{"id":20345,"date":"2023-01-31T10:19:12","date_gmt":"2023-01-31T09:19:12","guid":{"rendered":"https:\/\/apdp-mc-stage.jupiter.cdigital.fr\/?page_id=20345"},"modified":"2025-10-10T12:03:07","modified_gmt":"2025-10-10T10:03:07","slug":"how-we-work","status":"publish","type":"page","link":"https:\/\/apdp.mc\/en\/apdp\/how-we-work\/","title":{"rendered":"How we work"},"content":{"rendered":"<ul>\n<li style=\"text-align: justify;\"><em><strong>The plenary formation:<\/strong><\/em><\/li>\n<\/ul>\n<p style=\"text-align: justify;\">The plenary session is responsible for developing tools to comply with Law no. 1.565 of December 3, 2024 and ensure compliance with the law.<\/p>\n<p style=\"text-align: justify;\">Pursuant to Article 46 of the Law, the plenary formation, <strong>outside the restricted formation, shall carry out, on its own initiative or on the basis of a report, the necessary verifications and investigations<\/strong> to monitor the implementation of the processing operations.<\/p>\n<p style=\"text-align: justify;\">In addition to <strong>on-site inspections and those carried out in response to a summons<\/strong>, members of the Authority, its agents or investigators may carry out <strong>any useful observations<\/strong>, such as, for example, consulting data freely accessible or made accessible via an online communication service.<\/p>\n<p style=\"text-align: justify;\"><strong>Where a non-compliance is found to be likely to be remedied<\/strong>, the President of the Authority may issue a formal notice to the controller or processor to comply, which may be made public. This procedure will be closed if compliance is achieved.<\/p>\n<p>&nbsp;<\/p>\n<ul style=\"text-align: justify;\">\n<li><em><strong>The restricted formation:<\/strong><\/em><\/li>\n<\/ul>\n<p style=\"text-align: justify;\">The restricted formation is responsible for <strong>taking measures<\/strong> and <strong>imposing penalties<\/strong> on data controllers or processors who <strong>fail to comply with<\/strong> the provisions of Law no. 1.565 of December 3, 2024.<\/p>\n<p style=\"text-align: justify;\">This formation is made up of <strong>three members of the plenary formation<\/strong>, namely the <strong>judge of the court<\/strong> who is the President and two other members elected by the Authority from among its members.<\/p>\n<p style=\"text-align: justify;\">These members may not exercise <strong>any powers of investigation or prosecution<\/strong>.<\/p>\n<p style=\"text-align: justify;\">The restricted formation deliberates outside the presence of the Authority staff, with the exception of a meeting secretary.<\/p>\n<p style=\"text-align: justify;\">Cases may be referred to the restricted formation:<\/p>\n<ul style=\"text-align: justify;\">\n<li>when the <strong>formal notice<\/strong> given to the data controller or its processor to comply has<strong> remained unsuccessful<\/strong>;<\/li>\n<li>without prior formal notice, <strong>when the non-conformity is not likely to be brought into compliance<\/strong> as it cannot give rise to a corrective measure:<\/li>\n<\/ul>\n<p style=\"text-align: justify;\"><strong>Example<\/strong> : data have been destroyed or a disputed transfer has taken place.<\/p>\n<ul style=\"text-align: justify;\">\n<li>When a data controller or processor <strong>fail to comply with the obligations of the Law<\/strong>.<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">At the end of an <strong>adversarial procedure<\/strong>, the restricted formation of the APDP may impose one of the following sanctions:<\/p>\n<ul style=\"text-align: justify;\">\n<li>a <strong>warning<\/strong>;<\/li>\n<li>an obligation to <strong>bring the processing into compliance<\/strong> or to <strong>satisfy the requests of the data subject<\/strong>, which may be accompanied by a penalty payment of up to to 10,000 Euros \/ calendar day of delay;<\/li>\n<li>a <strong>temporary or permanent restriction of processing<\/strong>;<\/li>\n<li>a <strong>withdrawal of the issued accreditation<\/strong> to a certifying body or an injunction to the latter to refuse or withdraw the granted certification;<\/li>\n<li>a <strong>withdrawal of the delivered certification<\/strong>;<\/li>\n<li>a total or partial suspension of the <strong>decision approving the binding corporate rules<\/strong>;<\/li>\n<li>the<strong> suspension of data flows<\/strong> addressed to a recipient located in a foreign country;<\/li>\n<li>an <strong>administrative fine<\/strong> of up to <strong><span style=\"text-decoration: underline;\">10,000,000 Euros<\/span> or, in the case of a company, <span style=\"text-decoration: underline;\">up to 4% of the previous year&#8217;s total worldwide annual revenue<\/span>, whichever amount is the higest<\/strong>.<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">The restricted formation may decide to <strong>publish its decisions<\/strong>.<\/p>\n<p style=\"text-align: justify;\">The decisions of the restricted formation are also <strong>subject to full litigation appeals<\/strong> before the <strong>Court of First Instance<\/strong>.<\/p>\n<p style=\"text-align: justify;\">Breaches constituting <strong>criminal offences<\/strong> are reported <strong>without delay to the Public Prosecutor<\/strong>.<\/p>\n<table style=\"width: 100.275%;\" width=\"604\">\n<tbody>\n<tr>\n<td style=\"width: 100%; text-align: justify;\" width=\"604\"><strong>The administrative fines of up to <span style=\"text-decoration: underline;\">5,000,000 Euros<\/span> or, in the case of a company, <span style=\"text-decoration: underline;\">up to 2% of the previous year&#8217;s total worldwide annual revenue<\/span>, whichever amount is the higest.<\/strong><\/td>\n<\/tr>\n<tr>\n<td style=\"width: 100%;\" width=\"604\">\n<p style=\"text-align: justify;\">Article 53 of Law no. 1.565 of December 3, 2024, stipulates that failure to comply with the following obligations is punishable by this fine:<\/p>\n<ul>\n<li style=\"text-align: justify;\">verification that <strong>consent has been obtained<\/strong> where processing is based on such consent;<\/li>\n<li style=\"text-align: justify;\"><strong>cooperation<\/strong> of the data controller or processor <strong>with the Authority<\/strong>;<\/li>\n<li><strong>protection by default<\/strong> and <strong>protection by design<\/strong>;<\/li>\n<li style=\"text-align: justify;\">requirements for joint <strong>responsibility<\/strong>, appointment of a <strong>representative, processing, record of processing activities<\/strong> or appointment of a <strong>data protection officer<\/strong>;<\/li>\n<li style=\"text-align: justify;\">the <strong>security measures<\/strong> for processing;<\/li>\n<li style=\"text-align: justify;\"><strong>communication of personal data breaches<\/strong> to the Authority and, where applicable, to data subjects;<\/li>\n<li style=\"text-align: justify;\"><strong>codes of conduct<\/strong>;<\/li>\n<li style=\"text-align: justify;\"><strong>impact assessment requirements<\/strong>;<\/li>\n<li style=\"text-align: justify;\"><strong>informing the Authority<\/strong> of the existence of a video surveillance system installed in <strong>a place not open to the public<\/strong>.<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<table style=\"width: 100.525%;\">\n<tbody>\n<tr>\n<td style=\"width: 100%; text-align: justify;\" width=\"604\"><strong>The administrative fines of up to <span style=\"text-decoration: underline;\">10,000,000 Euros<\/span> or, in the case of a company, <span style=\"text-decoration: underline;\">up to 4% of the previous year&#8217;s total worldwide annual revenue<\/span>, whichever amount is the higest.<\/strong><\/td>\n<\/tr>\n<tr>\n<td style=\"width: 100%;\" width=\"604\">\n<p style=\"text-align: justify;\">Article 54 of Law no. 1.565 of December 3, 2024, stipulates that this fine applies to breaches of the following obligations:<\/p>\n<ul>\n<li style=\"text-align: justify;\">principles relating to <strong>data quality<\/strong> and the conditions for lawful <strong>processing<\/strong>;<\/li>\n<li style=\"text-align: justify;\"><strong>information of the data subjects<\/strong>;<\/li>\n<li style=\"text-align: justify;\">the collection, recording, storage or use of <strong>sensitive data<\/strong>;<\/li>\n<li style=\"text-align: justify;\">the rights of the <strong>data subjects<\/strong>;<\/li>\n<li style=\"text-align: justify;\">the <strong>communication of inaccurate information or documents<\/strong> to the data subjects or to the persons in charge of verifications or investigations;<\/li>\n<li style=\"text-align: justify;\">with the exception of administrative and judicial authorities, the collection, recording, storage or use of personal data relating to <strong>offences, convictions or security measures or whose purpose is the prevention, investigation, recording or prosecution of criminal offences or the execution of criminal convictions or security measures<\/strong>;<\/li>\n<li style=\"text-align: justify;\"><strong>data transfers<\/strong> outside the Principality that do not comply with the provisions of the Law;<\/li>\n<li style=\"text-align: justify;\">failure to comply with <strong>injunctions and prescriptions<\/strong> issued by the Authority&#8217;s <strong>restricted formation<\/strong>.<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>&nbsp;<\/p>\n<table style=\"width: 100.606%;\">\n<tbody>\n<tr>\n<td style=\"width: 100%; text-align: justify;\" width=\"604\"><strong>What criteria must be taken into account to ensure that the fine is <span style=\"text-decoration: underline;\">effective, proportionate<\/span> and <span style=\"text-decoration: underline;\">dissuasive<\/span>?<\/strong><\/td>\n<\/tr>\n<tr>\n<td style=\"width: 100%;\" width=\"604\">\n<p style=\"text-align: justify;\">Article 52 of Law no. 1.565 of December 3, 2024, stipulates that when imposing a penalty payment or administrative fine, the restricted panel must take the following criteria into account:<\/p>\n<ul>\n<li style=\"text-align: justify;\">the <strong>nature, seriousness and duration<\/strong> of the breach;<\/li>\n<li style=\"text-align: justify;\">whether the breach was <strong>deliberate, negligent<\/strong> or <strong>repeated<\/strong>;<\/li>\n<li style=\"text-align: justify;\"><strong>the measures taken<\/strong> by the data controller or processor to <strong>mitigate the damage<\/strong> suffered by the data subjects;<\/li>\n<li style=\"text-align: justify;\">the degree of <strong>cooperation with the Authority<\/strong> in order to remedy the breach or mitigating any adverse effects;<\/li>\n<li style=\"text-align: justify;\">the <strong>categories of personal data<\/strong> affected by the breach;<\/li>\n<li style=\"text-align: justify;\">any applicable <strong>aggravating or attenuating circumstances.<\/strong><\/li>\n<\/ul>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p style=\"text-align: justify;\"><em>\u00a0<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The plenary formation: The plenary session is responsible for developing tools to comply with Law no. 1.565 of December 3, 2024 and ensure compliance with the law. Pursuant to Article 46 of the Law, the plenary formation, outside the restricted formation, shall carry out, on its own initiative or on the basis of a report, [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":20338,"menu_order":219,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"class_list":["post-20345","page","type-page","status-publish","hentry"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>How we work &#8211; APDP<\/title>\n<meta name=\"description\" content=\"APDP - Autorit\u00e9 de Protection des Donn\u00e9es Personnelles \u2013 Principaut\u00e9 de Monaco - official site https:\/\/apdp.mc\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/apdp.mc\/en\/apdp\/how-we-work\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How we work &#8211; APDP\" \/>\n<meta property=\"og:description\" content=\"APDP - Autorit\u00e9 de Protection des Donn\u00e9es Personnelles \u2013 Principaut\u00e9 de Monaco - official site https:\/\/apdp.mc\" \/>\n<meta property=\"og:url\" content=\"https:\/\/apdp.mc\/en\/apdp\/how-we-work\/\" \/>\n<meta property=\"og:site_name\" content=\"APDP\" \/>\n<meta property=\"article:modified_time\" content=\"2025-10-10T10:03:07+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/apdp.mc\\\/en\\\/apdp\\\/how-we-work\\\/\",\"url\":\"https:\\\/\\\/apdp.mc\\\/en\\\/apdp\\\/how-we-work\\\/\",\"name\":\"How we work &#8211; APDP\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/apdp.mc\\\/en\\\/#website\"},\"datePublished\":\"2023-01-31T09:19:12+00:00\",\"dateModified\":\"2025-10-10T10:03:07+00:00\",\"description\":\"APDP - Autorit\u00e9 de Protection des Donn\u00e9es Personnelles \u2013 Principaut\u00e9 de Monaco - official site https:\\\/\\\/apdp.mc\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/apdp.mc\\\/en\\\/apdp\\\/how-we-work\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/apdp.mc\\\/en\\\/apdp\\\/how-we-work\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/apdp.mc\\\/en\\\/apdp\\\/how-we-work\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/apdp.mc\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"APDP\",\"item\":\"https:\\\/\\\/apdp.mc\\\/en\\\/apdp\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"How we work\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/apdp.mc\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/apdp.mc\\\/en\\\/\",\"name\":\"APDP\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/apdp.mc\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How we work &#8211; APDP","description":"APDP - Autorit\u00e9 de Protection des Donn\u00e9es Personnelles \u2013 Principaut\u00e9 de Monaco - official site https:\/\/apdp.mc","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/apdp.mc\/en\/apdp\/how-we-work\/","og_locale":"en_US","og_type":"article","og_title":"How we work &#8211; APDP","og_description":"APDP - Autorit\u00e9 de Protection des Donn\u00e9es Personnelles \u2013 Principaut\u00e9 de Monaco - official site https:\/\/apdp.mc","og_url":"https:\/\/apdp.mc\/en\/apdp\/how-we-work\/","og_site_name":"APDP","article_modified_time":"2025-10-10T10:03:07+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/apdp.mc\/en\/apdp\/how-we-work\/","url":"https:\/\/apdp.mc\/en\/apdp\/how-we-work\/","name":"How we work &#8211; APDP","isPartOf":{"@id":"https:\/\/apdp.mc\/en\/#website"},"datePublished":"2023-01-31T09:19:12+00:00","dateModified":"2025-10-10T10:03:07+00:00","description":"APDP - Autorit\u00e9 de Protection des Donn\u00e9es Personnelles \u2013 Principaut\u00e9 de Monaco - official site https:\/\/apdp.mc","breadcrumb":{"@id":"https:\/\/apdp.mc\/en\/apdp\/how-we-work\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/apdp.mc\/en\/apdp\/how-we-work\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/apdp.mc\/en\/apdp\/how-we-work\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/apdp.mc\/en\/"},{"@type":"ListItem","position":2,"name":"APDP","item":"https:\/\/apdp.mc\/en\/apdp\/"},{"@type":"ListItem","position":3,"name":"How we work"}]},{"@type":"WebSite","@id":"https:\/\/apdp.mc\/en\/#website","url":"https:\/\/apdp.mc\/en\/","name":"APDP","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/apdp.mc\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/apdp.mc\/en\/wp-json\/wp\/v2\/pages\/20345","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/apdp.mc\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/apdp.mc\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/apdp.mc\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/apdp.mc\/en\/wp-json\/wp\/v2\/comments?post=20345"}],"version-history":[{"count":4,"href":"https:\/\/apdp.mc\/en\/wp-json\/wp\/v2\/pages\/20345\/revisions"}],"predecessor-version":[{"id":21112,"href":"https:\/\/apdp.mc\/en\/wp-json\/wp\/v2\/pages\/20345\/revisions\/21112"}],"up":[{"embeddable":true,"href":"https:\/\/apdp.mc\/en\/wp-json\/wp\/v2\/pages\/20338"}],"wp:attachment":[{"href":"https:\/\/apdp.mc\/en\/wp-json\/wp\/v2\/media?parent=20345"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}