1. The supervisory of personal data protection is an independent administrative
authority, CNPD, which operates within the National Assembly.
2. The CNPD is regulated by the Law.
Section II
Notification
Article 23
(Obligation to notify the CNPD)
1. The controller or his representative, if any, must notify the CNPD before
carrying out any whole or partial automatic processing operation or set of
operations intended to serve a single purpose or several purpose or several
related purposes.
2. The CNPD may authorise the simplification of or exemption from notification
for particular categories of processing which are unlikely, taking account of the
data to be processed, to affect adversely the rights and freedoms of the data
subjects and in to take account of criteria of speed, economy and efficiency.
3. The authorisation, which must specify the purposes of the processing, the data or
categories of data to be processed, the category or categories of recipients to
whom the data may be disclosed and the length of time the data are to be stored.
4. Processing whose sole purpose is the keeping of a register which according to
law or regulations is intended to provide information to the public and which is
open to consultation by the public in general or by nay person demonstrating a
legitimate interest shall be exempted from notification.
5. The non-authorised processing of the personal data provided for in paragraph 1
of Article 8 shall be subject to notification when they are processed under
Article 3 a).
Article 24
(Prior checking)
1. Except authorised by legal ruling, authorisation of the CNPD is required for:
a) the processing of personal data referred to in subsections a) and e) of
paragraph 1 of Article 8 and paragraphs 2 and 3 of Article 9;
b) the processing of personal data relating to credit and the solvency of the data
subjects;
c) the combination of personal data as provided for in Article 9;
d) the use of personal data for purposes not giving rise to their collection.
2. The legal ruling which authorises the processing of data referred to in the
previous number requires the opinion of the CNPD.
Article 25
(Content of applications for opinions or authorisation and notification)
Applications for opinions or authorisations as well as notifications submitted to the
CNPD shall include the following information: