Monaco Law on the Protection of Personal Information 

Under Monaco’s data privacy law, covered businesses have a series of obligations such as declaring the processing of personal data to the supervisory authority, the Commission de Contrôle des Informations Nominatives (CCIN), obtaining necessary authorizations, ensuring data accuracy, and maintaining data security. In addition to the text of the law, the CCIN has also issued guidelines to help covered entities understand their obligations under the law or the procedure for submitting a request with the CCIN.

Data controllers, natural persons or legal entities under private law that wish to conduct automated processing of personal data have to notify the chairman of the CCIN. The notification has to confirm that the data processing meets the requirements of the law and the Commission will issue a receipt which allows the automated processing of personal data but does not exempt the notifying entity of liability. 

In the case of public authorities or certain private bodies that want to use automated systems to process personal data, these must get approval from the CCIN, who reviews and issues an opinion following a notification submitted with them, which  is then published in the official Journal de Monaco, along with the Commission's opinion. 

When it comes to health research, any entity—public or private—must first seek the Commission’s opinion before processing personal data. Should the Commission disapprove, government approval becomes necessary to move forward. It's important to note that these rules do not apply to medical research as defined  by Law No. 1,265 of 23 December 2002., which follows a different set of regulations.

In either case, in order to submit a valid request, entities have to include the following:

• Who is submitting the request (their identity, the data controller's, and their representative if in Monaco).
• What the data processing involves (purpose, name, and justification).
• Who manages the data and how people can access it.
• Who has access to the data.
• What data is processed, where it comes from, how long it's kept, and who receives it.
• If data is linked or transferred to others.
• Security measures taken.
• If data is sent abroad.

All data processing activities are documented in a registry that records the dates and key details of each process. This registry is accessible to the public, and is updated every year before April 1st, although some sensitive information might be excluded to protect privacy.

In addition to this, Monaco Law No. 1.165 also establishes obligations for covered entities related to the way personal data is processed: 

• personal data has to be collected and handled fairly, with a clear and lawful purpose, and it should be kept accurate and up to date; 
• personal data should only be retained for as long as necessary to fulfill its intended purpose;
• data processing can only be conducted based on the consent of the individual, legal obligations, public interest, the execution of a contract, or a legitimate interest that does not infringe on the rights and freedoms of individuals; 
• sensitive data, such as information related to public security or criminal offenses, can only be processed by judicial or administrative authorities within their legal mandates. In exceptional cases, other entities may process such data with the Commission’s approval, provided it is essential for a legitimate purpose and respects the rights of those involved.
• processing personal data that reveals sensitive aspects like political opinions, religion, race, or health is strictly controlled and can only be processed with explicit consent from the individual or under specific legal justification;
• for the purpose of security and confidentiality in personal data processing, covered entities have to implement appropriate technical and organizational measures to protect it from unauthorized access, loss, or destruction; 
• if third-party services are used, these services must also adhere to the same stringent security standards and the same applies where subcontractors are used; this is only allowed if  they comply with the same security obligations as the primary service providers.