FAQS

By integrating the Convention 108+ of the Council of Europe and the “European data protection package” of the European Union in the elaboration of its new Law, the Principality wants to equip itself with a level of protection adapted to the new requirements for the protection of personal data with the aim of obtaining from the European Commission a so-called "adequacy" decision which should greatly facilitate the exchange of data with the countries of the European Union.

Law no. 1.565 of December 3, 2024 thus includes among others the criteria from the GDPR which are both territorial and extraterritorial in scope, as well as the main principles laid down by the Convention 108+ and the GDPR. Personal information becomes personal data, in accordance with the two European texts and the “Personal Data Protection Authority (APDP)” replaces the CCIN.

The Law further includes new rights of the data subjects, more specifically, data portability and processing limitation, and removes a large number of prior formalities under the principle of accountability.

It also integrates the tools for ensuring data processing compliance applicable to both data controllers and processors, such as for example, the appointment of a Data Protection Officer and the impact assessment.

The Law reinforces the obligations of the processor as well as the security of data and their processing through the introduction of new European concepts, such as data protection by design and by default, and similarly regulates data transfers.

Furthermore, it provides for a right to compensation and a right to legal remedy against the controller and processor in the event of damages.

Finally, in accordance to the Convention 108+, the powers of the new Authority are reinforced, especially in the area of sanctions.

Pursuant to its Article 3, Law no. 1.565 of December 3, 2024 applies to the processing of personal data, fully or partially automated, as well as non-automated processing of data contained or intended to be included in the files:

• implemented by a data controller or processor located in Monaco, whether the processing takes place in Monaco or not;
• relating to data subjects located in the territory of the Principality and implemented by a data controller or processor outside of the territory of the Principality when the processing relates to the offer of goods or services or to the monitoring of the behavior of these data subjects.

Example 1: the Law applies when the data controller, or processor, located abroad, targets, through its website, consumers in Monaco offering them goods or services by enabling them to place their order in French, pay in Euros, and have it delivered to Monaco.

Example 2: the rules established in the Principality for the protection of personal data must be complied with by the data controllers, or processors located abroad as soon as they follow (trace) Internet users located in Monaco, for example, by means of cookies and trackers, in order to subsequently send them targeted advertising.

Conversely, the Law does not apply to processing carried out by a natural person for the exercise of exclusively personal or domestic activities.

For example: storing family or private photos on a computer.

Although Law no. 1.165 of December 23, 1993 granted rights to legal persons whose data were processed, namely a right of opposition and a right of access, the new Law has chosen not to maintain these rights; practice has shown that the exercise of these rights is extremely limited, if not non-existent and a source of difficulty.

Definition of the data controller or “controller”

• Independent of the controlled sectors and public authorities, it is not subject to any authority
• Administrative :  acts "on behalf of the State" and certain powers devolved upon the administration are delegated to it (control, verification, authorization)
• Authority : has its own specific powers (recommendations, decisions, regulatory proposals, sanctions).

In addition to the processing carried out by a natural person for the exercise of exclusively personal or domestic activities, the following are excluded from the jurisdiction of the APDP:

• the processing operations carried out by courts and the Public Prosecutor's Office in the exercise of their judicial functions as well as those carried out in the context of international mutual legal assistance procedures ;
• the processing operations relating to State security and national security.

The APDP has 20 missions:

• raising public awareness of its functions, powers, and activities as well as its understanding of the risks, rules, safeguards, and rights relating to the protection of personal data and the particular attention to the right to data protection of minors and vulnerable persons, and to promote as part of its duties, the use of privacy-protecting technologies ;

Example of “vulnerable persons”: employees, people with disabilities, the elderly, minors.

• information to data subjects to inform them of their rights and obligations by answering their questions and communicating on data protection ;
• advice and support to the data controllers, processors and data subjects ;
• the formulation of reasoned opinions on the processing submitted by the competent administrative and judicial authorities within the limits provided for by the Law ;
• the list of processing operations made available to the public ;
• the issuance of a reasoned opinion on high-risk impact assessments ;
• the authorization in certain cases of data transfers to a State, a territory or an international organization that does not ensure an adequate level of protection;
• the control (verifications and investigations) of the implementation of the processing operations and the notification to the controller or processor of any breaches of the Law;
• the keeping of internal registers of violations of the Law and corrective measures taken ;
• the immediate reporting to the Public Prosecutor of acts constituting crimes and offences ; 
• the investigation of all claims, petitions and complaints submitted by the data subjects ;
• the implementation of indirect right of access ;
• the validation and publication of the codes of conduct ;
• the issuing of certifications and approvals to certification organizations, as well as their periodic reviews ;
• the adoption and publication of guidelines or recommendations;
• the approval and publication of standard contractual clauses;
• the option to alert the Minister of State to changes in practices, legislation, and regulations that would no longer allow a State to be recognized as having an adequate level of protection by the Principality;
• the publication of a list of countries with an adequate level of protection ;
• the cooperation with foreign data protection authorities ;
• the drawing up of an annual activity report.

The new distribution ensures that the Authority’s expertise is shared between:

• the powers of investigation devolved to the plenary formation, excluding the restricted committee, and
• the powers of sanction exercised by the restricted formation.

• The plenary formation

Pursuant to Article 46 of Law no. 1.565 of December 3, 2024, the plenary formation, outside the restricted formation, shall carry out, on its own initiative or on the basis of a report, the necessary verifications and investigations to monitor the implementation of the processing operations.

In addition to on-site inspections and those carried out in response to a summons, members of the Authority, its agents or investigators may carry out any useful observations

Example: consulting via an online communication service, data that are freely accessible or made accessible.

When a non-compliance is found to be likely to be remedied, the President of the Authority may issue formal notice to comply with the data controller or processor.

The formal notice can be made public.

This procedure shall be closed if compliance is achieved.

• The restricted formation

Cases may be referred to the restricted formation:

• when the formal notice given to the data controller or its processor to comply has remained unsuccessful ;
• without prior formal notice, when the non-conformity is not likely to be brought into compliance as it cannot give rise to a corrective measure;

Example: the data have been destroyed.

• When a data controller or processor fail to comply with the obligations of the Law.

Lawfulness

In accordance with Article 5 of Law no. 1.565 of December 3, 2024, in order to be lawful, personal data processing must meet at least one of the following requirements:

• obtaining consent, for one or more specific purposes, from the data subject;
• the requirement to comply with the legal obligation to which the data controller is subject ;

            Example: processing relating to anti-money laundering obligations implemented by banks

• the necessity for the performance of a contract to which the data subject is a party or of for the performance of pre-contractual measures taken at the request of the data subject.

            Example: the processing of personal data is necessary for the preparation and delivery of an order made online.

• necessary to protect the vital interests of the data subject or those of another natural person;

Example: the processing implemented by a doctor for the medical follow-up of his or her patients;

• the existence of public interest reasons when the processing is carried out by a legal person governed by public law or by a legal person governed by private law entrusted with a mission of general interest or a public service concession;

Example: the processing by an administrative department of data related to the monitoring of people placed in shelters

• tnecessary for the purposes of a legitimate interest pursued by the data controller or by a third party.

Fairness

Personal data must also be processed fairly. This implies that the data subject is informed of the risk of impact on his or her privacy in order to ensure that the processing does not have unforeseeable negative effects.

Transparency

Finally, personal data must be processed in a transparent manner. The transparency principle implies that the data controller must take appropriate measures to provide the data subject with a certain amount of information relating to the processing of their data (purposes, identity of the data controller, storage period, recipients, etc.) and facilitate the exercise of one's rights.

This is what is known as the principle of transparency.

This obligation of transparency applies throughout the lifecycle of the processing.

The personal data processed must be accurate and, where necessary, kept up to date.

The data controller shall take reasonable measures, that is, measures that do not require disproportionate effort, to ensure that inaccurate or incomplete data are erased or rectified as soon as possible.

The principle of data accuracy must be respected for each processing implemented by the data controller and must be assessed in the context of the purpose of the data processing.

In certain cases, the data cannot be updated. These are cases where the purpose is essentially the documentation of events as a historical "snapshot".

Example: the protocol of a medical intervention cannot be updated, even if it later appears that the conclusions in the protocol were inaccurate. In this case, additions may be made to the protocol, provided that they are clearly identified as contributions made at a later date.

Conversely, in some situations, updating the data and their accuracy is of absolute necessity due to the potential harm that can be caused to the data subject if the data are inaccurate.

Example: special databases that contain personal credit history data. These databases are very useful for banking institutions as they enable them to check the creditworthiness of  potential customer in order to obtain a loan.

The processing operations put in place must guarantee appropriate security of personal data, including protection against unauthorized or unlawful processing or against accidental loss, destruction or damage, by means of technical and/or organizational measures to ensure their integrity and confidentiality.

The appropriateness of the measures should be determined on a case-by-case basis and reviewed regularly.

Article 10 of Law no. 1.565 of December 3, 2024 imposes the obligation on the data controller to take appropriate measures to provide the data subject with any information on the use of his or her data and to facilitate the exercise of his or her rights.

This is what is known as the principle of transparency.

This obligation of transparency applies throughout the life cycle of the processing.

Its objective is to provide data subjects with useful information so that they can claim their rights and hold accountable the data controllers for the processing of their personal data.

Article 12 of Law no. 1.565 of December 3, 2024 allows any person who can prove his or her identity to obtain confirmation from the data controller as to whether his or her data have been processed and, if so, to communicate them in a readable and comprehensible form.

This is what is known as the right of access.

This right is generally exercised directly with the data controller.

However, the right of access may be exercised indirectly.

Indeed, for processing operations carried out for the purposes of the prevention, detection or prosecution of criminal offenses or the execution of sanctions, the data subject must submit a request verification to the APDP to find out whether his or her data is being processed.

This right, reinforced by the new Law, implies that the data subject may obtain from the data controllers that they rectify, complete, or even update, as soon as possible, the data that the data controllers hold on him or her when the information proves to be inaccurate or incomplete.

This right was recently reinforced by the Law to allow the data subject to request from the data controller, in very specific cases, that his or her personal data be erased, whether public or not.

The exercise of this right is limited to the following cases:

• where the data subject withdraws the consent on which the processing is based and there is no other legal ground for the processing;
• where the data subject objects for reasons relating to his or particular situation to the processing of his or her data based on public interest or legitimate interest, and there is no overriding legitimate reason for the processing, or where he or she objects to the processing of his or her data for commercial prospecting purposes;
• where the personal data are no longer necessary regarding the purposes for which they were collected or otherwise processed;
• where the personal data have been unlawfully processed;
• where the data have been collected concerning a direct offer of information society services;
• to comply with a legal obligation.

However, this right to erasure does not apply when the processing is necessary:

• • to comply with a legal obligation that requires the processing of these data;
  • to carry out a task in the general interest by a legal entity governed by private law which has been entrusted with such a task or which holds a public service concession;
  • to carry out a task in the exercise of official authority vested in the controller;
  • for archiving purposes in the public interest, for scientific or historical research purposes, or for statistical purposes, insofar as the exercise of this right is likely to render impossible or seriously impair the achievement of the purposes of the processing;
  • for the establishment, exercise, or defense of legal claims;
  • to exercise the right of freedom of public expression and information.

The right to restriction of processing allows the data subject to obtain from the data controller, the temporary freezing of the use of some of his or her data.

This new right applies in 4 cases:

• the data subject disputes the accuracy of the data;
• the processing is unlawful but the data subject does not want the data to be erased;
• the processing is no longer justified by the processing purpose but the data subject wishes to have his or her rights established, exercised, or defended in court;
• the processing is justified on legitimate grounds pursued by the data controller and the data subject contests the legitimacy of the processing. The data controller will then "freeze" the processing until it is known whether its legitimate grounds prevail over those of the data subject.

The data subject has the right to object to the processing of his or her personal data, which is enforced by the new legislation.

The right to object allows the data subject to refuse that his or her data are used by an organization for a specific purpose.

This right is exercised differently depending on the purposes pursued by the processing in question.

This first condition implies that data subjects must be able to make a real choice regarding the processing of their data.

As such, the data subjects must not be coerced or influenced in their choice.

Data subjects should not suffer from any negative consequences if they do not consent.

Consent is presumed not freely-given in three cases:

• When there exists a clear imbalance of power between the data subject and the data controller, especially when the latter is a public authority or an employer;

The data processing should therefore be justified by another legal basis, such as, the existence of a legal obligation or the fulfilment of a legitimate interest pursued by the data controller.

For example: The installation of a video surveillance system in a store cannot be justified by employees’ consent because they are in a relationship of subordination to their employer and will not be able to give their consent freely.

On the other hand, such a system may be justified by the legitimate interest of the data controller, namely the safety of property and people.

• When the consent is tied with the acceptance of general terms and conditions or when the provisions of a contract or service are subject to a request for consent to the processing of personal data not necessary for the execution of the contract or service;

In such cases, the appropriate legal basis will be the fulfilment of a contract, provided however that the requested data are really necessary for the fulfilment of the contract.

For example: the providing by the buyer of his or her postal address to enable the ordered goods to be delivered.

• When a prejudice is suffered as a result of a refusal to give consent.

Data subjects should be in a position to refuse to give their consent in order to express a real freedom of choice.

Consequently, any deception, intimidation, coercion, or significant negative consequences if the person refuses to give consent invalidate such consent.

Consent must be specific to the purpose of the processing.

Therefore, when the processing has several purposes, the consent should be obtained independently for each purpose.

This is referred to as separate consent for each purpose.

The purpose must be clearly described and in unambiguous terms. This must be done by reference to the “reasonable expectations of an average data subject”.

This criterion of specificity allows data subjects to retain a certain degree of control over their data.

It constitutes a guarantee against the use of personal data collected for purposes far removed from the reasons initially listed, and thus makes it possible to avoid misuse of said data.

Where processing operations must be added or modified, consent must be sought once again from the data subject, except in cases where another legal basis appears to be more appropriate.

The data controller must inform the data subject of certain information consistent with the principle of transparency, before the data subject makes a choice.

[For more information about the principle of transparency, refer to Information to be provided to the data subjects]

This information must allow the data subject to become aware of how his or her data are used and to be able to assess the consequences of his or her consent.

The data subject can thus make an informed choice.

Such information must be provided in a way that is:

• clear;
• accessible;
• adapted to the data subjects.

To adapt this information, the data controller must consider the different categories of data subjects and identify the appropriate media.

The data controller must therefore use terms understood by most people, with particular attention to the terms used when addressing minors (underage).

The information can be provided orally or in writing, but also in audio and video messages.

The consent must either :

• be given by an oral or written statement
• result from a clear affirmative act

There must be no reasonable doubt as to the person’s wish to give consent to the processing of his or her data.

Important: Silence or inaction of the data subject does not constitute valid consent within the meaning of the legislation relating to the protection of personal data as consent cannot be unambiguous.

For example, the following do not constitute unambiguous consent:

• the use of a pre-checked box
• a mention in the privacy policy
• the overall acceptance of the terms and conditions.

In addition to this "classic" consent provided for in Article 6 of Law no. 1.565 of December 3, 2024, Article 7 of the said law provides for reinforced consent when a controller relies on the consent of the data subject to process sensitive data.

This explicit consent implies that the consent is of course given freely, specific, informed, and unambiguous, but also that it is affirmed in a clear statement.

It must therefore no longer be possible to infer consent solely from the actions of the data subject, but must be explicit and expressed in clear terms.

Several ways can be considered, such as:

• a written and signed statement
• an electronic form to complete
• an email to be sent back
• the use of an electronic signature
• a telephone conversation, provided that a specific request for confirmation from the data subject is formulated in a comprehensible and clear manner

The data subject must be able to withdraw his or her consent at any time.

The data controller must inform the data subject that a right of withdrawal exists at the same time as the consent is obtained. He must also indicate the procedure to follow to exercise this right of withdrawal.

It must therefore be as easy to withdraw one’s consent as it is to give it.

Consequently, in the event of exercising this right, the data subject does not have to justify his or her choice.

Furthermore, the data subject must not suffer any prejudice as a result of the withdrawal except for the cessation of benefits that could have resulted from the use of the data to which he or she had initially consented.

Any automated processing carried out before the withdrawal of consent remains lawful.

The new Law introduces two new European concepts in the Monegasque normative corpus: Data protection by design (privacy by design) and data protection by default (privacy by default).

What does data protection by design mean?

Pursuant to Article 23 of Law no. 1.565 of December 3, 2024, the data controller must implement, at the same time when determining the means of processing and during the processing itself, appropriate technical and organizational measures to ensure the highest level of privacy of personal data.

This principle of “data protection by design” applies throughout the lifecycle of the processing.

Its application implies that the data controller assesses the potential impact of processing on the rights and freedoms of data subjects and this, on a regular basis.

The technical and organizational measures taken by the data controller may thus include:

• minimize the processing of personal data;
• pseudonymize personal data as soon as possible;
• ensure the transparency with regards to the functions and processing of personal data;
• allow the data subject to control the data processing;
• allow the data controller to implement security measures or improve those already in place.

These measures must be taken in terms of:

• the state of knowledge
• the implementation costs and the nature, scope, context, and purposes of the processing;
• the risks, including the probability and severity, to the rights and freedoms of natural persons.

What does data protection by default mean?

Article 23 of Law no. 1.565 of December 3, 2024 provides that the data controller shall also implement appropriate technical and organizational measures to ensure that, by default, only the personal data necessary for each purpose  of the processing are processed.

This applies to:

• the amount of personal data collected;
• the extent of their processing;
• the period of retention;
• their availability.

More specifically, these measures guarantee that, by default, the personal data are not made available to an indeterminate number of natural persons without the intervention of the data subject in person.

Pursuant to Article 25 of Law no. 1.565 of December 3, 2024, the representative is the natural or legal person established on the territory of the Principality or, failing that, within a Member State of the European Union, mandated by a data controller located outside Monaco, to be the contact of both the data subjects and the APDP, to answer any questions.

His or her appointment is mandatory if a data controller not established in Monaco:

• offers products or services to persons located in the territory of the Principality;
• implements processing related to the monitoring of their behavior.

A representative may be appointed by any written means.

This obligation is not general and has 3 exceptions:

• the processing is occasional and does not involve large-scale processing of sensitive data;
• the processing relates to criminal convictions or offences;
• the data controller is a legal person governed by public law or a public organization.

What is the penalty for failing to comply with the obligation to appoint a representative?

Article 53 of Law no. 1.565 of December 3, 2024 provides that failure to comply with the obligation to appoint a representative is punishable by an administrative fine of up to 5,000,000 Euros or, in the case of a company, up to 2% of the previous year's total worldwide annual revenue, whichever is the highest.

Pursuant to Article 27 of Law no. 1.565 of December 3, 2024, a data controller must record the processing operations in a record under his or her responsibility immediately he or she has at least 50 employees.

However, this threshold of 50 employees does not apply in the following 4 cases:

• If the processing is likely to involve a risk to the rights and freedoms of the data subjects;

Example: the use of a geolocation system

• If the processing is not occasional;

Example: management of customer files.

• If the processing involves sensitive data;

Example: health data

• If the processing involves personal data relating to offences, criminal convictions, and security measures, or relating to suspicions of illegal activities.

Example: anti-money laundering processing.

The record maintained by the data controller is intended to replace a large part of the preliminary formalities established by Law No. 1.165 of 23 December 1993, amended.

What must be included in the record of processing operations?

The record must contain at the very least the following information:

• the name and contact details of the data controller, and, if applicable, of his or her joint data controller, representative, and data protection officer;
• the purposes of the processing;
• the categories of the data subjects and the categories of the personal data processed;
• the categories of recipients;
• when possible, the retention period for personal data, or the criteria for determining this period.
• when possible, a general description of the appropriate technical and organizational measures to ensure a level of security appropriate to the risks to the rights and freedoms of natural persons;
• in case of transfers of personal data outside the Principality, the identification of the recipient country, the territory or the international organization and, where applicable, the provided safeguards,
• where applicable, the use of profiling for processing carried out for the purposes of the prevention, detection, investigation, and prosecution of criminal offences or the execution of criminal sanctions;
• an indication of the legal basis of the processing, including transfers, for:
• Processing operations carried out for the purposes of the prevention and detection of criminal offences, the investigation and prosecution of criminal sanctions or the execution of criminal sanctions;
• Processing of interest to national security.

What is the penalty for failing to comply with the obligation to maintain a record of processing operations?

Article 53 of Law no. 1.565 of December 3, 2024 provides that failure to comply with the obligations relating to maintaining a record of the processing operations is punishable by an administrative fine of up to 5,000,000 Euros or, in the case of a company, up to 2% of the previous year's total worldwide annual revenue, whichever is the highest.

If, in a logic of accountability of data controllers, a very large number of processing operations are no longer subject to formalities with the APDP, exceptions remain.

The following three categories of particularly sensitive processing are thus subject to the prior opinion of the APDP:

• the processing operations for the purposes of the prevention, detection, investigation, and prosecution of criminal offences or the execution of criminal sanctions, including protection against and prevention of threats to public security;
• the processing of genetic or biometric data necessary to authenticate or verify a person’s identity;

• processing for the purpose of research in the field of health.

The transfer of data to a State, a territory or an international organization that does not ensure an adequate level of protection is also subject to prior authorization of the APDP, when:

• the appropriate safeguards have not been put in place, and
• none of the derogations provided by Article 99 of Law no. 1.565 of December 3, 2024 do not apply, and
• the 4 conditions provided for by paragraph 3 of the article 99 are not met.

Special case of video surveillance systems:

In line with article 85 of Law no. 1.565 of December 3, 2024, video surveillance systems installed in places not open to the public shall be brought to the immediate attention of the APDP.

According to the explanatory statement, a place not open to the public is “for example, a private place (home, garage, etc.) or premises for professional use such as offices or warehouses".

Video surveillance systems installed in places open to the public or filming the surroundings of public roads, spaces open to the public or to public traffic, remain subject to prior authorization of the Minister of State.

According to the explanatory statement, places open to the public can include for example “a restaurant, a shopping mall, or an administration desk”.

What should be included in the request for opinion or authorization?

The requests for opinion and authorization submitted to the APDP must include the following information:

• the name and professional contact details of the data controller or his or her representative in Monaco;
• the legal basis for the processing and, where applicable, the draft ministerial order or the draft order of the Secretary of State for Justice, Director of Judicial Services;
• The purposes of the processing;
• the name, if any, of the processing
• the categories of personal data processed, their origins, and the categories of the data subjects of the processing;
• the retention period of the personal data processed or, if this is not possible, the criteria used to determine this period;
• the departments in charge of the implementation of the processing;
• a risk analysis relating to the safeguarding of the processing, including security measures;
• the authority or function of the person or department to whom the right of access is exercised and the measures taken to facilitate the exercise of this right;
• the categories of persons who, by reason of their functions or for the purposes of the service, have access to the personal data;
• the recipients or recipient categories entitled to receive the personal data;
• where applicable, interconnections, reconciliations, or any other form of connection with other processing;
• where applicable, the identity and address of the processor;
• where applicable, the transfer of data outside the Principality and the appropriate guarantees governing such transfers.

For processing carried out in the context of research involving human beings, the file submitted in support of the request for opinion must also include the following information:

• the objective of the research;
• the population concerned;
• the retained method of observation or investigation;
• the justification for the use of personal data;
• the duration and organization methods of research;
• the data analysis method;
• where applicable, a copy of the opinion issued by the committee responsible for the protection of persons taking part in biomedical research.

The APDP must be kept informed of any changes affecting the information contained in such requests for opinion and applications for authorization.

What is the response time of the APDP?

The APDP renders its opinion or authorization within two months after receiving the request for opinion or authorization.

This delay may be renewed once by a reasoned decision of the President of APDP.

If, at the end of this period, the opinion has not been issued by the APDP, the said opinion shall be deemed to be favorable.

If, at the end of this period, the authorization has not been issued by the APDP, the said authorization is deemed to have been refused.

The APDP shall make available to the public a list of all the processing operations, which have been the object of prior formalities.

Mandatory in some organizations and often recommended in others, the Data Protection Officer (DPO) facilitates compliance with the data protection legislation and acts both as the privileged contact for all questions relating to personal data, whether internal or from a data subject, and as the interlocutor of the Data Protection Authority.

Article 29 of the Law provides that with the exception of courts within the exercise of their judicial duties, the appointment of a DPO is mandatory in the following cases:

• the data processing is carried out by a legal person governed by public law or a legal person governed by private law entrusted with a mission of general interest or a public service concession;
• the basic activities of the data controller consist of processing operations, which by reason of their nature, scope or purposes, require regular and systematic monitoring of the data subjects on a large scale; 

Example: profiling and rating for risk assessment purposes

• the basic activities of the organization consist of large-scale processing of sensitive data or personal data relating to criminal convictions or offences.

Example: processing of customer data by an insurance company or bank in the normal course of its business.

What are the missions of the Data Protection Officer?

The Data Protection Officer has 5 missions:

• inform and advise the organization and the employees who carry out the processing of their obligations pursuant to the legislation currently in place in the Principality;
• monitor compliance with the personal data protection legislation and the organization's internal rules on the protection of personal data, including the allocation of responsibilities, awareness-raising, and training of staff involved in the processing operations, and related audits;
• provide on-demand advice, on data protection impact assessment;
• cooperate with the Data Protection Authority and be its contact point on matters relating to the processing;
• submit requests for opinion to the Data Protection Authority when they relate to the following processing operations:
  • processing for the purposes of preventing, detecting, investigating, prosecuting or punishing criminal offences, including protection against and prevention of threats to public security;
  • processing for the purposes of preventing, detecting, investigating, prosecuting or punishing criminal offences, including protection against and prevention of threats to public security.

What qualifications are required to be appointed Data Protection Officer?

In particular, the Data Protection Officer must have expert knowledge of data protection law and practices.

He or she must also be appointed according to his or her ability to carry out his or her missions. This level of expertise must be commensurate with the sensitivity, complexity, and volume of data processed by the organization.

It is also important that the Data Protection Officer has a good understanding of the processing operations carried out by the organization, the information systems used by the organization, and the data protection requirements of the organization.

The organization must also enable the Data Protection Officer to maintain and complete his or her skills and knowledge (continuous training, participation in workshops, etc.) throughout the duration of his or her mission.

What is the penalty for failing to comply with the obligation to appoint a Data Protection Officer?

Article 53 of Law no. 1.565 of December 3, 2024 provides that failure to comply with the obligation relating to the appointment of a Data Protection Officer is punishable by an administrative fine of up to 5,000,000 Euros or, in the case of a company, up to 2% of the previous year's total worldwide annual revenue, whichever is the highest.

As soon as a data controller uses a processor, this latter must provide sufficient guarantees as to the implementation of appropriate technical and organizational measures to ensure the protection of personal data and respect for the rights of data subjects.

Any use of a processor must be governed by a written contract and whose minimum clauses are set out in Article 26 of Law no. 1.565 of December 3, 2024.

This contract must define:

• the purpose and duration of the processing;
• the nature and purpose or purposes of the processing;
• the type of personal data and the categories of data subjects; and
• the obligations and rights of the data controller.

What information should be included in the contract?

Among the information that must be included in this contract are the following obligations:

• the processor must only process the personal data on the basis of a documented directives from the data controller;
• the processor ensures that confidentiality is respected;
• the processor takes all required measures regarding the security of personal data;
• the processor, according to the data controller’s decision, deletes all personal data or returns them to the data controller upon completion of the services, and destroys existing copies unless the right to which he or she is subject requires the retention of the personal data;
• the Processor assists the data controller, through appropriate technical and organizational measures, to the extent possible, in fulfilling his or her obligation to respond to requests submitted to him or her by data subjects to exercise their rights under the law;
• the Processor makes available to the data controller all the information necessary to demonstrate compliance with his or her obligations;
• considering the nature of the processing and the information at his or her disposal, the Processor shall assist the data controller in ensuring compliance with the related obligations:
  • the appropriate technical and organizational measures to be taken;
  • data breach notifications;
  • impact assessments.

Whenever a controller uses a processor, the latter must provide sufficient guarantees as to the implementation of appropriate technical and organizational measures to ensure the protection of personal data and respect  for the rights of the data subjects.

Any use of a processor must be governed by a contract with the minimum clauses set out in Article 26 of Law no. 1.565 of December 3, 2024.

This contract must define:

• the purpose and the duration of the processing;
• the nature and the purpose(s) of the processing;
• the type of personal data and the categories of data subjects;

• the obligations and rights of the data controller.

What are the obligations to be defined in the subcontract of the processor?

The subcontract must contain the following obligations as well as other the information:

• the processor must only process the personal data according to the documented instructions provided by the data controller;
• the processor ensures the compliance with data confidentiality;
• the processor shall take all required measures regarding the security of personal data;
• the processor, according to the data controller’s decision, deletes all personal data or returns them to the data controller upon completion of the provision of services, and destroys existing copies unless the right to which it is subject requires the retention of the personal data;
• the processor assists the data controller, through the appropriate technical and organizational measures, to the greatest possible extent, in fulfilling his or her obligation to respond to requests submitted to him or her by the data subjects in order to exercise their rights under the law;
• the processor makes available to the data controller all necessary information to demonstrate compliance with his or her obligations;
• considering the nature of the processing and the information at his or her disposal, the Processor shall assist the data controller in ensuring compliance with the related obligations related to:
  • the appropriate technical and organizational measures to be taken;
  • the notifications of security breaches;
  • the impact assessments.

The processor must inform immediately the data controller if, according to him or her, an instruction is a violation of the Law.

The processor can subcontract the processing him or herself to a third party only with the prior written approval of the data controller, specific or general, and compliant with the provisions defined in the Article 26 of the Law.

When a processor uses another processor to carry out specific processing operations on behalf of the data controller, they shall enter into a contract that provides for the same obligations in this matter as those set out in the contract concluded between the data controller and the processor.

Finally, the processor is considered to be the data controller, if, in violation of the Law, he or she determines the purposes and means of the processing.

The representative is the natural or legal person established in the territory of the Principality, or, failing that, within a Member State of the European Union, mandated by a Processor located outside of Monaco, to be the contact for both the data subjects of the processing and the APDP, to answer any questions.

His or her appointment is mandatory when a processor not located in Monaco:

• offers products or services to persons located in the territory of the Principality;
• implements processing related to behavioral monitoring.

The appointment of a representative must be made in all written means.

This obligation is not general and has 3 exceptions:

• the processing is occasional and does not involve large-scale processing of sensitive data;
• the processing relates to criminal convictions or offences;
• the data controller is a legal person governed by public law or a public organization.

What is the penalty for failing to appoint a representative?

Article 53 of Law no. 1.565 of December 3, 2024 provides that failure to comply with the obligation to appoint a representative is punishable by an administrative fine of up to 5,000,000 Euros or, in the case of a company, up to 2% of the previous year's total worldwide annual revenue, whichever is the highest.

The Processor must record the processing operations in a record under his or her responsibility if the or she has at least 50 employees.

However, this threshold of 50 employees does not apply in the following 4 cases:

• If the processing is likely to involve a risk to the rights and freedoms of the data subjects;

Example: the use of a geolocation system

• If the processing is not occasional;

Example: management of customer files.

• If the processing involves sensitive data;

Example: health data

• If the processing involves personal data relating to offences, criminal convictions, and security measures, or relating to suspicions of illegal activities.

Example: Anti-money laundering processing.

The record maintained by the processor is intended to replace a large part of the preliminary formalities established by Law No. 1.165 of 23 December 1993, as amended.

What must be included in the record of processing operations?

The paragraph 2 of Article 27 of Law no. 1.565 of December 3, 2024 provides that the record maintained by the Processor must, at a minimum, contain the following information:

• the name and contact details of the processor and of each data controller on whose account he or she is doing the processing, as well as, if applicable, the name and the contact details of the representative in charge of the processing or the Processor and data protection officer;
• the categories of processing implemented on behalf of each data controller;
• when possible, a general description of the appropriate technical and organizational measures to ensure a level of security appropriate to the risks to the rights and freedoms of natural persons;
• in case of transfers of personal data outside the Principality, the identification of the recipient country, the territory or the international organization and, where applicable, the provided guarantees.

What is the penalty for failing to comply with the obligation to maintain a record of the processing operations?

Article 53 of Law no. 1.565 of December 3, 2024 provides that failure to comply with the obligations relating to maintaining a record of the processing operations is punishable by an administrative fine of up to 5,000,000 Euros or, in the case of a company, up to 2% of the previous year's total worldwide annual revenue, whichever is the highest.

Mandatory in some organizations and often recommended in others, the Data Protection Officer (DPO) facilitates compliance with data protection legislation and acts both as the privileged interlocutor for all questions relating to personal data, whether internal or from a data subject, and as the interlocutor of the Data Protection Authority.

Article 29 of Law no. 1.565 of December 3, 2024 provides that with the exception of courts within the exercise of their judicial duties, the appointment of a DPO is mandatory in the following cases:

• the data processing is carried out by a legal person governed by public law or a legal person governed by private law entrusted with a mission of general interest or a public service concession;
• the core activities of the processor consist of processing operations, which by reason of their nature, scope or purposes, require regular and systematic monitoring of the data subjects on a large scale;

Example: the processor provides website analysis services that include the monitoring of Internet users' activity. When providing these services to a large number of clients, they must appoint a DPO, whereas their clients are not necessarily required to do so.

• the core activities of the processor consist of large-scale processing of sensitive data or personal data relating to criminal convictions or offences.

Example: the processing of data of natural persons on behalf of several insurance companies, including health data

What are the missions of the Data Protection Officer?

The Data Protection Officer has 5 missions :

• inform and advise the organization and employees who carry out the processing of their obligations pursuant to the legislation currently in place in the Principality;
• monitor compliance with the personal data protection legislation and the organization's internal rules on the protection of personal data, including the allocation of responsibilities, awareness-raising, and training of staff involved in the processing operations, and related audits; 
• provide on-demand advice on the impact assessment relating to the protection of personal data;
• cooperate with the Data Protection Authority and be its interlocutor on matters relating to the processing;
• submit requests for opinion to the Data Protection Authority when they relate to the following processing operations:
  • processing operations carried out for the purposes of the prevention and detection of criminal offences, the investigation and prosecution of criminal sanctions or the execution of criminal sanctions, including the protection against threats to public security and the prevention of such threats;
  • processing operations carried out by administrative and judicial authorities, acting within their prerogatives of public authority, which relate to genetic or biometric data necessary to authenticate or verify people’s identity.

What qualifications are required to be appointed Data Protection Officer?

In particular, the Data Protection Officer must have expert knowledge of data protection law and practices.

He or she must also be appointed according to his or her ability to carry out his or her missions. This level of expertise must be commensurate with the sensitivity, complexity, and volume of data processed by the organization.

It is also important that the Data Protection Officer has a good understanding of the processing operations carried out by the organization, the information systems used by the organization, and the data protection requirements of the organization.

The organization must also enable the Data Protection Officer to maintain and complete his or her skills and knowledge (continuous training, participation in workshops, etc.) throughout the duration of his or her mission.

What is the penalty for failing to comply with the obligation to appoint a Data Protection Officer?

Article 53 of Law no. 1.565 of December 3, 2024 provides that failure to comply with the obligation relating to the appointment of a Data Protection Officer is punishable by an administrative fine of up to 5,000,000 Euros or, in the case of a company, up to 2% of the previous year's total worldwide annual revenue, whichever is the highest.

Article 31 of Law no. 1.565 of December 3, 2024 determines the safety obligations imposed on the processor.

The latter must therefore take appropriate technical and organizational measures to ensure a level of security adapted to the risks to the rights and freedoms of the data subjects.

The adoption of these measures requires an analysis to identify the risks and then determine their level of probability and severity.

What are the risks FOR the rights and freedoms of natural persons?

Pursuant to Article 31 of the Law, these risks include:

• data destruction;
• loss of data;
• data alteration;
• unauthorized data disclosure;
• unauthorized access to personal data.

These risks can occur accidentally or unlawfully.

What appropriate measures can be taken?

For example, Article 31 of the Law provides that the processor may take the following actions:

• data pseudonymization and data encryption;
• any means to ensure the confidentiality, integrity, availability, and continued resilience of processing systems and services;

Example: access control to the installations

• any means to restore the availability of and access to personal data in an appropriate time frame in the event of a physical or technical incident;
• the adoption of a procedure to test, analyze, and evaluate the effectiveness of technical and organizational measures regularly to safeguard the security of the processing.

Article 97 of Law no. 1.565 of December 3, 2024 establishes the principle whereby any transfer of personal data outside the Principality may be undertaken without any prior formality providing the legislation or regulation of personal data of the recipient country, territory, or international organization has an adequate level of protection as observed by the Principality.

The list of countries, territories, and international organizations with an adequate level of protection is adopted by the Government by Ministerial Order.

The APDP is consulted beforehand for its opinion.

This list is updated regularly. It is published in the Monaco Journal and on the website of the APDP.

When the recipient country, territory, or international organization of the data does not appear on the list of countries with an adequate level of protection, the other scenarios provided for in this section are to be considered.

There are 5 of these safeguards:

• compliance with an enforceable commitment in the Principality
• the use of standard protection clauses previously approved by the APDP
• compliance with binding corporate rules approved by the APDP or by a data protection authority of a State that ensures an adequate level of protection

Definition of binding corporate rules (Article 2 of Law no. 1.565 of December 3, 2024):

“The internal rules relating to the protection of personal data applied by a data controller or processor established in the territory of the Principality for transfers or for a set of transfers of personal data to a data controller or processor located abroad within a group of companies, or a group of companies engaged in a joint economic activity”.

• a certification mechanism implemented by the APDP or by independent organizations approved by it
• the adherence to a code of conduct approved and published by the APDP.

In absence of an adequate level of protection and appropriate safeguards, Article 9 of Law no. 1.565 of December 3, 2024 provides for derogations to nevertheless allow a transfer of data to a country, territory or international organization that does not have an adequate level of protection.

There are 7 such derogations:

• the person to whom the data relate has explicitly consented to their transfer after having been informed of the absence of an appropriate level of protection or safeguards and of the nature of the risks introduced by this absence;

Example: an Internet user has consented by means of a checkbox box to the transfer of his data to the United States for statistical purposes after having been duly informed of this transfer beforehand by an information banner

• the transfer is necessary to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent;

Example: sharing of personal data by the relatives of a victim of an earthquake in Peru with the authorities in charge of local rescue operations

• for important reasons of public interest;

In the context of this derogation, the APDP may request any relevant information from the data controller or processor.

• if the transfer is necessary for the establishment, exercise, or defense of a legal claim;

Example: the disclosure of documents as part of an anti-trust investigation

• for the consultation of a public register provided for by law, intended for the information of the public and open to consultation by the public or any person demonstrating a legitimate interest;

Example: register of companies

• If the transfer is necessary for the performance of a contract between the data controller or its representative and the data subject or for the implementation of pre-contractual measures taken at the data subject’s request;

Example: the transfer by a travel agency of its customers' personal data to hotels located in Asia as part of the organization of holidays abroad

• when the transfer is necessary for the conclusion or performance of a contract concluded or to be concluded, in the interest of the data subject, between the data controller or its representative and a third party.

ATTENTION: Only 4 of these 7 derogations apply to the activities of public authorities in the exercise of their prerogatives as public authorities, namely:

• the safeguarding of vital interests;
• the important reasons of public interest;
• the establishment, exercise or defense of a legal claim;
• the consultation of a public register.

In the absence of an adequate level of protection and appropriate safeguards, and if none of the derogations provided for in paragraphs 1 and 2 of Article 99 of Law no. 1.565 of December 3, 2024 is applicable, a data transfer to a country, a territory or an international organization that does not have an adequate level of protection is possible, if the following 4 conditions are met:

• the transfer is not repetitive;

The transfer must not be carried out as part of the normal course of operations within an entity.

Example: one-off access to a file as part of legal proceedings

• the transfer only affects a limited number of data subjects;

This condition will be assessed on a case-by-case basis, but the number must be sufficiently small given the type of transfer.

Example: only the data of employees working in a bank’s IT department are transferred

• the transfer is necessary for the purposes of pursuing compelling legitimate interests of the data controller which are not overridden by the interests or rights and freedoms of the data subject;

Example: the transfer is necessary to protect an organization from serious and immediate harm

• appropriate safeguards have been taken.

Example: deletion of data as soon as possible after transfer

The APDP must be informed of such a transfer.

ATTENTION: this exception provided for in paragraph 3 of Article 99 of the Law does not apply to the activities of public authorities in the exercise of their prerogatives as public authorities.

If:

• the data are transferred to a country, territory, or international organization that does not ensure an adequate level of protection, and
• appropriate safeguards have not been put in place, and
• none of the derogations provided for in Article 99 of Law no. 1.565 of December 3, 2024 apply, and
• the 4 conditions provided for in paragraph 3 of Article 99 are not met,

the data controller or processor must request prior authorization from the APDP.

This transfer will be authorized if:

• appropriate safeguards other than those referred to above have been taken,

Or

• specific contractual clauses between the data controller and the processor or between one of them and the data controller, the processor and the recipient of the data have been provided for.

The APDP renders a decision within 2 months after receiving the request for authorization.

This delay may be renewed once by reasoned decision of the President.

ATTENTION: If, at the end of this period, the authorization has not been issued by the APDP, the authorization is deemed to have been refused.

Pursuant to Article 54 of Law no. 1.565 of December 3, 2024, failure to comply with the obligations relating to the data transfers out of the Principality is punishable by an administrative fine of up to 10,000,000 Euros or, in the case of a company, up to 4% of the previous year's total worldwide annual revenue, whichever is the highest.