Key developments in FDI screening practices in 35 jurisdictions. The Digital Code Law entered into force on the date of its approval 13 March Personal data is defined in Article of the Digital Code Law and listed in eight different categories:. There is no separate definition of sensitive data, but the Digital Code prohibits, as a matter of principle, the processing of certain data which can be considered as sensitive, such as personal data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, the status of refugees or stateless persons, trade union membership, sex life or, more generally, data relating to the state of health.
There are several exceptions to this principle stated in the Digital Code. The processing of such data will be admissible should, for instance, one consents to such processing for a well determined purpose.
The processing of such data for statistical analysis or health reasons will usually, and within the boundaries of the Law, be equally accepted. According to Article of the Digital Code provides that a decree from the Prime Minister will have to establish the APD and determine its organization, its functioning and regulatory powers.
To date, no such decree has been adopted. This is considered as being illegal by many law scholars and practitioners but has not been challenged yet. The declaration regime is applicable to all actors processing data and such declaration is to be performed by the person or entity responsible for the processing of personal data. The authorisation regime is applicable for the processing of certain more sensitive data, such as the processing of national identification numbers, genetic data, data regarding criminal records, etc.
Considering that the APD has not yet been established, the declaration and authorisation regimes are not yet in practice complied with. The Digital Code only provides for some of its duties, namely:.
