Collection and processing in Algeria
How is personal data collected
Law No. 18-07 applies to any public or private entity likely to receive, store and process personal data. As soon as an entity receives data, whether in digital form or not, it must comply with law No. 18-07.
Personal data is, notably, collected through direct input, cookies, social media, mobile apps, surveys, public records, purchase transactions, and by employers or institutions.
How is personal data processed
Personal data processing may only be processed with the express consent of the data subject (or consent of the legal representatives of a child, failing which by authorisation of the competent judge).
The data subject may withdraw his / her consent at any time.
Personal data may only be communicated to a third party for purposes directly related to the functions of the data controller and the recipient. Such communication is subject to the prior consent of the data subject.
However, in some cases, consent is not required if the processing is necessary, namely:
- to comply with a legal obligation to which the data subject or the data controller is obliged;
- to protect the data subject's life;
- for the performance of a contract to which the data subject is a party or to the performance of pre-contractual measures taken at their request;
- to safeguard the vital interests of the person concerned, if they are physically or legally unable to give their consent;
- for the performance of a task carried out in the public interest; or in the exercise of official authority vested in the data controller or the third party to whom the data is communicated; or
- for the accomplishment of a legitimate interest pursued by the data controller or the recipient, within the interest and/or fundamental rights and freedoms of the data subject.
Specific rights and protections
The person concerned by the collection of their data has a right to information, a right of access, a right of rectification and a right to object to their data being collected.
According to Article 9 of the law No. 18-07 (free translation):
“Personal data must be:
- processed lawfully and fairly;
- collected for specified, explicit and legitimate purposes legitimate purposes and may not be further processed in a way that is incompatible with those purposes;
- adequate, relevant and not excessive in relation to the purposes for which they are collected or processed;
- accurate, complete and, where necessary, kept up to date;
- kept in a form which permits identification of the data subjects for no longer than is the purposes for which they were collected or processed.”
Judicial and other decisions
Court decisions requiring an assessment of a person’s conduct may not be based solely on the automated processing of personal data involving the evaluation of certain aspects of their personality.
No other decision having legal effects on an individual may be taken solely on the basis of automated data processing designed to characterize an individual or to evaluate certain aspects of their personality, including profiling.
The law now explicitly recognizes the concept of profiling, defined as any use of personal data intended to evaluate or predict aspects relating to a natural person (performance, behavior, preferences, etc.), and implicitly introduces stricter requirements regarding transparency, proportionality and the limitation of decisions based solely on automated processing.
Data Protection Impact Assessment
Where a type of processing, in particular involving the use of new technologies, is likely to result in a high risk to the rights and freedoms of natural persons, the controller must, prior to processing, assess the impact of the processing operations to be carried out on personal data, taking into account the nature, scope, context and purposes of the processing.
The assessment must include, at a minimum, a general description of the processing operations to be carried out, an assessment of the risks to the rights and freedoms of data subjects, the measures envisaged to address those risks, safeguards, security measures and mechanisms capable of ensuring the protection of personal data and providing evidence of compliance with the provisions of this Act, having regard to the rights and legitimate interests of the data subjects and other persons.
