Prior to implementing any electronic marketing activity the CCIN must be notified, as electronic marketing activities may use personal data. The DPL does not prohibit the use of personal data for the purpose of electronic marketing per se. However, when implementing electronic marketing activities a company must respect the provisions of Articles 1, 10-1, 10-2 and 14 of the DPL.

The automated or non-automated processing of personal data must not infringe the fundamental rights and freedoms enshrined in Title III of the Constitution.

When marketing, personal data must be:

• Collected and processed fairly and lawfully;
• Collected for specified, explicit and legitimate purposes and not be further processed in a way incompatible with those purposes;
• Adequate, relevant and not excessive in relation to the purposes for which it is collected and / or further processed;
• Accurate and, if necessary, updated; every reasonable step must be taken to ensure that data which is inaccurate or incomplete, having regard to the purposes for which it was collected or for which it is further processed, is erased or rectified;
• Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data was collected or for which it is further processed.

Processing of personal data must be justified by one of the following bases:

• By consent from the data subject(s);
• By compliance with a legal obligation to which the data controller or their representative is subject;
• By it being in the public interest;
• By the performance of a contract or pre-contractual measures with the data subject;
• By the fulfillment of a legitimate motive on the part of the data controller or their representative or by the recipient, on condition that the interests or fundamental rights and freedoms of the data subject are not infringed.

Data subjects from whom personal data is collected must be informed of all of the following:

• The data controller’s identity and, if applicable, the identity of their representative in Monaco;
• The purpose of processing;
• The obligatory or optional nature of replies;
• The consequences for data subjects of failure to reply;
• The identity of recipients or categories of recipients;
• Their right to oppose, access and rectify their data;
• Their right to oppose disclosure to and use of personal data by a third party, or the disclosure for the purposes of the third party’s commercial use, including marketing.