's data for direct marketing, including any profiling tied to it, the moment they object, and flag that right to them clearly and separately no later than the first communication.
• Give a person their data in a structured, commonly used, machine readable format on request, and transmit it directly to another controller where that is technically possible.
• Let a deceased person's ascendant, descendant to the second degree, surviving spouse, cohabitant, or registered partner exercise the access, rectification, erasure, restriction, objection, and portability rights over that person's data where they show an interest.