Setting up of the National Authority for the Protection of Personal Data (ANPDP)

PRESENTATION OF THE ANPDP

The ANPDP established under the President of the Republic is an independent administrative authority responsible for ensuring compliance with the provisions of Law no. 18-07 of 10 June 2018 on the protection of individuals in the processing of personal data (the “Law 18-07“).

Its members and Chairman were appointed by Presidential Decree no. 22-187 of 18 May 2022 for a term of 5 years and officially appointed on 11 August 2022¹.

FORTHCOMING EXPIRY OF THE COMPLIANCE DEADLINE

It is important to note that Law 18-07 provides for a compliance period of one year for operators as from the appointment of the ANPDP, which period therefore expires on 11 August 2023.

During the compliance period expiring on 11 August 2023, the ANPDP’s goal, in particular via its website, is to raise awareness and inform data subjects and data controllers of their rights and obligations.

ENFORCEMENT OF LAW 18-07

Law 18-07 applies to all operators, i.e. public entities and individuals (i) when they carry out an activity on Algerian territory or (ii) when they use automated means to process personal data without being established on Algerian territory.

Law 18-07 introduces a declaratory system, i.e. any operator processing personal data must first inform the ANPDP. Where the data controller processes personal data that is likely to present an obvious risk to the protection of the privacy and fundamental rights and freedoms of the persons concerned, the prior authorization system will apply (particularly for transfers of personal data outside Algerian territory).

Data controllers who fail to comply with the provisions of Law 18-07 are liable to a penalty of up to 5 years’ imprisonment and a fine of 500,000 Algerian dinars.

To date, it is not possible to comply with all the provisions of Law 18-07, such as filing personal data processing declarations or obtaining authorizations for the transfer of personal data abroad, as the required forms are not available.

PREPARATORY WORK CARRIED OUT BY THE ANPDP

In order to ensure that the provisions of Law 18-07 are fully enforceable by operators from August 2023, the ANPDP has begun the following preparatory work, in particular:

• setting up a national personal data protection register, which will be available from August 2023 and which will list in particular the files for which the public authorities are responsible for processing, the files for which processing is carried out by individuals, the declarations made to the ANPDP and the authorizations it issues.
• all forms will be drawn up and published online from August 2023 on its website, in particular forms for declaring processing operations, requesting authorization to carry out new processing operations, requesting authorization to transfer data abroad and for sensitive data.
• a census of personal data processing and identification of data controllers carried out by the ANPDP.

ONLINE ACTIONS TO BE CARRIED OUT BY OPERATORS ON THE ANPDP WEBSITE

Operators processing personal data are invited by the ANPDP to carry out the following actions online on the ANPDP website:

• register on the ANPDP portal and create a personal space (https://espace-rt.anpdp.dz/).
• appoint an authorized representative with an appropriate profile, in particular to map data processing, monitor data processing and make users aware of the regulations relating to personal data.

This representative is the main contact for the ANPDP, who must be independent and have direct access to the head of the entity to report any breaches of the provisions of Law 18-07 (https://anpdp.dz/fr/recommandations/).

• take part in the census of personal data processing by declaring the processing using a form available online after creating a personal space on the ANPDP website (https://espace-rt.anpdp.dz/guide_recensement.pdf).

For any questions you may have regarding Law 18-07, please do not hesitate to contact us.