New Data Protection Law in Andorra
Data Protection Law in Andorra: What’s new and key changes in the regulation?
In Andorra, as in other countries, it is important to safeguard privacy. Data protection legislation in Andorra is in line with EU directives (LCPDP).
In fact, Andorra is a country whose regulatory framework is approved by the European Union, so when dealing with data protection in Andorra, it is treated as if it were a country of the European Union.
The legal framework establishes the basic principles of data processing, including consent and minimization of information and data privacy.
Who is obliged to comply with the new law?
Data protection in Andorra is very clear when it states that it must be implemented by all companies and even for-profit individuals that collect personal data.
This includes the manual processing of data on Andorran territory by Andorran companies based in and/or based in or outside the country.
This is provided for in the new data protection law in Andorra, Law 29 2021.
Obligation to appoint a DPO
Some companies are obliged to appoint a Data Protection Officer in Andorra (DPO).
The cases in which the data protection law in Andorra establishes the obligation are:
- Treatments of personal data that you make require a systematic and exhaustive evaluation of personal aspects based on automated processing.
- You carry out special data processing on a large scale.
- You process a considerable amount of personal data of national or supranational scope which may affect a large number of data subjects and which may entail a high risk to the rights and freedoms of the data subjects.
- Your main activity involves the processing of data of vulnerable subjects, at risk of social exclusion and/or minors under 14 years of age who deserve specific protection.
- You are on the list of the type of organizations likely to be obliged to appoint a DPD.
Appointment of a Data Protection Delegate (DPD)
The main change resulting from the new data protection law in Andorra, law 29 2021, will be the creation of the Data Protection Delegate.
The figure of the data protection delegate, according to the Andorran protection agency of the Principat d’Andorra, can work in the staff of the organization or fulfill functions under service contracts.
This is required in all private entities. Within private entities it reflects the size of the company and is mandatory if sensitive data is processed at a high volume.
It has an important role in providing information on legal obligations and in monitoring their compliance with those obligations.
The appointment of the DPD must be reported to the Andorran Personal Data Protection Agency (APDA), through its web form.
Obligation to notify security breaches
Andorra’s new qualified personal data protection law establishes that the data controller must notify the security breach, i.e. the security violation (depending on the magnitude of the violation and the security measures in place), to the Andorran Data Protection Agency within 48 hours.
These 48 hours are calendar hours, i.e. weekends and holidays also count. So data controllers will have to be very agile on this point.
The new rights of natural persons
A new amendment to the 2003 law includes the right to be forgotten, the limitation of processing or the transferability of the information of individuals who request it.
Each of these is intended to ensure the highest level of protection for the processing of personal information.
It imposes an obligation on the person contacted to determine which methods are used to exercise his or her right.
It is completely free of charge. As long as it does not involve companies in concrete harm.
It is very important that companies in Andorra are very clear about the application of this matter, the application of the obligations of those responsible for the processing of personal data.
An infringement of measures, compliance or customer rights may result in significant penalties. We are talking about minor penalties of between 150 and 60,000 euros.
It is important to take into account that the law has been made in the image and likeness of the Spanish law and the RGPD, so the sanctions are similar to those of the countries of the European Union. Therefore, the regulation has not taken into account the Andorran dimension.
Obligation to carry out an impact assessment
The impact assessment on the processing of personal data is a decision taken by some companies to comply with the requirement of a proactive attitude in relation to the regulations and the qualified law on the protection of personal data.
It is not necessary for all companies, but the regulations do state that it is highly recommended, as it is carried out with the aim of enabling the responsible to determine whether it is necessary to appoint a DPD in the company and whether all the rights of the clients are complied with according to the regulations in force.
We can help you in this process by making a file with the adaptation to the Andorran data protection system as well as with the fulfillment of the rights of the clients in the matter of data protection in force.
The obligation to register personal data files with the APDA is eliminated.
The law eliminates the registrations in the public registers of APDA. The law states that controllers must report processing activities within a company with 50,000 workers or within government offices.
In October 2021 legislation 29/2021 was passed by the Parliament of Andorra as data protection legislation.
Contact us
If you are interested in this article, this is your place of reference. We have in our team a person who can advise you on data protection law, as well as a team specialized in EU legislation and GDPR.
We can help you to adapt your website and your company’s legal documents to the data protection law and the GDPR.
So if you are interested in this article and the news in this area, you can write us an email or write us by whats app.
You can also subscribe to our newsletter to receive more articles like this and be up to date with our newsletter of any article related to Andorra and the European Parliament.