San Marino

Article 34(1) requires the controller, in the case of a personal data breach, to notify it to the Data Protection Authority without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons, and to accompany a later notification with reasons for the delay.

Article 34(2) requires the processor to notify the controller without undue delay after becoming aware of a breach, and article 34(3) fixes what the notification must describe: the nature of the breach including, where possible, the categories and approximate number of data subjects and of personal data records concerned, the name and contact details of the data protection officer or other contact point, the likely consequences, and the measures taken or proposed to address it and mitigate its adverse effects.

Article 34(5) requires the controller to document every breach, its effects and the remedial action taken.

Article 35(1) requires the controller to communicate the breach to the data subject without undue delay where it is likely to result in a high risk to the rights and freedoms of natural persons, in clear and plain language, and article 35(3) excuses that communication only where protective measures such as encryption render the data unintelligible, where subsequent measures make the high risk no longer likely, or where it would involve a disproportionate effort and a public communication of equal effect is made instead.

Law 171/2018 was approved by the Great and General Council on 12 December 2018 and promulgated by the Captains Regent on 21 December 2018, the date carried in the law's own official title, and it states no separate entry-into-force clause, so that promulgation date is the day these provisions began to bind.

Article 3 fixes the law's territorial and material scope. Article 4 carries the processing principles and article 5 the lawful bases, while article 6 sets the conditions for valid consent and article 7 the conditions for a child's consent to an information society service. Articles 10 and 11 govern data on criminal convictions and processing that does not require identification.

Article 26 places responsibility for compliance on the controller, article 27 requires data protection by design and by default, article 28 governs joint controllers, article 29 the engagement of a processor and article 30 processing under the authority of either. Article 31 requires records of processing activities and article 32 cooperation with the Data Protection Authority. Article 33 requires technical and organisational measures giving a level of security appropriate to the risk.

Article 36 requires a data protection impact assessment where processing is likely to result in a high risk, and article 37 prior consultation of the Authority where the assessment shows that risk. Articles 38 to 40 govern the designation, position and tasks of the data protection officer, and articles 41 to 44 the codes of conduct, their monitoring, certification and certification bodies.

Law 171/2018 was approved by the Great and General Council on 12 December 2018 and promulgated by the Captains Regent on 21 December 2018, the date carried in the law's own official title, and it states no separate entry-into-force clause, so that promulgation date is the day these provisions began to bind.

Article 45 permits a transfer of personal data to a foreign country or an international organisation only on the conditions this Title lays down, including for onward transfers from there to another country or organisation.

Article 46 governs transfer on the basis of a decision that the destination affords an adequate level of protection, article 47 transfer subject to appropriate safeguards such as standard data protection clauses, article 48 binding corporate rules and what they must specify, and article 49 the recognition of judgements and decisions of foreign countries.

Article 50 sets the narrow derogations that permit a transfer in the absence of an adequacy decision or appropriate safeguards, including the data subject's explicit consent after being informed of the risks, contractual necessity, important reasons of public interest, legal claims, vital interests, and a transfer from a public register.

Law 171/2018 was approved by the Great and General Council on 12 December 2018 and promulgated by the Captains Regent on 21 December 2018, the date carried in the law's own official title, and it states no separate entry-into-force clause, so that promulgation date is the day these provisions began to bind.

Article 13 fixes the information a controller gives when it collects personal data from the data subject, and article 14 the information due where the data came from elsewhere.

Article 15 gives a right of access, article 16 a right to rectification, article 17 a right to erasure described as the right to be forgotten, article 18 a right to restriction of processing, article 19 the duty to notify recipients of a rectification, erasure or restriction, article 20 a right to data portability and article 21 a right to object, including to direct marketing.

Article 22 gives the data subject the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, and where a carve-out applies the controller must implement suitable measures to safeguard the data subject's rights, freedoms and legitimate interests, at least the right to obtain human intervention, to express a point of view and to contest the decision.

Articles 23 and 24 set the restrictions on those rights, including for reasons of justice, and article 25 carries the rights of deceased persons. Law 171/2018 was approved by the Great and General Council on 12 December 2018 and promulgated by the Captains Regent on 21 December 2018, the date carried in the law's own official title, and it states no separate entry-into-force clause, so that promulgation date is the day these provisions began to bind.

Articles 52 to 59 establish the San Marino Data Protection Authority, fix the fit and proper requirements of its members, guarantee its autonomy and independence, and set its competence, tasks and powers, and articles 60 to 63 let it request information and documents and carry out verifications, including special ones.

Article 65 sets the remedies open to a data subject, article 66 the complaint to the Authority, article 67 the decision on it, article 68 reporting, article 69 objection and article 70 judicial protection.

Article 71 entitles any person who has suffered material or non-material damage from an infringement of the law to compensation from the controller or processor, makes each controller involved liable for the damage caused by infringing processing, and makes a processor liable where it has not complied with obligations directed to processors or has acted outside the controller's lawful instructions, with joint and several liability where more than one is involved.

Article 72(1) subjects the controller's and processor's own obligations to administrative fines of up to five million euros or two per cent of total annual turnover of the previous financial year, whichever is higher, and article 72(2) sets the higher tier for the basic principles, the data subject's rights and the transfer rules. Article 73 fixes the procedure for imposing fines, and article 75 bars publishing or disseminating news or images identifying a child involved in legal proceedings.

Law 171/2018 was approved by the Great and General Council on 12 December 2018 and promulgated by the Captains Regent on 21 December 2018, the date carried in the law's own official title, and it states no separate entry-into-force clause, so that promulgation date is the day these provisions began to bind.

Article 8(1) prohibits processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and the processing of genetic data, of biometric data for the purpose of uniquely identifying a natural person, and of data concerning health or a natural person's sex life or sexual orientation.

Article 8(2) lifts that prohibition only in the cases it lists, which mirror the General Data Protection Regulation (GDPR)'s: the data subject's explicit consent to one or more specified purposes; obligations and rights in the field of employment, social security and social protection law; the vital interests of the data subject or another person where the data subject is incapable of consenting; processing in the course of the legitimate activities of a foundation, association or other not-for-profit body with a political, philosophical, religious or trade union aim, confined to its members and not disclosed onward without consent; data manifestly made public by the data subject; legal claims and courts acting judicially; substantial public interest; preventive or occupational medicine and the provision of health or social care by or under the responsibility of a professional bound by secrecy; public health; and archiving in the public interest, scientific or historical research or statistics.

Because the prohibition attaches to biometric data processed for unique identification, biometric material derived from an ordinary recording is not carved out of it. Law 171/2018 was approved by the Great and General Council on 12 December 2018 and promulgated by the Captains Regent on 21 December 2018, the date carried in the law's own official title, and it states no separate entry-into-force clause, so that promulgation date is the day these provisions began to bind.

Law No. 114 of 23 August 2016 introduced criminal-law protection against computer crimes by inserting new articles into the Criminal Code.

Article 182-bis punishes anyone who unlawfully enters a computer or telematics system protected by security measures, or remains there against the express or tacit will of the person entitled to exclude them, with second-degree imprisonment; the punishment rises to third-degree imprisonment for a public official, a private investigator, a system operator, or where violence or destruction of data is involved, and to third or fourth-degree imprisonment where the system is one of public interest.

A separate paragraph punishes, with first-degree imprisonment and a fine of up to 5,500.00 euro, anyone who holds or has access to means suited to enter a protected system in order to obtain an undue profit or cause damage, rising to second-degree imprisonment and a fine from 5,500.00 to 10,500.00 euro where the public-official or system-operator aggravating circumstance applies; a further paragraph punishes, with second-degree imprisonment and a fine of up to 10,500.00 euro, anyone holding or accessing without justified reason equipment or programmes designed to alter a system or its data.

Because the core offence's trigger is defeating a security measure or exceeding an express or tacit exclusion, a plain reading does not reach reading a public, unauthenticated page. The same law separately inserted an interception offence (art. 190-bis), a data and system damage offence (art. 203-bis), and a computer fraud offence (art. 204-ter) into the Criminal Code, not further detailed on this instrument.

The law's own text states that it enters into force on the fifth day following its legal publication, but no stated calendar day for that publication appears in the text, so no effective date is recorded.

Article 98 of Law No. 8 of 25 January 1991 lists 'free uses' of a previously disseminated work, including at (c) analysis and brief quotation of other works, justified by the critical, polemic, pedagogic, scientific or informative character of the work in which they are included.

Article 100 separately permits the reproduction of news and information generally, provided it is in conformity with the codes of conduct for journalists and that the source is quoted, without a stated headline-length or short-extract cap. Article 101 limits both: it prohibits the reproduction or slavish imitation of a work's configuration where this could cause confusion as to the work or its author, separately prohibits reproducing the regular columns of a periodical publication where doing so is so systematic as to identify the periodical's usual and typical content, and bars reproducing the title of a newspaper, magazine or other periodical in another work of the same kind within three years of the title's prior use.

No reported San Marino decision applies articles 98 or 100 to a systematic news aggregator as opposed to an individual quoting or reporting on a published work.

The law's own text (Chapter VI, art. 121) states that it enters into force on the fifth day following its legal publication; the law's own printed header states its promulgation date and that it was published on 4 February 1991, but the text does not itself carry the resulting commencement day as a stated calendar date, so no effective date is recorded.