MonacoLoi sur la Protection des Données Personnelles, autorité de contrôle et sanctions
In force since .
An enforcement supervision rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Comply with the Authority's formal notice to bring processing into conformity or to satisfy a data subject's rights request, within the period it sets, since noncompliance can draw a daily penalty of up to 10,000 euros that does not apply to the State or the Commune.
- Cooperate with the Authority's checks and investigations, giving its members, agents, and sworn investigators the information, documents, and premises access they need, since only national security secrecy, attorney client privilege, journalistic source secrecy, and individual medical secrecy channelled through a designated physician can be raised against them.
- Expect a person to be able to complain to the Authority about your processing and separately bring a court claim before the Tribunal de Premiere Instance, and expect a nonprofit body active in personal data protection to be able to do the same on that person's behalf.
- Pay a person material or moral damages for the harm a violation of this law caused them, whether you are the controller or the processor, jointly and severally with any other controller or processor that took part in the same processing.
- Expect an administrative fine of up to 5,000,000 euros or 2 percent of worldwide annual turnover, whichever is higher, for the narrower obligations Article 53 lists, rising to up to 10,000,000 euros or 4 percent of turnover for the core violations Article 54 lists, none of which apply to the State or the Commune.
- Expect a report to the Procureur General and possible prosecution under Penal Code Article 308-7 alongside, never instead of, an administrative fine, for conduct such as failing to keep a processing register, negligently failing to secure data, or collecting sensitive data outside a legal exception.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Monaco's Penal Code Article 308-7 (Section XII, created by Law 1.565) criminalises specific personal-data conduct in two tiers, separate from the Articles 53-54 administrative fines. The lower tier, one to six months imprisonment, a fine of EUR 9,000 to 18,000 (Article 26, class 3), or both, covers obstructing an investigation or withholding requested information, failing to keep a processing register under Article 27, retaining data beyond the period necessary for its purpose, negligently failing to secure data under Article 31 or disclosing data that harms a person's reputation or private or family life, breaching Articles 23 or 32, and an unlawful cross-border transfer under Chapter VIII. The higher tier, three months to one year imprisonment, a fine of EUR 18,000 to 90,000 (Article 26, class 4), or both, covers unauthorized video-surveillance data collection, fraudulent, unfair or unlawful collection, misuse for incompatible purposes, processing despite a data subject's objection, unauthorized processing of criminal-offence or conviction data, and unauthorized processing of sensitive-category data.
Penalty structure
Law 1.565 Article 54 sets the higher administrative fine tier, up to EUR 10,000,000 or, for an undertaking, up to 4% of total worldwide annual turnover for the preceding financial year, whichever is higher, for breaches including the lawfulness and characteristics of processing, consent, data subject rights, unauthorized processing of sensitive or criminal-record data, unlawful cross-border transfer, and non-compliance with an injunction of the Authority's restricted panel. Article 53 sets a lower tier, up to EUR 5,000,000 or 2% of turnover, whichever is higher, for narrower obligations (consent verification under Article 6, cooperation with the Authority, security by design under Article 23, the Articles 24-28 accountability obligations, security measures under Article 31, breach notification under Article 32, codes of conduct, impact assessments, and video-surveillance notification). Both tiers are lower in absolute euro terms than the GDPR's own EUR 20,000,000 and EUR 10,000,000 caps, though the percentage-of-turnover tiers, 4% and 2%, are identical. Under Article 51, most of these corrective measures, including the administrative fine, do not apply to the State or the Commune.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Autorite de Protection des Donnees Personnelles (A.P.D.P.), Monaco's independent administrative supervisory authority.
Enforcement record
Counts the public corrective measures the Authority's own register of corrective measures and sanctions lists: one, a formal notice (mise en demeure) of its president ordering conformity, dated , with no administrative fine among the entries. This is the regime's own enforcement record, not specific to this instrument.
- As of
- Source link
- https://apdp.mc/apdp/publications/mesures-correctrices-et-sanctions/
- Actions per year
- 1
Settledness
- As of
- Open questions
- Does the exception in Article 51 of Law No. 1.565 for a processing 'mis en œuvre par l'État ou la Commune' (implemented by the State or the Commune) lift the daily penalty of up to EUR 10,000 only for a processing run by the State or the Commune itself, or also for a processor or other body that runs it for them?
What it makes you log
Who may demand the log
Regulator
Logging duty
Articles 37 to 57 create the Authority, its powers, the restricted formation and the administrative fines, and Articles 102 to 106 cover jurisdiction, representation by a non-profit body, criminal consequences and the right to damages. They impose no duty on a controller to make, keep or produce a log or record. Article 46 lets the Authority's members and agents inspect, summon any processing, demand or copy any professional document whatever its medium, and access computer programs and information; that is a power to demand production, so it is coded as an on-request check by the regulator. The internal registers of breaches of the law that the Authority itself keeps are its own record and not a duty on a regulated party. Article 102 is a forum rule for civil actions (the courts of the controller's establishment or of the person's habitual residence) and is not read as a territorial scope clause for the Law, which is Article 3.
- Kind
- None
- As of
What this law does
Article 37 creates the Autorite de Protection des Donnees Personnelles as an independent administrative authority, and Article 39 lets a person who believes their rights under this law have been ignored complain to its president, without prejudice to a separate court action before the Tribunal de Premiere Instance.
Article 103 lets a nonprofit body active in personal data protection complain to the Authority or go to court on a person's behalf, including to claim the Article 106 damages right for them.
Articles 46 to 49 give the Authority's members, agents, and sworn investigators the power to check and investigate a controller's processing, and only national security secrecy, attorney client privilege, journalistic source secrecy, and, through a physician the president designates, individual medical secrecy can be raised against them.
Article 50 lets the president issue a formal notice to bring processing into conformity, and Article 51 lets the Authority's restricted panel, after a contradictory procedure, impose a warning, an order to comply that can carry a daily penalty of up to 10,000 euros, a temporary or permanent limitation or ban on the processing, a certification withdrawal, a suspension of binding corporate rules, a suspension of a transfer, or an administrative fine, none of which besides the warning and the compliance order apply to the State or the Commune.
Article 53 caps the lighter tier of fine at 5,000,000 euros or 2 percent of worldwide annual turnover, whichever is higher, for the narrower obligations it lists, and Article 54 caps the heavier tier at 10,000,000 euros or 4 percent of turnover, whichever is higher, for the core violations it lists, including unlawful sensitive data processing, denial of data subject rights, and an unlawful transfer.
Penal Code Article 308-7, created by this law, separately criminalises specific conduct in two tiers, one to six months' imprisonment or a fine for the lighter offences and three months to a year or a fine for the heavier ones, including collecting sensitive data such as biometric or genetic data outside a legal exception.
Article 106 gives any person who has suffered material or moral harm from a violation of this law a court enforceable damages claim against the controller or the processor, distinct from the Article 39 administrative complaint route, and every controller that took part in the processing answers for the whole of the harm so the person recovers in full.
Monaco's biometric definition is drafted broadly enough that it does not exclude an identifier derived from a photo, video, or audio recording, the way Washington's RCW 19.375 does.
When LexLint raises it
When your app profile says your app is a listed company, processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .