Vatican CityGeneral Regulation on the Protection of Personal Data, Data Protection Officer and complaints
Decreto n. DCLVII del 30 aprile 2024, Arts. 10 and 25 (Data Protection Officer and complaints)
In force since .
An enforcement supervision rule binding government bodies.
- Enforcement body
- Data Protection Officer function, assigned to the General Councillor of Vatican City State
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Where this Regulation binds your processing, route a written complaint from the Interested party that your treatment violates the Regulation to the Data Protection Officer, a function always assigned to the General Councillor of Vatican City State who acts in full independence, without prejudice to recourse to the judicial authority of Vatican City State.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureNo
Criminal exposure note
The Regulation sets out a written complaint to the Data Protection Officer, decided by a reasoned ordinance of the President of the Governorate that may contain reprimands, admonitions and corrective measures (Articles 25 to 27); a Referente who contravenes the Regulation may face disciplinary sanctions, without prejudice to any criminal liability for wilful conduct (Article 13, paragraph 4).
What it makes you log
Logging duty
Articles 10 and 25 to 27 make the Data Protection Officer the body that receives a written complaint, gathers information from the person responsible for treatment, may obtain documents, and gives a reasoned opinion on which the President of the Governorate issues a reasoned ordinance. The officer's power to ask for information and documents is a demand power and names no record the controller must keep. The Register of treatment activities is Article 9 and the 72-hour breach report to the officer is Article 13(2); this row cites neither.
- Kind
- None
- As of
What this law does
Article 25 gives the Interested party, without prejudice to recourse to the judicial authority of Vatican City State, the right to make a written complaint to the Data Protection Officer where they consider that the treatment of their data violates the Regulation.
Article 10, paragraph 2 always assigns the Data Protection Officer function to the General Councillor of Vatican City State, and paragraph 3 has that officer act in full independence in carrying out the tasks and exercising the powers the Regulation gives. Under Article 26, paragraph 3, the Data Protection Officer issues a reasoned opinion on a complaint within 30 days, extendable to 90 days in a particularly complex case, and sends it to the President of the Governorate.
Article 27, paragraph 1 has the President of the Governorate close the complaint procedure with a reasoned ordinance, not open to appeal, upholding or rejecting the complaint. Where a complaint is upheld, Article 27, paragraph 3 allows the ordinance to contain reprimands, admonitions and appropriate corrective measures.
Article 27, paragraph 2 provides that an ordinance upholding the complaint refers the Interested party to the competent judicial authority for any claim for compensation of material or immaterial damage caused by the treatment.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .