{"id":5343,"date":"2022-03-31T18:34:09","date_gmt":"2022-03-31T16:34:09","guid":{"rendered":"https:\/\/www.augelegalfiscal.com\/obligations-lawyers-personal-data-protection-law\/"},"modified":"2022-03-31T18:37:51","modified_gmt":"2022-03-31T16:37:51","slug":"obligations-lawyers-personal-data-protection-law","status":"publish","type":"post","link":"https:\/\/www.augelegalfiscal.com\/en\/obligations-lawyers-personal-data-protection-law\/","title":{"rendered":"Obligations of lawyers before the Personal Data Protection Law"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"5343\" class=\"elementor elementor-5343 elementor-5329\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-84ef0d8 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"84ef0d8\" data-element_type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-3575bfef\" data-id=\"3575bfef\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-77cb9e55 elementor-widget elementor-widget-heading\" data-id=\"77cb9e55\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_79_2 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #8f2b2f;color:#8f2b2f\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #8f2b2f;color:#8f2b2f\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 eztoc-toggle-hide-by-default' ><li class='ez-toc-page-1 ez-toc-heading-level-1'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.augelegalfiscal.com\/en\/obligations-lawyers-personal-data-protection-law\/#Obligations_of_lawyers_before_the_Personal_Data_Protection_Law\" >Obligations of lawyers before the Personal Data Protection Law<\/a><\/li><\/ul><\/nav><\/div>\n<h1 class=\"elementor-heading-title elementor-size-default\"><span class=\"ez-toc-section\" id=\"Obligations_of_lawyers_before_the_Personal_Data_Protection_Law\"><\/span>Obligations of lawyers before the Personal Data Protection Law<span class=\"ez-toc-section-end\"><\/span><\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-58eb10cb elementor-widget elementor-widget-text-editor\" data-id=\"58eb10cb\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Eighteen years after the General Council approved the first qualified law on the protection of personal data, on November 17, 2021, the new Law 29\/2021 of October 28 on the protection of personal data (hereinafter referred to as *LPD) was published and will enter into force in May 2022.<\/p>\n<p>The purpose of this Law is to update the Andorran regulations regarding the processing that both private persons or entities and the public administration carry out of data corresponding to natural persons, in the light of the new European regulation, especially Regulation (EU) 2016\/679 of the European Parliament and of the Council. The new Law introduces important novelties with respect to the previous legislation, which is why the present article seeks to specify the data protection obligations that arise for the legal profession.<\/p>\n<p>In this sense, lawyers (or the organization to which they belong), must apply a set of technical, organizational and legal measures that will allow the organization to ensure the confidentiality, integrity and availability of the information.<\/p>\n<p>First of all, it is worth mentioning the specific duty established by the new *LPD to ensure the express consent of customers when processing their personal data. For these purposes, consent shall be understood as the manifestation of free, specific, informed and unequivocal will by which the interested party accepts (art. 4.2 *LPD), excluding tacit consent.<\/p>\n<p>Otherwise, the *LPD adds by the interested ones, to the margin of the traditional rights *ARSO (access, rectification, suppression, and opposition), other nuts, which will have to be guaranteed by the lawyers in the treatment of personal data. First, the right of limitation, which implies that those affected may request the limitation in the processing of their personal data (art. 22 *LPD). On the other hand, the right to portability, which entails the right to transmit the data to another data controller or to the same data subject, through a structured format of habitual use and mechanical reading, when the processing is carried out by automated means (art. 23 *LPD). Likewise, the right of the data subjects not to be subject to automated individual decisions and profiling is also provided for (art. 25 *LPD).<\/p>\n<p>Even so, the new law requires lawyers to carry out a risk analysis, i.e., they will have to assess the possible contingencies of such data processing. Consequently, in the event that the risk is particularly high, they will have to carry out an impact assessment in order to minimize the possibilities of affecting the rights or freedoms of data subjects and will have to implement appropriate security measures (art. 32 *LPD).<\/p>\n<p>It is also necessary to consider the requirement to keep a register of processing activities, which will only be required when the organization meets the following requirements: it has more than 50 employees; the processing may entail a risk to the rights and freedoms of the persons concerned; it is not occasional; or it includes special categories of personal data (art. 34 *LPD).<\/p>\n<p>On the other hand, when data is transferred to third parties, a duty of care is required in the selection of the data processor. Specifically, a processor must be chosen that offers sufficient guarantees to implement appropriate technical and organizational measures, so that the processing guarantees the protection of the rights of the data subjects, and the processor may only process this data on the instructions of the data controller, unless it is obliged to do so by a legal requirement (art. 31 *LPD).<\/p>\n<p>Furthermore, when the lawyer is part of an organization, the employees of the organization will have to sign a confidentiality agreement to prevent the personal data being processed from reaching unauthorized persons. Likewise, it must be ensured that the employees comply with the established security measures.<\/p>\n<p>In the event of a breach of security of personal data, such as a *cyberattack, this will have to be notified to the Andorran Data Protection Agency (*APDA) within 72 hours (art. 36.1 *LPD), and if applicable, to the data subjects concerned (art. 37.1 *LPD).<\/p>\n<p>Finally, it should be added that the new Law has introduced the figure of the Data Protection Officer (*DPD), who is the person in charge of instructing the data controller on the legal obligations to be observed in the field of data protection. In the case of law firms, given that, as a general rule, they process personal data on a large scale, they would be considered as subjects obliged to appoint a *DPD.<\/p>\n<p>By way of conclusion, the legal profession, as a profession that provides a service to society in the public interest through the advice and defence of rights and public and private interests, are determined as subjects bound by the *LPD, which seeks to ensure an adequate level of protection of personal data of individuals, as a fundamental right guaranteed by Article 14 of the Constitution of the Principality of Andorra.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4b8c8c37 elementor-widget elementor-widget-text-editor\" data-id=\"4b8c8c37\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>Cl\u00e0udia Alonso<\/b><\/p>\n<p><span style=\"color: #a22d58;\">Aug\u00e9 Legal &amp; Fiscal<\/span><\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-63fe5a83 elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"63fe5a83\" data-element_type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Eighteen years after the General Council approved the first qualified law on the protection of personal data, on November 17, 2021, the new Law 29\/2021 of October 28 on the protection of personal data (hereinafter referred to as *LPD) was published and will enter into force in May 2022. The purpose of this Law is [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":5332,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[11],"tags":[],"class_list":["post-5343","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-auge"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.augelegalfiscal.com\/en\/wp-json\/wp\/v2\/posts\/5343","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.augelegalfiscal.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.augelegalfiscal.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.augelegalfiscal.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.augelegalfiscal.com\/en\/wp-json\/wp\/v2\/comments?post=5343"}],"version-history":[{"count":3,"href":"https:\/\/www.augelegalfiscal.com\/en\/wp-json\/wp\/v2\/posts\/5343\/revisions"}],"predecessor-version":[{"id":5348,"href":"https:\/\/www.augelegalfiscal.com\/en\/wp-json\/wp\/v2\/posts\/5343\/revisions\/5348"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.augelegalfiscal.com\/en\/wp-json\/wp\/v2\/media\/5332"}],"wp:attachment":[{"href":"https:\/\/www.augelegalfiscal.com\/en\/wp-json\/wp\/v2\/media?parent=5343"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.augelegalfiscal.com\/en\/wp-json\/wp\/v2\/categories?post=5343"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.augelegalfiscal.com\/en\/wp-json\/wp\/v2\/tags?post=5343"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}