How is personal data collected

The law No. 18-07 applies to any public or private entity likely to receive, store and process personal data. As soon as an entity receives data, whether in digital form or not, it must comply with law No. 18-07.

Personal data is, notably, collected through direct input, cookies, social media, mobile apps, surveys, public records, purchase transactions, and by employers or institutions.

How is personal data processed

Personal data processing may only be processed with the express consent of the data subject (or consent of the legal representatives of a child, failing which by authorisation of the competent judge).

The data subject may withdraw his / her consent at any time. 

Personal data may only be communicated to a third party for purposes directly related to the functions of the data controller and the recipient. Such communication is subject to the prior consent of the data subject.

However, in some cases, consent is not required if the processing is necessary:

• to comply with a legal obligation to which the data subject or the data controller is obliged;
• to protect the data subject's life; 
• for the performance of a contract to which the data subject is a party or to the performance of pre-contractual measures taken at their request;
• to safeguard the vital interests of the person concerned, if they are physically or legally unable to give their consent;
• for the performance of a task carried out in the public interest. Or in the exercise of official authority vested in the data controller or the third party to whom the data is communicated; or
• for the accomplishment of a legitimate interest pursued by the data controller or the recipient, within the interest and/or fundamental rights and freedoms of the data subject.

Specific rights and protections

The person concerned by the collection of their data has a right to information, a right of access, a right of rectification and a right to object to their data being collected.

According to Article 9 of the law No. 18-07 (free translation): 

“Personal data must be:

1. processed lawfully and fairly;
2. collected for specified, explicit and legitimate purposes legitimate purposes and may not be further processed in a way that is incompatible with those purposes;
3. adequate, relevant and not excessive in relation to the purposes for which they are collected or processed;
4. accurate, complete and, where necessary, kept up to date;
5. kept in a form which permits identification of the data subjects for no longer than is the purposes for which they were collected or processed.”