The law qualifies as personal data, “any information of any kind whatsoever and regardless of its medium, including sound and image, relating to an identified or identifiable natural person directly or indirectly, by reference to an identification number or to one or more specific elements, specific to his physical, physiological, genetic, psychic, cultural, social or economic identity”.
Personal data is therefore data that makes it possible to identify an individual or data relating to an already identified person.
Example: Last name; first name; phone number; CNI number; voice, image; biometric data etc.

The purpose of a treatment is the objective pursued by the person in charge of the treatment. The data subject must know what his data will be used for. The purpose must be determined, legitimate and explicit during the collection.
The data controller must, before implementing a treatment, ask himself about the categories of data to be collected in order to be able to achieve the purposes he has set for himself.
The collection of data must not go beyond what is necessary with regard to the purpose(s) pursued.

Yes. It is possible for an organization, within a single declaration, to group together a set of treatments having identical or related purposes. For example, this may be the case of different treatments related to personnel management such as recruitment, payroll or training.

The conditions for implementing a treatment are :
– the legitimacy of the treatment;
– the loyalty and lawfulness of the treatment;
– the specific determination of the purpose of the treatment and the conditions for the reuse of the data ;
– respect for the principle of proportionality in the collection and processing of data, these must be relevant, adequate and not excessive with regard to the purposes of the collection and processing ;
– the accuracy and updating of the data which must also be complete ;
– the storage period, in a form allowing the identification of the persons concerned, proportionate to the purpose ;
– confidentiality and protection of the data processed.

The fair and lawful processing of data presupposes that the data subjects can be aware of the existence of the treatments and benefit from effective and complete information with regard to the circumstances of this treatment.

Article 21 of the personal data protection act lays down the principle of prohibiting the collection or processing of sensitive data.
This article nevertheless provides for several exceptions in the following cases, subject to the prior submission of the treatment to an authorization issued by the ARTCI :
– the processing of personal data relating to data manifestly made public by the data subject;
– the processing of genetic data or data relating to the state of health when they are necessary to safeguard the vital interests of the data subject or of another person in the event that the data subject is physically or legally unable to give his consent;
– the processing, in particular of genetic data, when they are necessary for the challenge, exercise or defense of a right in court of the person concerned;
– the processing of personal data when a judicial or criminal procedure is opened but only when the purpose of the processing of personal data is to establish the facts or to reveal the truth;
– the processing carried out within the framework of the legitimate activities of a foundation, an association or any other non-profit organization and for political, philosophical, religious, mutual or trade union purposes. However, the processing must relate only to the members of this organization or to the persons maintaining regular contacts with it, related to its purpose. Furthermore, the data must not be communicated to third parties without the consent of the data subjects.
It should therefore be considered that, unless the processing falls within one of these exceptions, any collection of sensitive data is strictly prohibited.

Yes. The data controller is obliged to take all necessary precautions, with regard to the nature of the data and the risks presented by the processing, to preserve the security of the data, and, in particular, to prevent them from being distorted, damaged, or that unauthorized third parties have access to them.

The data protection correspondent is an interlocutor specialized in the protection of personal data, both for the data controller and in the latter’s relations with the Protection Authority.
Its role consists in becoming the relay of the Protection Authority in the company. To this end, he has an advisory and monitoring role in the legality of the deployment of IT projects and can carry out audits and some mediation.

The correspondent ensures compliance with the obligations provided for by the personal data protection act for the processing for which he has been designated.
The duties of the protection correspondent consist of :
– keep the list of treatments performed up to date ;
– hold a copy of the codes and passwords for access to the files relating to the treatments carried out ;
– ensure access to these data to any data subject who requests it ;
– ensure compliance with current legislation ;
– report to the data controller, the detected violations of the legislation on the protection of personal data ;
– notify ARTCI of any violation of the legislation on the protection of personal data previously reported and uncorrected within three months of the report.

Any person who is the subject of personal data processing.

The law recognizes to the persons whose personal data are processed the following specific rights :
– the right to information ;
– the right of opposition ;
– the right of interrogation ;
– the right of access ;
– the right of rectification ;
– the right to be forgotten.

Everyone has the right to know whether or not personal data concerning them are being processed. The right to information about one’s own personal data applies to both the collection of data and their use.
The person from whom personal data concerning him are collected is informed, unless he has been informed beforehand, by the data controller, at the latest at the time of collection, regardless of the means and media used :
– the identity of the person responsible for the treatment and, if necessary, that of his duly authorized representative ;
– the purpose(s) specified for the processing for which the data are intended ;
– the categories of data concerned ;
– the recipient(s) to whom the data may be communicated ;
– the possibility of refusing to appear on the file in question ;
– the existence of a right of access to data concerning the person and a right to rectify these data ;
– the duration of data retention ;
– the possibility of any transfer of data to third countries.
The mandatory information provided by the data controller must be clearly provided.

The right of access is the right for a data subject to ask the controller whether or not personal data concerning him or her are being processed and, if so, to read this information and obtain communication.
The right of access is a discretionary right. The one who exercises it therefore does not have to justify any reason.

The storage period of personal data must not exceed what is necessary for the purpose of the processing. The personal data protection act therefore imposes a right to be forgotten.
Article 33 of the law thus provides that “the data subject has the right to obtain from the controller, the erasure of personal data concerning him or her and the cessation of the dissemination of these data, in particular with regard to personal data that the data subject had made available when he or she was a minor, or for one of the following reasons :
– the data are no longer necessary with regard to the purposes for which they were collected or processed ;
– the data subject has withdrawn the consent on which the processing is based or when the authorized storage period has expired and there is no other legal ground for the processing of the data ;
– the data subject objects to the processing of personal data concerning him/ her when there are no legal grounds for such processing ;
– the data processing does not comply with the provisions of the law ;
– for any other legitimate reason”.
The law provides for additional obligations towards data controllers in that they must, when they have made the data public, take all reasonable measures, including technical measures, with a view to informing third parties who process said data that a data subject has requested their erasure.
The erasure of the data must be done without delay by the data controller. To do this, the latter must put in place appropriate mechanisms ensuring compliance with the right to be digitally forgotten and to the erasure of personal data, unless the controller regularly examines the need to retain this data.
The ARTCI, in its mission as Authority for the protection of personal data, adopts measures and guidelines making it possible in particular to specify the conditions for the deletion of links to the data to be deleted, copies or reproductions of them existing on electronic communication services accessible to the public.
However, the law provides for exceptions to the application of the right to be forgotten when the storage of personal data is necessary :
– either to the exercise of the right to freedom of expression ;
– either for reasons of general interest in the field of public health, in accordance with the law ;
– or compliance with a legal obligation to store personal data provided for by current legislation to which the data controller is subject.

Any natural person, justifying his identity, may require the controller to correct, complete, update, lock or delete personal data concerning him, which are inaccurate, incomplete, equivocal, outdated, or whose collection, use, communication or storage is prohibited.

Any natural person has the right to object, for legitimate reasons, to personal data concerning him being processed. In addition, she has the right to object, free of charge, to the data concerning her being used by the data controller for prospecting purposes, in particular commercial. Likewise, the data subject may object to the communication or use of his personal data by a third party or on behalf of a third party. It must have been previously informed by the data controller of this communication or use by a third party before the first communication of the data to the latter. There are therefore 3 types of opposition: – opposition for legitimate reasons; – opposition to prospecting, without having to justify themselves; – opposition to the communication or use of your data to / by third parties.