San MarinoSan Marino Law No. 171, the Data Protection Authority, remedies and fines
Legge 21 dicembre 2018 n. 171, articoli 51-75 (Autorita Garante, rimedi e sanzioni)
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting, Prohibition
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect a data subject to be able to complain to the San Marino Data Protection Authority, to challenge its measures and to seek judicial protection before the Administrative Judge, alongside a claim for compensation against you.
- Answer the Authority's requests for information and documents, and expect verifications, including the special verifications article 63 provides for.NIST Privacy FrameworkGV.PO-P5
- Expect joint and several liability where more than one controller or processor is involved in the same infringing processing, and expect to have to prove you are not responsible for the event that caused the damage in order to be exempted.
- Do not publish or disseminate news or images identifying a child involved in legal proceedings.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Article 75(2) makes an infringement of the Article 75(1) prohibition on publishing or disseminating news or images identifying a child involved in legal proceedings a criminal offence, punishable under Article 192 bis of the San Marino Criminal Code. A second, narrower criminal cross-reference at Article 121(5) applies Article 377 of the Criminal Code to a provider's or operator's breach of its secrecy duty over a data-preservation order of the Data Protection Authority. Both are specific, sector-limited criminal offences layered on top of the law, distinct from the general administrative-fine regime of Title VIII (Arts. 72 to 73), which is purely administrative and carries no criminal penalty of its own.
Penalty structure
Article 72(2) sets the higher administrative-fine tier, up to EUR 10,000,000 or 4 percent of total annual turnover of the previous financial year, whichever is higher, for infringements of the basic principles of processing including consent (Arts. 4, 5, 6, 8), the data subjects' rights (Arts. 12 to 22), cross-border transfer (Title V of Part I), and non-compliance with a Data Protection Authority order, limitation or suspension under Article 59(2) or a failure to provide access under Article 59(1). A separate, lower tier under Article 72(1) caps the controller/processor, certification-body and monitoring-body obligations (Arts. 7, 11, 24 to 40, 43 and 44 for controllers and processors, Arts. 43 and 44 for certification bodies and Art. 42 for monitoring bodies) at EUR 5,000,000 or 2 percent, whichever is higher. San Marino's own fixed caps are exactly half GDPR Article 83's EUR 20,000,000 / 10,000,000 figures while matching its 4 percent / 2 percent turnover percentages; San Marino is not an EU member state, so GDPR Article 83's fixed euro amounts do not apply here by operation of law and the law sets its own, lower fixed caps.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
San Marino Data Protection Authority
Enforcement record
The Authority (agpdp.sm is its own official site) publishes an annual 'Provvedimenti' (decisions) register, itemised by numbered, dated decision and its type: opinions (pareri), right-to-be-forgotten complaints under Article 66, video-surveillance authorisations, certificate-issuance requests, data-breach notices, reports (segnalazioni), and formal injunctions (ingiunzioni) for failure to adopt security measures. By year, 2019 and 2020 each list roughly two dozen to thirty decisions (including a security-measures injunction in 2020); 2021 lists 7 (including two injunctions, one specifically for failing to verify minors' ages); 2022 lists 6 (predominantly video-surveillance authorisations); no decisions are published for 2023; and 2024, the most recent year listed, has only 2 (one under appeal). None of the published decision titles states a monetary fine amount, so no total or median fine can be verified from this register. Secondary Italian legal-press coverage separately reports a EUR 4 million fine against Meta/Facebook confirmed on appeal around 2019, which could not be confirmed against the primary decision text.
- As of
- Trend
- Falling
- Source link
- https://agpdp.sm/pub1/garante/it/provvedimenti.html
Settledness
- As of
- Open questions
- Does the exclusive jurisdiction of the Giudice Amministrativo (Administrative Judge) under Article 70, paragraph 1 of Law 171/2018 over 'le controversie che riguardano l'applicazione della presente legge' (disputes concerning the application of this law) reach a compensation claim against a private controller under Article 71, or is that claim heard by the ordinary civil court?
What it makes you log
Who may demand the log
Regulator
Logging duty
Articles 51 to 75 set up the Autorità Garante, its tasks, powers, inspections, complaints, remedies and fines. They impose no log or record duty on a controller. The Authority may order a controller or processor to supply any information it needs and to produce documents (Articles 59(1)(a) and 60), conduct data protection audits (Article 59(1)(b)) and inspect premises and databases (Articles 61 to 62), which is a general power to demand and examine and not a rule about a record. The records the Law names in these articles are the Authority's own: internal registers of violations and measures (Article 58(1)(u)), minutes of inspections (Articles 61 and 62) and its annual report (Article 64). The cited articles carry no scope clause.
- Kind
- None
- As of
What this law does
Article 52, paragraph 1 establishes the Data Protection Authority as an independent public authority responsible for monitoring the application of the law in order to protect the fundamental rights and freedoms of natural persons with regard to personal data processing.
Article 52, paragraph 2 makes the Authority a collegial body of three regular members and two substitute members appointed by the Great and General Council, which designates the President and Vice-President when it appoints the board. Members serve four-year terms, renewable for two further mandates.
Article 53 requires members to meet integrity requirements and to be chosen from experts of proven experience and competence in personal data protection, in particular in legal and information technology disciplines. Article 54 guarantees the Authority full autonomy and independence, provides it with the human, technical and financial resources it needs, and bars its members from seeking or accepting instructions from anyone.
Article 58, paragraph 1 sets the Authority's tasks, which include supervising and ensuring application of the law, promoting data protection culture among controllers and processors, advising the Great and General Council and the State Congress on legislative and administrative measures, examining complaints, and conducting investigations on the application of the law.
Article 59, paragraph 1 gives the Authority investigative powers, including ordering a controller or processor to provide any information it needs, conducting data protection audits, and obtaining access to all personal data and information and to all premises of the controller and processor.
Article 59, paragraph 2 gives it corrective powers, including issuing warnings and reprimands and ordering a controller or processor to meet a data subject's requests and to bring processing into compliance with the law. Articles 60 to 63 let it request information and documents and carry out verifications, including special ones. Article 65 provides that a data subject has administrative protection, through complaints and reports to the Authority, and judicial protection under Article 70.
Article 66 gives a data subject who considers that the processing concerning them violates the law the right to lodge a complaint with the Authority if the alleged violation occurred in San Marino. Article 67 requires the Authority to decide a complaint by a reasoned measure within 90 days of receiving it, extendable by at most two months, and declares a complaint inadmissible if the complainant has brought an action before the judicial authority.
Article 68 lets anyone submit a report to the Authority if they believe the law has been violated. Article 69, which provided for opposition to the Authority's measures, has been repealed. Article 70, paragraph 1 gives the Administrative Judge exclusive jurisdiction over disputes on the application of the law, including those concerning the sanctioning measures the Authority issues.
Article 71 entitles any person who has suffered material or non-material damage from an infringement of the law to compensation from the controller or processor, makes each controller involved liable for the damage caused by infringing processing, and makes a processor liable where it has not complied with obligations directed to processors or has acted outside the controller's lawful instructions, with joint and several liability where more than one is involved.
Article 72, paragraph 1 subjects the controller's and processor's own obligations to administrative fines of up to five million euros or two per cent of total annual turnover of the previous financial year, whichever is higher, and article 72, paragraph 2 sets the higher tier for the basic principles, the data subject's rights and the transfer rules.
Article 73 fixes the procedure for imposing fines, and article 75 bars publishing or disseminating news or images identifying a child involved in legal proceedings. Law 171/2018 was approved by the Great and General Council on and promulgated by the Captains Regent on , the date carried in the law's own official title. Article 129 provides that the law enters into force on the fifteenth day after its legal publication. The Bollettino Ufficiale records its publication on , so the law entered into force on .
When LexLint raises it
When your app profile says your app is a listed company or processes personal data.
Back to the example · Lint your app
Page updated .