LAW 1 March 1983, n.27 (published March 9, 1983) Discipline collection, processing and use of personal data in the computer sector. We the Captains Regent of the Most Serene Republic of San Marino Promulgate and publish the following law approved by the Great and General Council at its meeting on 1 March 1983. CHAPTER I GENERAL PRINCIPLES Art. 1 (Scope) Each application in the field which impl those setting up or use in the territory of San Marino magnetic files or automated data containing names or in any way relate to precisely defined legal entities, by the State, public bodies or natural or legal persons, it is subject to presc inherently free of this Act. Art. 2 (Purpose) Computer applications in art. 1 have the primary function of a service for the benefit of all citizens. Consequently, they must not in any way undermine respect for human rights and individual freedoms and fundamental public, nor an attempt on the dignity and identity of the human person, whose private life is inviolable. Art. 3 (Definitions) For the purposes of this Law the terms indicated below have the following meanings: a) the names or personal data: any information relating to natural or legal persons identified or otherwise clearly identifiable; b) databases or magnetic files: all collections of information recorded on the appropriate computer media; c) third party: any person other than the owner or operator of the database. Art. 4 (Guarantees) Natural or legal persons shall be protected against the abuse of personal data when such data: a) is collected as part of applications and programs; b) are recorded on appropriate supports; c) are subject to the preparation and treatment izzato automaton; d) they are subject, individually or globally, or synthetically, sorting, evaluation or transfer to private or public entities. Except as expressly required by law no judicial or administrative measure involving an appreciation on the individual behavior of citizens it may be based on data computer processing from which can emerge a profile of the personality of the party. Any natural or legal person has the right to know and to challenge, for any adjustment, the data and information collected, processed and used in computer applications, the results of which are affixed to or relate personally. Any entity or person who carries out the collection, processing or use of personal data given must not only respect the secrecy pr fessional, to take every necessary precaution in order to preserve the security and confidentiality of information, in particular, to avoid that the same can be deformed, altered or disclosed to unauthorized persons. The transfer of data outside the territory regarding natural or legal persons San Marino is subject to the Commission's prior and motivated authorization under Article. 15. CHAPTER II ESTABLISHMENT AND UTILIZATION OF BANKS OF DATA Art. 5 (State Data banks and public bodies) The collection, processing and automated use of personal data by the State and public bodies are only allowed in Upon creation, with specific Reggenziale Decree, by state database in San Marino. The Decree referred to above, which also specify the manner of management of the various magnetic or automated files used by the center, will be issued within 90 days of entry into force of this Act, after obtaining the opinion of the Commission under Article. 15. Art. 6 (private databases) The collection, processing and use of automated nominative data with its purpose, by private natural or legal persons shall be subject to prior authorization of the State Congress and Commission for Information Technology in art. 15, who they decide on such issues with motivated resolutions. The relevant procedural rules the application and issuing of individual authorizations will be defined by Decree Reggenziale in art. 5, which will also regulate the establishment, at the Secretariat of State for Internal Affairs, a special national register of authorized databases. The management of databases for administrative accounting purposes interiors by natural or legal persons San Marino is allowed through a simple act of surrender by the Commission for Information Technology in art. 15. A similar procedure is applied for political, social and
cultural wishing to collect, process or use personal data to its members and relevant to their specific purpose with the help of automated databases or archives do not avoid a review of the same members, whose data can not however be brought to the attention of third parties . CHAPTER III REGULATION OF DATA COLLECTION Art. 7 (Prohibitions) The collection of data carried out with use of fraudulent means, unlawful or unfair is prohibited. And 'also it is forbidden to collect, process or use of you, unless expressly permitted by the individuals concerned or by the statutes of individual entities or associations, relating to activities or political opinions, trade union or religious. And the collection, processing, the use of personal data pertaining to the intimate sphere of private life 'in any case prohibited. Art. 8 (Prescriptions) any person be asked to collect datipersonali for computer applications should be made aware: a) of the purpose of collection of dat; b) the compulsory or optional nature of the answers; c) the consequences, against it, the possible failure to reply; d) the destination of the collected information, which can be public, private or extending to clearly identified third parties; e) the existence of the right, guaranteed by law, access and rectification of the data collected. If collection of data took place with the help of questionnaires, the latter shall state expressly the above requirements. These requirements do not apply to the collection of data and information carried out within the assessment of criminal or administrative offenses. Art. 9 (Banks of confidential data) are reserved to the State and the competent public bodies which hold the sole ownership, within the laws and regulations in force and according to the regulations laid down by Reggenziale Decree referred to in Article 5, the collection and processing of data intended: a) to the estate and all 'update of personal and electoral files of the entire population and of all San Marino citizens living abroad; b) the keeping and updating of criminal records; c) the keeping and updating of the files attinen the health registers and tax from the population. CHAPTER IV RIGHT OF ACCESS AND CORRECTION Art. 10 (Access to the national repertoire) Any person may, on the basis of a request for legal crta signed and addressed to the Secretariat of State for Internal Affairs, to determine whether the databases listed in the register in art. 6 or those run by the state and public bodies have collected or processed nominative data that concern him personally. Art. 11 (Database access) Anyone may obtain copies of data and information concerning him personally to the following conditions: a) that the application, on stamped paper, both signed by the same proprietor or his legal representative and is in any case accompanied by extremes of a personal identification document valid; b) that the collected information would not be protected by law since absolute secrecy. The right of access to health-related information may be exercised only for the textures, and a medical official or an agreement with the Institute for Social Security, whose name must be indicated in the application; It is on the faculty of the medical patient to communicate all or only part of the information. The access to the electoral roll is allowed in c ndizioni of full equality in all political parties under the control of the Electoral Commission, which may delegate it to the Chief Electoral Office. Art. 12 (Right of reply) The holder of the right of access has the power to make sure to request, through the application of legal paper addressed to the Secretariat of State for Internal Affairs, which it corrected, supplemented, clarified, updated or deleted data and information concerning him personally, and that is inaccurate, incomplete, ambiguous, outdated or whose collection, processing, transmission or storage are prohibited. On the same question, the person concerned may request the release of a transcript of the corrected data, which is in this case transmitted free. If the wrong information had been brought to the knowledge of third parties, amendment or cancellation shall also be notified to the latter. Art. 13 (Additional checks) Whoever, in the exercise of the right of access, serious reasons to doubt that the data carried on knowledge are not consistent with those collected and processed, can transmit a written report, on legal paper, the Commission computer science in art. 15. The Commission, which is
required to provide an answer within 60 days of receiving the request, review may, if deemed necessary, appropriate administrative inquiries or request the intervention of the Judiciary. Art. 14 (office Grinding) A file name must be corrected, amended or supplemented at the office when the body or the person who runs it is aware of the incorrectness or incompleteness of the harvested or processed data. Notice of the correction, integration or update of personal data must be given free of charge to those directly affected. CHAPTER V COMMITTEE ON INFORMATION TECHNOLOGY Art. 15 (Functions) The Commission for Information Technology, appointed by the Great and General Council for the duration of a legislature, has the task of monitoring the proper application of this law and in particular of: ) to issue binding opinion on requests for authorization of private databases; b) ensure that the public and private databases will scrupulously adhere to compliance with the law; c) investigate complaints from any person or entity on the application of this Act; d) to make mandatory opinion about decrees and regulations to be issued pursuant to this Law; e) report to the judicial authorities all offenses detected; f) granting access to databases of information from authorities, offices and persons who are not holders of the right of access. Art. 16 (Composition) The Commission for Information Technology is made: a) by the State Secretary for Finance, Budget and Planning who is the Chairman; b) by the Home Secretary who is the Vice President; c) five members elected by the Great and General Council from among its members in proportion to the Council Groups. The meetings of the Commission for Information prtecipa addition, an advisory vote, the Legal Office Manager, which acts as Segretaio with the task of also cure the preparation of minutes of the meetings. Always with merely advisory powers, can be invited to the Commission sessions those officials, technicians or experts whose contribution is deemed useful for the examination and investigation of matters to be discussed. Art. 17 (procedural rules) The Commission for Information Technology is convened by the President whenever he deems it necessary or when at least three members so require and at least once every six months. The summons shall be transmitted to all members of the Commission by registered letter to be sent at least 10 days in advance of the date of the session. The sessions are valid only if at least half of the members, including the President or the Vice President. The Commission's deliberations are taken by majority vote of those present. In case of equality of votes, that of the Chairman or his deputy. Against the Commission's decisions are open to appeal to the Council of Twelve. CHAPTER VI PENALTIES Art. 18 (offenses and penalties) Anyone who creates, manages or uses a database without the required prior authorization under Article. 6 first paragraph shall be punished with a fine by days. Whoever, during collection or processing of personal data, it does or allows a distorted use relation to the purposes provided by law or by decree in art. 5 or resulting by the Article 6 first paragraph, shall be punished by imprisonment or a daily fine. Employers who use fraudulent means to acceder to confidential information to the holders of the right of access shall be punished with imprisonment or with third-degree daily fine. Anyone who has collected or made collect, registered or recorded, stored and made to keep personal data in violation of the provisions laid down in art. 7-8-9 is punished with a fine by giorn. The facts of the preceding paragraphs shall be punished by imprisonment of First Instance or with the daily fine third degree if they have been committed to procure for himself or others an advantage, or to bring harm to others. Anyone who obstructs or hinders without justification the right of access or correction of Articles 10-11-12- 13 shall be punished with imprisonment or with a fine by days of first grade. In the cases of the preceding paragraphs the judge may also choose to apply the prohibition of I degree in cario operator carrying out the collection, processing or use of data. The foregoing is without prejudice to the more 'serious previst penalties for the same offenses in the Penal Code or other laws of the state. Art. 19 (Administrative penalties) In the event of conviction for one of the offenses listed in the preceding article, the State Congress can
suspend the authorization referred to in Article 6 first paragraph for a maximum of three months. In case of recurrence or continuation of the suspension referred to in the previous paragraph it must be immediately prepared by the State Congress. In case of further recurrence of State Congress it has undeniable for withdrawal. CHAPTER VII TRANSITIONAL AND FINAL PROVISIONS Art. 20 (amnesty) The owners, managers or users of databases already in existence on the date of entry into force of this law, are obliged to comply with its provisions within a maximum of one year. To do this, the request for authorization referred to in Article. 6 must be submitted within three months of the entry into force of the law. Art. 21 (Entry into force) This Law shall enter into force on the 5th day after its legal publication. Our Residence, this day of March 3 1983/1682 THE CAPTAINS REGENT Free Barulli - Maurizio Gobbi THE SECRETARY OF STATE FOR INTERNAL AFFAIRS Alvaro Selva