CCIN Monaco: are you concerned?
Who is Subject Data Processing Declaration Obligations in Monaco?
Are you a business manager, president of an association, or manager of a business in Monaco? Are you a craftsman, or do you practice a liberal profession in Monaco?
If so, read the following carefully; you are most likely subject to the legal obligations to declare your data processing to the CCIN!
Law 1.165 of December 23, 1993, which established the CCIN (Commission for the Control of Nominative Information), concerns “automated or non-automated processing of personal information.” This includes “the collection, recording, organization, modification, conservation, extraction, consultation, or destruction of information, as well as the exploitation, interconnection, or reconciliation, communication of information by transmission, broadcast, or any other form of making available.”
CCCIN / Monaco : Monaco Compliance Guide
Compliance Monaco : The Complete Guide to CCIN / RGPD
Everything you need to know about personal data processing in Monaco: Control Authority for Personal Information (CCIN), General Data Protection Regulation (GDPR), obligations, penalties, and steps for ensuring perfect compliance for your business or organization!
If you collect personal data in Monaco, you are affected by the CCIN!
Concretely, this means that as soon as your company collects personal information, particularly via the internet (website, form, newsletter subscription, third-party service, etc.), it is subject to the obligations of the data privacy laws in Monaco. This is, for example, the case for any e-commerce site by simply registering a user account.
Furthermore, Law No. 1.165 of December 23, 1993, as amended, also provides that any transfer of personal data abroad must be duly and explicitly approved by the user. Like many companies, you may not feel concerned by this measure, and yet, this is indeed the case, for example, if your website uses a service as widespread as Google Analytics!
Consequently, from the moment you plan to collect, store, and use personal data via your website or any other means, electronic or not, to/from the Principality of Monaco, you are subject to Law 1.165, and you must declare these activities to the CCIN!
Special Cases of Sensitive Business and Health Professional Data
Generally speaking, article 12 of Law No. 1.165 of December 23, 1993, as amended, expressly prohibits the processing of sensitive data relating to health.
Only natural or legal persons subject to professional secrecy are authorized to carry out data processing for medical purposes within a framework strictly regulated by law and subject to prior authorization from the CCIN.
The processing of medical data is also subject to strict IT protection and security obligations at the level of the internal infrastructure as well as the website hosting solution and the personal data of visitors, prospects, and customers.
It is therefore strongly recommended to call on an expert in the processing of sensitive data in order to benefit from HDS (Health Data Hosting) certified hosting such as those implemented by Baccana Digital Consulting on the Monaco Cloud.uch as those implemented by Baccana Digital Consulting on the Monaco Cloud.
Other Special Cases
For obvious reasons, the processing of personal data of a religious, political, racial, philosophical, or trade union nature is strictly prohibited by Article 12 of Law No. 1.165 of December 23, 1993, as amended:
“No one may carry out processing, whether automated or not, which reveals, directly or indirectly, political, racial or ethnic, religious, philosophical or trade union opinions or affiliations, or data relating to health, including genetic data, sexual life, morals, measures of a social nature.”
However, the processing of this data may be subject to exceptions subject to specific rules, and this data can only be collected, stored, and used under strict conditions, in particular where express written consent is required.