Key developments in FDI screening practices in 35 jurisdictions. The Digital Code Law entered into force on the date of its approval 13 March Personal data is defined in Article of the Digital Code Law and listed in eight different categories:. There is no separate definition of sensitive data, but the Digital Code prohibits, as a matter of principle, the processing of certain data which can be considered as sensitive, such as personal data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, the status of refugees or stateless persons, trade union membership, sex life or, more generally, data relating to the state of health.
There are several exceptions to this principle stated in the Digital Code. The processing of such data will be admissible should, for instance, one consents to such processing for a well determined purpose. The processing of such data for statistical analysis or health reasons will usually, and within the boundaries of the Law, be equally accepted. According to Article of the Digital Code provides that a decree from the Prime Minister will have to establish the APD and determine its organization, its functioning and regulatory powers.
To date, no such decree has been adopted. This is considered as being illegal by many law scholars and practitioners but has not been challenged yet. The declaration regime is applicable to all actors processing data and such declaration is to be performed by the person or entity responsible for the processing of personal data. The authorisation regime is applicable for the processing of certain more sensitive data, such as the processing of national identification numbers, genetic data, data regarding criminal records, etc.
Considering that the APD has not yet been established, the declaration and authorisation regimes are not yet in practice complied with. The Digital Code only provides for some of its duties, namely:. As a matter of principle, the collection and processing of personal data whether sensitive or not is prohibited. It can be carried out with the prior and explicit consent of the person concerned or on the request of the public prosecutor's office, provided that the consent of the person concerned can always be proven.
The transfer of personal data refers to the transfer of data to another country or a data service provider whose servers are located in another country. Such transfer is legal and accepted provided that the third country or international organization where the date will be effectively kept provides a level of security and protection equal or better as the level of security and protection provided by the Digital Code. The APD shall inform the person lodging the complaint of the progress and outcome of the complaint, including the possibility of judicial remedy.
