This story has been updated. Please see the most recent update below.

On November 29, 2024, the Government of Monaco announced the adoption, on November 28, 2024, of Act No. 1.054 on the Protection of Personal Data by the National Council of Monaco. The Act amends Act No. 1.165. 

In particular, the Government highlighted that the Act aims to facilitate compliance with the processing of personal data in line with the General Data Protection Regulation (GDPR), and that the passage of the Act marks the ratification by Monaco of Convention 108.

What are the amendments of the Act?

The Act amends Act No. 1.165 in relation to the data processing principles. Firstly, the Act provides that personal data may be collected not for a single purpose but for several purposes, provided that they are determined, explicit, legitimate, and not subsequently processed in an incompatible manner. In addition, the Act adds that personal data may be processed for archiving purposes in the public interest and for scientific, historical research, or statistical purposes.

In addition, regarding consent to e-commerce, the Act stipulates the need for explicit consent.

Notably, the Act amends provisions under Act No. 1.165 relating to automated decision-making. Specifically, individuals may have the right not to be subject to a decision that produces legal effects concerning them or significantly affects them, taken solely on the basis of automated processing, including profiling. Persons may be subject to an automated decision where the decision:

• is taken in the context of the conclusion or performance of a contract;
• is authorized by legislative or regulatory provisions that specify measures guaranteeing the safeguarding of rights and freedoms and legitimate interests of the person concerned;
• is based on the explicit consent of the data subject, subject to appropriate safeguards; and
• in the presence of sensitive data, is based on the explicit consent of the data subject or justified by reasons of public interest, subject to appropriate safeguards.

The Act also introduces the mandatory designation of a data protection officer (DPO) under specific processing activities and types of data controllers.

Further, the Act introduces the Personal Data Protection Authority (APDP) to replace the Monégasque data protection authority (CCNI), responsible for supervising data processing activities and compliance with the Act.

Regarding enforcement, the Act also details administrative fines of €500,000 and €900,000 for violations of its provisions.

You can read the press release here and the Act here, both only available in French.

Updated: December 17, 2024

Act published in Official Journal

On December 13, 2024, the Act was published in the Official Journal of Monaco.

You can read the Journal here and the Act here, both only available in French.