Todas las entradas de José Cuervo

01Abr/19

Copyright, Designs and Patents Act 1988. 1988 CHAPTER 48. Last amended: 27th September 2017

1 abril, 2019LeyCopyright, Designs and Patents Act 1988. 1988 CHAPTER 48. Last amended: 27th September 2017José Cuervo

An Act to restate the law of copyright, with amendments; to make fresh provision as to the rights of performers and others in performances; to confer a design right in original designs; to amend the Registered Designs Act 1949; to make provision with respect to patent agents and trade mark agents; to confer patents and designs jurisdiction on certain county courts; to amend the law of patents; to make provision with respect to devices designed to circumvent copy-protection of works in electronic form; to make fresh provision penalising the fraudulent reception of transmissions; to make the fraudulent application or use of a trade mark an offence; to make provision for the benefit of the Hospital for Sick Children, Great Ormond Street, London; to enable financial assistance to be given to certain international bodies; and for connected purposes.

[15th November 1988]

Be it enacted by the Queen’s most Excellent Majesty, by and with the advice and consent of the Lords Spiritual and Temporal, and Commons, in this present Parliament assembled, and by the authority of the same, as follows::

Part I.- Copyright

Chapter I.- Subsistence, ownership and duration of copyright

Introductory

1.- Copyright and copyright works.

(1) Copyright is a property right which subsists in accordance with this Part in the following descriptions of work:

(a) original literary, dramatic, musical or artistic works,

(b) sound recordings, films [F1or broadcasts], and

(2) In this Part “copyright work” means a work of any of those descriptions in which copyright subsists.

(3) Copyright does not subsist in a work unless the requirements of this Part with respect to qualification for copyright protection are met (see section 153 and the provisions referred to there).

2.- Rights subsisting in copyright works.

(1) The owner of the copyright in a work of any description has the exclusive right to do the acts specified in Chapter II as the acts restricted by the copyright in a work of that description.

(2) In relation to certain descriptions of copyright work the following rights conferred by Chapter IV (moral rights) subsist in favour of the author, director or commissioner of the work, whether or not he is the owner of the copyright:

(a) section 77 (right to be identified as author or director),

(b) section 80 (right to object to derogatory treatment of work), and

Descriptions of work and related provisions

3.- Literary, dramatic and musical works.

(1) In this Part:

“literary work” means any work, other than a dramatic or musical work, which is written, spoken or sung, and accordingly includes:

(a) a table or compilation [F2other than a database], F3. . .

(b) a computer program; F4. . .[F5(c) preparatory design material for a computer program][F6and

F6(d) a database]

“dramatic work” includes a work of dance or mime; and

“musical work” means a work consisting of music, exclusive of any words or action intended to be sung, spoken or performed with the music.

(2) Copyright does not subsist in a literary, dramatic or musical work unless and until it is recorded, in writing or otherwise; and references in this Part to the time at which such a work is made are to the time at which it is so recorded.

(3) It is immaterial for the purposes of subsection (2) whether the work is recorded by or with the permission of the author; and where it is not recorded by the author, nothing in that subsection affects the question whether copyright subsists in the record as distinct from the work recorded.

[F7

3A.- Databases

(1) In this Part “database” means a collection of independent works, data or other materials which:

(a) are arranged in a systematic or methodical way, and

(b) are individually accessible by electronic or other means.

(2) For the purposes of this Part a literary work consisting of a database is original if, and only if, by reason of the selection or arrangement of the contents of the database the database constitutes the author’s own intellectual creation.]

4.- Artistic works.

(1) In this Part “artistic work” means:

(a) a graphic work, photograph, sculpture or collage, irrespective of artistic quality,

(b) a work of architecture being a building or a model for a building, or

(2) In this Part:

“building” includes any fixed structure, and a part of a building or fixed structure;

“graphic work” includes:

(a) any painting, drawing, diagram, map, chart or plan, and

(b) any engraving, etching, lithograph, woodcut or similar work;

“photograph” means a recording of light or other radiation on any medium on which an image is produced or from which an image may by any means be produced, and which is not part of a film;

“sculpture” includes a cast or model made for purposes of sculpture.

[F8

5A.- Sound recordings.

(1) In this Part “sound recording” means:

(a) a recording of sounds, from which the sounds may be reproduced, or

(b) a recording of the whole or any part of a literary, dramatic or musical work, from which sounds reproducing the work or part may be produced,regardless of the medium on which the recording is made or the method by which the sounds are reproduced or produced.

(2) Copyright does not subsist in a sound recording which is, or to the extent that it is, a copy taken from a previous sound recording.][F9

5B.- Films.

(1) In this Part “film” means a recording on any medium from which a moving image may by any means be produced.

(2) The sound track accompanying a film shall be treated as part of the film for the purposes of this Part.

(3) Without prejudice to the generality of subsection (2), where that subsection applies:

(a) references in this Part to showing a film include playing the film sound track to accompany the film,

[F10

(b) references in this Part to playing a sound recording, or to communicating a sound recording to the public, do not include playing or communicating the film sound track to accompany the film,

(c) references in this Part to copying a work, so far as they apply to a sound recording, do not include copying the film sound track to accompany the film, and

(d) references in this Part to the issuing, rental or lending of copies of a work, so far as they apply to a sound recording, do not include the issuing, rental or lending of copies of the sound track to accompany the film.]

(4) Copyright does not subsist in a film which is, or to the extent that it is, a copy taken from a previous film.

(5) Nothing in this section affects any copyright subsisting in a film sound track as a sound recording.]

5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

6.- Broadcasts.

[F11

(1) In this Part a “ broadcast ” means an electronic transmission of visual images, sounds or other information which:

(a) is transmitted for simultaneous reception by members of the public and is capable of being lawfully received by them, or

(b) is transmitted at a time determined solely by the person making the transmission for presentation to members of the public,and which is not excepted by subsection (1A); and references to broadcasting shall be construed accordingly.

(1A) Excepted from the definition of “broadcast” is any internet transmission unless it is:

(a) a transmission taking place simultaneously on the internet and by other means,

(b) a concurrent transmission of a live event, or

(c) a transmission of recorded moving images or sounds forming part of a programme service offered by the person responsible for making the transmission, being a service in which programmes are transmitted at scheduled times determined by that person.]

(2) An encrypted transmission shall be regarded as capable of being lawfully received by members of the public only if decoding equipment has been made available to members of the public by or with the authority of the person making the transmission or the person providing the contents of the transmission.

(3) References in this Part to the person making a broadcast, [F12or a transmission which is a broadcast] are:

(a) to the person transmitting the programme, if he has responsibility to any extent for its contents, and

(b) to any person providing the programme who makes with the person transmitting it the arrangements necessary for its transmission;and references in this Part to a programme, in the context of broadcasting, are to any item included in a broadcast.

F13[

(4) For the purposes of this Part, the place from which a [F14wireless] broadcast is made is the place where, under the control and responsibility of the person making the broadcast, the programme-carrying signals are introduced into an uninterrupted chain of communication (including, in the case of a satellite transmission, the chain leading to the satellite and down towards the earth).]

F15[

(4A) Subsections (3) and (4) have effect subject to section 6A (safeguards in case of certain satellite broadcasts).]

(5) References in this Part to the reception of a broadcast include reception of a broadcast relayed by means of a telecommunications system.

[F16

(5A) The relaying of a broadcast by reception and immediate re-transmission shall be regarded for the purposes of this Part as a separate act of broadcasting from the making of the broadcast which is so re-transmitted.]

(6) Copyright does not subsist in a broadcast which infringes, or to the extent that it infringes, the copyright in another broadcast F17. . . .

[F18

(6A) Safeguards in case of certain satellite broadcasts.

(1) This section applies where the place from which a broadcast by way of satellite transmission is made is located in a country other than an EEA State and the law of that country fails to provide at least the following level of protection:

(a) exclusive rights in relation to [F19wireless] broadcasting equivalent to those conferred by section 20 ([F20infringement by communication to the public]) on the authors of literary, dramatic, musical and artistic works, films and broadcasts;

(b) a right in relation to live [F21wireless] broadcasting equivalent to that conferred on a performer by section 182(1)(b) (consent required for live broadcast of performance); and

(c) a right for authors of sound recordings and performers to share in a single equitable remuneration in respect of the [F21wireless] broadcasting of sound recordings.

(2) Where the place from which the programme-carrying signals are transmitted to the satellite (“the uplink station”) is located in an EEA State:

(a) that place shall be treated as the place from which the broadcast is made, and

(b) the person operating the uplink station shall be treated as the person making the broadcast.

(3) Where the uplink station is not located in an EEA State but a person who is established in an EEA State has commissioned the making of the broadcast:

(a) that person shall be treated as the person making the broadcast, and

(b) the place in which he has his principal establishment in the European Economic Area shall be treated as the place from which the broadcast is made.]

7.- Cable programmes.

F22. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

8.- Published editions.

(1) In this Part “published edition”, in the context of copyright in the typographical arrangement of a published edition, means a published edition of the whole or any part of one or more literary, dramatic or musical works.

(2) Copyright does not subsist in the typographical arrangement of a published edition if, or to the extent that, it reproduces the typographical arrangement of a previous edition.

Authorship and ownership of copyright

9.- Authorship of work.

(1) In this Part “author”, in relation to a work, means the person who creates it.

(2) That person shall be taken to be:

F23 [F23( aa ) in the case of a sound recording, the producer;

F23( ab ) in the case of a film, the producer and the principal director;]

(b) in the case of a broadcast, the person making the broadcast (see section 6(3)) or, in the case of a broadcast which relays another broadcast by reception and immediate re-transmission, the person making that other broadcast;

(d) in the case of the typographical arrangement of a published edition, the publisher.

(3) In the case of a literary, dramatic, musical or artistic work which is computer-generated, the author shall be taken to be the person by whom the arrangements necessary for the creation of the work are undertaken.

(4) For the purposes of this Part a work is of “unknown authorship” if the identity of the author is unknown or, in the case of a work of joint authorship, if the identity of none of the authors is known.

(5) For the purposes of this Part the identity of an author shall be regarded as unknown if it is not possible for a person to ascertain his identity by reasonable inquiry; but if his identity is once known it shall not subsequently be regarded as unknown.

10.- Works of joint authorship.

(1) In this Part a “work of joint authorship” means a work produced by the collaboration of two or more authors in which the contribution of each author is not distinct from that of the other author or authors.

F25 [(

1A ) A film shall be treated as a work of joint authorship unless the producer and the principal director are the same person.]

(2) A broadcast shall be treated as a work of joint authorship in any case where more than one person is to be taken as making the broadcast (see section 6(3)).

(3) References in this Part to the author of a work shall, except as otherwise provided, be construed in relation to a work of joint authorship as references to all the authors of the work.

[F26

10A.- Works of co-authorship

(1) In this Part a “work of co-authorship” means a work produced by the collaboration of the author of a musical work and the author of a literary work where the two works are created in order to be used together.

(2) References in this Part to a work or the author of a work shall, except as otherwise provided, be construed in relation to a work of co-authorship as references to each of the separate musical and literary works comprised in the work of co-authorship and to each of the authors of such works.]

11.- First ownership of copyright.

(1) The author of a work is the first owner of any copyright in it, subject to the following provisions.

(2) Where a literary, dramatic, musical or artistic work [F27, or a film,] is made by an employee in the course of his employment, his employer is the first owner of any copyright in the work subject to any agreement to the contrary.

(3) This section does not apply to Crown copyright or Parliamentary copyright (see sections 163 and 165) or to copyright which subsists by virtue of section 168 (copyright of certain international organisations).

Duration of copyright

[F28

12.- Duration of copyright in literary, dramatic, musical or artistic works.

(1) The following provisions have effect with respect to the duration of copyright in a literary, dramatic, musical or artistic work.

(2) Copyright expires at the end of the period of 70 years from the end of the calendar year in which the author dies, subject as follows.

(3) If the work is of unknown authorship, copyright expires:

(a) at the end of the period of 70 years from the end of the calendar year in which the work was made, or

(b) if during that period the work is made available to the public, at the end of the period of 70 years from the end of the calendar year in which it is first so made available,subject as follows.

(4) Subsection (2) applies if the identity of the author becomes known before the end of the period specified in paragraph (a) or (b) of subsection (3).

(5) For the purposes of subsection (3) making available to the public includes:

(a) in the case of a literary, dramatic or musical work:

(i) performance in public, or

[F29

(ii) communication to the public;]

(b) in the case of an artistic work:

(i) exhibition in public,

(ii) a film including the work being shown in public, or

[F30

(iii) communication to the public;]but in determining generally for the purposes of that subsection whether a work has been made available to the public no account shall be taken of any unauthorised act.

(6) Where the country of origin of the work is not an EEA state and the author of the work is not a national of an EEA state, the duration of copyright is that to which the work is entitled in the country of origin, provided that does not exceed the period which would apply under subsections (2) to (5).

(7) If the work is computer-generated the above provisions do not apply and copyright expires at the end of the period of 50 years from the end of the calendar year in which the work was made.

(8) The provisions of this section are adapted as follows in relation to a work of joint authorship [F31or a work of co-authorship]:

(a) the reference in subsection (2) to the death of the author shall be construed:

(i) if the identity of all the authors is known, as a reference to the death of the last of them to die, and

(ii) if the identity of one or more of the authors is known and the identity of one or more others is not, as a reference to the death of the last whose identity is known;

(b) the reference in subsection (4) to the identity of the author becoming known shall be construed as a reference to the identity of any of the authors becoming known;

(c) the reference in subsection (6) to the author not being a national of an EEA state shall be construed as a reference to none of the authors being a national of an EEA state.

(9) This section does not apply to Crown copyright or Parliamentary copyright (see sections 163 to [F32166D]) or to copyright which subsists by virtue of section 168 (copyright of certain international organisations).][F33

13A.- Duration of copyright in sound recordings.

(1) The following provisions have effect with respect to the duration of copyright in a sound recording.

[F34

(2) Subject to subsections (4) and (5) [F35and section 191HA(4)], copyright expires:

(a) at the end of the period of 50 years from the end of the calendar year in which the recording is made, or

(b) if during that period the recording is published, [F3670] years from the end of the calendar year in which it is first published, or

(c) if during that period the recording is not published but is made available to the public by being played in public or communicated to the public, [F3770] years from the end of the calendar year in which it is first so made available,but in determining whether a sound recording has been published, played in public or communicated to the public, no account shall be taken of any unauthorised act.]

(3) F38 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(4) Where the author of a sound recording is not a national of an EEA state, the duration of copyright is that to which the sound recording is entitled in the country of which the author is a national, provided that does not exceed the period which would apply under [F39 subsection (2)].

(5) If or to the extent that the application of subsection (4) would be at variance with an international obligation to which the United Kingdom became subject prior to 29th October 1993, the duration of copyright shall be as specified in [F39subsection (2)].][F40

13B.- Duration of copyright in films.

(1) The following provisions have effect with respect to the duration of copyright in a film.

(2) Copyright expires at the end of the period of 70 years from the end of the calendar year in which the death occurs of the last to die of the following persons:

(a) the principal director,

(b) the author of the screenplay,

(d) the composer of music specially created for and used in the film;subject as follows.

(3) If the identity of one or more of the persons referred to in subsection (2)(a) to (d) is known and the identity of one or more others is not, the reference in that subsection to the death of the last of them to die shall be construed as a reference to the death of the last whose identity is known.

(4) If the identity of the persons referred to in subsection (2)(a) to (d) is unknown, copyright expires at:

(a) the end of the period of 70 years from the end of the calendar year in which the film was made, or

(b) if during that period the film is made available to the public, at the end of the period of 70 years from the end of the calendar year in which it is first so made available.

(5) Subsections (2) and (3) apply if the identity of any of those persons becomes known before the end of the period specified in paragraph (a) or (b) of subsection (4).

(6) For the purposes of subsection (4) making available to the public includes:

(a) showing in public, or

[F41

(b) communicating to the public;]but in determining generally for the purposes of that subsection whether a film has been made available to the public no account shall be taken of any unauthorised act.

(7) Where the country of origin is not an EEA state and the author of the film is not a national of an EEA state, the duration of copyright is that to which the work is entitled in the country of origin, provided that does not exceed the period which would apply under subsections (2) to (6).

(8) In relation to a film of which there are joint authors, the reference in subsection (7) to the author not being a national of an EEA state shall be construed as a reference to none of the authors being a national of an EEA state.

(9) If in any case there is no person falling within paragraphs (a) to (d) of subsection (2), the above provisions do not apply and copyright expires at the end of the period of 50 years from the end of the calendar year in which the film was made.

(10) For the purposes of this section the identity of any of the persons referred to in subsection (2)(a) to (d) shall be regarded as unknown if it is not possible for a person to ascertain his identity by reasonable inquiry; but if the identity of any such person is once known it shall not subsequently be regarded as unknown.]

13.-. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[F43

14.- Duration of copyright in broadcasts F42. . . .

(1) The following provisions have effect with respect to the duration of copyright in a broadcast F44. . . .

(2) Copyright in a broadcast F44. . . expires at the end of the period of 50 years from the end of the calendar year in which the broadcast was made F45. . . , subject as follows.

(3) Where the author of the broadcast F44. . . is not a national of an EEA state, the duration of copyright in the broadcast F44. . . is that to which it is entitled in the country of which the author is a national, provided that does not exceed the period which would apply under subsection (2).

(4) If or to the extent that the application of subsection (3) would be at variance with an international obligation to which the United Kingdom became subject prior to 29th October 1993, the duration of copyright shall be as specified in subsection (2).

(5) Copyright in a repeat broadcast F44. . . expires at the same time as the copyright in the original broadcast F44. . . ; and accordingly no copyright arises in respect of a repeat broadcast F44. . . which is broadcast F46. . . after the expiry of the copyright in the original broadcast F44. . . .

(6) A repeat broadcast F44. . . means one which is a repeat F47. . . of a broadcast previously made F47. . . .]

15.- Duration of copyright in typographical arrangement of published editions.

Copyright in the typographical arrangement of a published edition expires at the end of the period of 25 years from the end of the calendar year in which the edition was first published.

[F48

15A.- Meaning of country of origin.

(1) For the purposes of the provisions of this Part relating to the duration of copyright the country of origin of a work shall be determined as follows.

(2) If the work is first published in a Berne Convention country and is not simultaneously published elsewhere, the country of origin is that country.

(3) If the work is first published simultaneously in two or more countries only one of which is a Berne Convention country, the country of origin is that country.

(4) If the work is first published simultaneously in two or more countries of which two or more are Berne Convention countries, then:

(a) if any of those countries is an EEA state, the country of origin is that country; and

(b) if none of those countries is an EEA state, the country of origin is the Berne Convention country which grants the shorter or shortest period of copyright protection.

(5) If the work is unpublished or is first published in a country which is not a Berne Convention country (and is not simultaneously published in a Berne Convention country), the country of origin is:

(a) if the work is a film and the maker of the film has his headquarters in, or is domiciled or resident in a Berne Convention country, that country;

(b) if the work is:

(i) a work of architecture constructed in a Berne Convention country, or

(ii) an artistic work incorporated in a building or other structure situated in a Berne Convention country,that country;

(6) In this section:

(a) a “Berne Convention country” means a country which is a party to any Act of the International Convention for the Protection of Literary and Artistic Works signed at Berne on 9th September 1886; and

(b) references to simultaneous publication are to publication within 30 days of first publication.]

Chapter II.- Rights of Copyright Owner

The acts restricted by copyright

16.- The acts restricted by copyright in a work.

(1) The owner of the copyright in a work has, in accordance with the following provisions of this Chapter, the exclusive right to do the following acts in the United Kingdom:

(a) to copy the work (see section 17);

(b) to issue copies of the work to the public (see section 18);

F49[

(ba) to rent or lend the work to the public (see section 18A);]

[F50

(d) to communicate the work to the public (see section 20);]

(e) to make an adaptation of the work or do any of the above in relation to an adaptation (see section 21);and those acts are referred to in this Part as the “acts restricted by the copyright”.

(2) Copyright in a work is infringed by a person who without the licence of the copyright owner does, or authorises another to do, any of the acts restricted by the copyright.

(3) References in this Part to the doing of an act restricted by the copyright in a work are to the doing of it:

(a) in relation to the work as a whole or any substantial part of it, and

(b) either directly or indirectly;and it is immaterial whether any intervening acts themselves infringe copyright.

(4) This Chapter has effect subject to:

(a) the provisions of Chapter III (acts permitted in relation to copyright works), and

(b) the provisions of Chapter VII (provisions with respect to copyright licensing).

17.- Infringement of copyright by copying.

(1) The copying of the work is an act restricted by the copyright in every description of copyright work; and references in this Part to copying and copies shall be construed as follows.

(2) Copying in relation to a literary, dramatic, musical or artistic work means reproducing the work in any material form.This includes storing the work in any medium by electronic means.

(3) In relation to an artistic work copying includes the making of a copy in three dimensions of a two-dimensional work and the making of a copy in two dimensions of a three-dimensional work.

(4) Copying in relation to a film [F51or broadcast] includes making a photograph of the whole or any substantial part of any image forming part of the film [F51or broadcast].

(5) Copying in relation to the typographical arrangement of a published edition means making a facsimile copy of the arrangement.

(6) Copying in relation to any description of work includes the making of copies which are transient or are incidental to some other use of the work.

18.- Infringement by issue of copies to the public.

(1) The issue to the public of copies of the work is an act restricted by the copyright in every description of copyright work.

[F52[F53

(2) References in this Part to the issue to the public of copies of a work are to the act of putting into circulation in the United Kingdom copies not previously put into circulation in the EEA by or with the consent of the copyright owner.]

(3) References in this P art to the issue to the public of copies of a work do not include:

(a) any subsequent distribution, sale, hiring or loan of copies previously put into circulation (but see section 18A: infringement by rental or lending) F54…

F55

(b). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .F56…]

F57[

(4) References in this Part to the issue of copies of a work include the issue of the original.][F58

18A Infringement by rental or lending of work to the public.

(1) The rental or lending of copies of the work to the public is an act restricted by the copyright in:

(a) a literary, dramatic or musical work,

(b) an artistic work, other than:

(i) a work of architecture in the form of a building or a model for a building, or

(ii) a work of applied art, or

(2) In this Part, subject to the following provisions of this section:

(a) “rental” means making a copy of the work available for use, on terms that it will or may be returned, for direct or indirect economic or commercial advantage, and

(b) “lending” means making a copy of the work available for use, on terms that it will or may be returned, otherwise than for direct or indirect economic or commercial advantage, through an establishment which is accessible to the public.

(3) The expressions “rental” and “lending” do not include:

(a) making available for the purpose of public performance, playing or showing in public [F59or communication to the public];

(b) making available for the purpose of exhibition in public; or

(4) The expression “lending” does not include making available between establishments which are accessible to the public.

(5) Where lending by an establishment accessible to the public gives rise to a payment the amount of which does not go beyond what is necessary to cover the operating costs of the establishment, there is no direct or indirect economic or commercial advantage for the purposes of this section.

(6) References in this Part to the rental or lending of copies of a work include the rental or lending of the original.]

19.- Infringement by performance, showing or playing of work in public.

(1) The performance of the work in public is an act restricted by the copyright in a literary, dramatic or musical work.

(2) In this Part “performance”, in relation to a work:

(a) includes delivery in the case of lectures, addresses, speeches and sermons, and

(b) in general, includes any mode of visual or acoustic presentation, including presentation by means of a sound recording, film [F60or broadcast] of the work.

(3) The playing or showing of the work in public is an act restricted by the copyright in a sound recording, film [F60or broadcast].

(4) Where copyright in a work is infringed by its being performed, played or shown in public by means of apparatus for receiving visual images or sounds conveyed by electronic means, the person by whom the visual images or sounds are sent, and in the case of a performance the performers, shall not be regarded as responsible for the infringement.

[F61

20.- Infringement by communication to the public

(1) The communication to the public of the work is an act restricted by the copyright in:

(a) a literary, dramatic, musical or artistic work,

(b) a sound recording or film, or

(2) References in this Part to communication to the public are to communication to the public by electronic transmission, and in relation to a work include:

(a) the broadcasting of the work;

(b) the making available to the public of the work by electronic transmission in such a way that members of the public may access it from a place and at a time individually chosen by them.]

21.- Infringement by making adaptation or act done in relation to adaptation.

(1) The making of an adaptation of the work is an act restricted by the copyright in a literary, dramatic or musical work.For this purpose an adaptation is made when it is recorded, in writing or otherwise.

(2) The doing of any of the acts specified in sections 17 to 20, or subsection (1) above, in relation to an adaptation of the work is also an act restricted by the copyright in a literary, dramatic or musical work.For this purpose it is immaterial whether the adaptation has been recorded, in writing or otherwise, at the time the act is done.

(3) In this Part “adaptation”:

(a) in relation to a literary [F62work, [F63other than a computer program or a database, or in relation to a]] dramatic work, means:

(i) a translation of the work;

(ii) a version of a dramatic work in which it is converted into a non-dramatic work or, as the case may be, of a non-dramatic work in which it is converted into a dramatic work;

(iii) a version of the work in which the story or action is conveyed wholly or mainly by means of pictures in a form suitable for reproduction in a book, or in a newspaper, magazine or similar periodical;

F64[

(ab) in relation to a computer program, means an arrangement or altered version of the program or a translation of it;]

F65[

(ac) in relation to a database, means an arrangement or altered version of the database or a translation of it;]

(b) in relation to a musical work, means an arrangement or transcription of the work.

(4) In relation to a computer program a “translation” includes a version of the program in which it is converted into or out of a computer language or code or into a different computer language or code F66. . .

(5) No inference shall be drawn from this section as to what does or does not amount to copying a work.

Secondary infringement of copyright

22.- Secondary infringement: importing infringing copy.

The copyright in a work is infringed by a person who, without the licence of the copyright owner, imports into the United Kingdom, otherwise than for his private and domestic use, an article which is, and which he knows or has reason to believe is, an infringing copy of the work.

23.- Secondary infringement: possessing or dealing with infringing copy.

The copyright in a work is infringed by a person who, without the licence of the copyright owner:

(a) possesses in the course of a business,

(b) sells or lets for hire, or offers or exposes for sale or hire,

(d) distributes otherwise than in the course of a business to such an extent as to affect prejudicially the owner of the copyright,an article which is, and which he knows or has reason to believe is, an infringing copy of the work.

24.- Secondary infringement: providing means for making infringing copies.

(1) Copyright in a work is infringed by a person who, without the licence of the copyright owner:

(a) makes,

(b) imports into the United Kingdom,

(d) sells or lets for hire, or offers or exposes for sale or hire,an article specifically designed or adapted for making copies of that work, knowing or having reason to believe that it is to be used to make infringing copies.

(2) Copyright in a work is infringed by a person who without the licence of the copyright owner transmits the work by means of a telecommunications system (otherwise than by [F67communication to the public]), knowing or having reason to believe that infringing copies of the work will be made by means of the reception of the transmission in the United Kingdom or elsewhere.

25.- Secondary infringement: permitting use of premises for infringing performance.

(1) Where the copyright in a literary, dramatic or musical work is infringed by a performance at a place of public entertainment, any person who gave permission for that place to be used for the performance is also liable for the infringement unless when he gave permission he believed on reasonable grounds that the performance would not infringe copyright.

(2) In this section “place of public entertainment” includes premises which are occupied mainly for other purposes but are from time to time made available for hire for the purposes of public entertainment.

26.- Secondary infringement: provision of apparatus for infringing performance, &c.

(1) Where copyright in a work is infringed by a public performance of the work, or by the playing or showing of the work in public, by means of apparatus for:

(a) playing sound recordings,

(b) showing films, or

(c) receiving visual images or sounds conveyed by electronic means,the following persons are also liable for the infringement.

(2) A person who supplied the apparatus, or any substantial part of it, is liable for the infringement if when he supplied the apparatus or part:

(a) he knew or had reason to believe that the apparatus was likely to be so used as to infringe copyright, or

(b) in the case of apparatus whose normal use involves a public performance, playing or showing, he did not believe on reasonable grounds that it would not be so used as to infringe copyright.

(3) An occupier of premises who gave permission for the apparatus to be brought onto the premises is liable for the infringement if when he gave permission he knew or had reason to believe that the apparatus was likely to be so used as to infringe copyright.

(4) A person who supplied a copy of a sound recording or film used to infringe copyright is liable for the infringement if when he supplied it he knew or had reason to believe that what he supplied, or a copy made directly or indirectly from it, was likely to be so used as to infringe copyright.

Infringing copies

27.- Meaning of “infringing copy”.

(1) In this Part “infringing copy”, in relation to a copyright work, shall be construed in accordance with this section.

(2) An article is an infringing copy if its making constituted an infringement of the copyright in the work in question.

(3) F68. . . An article is also an infringing copy if:

(a) it has been or is proposed to be imported into the United Kingdom, and

(b) its making in the United Kingdom would have constituted an infringement of the copyright in the work in question, or a breach of an exclusive licence agreement relating to that work.

F69

(3A). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(4) Where in any proceedings the question arises whether an article is an infringing copy and it is shown:

(a) that the article is a copy of the work, and

(b) that copyright subsists in the work or has subsisted at any time,it shall be presumed until the contrary is proved that the article was made at a time when copyright subsisted in the work.

(5) Nothing in subsection (3) shall be construed as applying to an article which may lawfully be imported into the United Kingdom by virtue of any enforceable [F70EU] right within the meaning of section 2(1) of the M1European Communities Act 1972.

(6) In this Part “infringing copy” includes a copy falling to be treated as an infringing copy by virtue of any of the following provisions :

[F71 section 29A(3) (copies for text and data analysis for non-commercial research),][F72 section 28B(7) and (9) (personal copies for private use),][F73 section 31A(5) and (6) (disabled persons: copies of works for personal use),][F74 section 31B(11) (making and supply of accessible copies by authorised bodies),][F71 section 35(5) (recording by educational establishments of broadcasts),][F71 section 36(8) (copying and use of extracts of works by educational establishments),][F71 section 42A(5)(b) (copying by librarians: single copies of published works),][F71 section 61(6)(b) (recordings of folksongs),]

F75…

F76…

section 56(2) (further copies, adaptations, &c. of work in electronic form retained on transfer of principal copy),

section 63(2) (copies made for purpose of advertising artistic work for sale),

section 68(4) (copies made for purpose of broadcast F77 . . . ),

[F78 section 70(2) (recording for the purposes of time-shifting),

section 71(2) (photographs of broadcasts), or]

any provision of an order under section 141 (statutory licence for certain reprographic copying by educational establishments).

Chapter III.- Acts Permitted in relation to Copyright Works

Introductory

28.- Introductory provisions.

(1) The provisions of this Chapter specify acts which may be done in relation to copyright works notwithstanding the subsistence of copyright; they relate only to the question of infringement of copyright and do not affect any other right or obligation restricting the doing of any of the specified acts.

(2) Where it is provided by this Chapter that an act does not infringe copyright, or may be done without infringing copyright, and no particular description of copyright work is mentioned, the act in question does not infringe the copyright in a work of any description.

(3) No inference shall be drawn from the description of any act which may by virtue of this Chapter be done without infringing copyright as to the scope of the acts restricted by the copyright in any description of work.

(4) The provisions of this Chapter are to be construed independently of each other, so that the fact that an act does not fall within one provision does not mean that it is not covered by another provision.

General

[F79

28A.- Making of temporary copies

Copyright in a literary work, other than a computer program or a database, or in a dramatic, musical or artistic work, the typographical arrangement of a published edition, a sound recording or a film, is not infringed by the making of a temporary copy which is transient or incidental, which is an integral and essential part of a technological process and the sole purpose of which is to enable:

(a) a transmission of the work in a network between third parties by an intermediary; or

(b) a lawful use of the work;and which has no independent economic significance.][F80

28B.- Personal copies for private use

(1) The making of a copy of a work, other than a computer program, by an individual does not infringe copyright in the work provided that the copy:

(a) is a copy of:

(i) the individual’s own copy of the work, or

(ii) a personal copy of the work made by the individual,

(b) is made for the individual’s private use, and

(2) In this section “the individual’s own copy” is a copy which:

(a) has been lawfully acquired by the individual on a permanent basis,

(b) is not an infringing copy, and

(c) has not been made under any provision of this Chapter which permits the making of a copy without infringing copyright.

(3) In this section a “personal copy” means a copy made under this section.

(4) For the purposes of subsection (2)(a), a copy “lawfully acquired on a permanent basis”:

(a) includes a copy which has been purchased, obtained by way of a gift, or acquired by means of a download resulting from a purchase or a gift (other than a download of a kind mentioned in paragraph (b)); and

(b) does not include a copy which has been borrowed, rented, broadcast or streamed, or a copy which has been obtained by means of a download enabling no more than temporary access to the copy.

(5) In subsection (1)(b) “private use” includes private use facilitated by the making of a copy:

(a) as a back up copy,

(b) for the purposes of format-shifting, or

(c) for the purposes of storage, including in an electronic storage area accessed by means of the internet or similar means which is accessible only by the individual (and the person responsible for the storage area).

(6) Copyright in a work is infringed if an individual transfers a personal copy of the work to another person (otherwise than on a private and temporary basis), except where the transfer is authorised by the copyright owner.

(7) If copyright is infringed as set out in subsection (6), a personal copy which has been transferred is for all purposes subsequently treated as an infringing copy.

(8) Copyright in a work is also infringed if an individual, having made a personal copy of the work, transfers the individual’s own copy of the work to another person (otherwise than on a private and temporary basis) and, after that transfer and without the licence of the copyright owner, retains any personal copy.

(9) If copyright is infringed as set out in subsection (8), any retained personal copy is for all purposes subsequently treated as an infringing copy.

(10) To the extent that a term of a contract purports to prevent or restrict the making of a copy which, by virtue of this section, would not infringe copyright, that term is unenforceable.]

29.- Research and private study.

[F81

(1) Fair dealing with a F82… work for the purposes of research for a non-commercial purpose does not infringe any copyright in the work provided that it is accompanied by a sufficient acknowledgement.][F83

(1B) No acknowledgement is required in connection with fair dealing for the purposes mentioned in subsection (1) where this would be impossible for reasons of practicality or otherwise.

(1C) Fair dealing with a F84… work for the purposes of private study does not infringe any copyright in the work.]

F85

(2). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(3) Copying by a person other than the researcher or student himself is not fair dealing if:

[F86

(a) in the case of a librarian, or a person acting on behalf of a librarian, that person does anything which is not permitted under section 42A (copying by librarians: single copies of published works), or]

(b) in any other case, the person doing the copying knows or has reason to believe that it will result in copies of substantially the same material being provided to more than one person at substantially the same time and for substantially the same purpose.

F87 [

(4) It is not fair dealing:

(a) to convert a computer program expressed in a low level language into a version expressed in a higher level language, or

(b) incidentally in the course of so converting the program, to copy it,(these acts being permitted if done in accordance with section 50B (decompilation)).][F88

(4A) It is not fair dealing to observe, study or test the functioning of a computer program in order to determine the ideas and principles which underlie any element of the program (these acts being permitted if done in accordance with section 50BA (observing, studying and testing)).][F89

(4B) To the extent that a term of a contract purports to prevent or restrict the doing of any act which, by virtue of this section, would not infringe copyright, that term is unenforceable.]

(5) F90. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[F91

29A.- Copies for text and data analysis for non-commercial research

(1) The making of a copy of a work by a person who has lawful access to the work does not infringe copyright in the work provided that:

(a) the copy is made in order that a person who has lawful access to the work may carry out a computational analysis of anything recorded in the work for the sole purpose of research for a non-commercial purpose, and

(b) the copy is accompanied by a sufficient acknowledgement (unless this would be impossible for reasons of practicality or otherwise).

(2) Where a copy of a work has been made under this section, copyright in the work is infringed if:

(a) the copy is transferred to any other person, except where the transfer is authorised by the copyright owner, or

(b) the copy is used for any purpose other than that mentioned in subsection (1)(a), except where the use is authorised by the copyright owner.

(3) If a copy made under this section is subsequently dealt with:

(a) it is to be treated as an infringing copy for the purposes of that dealing, and

(b) if that dealing infringes copyright, it is to be treated as an infringing copy for all subsequent purposes.

(4) In subsection (3) “dealt with” means sold or let for hire, or offered or exposed for sale or hire.

(5) To the extent that a term of a contract purports to prevent or restrict the making of a copy which, by virtue of this section, would not infringe copyright, that term is unenforceable.]

30.- Criticism, review [F92, quotation] and news reporting.

(1) Fair dealing with a work for the purpose of criticism or review, of that or another work or of a performance of a work, does not infringe any copyright in the work provided that it is accompanied by a sufficient acknowledgement [F93 (unless this would be impossible for reasons of practicality or otherwise)] [F94 and provided that the work has been made available to the public].

[F95(1ZA) Copyright in a work is not infringed by the use of a quotation from the work (whether for criticism or review or otherwise) provided that:

(a) the work has been made available to the public,

(b) the use of the quotation is fair dealing with the work,

(d) the quotation is accompanied by a sufficient acknowledgement (unless this would be impossible for reasons of practicality or otherwise).][F96

(1A) For the purposes of [F97subsections (1) and (1ZA)] a work has been made available to the public if it has been made available by any means, including:

(a) the issue of copies to the public;

(b) making the work available by means of an electronic retrieval system;

(d) the performance, exhibition, playing or showing of the work in public;

(e) the communication to the public of the work,but in determining generally for the purposes of [F98those subsections] whether a work has been made available to the public no account shall be taken of any unauthorised act.]

(2) Fair dealing with a work (other than a photograph) for the purpose of reporting current events does not infringe any copyright in the work provided that (subject to subsection (3)) it is accompanied by a sufficient acknowledgement.

(3) No acknowledgement is required in connection with the reporting of current events by means of a sound recording, film [F99 or broadcast where this would be impossible for reasons of practicality or otherwise].

[F100

(4) To the extent that a term of a contract purports to prevent or restrict the doing of any act which, by virtue of subsection (1ZA), would not infringe copyright, that term is unenforceable.][F101

30A.- Caricature, parody or pastiche

(1) Fair dealing with a work for the purposes of caricature, parody or pastiche does not infringe copyright in the work.

(2) To the extent that a term of a contract purports to prevent or restrict the doing of any act which, by virtue of this section, would not infringe copyright, that term is unenforceable.]

31.- Incidental inclusion of copyright material.

(1) Copyright in a work is not infringed by its incidental inclusion in an artistic work, sound recording, film [F102or broadcast].

(2) Nor is the copyright infringed by the issue to the public of copies, or the playing, showing [F103or communication to the public], of anything whose making was, by virtue of subsection (1), not an infringement of the copyright.

(3) A musical work, words spoken or sung with music, or so much of a sound recording [F102or broadcast] as includes a musical work or such words, shall not be regarded as incidentally included in another work if it is deliberately included.

[F104 Disability][F105

31A.- Disabled persons: copies of works for personal use

(1) This section applies if:

(a) a disabled person has lawful [F106access to] a copy of the whole or part of a work, and

(b) the person’s disability prevents the person from enjoying the work to [F107substantially] the same degree as a person who does not have that disability.

(2) The making of an accessible copy of the copy of the work referred to in subsection (1)(a) does not infringe copyright if:

(a) the copy is made by the disabled person [F108and] or by a person acting on behalf of the disabled person,

(b) the copy is made for the disabled person’s personal use F109…

F110(c). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F111(3). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(4) Copyright is infringed by the transfer of an accessible copy of a work made under this section to any person other than:

(a) a person by or for whom an accessible copy of the work may be made under this section, or

(b) a person who intends to transfer the copy to a person falling within paragraph (a),except where the transfer is authorised by the copyright owner.

(5) An accessible copy of a work made under this section is to be treated for all purposes as an infringing copy if it is held by a person at a time when the person does not fall within subsection (4)(a) or (b).

(6) If an accessible copy made under this section is subsequently dealt with:

(a) it is to be treated as an infringing copy for the purposes of that dealing, and

(b) if that dealing infringes copyright, it is to be treated as an infringing copy for all subsequent purposes.

(7) In this section “dealt with” means sold or let for hire or offered or exposed for sale or hire.][F112

31B.- Making [F113, communicating, making available, distributing or lending] of accessible copies by authorised bodies

[F114(1) If:

(a) an authorised body has lawful access to the whole or part of a work which has been published or otherwise made available, and

(b) the body complies with subsection (1A),the body may, without infringing copyright, make, communicate, make available, distribute or lend accessible copies of the work on a non-profit basis for the personal use of disabled persons in the United Kingdom or another member State of the European Union.

(1A) An authorised body complies with this subsection if it:

(a) distributes, communicates, makes available or lends accessible copies only to disabled persons or other authorised bodies,

(b) takes appropriate steps to discourage the unauthorised reproduction, distribution, communication to the public or making available to the public of accessible copies,

(d) publishes and updates, on its website if appropriate, or through other online or offline channels, information on how it complies with the obligations in paragraphs (a), (b) and (c).]

F115

(2). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F115

(3). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F115

(4). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(5) For the purposes of [F116subsection (1)], [F117to communicate, make available, distribute or lend] “for the personal use of disabled persons” [F118includes to communicate, make available, distribute or lend] to a person acting on behalf of a disabled person.

F119

(6). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F119

(7). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F119

(8). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(9) An authorised body which has made an accessible copy of a work under this section may [F120communicate, make available, distribute or lend] it to another authorised body [F121established in the United Kingdom or another member State of the European Union] which is entitled to make accessible copies of the work under this section for the purposes of enabling that other body to make accessible copies of the work.

F122

(10). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(11) If an accessible copy made under this section is subsequently dealt with:

(a) it is to be treated as an infringing copy for the purposes of that dealing, and

(b) if that dealing infringes copyright, it is to be treated as an infringing copy for all subsequent purposes.

(12) In this section “dealt with” means sold or let for hire or offered or exposed for sale or hire.

31BA.- Making [F123, communicating, making available, distributing or lending] of intermediate copies by authorised bodies

(1) An authorised body which is entitled to make an accessible copy of a work under section 31B may, without infringing copyright, make a copy of the work (“an intermediate copy”) if this is necessary in order to make the accessible copy.

(2) An authorised body which has made an intermediate copy of a work under this section may [F124communicate, make available, distribute or lend it on a non-profit basis] to another authorised body which is entitled to make accessible copies of the work under section 31B for the purposes of enabling that other body to make accessible copies of the work.

(3) Copyright is infringed by the transfer of an intermediate copy made under this section to a person other than another authorised body as permitted by subsection (2), except where the transfer is authorised by the copyright owner.

(4)F125 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

31BB.- Accessible and intermediate copies: records and notification

(1) [F126A person listed in subsection (3) may request an authorised body:

(a) making accessible copies under section 31B, or

(b) making intermediate copies under section 31BA,to provide the person with the information in subsection (4).

(2) On receipt of a request under subsection (1), an authorised body must provide the information to the person in an accessible way within a reasonable time.

(3) The persons who may make a request under subsection (1) are:

(a) disabled person;

(b) another authorised body;

(4) The information that must be provided by the authorised body is:

(a) the list of works for which it has accessible copies and the available formats, and

(b) the name and contact details of any authorised body established in another member State of the European Union from which, or to which, it has imported, exported or accessed an accessible copy.]]

F127

31C.-

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F127

31D.-

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F127

31E.-

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[F128

31F.- Sections 31A to 31BB: interpretation and general

(1) This section supplements sections 31A to 31BB and includes definitions.

(2) “Disabled person” means a person who has a physical or mental impairment which prevents the person from enjoying a copyright work to [F129substantially] the same degree as a person who does not have that impairment, and “disability” is to be construed accordingly.

(3) But a person is not to be regarded as disabled by reason only of an impairment of visual function which can be improved, [F130for example] by the use of corrective lenses, to a level that is normally acceptable for reading without a special level or kind of light.

(4) An “accessible copy” of a copyright work means a version of the work which enables [F131disabled persons to access the work, including accessing it as feasibly and comfortably as a person who is not a disabled person].

(5) An accessible copy:

(a) may include facilities for navigating around the version of the work, but

(b) must not include any changes to the work which are not necessary to overcome the problems suffered by the disabled persons for whom the accessible copy is intended.

(6) “Authorised body” means:

(a) an educational establishment, or

(b) a body that is not conducted for profit.

F132

(7). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(8) To the extent that a term of a contract purports to prevent or restrict the doing of any act which, by virtue of section [F13327,] 31A, 31B or 31BA, would not infringe copyright, that term is unenforceable.]

Education

[F134

32.- Illustration for instruction

(1) Fair dealing with a work for the sole purpose of illustration for instruction does not infringe copyright in the work provided that the dealing is:

(a) for a non-commercial purpose,

(b) by a person giving or receiving instruction (or preparing for giving or receiving instruction), and

(c) accompanied by a sufficient acknowledgement (unless this would be impossible for reasons of practicality or otherwise).

(2) For the purposes of subsection (1), “giving or receiving instruction” includes setting examination questions, communicating the questions to pupils and answering the questions.

(3) To the extent that a term of a contract purports to prevent or restrict the doing of any act which, by virtue of this section, would not infringe copyright, that term is unenforceable.]

33.- Anthologies for educational use.

(1) The inclusion of a short passage from a published literary or dramatic work in a collection which:

(a) is intended for use in educational establishments and is so described in its title, and in any advertisements issued by or on behalf of the publisher, and

(b) consists mainly of material in which no copyright subsists,does not infringe the copyright in the work if the work itself is not intended for use in such establishments and the inclusion is accompanied by a sufficient acknowledgement.

(2) Subsection (1) does not authorise the inclusion of more than two excerpts from copyright works by the same author in collections published by the same publisher over any period of five years.

(3) In relation to any given passage the reference in subsection (2) to excerpts from works by the same author:

(a) shall be taken to include excerpts from works by him in collaboration with another, and

(b) if the passage in question is from such a work, shall be taken to include excerpts from works by any of the authors, whether alone or in collaboration with another.

(4) References in this section to the use of a work in an educational establishment are to any use for the educational purposes of such an establishment.

34.- Performing, playing or showing work in course of activities of educational establishment.

(1) The performance of a literary, dramatic or musical work before an audience consisting of teachers and pupils at an educational establishment and other persons directly connected with the activities of the establishment:

(a) by a teacher or pupil in the course of the activities of the establishment, or

(b) at the establishment by any person for the purposes of instruction,is not a public performance for the purposes of infringement of copyright.

(2) The playing or showing of a sound recording, film [F135or broadcast] before such an audience at an educational establishment for the purposes of instruction is not a playing or showing of the work in public for the purposes of infringement of copyright.

(3) A person is not for this purpose directly connected with the activities of the educational establishment simply because he is the parent of a pupil at the establishment.

[F136

35.- Recording by educational establishments of broadcasts

(1) A recording of a broadcast, or a copy of such a recording, may be made by or on behalf of an educational establishment for the educational purposes of that establishment without infringing copyright in the broadcast, or in any work included in it, provided that:

(a) the educational purposes are non-commercial, and

(b) the recording or copy is accompanied by a sufficient acknowledgement (unless this would be impossible for reasons of practicality or otherwise).

(2) Copyright is not infringed where a recording of a broadcast or a copy of such a recording, made under subsection (1), is communicated by or on behalf of the educational establishment to its pupils or staff for the non-commercial educational purposes of that establishment.

(3) Subsection (2) only applies to a communication received outside the premises of the establishment if that communication is made by means of a secure electronic network accessible only by the establishment’s pupils and staff.

(4) Acts which would otherwise be permitted by this section are not permitted if, or to the extent that, licences are available authorising the acts in question and the educational establishment responsible for those acts knew or ought to have been aware of that fact.

(5) If a copy made under this section is subsequently dealt with:

(a) it is to be treated as an infringing copy for the purposes of that dealing, and

(b) if that dealing infringes copyright, it is to be treated as an infringing copy for all subsequent purposes.

(6) In this section “dealt with” means:

(a) sold or let for hire,

(b) offered or exposed for sale or hire, or

36 Copying and use of extracts of works by educational establishments

(1) The copying of extracts of a relevant work by or on behalf of an educational establishment does not infringe copyright in the work, provided that:

(a) the copy is made for the purposes of instruction for a non-commercial purpose, and

(b) the copy is accompanied by a sufficient acknowledgement (unless this would be impossible for reasons of practicality or otherwise).

(2) Copyright is not infringed where a copy of an extract made under subsection (1) is communicated by or on behalf of the educational establishment to its pupils or staff for the purposes of instruction for a non-commercial purpose.

(4) In this section “relevant work” means a copyright work other than:

(a) a broadcast, or

(b) an artistic work which is not incorporated into another work.

(5) Not more than 5% of a work may be copied under this section by or on behalf of an educational establishment in any period of 12 months, and for these purposes a work which incorporates another work is to be treated as a single work.

(6) Acts which would otherwise be permitted by this section are not permitted if, or to the extent that, licences are available authorising the acts in question and the educational establishment responsible for those acts knew or ought to have been aware of that fact.

(7)The terms of a licence granted to an educational establishment authorising acts permitted by this section are of no effect so far as they purport to restrict the proportion of a work which may be copied (whether on payment or free of charge) to less than that which would be permitted by this section.

(8) If a copy made under this section is subsequently dealt with:

(a) it is to be treated as an infringing copy for the purposes of that dealing, and

(b) if that dealing infringes copyright, it is to be treated as an infringing copy for all subsequent purposes.

(9) In this section “dealt with” means:

(a) sold or let for hire,

(b) offered or exposed for sale or hire, or

36A.- Lending of copies by educational establishments

Libraries and archives

F139

37.- Libraries and archives: introductory.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F139

38.- Copying by librarians: articles in periodicals.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F139.-

39.- Copying by librarians: parts of published works.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F139.-

40.- Restriction on production of multiple copies of the same material.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[F140.-

40A.- Lending of copies by libraries or archives.

[F1

41.-

(1) Copyright in a work of any description is not infringed by the following acts by a public library in relation to a book within the public lending right scheme:

(a) lending the book;

(b) in relation to an audio-book or e-book, copying or issuing a copy of the book as an act incidental to lending it.

[F142(1ZA) Subsection (1) applies to an e-book or an e-audio-book only if:

(a) the book has been lawfully acquired by the library, and

(b) the lending is in compliance with any purchase or licensing terms to which the book is subject.]

(1A) In [F143subsections (1) and (1ZA)] :

(a) “ book ”, “ audio-book ” and “ e-book ” have the meanings given in section 5 of the Public Lending Right Act 1979,

[F144

(aa) “e-audio-book” means an audio-book (as defined in paragraph (a)) in a form enabling lending of the book by electronic transmission,]

(b) “the public lending right scheme” means the scheme in force under section 1 of that Act,

(c) a book is within the public lending right scheme if it is a book within the meaning of the provisions of the scheme relating to eligibility, whether or not it is in fact eligible, and

(d) “lending” is to be read in accordance with the definition of “lent out” in section 5 of that Act (and section 18A of this Act does not apply). ]

(2) Copyright in a work is not infringed by the lending of copies of the work by a F145 …library or archive (other than a public library) which is not conducted for profit. ][F146

40B.- Libraries and educational establishments etc : making works available through dedicated terminals

(1) Copyright in a work is not infringed by an institution specified in subsection (2) communicating the work to the public or making it available to the public by means of a dedicated terminal on its premises, if the conditions in subsection (3) are met.

(2) The institutions are:

(a) a library,

(b) an archive,

(d) an educational establishment.

(3) The conditions are that the work or a copy of the work:

(a) has been lawfully acquired by the institution,

(b) is communicated or made available to individual members of the public for the purposes of research or private study, and

(c) is communicated or made available in compliance with any purchase or licensing terms to which the work is subject.][F147

41.- Copying by librarians: supply of single copies to other libraries

(1) A librarian may, if the conditions in subsection (2) are met, make a single copy of the whole or part of a published work and supply it to another library, without infringing copyright in the work.

(2) The conditions are:

(a) the copy is supplied in response to a request from a library which is not conducted for profit, and

(b) at the time of making the copy the librarian does not know, or could not reasonably find out, the name and address of a person entitled to authorise the making of a copy of the work.

(3) The condition in subsection (2)(b) does not apply where the request is for a copy of an article in a periodical.

(4) Where a library makes a charge for supplying a copy under this section, the sum charged must be calculated by reference to the costs attributable to the production of the copy.

(5) To the extent that a term of a contract purports to prevent or restrict the doing of any act which, by virtue of this section, would not infringe copyright, that term is unenforceable.

42.- Copying by librarians etc : replacement copies of works

(1) A librarian, archivist or curator of a library, archive or museum may, without infringing copyright, make a copy of an item in that institution’s permanent collection:

(a) in order to preserve or replace that item in that collection, or

(b) where an item in the permanent collection of another library, archive or museum has been lost, destroyed or damaged, in order to replace the item in the collection of that other library, archive or museum,provided that the conditions in subsections (2) and (3) are met.

(2) The first condition is that the item is:

(a) included in the part of the collection kept wholly or mainly for the purposes of reference on the institution’s premises,

(b) included in a part of the collection not accessible to the public, or

(3) The second condition is that it is not reasonably practicable to purchase a copy of the item to achieve either of the purposes mentioned in subsection (1).

(4) The reference in subsection (1)(b) to a library, archive or museum is to a library, archive or museum which is not conducted for profit.

(5) Where an institution makes a charge for supplying a copy to another library, archive or museum under subsection (1)(b), the sum charged must be calculated by reference to the costs attributable to the production of the copy.

(6) In this section “item” means a work or a copy of a work.

(7) To the extent that a term of a contract purports to prevent or restrict the doing of any act which, by virtue of this section, would not infringe copyright, that term is unenforceable.

42A.- Copying by librarians: single copies of published works

(1) A librarian of a library which is not conducted for profit may, if the conditions in subsection

(2) are met, make and supply a single copy of:

(a) one article in any one issue of a periodical, or

(b) a reasonable proportion of any other published work,without infringing copyright in the work.

(2) The conditions are:

(a) the copy is supplied in response to a request from a person who has provided the librarian with a declaration in writing which includes the information set out in subsection (3), and

(b) the librarian is not aware that the declaration is false in a material particular.

(3) The information which must be included in the declaration is:

(a) the name of the person who requires the copy and the material which that person requires,

(b) a statement that the person has not previously been supplied with a copy of that material by any library,

(c) a statement that the person requires the copy for the purposes of research for a non-commercial purpose or private study, will use it only for those purposes and will not supply the copy to any other person, and

(d) a statement that to the best of the person’s knowledge, no other person with whom the person works or studies has made, or intends to make, at or about the same time as the person’s request, a request for substantially the same material for substantially the same purpose.

(4) Where a library makes a charge for supplying a copy under this section, the sum charged must be calculated by reference to the costs attributable to the production of the copy.

(5) Where a person (“P”) makes a declaration under this section that is false in a material particular and is supplied with a copy which would have been an infringing copy if made by P:

(a) P is liable for infringement of copyright as if P had made the copy, and

(b) the copy supplied to P is to be treated as an infringing copy for all purposes.

(6) To the extent that a term of a contract purports to prevent or restrict the doing of any act which, by virtue of this section, would not infringe copyright, that term is unenforceable.

43.- Copying by librarians or archivists: single copies of unpublished works

(1) A librarian or archivist may make and supply a single copy of the whole or part of a work without infringing copyright in the work, provided that:

(a) the copy is supplied in response to a request from a person who has provided the librarian or archivist with a declaration in writing which includes the information set out in subsection (2), and

(b) the librarian or archivist is not aware that the declaration is false in a material particular.

(2) The information which must be included in the declaration is:

(a) the name of the person who requires the copy and the material which that person requires,

(b) a statement that the person has not previously been supplied with a copy of that material by any library or archive, and

(3) But copyright is infringed if:

(a) the work had been published or communicated to the public before the date it was deposited in the library or archive, or

(b) the copyright owner has prohibited the copying of the work,and at the time of making the copy the librarian or archivist is, or ought to be, aware of that fact.

(4) Where a library or archive makes a charge for supplying a copy under this section, the sum charged must be calculated by reference to the costs attributable to the production of the copy.

(5) Where a person (“P”) makes a declaration under this section that is false in a material particular and is supplied with a copy which would have been an infringing copy if made by P:

(a) P is liable for infringement of copyright as if P had made the copy, and

(b) the copy supplied to P is to be treated as an infringing copy for all purposes.

43A.- Sections 40A to 43: interpretation

(1) The following definitions have effect for the purposes of sections 40A to 43.

(2) “Library” means:

(a) a library which is publicly accessible, or

(b) a library of an educational establishment.

(3) “Museum” includes a gallery.

(4) “Conducted for profit”, in relation to a library, archive or museum, means a body of that kind which is established or conducted for profit or which forms part of, or is administered by, a body established or conducted for profit.

(5) References to a librarian, archivist or curator include a person acting on behalf of a librarian, archivist or curator.]

44.- Copy of work required to be made as condition of export.

If an article of cultural or historical importance or interest cannot lawfully be exported from the United Kingdom unless a copy of it is made and deposited in an appropriate library or archive, it is not an infringement of copyright to make that copy.

[F148

44A.- Legal deposit libraries

(1) Copyright is not infringed by the copying of a work from the internet by a deposit library or person acting on its behalf if:

(a) the work is of a description prescribed by regulations under section 10(5) of the 2003 Act,

(b) its publication on the internet, or a person publishing it there, is connected with the United Kingdom in a manner so prescribed, and

(2) Copyright is not infringed by the doing of anything in relation to relevant material permitted to be done under regulations under section 7 of the 2003 Act.

(3) The Secretary of State may by regulations make provision excluding, in relation to prescribed activities done in relation to relevant material, the application of such of the provisions of this Chapter as are prescribed.

(4) Regulations under subsection (3) may in particular make provision prescribing activities:

(a) done for a prescribed purpose,

(b) done by prescribed descriptions of reader,

(d) done other than in accordance with prescribed conditions.

(5) Regulations under this section may make different provision for different purposes.

(6) Regulations under this section shall be made by statutory instrument which shall be subject to annulment in pursuance of a resolution of either House of Parliament.

(7) In this section:

(a) “the 2003 Act” means the Legal Deposit Libraries Act 2003;

(b) “deposit library”, “ reader ” and “ relevant material ” have the same meaning as in section 7 of the 2003 Act;

44B.- Permitted uses of orphan works

(1) Copyright in an orphan work is not infringed by a relevant body in the circumstances set out in paragraph 1(1) of Schedule ZA1 (subject to paragraph 6 of that Schedule).

(2) “Orphan work” and “relevant body” have the meanings given by that Schedule.]

Public administration

45.- Parliamentary and judicial proceedings.

(1) Copyright is not infringed by anything done for the purposes of parliamentary or judicial proceedings.

(2) Copyright is not infringed by anything done for the purposes of reporting such proceedings; but this shall not be construed as authorising the copying of a work which is itself a published report of the proceedings.

46.- Royal Commissions and statutory inquiries.

(1) Copyright is not infringed by anything done for the purposes of the proceedings of a Royal Commission or statutory inquiry.

(2) Copyright is not infringed by anything done for the purpose of reporting any such proceedings held in public; but this shall not be construed as authorising the copying of a work which is itself a published report of the proceedings.

(3) Copyright in a work is not infringed by the issue to the public of copies of the report of a Royal Commission or statutory inquiry containing the work or material from it.

(4) In this section:

“Royal Commission” includes a Commission appointed for Northern Ireland by the Secretary of State in pursuance of the prerogative powers of Her Majesty delegated to him under section 7(2) of the M2Northern Ireland Constitution Act 1973; and

“statutory inquiry” means an inquiry held or investigation conducted in pursuance of a duty imposed or power conferred by or under an enactment.

47.- Material open to public inspection or on official register.

(1) Where material is open to public inspection pursuant to a statutory requirement, or is on a statutory register, any copyright in the material as a literary work is not infringed by the copying of so much of the material as contains factual information of any description, by or with the authority of the appropriate person, for a purpose which does not involve the issuing of copies to the public.

[F150

(2) Where material is open to public inspection pursuant to a statutory requirement, copyright in the material is not infringed by an act to which subsection (3A) applies provided that:

(a) the act is done by or with the authority of the appropriate person,

(b) the purpose of the act is:

(i) to enable the material to be inspected at a more convenient time or place, or

(ii) to otherwise facilitate the exercise of any right for the purpose of which the statutory requirement is imposed, and

(c) in the case of the act specified in subsection (3A)(c), the material is not commercially available to the public by or with the authority of the copyright owner.

(3) Where material which contains information about matters of general scientific, technical, commercial or economic interest is on a statutory register or is open to public inspection pursuant to a statutory requirement, copyright in the material is not infringed by an act to which subsection (3A) applies provided that:

(a) the act is done by or with the authority of the appropriate person,

(b) the purpose of the act is to disseminate that information, and

(c) in the case of the act specified in subsection (3A)(c), the material is not commercially available to the public by or with the authority of the copyright owner.

(3A) This subsection applies to any of the following acts:

(a) copying the material,

(b) issuing copies of the material to the public, and

(c) making the material (or a copy of it) available to the public by electronic transmission in such a way that members of the public may access it from a place and at a time individually chosen by them.]

(4) The Secretary of State may by order provide that subsection (1), (2) or (3) shall, in such cases as may be specified in the order, apply only to copies marked in such manner as may be so specified.

(5) The Secretary of State may by order provide that subsections (1) to (3) apply, to such extent and with such modifications as may be specified in the order:

(a) to material made open to public inspection by:

(i) an international organisation specified in the order, or

(ii) a person so specified who has functions in the United Kingdom under an international agreement to which the United Kingdom is party, or

(b) to a register maintained by an international organisation specified in the order,as they apply in relation to material open to public inspection pursuant to a statutory requirement or to a statutory register.

(6) In this section:

“appropriate person” means the person required to make the material open to public inspection or, as the case may be, the person maintaining the register;

“statutory register” means a register maintained in pursuance of a statutory requirement; and

“statutory requirement” means a requirement imposed by provision made by or under an enactment.

(7) An order under this section shall be made by statutory instrument which shall be subject to annulment in pursuance of a resolution of either House of Parliament.

48.- Material communicated to the Crown in the course of public business.

(1) This section applies where a literary, dramatic, musical or artistic work has in the course of public business been communicated to the Crown for any purpose, by or with the licence of the copyright owner and a document or other material thing recording or embodying the work is owned by or in the custody or control of the Crown.

[F151

(2) The Crown may, without infringing copyright in the work, do an act specified in subsection (3) provided that:

(a) the act is done for the purpose for which the work was communicated to the Crown, or any related purpose which could reasonably have been anticipated by the copyright owner, and

(b) the work has not been previously published otherwise than by virtue of this section.][F151

(3) The acts referred to in subsection (2) are:

(a) copying the work,

(b) issuing copies of the work to the public, and

(c) making the work (or a copy of it) available to the public by electronic transmission in such a way that members of the public may access it from a place and at a time individually chosen by them.]

(4) In subsection (1) “public business” includes any activity carried on by the Crown.

(5) This section has effect subject to any agreement to the contrary between the Crown and the copyright owner.

[F152

(6) In this section “the Crown” includes a health service body, as defined in section 60(7) of the National Health Service and Community Care Act 1990, [F153the National Health Service Commissioning Board, a clinical commissioning group established under section 14D of the National Health Service Act 2006,] F154… , the Care Quality Commission [F155, Health Education England ] [F156, the Health Research Authority] and a National Health Service trust established under [F157 section 25 of the National Health Service Act 2006, section 18 of the National Health Service (Wales) Act 2006 ] or the National Health Service (Scotland) Act 1978 [F158 and an NHS foundation trust ] [F159 and also includes a health and social services body, as defined in Article 7(6) of the Health and Personal Social Services (Northern Ireland) Order 1991, and a Health and Social Services trust established under that Order ], and the reference in subsection (1) above to public business shall be construed accordingly. ]

49.- Public records.

Material which is comprised in public records within the meaning of the M3Public Records Act 1958, the M4Public Records (Scotland) Act 1937 or the M5Public Records Act (Northern Ireland) 1923 [F160, or in Welsh public records (as defined in the [F161the Government of Wales Act 2006]),] which are open to public inspection in pursuance of that Act, may be copied, and a copy may be supplied to any person, by or with the authority of any officer appointed under that Act, without infringement of copyright.

50.- Acts done under statutory authority.

(1) Where the doing of a particular act is specifically authorised by an Act of Parliament, whenever passed, then, unless the Act provides otherwise, the doing of that act does not infringe copyright.

(2) Subsection (1) applies in relation to an enactment contained in Northern Ireland legislation as it applies in relation to an Act of Parliament.

(3) Nothing in this section shall be construed as excluding any defence of statutory authority otherwise available under or by virtue of any enactment.

[F162 Computer programs: lawful users

F163

50A.- Back up copies.

(1) It is not an infringement of copyright for a lawful user of a copy of a computer program to make any back up copy of it which it is necessary for him to have for the purposes of his lawful use.

(2) For the purposes of this section and sections 50B [F164, 50BA] and 50C a person is a lawful user of a computer program if (whether under a licence to do any acts restricted by the copyright in the program or otherwise), he has a right to use the program.

(3) Where an act is permitted under this section, it is irrelevant whether or not there exists any term or condition in an agreement which purports to prohibit or restrict the act (such terms being, by virtue of section 296A, void).

F165

50B.- Decompilation.

(1) It is not an infringement of copyright for a lawful user of a copy of a computer program expressed in a low level language:

(a) to convert it into a version expressed in a higher level language, or

(b) incidentally in the course of so converting the program, to copy it,(that is, to “decompile” it), provided that the conditions in subsection (2) are met.

(2) The conditions are that:

(a) it is necessary to decompile the program to obtain the information necessary to create an independent program which can be operated with the program decompiled or with another program (“the permitted objective”); and

(b) the information so obtained is not used for any purpose other than the permitted objective.

(3) In particular, the conditions in subsection (2) are not met if the lawful user:

(a) has readily available to him the information necessary to achieve the permitted objective;

(b) does not confine the decompiling to such acts as are necessary to achieve the permitted objective;

(c) supplies the information obtained by the decompiling to any person to whom it is not necessary to supply it in order to achieve the permitted objective; or

(d) uses the information to create a program which is substantially similar in its expression to the program decompiled or to do any act restricted by copyright.

(4) Where an act is permitted under this section, it is irrelevant whether or not there exists any term or condition in an agreement which purports to prohibit or restrict the act (such terms being, by virtue of section 296A, void).

[F166

50BA.- Observing, studying and testing of computer programs

(1) It is not an infringement of copyright for a lawful user of a copy of a computer program to observe, study or test the functioning of the program in order to determine the ideas and principles which underlie any element of the program if he does so while performing any of the acts of loading, displaying, running, transmitting or storing the program which he is entitled to do.

(2) Where an act is permitted under this section, it is irrelevant whether or not there exists any term or condition in an agreement which purports to prohibit or restrict the act (such terms being, by virtue of section 296A, void).]

F167

50C.- Other acts permitted to lawful users.

(1) It is not an infringement of copyright for a lawful user of a copy of a computer program to copy or adapt it, provided that the copying or adapting:

(a) is necessary for his lawful use; and

(b) is not prohibited under any term or condition of an agreement regulating the circumstances in which his use is lawful.

(2) It may, in particular, be necessary for the lawful use of a computer program to copy it or adapt it for the purpose of correcting errors in it.

(3) This section does not apply to any copying or adapting permitted under [F168section 50A, 50B or 50BA].][F169 Databases: permitted acts]

50D.-

[F170 Acts permitted in relation to databases.]

(1) It is not an infringement of copyright in a database for a person who has a right to use the database or any part of the database, (whether under a licence to do any of the acts restricted by the copyright in the database or otherwise) to do, in the exercise of that right, anything which is necessary for the purposes of access to and use of the contents of the database or of that part of the database.

(2) Where an act which would otherwise infringe copyright in a database is permitted under this section, it is irrelevant whether or not there exists any term or condition in any agreement which purports to prohibit or restrict the act (such terms being, by virtue of section 296B, void).

Designs

51.- Design documents and models.

(1) It is not an infringement of any copyright in a design document or model recording or embodying a design for anything other than an artistic work or a typeface to make an article to the design or to copy an article made to the design.

(2) Nor is it an infringement of the copyright to issue to the public, or include in a film [F171or communicate to the public], anything the making of which was, by virtue of subsection (1), not an infringement of that copyright.

(3) In this section:

“design” means the design of F172…the shape or configuration (whether internal or external) of the whole or part of an article, other than surface decoration; and

“design document” means any record of a design, whether in the form of a drawing, a written description, a photograph, data stored in a computer or otherwise.

F173

52.- Effect of exploitation of design derived from artistic work.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

53.- Things done in reliance on registration of design.

(1) The copyright in an artistic work is not infringed by anything done:

(a) in pursuance of an assignment or licence made or granted by a person registered[F174 :

(i)] under the M6Registered Designs Act 1949 as the proprietor of a corresponding design, and[F175, or

(ii) under the Community Design Regulation as the right holder of a corresponding registered Community design]

(b) in good faith in reliance on the registration and without notice of any proceedings for the cancellation [F176or invalidation] of the registration or[F177, in a case of registration under the 1949 Act,] for rectifying the relevant entry in the register of designs;and this is so notwithstanding that the person registered as the proprietor was not the proprietor of the design for the purposes of the 1949 Act[F178 or, in a case of registration under the Community Design Regulation, that the person registered as the right holder was not the right holder of the design for the purposes of the Regulation].

(2) In subsection (1) a “corresponding design”, in relation to an artistic work, means a design within the meaning of the 1949 Act which if applied to an article would produce something which would be treated for the purposes of this Part as a copy of the artistic work.

[F179

(3) In subsection (1), a “ corresponding registered Community design ”, in relation to an artistic work, means a design within the meaning of the Community Design Regulation which if applied to an article would produce something which would be treated for the purposes of this Part as a copy of the artistic work. ][F180

(4) In this section, “ the Community Design Regulation” means Council Regulation ( EC ) nº 6/2002 of 12 December 2001 on Community designs.]

Typefaces

54.- Use of typeface in ordinary course of printing.

(1) It is not an infringement of copyright in an artistic work consisting of the design of a typeface:

(a) to use the typeface in the ordinary course of typing, composing text, typesetting or printing,

(b) to possess an article for the purpose of such use, or

(c) to do anything in relation to material produced by such use;and this is so notwithstanding that an article is used which is an infringing copy of the work.

(2) However, the following provisions of this Part apply in relation to persons making, importing or dealing with articles specifically designed or adapted for producing material in a particular typeface, or possessing such articles for the purpose of dealing with them, as if the production of material as mentioned in subsection (1) did infringe copyright in the artistic work consisting of the design of the typeface:

section 24 (secondary infringement: making, importing, possessing or dealing with article for making infringing copy),

sections 99 and 100 (order for delivery up and right of seizure),

section 107(2) (offence of making or possessing such an article), and

section 108 (order for delivery up in criminal proceedings).

(3) The references in subsection (2) to “dealing with” an article are to selling, letting for hire, or offering or exposing for sale or hire, exhibiting in public, or distributing.

55.- Articles for producing material in particular typeface.

(1) This section applies to the copyright in an artistic work consisting of the design of a typeface where articles specifically designed or adapted for producing material in that typeface have been marketed by or with the licence of the copyright owner.

(2) After the period of 25 years from the end of the calendar year in which the first such articles are marketed, the work may be copied by making further such articles, or doing anything for the purpose of making such articles, and anything may be done in relation to articles so made, without infringing copyright in the work.

(3) In subsection (1) “marketed” means sold, let for hire or offered or exposed for sale or hire, in the United Kingdom or elsewhere.

Works in electronic form

56.- Transfers of copies of works in electronic form.

(1) This section applies where a copy of a work in electronic form has been purchased on terms which, expressly or impliedly or by virtue of any rule of law, allow the purchaser to copy the work, or to adapt it or make copies of an adaptation, in connection with his use of it.

(2) If there are no express terms:

(a) prohibiting the transfer of the copy by the purchaser, imposing obligations which continue after a transfer, prohibiting the assignment of any licence or terminating any licence on a transfer, or

(b) providing for the terms on which a transferee may do the things which the purchaser was permitted to do,anything which the purchaser was allowed to do may also be done without infringement of copyright by a transferee; but any copy, adaptation or copy of an adaptation made by the purchaser which is not also transferred shall be treated as an infringing copy for all purposes after the transfer.

(3) The same applies where the original purchased copy is no longer usable and what is transferred is a further copy used in its place.

(4) The above provisions also apply on a subsequent transfer, with the substitution for references in subsection (2) to the purchaser of references to the subsequent transferor.

Miscellaneous: literary, dramatic, musical and artistic works

57.- Anonymous or pseudonymous works: acts permitted on assumptions as to expiry of copyright or death of author.

(1) Copyright in a literary, dramatic, musical or artistic work is not infringed by an act done at a time when, or in pursuance of arrangements made at a time when:

(a) it is not possible by reasonable inquiry to ascertain the identity of the author, and

(b) it is reasonable to assume:

(i) that copyright has expired, or

(ii) that the author died [F18170 years] or more before the beginning of the calendar year in which the act is done or the arrangements are made.

(2) Subsection (1)(b)(ii) does not apply in relation to:

(a) a work in which Crown copyright subsists, or

(b) a work in which copyright originally vested in an international organisation by virtue of section 168 and in respect of which an Order under that section specifies a copyright period longer than [F18170 years].

(3) In relation to a work of joint authorship:

(a) the reference in subsection (1) to its being possible to ascertain the identity of the author shall be construed as a reference to its being possible to ascertain the identity of any of the authors, and

(b) the reference in subsection (1)(b)(ii) to the author having died shall be construed as a reference to all the authors having died.

58.- Use of notes or recordings of spoken words in certain cases.

(1) Where a record of spoken words is made, in writing or otherwise, for the purpose:

(a) of reporting current events, or

(b) of [F182communicating to the public] the whole or part of the work,it is not an infringement of any copyright in the words as a literary work to use the record or material taken from it (or to copy the record, or any such material, and use the copy) for that purpose, provided the following conditions are met.

(2) The conditions are that:

(a) the record is a direct record of the spoken words and is not taken from a previous record or from a broadcast F183. . . ;

(b) the making of the record was not prohibited by the speaker and, where copyright already subsisted in the work, did not infringe copyright;

(c) the use made of the record or material taken from it is not of a kind prohibited by or on behalf of the speaker or copyright owner before the record was made; and

(d) the use is by or with the authority of a person who is lawfully in possession of the record.

59.- Public reading or recitation.

(1) The reading or recitation in public by one person of a reasonable extract from a published literary or dramatic work does not infringe any copyright in the work if it is accompanied by a sufficient acknowledgement.

(2) Copyright in a work is not infringed by the making of a sound recording, or the [F184communication to the public], of a reading or recitation which by virtue of subsection (1) does not infringe copyright in the work, provided that the recording [F185or communication to the public] consists mainly of material in relation to which it is not necessary to rely on that subsection.

60.- Abstracts of scientific or technical articles.

(1) Where an article on a scientific or technical subject is published in a periodical accompanied by an abstract indicating the contents of the article, it is not an infringement of copyright in the abstract, or in the article, to copy the abstract or issue copies of it to the public.

(2) This section does not apply if or to the extent that there is a licensing scheme certified for the purposes of this section under section 143 providing for the grant of licences.

61.- Recordings of folksongs.

(1) A sound recording of a performance of a song may be made for the purpose of including it in an archive maintained by a [F186body not established or conducted for profit] without infringing any copyright in the words as a literary work or in the accompanying musical work, provided the conditions in subsection (2) below are met.

(2) The conditions are that:

(a) the words are unpublished and of unknown authorship at the time the recording is made,

(b) the making of the recording does not infringe any other copyright, and

[F187

(3) A single copy of a sound recording made in reliance on subsection (1) and included in an archive referred to in that subsection may be made and supplied by the archivist without infringing copyright in the recording or the works included in it, provided that:

(a) the copy is supplied in response to a request from a person who has provided the archivist with a declaration in writing which includes the information set out in subsection (4), and

(b) the archivist is not aware that the declaration is false in a material particular.

(4) The information which must be included in the declaration is:

(a) the name of the person who requires the copy and the sound recording which is the subject of the request,

(b) a statement that the person has not previously been supplied with a copy of that sound recording by any archivist, and

(5) Where an archive makes a charge for supplying a copy under this section, the sum charged must be calculated by reference to the costs attributable to the production of the copy.

(6) Where a person (“P”) makes a declaration under this section that is false in a material particular and is supplied with a copy which would have been an infringing copy if made by P:

(a) P is liable for infringement of copyright as if P had made the copy, and

(b) the copy supplied to P is to be treated as an infringing copy for all purposes.

(7) In this section references to an archivist include a person acting on behalf of an archivist.]

62.- Representation of certain artistic works on public display.

(1) This section applies to:

(a) buildings, and

(b) sculptures, models for buildings and works of artistic craftsmanship, if permanently situated in a public place or in premises open to the public.

(2) The copyright in such a work is not infringed by:

(a) making a graphic work representing it,

(b) making a photograph or film of it, or

(c)[F188 making a broadcast of] a visual image of it.

(3) Nor is the copyright infringed by the issue to the public of copies, or the [F189communication to the public], of anything whose making was, by virtue of this section, not an infringement of the copyright.

63.- Advertisement of sale of artistic work.

(1) It is not an infringement of copyright in an artistic work to copy it, or to issue copies to the public, for the purpose of advertising the sale of the work.

(2) Where a copy which would otherwise be an infringing copy is made in accordance with this section but is subsequently dealt with for any other purpose, it shall be treated as an infringing copy for the purposes of that dealing, and if that dealing infringes copyright for all subsequent purposes.For this purpose “dealt with” means sold or let for hire, offered or exposed for sale or hire, exhibited in public [F190, distributed or communicated to the public].

64.- Making of subsequent works by same artist.

Where the author of an artistic work is not the copyright owner, he does not infringe the copyright by copying the work in making another artistic work, provided he does not repeat or imitate the main design of the earlier work.

65.- Reconstruction of buildings.

Anything done for the purposes of reconstructing a building does not infringe any copyright:

(a)in the building, or

(b) in any drawings or plans in accordance with which the building was, by or with the licence of the copyright owner, constructed.

F191 [ Miscellaneous: lending of works and playing of sound recordings ]

66.- [F192 Lending to public of copies of certain works.]

(1) The Secretary of State may by order provide that in such cases as may be specified in the order the lending to the public of copies of literary, dramatic, musical or artistic works, sound recordings or films shall be treated as licensed by the copyright owner subject only to the payment of such reasonable royalty or other payment as may be agreed or determined in default of agreement by the Copyright Tribunal.

(2) No such order shall apply if, or to the extent that, there is a licensing scheme certified for the purposes of this section under section 143 providing for the grant of licences.

(3) An order may make different provision for different cases and may specify cases by reference to any factor relating to the work, the copies lent, the lender or the circumstances of the lending.

(4) An order shall be made by statutory instrument; and no order shall be made unless a draft of it has been laid before and approved by a resolution of each House of Parliament.

(5) Nothing in this section affects any liability under section 23 (secondary infringement: possessing or dealing with infringing copy) in respect of the lending of infringing copies.

[F193 MISCellaneous: films and sound recordings]

66A.- [F194 Films: acts permitted on assumptions as to expiry of copyright, &c.]

(1) Copyright in a film is not infringed by an act done at a time when, or in pursuance of arrangements made at a time when:

(a) it is not possible by reasonable inquiry to ascertain the identity of any of the persons referred to in section 13B(2)(a) to (d) (persons by reference to whose life the copyright period is ascertained), and

(b) it is reasonable to assume:

(i) that copyright has expired, or

(ii) that the last to die of those persons died 70 years or more before the beginning of the calendar year in which the act is done or the arrangements are made.

(2) Subsection (1)(b)(ii) does not apply in relation to:

(a) a film in which Crown copyright subsists, or

(b) a film in which copyright originally vested in an international organisation by virtue of section 168 and in respect of which an Order under that section specifies a copyright period longer than 70 years.

67.- Playing of sound recordings for purposes of club, society, &c.

F195. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Miscellaneous: broadcasts F196. . .

68.- Incidental recording for purposes of broadcast F197. . . .

(1) This section applies where by virtue of a licence or assignment of copyright a person is authorised to broadcast F198. . . :

(a) a literary, dramatic or musical work, or an adaptation of such a work,

(b) an artistic work, or

(2) He shall by virtue of this section be treated as licensed by the owner of the copyright in the work to do or authorise any of the following for the purposes of the broadcast F198. . . :

(a) in the case of a literary, dramatic or musical work, or an adaptation of such a work, to make a sound recording or film of the work or adaptation;

(b) in the case of an artistic work, to take a photograph or make a film of the work;

(3) That licence is subject to the condition that the recording, film, photograph or copy in question:

(a) shall not be used for any other purpose, and

(b) shall be destroyed within 28 days of being first used for broadcasting the work F198. . . .

(4) A recording, film, photograph or copy made in accordance with this section shall be treated as an infringing copy:

(a) for the purposes of any use in breach of the condition mentioned in subsection (3)(a), and

(b) for all purposes after that condition or the condition mentioned in subsection (3)(b) is broken.

69.- Recording for purposes of supervision and control of broadcasts and [F199other services].

(1) Copyright is not infringed by the making or use by the British Broadcasting Corporation, for the purpose of maintaining supervision and control over programmes broadcast by them [F200 or included in any on-demand programme service provided by them], of recordings of those programmes.

F201 [F202

(2)Copyright is not infringed by anything done in pursuance of:

[F203

(a) section 167(1) of the Broadcasting Act 1990, section 115(4) or (6) or 117 of the Broadcasting Act 1996 or paragraph 20 of Schedule 12 to the Communications Act 2003;]

(b) a condition which, [F204 by virtue of section 334(1) of the Communications Act 2003 ] , is included in a licence granted under Part I or III of that Act or Part I or II of the Broadcasting Act 1996; F205 . . .

(c) a direction given under section 109(2) of the Broadcasting Act 1990 (power of [F206OFCOM] to require production of recordings etc ).

[F207

(d) section 334(3) [F208, 368O(1) or (3)] of the Communications Act 2003.][F202

(3) Copyright is not infringed by the use by OFCOM in connection with the performance of any of their functions under the Broadcasting Act 1990, the Broadcasting Act 1996 or the Communications Act 2003 of:

(a) any recording, script or transcript which is provided to them under or by virtue of any provision of those Acts; or

(b) any existing material which is transferred to them by a scheme made under section 30 of the Communications Act 2003.]]

(4) In subsection (3), “existing material” means:

(a) any recording, script or transcript which was provided to the Independent Television Commission or the Radio Authority under or by virtue of any provision of the Broadcasting Act 1990 or the Broadcasting Act 1996; and

(b) any recording or transcript which was provided to the Broadcasting Standards Commission under section 115(4) or (6) or 116(5) of the Broadcasting Act 1996.

[F209

(5) Copyright is not infringed by the use by an appropriate regulatory authority designated under section 368B of the Communications Act 2003, in connection with the performance of any of their functions under that Act, of any recording, script or transcript which is provided to them under or by virtue of any provision of that Act.

(6) In this section “ on-demand programme service ” has the same meaning as in the Communications Act 2003 (see section 368A of that Act). ]

70.- Recording for purposes of time-shifting.

[F210

(1)] The making [F211 in domestic premises] for private and domestic use of a recording of a broadcast F212. . . solely for the purpose of enabling it to be viewed or listened to at a more convenient time does not infringe any copyright in the broadcast F212. . . or in any work included in it.

[F213

(2) Where a copy which would otherwise be an infringing copy is made in accordance with this section but is subsequently dealt with:

(a) it shall be treated as an infringing copy for the purposes of that dealing; and

(b) if that dealing infringes copyright, it shall be treated as an infringing copy for all subsequent purposes.

(3) In subsection (2), “ dealt with ” means sold or let for hire, offered or exposed for sale or hire or communicated to the public. ][F214

71.- Photographs of broadcasts

(1) The making in domestic premises for private and domestic use of a photograph of the whole or any part of an image forming part of a broadcast, or a copy of such a photograph, does not infringe any copyright in the broadcast or in any film included in it.

(2) Where a copy which would otherwise be an infringing copy is made in accordance with this section but is subsequently dealt with:

(a) it shall be treated as an infringing copy for the purposes of that dealing; and

(b) if that dealing infringes copyright, it shall be treated as an infringing copy for all subsequent purposes.

(3) In subsection (2), “ dealt with ” means sold or let for hire, offered or exposed for sale or hire or communicated to the public. ]

72.- Free public showing or playing of broadcast F215. . . .

(1) The showing or playing in public of a broadcast F216. . . to an audience who have not paid for admission to the place where the broadcast F216. . . is to be seen or heard does not infringe any copyright in:

[F217

(a) the broadcast; [F218or]

(b)any sound recording (except so far as it is an excepted sound recording) included in it F219…

F220(c). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .][F221

(1A) For the purposes of this Part an “excepted sound recording” is a sound recording:

(a) whose author is not the author of the broadcast in which it is included; and

(b) which is a recording of music with or without words spoken or sung.

(1B) Where by virtue of subsection (1) the copyright in a broadcast shown or played in public is not infringed, copyright in any [F222film or] excepted sound recording included in it is not infringed if the playing or showing of that broadcast in public:

(a)F223 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(b) is necessary for the purposes of:

(i) repairing equipment for the reception of broadcasts;

(ii) demonstrating that a repair to such equipment has been carried out; or

(iii) demonstrating such equipment which is being sold or let for hire or offered or exposed for sale or hire.]

(2) The audience shall be treated as having paid for admission to a place:

(a) if they have paid for admission to a place of which that place forms part; or

(b)i f goods or services are supplied at that place (or a place of which it forms part):

(i) at prices which are substantially attributable to the facilities afforded for seeing or hearing the broadcast F224. . . , or

(ii) at prices exceeding those usually charged there and which are partly attributable to those facilities.

(3) The following shall not be regarded as having paid for admission to a place:

(a) persons admitted as residents or inmates of the place;

(b) persons admitted as members of a club or society where the payment is only for membership of the club or society and the provision of facilities for seeing or hearing broadcasts F225. . . is only incidental to the main purposes of the club or society.

(4) Where the making of the broadcast F226. . . was an infringement of the copyright in a sound recording or film, the fact that it was heard or seen in public by the reception of the broadcast F226. . . shall be taken into account in assessing the damages for that infringement.

F227

73.- Reception and re-transmission of wireless broadcast by cable.

F228

73A.- Royalty or other sum payable in pursuance of section 73(4).

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F229

74.-

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[F230

75.- Recording of broadcast for archival purposes

(1) A recording of a broadcast or a copy of such a recording may be made for the purpose of being placed in an archive maintained by a body which is not established or conducted for profit without infringing any copyright in the broadcast or in any work included in it.

(2) To the extent that a term of a contract purports to prevent or restrict the doing of any act which, by virtue of this section, would not infringe copyright, that term is unenforceable.]

Adaptations

76.- Adaptations.

An act which by virtue of this Chapter may be done without infringing copyright in a literary, dramatic or musical work does not, where that work is an adaptation, infringe any copyright in the work from which the adaptation was made.

[F231CHAPTER 3A.- CERTAIN PERMITTED USES OF ORPHAN WORKS

76A.- Certain permitted uses of orphan works

Schedule ZA1 makes provision about the use by relevant bodies of orphan works.]

Chapter IV.- Moral Rights

Right to be identified as author or director

77.- Right to be identified as author or director.

(1) The author of a copyright literary, dramatic, musical or artistic work, and the director of a copyright film, has the right to be identified as the author or director of the work in the circumstances mentioned in this section; but the right is not infringed unless it has been asserted in accordance with section 78.

(2) The author of a literary work (other than words intended to be sung or spoken with music) or a dramatic work has the right to be identified whenever:

(a) the work is published commercially, performed in public [F232or communicated to the public]; or

(b) copies of a film or sound recording including the work are issued to the public;and that right includes the right to be identified whenever any of those events occur in relation to an adaptation of the work as the author of the work from which the adaptation was made.

(3) The author of a musical work, or a literary work consisting of words intended to be sung or spoken with music, has the right to be identified whenever:

(a) the work is published commercially;

(b) copies of a sound recording of the work are issued to the public; or

(c) a film of which the sound-track includes the work is shown in public or copies of such a film are issued to the public;and that right includes the right to be identified whenever any of those events occur in relation to an adaptation of the work as the author of the work from which the adaptation was made.

(4) The author of an artistic work has the right to be identified whenever:

(a) the work is published commercially or exhibited in public, or a visual image of it is [F233communicated to the public];

(b) a film including a visual image of the work is shown in public or copies of such a film are issued to the public; or

(c) in the case of a work of architecture in the form of a building or a model for a building, a sculpture or a work of artistic craftsmanship, copies of a graphic work representing it, or of a photograph of it, are issued to the public.

(5) The author of a work of architecture in the form of a building also has the right to be identified on the building as constructed or, where more than one building is constructed to the design, on the first to be constructed.

(6) The director of a film has the right to be identified whenever the film is shown in public [F232or communicated to the public] or copies of the film are issued to the public.

(7) The right of the author or director under this section is:

(a) in the case of commercial publication or the issue to the public of copies of a film or sound recording, to be identified in or on each copy or, if that is not appropriate, in some other manner likely to bring his identity to the notice of a person acquiring a copy,

(b) in the case of identification on a building, to be identified by appropriate means visible to persons entering or approaching the building, and

(c) in any other case, to be identified in a manner likely to bring his identity to the attention of a person seeing or hearing the performance, exhibition, showing [F234or communication to the public] in question;and the identification must in each case be clear and reasonably prominent.

(8) If the author or director in asserting his right to be identified specifies a pseudonym, initials or some other particular form of identification, that form shall be used; otherwise any reasonable form of identification may be used.

(9) This section has effect subject to section 79 (exceptions to right).

78.- Requirement that right be asserted.

(1) A person does not infringe the right conferred by section 77 (right to be identified as author or director) by doing any of the acts mentioned in that section unless the right has been asserted in accordance with the following provisions so as to bind him in relation to that act.

(2) The right may be asserted generally, or in relation to any specified act or description of acts:

(a) on an assignment of copyright in the work, by including in the instrument effecting the assignment a statement that the author or director asserts in relation to that work his right to be identified, or

(b) by instrument in writing signed by the author or director.

(3) The right may also be asserted in relation to the public exhibition of an artistic work:

(a) by securing that when the author or other first owner of copyright parts with possession of the original, or of a copy made by him or under his direction or control, the author is identified on the original or copy, or on a frame, mount or other thing to which it is attached, or

(b) by including in a licence by which the author or other first owner of copyright authorises the making of copies of the work a statement signed by or on behalf of the person granting the licence that the author asserts his right to be identified in the event of the public exhibition of a copy made in pursuance of the licence.

(4) The persons bound by an assertion of the right under subsection (2) or (3) are:

(a) in the case of an assertion under subsection (2)(a), the assignee and anyone claiming through him, whether or not he has notice of the assertion;

(b) in the case of an assertion under subsection (2)(b), anyone to whose notice the assertion is brought;

(c) in the case of an assertion under subsection (3)(a), anyone into whose hands that original or copy comes, whether or not the identification is still present or visible;

(d) in the case of an assertion under subsection (3)(b), the licensee and anyone into whose hands a copy made in pursuance of the licence comes, whether or not he has notice of the assertion.

(5) In an action for infringement of the right the court shall, in considering remedies, take into account any delay in asserting the right.

79.- Exceptions to right.

(1) The right conferred by section 77 (right to be identified as author or director) is subject to the following exceptions.

(2) The right does not apply in relation to the following descriptions of work:

(a) a computer program;

(b) the design of a typeface;

(3) The right does not apply to anything done by or with the authority of the copyright owner where copyright in the work originally [F235 vested in the author’s or director’s employer by virtue of section 11(2) (works produced in the course of employment).]

(4) The right is not infringed by an act which by virtue of any of the following provisions would not infringe copyright in the work:

(a) section 30 (fair dealing for certain purposes), so far as it relates to the reporting of current events by means of a sound recording, film [F236or broadcast];

(b) section 31 (incidental inclusion of work in an artistic work, sound recording, film [F236or broadcast]);

F237(c). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(d) section 45 (parliamentary and judicial proceedings);

(e) section 46(1) or (2) (Royal Commissions and statutory inquiries);

(f) section 51 (use of design documents and models);

F238

(g). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(h)[F239 section 57 or 66A (acts permitted on assumptions as to expiry of copyright, &c.)];

[F240

(4A) The right is also not infringed by any act done for the purposes of an examination which by virtue of any provision of Chapter 3 of Part 1 would not infringe copyright.]

(5) The right does not apply in relation to any work made for the purpose of reporting current events.

(6) The right does not apply in relation to the publication in:

(a) a newspaper, magazine or similar periodical, or

(b) an encyclopaedia, dictionary, yearbook or other collective work of reference,of a literary, dramatic, musical or artistic work made for the purposes of such publication or made available with the consent of the author for the purposes of such publication.

(7) The right does not apply in relation to:

(a) a work in which Crown copyright or Parliamentary copyright subsists, or

(b) a work in which copyright originally vested in an international organisation by virtue of section 168,unless the author or director has previously been identified as such in or on published copies of the work.

Right to object to derogatory treatment of work

80.- Right to object to derogatory treatment of work.

(1) The author of a copyright literary, dramatic, musical or artistic work, and the director of a copyright film, has the right in the circumstances mentioned in this section not to have his work subjected to derogatory treatment.

(2) For the purposes of this section:

(a) “treatment” of a work means any addition to, deletion from or alteration to or adaptation of the work, other than:

(i) a translation of a literary or dramatic work, or

(ii) an arrangement or transcription of a musical work involving no more than a change of key or register; and

(b) the treatment of a work is derogatory if it amounts to distortion or mutilation of the work or is otherwise prejudicial to the honour or reputation of the author or director;and in the following provisions of this section references to a derogatory treatment of a work shall be construed accordingly.

(3) In the case of a literary, dramatic or musical work the right is infringed by a person who:

(a) publishes commercially, performs in public [F241or communicates to the public] a derogatory treatment of the work; or

(b) issues to the public copies of a film or sound recording of, or including, a derogatory treatment of the work.

(4) In the case of an artistic work the right is infringed by a person who:

(a) publishes commercially or exhibits in public a derogatory treatment of the work, [F242or communicates to the public] a visual image of a derogatory treatment of the work,

(b) shows in public a film including a visual image of a derogatory treatment of the work or issues to the public copies of such a film, or

(i) a work of architecture in the form of a model for a building,

(ii) a sculpture, or

(iii) a work of artistic craftsmanship,issues to the public copies of a graphic work representing, or of a photograph of, a derogatory treatment of the work.

(5) Subsection (4) does not apply to a work of architecture in the form of a building; but where the author of such a work is identified on the building and it is the subject of derogatory treatment he has the right to require the identification to be removed.

(6) In the case of a film, the right is infringed by a person who:

(a) shows in public [F241or communicates to the public] a derogatory treatment of the film; or

(b) issues to the public copies of a derogatory treatment of the film,F243. . .

(7) The right conferred by this section extends to the treatment of parts of a work resulting from a previous treatment by a person other than the author or director, if those parts are attributed to, or are likely to be regarded as the work of, the author or director.

(8) This section has effect subject to sections 81 and 82 (exceptions to and qualifications of right).

81.- Exceptions to right.

(1) The right conferred by section 80 (right to object to derogatory treatment of work) is subject to the following exceptions.

(2) The right does not apply to a computer program or to any computer-generated work.

(3) The right does not apply in relation to any work made for the purpose of reporting current events.

(4) The right does not apply in relation to the publication in:

(a) a newspaper, magazine or similar periodical, or

Nor does the right apply in relation to any subsequent exploitation elsewhere of such a work without any modification of the published version.

(5) The right is not infringed by an act which by virtue of [F244section 57 or 66A (acts permitted on assumptions as to expiry of copyright, &c.)] would not infringe copyright.

(6) The right is not infringed by anything done for the purpose of:

(a) avoiding the commission of an offence,

(b) complying with a duty imposed by or under an enactment, or

(c) in the case of the British Broadcasting Corporation, avoiding the inclusion in a programme broadcast by them of anything which offends against good taste or decency or which is likely to encourage or incite to crime or to lead to disorder or to be offensive to public feeling,provided, where the author or director is identified at the time of the relevant act or has previously been identified in or on published copies of the work, that there is a sufficient disclaimer.

82.- Qualification of right in certain cases.

(1) This section applies to:

(a) works in which copyright originally vested in the author’s [F245 or director’s] employer by virtue of section 11(2) (works produced in course of employment) F246. . .

(b) works in which Crown copyright or Parliamentary copyright subsists, and

(2) The right conferred by section 80 (right to object to derogatory treatment of work) does not apply to anything done in relation to such a work by or with the authority of the copyright owner unless the author or director:

(a) is identified at the time of the relevant act, or

(b) has previously been identified in or on published copies of the work;and where in such a case the right does apply, it is not infringed if there is a sufficient disclaimer.

83.- Infringement of right by possessing or dealing with infringing article.

(1) The right conferred by section 80 (right to object to derogatory treatment of work) is also infringed by a person who:

(a) possesses in the course of a business, or

(b) sells or lets for hire, or offers or exposes for sale or hire, or

(d) distributes otherwise than in the course of a business so as to affect prejudicially the honour or reputation of the author or director,an article which is, and which he knows or has reason to believe is, an infringing article.

(2) An “infringing article” means a work or a copy of a work which:

(a) has been subjected to derogatory treatment within the meaning of section 80, and

(b) has been or is likely to be the subject of any of the acts mentioned in that section in circumstances infringing that right.

False attribution of work

84.- False attribution of work.

(1) A person has the right in the circumstances mentioned in this section:

(a) not to have a literary, dramatic, musical or artistic work falsely attributed to him as author, and

(b) not to have a film falsely attributed to him as director;and in this section an “attribution”, in relation to such a work, means a statement (express or implied) as to who is the author or director.

(2)The right is infringed by a person who:

(a) issues to the public copies of a work of any of those descriptions in or on which there is a false attribution, or

(b) exhibits in public an artistic work, or a copy of an artistic work, in or on which there is a false attribution.

(3) The right is also infringed by a person who:

(a) in the case of a literary, dramatic or musical work, performs the work in public [F247or communicates it to the public] as being the work of a person, or

(b) in the case of a film, shows it in public [F247or communicates it to the public] as being directed by a person,knowing or having reason to believe that the attribution is false.

(4) The right is also infringed by the issue to the public or public display of material containing a false attribution in connection with any of the acts mentioned in subsection (2) or (3).

(5) The right is also infringed by a person who in the course of a business:

(a) possesses or deals with a copy of a work of any of the descriptions mentioned in subsection (1) in or on which there is a false attribution, or

(b) in the case of an artistic work, possesses or deals with the work itself when there is a false attribution in or on it,knowing or having reason to believe that there is such an attribution and that it is false.

(6) In the case of an artistic work the right is also infringed by a person who in the course of a business:

(a) deals with a work which has been altered after the author parted with possession of it as being the unaltered work of the author, or

(b) deals with a copy of such a work as being a copy of the unaltered work of the author,knowing or having reason to believe that that is not the case.

(7) References in this section to dealing are to selling or letting for hire, offering or exposing for sale or hire, exhibiting in public, or distributing.

(8) This section applies where, contrary to the fact:

(a) a literary, dramatic or musical work is falsely represented as being an adaptation of the work of a person, or

(b) a copy of an artistic work is falsely represented as being a copy made by the author of the artistic work,as it applies where the work is falsely attributed to a person as author.

Right to privacy of certain photographs and films

85.- Right to privacy of certain photographs and films.

(1) A person who for private and domestic purposes commissions the taking of a photograph or the making of a film has, where copyright subsists in the resulting work, the right not to have:

(a) copies of the work issued to the public,

(b) the work exhibited or shown in public, or

(c) the work [F248communicated to the public]; and, except as mentioned in subsection (2), a person who does or authorises the doing of any of those acts infringes that right.

(2) The right is not infringed by an act which by virtue of any of the following provisions would not infringe copyright in the work:

(a) section 31 (incidental inclusion of work in an artistic work, film [F249or broadcast]);

(b) section 45 (parliamentary and judicial proceedings);

(d) section 50 (acts done under statutory authority);

(e)[F250 section 57 or 66A (acts permitted on assumptions as to expiry of copyright, &c.)].

Supplementary

86.- Duration of rights.

(1) The rights conferred by section 77 (right to be identified as author or director), section 80 (right to object to derogatory treatment of work) and section 85 (right to privacy of certain photographs and films) continue to subsist so long as copyright subsists in the work.

(2) The right conferred by section 84 (false attribution) continues to subsist until 20 years after a person’s death.

87.- Consent and waiver of rights.

(1) It is not an infringement of any of the rights conferred by this Chapter to do any act to which the person entitled to the right has consented.

(2) Any of those rights may be waived by instrument in writing signed by the person giving up the right.

(3) A waiver:

(a) may relate to a specific work, to works of a specified description or to works generally, and may relate to existing or future works, and

(b) may be conditional or unconditional and may be expressed to be subject to revocation;and if made in favour of the owner or prospective owner of the copyright in the work or works to which it relates, it shall be presumed to extend to his licensees and successors in title unless a contrary intention is expressed.

(4) Nothing in this Chapter shall be construed as excluding the operation of the general law of contract or estoppel in relation to an informal waiver or other transaction in relation to any of the rights mentioned in subsection (1).

88.- Application of provisions to joint works.

(1) The right conferred by section 77 (right to be identified as author or director) is, in the case of a work of joint authorship, a right of each joint author to be identified as a joint author and must be asserted in accordance with section 78 by each joint author in relation to himself.

(2) The right conferred by section 80 (right to object to derogatory treatment of work) is, in the case of a work of joint authorship, a right of each joint author and his right is satisfied if he consents to the treatment in question.

(3) A waiver under section 87 of those rights by one joint author does not affect the rights of the other joint authors.

(4) The right conferred by section 84 (false attribution) is infringed, in the circumstances mentioned in that section:

(a) by any false statement as to the authorship of a work of joint authorship, and

(b) by the false attribution of joint authorship in relation to a work of sole authorship;and such a false attribution infringes the right of every person to whom authorship of any description is, whether rightly or wrongly, attributed.

(5) The above provisions also apply (with any necessary adaptations) in relation to a film which was, or is alleged to have been, jointly directed, as they apply to a work which is, or is alleged to be, a work of joint authorship.A film is “jointly directed” if it is made by the collaboration of two or more directors and the contribution of each director is not distinct from that of the other director or directors.

(6) The right conferred by section 85 (right to privacy of certain photographs and films) is, in the case of a work made in pursuance of a joint commission, a right of each person who commissioned the making of the work, so that:

(a) the right of each is satisfied if he consents to the act in question, and

(b) a waiver under section 87 by one of them does not affect the rights of the others.

89.- Application of provisions to parts of works.

(1) The rights conferred by section 77 (right to be identified as author or director) and section 85 (right to privacy of certain photographs and films) apply in relation to the whole or any substantial part of a work.

(2) The rights conferred by section 80 (right to object to derogatory treatment of work) and section 84 (false attribution) apply in relation to the whole or any part of a work.

Chapter V.- Dealings with Rights in Copyright Works

90.- Assignment and licences.

(1) Copyright is transmissible by assignment, by testamentary disposition or by operation of law, as personal or moveable property.

(2) An assignment or other transmission of copyright may be partial, that is, limited so as to apply:

(a) to one or more, but not all, of the things the copyright owner has the exclusive right to do;

(b) to part, but not the whole, of the period for which the copyright is to subsist.

(3) An assignment of copyright is not effective unless it is in writing signed by or on behalf of the assignor.

(4) A licence granted by a copyright owner is binding on every successor in title to his interest in the copyright, except a purchaser in good faith for valuable consideration and without notice (actual or constructive) of the licence or a person deriving title from such a purchaser; and references in this Part to doing anything with, or without, the licence of the copyright owner shall be construed accordingly.

91.- Prospective ownership of copyright.

(1) Where by an agreement made in relation to future copyright, and signed by or on behalf of the prospective owner of the copyright, the prospective owner purports to assign the future copyright (wholly or partially) to another person, then if, on the copyright coming into existence, the assignee or another person claiming under him would be entitled as against all other persons to require the copyright to be vested in him, the copyright shall vest in the assignee or his successor in title by virtue of this subsection.

(2) In this Part:

“future copyright” means copyright which will or may come into existence in respect of a future work or class of works or on the occurrence of a future event; and

“prospective owner” shall be construed accordingly, and includes a person who is prospectively entitled to copyright by virtue of such an agreement as is mentioned in subsection (1).

(3) A licence granted by a prospective owner of copyright is binding on every successor in title to his interest (or prospective interest) in the right, except a purchaser in good faith for valuable consideration and without notice (actual or constructive) of the licence or a person deriving title from such a purchaser; and references in this Part to doing anything with, or without, the licence of the copyright owner shall be construed accordingly.

92.- Exclusive licences.

(1) In this Part an “exclusive licence” means a licence in writing signed by or on behalf of the copyright owner authorising the licensee to the exclusion of all other persons, including the person granting the licence, to exercise a right which would otherwise be exercisable exclusively by the copyright owner.

(2) The licensee under an exclusive licence has the same rights against a successor in title who is bound by the licence as he has against the person granting the licence.

93.- Copyright to pass under will with unpublished work.

Where under a bequest (whether specific or general) a person is entitled, beneficially or otherwise, to:

(a) an original document or other material thing recording or embodying a literary, dramatic, musical or artistic work which was not published before the death of the testator, or

(b) an original material thing containing a sound recording or film which was not published before the death of the testator,the bequest shall, unless a contrary intention is indicated in the testator’s will or a codicil to it, be construed as including the copyright in the work in so far as the testator was the owner of the copyright immediately before his death.

[F251

93A.- Presumption of transfer of rental right in case of film production agreement.

(1) Where an agreement concerning film production is concluded between an author and a film producer, the author shall be presumed, unless the agreement provides to the contrary, to have transferred to the film producer any rental right in relation to the film arising by virtue of the inclusion of a copy of the author’s work in the film.

(2) In this section “author” means an author, or prospective author, of a literary, dramatic, musical or artistic work.

(3) Subsection (1) does not apply to any rental right in relation to the film arising by virtue of the inclusion in the film of the screenplay, the dialogue or music specifically created for and used in the film.

(4) Where this section applies, the absence of signature by or on behalf of the author does not exclude the operation of section 91(1) (effect of purported assignment of future copyright).

(5) The reference in subsection (1) to an agreement concluded between an author and a film producer includes any agreement having effect between those persons, whether made by them directly or through intermediaries.

(6) Section 93B (right to equitable remuneration on transfer of rental right) applies where there is a presumed transfer by virtue of this section as in the case of an actual transfer.]

F252 [Right to equitable remuneration where rental right transferred

F253

93B.- Right to equitable remuneration where rental right transferred.

(1) Where an author to whom this section applies has transferred his rental right concerning a sound recording or a film to the producer of the sound recording or film, he retains the right to equitable remuneration for the rental.The authors to whom this section applies are:

(a) the author of a literary, dramatic, musical or artistic work, and

(b) the principal director of a film.

(2) The right to equitable remuneration under this section may not be assigned by the author except to a collecting society for the purpose of enabling it to enforce the right on his behalf.The right is, however, transmissible by testamentary disposition or by operation of law as personal or moveable property; and it may be assigned or further transmitted by any person into whose hands it passes.

(3) Equitable remuneration under this section is payable by the person for the time being entitled to the rental right, that is, the person to whom the right was transferred or any successor in title of his.

(4) The amount payable by way of equitable remuneration is as agreed by or on behalf of the persons by and to whom it is payable, subject to section 93C (reference of amount to Copyright Tribunal).

(5) An agreement is of no effect in so far as it purports to exclude or restrict the right to equitable remuneration under this section.

(6) References in this section to the transfer of rental right by one person to another include any arrangement having that effect, whether made by them directly or through intermediaries.

(7) In this section a “collecting society” means a society or other organisation which has as its main object, or one of its main objects, the exercise of the right to equitable remuneration under this section on behalf of more than one author.

F254

93C.- Equitable remuneration: reference of amount to Copyright Tribunal.

(1) In default of agreement as to the amount payable by way of equitable remuneration under section 93B, the person by or to whom it is payable may apply to the Copyright Tribunal to determine the amount payable.

(2) A person to or by whom equitable remuneration is payable under that section may also apply to the Copyright Tribunal:

(a) to vary any agreement as to the amount payable, or

(b) to vary any previous determination of the Tribunal as to that matter; but except with the special leave of the Tribunal no such application may be made within twelve months from the date of a previous determination.An order made on an application under this subsection has effect from the date on which it is made or such later date as may be specified by the Tribunal.

(3) On an application under this section the Tribunal shall consider the matter and make such order as to the method of calculating and paying equitable remuneration as it may determine to be reasonable in the circumstances, taking into account the importance of the contribution of the author to the film or sound recording.

(4) Remuneration shall not be considered inequitable merely because it was paid by way of a single payment or at the time of the transfer of the rental right.

(5) An agreement is of no effect in so far as it purports to prevent a person questioning the amount of equitable remuneration or to restrict the powers of the Copyright Tribunal under this section.]

Moral rights

94.- Moral rights not assignable.

The rights conferred by Chapter IV (moral rights) are not assignable.

95.- Transmission of moral rights on death.

(1) On the death of a person entitled to the right conferred by section 77 (right to identification of author or director), section 80 (right to object to derogatory treatment of work) or section 85 (right to privacy of certain photographs and films):

(a) the right passes to such person as he may by testamentary disposition specifically direct,

(b) if there is no such direction but the copyright in the work in question forms part of his estate, the right passes to the person to whom the copyright passes, and

(c) if or to the extent that the right does not pass under paragraph (a) or (b) it is exercisable by his personal representatives.

(2) Where copyright forming part of a person’s estate passes in part to one person and in part to another, as for example where a bequest is limited so as to apply:

(a) to one or more, but not all, of the things the copyright owner has the exclusive right to do or authorise, or

(b) to part, but not the whole, of the period for which the copyright is to subsist,any right which passes with the copyright by virtue of subsection (1) is correspondingly divided.

(3 )Where by virtue of subsection (1)(a) or (b) a right becomes exercisable by more than one person:

(a) it may, in the case of the right conferred by section 77 (right to identification of author or director), be asserted by any of them;

(b) it is, in the case of the right conferred by section 80 (right to object to derogatory treatment of work) or section 85 (right to privacy of certain photographs and films), a right exercisable by each of them and is satisfied in relation to any of them if he consents to the treatment or act in question; and

(4) A consent or waiver previously given or made binds any person to whom a right passes by virtue of subsection (1).

(5) Any infringement after a person’s death of the right conferred by section 84 (false attribution) is actionable by his personal representatives.

(6) Any damages recovered by personal representatives by virtue of this section in respect of an infringement after a person’s death shall devolve as part of his estate as if the right of action had subsisted and been vested in him immediately before his death.

Chapter VI.- Remedies for Infringement

Rights and remedies of copyright owner

96.- Infringement actionable by copyright owner.

(1) An infringement of copyright is actionable by the copyright owner.

(2) In an action for infringement of copyright all such relief by way of damages, injunctions, accounts or otherwise is available to the plaintiff as is available in respect of the infringement of any other property right.

(3) This section has effect subject to the following provisions of this Chapter.

97.- Provisions as to damages in infringement action.

(1) Where in an action for infringement of copyright it is shown that at the time of the infringement the defendant did not know, and had no reason to believe, that copyright subsisted in the work to which the action relates, the plaintiff is not entitled to damages against him, but without prejudice to any other remedy.

(2) The court may in an action for infringement of copyright having regard to all the circumstances, and in particular to:

(a) the flagrancy of the infringement, and

(b) any benefit accruing to the defendant by reason of the infringement,award such additional damages as the justice of the case may require.

[F255

97A.- Injunctions against service providers

(1) The High Court (in Scotland, the Court of Session) shall have power to grant an injunction against a service provider, where that service provider has actual knowledge of another person using their service to infringe copyright.

(2) In determining whether a service provider has actual knowledge for the purpose of this section, a court shall take into account all matters which appear to it in the particular circumstances to be relevant and, amongst other things, shall have regard to:

(a) whether a service provider has received a notice through a means of contact made available in accordance with regulation 6(1)(c) of the Electronic Commerce (EC Directive) Regulations 2002 (SI 2002/2013); and

(b )the extent to which any notice includes:

(i) the full name and address of the sender of the notice;

(ii) details of the infringement in question.

(3) In this section “ service provider ” has the meaning given to it by regulation 2 of the Electronic Commerce ( EC Directive) Regulations 2002. ]

98.- Undertaking to take licence of right in infringement proceedings.

(1) If in proceedings for infringement of copyright in respect of which a licence is available as of right under section 144 (powers exercisable in consequence of report of [F256Competition and Markets Authority]) the defendant undertakes to take a licence on such terms as may be agreed or, in default of agreement, settled by the Copyright Tribunal under that section:

(a) no injunction shall be granted against him,

(b) no order for delivery up shall be made under section 99, and

(c) the amount recoverable against him by way of damages or on an account of profits shall not exceed double the amount which would have been payable by him as licensee if such a licence on those terms had been granted before the earliest infringement.

(2) An undertaking may be given at any time before final order in the proceedings, without any admission of liability.

(3) Nothing in this section affects the remedies available in respect of an infringement committed before licences of right were available.

99.- Order for delivery up.

(1) Where a person:

(a) has an infringing copy of a work in his possession, custody or control in the course of a business, or

(b) has in his possession, custody or control an article specifically designed or adapted for making copies of a particular copyright work, knowing or having reason to believe that it has been or is to be used to make infringing copies,the owner of the copyright in the work may apply to the court for an order that the infringing copy or article be delivered up to him or to such other person as the court may direct.

(2) An application shall not be made after the end of the period specified in section 113 (period after which remedy of delivery up not available); and no order shall be made unless the court also makes, or it appears to the court that there are grounds for making, an order under section 114 (order as to disposal of infringing copy or other article).

(3) A person to whom an infringing copy or other article is delivered up in pursuance of an order under this section shall, if an order under section 114 is not made, retain it pending the making of an order, or the decision not to make an order, under that section.

(4) Nothing in this section affects any other power of the court.

100.- Right to seize infringing copies and other articles.

(1) An infringing copy of a work which is found exposed or otherwise immediately available for sale or hire, and in respect of which the copyright owner would be entitled to apply for an order under section 99, may be seized and detained by him or a person authorised by him.The right to seize and detain is exercisable subject to the following conditions and is subject to any decision of the court under section 114.

(2) Before anything is seized under this section notice of the time and place of the proposed seizure must be given to a local police station.

(3) A person may for the purpose of exercising the right conferred by this section enter premises to which the public have access but may not seize anything in the possession, custody or control of a person at a permanent or regular place of business of his, and may not use any force.

(4) At the time when anything is seized under this section there shall be left at the place where it was seized a notice in the prescribed form containing the prescribed particulars as to the person by whom or on whose authority the seizure is made and the grounds on which it is made.

(5) In this section:

“premises” includes land, buildings, moveable structures, vehicles, vessels, aircraft and hovercraft; and “prescribed” means prescribed by order of the Secretary of State.

(6) An order of the Secretary of State under this section shall be made by statutory instrument which shall be subject to annulment in pursuance of a resolution of either House of Parliament.

Rights and remedies of exclusive licensee

101.- Rights and remedies of exclusive licensee.

(1) An exclusive licensee has, except against the copyright owner, the same rights and remedies in respect of matters occurring after the grant of the licence as if the licence had been an assignment.

(2) His rights and remedies are concurrent with those of the copyright owner; and references in the relevant provisions of this Part to the copyright owner shall be construed accordingly.

(3) In an action brought by an exclusive licensee by virtue of this section a defendant may avail himself of any defence which would have been available to him if the action had been brought by the copyright owner.

[F257

101A.- Certain infringements actionable by a non-exclusive licensee

(1) A non-exclusive licensee may bring an action for infringement of copyright if:

(a) the infringing act was directly connected to a prior licensed act of the licensee; and

(b) the licence:

(i) is in writing and is signed by or on behalf of the copyright owner; and

(ii) expressly grants the non-exclusive licensee a right of action under this section.

(2) In an action brought under this section, the non-exclusive licensee shall have the same rights and remedies available to him as the copyright owner would have had if he had brought the action.

(3) The rights granted under this section are concurrent with those of the copyright owner and references in the relevant provisions of this Part to the copyright owner shall be construed accordingly.

(4) In an action brought by a non-exclusive licensee by virtue of this section a defendant may avail himself of any defence which would have been available to him if the action had been brought by the copyright owner.

(5) Subsections (1) to (4) of section 102 shall apply to a non-exclusive licensee who has a right of action by virtue of this section as it applies to an exclusive licensee.

(6) In this section a “ non-exclusive licensee ” means the holder of a licence authorising the licensee to exercise a right which remains exercisable by the copyright owner. ]

102.- Exercise of concurrent rights.

(1) Where an action for infringement of copyright brought by the copyright owner or an exclusive licensee relates (wholly or partly) to an infringement in respect of which they have concurrent rights of action, the copyright owner or, as the case may be, the exclusive licensee may not, without the leave of the court, proceed with the action unless the other is either joined as a plaintiff or added as a defendant.

(2) A copyright owner or exclusive licensee who is added as a defendant in pursuance of subsection (1) is not liable for any costs in the action unless he takes part in the proceedings.

(3) The above provisions do not affect the granting of interlocutory relief on an application by a copyright owner or exclusive licensee alone.

(4) Where an action for infringement of copyright is brought which relates (wholly or partly) to an infringement in respect of which the copyright owner and an exclusive licensee have or had concurrent rights of action:

(a) the court shall in assessing damages take into account:

(i) the terms of the licence, and

(ii) any pecuniary remedy already awarded or available to either of them in respect of the infringement;

(b) no account of profits shall be directed if an award of damages has been made, or an account of profits has been directed, in favour of the other of them in respect of the infringement; and

(c) the court shall if an account of profits is directed apportion the profits between them as the court considers just, subject to any agreement between them;and these provisions apply whether or not the copyright owner and the exclusive licensee are both parties to the action.

(5) The copyright owner shall notify any exclusive licensee having concurrent rights before applying for an order under section 99 (order for delivery up) or exercising the right conferred by section 100 (right of seizure); and the court may on the application of the licensee make such order under section 99 or, as the case may be, prohibiting or permitting the exercise by the copyright owner of the right conferred by section 100, as it thinks fit having regard to the terms of the licence.

Remedies for infringement of moral rights

103.- Remedies for infringement of moral rights.

(1) An infringement of a right conferred by Chapter IV (moral rights) is actionable as a breach of statutory duty owed to the person entitled to the right.

(2) In proceedings for infringement of the right conferred by section 80 (right to object to derogatory treatment of work) the court may, if it thinks it is an adequate remedy in the circumstances, grant an injunction on terms prohibiting the doing of any act unless a disclaimer is made, in such terms and in such manner as may be approved by the court, dissociating the author or director from the treatment of the work.

Presumptions

104.- Presumptions relevant to literary, dramatic, musical and artistic works.

(1) The following presumptions apply in proceedings brought by virtue of this Chapter with respect to a literary, dramatic, musical or artistic work.

(2) Where a name purporting to be that of the author appeared on copies of the work as published or on the work when it was made, the person whose name appeared shall be presumed, until the contrary is proved:

(a) to be the author of the work;

(b) to have made it in circumstances not falling within section 11(2), 163, 165 or 168 (works produced in course of employment, Crown copyright, Parliamentary copyright or copyright of certain international organisations).

(3) In the case of a work alleged to be a work of joint authorship, subsection (2) applies in relation to each person alleged to be one of the authors.

(4) Where no name purporting to be that of the author appeared as mentioned in subsection (2) but:

(a) the work qualifies for copyright protection by virtue of section 155 (qualification by reference to country of first publication), and

(b) a name purporting to be that of the publisher appeared on copies of the work as first published,the person whose name appeared shall be presumed, until the contrary is proved, to have been the owner of the copyright at the time of publication.

(5) If the author of the work is dead or the identity of the author cannot be ascertained by reasonable inquiry, it shall be presumed, in the absence of evidence to the contrary:

(a) that the work is an original work, and

(b) that the plaintiff’s allegations as to what was the first publication of the work and as to the country of first publication are correct.

105.- Presumptions relevant to sound recordings and films.

(1) In proceedings brought by virtue of this Chapter with respect to a sound recording, where copies of the recording as issued to the public bear a label or other mark stating:

(a) that a named person was the owner of copyright in the recording at the date of issue of the copies, or

(b) that the recording was first published in a specified year or in a specified country,the label or mark shall be admissible as evidence of the facts stated and shall be presumed to be correct until the contrary is proved.

(2) In proceedings brought by virtue of this Chapter with respect to a film, where copies of the film as issued to the public bear a statement:

(a) that a named person was the [F258director or producer] of the film,

F259[

(aa) that a named person was the principal director, the author of the screenplay, the author of the dialogue or the composer of music specifically created for and used in the film,]

(b) that a named person was the owner of copyright in the film at the date of issue of the copies, or

(c) that the film was first published in a specified year or in a specified country,the statement shall be admissible as evidence of the facts stated and shall be presumed to be correct until the contrary is proved.

(3) In proceedings brought by virtue of this Chapter with respect to a computer program, where copies of the program are issued to the public in electronic form bearing a statement:

(a) that a named person was the owner of copyright in the program at the date of issue of the copies, or

(b) that the program was first published in a specified country or that copies of it were first issued to the public in electronic form in a specified year,the statement shall be admissible as evidence of the facts stated and shall be presumed to be correct until the contrary is proved.

(4) The above presumptions apply equally in proceedings relating to an infringement alleged to have occurred before the date on which the copies were issued to the public.

(5) In proceedings brought by virtue of this Chapter with respect to a film, where the film as shown in public [F260or communicated to the public] bears a statement:

(a) that a named person was the [F258director or producer] of the film, or

F261[

(aa) that a named person was the principal director of the film, the author of the screenplay, the author of the dialogue or the composer of music specifically created for and used in the film, or,]

(b) that a named person was the owner of copyright in the film immediately after it was made,the statement shall be admissible as evidence of the facts stated and shall be presumed to be correct until the contrary is proved.

This presumption applies equally in proceedings relating to an infringement alleged to have occurred before the date on which the film was shown in public, broadcast or included in a cable programme service.

F262[

(6) For the purposes of this section, a statement that a person was the director of a film shall be taken, unless a contrary indication appears, as meaning that he was the principal director of the film.]

106.- Presumptions relevant to works subject to Crown copyright.

In proceedings brought by virtue of this Chapter with respect to a literary, dramatic or musical work in which Crown copyright subsists, where there appears on printed copies of the work a statement of the year in which the work was first published commercially, that statement shall be admissible as evidence of the fact stated and shall be presumed to be correct in the absence of evidence to the contrary.

Offences

107.- Criminal liability for making or dealing with infringing articles, &c.

(1) A person commits an offence who, without the licence of the copyright owner:

(a) makes for sale or hire, or

(b )imports into the United Kingdom otherwise than for his private and domestic use, or

(d) in the course of a business :

(i) sells or lets for hire, or

(ii) offers or exposes for sale or hire, or

(iii) exhibits in public, or

(iv) distributes, or

(e) distributes otherwise than in the course of a business to such an extent as to affect prejudicially the owner of the copyright,an article which is, and which he knows or has reason to believe is, an infringing copy of a copyright work.

(2) A person commits an offence who:

(a) makes an article specifically designed or adapted for making copies of a particular copyright work, or

(b) has such an article in his possession,knowing or having reason to believe that it is to be used to make infringing copies for sale or hire or for use in the course of a business.

[F263

(2A) A person (“P”) who infringes copyright in a work by communicating the work to the public commits an offence if P:

(a) knows or has reason to believe that P is infringing copyright in the work, and

(b) either:

(i) intends to make a gain for P or another person, or

(ii) knows or has reason to believe that communicating the work to the public will cause loss to the owner of the copyright, or will expose the owner of the copyright to a risk of loss.

(2B) For the purposes of subsection (2A):

(a) “gain” and “loss”:

(i) extend only to gain or loss in money, and

(ii) include any such gain or loss whether temporary or permanent, and

(b) “loss” includes a loss by not getting what one might get.]

(3) Where copyright is infringed (otherwise than by reception of a [F264communication to the public]):

(a) by the public performance of a literary, dramatic or musical work, or

(b) by the playing or showing in public of a sound recording or film,any person who caused the work to be so performed, played or shown is guilty of an offence if he knew or had reason to believe that copyright would be infringed.

(4) A person guilty of an offence under subsection (1)(a), (b), (d)(iv) or (e) is liable:

(a) on summary conviction to imprisonment for a term not exceeding six months or [F265a fine], or both;

(b) on conviction on indictment to a fine or imprisonment for a term not exceeding [F266ten] years, or both.

[F267

(4A) A person guilty of an offence under subsection (2A) is liable:

(a) on summary conviction to imprisonment for a term not exceeding three months or [F268a fine], or both;

(b) on conviction on indictment to a fine or imprisonment for a term not exceeding [F269ten] years, or both.]

(5) A person guilty of any other offence under this section is liable on summary conviction to imprisonment for a term not exceeding [F270three] months or a fine not exceeding level 5 on the standard scale, or both.

(6) Sections 104 to 106 (presumptions as to various matters connected with copyright) do not apply to proceedings for an offence under this section; but without prejudice to their application in proceedings for an order under section 108 below.

[F271

107.- A Enforcement by local weights and measures authority.

(1) It is the duty of every local weights and measures authority to enforce within their area the provisions of section 107.

F272

(2). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(3) Subsection (1) above does not apply in relation to the enforcement of section 107 in Northern Ireland, but it is the duty of the Department of Economic Development to enforce that section in Northern Ireland.F273…

[F274

(3A) For the investigatory powers available to a local weights and measures authority or the Department of Enterprise, Trade and Investment in Northern Ireland for the purposes of the duties in this section, see Schedule 5 to the Consumer Rights Act 2015.]

(4) Any enactment which authorises the disclosure of information for the purpose of facilitating the enforcement of the Trade Descriptions Act 1968 shall apply as if section 107 were contained in that Act and as if the functions of any person in relation to the enforcement of that section were functions under that Act.

(5) Nothing in this section shall be construed as authorising a local weights and measures authority to bring proceedings in Scotland for an offence.]

108.- Order for delivery up in criminal proceedings.

(1) The court before which proceedings are brought against a person for an offence under section 107 may, if satisfied that at the time of his arrest or charge:

(a) he had in his possession, custody or control in the course of a business an infringing copy of a copyright work, or

(b) he had in his possession, custody or control an article specifically designed or adapted for making copies of a particular copyright work, knowing or having reason to believe that it had been or was to be used to make infringing copies,order that the infringing copy or article be delivered up to the copyright owner or to such other person as the court may direct.

(2) For this purpose a person shall be treated as charged with an offence:

(a) in England, Wales and Northern Ireland, when he is orally charged or is served with a summons or indictment;

(b) in Scotland, when he is cautioned, charged or served with a complaint or indictment.

(3) An order may be made by the court of its own motion or on the application of the prosecutor (or, in Scotland, the Lord Advocate or procurator-fiscal), and may be made whether or not the person is convicted of the offence, but shall not be made:

(a) after the end of the period specified in section 113 (period after which remedy of delivery up not available), or

(b) if it appears to the court unlikely that any order will be made under section 114 (order as to disposal of infringing copy or other article).

(4) An appeal lies from an order made under this section by a magistrates’ court:

(a) in England and Wales, to the Crown Court, and

(b) in Northern Ireland, to the county court;and in Scotland, where an order has been made under this section, the person from whose possession, custody or control the infringing copy or article has been removed may, without prejudice to any other form of appeal under any rule of law, appeal against that order in the same manner as against sentence.

(5) A person to whom an infringing copy or other article is delivered up in pursuance of an order under this section shall retain it pending the making of an order, or the decision not to make an order, undersection 114.

(6) Nothing in this section affects the powers of the court under [F275section 143 of the Powers of Criminal Courts (Sentencing)Act 2000], [F276Part II of the Proceeds of Crime (Scotland) Act 1995] or [F277Article 11 of the Criminal Justice (Northern Ireland) Order 1994] (general provisions as to forfeiture in criminal proceedings).

109.- Search warrants.

(1) Where a justice of the peace (in Scotland, a sheriff or justice of the peace) is satisfied by information on oath given by a constable (in Scotland, by evidence on oath) that there are reasonable grounds for believing:

(a )that an offence under [F278section 107(1), (2) or (2A)] has been or is about to be committed in any premises, and

(b) that evidence that such an offence has been or is about to be committed is in those premises,he may issue a warrant authorising a constable to enter and search the premises, using such reasonable force as is necessary.

(2) The power conferred by subsection (1) does not, in England and Wales, extend to authorising a search for material of the kinds mentioned in section 9(2) of the M7Police and Criminal Evidence Act 1984 (certain classes of personal or confidential material).

(3) A warrant under this section:

(a) may authorise persons to accompany any constable executing the warrant, and

(b) remains in force for [F279three months] from the date of its issue.

(4) In executing a warrant issued under this section a constable may seize an article if he reasonably believes that it is evidence that any offence under [F280section 107(1), (2) or (2A)] has been or is about to be committed.

(5) In this section “premises” includes land, buildings [F281fixed or], moveable structures, vehicles, vessels, aircraft and hovercraft.

110.- Offence by body corporate: liability of officers.

(1) Where an offence under section 107 committed by a body corporate is proved to have been committed with the consent or connivance of a director, manager, secretary or other similar officer of the body, or a person purporting to act in any such capacity, he as well as the body corporate is guilty of the offence and liable to be proceeded against and punished accordingly.

(2) In relation to a body corporate whose affairs are managed by its members “director” means a member of the body corporate.

Provision for preventing importation of infringing copies

111.- Infringing copies may be treated as prohibited goods.

(1) The owner of the copyright in a published literary, dramatic or musical work may give notice in writing to the Commissioners of Customs and Excise:

(a) that he is the owner of the copyright in the work, and

(b) that he requests the Commissioners, for a period specified in the notice, to treat as prohibited goods printed copies of the work which are infringing copies.

(2) The period specified in a notice under subsection (1) shall not exceed five years and shall not extend beyond the period for which copyright is to subsist.

(3) The owner of the copyright in a sound recording or film may give notice in writing to the Commissioners of Customs and Excise:

(a) that he is the owner of the copyright in the work,

(b) that infringing copies of the work are expected to arrive in the United Kingdom at a time and a place specified in the notice, and

[F282

(3A) The Commissioners may treat as prohibited goods only infringing copies of works which arrive in the United Kingdom:

(a) from outside the European Economic Area, or

(b) from within that Area but not having been entered for free circulation.

[F283

(3B) This section does not apply to goods placed in, or expected to be placed in, one of the situations referred to in Article 1(1), in respect of which an application may be made under [F284Article 3 of Regulation (EU) No 608/2013 of the European Parliament and of the Council of 12 June 2013 concerning customs enforcement of intellectual property rights].]]

(4) When a notice is in force under this section the importation of goods to which the notice relates, otherwise than by a person for his private and domestic use, [F285subject to subsections (3A) and (3B), is prohibited]; but a person is not by reason of the prohibition liable to any penalty other than forfeiture of the goods.

112.- Power of Commissioners of Customs and Excise to make regulations.

(1) The Commissioners of Customs and Excise may make regulations prescribing the form in which notice is to be given under section 111 and requiring a person giving notice:

(a) to furnish the Commissioners with such evidence as may be specified in the regulations, either on giving notice or when the goods are imported, or at both those times, and

(b) to comply with such other conditions as may be specified in the regulations.

(2) The regulations may, in particular, require a person giving such a notice:

(a) to pay such fees in respect of the notice as may be specified by the regulations;

(b) to give such security as may be so specified in respect of any liability or expense which the Commissioners may incur in consequence of the notice by reason of the detention of any article or anything done to an article detained;

(3) The regulations may make different provision as respects different classes of case to which they apply and may include such incidental and supplementary provisions as the Commissioners consider expedient.

(4) Regulations under this section shall be made by statutory instrument which shall be subject to annulment in pursuance of a resolution of either House of Parliament.

(5) F286. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Supplementary

113.- Period after which remedy of delivery up not available.

(1) An application for an order under section 99 (order for delivery up in civil proceedings) may not be made after the end of the period of six years from the date on which the infringing copy or article in question was made, subject to the following provisions.

(2) If during the whole or any part of that period the copyright owner:

(a) is under a disability, or

(b) is prevented by fraud or concealment from discovering the facts entitling him to apply for an order,an application may be made at any time before the end of the period of six years from the date on which he ceased to be under a disability or, as the case may be, could with reasonable diligence have discovered those facts.

(3) In subsection (2) “disability”:

(a) in England and Wales, has the same meaning as in the M8Limitation Act 1980;

(b) in Scotland, means legal disability within the meaning of the M9Prescription and Limitation (Scotland) Act 1973;

(4) An order under section 108 (order for delivery up in criminal proceedings) shall not, in any case, be made after the end of the period of six years from the date on which the infringing copy or article in question was made.

114.- Order as to disposal of infringing copy or other article.

(1) An application may be made to the court for an order that an infringing copy or other article delivered up in pursuance of an order under section 99 or 108, or seized and detained in pursuance of the right conferred by section 100, shall be:

(a) forfeited to the copyright owner, or

(b) destroyed or otherwise dealt with as the court may think fit,or for a decision that no such order should be made.

(2) In considering what order (if any) should be made, the court shall consider whether other remedies available in an action for infringement of copyright would be adequate to compensate the copyright owner and to protect his interests.

(3) Provision shall be made by rules of court as to the service of notice on persons having an interest in the copy or other articles, and any such person is entitled:

(a) to appear in proceedings for an order under this section, whether or not he was served with notice, and

(b) to appeal against any order made, whether or not he appeared;and an order shall not take effect until the end of the period within which notice of an appeal may be given or, if before the end of that period notice of appeal is duly given, until the final determination or abandonment of the proceedings on the appeal.

(4) Where there is more than one person interested in a copy or other article, the court shall make such order as it thinks just and may (in particular) direct that the article be sold, or otherwise dealt with, and the proceeds divided.

(5) If the court decides that no order should be made under this section, the person in whose possession, custody or control the copy or other article was before being delivered up or seized is entitled to its return.

(6) References in this section to a person having an interest in a copy or other article include any person in whose favour an order could be made in respect of it

[F287

(a) under this section or under section 204 or 231 of this Act;

(b) under section 24D of the Registered Designs Act 1949;

(c) under section 19 of Trade Marks Act 1994 (including that section as applied by regulation 4 of the Community Trade Mark Regulations 2006 (SI 2006/1027)); or

(d) under regulation 1C of the Community Design Regulations 2005 (SI 2005/2339).][F288

114A.- Forfeiture of infringing copies, etc.: England and Wales or Northern Ireland

(1) In England and Wales or Northern Ireland where there have come into the possession of any person in connection with the investigation or prosecution of a relevant offence:

(a) infringing copies of a copyright work, or

(b) articles specifically designed or adapted for making copies of a particular copyright work,that person may apply under this section for an order for the forfeiture of the infringing copies or articles.

(2) For the purposes of this section “relevant offence” means:

(a) an offence under [F289section 107(1), (2) or (2A)] (criminal liability for making or dealing with infringing articles, etc.),

(b) an offence under the Trade Descriptions Act 1968 (c. 29),

[F290

(ba) an offence under the Business Protection from Misleading Marketing Regulations 2008,

(bb) an offence under the Consumer Protection from Unfair Trading Regulations 2008, or]

(3) An application under this section may be made:

(a) where proceedings have been brought in any court for a relevant offence relating to some or all of the infringing copies or articles, to that court, or

(b) where no application for the forfeiture of the infringing copies or articles has been made under paragraph (a), by way of complaint to a magistrates’ court.

(4) On an application under this section, the court shall make an order for the forfeiture of any infringing copies or articles only if it is satisfied that a relevant offence has been committed in relation to the infringing copies or articles.

(5) A court may infer for the purposes of this section that such an offence has been committed in relation to any infringing copies or articles if it is satisfied that such an offence has been committed in relation to infringing copies or articles which are representative of the infringing copies or articles in question (whether by reason of being of the same design or part of the same consignment or batch or otherwise).

(6) Any person aggrieved by an order made under this section by a magistrates’ court, or by a decision of such a court not to make such an order, may appeal against that order or decision:

(a) in England and Wales, to the Crown Court, or

(b) in Northern Ireland, to the county court.

(7) An order under this section may contain such provision as appears to the court to be appropriate for delaying the coming into force of the order pending the making and determination of any appeal (including any application under section 111 of the Magistrates’ Courts Act 1980 (c. 43) or Article 146 of the Magistrates’ Courts (Northern Ireland) Order 1981 (S.I. 1981/1675 (N.I. 26)) (statement of case)).

(8) Subject to subsection (9), where any infringing copies or articles are forfeited under this section they shall be destroyed in accordance with such directions as the court may give.

(9) On making an order under this section the court may direct that the infringing copies or articles to which the order relates shall (instead of being destroyed) be forfeited to the owner of the copyright in question or dealt with in such other way as the court considers appropriate.]

F291

114B.- Forfeiture of infringing copies, etc.: Scotland

(1) In Scotland the court may make an order under this section for the forfeiture of any:

(a) infringing copies of a copyright work, or

(b) articles specifically designed or adapted for making copies of a particular copyright work.

(2) An order under this section may be made:

(a) on an application by the procurator-fiscal made in the manner specified in section 134 of the Criminal Procedure (Scotland) Act 1995 (c. 46), or

(b) where a person is convicted of a relevant offence, in addition to any other penalty which the court may impose.

(3) On an application under subsection (2)(a), the court shall make an order for the forfeiture of any infringing copies or articles only if it is satisfied that a relevant offence has been committed in relation to the infringing copies or articles.

(4) The court may infer for the purposes of this section that such an offence has been committed in relation to any infringing copies or articles if it is satisfied that such an offence has been committed in relation to infringing copies or articles which are representative of the infringing copies or articles in question (whether by reason of being of the same design or part of the same consignment or batch or otherwise).

(5) The procurator-fiscal making the application under subsection (2)(a) shall serve on any person appearing to him to be the owner of, or otherwise to have an interest in, the infringing copies or articles to which the application relates a copy of the application, together with a notice giving him the opportunity to appear at the hearing of the application to show cause why the infringing copies or articles should not be forfeited.

(6) Service under subsection (5) shall be carried out, and such service may be proved, in the manner specified for citation of an accused in summary proceedings under the Criminal Procedure (Scotland) Act 1995.

(7) Any person upon whom notice is served under subsection (5) and any other person claiming to be the owner of, or otherwise to have an interest in, infringing copies or articles to which an application under this section relates shall be entitled to appear at the hearing of the application to show cause why the infringing copies or articles should not be forfeited.

(8) The court shall not make an order following an application under subsection (2)(a):

(a) if any person on whom notice is served under subsection (5) does not appear, unless service of the notice on that person is proved, or

(b) if no notice under subsection (5) has been served, unless the court is satisfied that in the circumstances it was reasonable not to serve such notice.

(9) Where an order for the forfeiture of any infringing copies or articles is made following an application under subsection (2)(a), any person who appeared, or was entitled to appear, to show cause why infringing copies or articles should not be forfeited may, within 21 days of the making of the order, appeal to the High Court by Bill of Suspension.

(10) Section 182(5)(a) to (e) of the Criminal Procedure (Scotland) Act 1995 (c. 46) shall apply to an appeal under subsection (9) as it applies to a stated case under Part 2 of that Act.

(11) An order following an application under subsection (2)(a) shall not take effect:

(a) until the end of the period of 21 days beginning with the day after the day on which the order is made, or

(b) if an appeal is made under subsection (9) above within that period, until the appeal is determined or abandoned.

(12) An order under subsection (2)(b) shall not take effect:

(a) until the end of the period within which an appeal against the order could be brought under the Criminal Procedure (Scotland) Act 1995, or

(b) if an appeal is made within that period, until the appeal is determined or abandoned.

(13) Subject to subsection (14), infringing copies or articles forfeited under this section shall be destroyed in accordance with such directions as the court may give.

(14) On making an order under this section the court may direct that the infringing copies or articles to which the order relates shall (instead of being destroyed) be forfeited to the owner of the copyright in question or dealt with in such other way as the court considers appropriate.

(15) For the purposes of this section:

[F292“relevant offence” means:

(a) an offence under section 107(1), (2) or (2A) (criminal liability for making or dealing with infringing articles, etc),

(b) an offence under the Trade Descriptions Act 1968,

(d) an offence under the Consumer Protection from Unfair Trading Regulations 2008, or

(e) any offence involving dishonesty or deception;]

“the court” means:

(a) in relation to an order made on an application under subsection (2)(a), the sheriff, and

(b) in relation to an order made under subsection (2)(b), the court which imposed the penalty.

115.- Jurisdiction of county court and sheriff court.

(1) In England [F293and Wales the county court and in] Northern Ireland a county court may entertain proceedings under:

section 99 (order for delivery up of infringing copy or other article),

section 102(5) (order as to exercise of rights by copyright owner where exclusive licensee has concurrent rights), or

section 114 (order as to disposal of infringing copy or other article),

[F294 save that, in Northern Ireland, a county court may entertain such proceedings only] where the value of the infringing copies and other articles in question does not exceed the county court limit for actions in tort.

(2) In Scotland proceedings for an order under any of those provisions may be brought in the sheriff court.

(3) Nothing in this section shall be construed as affecting the jurisdiction of the High Court or, in Scotland, the Court of Session.

Chapter VII.- Copyright Licensing

Licensing schemes and licensing bodies

116.- Licensing schemes and licensing bodies.

(1) In this Part a “licensing scheme” means a scheme setting out:

(a) the classes of case in which the operator of the scheme, or the person on whose behalf he acts, is willing to grant copyright licences, and

(b) the terms on which licences would be granted in those classes of case;and for this purpose a “scheme” includes anything in the nature of a scheme, whether described as a scheme or as a tariff or by any other name.

(2) In this Chapter a “licensing body” means

[F295

(a) a society or other organisation which has as its main object, or one of its main objects, the negotiation or granting, either as owner or prospective owner of copyright or as agent for him, of copyright licences, and whose objects include the granting of licences covering works of more than one author] [F296, or,

(b) any other organisation which is a collective management organisation as defined by regulation 2 of the Collective Management of Copyright (EU Directive) Regulations 2016].

(3) In this section “copyright licences” means licences to do, or authorise the doing of, any of the acts restricted by copyright.

(4) References in this Chapter to licences or licensing schemes covering works of more than one author do not include licences or schemes covering only:

(a) a single collective work or collective works of which the authors are the same, or

(b) works made by, or by employees of or commissioned by, a single individual, firm, company or group of companies.For this purpose a group of companies means a holding company and its subsidiaries, within the meaning of [F297section 1159 of the Companies Act 2006].

[F298

(5) Schedule A1 confers powers to provide for the regulation of licensing bodies.][F299 Orphan works licensing and extended collective licensing

116A.- Power to provide for licensing of orphan works

(1) The Secretary of State may by regulations provide for the grant of licences in respect of works that qualify as orphan works under the regulations.

(2) The regulations may:

(a) specify a person or a description of persons authorised to grant licences, or

(b) provide for a person designated in the regulations to specify a person or a description of persons authorised to grant licences

(3) The regulations must provide that, for a work to qualify as an orphan work, it is a requirement that the owner of copyright in it has not been found after a diligent search made in accordance with the regulations.

(4) The regulations may provide for the granting of licences to do, or authorise the doing of, any act restricted by copyright that would otherwise require the consent of the missing owner.

(5) The regulations must provide for any licence:

(a) to have effect as if granted by the missing owner;

(b) not to give exclusive rights;

(6) The regulations may apply to a work although it is not known whether copyright subsists in it, and references to a missing owner and a right or interest of a missing owner are to be read as including references to a supposed owner and a supposed right or interest.

116B.- Extended collective licensing

(1) The Secretary of State may by regulations provide for a licensing body that applies to the Secretary of State under the regulations to be authorised to grant copyright licences in respect of works in which copyright is not owned by the body or a person on whose behalf the body acts.

(2) An authorisation must specify:

(a) the types of work to which it applies, and

(b) the acts restricted by copyright that the licensing body is authorised to license.

(3) The regulations must provide for the copyright owner to have a right to limit or exclude the grant of licences by virtue of the regulations.

(4) The regulations must provide for any licence not to give exclusive rights.

(5) In this section “ copyright licences ” has the same meaning as in section 116.

(6) Nothing in this section applies in relation to Crown copyright or Parliamentary copyright.

116C.- General provision about licensing under sections 116A and 116B

(1) This section and section 116D apply to regulations under sections 116A and 116B.

(2) The regulations may provide for a body to be or remain authorised to grant licences only if specified requirements are met, and for a question whether they are met to be determined by a person, and in a manner, specified in the regulations.

(3) The regulations may specify other matters to be taken into account in any decision to be made under the regulations as to whether to authorise a person to grant licences.

(4) The regulations must provide for the treatment of any royalties or other sums paid in respect of a licence, including:

(a) the deduction of administrative costs;

(b) the period for which sums must be held;

(5) The regulations must provide for circumstances in which an authorisation to grant licences may be withdrawn, and for determining the rights and obligations of any person if an authorisation is withdrawn.

(6) The regulations may include other provision for the purposes of authorisation and licensing, including in particular provision:

(a) for determining the rights and obligations of any person if a work ceases to qualify as an orphan work (or ceases to qualify by reference to any copyright owner), or if a rights owner exercises the right referred to in section 116B(3), while a licence is in force;

(b) about maintenance of registers and access to them;

(d) for a right conferred by section 77 to be treated as having been asserted in accordance with section 78;

(e) for the payment of fees to cover administrative expenses.

116D.-Regulations under sections 116A and 116B

(1)The power to make regulations includes power:

(a) to make incidental, supplementary or consequential provision, including provision extending or restricting the jurisdiction of the Copyright Tribunal or conferring powers on it;

(b) to make transitional, transitory or saving provision;

(2) Regulations under any provision may amend this Part, or any other enactment or subordinate legislation passed or made before that provision comes into force, for the purpose of making consequential provision or extending or restricting the jurisdiction of the Copyright Tribunal or conferring powers on it.

(3) Regulations may make provision by reference to guidance issued from time to time by any person.

(4) The power to make regulations is exercisable by statutory instrument.

(5) A statutory instrument containing regulations may not be made unless a draft of the instrument has been laid before and approved by a resolution of each House of Parliament.]

References and applications with respect to licensing schemes

[F300

117.- Licensing schemes to which following sections apply.

Sections 118 to 123 (references and applications with respect to licensing schemes) apply to licensing schemes which are operated by licensing bodies and cover works of more than one author, so far as they relate to licences for:

(a) copying the work,

(b) rental or lending of copies of the work to the public,

[F301

(d) communicating the work to the public;]and references in those sections to a licensing scheme shall be construed accordingly.]

118.- Reference of proposed licensing scheme to tribunal.

(1) The terms of a licensing scheme proposed to be operated by a licensing body may be referred to the Copyright Tribunal by an organisation claiming to be representative of persons claiming that they require licences in cases of a description to which the scheme would apply, either generally or in relation to any description of case.

(2) The Tribunal shall first decide whether to entertain the reference, and may decline to do so on the ground that the reference is premature.

(3) If the Tribunal decides to entertain the reference it shall considerthe matter referred and make such order, either confirming or varying the proposed scheme, either generally or so far as it relates to cases of the description to which the reference relates, as the Tribunal may determine to be reasonable in the circumstances.

(4) The order may be made so as to be in force indefinitely or for such period as the Tribunal may determine.

119.- Reference of licensing scheme to tribunal.

(1) If while a licensing scheme is in operation a dispute arises between the operator of the scheme and:

(a) a person claiming that he requires a licence in a case of a description to which the scheme applies, or

(b) an organisation claiming to be representative of such persons,that person or organisation may refer the scheme to the Copyright Tribunal in so far as it relates to cases of that description.

(2) A scheme which has been referred to the Tribunal under this section shall remain in operation until proceedings on the reference are concluded.

(3) The Tribunal shall consider the matter in dispute and make such order, either confirming or varying the scheme so far as it relates to cases of the description to which the reference relates, as the Tribunal may determine to be reasonable in the circumstances.

(4) The order may be made so as to be in force indefinitely or for such period as the Tribunal may determine.

120.- Further reference of scheme to tribunal.

(1) Where the Copyright Tribunal has on a previous reference of a licensing scheme under [F302section 118, 119 or 128A], or under this section, made an order with respect to the scheme, then, while the order remains in force:

(a) the operator of the scheme,

(b) a person claiming that he requires a licence in a case of the description to which the order applies, or

(c) an organisation claiming to be representative of such persons,may refer the scheme again to the Tribunal so far as it relates to cases of that description.

(2) A licensing scheme shall not, except with the special leave of the Tribunal, be referred again to the Tribunal in respect of the same description of cases:

(a) within twelve months from the date of the order on the previous reference, or

(b) if the order was made so as to be in force for 15 months or less, until the last three months before the expiry of the order.

(3) A scheme which has been referred to the Tribunal under this section shall remain in operation until proceedings on the reference are concluded.

(4) The Tribunal shall consider the matter in dispute and make such order, either confirming, varying or further varying the scheme so far as it relates to cases of the description to which the reference relates, as the Tribunal may determine to be reasonable in the circumstances.

(5) The order may be made so as to be in force indefinitely or for such period as the Tribunal may determine.

121.- Application for grant of licence in connection with licensing scheme.

(1) A person who claims, in a case covered by a licensing scheme, that the operator of the scheme has refused to grant him or procure the grant to him of a licence in accordance with the scheme, or has failed to do so within a reasonable time after being asked, may apply to the Copyright Tribunal.

(2) A person who claims, in a case excluded from a licensing scheme, that the operator of the scheme either:

(a) has refused to grant him a licence or procure the grant to him of a licence, or has failed to do so within a reasonable time of being asked, and that in the circumstances it is unreasonable that a licence should not be granted, or

(b) proposes terms for a licence which are unreasonable,may apply to the Copyright Tribunal.

(3) A case shall be regarded as excluded from a licensing scheme for the purposes of subsection (2) if:

(a) the scheme provides for the grant of licences subject to terms excepting matters from the licence and the case falls within such an exception, or

(b) the case is so similar to those in which licences are granted under the scheme that it is unreasonable that it should not be dealt with in the same way.

(4) If the Tribunal is satisfied that the claim is well-founded, it shall make an order declaring that, in respect of the matters specified in the order, the applicant is entitled to a licence on such terms as the Tribunal may determine to be applicable in accordance with the scheme or, as the case may be, to be reasonable in the circumstances.

(5) The order may be made so as to be in force indefinitely or for such period as the Tribunal may determine.

122.- Application for review of order as to entitlement to licence.

Where the Copyright Tribunal has made an order under section 121 that a person is entitled to a licence under a licensing scheme, the operator of the scheme or the original applicant may apply to the Tribunal to review its order.

(2) An application shall not be made, except with the special leave of the Tribunal:

(a) within twelve months from the date of the order, or of the decision on a previous application under this section, or

(b) if the order was made so as to be in force for 15 months or less, or as a result of the decision on a previous application under this section is due to expire within 15 months of that decision, until the last three months before the expiry date.

(3) The Tribunal shall on an application for review confirm or vary its order as the Tribunal may determine to be reasonable having regard to the terms applicable in accordance with the licensing scheme or, as the case may be, the circumstances of the case.

123.- Effect of order of tribunal as to licensing scheme.

(1)A licensing scheme which has been confirmed or varied by the Copyright Tribunal:

(a) under section 118 (reference of terms of proposed scheme), or

(b) under section 119 or 120 (reference of existing scheme to Tribunal),shall be in force or, as the case may be, remain in operation, so far as it relates to the description of case in respect of which the order was made, so long as the order remains in force.

(2) While the order is in force a person who in a case of a class to which the order applies:

(a) pays to the operator of the scheme any charges payable under the scheme in respect of a licence covering the case in question or, if the amount cannot be ascertained, gives an undertaking to the operator to pay them when ascertained, and

(b) complies with the other terms applicable to such a licence under the scheme,shall be in the same position as regards infringement of copyright as if he had at all material times been the holder of a licence granted by the owner of the copyright in question in accordance with the scheme.

(3) The Tribunal may direct that the order, so far as it varies the amount of charges payable, has effect from a date before that on which it is made, but not earlier than the date on which the reference was made or, if later, on which the scheme came into operation.If such a direction is made:

(a) any necessary repayments, or further payments, shall be made in respect of charges already paid, and

(b) the reference in subsection (2)(a) to the charges payable under the scheme shall be construed as a reference to the charges so payable by virtue of the order.No such direction may be made where subsection (4) below applies.

(4) An order of the Tribunal under section 119 or 120 made with respect to a scheme which is certified for any purpose under section 143 has effect, so far as it varies the scheme by reducing the charges payable for licences, from the date on which the reference was made to the Tribunal.

(5) Where the Tribunal has made an order under section 121 (order as to entitlement to licence under licensing scheme) and the order remains in force, the person in whose favour the order is made shall if he:

(a) pays to the operator of the scheme any charges payable in accordance with the order or, if the amount cannot be ascertained, gives an undertaking to pay the charges when ascertained, and

(b) complies with the other terms specified in the order,be in the same position as regards infringement of copyright as if he had at all material times been the holder of a licence granted by the owner of the copyright in question on the terms specified in the order.

References and applications with respect to licensing by licensing bodies

[F303

124.- Licences to which following sections apply.

Sections 125 to 128 (references and applications with respect to licensing by licensing bodies) apply to licences which are granted by a licensing body otherwise than in pursuance of a licensing scheme and cover works of more than one author, so far as they authorise:

(a) copying the work,

(b) rental or lending of copies of the work to the public,

[F304

(d) communicating the work to the public;]and references in those sections to a licence shall be construed accordingly.]

125.- Reference to tribunal of proposed licence.

(1) The terms on which a licensing body proposes to grant a licence may be referred to the Copyright Tribunal by the prospective licensee.

(2) The Tribunal shall first decide whether to entertain the reference, and may decline to do so on the ground that the reference is premature.

(3) If the Tribunal decides to entertain the reference it shall consider the terms of the proposed licence and make such order, either confirming or varying the terms, as it may determine to be reasonable in the circumstances.

(4) The order may be made so as to be in force indefinitely or for such period as the Tribunal may determine.

126.- Reference to tribunal of expiring licence.

(1) A licensee under a licence which is due to expire, by effluxion of time or as a result of notice given by the licensing body, may apply to the Copyright Tribunal on the ground that it is unreasonable in the circumstances that the licence should cease to be in force.

(2) Such an application may not be made until the last three months before the licence is due to expire.

(3) A licence in respect of which a reference has been made to the Tribunal shall remain in operation until proceedings on the reference are concluded.

(4) If the Tribunal finds the application well-founded, it shall make an order declaring that the licensee shall continue to be entitled to the benefit of the licence on such terms as the Tribunal may determine to be reasonable in the circumstances.

(5) An order of the Tribunal under this section may be made so as to be in force indefinitely or for such period as the Tribunal may determine.

127.- Application for review of order as to licence.

(1) Where the Copyright Tribunal has made an order under [F305section 125, 126 or 128B (where that order did not relate to a licensing scheme)], the licensing body or the person entitled to the benefit of the order may apply to the Tribunal to review its order.

(2) An application shall not be made, except with the special leave of the Tribunal:

(a) within twelve months from the date of the order or of the decision on a previous application under this section, or

The Tribunal shall on an application for review confirm or vary its order as the Tribunal may determine to be reasonable in the circumstances.

128.- Effect of order of tribunal as to licence.

(1) Where the Copyright Tribunal has made an order under section 125 or 126 and the order remains in force, the person entitled to the benefit of the order shall if he:

(a) pays to the licensing body any charges payable in accordance with the order or, if the amount cannot be ascertained, gives an undertaking to pay the charges when ascertained, and

(2) The benefit of the order may be assigned:

(a) in the case of an order under section 125, if assignment is not prohibited under the terms of the Tribunal’s order; and

(b) in the case of an order under section 126, if assignment was not prohibited under the terms of the original licence.

(3) The Tribunal may direct that an order under section 125 or 126, or an order under section 127 varying such an order, so far as it varies the amount of charges payable, has effect from a date before that on which it is made, but not earlier than the date on which the reference or application was made or, if later, on which the licence was granted or, as the case may be, was due to expire.If such a direction is made:

(a) any necessary repayments, or further payments, shall be made in respect of charges already paid, and

(b) the reference in subsection (1)(a) to the charges payable in accordance with the order shall be construed, where the order is varied by a later order, as a reference to the charges so payable by virtue of the later order.

[F306

128A.- Notification of licence or licensing scheme for excepted sound recordings

F307 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

128B.- References to the Tribunal by the Secretary of State under section 128A

F308 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ]

Factors to be taken into account in certain classes of case

129.- General considerations: unreasonable discrimination.

In determining what is reasonable on a reference or application under this Chapter relating to a licensing scheme or licence, the Copyright Tribunal shall have regard to:

(a) the availability of other schemes, or the granting of other licences, to other persons in similar circumstances, and

(b) the terms of those schemes or licences,and shall exercise its powers so as to secure that there is no unreasonable discrimination between licensees, or prospective licensees, under the scheme or licence to which the reference or application relates and licensees under other schemes operated by, or other licences granted by, the same person.

130 Licences for reprographic copying.

Where a reference or application is made to the Copyright Tribunal under this Chapter relating to the licensing of reprographic copying of published literary, dramatic, musical or artistic works, or the typographical arrangement of published editions, the Tribunal shall have regard to:

(a) the extent to which published editions of the works in question are otherwise available,

(b) the proportion of the work to be copied, and

131.- Licences for educational establishments in respect of works included in broadcasts F309. . . .

(1) This section applies to references or applications under this Chapter relating to licences for the recording by or on behalf of educational establishments of broadcasts F310. . . which include copyright works, or the making of copies of such recordings, for educational purposes.

(2) The Copyright Tribunal shall, in considering what charges (if any) should be paid for a licence, have regard to the extent to which the owners of copyright in the works included in the broadcast F310. . . have already received, or are entitled to receive, payment in respect of their inclusion.

132.- Licences to reflect conditions imposed by promoters of events.

(1) This section applies to references or applications under this Chapter in respect of licences relating to sound recordings, films [F311or broadcasts] which include, or are to include, any entertainment or other event.

(2) The Copyright Tribunal shall have regard to any conditions imposed by the promoters of the entertainment or other event; and, in particular, the Tribunal shall not hold a refusal or failure to grant a licence to be unreasonable if it could not have been granted consistently with those conditions.

(3) Nothing in this section shall require the Tribunal to have regard to any such conditions in so far as they:

(a) purport to regulate the charges to be imposed in respect of the grant of licences, or

(b) relate to payments to be made to the promoters of any event in consideration of the grant of facilities for making the recording, film [F312or broadcast].

133.- Licences to reflect payments in respect of underlying rights.

F313 [

(1) In considering what charges should be paid for a licence:

(a) on a reference or application under this Chapter relating to licences for the rental or lending of copies of a work, or

(b) on an application under section 142 (royalty or other sum payable for lending of certain works), the Copyright Tribunal shall take into account any reasonable payments which the owner of the copyright in the work is liable to make in consequence of the granting of the licence, or of the acts authorised by the licence, to owners of copyright in works included in that work.]

(2) On any reference or application under this Chapter relating to licensing in respect of the copyright in sound recordings, films [F314or broadcasts], the Copyright Tribunal shall take into account, in considering what charges should be paid for a licence, any reasonable payments which the copyright owner is liable to make in consequence of the granting of the licence, or of the acts authorised by the licence, in respect of any performance included in the recording, film [F315or broadcast].

134.- Licences in respect of works included in re-transmissions.

(1) F316… this section applies to references or applications under this Chapter relating to licences to include in a broadcast F317. . . :

(a) literary, dramatic, musical or artistic works, or,

(b) sound recordings or films,where one broadcast F317. . . (“the first transmission”) is, by reception and immediate re-transmission, to be further broadcast F317. . . (“the further transmission”).

(2) So far as the further transmission is to the same area as the first transmission, the Copyright Tribunal shall, in considering what charges (if any) should be paid for licences for either transmission, have regard to the extent to which the copyright owner has already received, or is entitled to receive, payment for the other transmission which adequately remunerates him in respect of transmissions to that area.

(3) So far as the further transmission is to an area outside that to which the first transmission was made, the Tribunal shall F317. . . leave the further transmission out of account in considering what charges (if any) should be paid for licences for the first transmission.

F318

(3A ). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F319

(4). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

135.- Mention of specific matters not to exclude other relevant considerations.

The mention in sections 129 to 134 of specific matters to which the Copyright Tribunal is to have regard in certain classes of case does not affect the Tribunal’s general obligation in any case to have regard to all relevant considerations.

[F320 Use as of right of sound recordings in broadcasts F321 . . .

135A.- Circumstances in which right available.

(1) Section 135C applies to the inclusion in a broadcast F322 . . . of any sound recordings if:

(a) a licence to include those recordings in the broadcast F322 . . . could be granted by a licensing body or such a body could procure the grant of a licence to do so,

(b) the condition in subsection (2) or (3) applies, and

(2) Where the person including the recordings in the broadcast F322 . . . does not hold a licence to do so, the condition is that the licensing body refuses to grant, or procure the grant of, such a licence, being a licence:

(a) whose terms as to payment for including the recordings in the broadcast F322 . . . would be acceptable to him or comply with an order of the Copyright Tribunal under section 135D relating to such a licence or any scheme under which it would be granted, and

(b) allowing unlimited needletime or such needletime as he has demanded.

(3) Where he holds a licence to include the recordings in the broadcast F322 . . . , the condition is that the terms of the licence limit needletime and the licensing body refuses to substitute or procure the substitution of terms allowing unlimited needletime or such needletime as he has demanded, or refuses to do so on terms that fall within subsection (2)(a).

(4) The references in subsection (2) to refusing to grant, or procure the grant of, a licence, and in subsection (3) to refusing to substitute or procure the substitution of terms, include failing to do so within a reasonable time of being asked.

(5) In the group of sections from this section to section 135G:

[F323 “ broadcast ” does not include any broadcast which is a transmission of the kind specified in section 6(1A)(b) or (c); ]

“ needletime ” means the time in any period (whether determined as a number of hours in the period or a proportion of the period, or otherwise) in which any recordings may be included in a broadcast F322 . . . ;

“ sound recording ” does not include a film sound track when accompanying a film.

(6) In sections 135B to 135G, “ terms of payment ” means terms as to payment for including sound recordings in a broadcast F322 . . . . ][F324

135B.- Notice of intention to exercise right.

(1) A person intending to avail himself of the right conferred by section 135C must:

(a) give notice to the licensing body of his intention to exercise the right, asking the body to propose terms of payment, and

(b) after receiving the proposal or the expiry of a reasonable period, give reasonable notice to the licensing body of the date on which he proposes to begin exercising that right, and the terms of payment in accordance with which he intends to do so.

(2) Where he has a licence to include the recordings in a broadcast F325 . . . , the date specified in a notice under subsection (1)(b) must not be sooner than the date of expiry of that licence except in a case falling within section 135A(3).

(3) Before the person intending to avail himself of the right begins to exercise it, he must:

(a) give reasonable notice to the Copyright Tribunal of his intention to exercise the right, and of the date on which he proposes to begin to do so, and

(b) apply to the Tribunal under section 135D to settle the terms of payment.][F326

135C.- Conditions for exercise of right.

(1) A person who, on or after the date specified in a notice under section 135B(1)(b), includes in a broadcast F327 . . . any sound recordings in circumstances in which this section applies, and who:

(a) complies with any reasonable condition, notice of which has been given to him by the licensing body, as to inclusion in the broadcast F327 . . . of those recordings,

(b) provides that body with such information about their inclusion in the broadcast F327 . . . as it may reasonably require, and

(c) makes the payments to the licensing body that are required by this section,shall be in the same position as regards infringement of copyright as if he had at all material times been the holder of a licence granted by the owner of the copyright in question.

(2) Payments are to be made at not less than quarterly intervals in arrears.

(3) The amount of any payment is that determined in accordance with any order of the Copyright Tribunal under section 135D or, if no such order has been made:

(a) in accordance with any proposal for terms of payment made by the licensing body pursuant to a request under section 135B, or

(b) where no proposal has been so made or the amount determined in accordance with the proposal so made is unreasonably high, in accordance with the terms of payment notified to the licensing body under section 135B(1)(b).

(4) Where this section applies to the inclusion in a broadcast F327 . . . of any sound recordings, it does so in place of any licence. ][F328

135D.- Applications to settle payments.

(1) On an application to settle the terms of payment, the Copyright Tribunal shall consider the matter and make such order as it may determine to be reasonable in the circumstances.

(2) An order under subsection (1) has effect from the date the applicant begins to exercise the right conferred by section 135C and any necessary repayments, or further payments, shall be made in respect of amounts that have fallen due.][F329

135E.- References etc. about conditions, information and other terms.

(1) A person exercising the right conferred by section 135C, or who has given notice to the Copyright Tribunal of his intention to do so, may refer to the Tribunal:

(a) any question whether any condition as to the inclusion in a broadcast F330 . . . of sound recordings, notice of which has been given to him by the licensing body in question, is a reasonable condition, or

(b) any question whether any information is information which the licensing body can reasonably require him to provide.

(2) On a reference under this section, the Tribunal shall consider the matter and make such order as it may determine to be reasonable in the circumstances.][F331

135F.- Application for review of order.

(1) A person exercising the right conferred by section 135C or the licensing body may apply to the Copyright Tribunal to review any order under section 135D or 135E.

(2) An application shall not be made, except with the special leave of the Tribunal:

(a) within twelve months from the date of the order, or of the decision on a previous application under this section, or

(b) if the order was made so as to be in force for fifteen months or less, or as a result of a decision on a previous application is due to expire within fifteen months of that decision, until the last three months before the expiry date.

(3) On the application the Tribunal shall consider the matter and make such order confirming or varying the original order as it may determine to be reasonable in the circumstances.

(4) An order under this section has effect from the date on which it is made or such later date as may be specified by the Tribunal.][F332

135G.- Factors to be taken into account.

(1) In determining what is reasonable on an application or reference under section 135D or 135E, or on reviewing any order under section 135F, the Copyright Tribunal shall:

(a) have regard to the terms of any orders which it has made in the case of persons in similar circumstances exercising the right conferred by section 135C, and

(b) exercise its powers so as to secure that there is no unreasonable discrimination between persons exercising that right against the same licensing body.

(2) In settling the terms of payment under section 135D, the Tribunal shall not be guided by any order it has made under any enactment other than that section.

(3) Section 134 (factors to be taken into account: retransmissions) applies on an application or reference under sections 135D to 135F as it applies on an application or reference relating to a licence.][F333

135H.- Power to amend sections 135A to 135G.

(1) The Secretary of State may by order, subject to such transitional provision as appears to him to be appropriate, amend sections 135A to 135G so as:

(a) to include in any reference to sound recordings any works of a description specified in the order; or

(b) to exclude from any reference to a broadcast F334 . . . any broadcast F334 . . . of a description so specified.

(2) An order shall be made by statutory instrument; and no order shall be made unless a draft of it has been laid before and approved by resolution of each House of Parliament.]

Implied indemnity in schemes or licences for reprographic copying

136.- Implied indemnity in certain schemes and licences for reprographic copying.

(1) This section applies to:

(a) schemes for licensing reprographic copying of published literary, dramatic, musical or artistic works, or the typographical arrangement of published editions, and

(b) licences granted by licensing bodies for such copying,where the scheme or licence does not specify the works to which it applies with such particularity as to enable licensees to determine whether a work falls within the scheme or licence by inspection of the scheme or licence and the work.

(2)There is implied:

(a) in every scheme to which this section applies an undertaking by the operator of the scheme to indemnify a person granted a licence under the scheme, and

(b) in every licence to which this section applies an undertaking by the licensing body to indemnify the licensee,against any liability incurred by him by reason of his having infringed copyright by making or authorising the making of reprographic copies of a work in circumstances within the apparent scope of his licence.

(3) The circumstances of a case are within the apparent scope of a licence if:

(a) it is not apparent from inspection of the licence and the work that it does not fall within the description of works to which the licence applies; and

(b) the licence does not expressly provide that it does not extend to copyright of the description infringed.

(4) In this section “liability” includes liability to pay costs; and this section applies in relation to costs reasonably incurred by a licensee in connection with actual or contemplated proceedings against him for infringement of copyright as it applies to sums which he is liable to pay in respect of such infringement.

(5) A scheme or licence to which this section applies may contain reasonable provision:

(a) with respect to the manner in which, and time within which, claims under the undertaking implied by this section are to be made;

(b) enabling the operator of the scheme or, as the case may be, the licensing body to take over the conduct of any proceedings affecting the amount of his liability to indemnify.

Reprographic copying by educational establishments

137.- Power to extend coverage of scheme or licence.

(1) This section applies to:

(a) a licensing scheme to which sections 118 to 123 apply (see section 117) and which is operated by a licensing body, or

(b) a licence to which sections 125 to 128 apply (see section 124),so far as it provides for the grant of licences, or is a licence, authorising the making by or on behalf of educational establishments for the purposes of instruction of reprographic copies of published literary, dramatic, musical or artistic works, or of the typographical arrangement of published editions.

(2) If it appears to the Secretary of State with respect to a scheme or licence to which this section applies that:

(a) works of a description similar to those covered by the scheme or licence are unreasonably excluded from it, and

(b) making them subject to the scheme or licence would not conflict with the normal exploitation of the works or unreasonably prejudice the legitimate interests of the copyright owners,he may by order provide that the scheme or licence shall extend to those works.

(3) Where he proposes to make such an order, the Secretary of State shall give notice of the proposal to:

(a) the copyright owners,

(b) the licensing body in question, and

(c) such persons or organisations representative of educational establishments, and such other persons or organisations, as the Secretary of State thinks fit.

(4) The notice shall inform those persons of their right to make written or oral representations to the Secretary of State about the proposal within six months from the date of the notice; and if any of them wishes to make oral representations, the Secretary of State shall appoint a person to hear the representations and report to him.

(5) In considering whether to make an order the Secretary of State shall take into account any representations made to him in accordance with subsection (4), and such other matters as appear to him to be relevant.

138.- Variation or discharge of order extending scheme or licence.

(1) The owner of the copyright in a work in respect of which an order is in force under section 137 may apply to the Secretary of State for the variation or discharge of the order, stating his reasons for making the application.

(2) The Secretary of State shall not entertain an application made within two years of the making of the original order, or of the making of an order on a previous application under this section, unless it appears to him that the circumstances are exceptional.

(3) On considering the reasons for the application the Secretary of State may confirm the order forthwith; if he does not do so, he shall give notice of the application to:

(a) the licensing body in question, and

(b) such persons or organisations representative of educational establishments, and such other persons or organisations, as he thinks fit.

(4) The notice shall inform those persons of their right to make written or oral representations to the Secretary of State about the application within the period of two months from the date of the notice; and if any of them wishes to make oral representations, the Secretary of State shall appoint a person to hear the representations and report to him.

(5) In considering the application the Secretary of State shall take into account the reasons for the application, any representations made to him in accordance with subsection (4), and such other matters as appear to him to be relevant.

(6) The Secretary of State may make such order as he thinks fit confirming or discharging the order (or, as the case may be, the order as previously varied), or varying (or further varying) it so as to exclude works from it.

139.- Appeals against orders.

(1) The owner of the copyright in a work which is the subject of an order under section 137 (order extending coverage of scheme or licence) may appeal to the Copyright Tribunal which may confirm or discharge the order, or vary it so as to exclude works from it, as it thinks fit having regard to the considerations mentioned in subsection (2) of that section.

(2) Where the Secretary of State has made an order under section 138 (order confirming, varying or discharging order extending coverage of scheme or licence):

(a) the person who applied for the order, or

(b) any person or organisation representative of educational establishments who was given notice of the application for the order and made representations in accordance with subsection (4) of that section,may appeal to the Tribunal which may confirm or discharge the order or make any other order which the Secretary of State might have made.

(3) An appeal under this section shall be brought within six weeks of the making of the order or such further period as the Tribunal may allow.

(4) An order under section 137 or 138 shall not come into effect until the end of the period of six weeks from the making of the order or, if an appeal is brought before the end of that period, until the appeal proceedings are disposed of or withdrawn.

(5) If an appeal is brought after the end of that period, any decision of the Tribunal on the appeal does not affect the validity of anything done in reliance on the order appealed against before that decision takes effect.

140.- Inquiry whether new scheme or general licence required.

(1) The Secretary of State may appoint a person to inquire into the question whether new provision is required (whether by way of a licensing scheme or general licence) to authorise the making by or on behalf of educational establishments for the purposes of instruction of reprographic copies of:

(a) published literary, dramatic, musical or artistic works, or

(b) the typographical arrangement of published editions,of a description which appears to the Secretary of State not to be covered by an existing licensing scheme or general licence and not to fall within the power conferred by section 137 (power to extend existing schemes and licences to similar works).

(2) The procedure to be followed in relation to an inquiry shall be such as may be prescribed by regulations made by the Secretary of State.

(3) The regulations shall, in particular, provide for notice to be given to:

(a) persons or organisations appearing to the Secretary of State to represent the owners of copyright in works of that description, and

(b) persons or organisations appearing to the Secretary of State to represent educational establishments,and for the making of written or oral representations by such persons; but without prejudice to the giving of notice to, and the making of representations by, other persons and organisations.

(4) The person appointed to hold the inquiry shall not recommend the making of new provision unless he is satisfied:

(a) that it would be of advantage to educational establishments to be authorised to make reprographic copies of the works in question, and

(b) that making those works subject to a licensing scheme or general licence would not conflict with the normal exploitation of the works or unreasonably prejudice the legitimate interests of the copyright owners.

(5) If he does recommend the making of new provision he shall specify any terms, other than terms as to charges payable, on which authorisation under the new provision should be available.

(6) Regulations under this section shall be made by statutory instrument which shall be subject to annulment in pursuance of a resolution of either House of Parliament.

(7) In this section (and section 141) a “general licence” means a licence granted by a licensing body which covers all works of the description to which it applies.

141.- Statutory licence where recommendation not implemented.

(1) The Secretary of State may, within one year of the making of a recommendation under section 140 by order provide that if, or to the extent that, provision has not been made in accordance with the recommendation, the making by or on behalf of an educational establishment, for the purposes of instruction, of reprographic copies of the works to which the recommendation relates shall be treated as licensed by the owners of the copyright in the works.

(2) For that purpose provision shall be regarded as having been made in accordance with the recommendation if:

(a) a certified licensing scheme has been established under which a licence is available to the establishment in question, or

(b) a general licence has been:

(i) granted to or for the benefit of that establishment, or

(ii) referred by or on behalf of that establishment to the Copyright Tribunal under section 125 (reference of terms of proposed licence), or

(iii) offered to or for the benefit of that establishment and refused without such a reference,and the terms of the scheme or licence accord with the recommendation.

(3) The order shall also provide that any existing licence authorising the making of such copies (not being a licence granted under a certified licensing scheme or a general licence) shall cease to have effect to the extent that it is more restricted or more onerous than the licence provided for by the order.

(4) The order shall provide for the licence to be free of royalty but, as respects other matters, subject to any terms specified in the recommendation and to such other terms as the Secretary of State may think fit.

(5) The order may provide that where a copy which would otherwise be an infringing copy is made in accordance with the licence provided by the order but is subsequently dealt with, it shall be treated as an infringing copy for the purposes of that dealing, and if that dealing infringes copyright for all subsequent purposes.In this subsection “dealt with” means sold or let for hire, offered or exposed for sale or hire, or exhibited in public.

(6) The order shall not come into force until at least six months after it is made.

(7) An order may be varied from time to time, but not so as to include works other than those to which the recommendation relates or remove any terms specified in the recommendation, and may be revoked.

(8) An order under this section shall be made by statutory instrument which shall be subject to annulment in pursuance of a resolution of either House of Parliament.

(9) In this section a “certified licensing scheme” means a licensing scheme certified for the purposes of this section under section 143.

F335 [ Royalty or other sum payable for lending of certain works ]

142.- [F336 Royalty or other sum payable for lending of certain works.]

(1) An application to settle the royalty or other sum payable in pursuance of section 66 (lending of copies of certain copyright works) may be made to the Copyright Tribunal by the copyright owner or the person claiming to be treated as licensed by him.

(2) (2) The Tribunal shall consider the matter and make such order as it may determine to be reasonable in the circumstances.

(3) Either party may subsequently apply to the Tribunal to vary the order, and the Tribunal shall consider the matter and make such order confirming or varying the original order as it may determine to be reasonable in the circumstances.

(4) An application under subsection (3) shall not, except with the special leave of the Tribunal, be made within twelve months from the date of the original order or of the order on a previous application under that subsection.

(5) An order under subsection (3) has effect from the date on which it is made or such later date as may be specified by the Tribunal.

Certification of licensing schemes

143.- Certification of licensing schemes.

(1) A person operating or proposing to operate a licensing scheme may apply to the Secretary of State to certify the scheme for the purposes of:

F337

(a). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(b) section 60 (abstracts of scientific or technical articles),

[F338

F339

(d). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(e) section 141 (reprographic copying of published works by educational establishments).

(2) The Secretary of State shall by order made by statutory instrument certify the scheme if he is satisfied that it:

(a) enables the works to which it relates to be identified with sufficient certainty by persons likely to require licences, and

(b) sets out clearly the charges (if any) payable and the other terms on which licences will be granted.

(3) The scheme shall be scheduled to the order and the certification shall come into operation for the purposes of section F340… 60, 66F341… or 141, as the case may be:

(a) on such date, not less than eight weeks after the order is made, as may be specified in the order, or

(b) if the scheme is the subject of a reference under section 118 (reference of proposed scheme), any later date on which the order of the Copyright Tribunal under that section comes into force or the reference is withdrawn.

(4) A variation of the scheme is not effective unless a corresponding amendment of the order is made; and the Secretary of State shall make such an amendment in the case of a variation ordered by the Copyright Tribunal on a reference under section 118, 119 or 120, and may do so in any other case if he thinks fit.

(5) The order shall be revoked if the scheme ceases to be operated and may be revoked if it appears to the Secretary of State that it is no longer being operated according to its terms.

Powers exercisable in consequence of competition report

144.- Powers exercisable in consequence of report of [F342Competition and Markets Authority].

[F343

(1)Subsection (1A) applies where whatever needs to be remedied, mitigated or prevented by the Secretary of State [F344or (as the case may be) the Competition and Markets Authority] under section 12(5) of the Competition Act 1980 or section 41(2), 55(2), 66(6), 75(2), 83(2), 138(2), 147(2)[F345, 147A(2)] or 160(2) of, or paragraph 5(2) or 10(2) of Schedule 7 to, the Enterprise Act 2002 (powers to take remedial action following references to the [F346Competition and Markets Authority] in connection with public bodies and certain other persons, mergers or market investigations) consists of or includes:

(a)conditions in licences granted by the owner of copyright in a work restricting the use of the work by the licensee or the right of the copyright owner to grant other licences; or

(b) a refusal of a copyright owner to grant licences on reasonable terms.

(1A) The powers conferred by Schedule 8 to the Enterprise Act 2002 include power to cancel or modify those conditions and, instead or in addition, to provide that licences in respect of the copyright shall be available as of right.

(2) The references to anything permitted by Schedule 8 to the Enterprise Act 2002 in section 12(5A) of the Competition Act 1980 and in sections 75(4)(a), 83(4)(a), 84(2)(a), 89(1), 160(4)(a), 161(3)(a) and 164(1) of, and paragraphs 5, 10 and 11 of Schedule 7 to, the Act of 2002 shall be construed accordingly.]

(2) The references in sections 56(2) and 73(2) of that Act, and [F347section] 12(5) of the M11Competition Act 1980, to the powers specified in that Part of that Schedule shall be construed accordingly.

(3) [F348The Secretary of State [F349or (as the case may be) the Competition and Markets Authority]] shall only exercise the powers available by virtue of this section if he [F350or it] is satisfied that to do so does not contravene any Convention relating to copyright to which the United Kingdom is a party.

(4) The terms of a licence available by virtue of this section shall, in default of agreement, be settled by the Copyright Tribunal on an application by the person requiring the licence; and terms so settled shall authorise the licensee to do everything in respect of which a licence is so available.

(5) Where the terms of a licence are settled by the Tribunal, the licence has effect from the date on which the application to the Tribunal was made.

[F351 Compulsory collective administration of certain rights][F352

144A.- Collective exercise of certain rights in relation to cable re-transmission.

(1) This section applies to the right of the owner of copyright in a literary, dramatic, musical or artistic work, sound recording or film to grant or refuse authorisation for cable re-transmission of a [F353wireless] broadcast from another EEA F354. . . state in which the work is included. That right is referred to below as “cable re-transmission right”.

(2) Cable re-transmission right may be exercised against a cable operator only through a licensing body.

(3) Where a copyright owner has not transferred management of his cable re-transmission right to a licensing body, the licensing body which manages rights of the same category shall be deemed to be mandated to manage his right. Where more than one licensing body manages rights of that category, he may choose which of them is deemed to be mandated to manage his right.

(4) A copyright owner to whom subsection (3) applies has the same rights and obligations resulting from any relevant agreement between the cable operator and the licensing body as have copyright owners who have transferred management of their cable re-transmission right to that licensing body.

(5) Any rights to which a copyright owner may be entitled by virtue of subsection (4) must be claimed within the period of three years beginning with the date of the cable re-transmission concerned.

(6) This section does not affect any rights exercisable by the maker of the broadcast, whether in relation to the broadcast or a work included in it.

[F355

(7) In this section:

“ cable operator ” means a person responsible for cable re-transmission of a wireless broadcast; and

“ cable re-transmission ” means the reception and immediate re-transmission by cable, including the transmission of microwave energy between terrestrial fixed points, of a wireless broadcast. ]]

Chapter VIII.- The Copyright Tribunal

The Tribunal

145.- The Copyright Tribunal.

(1) The Tribunal established under section 23 of the M12Copyright Act 1956 is renamed the Copyright Tribunal.

(2) The Tribunal shall consist of a chairman and two deputy chairmen appointed by the Lord Chancellor, after consultation with the Lord Advocate, and not less than two or more than eight ordinary members appointed by the Secretary of State.

(3) A person is not eligible for appointment as chairman or deputy chairman [F356unless:

[F357

(a) he satisfies the judicial-appointment eligibility condition on a 5-year basis;]

(b) he is an advocate or solicitor in Scotland of at least [F3585] years’ standing;

(c) he is a member of the Bar of Northern Ireland or [F359solicitor of the Court of Judicature of Northern Ireland] of at least [F3585] years’ standing; or

(d) he has held judicial office.]

146.- Membership of the Tribunal.

(1) The members of the Copyright Tribunal shall hold and vacate office in accordance with their terms of appointment, subject to the following provisions.

(2) A member of the Tribunal may resign his office by notice in writing to the Secretary of State or, in the case of the chairman or a deputy chairman, to the Lord Chancellor.

(3) The Secretary of State or, in the case of the chairman or a deputy chairman, the Lord Chancellor may by notice in writing to the member concerned remove him from office if:

(a) he has become bankrupt or made an arrangement with his creditors or, in Scotland, his estate has been sequestrated or he has executed a trust deed for his creditors or entered into a composition contract, or

(b) he is incapacitated by physical or mental illness,or if he is in the opinion of the Secretary of State or, as the case may be, the Lord Chancellor otherwise unable or unfit to perform his duties as member.

[F360

(3A) A person who is the chairman or a deputy chairman of the Tribunal shall vacate his office on the day on which he attains the age of 70 years; but this subsection is subject to section 26(4) to (6) of the Judicial Pensions and Retirement Act 1993 (power to authorise continuance in office up to the age of 75 years).]

(4) If a member of the Tribunal is by reason of illness, absence or other reasonable cause for the time being unable to perform the duties of his office, either generally or in relation to particular proceedings, a person may be appointed to discharge his duties for a period not exceeding six months at one time or, as the case may be, in relation to those proceedings.

(5) The appointment shall be made:

(a) in the case of the chairman or deputy chairman, by the Lord Chancellor, who shall appoint a person who would be eligible for appointment to that office, and

(b) in the case of an ordinary member, by the Secretary of State;and a person so appointed shall have during the period of his appointment, or in relation to the proceedings in question, the same powers as the person in whose place he is appointed.

(6) The Lord Chancellor shall consult the Lord Advocate before exercising his powers under this section.

[F361

(7) The Lord Chancellor may exercise his powers to remove a person under subsection (3) or to appoint a person under subsection (4) only with the concurrence of the appropriate senior judge.

(8) The appropriate senior judge is the Lord Chief Justice of England and Wales, unless:

(a) the person to be removed exercises functions [F362, or the person to be appointed is to exercise functions,] wholly or mainly in Scotland, in which case it is the Lord President of the Court of Session, or

(b) the person to be removed exercises functions [F362, or the person to be appointed is to exercise functions,] wholly or mainly in Northern Ireland, in which case it is the Lord Chief Justice of Northern Ireland.

(9) The Lord Chief Justice of England and Wales may nominate a judicial office holder (as defined in section 109(4) of the Constitutional Reform Act 2005) to exercise his functions under subsection (7) in relation to the appointment of a person under subsection (4).

(10) The Lord President of the Court of Session may nominate a judge of the Court of Session who is a member of the First or Second Division of the Inner House of that Court to exercise his functions under subsection (7) in relation to the appointment of a person under subsection (4).

(11) The Lord Chief Justice of Northern Ireland may nominate any of the following to exercise his functions under subsection (7) in relation to the appointment of a person under subsection (4):

(a) the holder of one of the offices listed in Schedule 1 to the Justice (Northern Ireland) Act 2002;

(b) a Lord Justice of Appeal (as defined in section 88 of that Act).]

147.- Financial provisions.

(1) There shall be paid to the members of the Copyright Tribunal such remuneration (whether by way of salaries or fees), and such allowances, as the Secretary of State with the approval of the Treasury may determine.

(2) The Secretary of State may appoint such staff for the Tribunal as, with the approval of the Treasury as to numbers and remuneration, he may determine.

(3) The remuneration and allowances of members of the Tribunal, the remuneration of any staff and such other expenses of the Tribunal as the Secretary of State with the approval of the Treasury may determine shall be paid out of money provided by Parliament.

148.- Constitution for purposes of proceedings.

(1) For the purposes of any proceedings the Copyright Tribunal shall consist of:

(a) a chairman, who shall be either the chairman or a deputy chairman of the Tribunal, and

(b) two or more ordinary members.

(2) If the members of the Tribunal dealing with any matter are not unanimous, the decision shall be taken by majority vote; and if, in such a case, the votes are equal the chairman shall have a further, casting vote.

(3) Where part of any proceedings before the Tribunal has been heard and one or more members of the Tribunal are unable to continue, the Tribunal shall remain duly constituted for the purpose of those proceedings so long as the number of members is not reduced to less than three.

(4) If the chairman is unable to continue, the chairman of the Tribunal shall:

(a) appoint one of the remaining members to act as chairman, and

(b) appoint a suitably qualified person to attend the proceedings and advise the members on any questions of law arising.

(5) A person is “suitably qualified” for the purposes of subsection (4)(b) if he is, or is eligible for appointment as, a deputy chairman of the Tribunal.

Jurisdiction and procedure

149.- Jurisdiction of the Tribunal.

[F363 The Copyright Tribunal has jurisdiction under this Part] to hear and determine proceedings under:

F364(za). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F365 [( zb )section 93C (application to determine amount of equitable remuneration under section 93B);]

(a) section 118, 119, or 120 (reference of licensing scheme);

(b) section 121 or 122 (application with respect to entitlement to licence under licensing scheme);

[F366(ca) section 128B (reference by the Secretary of State under section 128A);][F367(cc) section 135D or 135E (application or reference with respect to use as of right of sound recordings in broadcasts F368 . . . ); ]

(d) section 139 (appeal against order as to coverage of licensing scheme or licence);

(e) section 142 (application to settle royalty or other sum payable for [F369lending of certain works];

(f) section 144(4) (application to settle terms of copyright licence available as of right);

[F370(fa) paragraph 7 of Schedule ZA1 (application to determine compensation for use of orphan works).]

F371(g). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F371(h). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

150.- General power to make rules.

(1) The Lord Chancellor may, after consultation with the Lord Advocate, make rules for regulating proceedings before the Copyright Tribunal and, subject to the approval of the Treasury, as to the fees chargeable in respect of such proceedings.

F372[

(2) The rules may apply in relation to the Tribunal, as respects proceedings in England and Wales or Northern Ireland, any of the provisions of Part I of the Arbitration Act 1996.]

(3) Provision shall be made by the rules:

(a) prohibiting the Tribunal from entertaining a reference under section 118, 119 or 120 by a representative organisation unless the Tribunal is satisfied that the organisation is reasonably representative of the class of persons which it claims to represent;

(b) specifying the parties to any proceedings and enabling the Tribunal to make a party to the proceedings any person or organisation satisfying the Tribunal that they have a substantial interest in the matter; and

(c) requiring the Tribunal to give the parties to proceedings an opportunity to state their case, in writing or orally as the rules may provide.

(4) The rules may make provision for regulating or prescribing any matters incidental to or consequential upon any appeal from the Tribunal under section 152 (appeal to the court on point of law).

(5) Rules under this section shall be made by statutory instrument which shall be subject to annulment in pursuance of a resolution of either House of Parliament.

151.- Costs, proof of orders, &c.

(1) The Copyright Tribunal may order that the costs of a party to proceedings before it shall be paid by such other party as the Tribunal may direct; and the Tribunal may tax or settle the amount of the costs, or direct in what manner they are to be taxed.

(2) A document purporting to be a copy of an order of the Tribunal and to be certified by the chairman to be a true copy shall, in any proceedings, be sufficient evidence of the order unless the contrary is proved.

(3) As respect proceedings in Scotland, the Tribunal has the like powers for securing the attendance of witnesses and the production of documents, and with regard to the examination of witnesses on oath, as an arbiter under a submission.

[F373

151A.- Award of interest.

(1) Any of the following, namely:

(a) a direction under section 123(3) so far as relating to a licence for [F374communicating a work to the public];

(b) a direction under section 128(3) so far as so relating;

(d) an order under section 135F confirming or varying an order under section 135D(1),may award simple interest at such rate and for such period, beginning not earlier than the relevant date and ending not later than the date of the order, as the Copyright Tribunal thinks reasonable in the circumstances.

(2) In this section “ the relevant date ” means:

(a) in relation to a direction under section 123(3), the date on which the reference was made;

(b) in relation to a direction under section 128(3), the date on which the reference or application was made;

(d) in relation to an order under section 135F, the date on which the application was made.]

Appeals

152.- Appeal to the court on point of law.

(1) An appeal lies on any point of law arising from a decision of the Copyright Tribunal to the High Court or, in the case of proceedings of the Tribunal in Scotland, to the Court of Session.

(2) Provision shall be made by rules under section 150 limiting the time within which an appeal may be brought.

(3) Provision may be made by rules under that section:

(a) for suspending, or authorising or requiring the Tribunal to suspend, the operation of orders of the Tribunal in cases where its decision is appealed against;

(b) for modifying in relation to an order of the Tribunal whose operation is suspended the operation of any provision of this Act as to the effect of the order;

(c) for the publication of notices or the taking of other steps for securing that persons affected by the suspension of an order of the Tribunal will be informed of its suspension.

Chapter IX.- Qualification for and Extent of Copyright Protection

Qualification for copyright protection

153.- Qualification for copyright protection.

(1) Copyright does not subsist in a work unless the qualification requirements of this Chapter are satisfied as regards:

(a) the author (see section 154), or

(b) the country in which the work was first published (see section 155), or

(2) Subsection (1) does not apply in relation to Crown copyright or Parliamentary copyright (see sections 163 to [F376166D]) or to copyright subsisting by virtue of section 168 (copyright of certain international organisations).

(3) If the qualification requirements of this Chapter, or section 163, 165 or 168, are once satisfied in respect of a work, copyright does not cease to subsist by reason of any subsequent event.

154.- Qualification by reference to author.

(1) A work qualifies for copyright protection if the author was at the material time a qualifying person, that is:

(a) a British citizen, [F377a national of another EEA state,] a British Dependent Territories citizen, a British National (Overseas), a British Overseas citizen, a British subject or a British protected person within the meaning of the M13British Nationality Act 1981, or

[F378

(b) an individual domiciled or resident in the United Kingdom or another EEA state or in the Channel Islands, the Isle of Man or Gibraltar or in a country to which the relevant provisions of this Part extend,] or

[F379

(c) a body incorporated under the law of a part of the United Kingdom or another EEA state or of the Channel Islands, the Isle of Man or Gibraltar or of a country to which the relevant provisions of this Part extend.]

(2) Where, or so far as, provision is made by Order under section 159 (application of this Part to countries to which it does not extend), a work also qualifies for copyright protection if at the material time the author was a citizen or subject of, an individual domiciled or resident in, or a body incorporated under the law of, a country to which the Order relates.

(3) A work of joint authorship qualifies for copyright protection if at the material time any of the authors satisfies the requirements of subsection (1) or (2); but where a work qualifies for copyright protection only under this section, only those authors who satisfy those requirements shall be taken into account for the purposes of:

section 11(1) and (2) (first ownership of copyright; entitlement of author or author’s employer),

[F380 section 12 (duration of copyright), and section 9(4) (meaning of “unknown authorship”) so far as it applies for the purposes of section 12, and]

section 57 (anonymous or pseudonymous works: acts permitted on assumptions as to expiry of copyright or death of author).

(4) The material time in relation to a literary, dramatic, musical or artistic work is:

(a) in the case of an unpublished work, when the work was made or, if the making of the work extended over a period, a substantial part of that period;

(b) in the case of a published work, when the work was first published or, if the author had died before that time, immediately before his death.

(5) The material time in relation to other descriptions of work is as follows:

(a) in the case of a sound recording or film, when it was made;

(b) in the case of a broadcast, when the broadcast was made;

(c)F381. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(d) in the case of the typographical arrangement of a published edition, when the edition was first published.

155.- Qualification by reference to country of first publication.

(1) A literary, dramatic, musical or artistic work, a sound recording or film, or the typographical arrangement of a published edition, qualifies for copyright protection if it is first published:

(a) in the United Kingdom[F382, another EEA state, the Channel Islands, the Isle of Man or Gibraltar], or

(b) in [F383a country] to which the relevant provisions of this Part extend.

(2) Where, or so far as, provision is made by Order under section 159 (application of this Part to countries to which it does not extend), such a work also qualifies for copyright protection if it is first published in a country to which the Order relates.

(3) For the purposes of this section, publication in one country shall not be regarded as other than the first publication by reason of simultaneous publication elsewhere; and for this purpose publication elsewhere within the previous 30 days shall be treated as simultaneous.

156.- Qualification by reference to place of transmission.

(1) F384A broadcast qualifies for copyright protection if it is made from . . . a place in:

(a) the United Kingdom[F385, another EEA state, the Channel Islands, the Isle of Man or Gibraltar], or

(b)[F386a country] to which the relevant provisions of this Part extend.

(2) Where, or so far as, provision is made by Order under section 159 (application of this Part to countries to which it does not extend), a broadcast F384. . . also qualifies for copyright protection if it is made from F384. . . a place in a country to which the Order relates.

Extent and application of this Part

157.- Countries to which this Part extends.

(1) This Part extends to England and Wales, Scotland and Northern Ireland.

(2) Her Majesty may by Order in Council direct that this Part shall extend, subject to such exceptions and modifications as may be specified in the Order, to:

(a) any of the Channel Islands,

(b) the Isle of Man, or

(3) That power includes power to extend, subject to such exceptions and modifications as may be specified in the Order, any Order in Council made under the following provisions of this Chapter.

(4) The legislature of a country to which this Part has been extended may modify or add to the provisions of this Part, in their operation as part of the law of that country, as the legislature may consider necessary to adapt the provisions to the circumstances of that country:

(a) as regards procedure and remedies, or

(b) as regards works qualifying for copyright protection by virtue of a connection with that country.

(5) Nothing in this section shall be construed as restricting the extent of paragraph 36 of Schedule 1 (transitional provisions: dependent territories where the M14Copyright Act 1956 or the M15Copyright Act 1911 remains in force) in relation to the law of a dependent territory to which this Part does not extend.

158.- Countries ceasing to be colonies.

(1) The following provisions apply where a country to which this Part has been extended ceases to be a colony of the United Kingdom.

(2) As from the date on which it ceases to be a colony it shall cease to be regarded as a country to which this Part extends for the purposes of:

(a) section 160(2)(a) (denial of copyright protection to citizens of countries not giving adequate protection to British works), and

(b) sections 163 and 165 (Crown and Parliamentary copyright).

(3) But it shall continue to be treated as a country to which this Part extends for the purposes of sections 154 to 156 (qualification for copyright protection) until:

(a) an Order in Council is made in respect of that country under section 159 (application of this Part to countries to which it does not extend), or

(b) an Order in Council is made declaring that it shall cease to be so treated by reason of the fact that the provisions of this Part as part of the law of that country have been repealed or amended.

(4) A statutory instrument containing an Order in Council under subsection (3)(b) shall be subject to annulment in pursuance of a resolution of either House of Parliament.

[F387

159.- Application of this Part to countries to which it does not extend

(1) Where a country is a party to the Berne Convention or a member of the World Trade Organisation, this Part, so far as it relates to literary, dramatic, musical and artistic works, films and typographical arrangements of published editions:

(a) applies in relation to a citizen or subject of that country or a person domiciled or resident there as it applies in relation to a person who is a British citizen or is domiciled or resident in the United Kingdom,

(b) applies in relation to a body incorporated under the law of that country as it applies in relation to a body incorporated under the law of a part of the United Kingdom, and

(c) applies in relation to a work first published in that country as it applies in relation to a work first published in the United Kingdom.

(2) Where a country is a party to the Rome Convention, this Part, so far as it relates to sound recordings and broadcasts:

(a) applies in relation to that country as mentioned in paragraphs (a), (b) and (c) of subsection (1), and

(b) applies in relation to a broadcast made from that country as it applies to a broadcast made from the United Kingdom.

(3) Where a country is a party to the WPPT, this Part, so far as relating to sound recordings, applies in relation to that country as mentioned in paragraphs (a), (b) and (c) of subsection (1).

(4) Her Majesty may by Order in Council:

(a) make provision for the application of this Part to a country by subsection (1), (2) or (3) to be subject to specified restrictions;

(b) make provision for applying this Part, or any of its provisions, to a specified country;

(d) make provision for the application of legislation to a country under paragraph (b) or (c) to be subject to specified restrictions.

(5) Provision made under subsection (4) may apply generally or in relation to such classes of works, or other classes of case, as are specified.

(6) Her Majesty may not make an Order in Council containing provision under subsection (4)(b) or (c) unless satisfied that provision has been or will be made under the law of the country or countries in question, in respect of the classes to which the provision under subsection (4)(b) or (c) relates, giving adequate protection to the owners of copyright under this Part.

(7) Application under subsection (4)(b) or (c) is in addition to application by subsections (1) to (3).

(8) Provision made under subsection (4)(c) may cover countries that become (or again become) of the specified description after the provision comes into force.

(9) In this section:

“the Berne Convention” means any Act of the International Convention for the Protection of Literary and Artistic Works signed at Berne on 9 September 1886;

“the Rome Convention” means the International Convention for the Protection of Performers, Producers of Phonograms and Broadcasting Organisations done at Rome on 26 October 1961;

“the WPPT” means the World Intellectual Property Organisation Performances and Phonograms Treaty adopted in Geneva on 20 December 1996.

(10) A statutory instrument containing an Order in Council under this section is subject to annulment in pursuance of a resolution of either House of Parliament.]

160.- Denial of copyright protection to citizens of countries not giving adequate protection to British works.

(1) If it appears to Her Majesty that the law of a country fails to give adequate protection to British works to which this section applies, or to one or more classes of such works, Her Majesty may make provision by Order in Council in accordance with this section restricting the rights conferred by this Part in relation to works of authors connected with that country.

(2) An Order in Council under this section shall designate the country concerned and provide that, for the purposes specified in the Order, works first published after a date specified in the Order shall not be treated as qualifying for copyright protection by virtue of such publication if at that time the authors are:

(a) citizens or subjects of that country (not domiciled or resident in the United Kingdom or another country to which the relevant provisions of this Part extend), or

(b) bodies incorporated under the law of that country;and the Order may make such provision for all the purposes of this Part or for such purposes as are specified in the Order, and either generally or in relation to such class of cases as are specified in the Order, having regard to the nature and extent of that failure referred to in subsection (1).

(3) This section applies to literary, dramatic, musical and artistic works, sound recordings and films; and “British works” means works of which the author was a qualifying person at the material time within the meaning of section 154.

(4)A statutory instrument containing an Order in Council under this section shall be subject to annulment in pursuance of a resolution of either House of Parliament.

Supplementary

161.- Territorial waters and the continental shelf.

(1) For the purposes of this Part the territorial waters of the United Kingdom shall be treated as part of the United Kingdom.

(2) This Part applies to things done in the United Kingdom sector of the continental shelf on a structure or vessel which is present there for purposes directly connected with the exploration of the sea bed or subsoil or the exploitation of their natural resources as it applies to things done in the United Kingdom.

(3) The United Kingdom sector of the continental shelf means the areas designated by order under section 1(7) of the M16Continental Shelf Act 1964.

162.- British ships, aircraft and hovercraft.

(1) This Part applies to things done on a British ship, aircraft or hovercraft as it applies to things done in the United Kingdom.

(2) In this section:

“British ship” means a ship which is a British ship for the purposes of the [F388Merchant Shipping Act 1995] otherwise than by virtue of registration in a country outside the United Kingdom; and

“British aircraft” and “British hovercraft” mean an aircraft or hovercraft registered in the United Kingdom.

Chapter X.- Miscellaneous and General

Crown and Parliamentary copyright

163.- Crown copyright.

(1) Where a work is made by Her Majesty or by an officer or servant of the Crown in the course of his duties:

(a) the work qualifies for copyright protection notwithstanding section 153(1) (ordinary requirement as to qualification for copyright protection), and

(b) Her Majesty is the first owner of any copyright in the work.

(1A) F389. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(2) Copyright in such a work is referred to in this Part as “Crown copyright”, notwithstanding that it may be, or have been, assigned to another person.

(3) Crown copyright in a literary, dramatic, musical or artistic work continues to subsist:

(a) until the end of the period of 125 years from the end of the calendar year in which the work was made, or

(b) if the work is published commercially before the end of the period of 75 years from the end of the calendar year in which it was made, until the end of the period of 50 years from the end of the calendar year in which it was first so published.

(4) In the case of a work of joint authorship where one or more but not all of the authors are persons falling within subsection (1), this section applies only in relation to those authors and the copyright subsisting by virtue of their contribution to the work.

(5) Except as mentioned above, and subject to any express exclusion elsewhere in this Part, the provisions of this Part apply in relation to Crown copyright as to other copyright.

(6) This section does not apply to a work if, or to the extent that, Parliamentary copyright subsists in the work (see sections 165 [F390to [F391166D]]).

164.- Copyright in Acts and Measures.

(1) Her Majesty is entitled to copyright in every Act of Parliament [F392Act of the Scottish Parliament][F393, [F394Measure of the National Assembly for Wales, Act of the National Assembly for Wales,] Act of the Northern Ireland Assembly] or Measure of the General Synod of the Church of England.

(2) The copyright subsists

[F395

(a) in the case of an Act or a Measure of the General Synod of the Church of England, until the end of the period of 50 years from the end of the calendar year in which Royal Assent was given, and

(b) in the case of a Measure of the National Assembly for Wales, until the end of the period of 50 years from the end of the calendar year in which the Measure was approved by Her Majesty in Council.]

(3) References in this Part to Crown copyright (except in section 163) include copyright under this section; and, except as mentioned above, the provisions of this Part apply in relation to copyright under this section as to other Crown copyright.

(4) No other copyright, or right in the nature of copyright, subsists in an Act or Measure.

165.- Parliamentary copyright.

(1) Where a work is made by or under the direction or control of the House of Commons or the House of Lords:

(a) the work qualifies for copyright protection notwithstanding section 153(1) (ordinary requirement as to qualification for copyright protection), and

(b) the House by whom, or under whose direction or control, the work is made is the first owner of any copyright in the work, and if the work is made by or under the direction or control of both Houses, the two Houses are joint first owners of copyright.

(2) Copyright in such a work is referred to in this Part as “Parliamentary copyright”, notwithstanding that it may be, or have been, assigned to another person.

(3) Parliamentary copyright in a literary, dramatic, musical or artistic work continues to subsist until the end of the period of 50 years from the end of the calendar year in which the work was made.

(4) For the purposes of this section, works made by or under the direction or control of the House of Commons or the House of Lords include:

(a) any work made by an officer or employee of that House in the course of his duties, and

(b) any sound recording, film [F396or live broadcast] of the proceedings of that House;but a work shall not be regarded as made by or under the direction or control of either House by reason only of its being commissioned by or on behalf of that House.

(5) In the case of a work of joint authorship where one or more but not all of the authors are acting on behalf of, or under the direction or control of, the House of Commons or the House of Lords, this section applies only in relation to those authors and the copyright subsisting by virtue of their contribution to the work.

(6) Except as mentioned above, and subject to any express exclusion elsewhere in this Part, the provisions of this Part apply in relation to Parliamentary copyright as to other copyright.

(7) The provisions of this section also apply, subject to any exceptions or modifications specified by Order in Council, to works made by or under the direction or control of any other legislative body of a country to which this Part extends; and references in this Part to “Parliamentary copyright” shall be construed accordingly.

(8)A statutory instrument containing an Order in Council under subsection (7) shall be subject to annulment in pursuance of a resolution of either House of Parliament.

166.- Copyright in Parliamentary Bills.

(1) Copyright in every Bill introduced into Parliament belongs, in accordance with the following provisions, to one or both of the Houses of Parliament.

(2) Copyright in a public Bill belongs in the first instance to the House into which the Bill is introduced, and after the Bill has been carried to the second House to both Houses jointly, and subsists from the time when the text of the Bill is handed in to the House in which it is introduced.

(3) Copyright in a private Bill belongs to both Houses jointly and subsists from the time when a copy of the Bill is first deposited in either House.

(4) Copyright in a personal Bill belongs in the first instance to the House of Lords, and after the Bill has been carried to the House of Commons to both Houses jointly, and subsists from the time when it is given a First Reading in the House of Lords.

(5) Copyright under this section ceases:

(a) on Royal Assent, or

(b) if the Bill does not receive Royal Assent, on the withdrawal or rejection of the Bill or the end of the Session:

Provided that, copyright in a Bill continues to subsist notwithstanding its rejection in any Session by the House of Lords if, by virtue of the Parliament Acts 1911 and 1949, it remains possible for it to be presented for Royal Assent in that Session.

(6) References in this Part to Parliamentary copyright (except in section 165) include copyright under this section; and, except as mentioned above, the provisions of this Part apply in relation to copyright under this section as to other Parliamentary copyright.

(7) No other copyright, or right in the nature of copyright, subsists in a Bill after copyright has once subsisted under this section; but without prejudice to the subsequent operation of this section in relation to a Bill which, not having passed in one Session, is reintroduced in a subsequent Session.

[F397

166A.- Copyright in Bills of the Scottish Parliament.

(1) Copyright in every Bill introduced into the Scottish Parliament belongs to the Scottish Parliamentary Corporate Body.

(2) Copyright under this section subsists from the time when the text of the Bill is handed in to the Parliament for introduction:

(a) until the Bill receives Royal Assent, or

(b) if the Bill does not receive Royal Assent, until it is withdrawn or rejected or no further parliamentary proceedings may be taken in respect of it.

(3) References in this Part to Parliamentary copyright (except in section 165) include copyright under this section; and, except as mentioned above, the provisions of this Part apply in relation to copyright under this section as to other Parliamentary copyright.

(4) No other copyright, or right in the nature of copyright, subsists in a Bill after copyright has once subsisted under this section; but without prejudice to the subsequent operation of this section in relation to a Bill which, not having received Royal Assent, is later reintroduced into the Parliament.][F398

166B.- Copyright in Bills of the Northern Ireland Assembly.

(1) Copyright in every Bill introduced into the Northern Ireland Assembly belongs to the Northern Ireland Assembly Commission.

(2) Copyright under this section subsists from the time when the text of the Bill is handed in to the Assembly for introduction:

(a) until the Bill receives Royal Assent, or

(b) if the Bill does not receive Royal Assent, until it is withdrawn or rejected or no further proceedings of the Assembly may be taken in respect of it.

166C.- Copyright in proposed Measures of the National Assembly for Wales

(1) Copyright in every proposed Assembly Measure introduced into the National Assembly for Wales belongs to the National Assembly for Wales Commission.

(2) Copyright under this section subsists from the time when the text of the proposed Assembly Measure is handed in to the Assembly for introduction:

(a) until the proposed Assembly Measure is approved by Her Majesty in Council, or

(b) if the proposed Assembly Measure is not approved by Her Majesty in Council, until it is withdrawn or rejected or no further proceedings of the Assembly may be taken in respect of it.

(4) No other copyright, or right in the nature of copyright, subsists in a proposed Assembly Measure after copyright has once subsisted under this section; but without prejudice to the subsequent operation of this section in relation to a proposed Assembly Measure which, not having been approved by Her Majesty in Council, is later reintroduced into the Assembly.

166D.-Copyright in Bills of the National Assembly for Wales

(1) Copyright in every Bill introduced into the National Assembly for Wales belongs to the National Assembly for Wales Commission.

(2) Copyright under this section subsists from the time when the text of the Bill is handed in to the Assembly for introduction:

(a) until the Bill receives Royal Assent, or

(b )if the Bill does not receive Royal Assent, until it is withdrawn or rejected or no further proceedings of the Assembly may be taken in respect of it.

167.- Houses of Parliament: supplementary provisions with respect to copyright.

(1) For the purposes of holding, dealing with and enforcing copyright, and in connection with all legal proceedings relating to copyright, each House of Parliament shall be treated as having the legal capacities of a body corporate, which shall not be affected by a prorogation or dissolution.

(2) The functions of the House of Commons as owner of copyright shall be exercised by the Speaker on behalf of the House; and if so authorised by the Speaker, or in case of a vacancy in the office of Speaker, those functions may be discharged by the Chairman of Ways and Means or a Deputy Chairman.

(3) For this purpose a person who on the dissolution of Parliament was Speaker of the House of Commons, Chairman of Ways and Means or a Deputy Chairman may continue to act until the corresponding appointment is made in the next Session of Parliament.

(4) The functions of the House of Lords as owner of copyright shall be exercised by the Clerk of the Parliaments on behalf of the House; and if so authorised by him, or in case of a vacancy in the office of Clerk of the Parliaments, those functions may be discharged by the Clerk Assistant or the Reading Clerk.

(5) Legal proceedings relating to copyright:

(a) shall be brought by or against the House of Commons in the name of “The Speaker of the House of Commons”; and

(b) shall be brought by or against the House of Lords in the name of “The Clerk of the Parliaments”.

Other miscellaneous provisions

168.- Copyright vesting in certain international organisations.

(1) Where an original literary, dramatic, musical or artistic work:

(a) is made by an officer or employee of, or is published by, an international organisation to which this section applies, and

(b) does not qualify for copyright protection under section 154 (qualification by reference to author) or section 155 (qualification by reference to country of first publication),copyright nevertheless subsists in the work by virtue of this section and the organisation is first owner of that copyright.

(2) The international organisations to which this section applies are those as to which Her Majesty has by Order in Council declared that it is expedient that this section should apply.

(3) Copyright of which an international organisation is first owner by virtue of this section continues to subsist until the end of the period of 50 years from the end of the calendar year in which the work was made or such longer period as may be specified by Her Majesty by Order in Council for the purpose of complying with the international obligations of the United Kingdom.

(4) An international organisation to which this section applies shall be deemed to have, and to have had at all material times, the legal capacities of a body corporate for the purpose of holding, dealing with and enforcing copyright and in connection with all legal proceedings relating to copyright.

(5) A statutory instrument containing an Order in Council under this section shall be subject to annulment in pursuance of a resolution of either House of Parliament.

169.- Folklore, &c.: anonymous unpublished works.

(1) Where in the case of an unpublished literary, dramatic, musical or artistic work of unknown authorship there is evidence that the author (or, in the case of a joint work, any of the authors) was a qualifying individual by connection with a country outside the United Kingdom, it shall be presumed until the contrary is proved that he was such a qualifying individual and that copyright accordingly subsists in the work, subject to the provisions of this Part.

(2) If under the law of that country a body is appointed to protect and enforce copyright in such works, Her Majesty may by Order in Council designate that body for the purposes of this section.

(3) A body so designated shall be recognised in the United Kingdom as having authority to do in place of the copyright owner anything, other than assign copyright, which it is empowered to do under the law of that country; and it may, in particular, bring proceedings in its own name.

(4) A statutory instrument containing an Order in Council under this section shall be subject to annulment in pursuance of a resolution of either House of Parliament.

(5) In subsection (1) a “qualifying individual” means an individual who at the material time (within the meaning of section 154) was a person whose works qualified under that section for copyright protection.

(6) This section does not apply if there has been an assignment of copyright in the work by the author of which notice has been given to the designated body; and nothing in this section affects the validity of an assignment of copyright made, or licence granted, by the author or a person lawfully claiming under him.

Transitional provisions and savings

170.- Transitional provisions and savings.

[F400

(1)] Schedule 1 contains transitional provisions and savings relating to works made, and acts or events occurring, before the commencement of this Part, and otherwise with respect to the operation of the provisions of this Part.

[F401

(2)The Secretary of State may by regulations amend Schedule 1 to reduce the duration of copyright in existing works which are unpublished, other than photographs or films.

(3) The regulations may provide for the copyright to expire:

(a) with the end of the term of protection of copyright laid down by Directive 2006/116/ EC or at any later time;

(b) subject to that, on the commencement of the regulations or at any later time.

(4) “Existing works” has the same meaning as in Schedule 1.

(5) Regulations under subsection (2) may:

(a) make different provision for different purposes;

(b) make supplementary or transitional provision;

(c) make consequential provision, including provision amending any enactment or subordinate legislation passed or made before that subsection comes into force.

(6) The power to make regulations under subsection (2) is exercisable by statutory instrument.

(7) A statutory instrument containing regulations under subsection (2) may not be made unless a draft of the instrument has been laid before and approved by resolution of each House of Parliament.]

171.- Rights and privileges under other enactments or the common law.

(1) Nothing in this Part affects:

(a) any right or privilege of any person under any enactment (except where the enactment is expressly repealed, amended or modified by this Act);

(b) any right or privilege of the Crown subsisting otherwise than under an enactment;

(d) the right of the Crown or any person deriving title from the Crown to sell, use or otherwise deal with articles forfeited under the laws relating to customs and excise;

(e) the operation of any rule of equity relating to breaches of trust or confidence.

(2) Subject to those savings, no copyright or right in the nature of copyright shall subsist otherwise than by virtue of this Part or some other enactment in that behalf.

(3) Nothing in this Part affects any rule of law preventing or restricting the enforcement of copyright, on grounds of public interest or otherwise.

(4) Nothing in this Part affects any right of action or other remedy, whether civil or criminal, available otherwise than under this Part in respect of acts infringing any of the rights conferred by Chapter IV (moral rights).

(5) The savings in subsection (1) have effect subject to section 164(4) and section 166(7) (copyright in Acts, Measures and Bills: exclusion of other rights in the nature of copyright).

Interpretation

172.- General provisions as to construction.

(1) This Part restates and amends the law of copyright, that is, the provisions of the M17Copyright Act 1956, as amended.

(2) A provision of this Part which corresponds to a provision of the previous law shall not be construed as departing from the previous law merely because of a change of expression.

(3) Decisions under the previous law may be referred to for the purpose of establishing whether a provision of this Part departs from the previous law, or otherwise for establishing the true construction of this Part.

[F402 [F403

172A.- Meaning of EEA and related expressions.

[F404

(1) In this Part:

“ the EEA ” means the European Economic Area; and

“ EEA state ” means a member State, Iceland, Liechtenstein or Norway. ]]

(2) References in this Part to a person being [F405a national of an EEA State] shall be construed in relation to a body corporate as references to its being incoporated under the law of an EEA state.

(3) F406. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .]

173.- Construction of references to copyright owner.

(1) Where different persons are (whether in consequence of a partial assignment or otherwise) entitled to different aspects of copyright in a work, the copyright owner for any purpose of this Part is the person who is entitled to the aspect of copyright relevant for that purpose.

(2)Where copyright (or any aspect of copyright) is owned by more than one person jointly, references in this Part to the copyright owner are to all the owners, so that, in particular, any requirement of the licence of the copyright owner requires the licence of all of them.

174.- Meaning of “educational establishment” and related expressions.

(1) The expression “educational establishment” in a provision of this Part means:

(a) any school, and

(b) any other description of educational establishment specified for the purposes of this Part, or that provision, by order of the Secretary of State.

(2) The Secretary of State may by order provide that the provisions of this Part relating to educational establishments shall apply, with such modifications and adaptations as may be specified in the order, in relation to teachers who are employed by a [F407local authority (as defined in section 579(1) of the Education Act 1996) or (in Northern Ireland) a local education authority,] to give instruction elsewhere to pupils who are unable to attend an educational establishment.

(3) In subsection (1)(a) “school”:

(a) in relation to England and Wales, has the same meaning as in [F408the Education Act 1996];

(b) in relation to Scotland, has the same meaning as in the M18Education (Scotland) Act 1962, except that it includes an approved school within the meaning of the M19Social Work (Scotland) Act 1968; and

(c) in relation to Northern Ireland, has the same meaning as in the M20Education and Libraries (Northern Ireland) Order 1986.

(4) An order under subsection (1)(b) may specify a description of educational establishment by reference to the instruments from time to time in force under any enactment specified in the order.

(5) In relation to an educational establishment the expressions “teacher” and “pupil” in this Part include, respectively, any person who gives and any person who receives instruction.

(6) References in this Part to anything being done “on behalf of” an educational establishment are to its being done for the purposes of that establishment by any person.

(7) An order under this section shall be made by statutory instrument which shall be subject to annulment in pursuance of a resolution of either House of Parliament.

175.- Meaning of publication and commercial publication.

(1) In this Part “publication”, in relation to a work:

(a) means the issue of copies to the public, and

(b) includes, in the case of a literary, dramatic, musical or artistic work, making it available to the public by means of an electronic retrieval system;and related expressions shall be construed accordingly.

(2) In this Part “commercial publication”, in relation to a literary, dramatic, musical or artistic work means:

(a) issuing copies of the work to the public at a time when copies made in advance of the receipt of orders are generally available to the public, or

(b) making the work available to the public by means of an electronic retrieval system;and related expressions shall be construed accordingly.

(3) In the case of a work of architecture in the form of a building, or an artistic work incorporated in a building, construction of the building shall be treated as equivalent to publication of the work.

(4) The following do not constitute publication for the purposes of this Part and references to commercial publication shall be construed accordingly:

(a) in the case of a literary, dramatic or musical work:

(i) the performance of the work, or

(ii) the [F409communication to the public of the work] (otherwise than for the purposes of an electronic retrieval system);

(b) in the case of an artistic work:

(i) the exhibition of the work,

(ii) the issue to the public of copies of a graphic work representing, or of photographs of, a work of architecture in the form of a building or a model for a building, a sculpture or a work of artistic craftsmanship,

(iii) the issue to the public of copies of a film including the work, or

(iv) the [F409communication to the public of the work] (otherwise than for the purposes of an electronic retrieval system);

(i) the work being played or shown in public, or

(ii) the [F409communication to the public of the work].

(5) References in this Part to publication or commercial publication do not include publication which is merely colourable and not intended to satisfy the reasonable requirements of the public.

(6) No account shall be taken for the purposes of this section of any unauthorised act.

176.- Requirement of signature: application in relation to body corporate.

(1) The requirement in the following provisions that an instrument be signed by or on behalf of a person is also satisfied in the case of a body corporate by the affixing of its seal:

section 78(3)(b) (assertion by licensor of right to identification of author in case of public exhibition of copy made in pursuance of the licence),

section 90(3) (assignment of copyright),

section 91(1) (assignment of future copyright),

section 92(1) (grant of exclusive licence).

(2) The requirement in the following provisions that an instrument be signed by a person is satisfied in the case of a body corporate by signature on behalf of the body or by the affixing of its seal:

section 78(2)(b) (assertion by instrument in writing of right to have author identified),

section 87(2) (waiver of moral rights).

177.- Adaptation of expressions for Scotland.

In the application of this Part to Scotland:

“account of profits” means accounting and payment of profits;

“accounts” means count, reckoning and payment;

“assignment” means assignation;

“costs” means expenses;

“defendant” means defender;

“delivery up” means delivery;

“estoppel” means personal bar;

“injunction” means interdict;

“interlocutory relief” means interim remedy; and

“plaintiff” means pursuer.

178.- Minor definitions.

In this Part:

“article”, in the context of an article in a periodical, includes an item of any description;

“business”includes a trade or profession;

“collective work” means:

(a) a work of joint authorship, or

(b) a work in which there are distinct contributions by different authors or in which works or parts of works of different authors are incorporated;

“computer-generated”, in relation to a work, means that the work is generated by computer in circumstances such that there is no human author of the work;

“country” includes any territory;

“the Crown” includes the Crown in right of [F410the Scottish Administration [F411, of the Welsh Assembly Government] or of] Her Majesty’s Government in Northern Ireland or in any country outside the United Kingdom to which this Part extends;

“electronic” means actuated by electric, magnetic, electro-mechanical energy, and “in electronic form” means in a form usable only by electronic means;

“employed”, “employee”, “employer”, and “employment” refer to employment under a contract of service or of apprenticeship;

“facsimile copy” includes a copy which is reduced or enlarged in scale;

“international organisation” means an organisation the members of which include one or more states;

“judicial proceedings”includes proceedings before any court, tribunal or person having authority to decide any matter affecting a person’s legal rights or liabilities;

“parliamentary proceedings” includes proceedings of the Northern Ireland Assembly [F412of the Scottish Parliament][F413, of the New Northern Ireland Assembly] or of the European Parliament [F414and Assembly proceedings within the meaning of section 1(5) of the Government of Wales Act 2006];

[F415 “ private study ” does not include any study which is directly or indirectly for a commercial purpose; ]

[F416“producer”, in relation to a sound recording or a film, means the person by whom the arrangements necessary for the making of the sound recording or film are undertaken;][F417“public library” means a library administered by or on behalf of:

(a)in England and Wales, a library authority within the meaning of the Public Libraries and Museums Act 1964;

(b)in Scotland, a statutory library authority within the meaning of the Public Libraries (Scotland) Act 1955;

(c)in Northern Ireland, an Education and Library Board within the meaning of the Education and Libraries (Northern Ireland) Order 1986;]

F418. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[F419“rental right” means the right of a copyright owner to authorise or prohibit the rental of copies of the work (see section 18A);]

“reprographic copy” and “reprographic copying” refer to copying by means of a reprographic process;

“reprographic process” means a process:

(a)for making facsimile copies, or

(b)involving the use of an appliance for making multiple copies,

and includes, in relation to a work held in electronic form, any copying by electronic means, but does not include the making of a film or sound recording;

“sufficient acknowledgement” means an acknowledgement identifying the work in question by its title or other description, and identifying the author unless:

(a) in the case of a published work, it is published anonymously;

(b) in the case of an unpublished work, it is not possible for a person to ascertain the identity of the author by reasonable inquiry;

“sufficient disclaimer”, in relation to an act capable of infringing the right conferred by section 80 (right to object to derogatory treatment of work), means a clear and reasonably prominent indication:

(a)given at the time of the act, and

(b)if the author or director is then identified, appearing along with the identification,

that the work has been subjected to treatment to which the author or director has not consented,

“telecommunications system” means a system for conveying visual images, sounds or other information by electronic means;

“typeface” includes an ornamental motif used in printing;

“unauthorised”, as regards anything done in relation to a work, means done otherwise than:

(a)by or with the licence of the copyright owner, or

(b) if copyright does not subsist in the work, by or with the licence of the author or, in a case where section 11(2) would have applied, the author’s employer or, in either case, persons lawfully claiming under him, or

(c)in pursuance of section 48 (copying, &c of certain material by the Crown);

[F420 “ wireless broadcast ” means a broadcast by means of wireless telegraphy; ]

“wireless telegraphy” means the sending of electro-magnetic energy over paths not provided by a material substance constructed or arranged for that purpose [F421, but does not include the transmission of microwave energy between terrestrial fixed points];

“writing” includes any form of notation or code, whether by hand or otherwise and regardless of the method by which, or medium in or on which, it is recorded, and “written” shall be construed accordingly

179.- Index of defined expressions.

The following Table shows provisions defining or otherwise explaining expressions used in this Part (other than provisions defining or explaining an expression used only in the same section):

[F422accessible copy (in sections 31A to 31F) section 31F(4)]

account of profits and accounts (in Scotland) section 177

acts restricted by copyright section 16(1)

adaptation section 21(3)

F423. . . F423. . .

[F424archivist (in sections 40A to 43) section 43A(5)]

article (in a periodical) section 178

artistic work section 4(1)

assignment (in Scotland) section 177

author sections 9 and 10(3)

[F425authorised body (in sections 31B to 31BB) section 31F(6)]

broadcast (and related expressions) section 6

building section 4(2)

business section 178

F426. . . F427. . . . . . . . . . . . . . . . . . . .

collective work section 178

commencement (in Schedule 1) paragraph 1(2) of that Schedule

commercial publication section 175

[F428communication to the public section 20]

computer-generated section 178

[F429conducted for profit (in sections 40A to 43) section 43A(4)]

copy and copying section 17

costs (in Scotland) section 177

country section 178

[F430country of origin] [F430section 15A.]

the Crown section 178

Crown copyright sections 163(2) and 164(3)

[F429curator (in sections 40A to 43) section 43A(5)][F431database] [F431section 3A(1)]

defendant (in Scotland) section 177

delivery up (in Scotland) section 177

[F425disabled person (in sections 31A to 31F) section 31F(2) and (3)]

dramatic work section 3(1)

educational establishment sections 174(1) to (4)

electronic and electronic form section 178

employed, employee, employer and employment section 178

[F432excepted sound recording s ection 72(1A)]

exclusive licence section 92(1)

[F433 the EEA , EEA state and national of an EEA state ] [F434section 172A]

existing works (in Schedule 1) paragraph 1(3) of that Schedule

facsimile copy section 178

film [F435section 5B]

future copyright section 91(2)

general licence (in sections 140 and 141) section 140(7)

graphic work section 4(2)

infringing copy section 27

injunction (in Scotland) section 177

interlocutory relief (in Scotland) section 177

international organisation section 178

issue of copies to the public [F436section 18]

joint authorship (work of) sections 10(1) and (2)

judicial proceedings section 178

[F437lawful user (in sections 50A to 50C)] [F437section 50A(2).][F438lending] [F438section 18A(2) to (6)][F439librarian (in sections 40A to 43 section 43A(5)][F429library (in sections 40A to 43) section 43A(2)]

licence (in sections 125 to 128) section 124

licence of copyright owner sections 90(4), 91(3) and 173

licensing body (in Chapter VII) section 116(2)

licensing scheme (generally) section 116(1)

licensing scheme (in sections 118 to 121) section 117

literary work section 3(1)

made (in relation to a literary, dramatic or musical work) section 3(2)

[F429 museum (in sections 40A to 43) section 43A(3)]

musical work section 3(1)

[F440 needletime] [F440 section 135A]

the new copyright provisions (in Schedule 1) paragraph 1(1) of that Schedule

the 1911 Act (in Schedule 1) paragraph 1(1) of that Schedule

the 1956 Act (in Schedule 1) paragraph 1(1) of that Schedule

on behalf of (in relation to an educational establishment) section 174(5)

[F431original (in relation to a database)] [F431section 3A(2)]

Parliamentary copyright sections 165(2) and (7) [F441166(6) [F442166A(3) [F443166B(3) 166C(3) and 166D(3)]]]

parliamentary proceedings section 178

performance section 19(2)

photograph section 4(2)

plaintiff (in Scotland) section 177

F444. . . F444. . .

[F445private study section 178][F446producer (in relation to a sound recording or film] [F446section 178.]

programme (in the context of broadcasting) section 6(3)

prospective owner (of copyright) section 91(2)

[F447public library] [F447section 178.]

publication and related expressions section 175

published edition (in the context of copyright in the

typographical arrangement) section 8

pupil section 174(5)

rental [F448section 18A(2) to (6)][F438rental right] [F438section 178.]

reprographic copies and repographic copying section 178

reprographic process section 178

sculpture section 4(2)

signed section 176

sound recording [F449sections 5A and 135A]

sufficient acknowledgement section 178

sufficient disclaimer section 178

[F425supply (in sections 31B to 31BB) section 31F(7)]

teacher section 174(5)

telecommunications system section 178

[F440terms of payment] [F440section 135A]

typeface section 178

unauthorised (as regards things done in relation to a work) section 178

unknown (in relation to the author of a work) section 9(5)

unknown authorship (work of) section 9(4)

F423. . . F423. . .

[F450wireless broadcast section 178]

wireless telegraphy section 178

work (in Schedule 1) paragraph 2(1) of that Schedule

work of more than one author (in Chapter VII) section 116(4)

writing and written section 178

Part II.- Rights in performances

[F451Chapter 1

INTRODUCTORY

180.- Rights conferred on performers and persons having recording rights.

(1) [F452Chapter 2 of this Part (economic rights)] confers rights:

(a) on a performer, by requiring his consent to the exploitation of his performances (see sections 181 to 184), and

(b) on a person having recording rights in relation to a performance, in relation to recordings made without his consent or that of the performer (see sections 185 to 188),and creates offences in relation to dealing with or using illicit recordings and certain other related acts (see sections 198 and 201).

[F453

(1) Rights are also conferred on a performer by the following provisions of Chapter 3 of this Part (moral rights):

(a) section 205C (right to be identified);

(b) section 205F (right to object to derogatory treatment of performance).]

(2) In this Part : “performance” means :

(a) a dramatic performance (which includes dance and mime),

(b) a musical performance,

(d) a performance of a variety act or any similar presentation,which is, or so far as it is, a live performance given by one or more individuals; and “recording”, in relation to a performance, means a film or sound recording:

(a) made directly from the live performance,

(b) made from a broadcast of F454. . . the performance, or

(3) The rights conferred by this Part apply in relation to performances taking place before the commencement of this Part; but no act done before commencement, or in pursuance of arrangements made before commencement, shall be regarded as infringing those rights.

(4) The rights conferred by this Part are independent of:

(a) any copyright in, or moral rights relating to, any work performed or any film or sound recording of, or broadcast F455. . . the performance, and

(b) any other right or obligation arising otherwise than under this Part.

181.- Qualifying performances.

A performance is a qualifying performance for the purposes of the provisions of this Part relating to performers’ right if it is given by a qualifying individual (as defined in section 206) or takes place in a qualifying country (as so defined).][F456 Chapter 2.- ECONOMIC RIGHTS

X3[F457 Performers’ rights]

X4[F458

182.- Consent required for recording, &c. of live performance.

(1) A performer’s rights are infringed by a person who, without his consent:

(a) makes a recording of the whole or any substantial part of a qualifying performance directly from the live performance,

(b) broadcasts live, F459. . . the whole or any substantial part of a qualifying performance,

(c) makes a recording of the whole or any substantial part of a qualifying performance directly from a broadcast of, F460. . . the live performance.

(2)F461. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(3) In an action for infringement of a performer’s rights brought by virtue of this section damages shall not be awarded against a defendant who shows that at the time of the infringement he believed on reasonable grounds that consent had been given.]

X5[F462

182A.- Consent required for copying of recording.

(1) A performer’s rights are infringed by a person who, without his consent, makes F463. . . a copy of a recording of the whole or any substantial part of a qualifying performance.

[F464

(1A) In subsection (1), making a copy of a recording includes making a copy which is transient or is incidental to some other use of the original recording.]

(2) It is immaterial whether the copy is made directly or indirectly.

(3) The right of a performer under this section to authorise or prohibit the making of such copies is referred to in [F465this Chapter] as “reproduction right”.]

X6[F466

182B.- Consent required for issue of copies to public.

(1) A performer’s rights are infringed by a person who, without his consent, issues to the public copies of a recording of the whole or any substantial part of a qualifying performance.

(2) References in this Part to the issue to the public of copies of a recording are to:

(a) the act of putting into circulation in the EEA copies not previously put into circulation in the EEA by or with the consent of the performer, or

(b) the act of putting into circulation outside the EEA copies not previously put into circulation in the EEA or elsewhere.

(3) References in this Part to the issue to the public of copies of a recording do not include:

(a) any subsequent distribution, sale, hiring or loan of copies previously put into circulation (but see section 182C: consent required for rental or lending), or

(b) any subsequent importation of such copies into the United Kingdom or another EEA state,except so far as paragraph (a) of subsection (2) applies to putting into circulation in the EEA copies previously put into circulation outside the EEA.

(4) References in this Part to the issue of copies of a recording of a performance include the issue of the original recording of the live performance.

(5) The right of a performer under this section to authorise or prohibit the issue of copies to the public is referred to in [F467this Chapter] as “distribution right”.]

X7[F468

182C.- Consent required for rental or lending of copies to public.

(1) A performer’s rights are infringed by a person who, without his consent, rents or lends to the public copies of a recording of the whole or any substantial part of a qualifying performance.

(2) In [F469this Chapter], subject to the following provisions of this section:

(a) “rental” means making a copy of a recording available for use, on terms that it will or may be returned, for direct or indirect economic or commercial advantage, and

(b) “lending” means making a copy of a recording available for use, on terms that it will or may be returned, otherwise than for direct or indirect economic or commercial advantage, through an establishment which is accessible to the public.

(3) The expressions “rental” and “lending” do not include:

(a) making available for the purpose of public performance, playing or showing in public [F470or communication to the public];

(b) making available for the purpose of exhibition in public; or

(4) The expression “lending” does not include making available between establishments which are accessible to the public.

(6) References in [F469this Chapter] to the rental or lending of copies of a recording of a performance include the rental or lending of the original recording of the live performance.

(7) In [F469this Chapter]:“rental right” means the right of a performer under this section to authorise or prohibit the rental of copies to the public, and

“lending right” means the right of a performer under this section to authorise or prohibit the lending of copies to the public.]

X8[F471

182CA.- Consent required for making available to the public

(1) A performer’s rights are infringed by a person who, without his consent, makes available to the public a recording of the whole or any substantial part of a qualifying performance by electronic transmission in such a way that members of the public may access the recording from a place and at a time individually chosen by them.

(2) The right of a performer under this section to authorise or prohibit the making available to the public of a recording is referred to in [F472this Chapter] as “making available right.]

X9 [F473

182D.- Right to equitable remuneration for exploitation of sound recording.

(1) Where a commercially published sound recording of the whole or any substantial part of a qualifying performance:

(a) is played in public, or

[F474

(b) is communicated to the public otherwise than by its being made available to the public in the way mentioned in section 182CA(1),]the performer is entitled to equitable remuneration from the owner of the copyright in the sound recording [F475or, where copyright in the sound recording has expired pursuant to section 191HA(4), from a person who plays the sound recording in public or communicates the sound recording to the public].

[F476

(1A) In subsection), (1 the reference to publication of a sound recording includes making it available to the public by electronic transmission in such a way that members of the public may access it from a place and at a time individually chosen by them.]

(2) The right to equitable remuneration under this section may not be assigned by the performer except to a collecting society for the purpose of enabling it to enforce the right on his behalf.The right is, however, transmissible by testamentary disposition or by operation of law as personal or moveable property; and it may be assigned or further transmitted by any person into whose hands it passes.

(3) The amount payable by way of equitable remuneration is as agreed by or on behalf of the persons by and to whom it is payable, subject to the following provisions.

(4) In default of agreement as to the amount payable by way of equitable remuneration, the person by or to whom it is payable may apply to the Copyright Tribunal to determine the amount payable.

(5) A person to or by whom equitable remuneration is payable may also apply to the Copyright Tribunal:

(a) to vary any agreement as to the amount payable, or

An order made on an application under this subsection has effect from the date on which it is made or such later date as may be specified by the Tribunal.

(6) On an application under this section the Tribunal shall consider the matter and make such order as to the method of calculating and paying equitable remuneration as it may determine to be reasonable in the circumstances, taking into account the importance of the contribution of the performer to the sound recording.

(7) An agreement is of no effect in so far as it purports:

(a) to exclude or restrict the right to equitable remuneration under this section, or

(b) to prevent a person questioning the amount of equitable remuneration or to restrict the powers of the Copyright Tribunal under this section.

[F477

(8) In this section “ collecting society ” means a society or other organisation which has as its main object, or one of its main objects, the exercise of the right to equitable remuneration on behalf of more than one performer. ]]

X10

183.- Infringement of performer’s rights by use of recording made without consent.

A performer’s rights are infringed by a person who, without his consent:

(a) shows or plays in public the whole or any substantial part of a qualifying performance, or

(b) [F478communicates to the public] the whole or any substantial part of a qualifying performance,by means of a recording which was, and which that person knows or has reason to believe was, made without the performer’s consent.

X11

184.- Infringement of performer’s rights by importing, possessing or dealing with illicit recording.

(1) A performer’s rights are infringed by a person who, without his consent:

(a) imports into the United Kingdom otherwise than for his private and domestic use, or

(b) in the course of a business possesses, sells or lets for hire, offers or exposes for sale or hire, or distributes,a recording of a qualifying performance which is, and which that person knows or has reason to believe is, an illicit recording.

(2) Where in an action for infringement of a performer’s rights brought by virtue of this section a defendant shows that the illicit recording was innocently acquired by him or a predecessor in title of his, the only remedy available against him in respect of the infringement is damages not exceeding a reasonable payment in respect of the act complained of.

(3) In subsection (2) “innocently acquired” means that the person acquiring the recording did not know and had no reason to believe that it was an illicit recording.

X12.- Rights of person having recording rights

X13

185.- Exclusive recording contracts and persons having recording rights.

(1) In [F479this Chapter] an “exclusive recording contract” means a contract between a performer and another person under which that person is entitled to the exclusion of all other persons (including the performer) to make recordings of one or more of his performances with a view to their commercial exploitation.

(2) References in [F479this Chapter] to a “person having recording rights”, in relation to a performance, are (subject to subsection (3)) to a person:

(a) who is party to and has the benefit of an exclusive recording contract to which the performance is subject, or

(b) to whom the benefit of such a contract has been assigned,and who is a qualifying person.

(3) If a performance is subject to an exclusive recording contract but the person mentioned in subsection (2)

is not a qualifying person, references in [F479this Chapter] to a “person having recording rights” in relation to the performance are to any person:

(a) who is licensed by such a person to make recordings of the performance with a view to their commercial exploitation, or

(b) to whom the benefit of such a licence has been assigned,and who is a qualifying person.

(4) In this section “with a view to commercial exploitation” means with a view to the recordings being sold or let for hire, or shown or played in public.

X14

186.- Consent required for recording of performance subject to exclusive contract.

(1) A person infringes the rights of a person having recording rights in relation to a performance who, without his consent or that of the performer, makes a recording of the whole or any substantial part of the performance F480. . . .

(2) In an action for infringement of those rights brought by virtue of this section damages shall not be awarded against a defendant who shows that at the time of the infringement he believed on reasonable grounds that consent had been given.

X15

187.- Infringement of recording rights by use of recording made without consent.

(1) A person infringes the rights of a person having recording rights in relation to a performance who, without his consent or, in the case of a qualifying performance, that of the performer:

(a) shows or plays in public the whole or any substantial part of the performance, or

(b) [F481communicates to the public] the whole or any substantial part of the performance,by means of a recording which was, and which that person knows or has reason to believe was, made without the appropriate consent.

(2) The reference in subsection (1) to “the appropriate consent” is to the consent of:

(a) the performer, or

(b) the person who at the time the consent was given had recording rights in relation to the performance (or, if there was more than one such person, of all of them).

X16

188.- Infringement of recording rights by importing, possessing or dealing with illicit recording.

(1) A person infringes the rights of a person having recording rights in relation to a performance who, without his consent or, in the case of a qualifying performance, that of the performer:

(a) imports into the United Kingdom otherwise than for his private and domestic use, or

(b) in the course of a business possesses, sells or lets for hire, offers or exposes for sale or hire, or distributes,a recording of the performance which is, and which that person knows or has reason to believe is, an illicit recording.

(2) Where in an action for infringement of those rights brought by virtue of this section a defendant shows that the illicit recording was innocently acquired by him or a predecessor in title of his, the only remedy available against him in respect of the infringement is damages not exceeding a reasonable payment in respect of the act complained of.

(3 )In subsection (2) “innocently acquired” means that the person acquiring the recording did not know and had no reason to believe that it was an illicit recording.

X17.- Exceptions to rights conferred

X18

189.- Acts permitted notwithstanding rights conferred by [F482this Chapter].

The provisions of Schedule 2 specify acts which may be done notwithstanding the rights conferred by [F483this Chapter], being acts which correspond broadly to certain of those specified in Chapter III of Part I (acts permitted notwithstanding copyright).

X19

190.- Power of tribunal to give consent on behalf of performer in certain cases.

[F484

(1) The Copyright Tribunal may, on the application of a person wishing to make a copy of a recording of a performance, give consent in a case where the identity or whereabouts of the person entitled to the reproduction right cannot be ascertained by reasonable inquiry.]

(2) Consent given by the Tribunal has effect as consent of [F485the person entitled to the reproduction right] for the purposes of:

(a) the provisions of [F486this Chapter] relating to performers’ rights, and

(b) section 198(3)(a) (criminal liability: sufficient consent in relation to qualifying performances),and may be given subject to any conditions specified in the Tribunal’s order.

(3) The Tribunal shall not give consent under subsection (1)(a) except after the service or publication of such notices as may be required by rules made under section 150 (general procedural rules) or as the Tribunal may in any particular case direct.

F487

(4). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(5) In any case the Tribunal shall take into account the following factors:

(a) whether the original recording was made with the performer’s consent and is lawfully in the possession or control of the person proposing to make the further recording;

(b) whether the making of the further recording is consistent with the obligations of the parties to the arrangements under which, or is otherwise consistent with the purposes for which, the original recording was made.

(6) Where the Tribunal gives consent under this section it shall, in default of agreement between the applicant and [F488the person entitled to the reproduction right], make such order as it thinks fit as to the payment to be made to [F489that person] in consideration of consent being given.

X20 F490.- [Duration of rights]

X21 [F491

191.- Duration of rights.]

(1) The following provisions have effect with respect to the duration of the rights conferred by [F492this Chapter].

(2) The rights conferred by [F492this Chapter] in relation to a performance expire:

(a) at the end of the period of 50 years from the end of the calendar year in which the performance takes place, or

(b) if during that period a recording of the performance[F493, other than a sound recording,] is released, 50 years from the end of the calendar year in which it is released, [F494or

(c) if during that period a sound recording of the performance is released, 70 years from the end of the calendar year in which it is released,]subject as follows.

(3) For the purposes of subsection (2) a recording is “released” when it is first published, played or shown in public [F495 or communicated to the public]; but in determining whether a recording has been released no account shall be taken of any unauthorised act.

(4) Where a performer is not a national of an EEA state, the duration of the rights conferred by [F492 this Chapter ] in relation to his performance is that to which the performance is entitled in the country of which he is a national, provided that does not exceed the period which would apply under subsections (2) and (3).

(5) If or to the extent that the application of subsection (4) would be at variance with an international obligation to which the United Kingdom became subject prior to 29th October 1993, the duration of the rights conferred by [F492this Chapter] shall be as specified in subsections (2) and (3).]

X22 [F496.- Performers’ property rights]

X23 [F497

191A.- Performers’ property rights.

(1) The following rights conferred by [F498this Chapter] on a performer:

reproduction right (section 182A),

distribution right (section 182B),

rental right and lending right (section 182C),

[F499making available right (section 182CA),]

are property rights (“F500. . . performer’s property rights”).

(2) References in [F498this Chapter] to the consent of the performer shall be construed in relation to a performer’s property rights as references to the consent of the rights owner.

(3) Where different persons are (whether in consequence of a partial assignment or otherwise) entitled to different aspects of a performer’s property rights in relation to a performance, the rights owner for any purpose of [F498this Chapter] is the person who is entitled to the aspect of those rights relevant for that purpose.

(4) Where a performer’s property rights (or any aspect of them) is owned by more than one person jointly, references in [F498this Chapter] to the rights owner are to all the owners, so that, in particular, any requirement of the licence of the rights owner requires the licence of all of them.]

X24 [F501

191B.- Assignment and licences.

(1) A performer’s property rights are transmissible by assignment, by testamentary disposition or by operation of law, as personal or moveable property.

(2) An assignment or other transmission of a performer’s property rights may be partial, that is, limited so as to apply:

(a) to one or more, but not all, of the things requiring the consent of the rights owner;

(b) to part, but not the whole, of the period for which the rights are to subsist.

(3) An assignment of a performer’s property rights is not effective unless it is in writing signed by or on behalf of the assignor.

(4) A licence granted by the owner of a performer’s property rights is binding on every successor in title to his interest in the rights, except a purchaser in good faith for valuable consideration and without notice (actual or constructive) of the licence or a person deriving title from such a purchaser; and references in [F502this Chapter] to doing anything with, or without, the licence of the rights owner shall be construed accordingly.]

X25 [F503

191C.- Prospective ownership of a performer’s property rights.

(1) This section applies where by an agreement made in relation to a future recording of a performance, and signed by or on behalf of the performer, the performer purports to assign his performer’s property rights (wholly or partially) to another person.

(2) If on the rights coming into existence the assignee or another person claiming under him would be entitled as against all other persons to require the rights to be vested in him, they shall vest in the assignee or his successor in title by virtue of this subsection.

(3) A licence granted by a prospective owner of a performer’s property rights is binding on every successor in title to his interest (or prospective interest) in the rights, except a purchaser in good faith for valuable consideration and without notice (actual or constructive) of the licence or a person deriving title from such a purchaser.References in [F504this Chapter] to doing anything with, or without, the licence of the rights owner shall be construed accordingly.

(4) In subsection (3) “prospective owner” in relation to a performer’s property rights means a person who is prospectively entitled to those rights by virtue of such an agreement as is mentioned in subsection (1).]

X26 [F505

191D.- Exclusive licences.

(1) In [F506this Chapter] an “exclusive licence” means a licence in writing signed by or on behalf of the owner of a performer’s property rights authorising the licensee to the exclusion of all other persons, including the person granting the licence, to do anything requiring the consent of the rights owner.

(2) The licensee under an exclusive licence has the same rights against a successor in title who is bound by the licence as he has against the person granting the licence.]

X27 [F507

191E.- Performer’s property right to pass under will with unpublished original recording.

Where under a bequest (whether general or specific) a person is entitled beneficially or otherwise to any material thing containing an original recording of a performance which was not published before the death of the testator, the bequest shall, unless a contrary intention is indicated in the testator’s will or a codicil to it, be construed as including any performer’s rights in relation to the recording to which the testator was entitled immediately before his death.]

X28 [F508

191F.- Presumption of transfer of rental right in case of film production agreement.

(1) Where an agreement concerning film production is concluded between a performer and a film producer, the performer shall be presumed, unless the agreement provides to the contrary, to have transferred to the film producer any rental right in relation to the film arising from the inclusion of a recording of his performance in the film.

(2) Where this section applies, the absence of signature by or on behalf of the performer does not exclude the operation of section 191C (effect of purported assignment of future rights).

(3) The reference in subsection (1) to an agreement concluded between a performer and a film producer includes any agreement having effect between those persons, whether made by them directly or through intermediaries.

(4) Section 191G (right to equitable remuneration on transfer of rental right) applies where there is a presumed transfer by virtue of this section as in the case of an actual transfer.]

X29 [F509

191G.- Right to equitable remuneration where rental right transferred.

(1) Where a performer has transferred his rental right concerning a sound recording or a film to the producer of the sound recording or film, he retains the right to equitable remuneration for the rental.The reference above to the transfer of rental right by one person to another includes any arrangement having that effect, whether made by them directly or through intermediaries.

(4) The amount payable by way of equitable remuneration is as agreed by or on behalf of the persons by and to whom it is payable, subject to section 191H (reference of amount to Copyright Tribunal).

(5) An agreement is of no effect in so far as it purports to exclude or restrict the right to equitable remuneration under this section.

(6) In this section a “collecting society” means a society or other organisation which has as its main object, or one of its main objects, the exercise of the right to equitable remuneration on behalf of more than one performer.]

X30 [F510

191H.- Equitable remuneration: reference of amount to Copyright Tribunal.

(1) In default of agreement as to the amount payable by way of equitable remuneration under section 191G, the person by or to whom it is payable may apply to the Copyright Tribunal to determine the amount payable.

(2) A person to or by whom equitable remuneration is payable may also apply to the Copyright Tribunal:

(a) to vary any agreement as to the amount payable, or

An order made on an application under this subsection has effect from the date on which it is made or such later date as may be specified by the Tribunal.

(4) Remuneration shall not be considered inequitable merely because it was paid by way of a single payment or at the time of the transfer of the rental right.

(5) An agreement is of no effect in so far as it purports to prevent a person questioning the amount of equitable remuneration or to restrict the powers of the Copyright Tribunal under this section.][F511

191HA.- Assignment of performer’s property rights in a sound recording

(1) This section applies where a performer has [F512by an agreement] assigned the following rights concerning a sound recording to the producer of the sound recording:

(a) reproduction, distribution and making available rights, or

(b) performer’s property rights.

(2) If, at the end of the 50-year period, the producer has failed to meet one or both of the following conditions, the performer may give a notice in writing to the producer of the performer’s intention to terminate the agreement:

(a) condition 1 is to issue to the public copies of the sound recording in sufficient quantities;

(b) condition 2 is to make the sound recording available to the public by electronic transmission in such a way that a member of the public may access the recording from a place and at a time chosen by him or her.

(3) If, at any time after the end of the 50-year period, the producer, having met one or both of the conditions referred to in subsection (2), fails to do so, the performer may give a notice in writing to the producer of the performer’s intention to terminate the agreement.

(4) If at the end of the period of 12 months beginning with the date of the notice, the producer has not met the conditions referred to in subsection (2), the agreement terminates and the copyright in the sound recording expires with immediate effect.

(5) An agreement is of no effect in so far as it purports to exclude or restrict the right to give a notice under subsection (2) or (3).

(6) A reference in this section to the assignment of rights includes any arrangement having that effect, whether made directly between the parties or through intermediaries.

(7) In this section:

“50-year period” means

(a) where the sound recording is published during the initial period, the period of 50 years from the end of the calendar year in which the sound recording is first published, or

(b) where during the initial period the sound recording is not published but is made available to the public by being played in public or communicated to the public, the period of 50 years from the end of the calendar year in which it was first made available to the public,

but in determining whether a sound recording has been published, played in public or communicated to the public, no account shall be taken of any unauthorised act,

“initial period” means the period beginning on the date the recording is made and ending 50 years from the end of the calendar year in which the sound recording is made,

“producer” means the person for the time being entitled to the copyright in the sound recording,

“sufficient quantities” means such quantity as to satisfy the reasonable requirements of the public for copies of the sound recording,

“unauthorised act” has the same meaning as in section 178.

191HB.- Payment in consideration of assignment

(1) A performer who, under an agreement relating to the assignment of rights referred to in section 191HA(1) (an “assignment agreement”), is entitled to a non-recurring payment in consideration of the assignment, is entitled to an annual payment for each relevant period from:

(a) the producer, or

(b )where the producer has granted an exclusive licence of the copyright in the sound recording, the licensee under the exclusive licence (the “exclusive licensee”).

(2) In this section, “relevant period” means:

(a) the period of 12 months beginning at the end of the 50-year period, and

(b) each subsequent period of 12 months beginning with the end of the previous period, until the date on which copyright in the sound recording expires.

(3) The producer or, where relevant, the exclusive licensee gives effect to the entitlement under subsection (1) by remitting to a collecting society for distribution to the performer in accordance with its rules an amount for each relevant period equal to 20% of the gross revenue received during that period in respect of:

(a) the reproduction and issue to the public of copies of the sound recording, and

(b) the making available to the public of the sound recording by electronic transmission in such a way that members of the public may access it from a place and at a time individually chosen by them.

(4) The amount required to be remitted under subsection (3) is payable within 6 months of the end of each relevant period and is recoverable by the collecting society as a debt.

(5) Subsection (6) applies where:

(a) the performer makes a written request to the producer or, where relevant, the exclusive licensee for information in that person’s possession or under that person’s control to enable the performer:

(i) to ascertain the amount of the annual payment to which the performer is entitled under subsection (1), or

(ii) to secure its distribution by the collecting society, and

(b) the producer or, where relevant, the exclusive licensee does not supply the information within the period of 90 days beginning with the date of the request.

(6) The performer may apply to the county court, or in Scotland to the sheriff, for an order requiring the producer or, where relevant, the exclusive licensee to supply the information.

(7) An agreement is of no effect in so far as it purports to exclude or restrict the entitlement under subsection (1).

(8) In the event of any dispute as to the amount required to be remitted under subsection (3), the performer may apply to the Copyright Tribunal to determine the amount payable.

(9) Where a performer is entitled under an assignment agreement to recurring payments in consideration of the assignment, the payments must, from the end of the 50-year period, be made in full, regardless of any provision in the agreement which entitles the producer to withhold or deduct sums from the amounts payable.

(10) In this section:

“producer” and “50-year period” each has the same meaning as in section 191HA,

“exclusive licence” has the same meaning as in section 92, and

“collecting society” has the same meaning as in section 191G.]

X31 [F513

191I.- Infringement actionable by rights owner.

(1) An infringement of a performer’s property rights is actionable by the rights owner.

(2) In an action for infringement of a performer’s property rights all such relief by way of damages, injunctions, accounts or otherwise is available to the plaintiff as is available in respect of the infringement of any other property right.

(3) This section has effect subject to the following provisions of [F514this Chapter].]

X32 [F515

191J.- Provisions as to damages in infringement action.

(1) Where in an action for infringement of a performer’s property rights it is shown that at the time of the infringement the defendant did not know, and had no reason to believe, that the rights subsisted in the recording to which the action relates, the plaintiff is not entitled to damages against him, but without prejudice to any other remedy.

(2) The court may in an action for infringement of a performer’s property rights having regard to all the circumstances, and in particular to:

(a) the flagrancy of the infringement, and

(b) any benefit accruing to the defendant by reason of the infringement,award such additional damages as the justice of the case may require.]

X33 [F516 191JA.- Injunctions against service providers

(b) the extent to which any notice includes:

(i) the full name and address of the sender of the notice;

(ii) details of the infringement in question.

(3) In this section “ service provider ” has the meaning given to it by regulation 2 of the Electronic Commerce ( EC Directive) Regulations 2002.

(4) Section 177 applies in respect of this section as it applies in respect of Part 1.]

X34 [F517

191K.- Undertaking to take licence of right in infringement proceedings.

(1) If in proceedings for infringement of a performer’s property rights in respect of which a licence is available as of right under paragraph 17 of Schedule 2A (powers exercisable in consequence of competition report) the defendant undertakes to take a licence on such terms as may be agreed or, in default of agreement, settled by the Copyright Tribunal under that paragraph:

(a) no injunction shall be granted against him,

(b) no order for delivery up shall be made under section 195, and

(2) An undertaking may be given at any time before final order in the proceedings, without any admission of liability.

(3) Nothing in this section affects the remedies available in respect of an infringement committed before licences of right were available.]

X35 [F518

191L.- Rights and remedies for exclusive licensee.

(1) An exclusive licensee has, except against the owner of a performer’s property rights, the same rights and remedies in respect of matters occurring after the grant of the licence as if the licence had been an assignment.

(2) His rights and remedies are concurrent with those of the rights owner; and references in the relevant provisions of [F519this Chapter] to the rights owner shall be construed accordingly.

X36 [F520

191M.- Exercise of concurrent rights.

(1) Where an action for infringement of a performer’s property rights brought by the rights owner or an exclusive licensee relates (wholly or partly) to an infringement in respect of which they have concurrent rights of action, the rights owner or, as the case may be, the exclusive licensee may not, without the leave of the court, proceed with the action unless the other is either joined as plaintiff or added as a defendant.

(2) A rights owner or exclusive licensee who is added as a defendant in pursuance of subsection (1) is not liable for any costs in the action unless he takes part in the proceedings.

(3) The above provisions do not affect the granting of interlocutory relief on an application by the rights owner or exclusive licensee alone.

(4) Where an action for infringement of a performer’s property rights is brought which relates (wholly or partly) to an infringement in respect of which the rights owner and an exclusive licensee have or had concurrent rights of action:

(a) the court shall in assessing damages take into account:

(i) the terms of the licence, and

(ii) any pecuniary remedy already awarded or available to either of them in respect of the infringement;

(b) no account of profits shall be directed if an award of damages has been made, or an account of profits has been directed, in favour of the other of them in respect of the infringement; and

(c) the court shall if an account of profits is directed apportion the profits between them as the court considers just, subject to any agreement between them; and these provisions apply whether or not the rights owner and the exclusive licensee are both parties to the action.

(5) The owner of a performer’s property rights shall notify any exclusive licensee having concurrent rights before applying for an order under section 195 (order for delivery up) or exercising the right conferred by section 196 (right of seizure); and the court may on the application of the licensee make such order under section 195 or, as the case may be, prohibiting or permitting the exercise by the rights owner of the right conferred by section 196, as it thinks fit having regard to the terms of the licence.]

X37 [F521.- Non-property rights]

X38 [F522

192A.- Performers’ non-property rights.

(1) the rights conferred on a performer by –

section 182 (consent required for recording, &c. of live performance),

section 183 (infringement of performer’s rights by use of recording made without consent), F523 …

section 184 (infringement of performer’s rights importing, possessing or dealing with illicit recording),

[F524 section 191HA (assignment of performer’s property rights in a sound recording), and

section 191HB (payment in consideration of assignment),]

are not assignable or transmissible, except to the following extent.

They are referred to in [F525 this Chapter ] as “ F526 . . . performer’s non-property rights”.

(2) On the death of a person entitled to any such right:

(a) the right passes to such person as he may by testamentary disposition specifically direct, and

(b) if or to the extent that there is no such direction, the right is exercisable by his personal representatives.

(3) References in [F525this Chapter] to the performer, in the context of the person having any such right, shall be construed as references to the person for the time being entitled to exercise those rights.

(4) Where by virtue of subsection (2)(a) a right becomes exercisable by more than one person, it is exercisable by each of them independently of the other or others.

(5) Any damages recovered by personal representatives by virtue of this section in respect of an infringement after a person’s death shall devolve as part of his estate as if the right of action had subsisted and been vested in him immediately before his death.]

X39 [F527

192B.- Transmissibility of rights of person having recording rights.

(1) The rights conferred by [F528this Chapter] on a person having recording rights are not assignable or transmissible.

(2) This does not affect section 185(2)(b) or (3)(b), so far as those provisions confer rights under [F528this Chapter] on a person to whom the benefit of a contract or licence is assigned.]

X40

193.- Consent.

(1) Consent for the purposes of [F529this Chapter][F530by a person having a performer’s non-property rights, or by a person having recording rights,] may be given in relation to a specific performance, a specified description of performances or performances generally, and may relate to past or future performances.

(2) A person having recording rights in a performance is bound by any consent given by a person through whom he derives his rights under the exclusive recording contract or licence in question, in the same way as if the consent had been given by him.

(3) Where [F531a performer’s non-property right] passes to another person, any consent binding on the person previously entitled binds the person to whom the right passes in the same way as if the consent had been given by him.

X41 F532. . .

X42

194.- Infringement actionable as breach of statutory duty.

An infringement of [F533:

(a) a performer’s non-property rights, or

(b) any right conferred by [F534this Chapter] on a person having recording rights,]is actionable by the person entitled to the right as a breach of statutory duty.

X43 [F535.- Delivery up or seizure of illicit recordings]

X44

195.- Order for delivery up.

(1) Where a person has in his possession, custody or control in the course of a business an illicit recording of a performance, a person having performer’s rights or recording rights in relation to the performance under [F536this Chapter] may apply to the court for an order that the recording be delivered up to him or to such other person as the court may direct.

(2) An application shall not be made after the end of the period specified in section 203; and no order shall be made unless the court also makes, or it appears to the court that there are grounds for making, an order under section 204 (order as to disposal of illicit recording).

(3) A person to whom a recording is delivered up in pursuance of an order under this section shall, if an order under section 204 is not made, retain it pending the making of an order, or the decision not to make an order, under that section.

(4) Nothing in this section affects any other power of the court.

X45

196.- Right to seize illicit recordings.

(1) An illicit recording of a performance which is found exposed or otherwise immediately available for sale or hire, and in respect of which a person would be entitled to apply for an order under section 195, may be seized and detained by him or a person authorised by him.The right to seize and detain is exercisable subject to the following conditions and is subject to any decision of the court under section 204 (order as to disposal of illicit recording).

(2) Before anything is seized under this section notice of the time and place of the proposed seizure must be given to a local police station.

(5) In this section:

“premises” includes land, buildings, fixed or moveable structures, vehicles, vessels, aircraft and hovercraft; and

“prescribed” means prescribed by order of the Secretary of State.

(6) An order of the Secretary of State under this section shall be made by statutory instrument which shall be subject to annulment in pursuance of a resolution of either House of Parliament.

X46

197.- Meaning of “illicit recording”.

(1) In [F537this Chapter]“illicit recording”, in relation to a performance, shall be construed in accordance with this section.

(2) For the purposes of a performer’s rights, a recording of the whole or any substantial part of a performance of his is an illicit recording if it is made, otherwise than for private purposes, without his consent.

(3) For the purposes of the rights of a person having recording rights, a recording of the whole or any substantial part of a performance subject to the exclusive recording contract is an illicit recording if it is made, otherwise than for private purposes, without his consent or that of the performer.

(4) For the purposes of sections 198 and 199 (offences and orders for delivery up in criminal proceedings), a recording is an illicit recording if it is an illicit recording for the purposes mentioned in subsection (2) or subsection (3).

(5) In [F537this Chapter]“illicit recording” includes a recording falling to be treated as an illicit recording by virtue of any of the following provisions of Schedule 2:

[F538 paragraph 1D(3) (copies for text and data analysis for non-commercial research),][F539 paragraph 3A(5) or (6) or 3B(10) (accessible copies of recordings made for disabled persons)][F540 paragraph 1B(5) and (7) (personal copies of recordings for private use),]

F541…

[F542 paragraph 6(5) (recording by educational establishments of broadcasts),][F538 paragraph 6F(5)(b) (copying by librarians: single copies of published recordings),][F538 paragraph 6G(5)(b) (copying by librarians or archivists: single copies of unpublished recordings),][F538 paragraph 6ZA(7) (copying and use of extracts of recordings by educational establishments),]

paragraph 12(2) (recordings of performance in electronic form retained on transfer of principal recording), F543. . .

[F538 paragraph 14(6)(b) (recordings of folksongs),]

paragraph 16(3) (recordings made for purposes of broadcast F544. . . ),

[F545 paragraph 17A(2) (recording for the purposes of time-shifting), or

paragraph 17B(2) (photographs of broadcasts),]

but otherwise does not include a recording made in accordance with any of the provisions of that Schedule.

(6) It is immaterial for the purposes of this section where the recording was made.

[F546

197A.- Presumptions relevant to recordings of performances

(1) In proceedings brought by virtue of this Part with respect to the rights in a performance, where copies of a recording of the performance as issued to the public bear a statement that a named person was the performer, the statement shall be admissible as evidence of the fact stated and shall be presumed to be correct until the contrary is proved.

(2) Subsection (1) does not apply to proceedings for an offence under section 198 (criminal liability for making etc. illicit recordings); but without prejudice to its application in proceedings for an order under section 199 (order for delivery up in criminal proceedings).]

X47.- Offences

X48

198.- Criminal liability for making, dealing with or using illicit recordings.

(1) A person commits an offence who without sufficient consent:

(a) makes for sale or hire, or

(b) imports into the United Kingdom otherwise than for his private and domestic use, or

(c) possesses in the course of a business with a view to committing any act infringing the rights conferred by [F547this Chapter], or

(d) in the course of a business:

(i) sells or lets for hire, or

(ii) offers or exposes for sale or hire, or

(iii) distributes,a recording which is, and which he knows or has reason to believe is, an illicit recording.

[F548

(1A) A person (“P”) who infringes a performer’s making available right in a recording commits an offence if P:

(a) knows or has reason to believe that P is infringing the right, and

(b) either:

(i) intends to make a gain for P or another person, or

(ii) knows or has reason to believe that infringing the right will cause loss to the owner of the right, or expose the owner of the right to a risk of loss.

(1B) For the purposes of subsection (1A):

(a) “gain” and “loss”:

(i) extend only to gain or loss in money, and

(ii) include any such gain or loss whether temporary or permanent, and

(b) “loss” includes a loss by not getting what one might get.]

(2) A person commits an offence who causes a recording of a performance made without sufficient consent to be:

(a) shown or played in public, or

[F549(b) communicated to the public,]thereby infringing any of the rights conferred by [F547 this Chapter], if he knows or has reason to believe that those rights are thereby infringed.

(3) In subsections (1) and (2) “sufficient consent” means:

(a) in the case of a qualifying performance, the consent of the performer, and

(b) in the case of a non-qualifying performance subject to an exclusive recording contract:

(i) for the purposes of subsection (1)(a) (making of recording), the consent of the performer or the person having recording rights, and

(ii) for the purposes of subsection (1)(b), (c) and (d) and subsection (2) (dealing with or using recording), the consent of the person having recording rights.The references in this subsection to the person having recording rights are to the person having those rights at the time the consent is given or, if there is more than one such person, to all of them.

(4) No offence is committed under subsection (1) or (2) by the commission of an act which by virtue of any provision of Schedule 2 may be done without infringing the rights conferred by [F547this Chapter].

(5) A person guilty of an offence under subsection (1)(a), (b) or (d)(iii) is liable:

(a) on summary conviction to imprisonment for a term not exceeding six months or [F550a fine], or both;

(b) on conviction on indictment to a fine or imprisonment for a term not exceeding [F551ten] years, or both.

[F552

(5A) A person guilty of an offence under subsection (1A) is liable:

(a) on summary conviction to imprisonment for a term not exceeding three months or [F553a fine], or both;

(b) on conviction on indictment to a fine or imprisonment for a term not exceeding [F554 ten ] years, or both.]

(6) A person guilty of any other offence under this section is liable on summary conviction to a fine not exceeding level 5 on the standard scale or imprisonment for a term not exceeding six months, or both.

X49[F555

198A.- Enforcement by local weights and measures authority.

(1) It is the duty of every local weights and measures authority to enforce within their area the provisions of section 198.

F556

(2). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(3) Subsection (1) above does not apply in relation to the enforcement of section 198 in Northern Ireland, but it is the duty of the Department of Economic Development to enforce that section in Northern Ireland.F557…

[F558

(4) Any enactment which authorises the disclosure of information for the purpose of facilitating the enforcement of the Trade Descriptions Act 1968 shall apply as if section 198 were contained in that Act and as if the functions of any person in relation to the enforcement of that section were functions under that Act.

(5) Nothing in this section shall be construed as authorising a local weights and measures authority to bring proceedings in Scotland for an offence.]

X50

199.- Order for delivery up in criminal proceedings.

(1) The court before which proceedings are brought against a person for an offence under section 198 may, if satisfied that at the time of his arrest or charge he had in his possession, custody or control in the course of a business an illicit recording of a performance, order that it be delivered up to a person having performers’ rights or recording rights in relation to the performance or to such other person as the court may direct.

(2) For this purpose a person shall be treated as charged with an offence:

(a) in England, Wales and Northern Ireland, when he is orally charged or is served with a summons or indictment;

(b) in Scotland, when he is cautioned, charged or served with a complaint or indictment.

(a) after the end of the period specified in section 203 (period after which remedy of delivery up not available), or

(b) if it appears to the court unlikely that any order will be made under section 204 (order as to disposal of illicit recording).

(4) An appeal lies from an order made under this section by a magistrates’ court:

(a) in England and Wales, to the Crown Court, and

(b) in Northern Ireland, to the county court;and in Scotland, where an order has been made under this section, the person from whose possession, custody or control the illicit recording has been been removed may, without predudice to any other form of appeal under any rule of law, appeal against that order in the same manner as against sentence.

(5) A person to whom an illicit recording is delivered up in pursuance of an order under this section shall retain it pending the making of an order, or the decision not to make an order, under section 204.

(6) Nothing in in this section affects the powers of the court under [F559section 143 of the Powers of Criminal Courts (Sentencing) Act 2000], [F560Part II of the Proceeds of Crime (Scotland) Act 1995] or [F561Article 11 of the Criminal Justice (Northern Ireland) Order 1994] (general provisions as to forfeiture in criminal proceedings).

X51

200.- Search warrants.

(a) that an offence under [F562section 198(1) or (1A)](offences of making, importing [F563, possessing, selling etc.] or distributing illicit recordings) has been or is about to be committed in any premises, and

(2) The power conferred by subsection (1) does not, in England and Wales, extend to authorising a search for material of the kinds mentioned in section 9(2) of the M21Police and Criminal Evidence Act 1984 (certain classes of personal or confidential material).

(3) A warrant under subsection (1):

(a) may authorise persons to accompany any constable executing the warrant, and

(b) remains in force for [F564three months] from the date of its issue.

[F565

(3A) In executing a warrant issued under subsection (1) a constable may seize an article if he reasonably believes that it is evidence that any offence under [F566section 198(1) or (1A)] has been or is about to be committed.]

(4) In this section “premises” includes land, buildings, fixed or moveable structures, vehicles, vessels, aircraft and hovercraft.

X52

201.- False representation of authority to give consent.

(1) It is an offence for a person to represent falsely that he is authorised by any person to give consent for the purposes of [F567this Chapter] in relation to a performance, unless he believes on reasonable grounds that he is so authorised.

(2) A person guilty of an offence under this section is liable on summary conviction to imprisonment for a term not exceeding six months or a fine not exceeding level 5 on the standard scale or both.

X53

202.- Offence by body corporate: liability of officers.

(1) Where an offence under [F568this Chapter] committed by a body corporate is proved to have been committed with the consent or connivance of a director, manager, secretary or other similar officer of the body, or a person purporting to act in any such capacity, he as well as the body corporate is guilty of the offence and liable to be proceeded against and punished accordingly.

(2) In relation to a body corporate whose affairs are managed by its members “director” means a member of the body corporate.

X54.- Supplementary provisions with respect to delivery up and seizure

X55

203.- Period after which remedy of delivery up not available.

(1) An application for an order under section 195 (order for delivery up in civil proceedings) may not be made after the end of the period of six years from the date on which the illicit recording in question was made, subject to the following provisions.

(2) If during the whole or any part of that period a person entitled to apply for an order:

(a) is under a disability, or

(b) is prevented by fraud or concealment from discovering the facts entitling him to apply,an application may be made by him at any time before the end of the period of six years from the date on which he ceased to be under a disability or, as the case may be, could with reasonable diligence have discovered those facts.

(3) In subsection (2) “disability”:

(a) in England and Wales, has the same meaning as in the M22Limitation Act 1980;

(b) in Scotland, means legal disability within the meaning of the M23Prescription and Limitations (Scotland) Act 1973;

(4) An order under section 199 (order for delivery up in criminal proceedings) shall not, in any case, be made after the end of the period of six years from the date on which the illicit recording in question was made.

X56

204.- Order as to disposal of illicit recording.

(1) An application may be made to the court for an order that an illicit recording of a performance delivered up in pursuance of an order under section 195 or 199, or seized and detained in pursuance of the right conferred by section 196, shall be:

(a) forfeited to such person having performer’s rights or recording rights in relation to the performance as the court may direct, or

(b) destroyed or otherwise dealt with as the court may think fit,or for a decision that no such order should be made.

(2) In considering what order (if any) should be made, the court shall consider whether other remedies available in an action for infringement of the rights conferred by [F569this Chapter] would be adequate to compensate the person or persons entitled to the rights and to protect their interests.

(3) Provision shall be made by rules of court as to the service of notice on persons having an interest in the recording, and any such person is entitled:

(a) to appear in proceedings for an order under this section, whether or not he was served with notice, and

(4) Where there is more than one person interested in a recording, the court shall make such order as it thinks just and may (in particular) direct that the recording be sold, or otherwise dealt with, and the proceeds divided.

(5) If the court decides that no order should be made under this section, the person in whose possession, custody or control the recording was before being delivered up or seized is entitled to its return.

(6) References in this section to a person having an interest in a recording include any person in whose favour an order could be made in respect of the recording

[F570

(a) under this section or under section 114 or 231 of this Act;

(b) under section 24D of the Registered Designs Act 1949;

(c) under section 19 of Trade Marks Act 1994 (including that section as applied by regulation 4 of the Community Trade Mark Regulations 2006 (SI 2006/1027)); or

(d) under regulation 1C of the Community Design Regulations 2005 (SI 2005/2339).]

X57[F571

204A.- Forfeiture of illicit recordings: England and Wales or Northern Ireland

(1) In England and Wales or Northern Ireland where illicit recordings of a performance have come into the possession of any person in connection with the investigation or prosecution of a relevant offence, that person may apply under this section for an order for the forfeiture of the illicit recordings.

(2) For the purposes of this section “relevant offence” means:

(a) an offence under [F572section 198(1) or (1A)](criminal liability for making or dealing with illicit recordings),

(b) an offence under the Trade Descriptions Act 1968 (c. 29),

[F573

(ba) an offence under the Business Protection from Misleading Marketing Regulations 2008,

(bb) an offence under the Consumer Protection from Unfair Trading Regulations 2008, or]

(3) An application under this section may be made:

(a) where proceedings have been brought in any court for a relevant offence relating to some or all of the illicit recordings, to that court, or

(b) where no application for the forfeiture of the illicit recordings has been made under paragraph (a), by way of complaint to a magistrates’ court.

(4) On an application under this section, the court shall make an order for the forfeiture of any illicit recordings only if it is satisfied that a relevant offence has been committed in relation to the illicit recordings.

(5) A court may infer for the purposes of this section that such an offence has been committed in relation to any illicit recordings if it is satisfied that such an offence has been committed in relation to illicit recordings which are representative of the illicit recordings in question (whether by reason of being part of the same consignment or batch or otherwise).

(6) Any person aggrieved by an order made under this section by a magistrates’ court, or by a decision of such a court not to make such an order, may appeal against that order or decision:

(a) in England and Wales, to the Crown Court, or

(b) in Northern Ireland, to the county court.

(8) Subject to subsection (9), where any illicit recordings are forfeited under this section they shall be destroyed in accordance with such directions as the court may give.

(9) On making an order under this section the court may direct that the illicit recordings to which the order relates shall (instead of being destroyed) be forfeited to the person having the performers’ rights or recording rights in question or dealt with in such other way as the court considers appropriate.]

X58 F574

204B.- Forfeiture: Scotland

(1) In Scotland the court may make an order under this section for the forfeiture of any illicit recordings.

(2) An order under this section may be made:

(a) on an application by the procurator-fiscal made in the manner specified in section 134 of the Criminal Procedure (Scotland) Act 1995 (c. 46), or

(b) where a person is convicted of a relevant offence, in addition to any other penalty which the court may impose.

(3) On an application under subsection (2)(a), the court shall make an order for the forfeiture of any illicit recordings only if it is satisfied that a relevant offence has been committed in relation to the illicit recordings.

(4) The court may infer for the purposes of this section that such an offence has been committed in relation to any illicit recordings if it is satisfied that such an offence has been committed in relation to illicit recordings which are representative of the illicit recordings in question (whether by reason of being part of the same consignment or batch or otherwise).

(5) The procurator-fiscal making the application under subsection (2)(a) shall serve on any person appearing to him to be the owner of, or otherwise to have an interest in, the illicit recordings to which the application relates a copy of the application, together with a notice giving him the opportunity to appear at the hearing of the application to show cause why the illicit recordings should not be forfeited.

(7) Any person upon whom notice is served under subsection (5) and any other person claiming to be the owner of, or otherwise to have an interest in, illicit recordings to which an application under this section relates shall be entitled to appear at the hearing of the application to show cause why the illicit recordings should not be forfeited.

(8) The court shall not make an order following an application under subsection (2)(a):

(a) if any person on whom notice is served under subsection (5) does not appear, unless service of the notice on that person is proved, or

(b )if no notice under subsection (5) has been served, unless the court is satisfied that in the circumstances it was reasonable not to serve such notice.

(9) Where an order for the forfeiture of any illicit recordings is made following an application under subsection (2)(a), any person who appeared, or was entitled to appear, to show cause why the illicit recordings should not be forfeited may, within 21 days of the making of the order, appeal to the High Court by Bill of Suspension.

(10) Section 182(5)(a) to (e) of the Criminal Procedure (Scotland) Act 1995 shall apply to an appeal under subsection (9) as it applies to a stated case under Part 2 of that Act.

(11) An order following an application under subsection (2)(a) shall not take effect:

(a) until the end of the period of 21 days beginning with the day after the day on which the order is made, or

(b) if an appeal is made under subsection (9) above within that period, until the appeal is determined or abandoned.

(12) An order under subsection (2)(b) shall not take effect:

(a) until the end of the period within which an appeal against the order could be brought under the Criminal Procedure (Scotland) Act 1995 (c. 46), or

(b) if an appeal is made within that period, until the appeal is determined or abandoned.

(13) Subject to subsection (14), illicit recordings forfeited under this section shall be destroyed in accordance with such directions as the court may give.

(14) On making an order under this section the court may direct that the illicit recordings to which the order relates shall (instead of being destroyed) be forfeited to the person having the performers’ rights or recording rights in question or dealt with in such other way as the court considers appropriate.

(15) For the purposes of this section:

[F575 “relevant offence” means:

(a) an offence under section 198(1) or (1A) (criminal liability for making or dealing with illicit recordings),

(b) an offence under the Trade Descriptions Act 1968,

(d) an offence under the Consumer Protection from Unfair Trading Regulations 2008, or

(e) any offence involving dishonesty or deception;]

“the court” means:

(a) in relation to an order made on an application under subsection (2)(a), the sheriff, and

(b) in relation to an order made under subsection (2)(b), the court which imposed the penalty.

X59

205.- Jurisdiction of county court and sheriff court.

(1) In England [F576and Wales the county court and in] Northern Ireland a county court may entertain proceedings under:

section 195 (order for delivery up of illicit recording), or

section 204 (order as to disposal of illicit recording),

[F577 save that, in Northern Ireland, a county court may entertain such proceedings only]where the value of the illicit recordings in question does not exceed the county court limit for actions in tort.

(2) In Scotland proceedings for an order under either of those provisions may be brought in the sheriff court.

(3) Nothing in this section shall be construed as affecting the jurisdiction of the High Court or, in Scotland, the Court of Session.

X60 F578.- [Licensing of performers’ F579… rights]

X61 [F581

205A.- Licensing of performers’ F580… rights.

The provisions of Schedule 2A have effect with respect to the licensing of performers’ F580 … rights. ]

X62 F582.- [Jurisdiction of Copyright Tribunal]

X63 [F583

205B.- Jurisdiction of Copyright Tribunal.

(1) The Copyright Tribunal has jurisdiction under [F584this Chapter] to hear and determine proceedings under:

(a) section 182D (amount of equitable remuneration for exploitation of commercial sound recording);

(b )section 190 (application to give consent on behalf of owner of reproduction right);

F585

(cc). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(d) paragraph 3, 4 or 5 of Schedule 2A (reference of licensing scheme);

(e) paragraph 6 or 7 of that Schedule (application with respect to licence under licensing scheme);

(f) paragraph 10, 11 or 12 of that Schedule (reference or application with respect to licensing by licensing body);

(g) paragraph 15 of that Schedule (application to settle royalty for certain lending);

(h) paragraph 17 of that Schedule (application to settle terms of licence available as of right).

(2) The provisions of Chapter VIII of Part I (general provisions relating to the Copyright Tribunal) apply in relation to the Tribunal when exercising any jurisdiction under [F584this Chapter].

(3) Provision shall be made by rules under section 150 prohibiting the Tribunal from entertaining a reference under paragraph 3, 4 or 5 of Schedule 2A (reference of licensing scheme) by a representative organisation unless the Tribunal is satisfied that the organisation is reasonably representative of the class of persons which it claims to represent.][F586 Chapter 3.- MORAL RIGHTS

Right to be identified as performer

205C.- Right to be identified as performer

(1) Whenever a person:

(a) produces or puts on a qualifying performance that is given in public,

(b) broadcasts live a qualifying performance,

(d) issues to the public copies of such a recording,the performer has the right to be identified as such.

(2) The right of the performer under this section is:

(a) in the case of a performance that is given in public, to be identified in any programme accompanying the performance or in some other manner likely to bring his identity to the notice of a person seeing or hearing the performance,

(b) in the case of a performance that is broadcast, to be identified in a manner likely to bring his identity to the notice of a person seeing or hearing the broadcast,

(c) in the case of a sound recording that is communicated to the public, to be identified in a manner likely to bring his identity to the notice of a person hearing the communication,

(d) in the case of a sound recording that is issued to the public, to be identified in or on each copy or, if that is not appropriate, in some other manner likely to bring his identity to the notice of a person acquiring a copy,or (in any of the above cases) to be identified in such other manner as may be agreed between the performer and the person mentioned in subsection (1).

(3) The right conferred by this section in relation to a performance given by a group (or so much of a performance as is given by a group) is not infringed:

(a) in a case falling within paragraph (a), (b) or (c) of subsection (2), or

(b) in a case falling within paragraph (d) of that subsection in which it is not reasonably practicable for each member of the group to be identified,if the group itself is identified as specified in subsection (2).

(4) In this section “group” means two or more performers who have a particular name by which they may be identified collectively.

(5) If the assertion under section 205D specifies a pseudonym, initials or some other particular form of identification, that form shall be used; otherwise any reasonable form of identification may be used.

(6) This section has effect subject to section 205E (exceptions to right).

205D.- Requirement that right be asserted

(1) A person does not infringe the right conferred by section 205C (right to be identified as performer) by doing any of the acts mentioned in that section unless the right has been asserted in accordance with the following provisions so as to bind him in relation to that act.

(2) The right may be asserted generally, or in relation to any specified act or description of acts:

(a) by instrument in writing signed by or on behalf of the performer, or

(b) on an assignment of a performer’s property rights, by including in the instrument effecting the assignment a statement that the performer asserts in relation to the performance his right to be identified.

(3) The persons bound by an assertion of the right under subsection (2) are:

(a) in the case of an assertion under subsection (2)(a), anyone to whose notice the assertion is brought;

(b) in the case of an assertion under subsection (2)(b), the assignee and anyone claiming through him, whether or not he has notice of the assertion.

In an action for infringement of the right the court shall, in considering remedies, take into account any delay in asserting the right.

205E.- Exceptions to right

(1) The right conferred by section 205C (right to be identified as performer) is subject to the following exceptions.

(2) The right does not apply where it is not reasonably practicable to identify the performer (or, where identification of a group is permitted by virtue of section 205C(3), the group).

(3) The right does not apply in relation to any performance given for the purposes of reporting current events.

(4) The right does not apply in relation to any performance given for the purposes of advertising any goods or services.

(5) The right is not infringed by an act which by virtue of any of the following provisions of Schedule 2 would not infringe any of the rights conferred by Chapter 2:

(a) paragraph 2(1A) (news reporting);

(b) paragraph 3 (incidental inclusion of a performance or recording);

(d) paragraph 8 (parliamentary and judicial proceedings);

(e) paragraph 9 (Royal Commissions and statutory inquiries).

Right to object to derogatory treatment

205F.- Right to object to derogatory treatment of performance

(1) The performer of a qualifying performance has a right which is infringed if:

(a) the performance is broadcast live, or

(b) by means of a sound recording the performance is played in public or communicated to the public,with any distortion, mutilation or other modification that is prejudicial to the reputation of the performer.

(2) This section has effect subject to section 205G (exceptions to right).

205G.-Exceptions to right

(1) The right conferred by section 205F (right to object to derogatory treatment of performance) is subject to the following exceptions.

(2) The right does not apply in relation to any performance given for the purposes of reporting current events.

(3) The right is not infringed by modifications made to a performance which are consistent with normal editorial or production practice.

(4) Subject to subsection (5), the right is not infringed by anything done for the purpose of:

(a) avoiding the commission of an offence,

(b) complying with a duty imposed by or under an enactment, or

(5) Where:

(a) the performer is identified in a manner likely to bring his identity to the notice of a person seeing or hearing the performance as modified by the act in question; or

(b) he has previously been identified in or on copies of a sound recording issued to the public,subsection (4) applies only if there is sufficient disclaimer.

(6) In subsection (5) “sufficient disclaimer”, in relation to an act capable of infringing the right, means a clear and reasonably prominent indication:

(a) given in a manner likely to bring it to the notice of a person seeing or hearing the performance as modified by the act in question, and

(b) if the performer is identified at the time of the act, appearing along with the identification,that the modifications were made without the performer’s consent.

205H.-Infringement of right by possessing or dealing with infringing article

(1) The right conferred by section 205F (right to object to derogatory treatment of performance) is also infringed by a person who:

(a) possesses in the course of business, or

(b) sells or lets for hire, or offers or exposes for sale or hire, or

(2) An “infringing article” means a sound recording of a qualifying performance with any distortion, mutilation or other modification that is prejudicial to the reputation of the performer.

Supplementary

205I.-Duration of rights

(1) A performer’s rights under this Chapter in relation to a performance subsist so long as that performer’s rights under Chapter 2 subsist in relation to the performance.

(2) In subsection (1) “performer’s rights” includes rights of a performer that are vested in a successor of his.

205J.-Consent and waiver of rights

(1) It is not an infringement of the rights conferred by this Chapter to do any act to which consent has been given by or on behalf of the person entitled to the right.

(2) Any of those rights may be waived by instrument in writing signed by or on behalf of the person giving up the right.

(3) A waiver:

(a) may relate to a specific performance, to performances of a specified description or to performances generally, and may relate to existing or future performances, and

(b) may be conditional or unconditional and may be expressed to be subject to revocation,and if made in favour of the owner or prospective owner of a performer’s property rights in the performance or performances to which it relates, it shall be presumed to extend to his licensees and successors in title unless a contrary intention is expressed.

205K.- Application of provisions to parts of performances

(1) The right conferred by section 205C (right to be identified as performer) applies in relation to the whole or any substantial part of a performance.

(2) The right conferred by section 205F (right to object to derogatory treatment of performance) applies in relation to the whole or any part of a performance.

205L.- Moral rights not assignable

The rights conferred by this Chapter are not assignable.

205M.-Transmission of moral rights on death

(1) On the death of a person entitled to a right conferred by this Chapter:

(a) the right passes to such person as he may by testamentary disposition specifically direct,

(b) if there is no such direction but the performer’s property rights in respect of the performance in question form part of his estate, the right passes to the person to whom the property rights pass,

(c) if or to the extent that the right does not pass under paragraph (a) or (b) it is exercisable by his personal representatives.

(2) Where a performer’s property rights pass in part to one person and in part to another, as for example where a bequest is limited so as to apply:

(a) to one or more, but not all, of the things to which the owner has the right to consent, or

(b) to part, but not the whole, of the period for which the rights subsist,any right which by virtue of subsection (1) passes with the performer’s property rights is correspondingly divided.

(3) Where by virtue of subsection (1)(a) or (1)(b) a right becomes exercisable by more than one person:

(a) it is, in the case of the right conferred by section 205F (right to object to derogatory treatment of performance), a right exercisable by each of them and is satisfied in relation to any of them if he consents to the treatment or act in question, and

(b) any waiver of the right in accordance with section 205J by one of them does not affect the rights of the others.

(4) A consent or waiver previously given or made binds any person to whom a right passes by virtue of subsection (1).

205N.- Remedies for infringement of moral rights

(1) An infringement of a right conferred by this Chapter is actionable as a breach of statutory duty owed to the person entitled to the right.

(2)Where:

(a) there is an infringement of a right conferred by this Chapter,

(b) a person falsely claiming to act on behalf of a performer consented to the relevant conduct or purported to waive the right, and

(c) there would have been no infringement if he had been so acting,that person shall be liable, jointly and severally with any person liable in respect of the infringement by virtue of subsection (1), as if he himself had infringed the right.

(3) Where proceedings for infringement of the right conferred on a performer by this Chapter, it shall be a defence to prove:

(a) that a person claiming to act on behalf of the performer consented to the defendant’s conduct or purported to waive the right, and

(b) that the defendant reasonably believed that the person was acting on behalf of the performer.

(4) In proceedings for infringement of the right conferred by section 205F the court may, if it thinks it an adequate remedy in the circumstances, grant an injunction on terms prohibiting the doing of any act unless a disclaimer is made, in such terms and in such manner as may be approved by the court, dissociating the performer from the broadcast or sound recording of the performance.][F587Chapter 4.- QUALIFICATION FOR PROTECTION, EXTENT AND INTERPRETATION

X64.- Qualification for protection and extent

X65

206.- Qualifying countries, individuals and persons.

(1) In this Part:

“qualifying country” means:

(a) the United Kingdom,

[F588

(b) another EEA state,][F589

(ba) the Channel Islands, the Isle of Man or Gibraltar,] or

[F590

(bb) a country which is a party to the Rome Convention,] or

(c) to the extent that an Order under section 208 so provides, a country designated under that section as enjoying reciprocal protection;

“qualifying individual” means a citizen or subject of, or an individual resident in, a qualifying country; and

“qualifying person” means a qualifying individual or a body corporate or other body having legal personality which:

(a) is formed under the law of a part of the United Kingdom or another qualifying country, and

(b) has in any qualifying country a place of business at which substantial business activity is carried on.

(2) The reference in the definition of “qualifying individual” to a person’s being a citizen or subject of a qualifying country shall be construed:

(a) in relation to the United Kingdom, as a reference to his being a British citizen, and

(b) in relation to a colony of the United Kingdom, as a reference to his being a British Dependent Territories’ citizen by connection with that colony.

(3) In determining for the purpose of the definition of “qualifying person” whether substantial business activity is carried on at a place of business in any country, no account shall be taken of dealings in goods which are at all material times outside that country.

[F591

(4) Her Majesty may by Order in Council:

(a) make provision for the application of this Part to a country by virtue of paragraph (bb) or (c) of the definition of “qualifying country” in subsection (1) to be subject to specified restrictions;

(b) amend the definition of “qualifying country” in subsection (1) so as to add a country which is not a party to the Rome Convention;

(c) make provision for the application of this Part to a country added under paragraph (b) to be subject to specified restrictions.

(5) A statutory instrument containing an Order in Council under this section is subject to annulment in pursuance of a resolution of either House of Parliament.][F592

(6) In this section, “the Rome Convention” means the International Convention for the Protection of Performers, Producers of Phonograms and Broadcasting Organisations done at Rome on 26 October 1961.]

X66

207.- Countries to which this Part extends.

This Part extends to England and Wales, Scotland and Northern Ireland.

X67

208.- Countries enjoying reciprocal protection.

(1) Her Majesty may by Order in Council designate as enjoying reciprocal protection under this Part:

(a) a Convention country, or

(b) a country as to which Her Majesty is satisfied that provision has been or will be made under its law giving adequate protection for British performances.

(2) A “Convention country” means a country which is a party to a Convention relating to performers’ rights to which the United Kingdom is also a party.

(3) A “British performance” means a performance:

(a) given by an individual who is a British citizen or resident in the United Kingdom, or

(b) taking place in the United Kingdom.

(4) If the law of that country provides adequate protection only for certain descriptions of performance, an Order under subsection (1)(b) designating that country shall contain provision limiting to a corresponding extent the protection afforded by this Part in relation to performances connected with that country.

(5) The power conferred by subsection (1)(b) is exercisable in relation to F593… any colony of the United Kingdom, as in relation to a foreign country.

(6) A statutory instrument containing an Order in Council under this section shall be subject to annulment in pursuance of a resolution of either House of Parliament.

X68

209.- Territorial waters and the continental shelf.

(1) For the purposes of this Part the territorial waters of the United Kingdom shall be treated as part of the United Kingdom.

(3) The United Kingdom sector of the continental shelf means the areas designated by order under section 1(7) of the M25Continental Shelf Act 1964.

X69

210.- British ships, aircraft and hovercraft.

(1) This Part applies to things done on a British ship, aircraft or hovercraft as it applies to things done in the United Kingdom.

(2) In this section:

“British ship” means a ship which is a British ship for the purposes of the [F594Merchant Shipping Act 1995] otherwise than by virtue of registration in a country outside the United Kingdom; and

“British aircraft” and “British hovercraft” mean an aircraft or hovercraft registered in the United Kingdom.

[F595

210A.- Requirement of signature: application in relation to body corporate

(1) The requirement in the following provisions that an instrument be signed by or on behalf of a person is also satisfied in the case of a body corporate by the affixing of its seal:

section 191B(3) (assignment of performer’s property rights);

section 191C(1) (assignment of future performer’s property rights);

section 191D(1) (grant of exclusive licence).

(2) The requirement in the following provisions that an instrument be signed by a person is also satisfied in the case of a body corporate by signature on behalf of the body or by the affixing of its seal:

section 205D(2)(a) (assertion of performer’s moral rights);

section 205J(2) (waiver of performer’s moral rights).]

X70.- Interpretation

X71

211.- Expressions having same meaning as in copyright provisions.

(1) The following expressions have the same meaning in this Part as in Part I (copyright):

[F596 assignment (in Scotland),]

broadcast,

business,

F597. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F598. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[F599 communication to the public,]

country,

defendant (in Scotland),

delivery up (in Scotland),

[F600 the EEA,][F600 EEA state,]

film,

[F601 injunction (in Scotland)]

literary work,

published, F602. . .

[F603 signed,][F604 sound recording, and][F605wireless broadcast.]

(2) [F606 The provisions of:

(a) section 5B(2) and (3) (supplementary provisions relating to films), and

(b) section 6(3) to (5A) and section 19(4) (supplementary provisions relating to broadcasting),apply] for the purposes of this Part, and in relation to an infringement of the rights conferred by this Part, as they apply for the purposes of Part I and in relation to an infringement of copyright.

X72

212.- Index of defined expressions.

The following Table shows provisions defining or otherwise explaining expressions used in this Part (other than provisions defining or explaining an expression used only in the same section):

[F607 accessible copy (in paragraphs 3A to 3E of Schedule 2) paragraph 3E(4) of Schedule 2][F608 assignment (in Scotland) section 211(1) (and section 177);]

broadcast (and related expressions) section 211 (and section 6)

business section 211(1) (and section 178)

F609. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[F610 communication to the public section 211(1) (and section 20)][F611 consent of performer (in relation to

performer’s property rights)] [F612section 191A(2)]

country section 211(1) (and section 178)

defendant (in Scotland) section 211(1) (and section 177)

delivery up (in Scotland) section 211(1) (and section 177)

[F607 disabled person (in paragraphs 3A to 3E of Schedule 2) paragraph 3E(2) and (3) of Schedule 2][F613 distribution right] [F614section 182B(5)][F615 the EEA and EEA state] [F616 section 211(1) (and section 172A)]

exclusive recording contract section 185(1)

film section 211(1) (and [F617section 5B])

[F618group section 205C(4);]

illicit recording section 197

[F619 injunction (in Scotland) section 211(1) (and section 177)][F620 issue to the public section 182B;]

literary work section 211(1) (and section 3(1))

[F621 lending right] [F622section 182C(7)][F623 making available right section 182CA]

performance section 180(2)

[F624 performer’s non-property rights] [F625section 192A(1)][F626 performer’s property rights] [F627section 191A(1)]

published section 211(1) (and section 175)

qualifying country section 206(1)

qualifying individual section 206(1) and (2)

qualifying performance section 181

qualifying person section 206(1) and (3)

recording (of a performance) section 180(2)

recording rights (person having) section 185(2) and (3)

[F628rental right)] [F629section 182C(7)][F630 reproduction right] [F631section 182A(3)][F632 rights owner (in relation to performer’s property rights)] [F633 section 191A(3) and (4).][F634 signed section 211(1) (and section 176);]

sound recording section 211(1) (and [F635 section 5A]).

[F636 wireless broadcast section 211(1) (and section 178).]][F637.- Supplementary

212A.- Power to amend in consequence of changes to international law

(1) The Secretary of State may by order amend this Part in consequence of changes to international law in the area of performance rights.

(2) An order under this section must be made by statutory instrument; and no order may be made unless a draft of it has been laid before and approved by a resolution of each House of Parliament.]

Part III.- Design Right

Chapter I.- Design right in original designs

Introductory

213.- Design right.

(1) Design right is a property right which subsists in accordance with this Part in an original design.

(2) In this Part “design” means the design of F638… the shape or configuration (whether internal or external) of the whole or part of an article.

(3) Design right does not subsist in:

(a) a method or principle of construction,

(b) features of shape or configuration of an article which:

(i) enable the article to be connected to, or placed in, around or against, another article so that either article may perform its function, or

(ii) are dependent upon the appearance of another article of which the article is intended by the designer to form an integral part, or

(4) A design is not “original” for the purposes of this Part if it is commonplace [F639in a qualifying country] in the design field in question at the time of its creation[F640; and “qualifying country” has the meaning given in section 217(3) ].

(5) Design right subsists in a design only if the design qualifies for design right protection by reference to:

(a) the designer or the person by whom [F641the designer was employed] (see sections 218 and 219), or

(b) the person by whom and country in which articles made to the design were first marketed (see section 220),or in accordance with any Order under section 221 (power to make further provision with respect to qualification).

F642 [

(5A) Design right does not subsist in a design which consists of or contains a controlled representation within the meaning of the Olympic Symbol etc. (Protection) Act 1995. ]

(6) Design right does not subsist unless and until the design has been recorded in a design document or an article has been made to the design.

(7) Design right does not subsist in a design which was so recorded, or to which an article was made, before the commencement of this Part.

214.- The designer.

(1) In this Part the “designer”, in relation to a design, means the person who creates it.

(2) In the case of a computer-generated design the person by whom the arrangements necessary for the creation of the design are undertaken shall be taken to be the designer.

215.- Ownership of design right.

(1) The designer is the first owner of any design right in a design which is not created F643… in the course of employment.

F644

(2). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(3) Where F645… a design is created by an employee in the course of his employment, his employer is the first owner of any design right in the design.

(4) If a design qualifies for design right protection by virtue of section 220 (qualification by reference to first marketing of articles made to the design), the above rules do not apply and the person by whom the articles in question are marketed is the first owner of the design right.

216.- Duration of design right.

(1) Design right expires:

(a) fifteen years from the end of the calendar year in which the design was first recorded in a design document or an article was first made to the design, whichever first occurred, or

(b) if articles made to the design are made available for sale or hire within five years from the end of that calendar year, ten years from the end of the calendar year in which that first occurred.

(2) The reference in subsection (1) to articles being made available for sale or hire is to their being made so available anywhere in the world by or with the licence of the design right owner.

Qualification for design right protection

217.- Qualifying individuals and qualifying persons.

(1)In this Part:

F646…

[F647 “ qualifying person ” means:

(a) an individual habitually resident in a qualifying country, or

(b) a body corporate or other body having legal personality which:

(i) is formed under the law of a part of the United Kingdom or another qualifying country, and

(ii) has in any qualifying country a place of business at which substantial business activity is carried on.]

(2) References in this Part to a qualifying person include the Crown and the government of any other qualifying country.

(3) In this section “qualifying country” means:

(a) the United Kingdom,

(b) a country to which this Part extends by virtue of an Order under section 255,

(d) to the extent that an Order under section 256 so provides, a country designated under that section as enjoying reciprocal protection.

F649

(4). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(5) In determining for the purpose of the definition of “qualifying person” whether substantial business activity is carried on at a place of business in any country, no account shall be taken of dealings in goods which are at all material times outside that country.

218.- Qualification by reference to designer.

(1) This section applies to a design which is not created F650…in the course of employment.

(2) A design to which this section applies qualifies for design right protection if the designer is F651… a qualifying person.

(3) A joint design to which this section applies qualifies for design right protection if any of the designers is F652… a qualifying person.

(4) Where a joint design qualifies for design right protection under this section, only those designers who are F653… qualifying persons are entitled to design right under section 215(1) (first ownership of design right: entitlement of designer).

219.- [F654.- Qualification by reference to employer].

(1) A design qualifies for design right protection if it is created [F655in the course of employment with ] a qualifying person.

(2) In the case of F656… joint employment a design qualifies for design right protection if any of the F656… employers is a qualifying person.

(3) Where a design which is F657… created in the course of joint employment qualifies for design right protection under this section, only those F657… employers who are qualifying persons are entitled to design right under section [F658215(3)] (first ownership of design right: entitlement of F657… employer).

220.- Qualification by reference to first marketing.

(1) A design which does not qualify for design right protection under section 218 or 219 (qualification by reference to designerF659… or employer) qualifies for design right protection if the first marketing of articles made to the design:

(a) is by a qualifying person F660…, and

(b) takes place in the United Kingdom, another country to which this Part extends by virtue of an Order under section 255, or another member State of the [F661European Union].

(2) If the first marketing of articles made to the design is done jointly by two or more persons, the design qualifies for design right protection if any of those persons meets the [F662 requirement] specified in subsection (1)(a).

In such a case only the persons who meet [F663that requirement ] are entitled to design right under section 215(4) (first ownership of design right: entitlement of first marketer of articles made to the design).

F664

(4). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

221.- Power to make further provision as to qualification.

(1) Her Majesty may, with a view to fulfilling an international obligation of the United Kingdom, by Order in Council provide that a design qualifies for design right protection if such requirements as are specified in the Order are met.

(2) An Order may make different provision for different descriptions of design or article; and may make such consequential modifications of the operation of sections 215 (ownership of design right) and sections 218 to 220 (other means of qualification) as appear to Her Majesty to be appropriate.

(3) A statutory instrument containing an Order in Council under this section shall be subject to annulment in pursuance of a resolution of either House of Parliament.

Dealings with design right

222.- Assignment and licences.

(1) Design right is transmissible by assignment, by testamentary disposition or by operation of law, as personal or moveable property.

(2) An assignment or other transmission of design right may be partial, that is, limited so as to apply:

(a) to one or more, but not all, of the things the design right owner has the exclusive right to do;

(b) to part, but not the whole, of the period for which the right is to subsist.

(3) An assignment of design right is not effective unless it is in writing signed by or on behalf of the assignor.

(4) A licence granted by the owner of design right is binding on every successor in title to his interest in the right, except a purchaser in good faith for valuable consideration and without notice (actual or constructive) of the licence or a person deriving title from such a purchaser; and references in this Part to doing anything with, or without, the licence of the design right owner shall be construed accordingly.

223.- Prospective ownership of design right.

(1) Where by an agreement made in relation to future design right, and signed by or on behalf of the prospective owner of the design right, the prospective owner purports to assign the future design right (wholly or partially) to another person, then if, on the right coming into existence, the assignee or another person claiming under him would be entitled as against all other persons to require the right to be vested in him, the right shall vest in him by virtue of this section.

(2) In this section:

“future design right” means design right which will or may come into existence in respect of a future design or class of designs or on the occurrence of a future event; and

“prospective owner” shall be construed accordingly, and includes a person who is prospectively entitled to design right by virtue of such an agreement as is mentioned in subsection (1).

(3) A licence granted by a prospective owner of design right is binding on every successor in title to his interest (or prospective interest) in the right, except a purchaser in good faith for valuable consideration and without notice (actual or constructive) of the licence or a person deriving title from such a purchaser; and references in this Part to doing anything with, or without, the licence of the design right owner shall be construed accordingly.

224.- Assignment of right in registered design presumed to carry with it design right.

Where a design consisting of a design in which design right subsists is registered under the M26Registered Designs Act 1949 and the proprietor of the registered design is also the design right owner, an assignment of the right in the registered design shall be taken to be also an assignment of the design right, unless a contrary intention appears.

225.- Exclusive licences.

(1) In this Part an “exclusive licence” means a licence in writing signed by or on behalf of the design right owner authorising the licensee to the exclusion of all other persons, including the person granting the licence, to exercise a right which would otherwise be exercisable exclusively by the design right owner.

(2) The licensee under an exclusive licence has the same rights against any successor in title who is bound by the licence as he has against the person granting the licence.

Chapter II.- Rights of Design Right Owner and Remedies

Infringement of design right

226.- Primary infringement of design right.

(1) The owner of design right in a design has the exclusive right to reproduce the design for commercial purposes:

(a) by making articles to that design, or

(b) by making a design document recording the design for the purpose of enabling such articles to be made.

(2) Reproduction of a design by making articles to the design means copying the design so as to produce articles exactly or substantially to that design, and references in this Part to making articles to a design shall be construed accordingly.

(3) Design right is infringed by a person who without the licence of the design right owner does, or authorises another to do, anything which by virtue of this section is the exclusive right of the design right owner.

(4) For the purposes of this section reproduction may be direct or indirect, and it is immaterial whether any intervening acts themselves infringe the design right.

(5) This section has effect subject to the provisions of Chapter III (exceptions to rights of design right owner).

227.- Secondary infringement: importing or dealing with infringing article.

(1) Design right is infringed by a person who, without the licence of the design right owner:

(a) imports into the United Kingdom for commercial purposes, or

(b) has in his possession for commercial purposes, or

(c) sells, lets for hire, or offers or exposes for sale or hire, in the course of a business,an article which is, and which he knows or has reason to believe is, an infringing article.

(2) This section has effect subject to the provisions of Chapter III (exceptions to rights of design right owner).

228.- Meaning of “infringing article”.

(1) In this Part “infringing article”, in relation to a design, shall be construed in accordance with this section.

(2) An article is an infringing article if its making to that design was an infringement of design right in the design.

(3) An article is also an infringing article if:

(a) it has been or is proposed to be imported into the United Kingdom, and

(b) its making to that design in the United Kingdom would have been an infringement of design right in the design or a breach of an exclusive licence agreement relating to the design.

(4) Where it is shown that an article is made to a design in which design right subsists or has subsisted at any time, it shall be presumed until the contrary is proved that the article was made at a time when design right subsisted.

(5) Nothing in subsection (3) shall be construed as applying to an article which may lawfully be imported into the United Kingdom by virtue of any enforceable [F665EU] right within the meaning of section 2(1) of the M27European Communities Act 1972.

(6) The expression “infringing article” does not include a design document, notwithstanding that its making was or would have been an infringement of design right.

Remedies for infringement

229.- Rights and remedies of design right owner.

(1) An infringement of design right is actionable by the design right owner.

(2) In an action for infringement of design right all such relief by way of damages, injunctions, accounts or otherwise is available to the plaintiff as is available in respect of the infringement of any other property right.

(3) The court may in an action for infringement of design right, having regard to all the circumstances and in particular to:

(a) the flagrancy of the infringement, and

(b) any benefit accruing to the defendant by reason of the infringement,award such additional damages as the justice of the case may require.

(4) This section has effect subject to section 233 (innocent infringement).

230.- Order for delivery up.

(1) Where a person:

(a) has in his possession, custody or control for commercial purposes an infringing article, or

(b) has in his possession, custody or control anything specifically designed or adapted for making articles to a particular design, knowing or having reason to believe that it has been or is to be used to make an infringing article,the owner of the design right in the design in question may apply to the court for an order that the infringing article or other thing be delivered up to him or to such other person as the court may direct.

(2) An application shall not be made after the end of the period specified in the following provisions of this section; and no order shall be made unless the court also makes, or it appears to the court that there are grounds for making, an order under section 231 (order as to disposal of infringing article, &c.).

(3) An application for an order under this section may not be made after the end of the period of six years from the date on which the article or thing in question was made, subject to subsection (4).

(4) If during the whole or any part of that period the design right owner:

(a) is under a disability, or

(5) In subsection (4) “disability”:

(a) in England and Wales, has the same meaning as in the M28Limitation Act 1980;

(b) in Scotland, means legal disability within the meaning of the M29Prescription and Limitation (Scotland) Act 1973;

(6) A person to whom an infringing article or other thing is delivered up in pursuance of an order under this section shall, if an order under section 231 is not made, retain it pending the making of an order, or the decision not to make an order, under that section.

(7) Nothing in this section affects any other power of the court.

231.- Order as to disposal of infringing articles, &c.

(1) An application may be made to the court for an order that an infringing article or other thing delivered up in pursuance of an order under section 230 shall be:

(a) forfeited to the design right owner, or

(b) destroyed or otherwise dealt with as the court may think fit,or for a decision that no such order should be made.

(2) In considering what order (if any) should be made, the court shall consider whether other remedies available in an action for infringement of design right would be adequate to compensate the design right owner and to protect his interests.

(3) Provision shall be made by rules of court as to the service of notice on persons having an interest in the article or other thing, and any such person is entitled:

(a) to appear in proceedings for an order under this section, whether or not he was served with notice, and

(4) Where there is more than one person interested in an article or other thing, the court shall make such order as it thinks just and may (in particular) direct that the thing be sold, or otherwise dealt with, and the proceeds divided.

(5) If the court decides that no order should be made under this section, the person in whose possession, custody or control the article or other thing was before being delivered up F666. . . is entitled to its return.

(6) References in this section to a person having an interest in an article or other thing include any person in whose favour an order could be made in respect of it

[F667

(a) under this section or under section 114 or 204 of this Act;

(b) under section 24D of the Registered Designs Act 1949;

(c) under section 19 of Trade Marks Act 1994 (including that section as applied by regulation 4 of the Community Trade Mark Regulations 2006 (SI 2006/1027)); or

(d) under regulation 1C of the Community Design Regulations 2005 (SI 2005/2339).]

232.- Jurisdiction of county court and sheriff court.

(1) In England [F668and Wales the county court and in] Northern Ireland a county court may entertain proceedings under:

section 230 (order for delivery up of infringing article, &c.),

section 231 (order as to disposal of infringing article, &c.), or

section 235(5) (application by exclusive licensee having concurrent rights),

[F669 save that, in Northern Ireland, a county court may entertain such proceedings only] where the value of the infringing articles and other things in question does not exceed the county court limit for actions in tort.

(2) In Scotland proceedings for an order under any of those provisions may be brought in the sheriff court.

(3) Nothing in this section shall be construed as affecting the jurisdiction of the High Court or, in Scotland, the Court of Session.

233.- Innocent infringement.

(1) Where in an action for infringement of design right brought by virtue of section 226 (primary infringement) it is shown that at the time of the infringement the defendant did not know, and had no reason to believe, that design right subsisted in the design to which the action relates, the plaintiff is not entitled to damages against him, but without prejudice to any other remedy.

(2) Where in an action for infringement of design right brought by virtue of section 227 (secondary infringement) a defendant shows that the infringing article was innocently acquired by him or a predecessor in title of his, the only remedy available against him in respect of the infringement is damages not exceeding a reasonable royalty in respect of the act complained of.

(3) In subsection (2) “innocently acquired” means that the person acquiring the article did not know and had no reason to believe that it was an infringing article.

234.- Rights and remedies of exclusive licensee.

(1) An exclusive licensee has, except against the design right owner, the same rights and remedies in respect of matters occurring after the grant of the licence as if the licence had been an assignment.

(2) His rights and remedies are concurrent with those of the design right owner; and references in the relevant provisions of this Part to the design right owner shall be construed accordingly.

235.- Exercise of concurrent rights.

(1) Where an action for infringement of design right brought by the design right owner or an exclusive licensee relates (wholly or partly) to an infringement in respect of which they have concurrent rights of action, the design right owner or, as the case may be, the exclusive licensee may not, without the leave of the court, proceed with the action unless the other is either joined as a plaintiff or added as a defendant.

(2) A design right owner or exclusive licensee who is added as a defendant in pursuance of subsection (1) is not liable for any costs in the action unless he takes part in the proceedings.

(3) The above provisions do not affect the granting of interlocutory relief on the application of the design right owner or an exclusive licensee.

(4) Where an action for infringement of design right is brought which relates (wholly or partly) to an infringement in respect of which the design right owner and an exclusive licensee have concurrent rights of action:

(a) the court shall, in assessing damages, take into account:

(i) the terms of the licence, and

(ii) any pecuniary remedy already awarded or available to either of them in respect of the infringement;

(b) no account of profits shall be directed if an award of damages has been made, or an account of profits has been directed, in favour of the other of them in respect of the infringement; and

(c) the court shall if an account of profits is directed apportion the profits between them as the court considers just, subject to any agreement between them;and these provisions apply whether or not the design right owner and the exclusive licensee are both parties to the action.

(5) The design right owner shall notify any exclusive licensee having concurrent rights before applying for an order under section 230 (order for delivery up of infringing article, &c.); and the court may on the application of the licensee make such order under that section as it thinks fit having regard to the terms of the licence.

Chapter III.- Exceptions to Rights of Design Right Owners

Infringement of copyright

236.- Infringement of copyright.

Where copyright subsists in a work which consists of or includes a design in which design right subsists, it is not an infringement of design right in the design to do anything which is an infringement of the copyright in that work.

Availability of licences of right

237.- Licences available in last five years of design right.

(1) Any person is entitled as of right to a licence to do in the last five years of the design right term anything which would otherwise infringe the design right.

(2) The terms of the licence shall, in default of agreement, be settled by the comptroller.

(3) The Secretary of State may if it appears to him necessary in order to:

(a) comply with an international obligation of the United Kingdom, or

(b) secure or maintain reciprocal protection for British designs in other countries,by order exclude from the operation of subsection (1) designs of a description specified in the order or designs applied to articles of a description so specified.

(4) An order shall be made by statutory instrument; and no order shall be made unless a draft of it has been laid before and approved by a resolution of each House of Parliament.

238.- Powers exercisable for protection of the public interest.

[F670

(1) Subsection (1A) applies where whatever needs to be remedied, mitigated or prevented by the Secretary of State [F671 or (as the case may be) the Competition and Markets Authority ] under section 12(5) of the Competition Act 1980 or section 41(2), 55(2), 66(6), 75(2), 83(2), 138(2), 147(2) [F672 , 147A(2) ] or 160(2) of, or paragraph 5(2) or 10(2) of Schedule 7 to, the Enterprise Act 2002 (powers to take remedial action following references to the [F673 Competition and Markets Authority ] in connection with public bodies and certain other persons, mergers or market investigations etc. ) consists of or includes:

(a) conditions in licences granted by a design right owner restricting the use of the design by the licensee or the right of the design right owner to grant other licences, or

(b) a refusal of a design right owner to grant licences on reasonable terms.

(3) The terms of a licence available by virtue of this section shall, in default of agreement, be settled by the comptroller.

239.- Undertaking to take licence of right in infringement proceedings.

(1) If in proceedings for infringement of design right in a design in respect of which a licence is available as of right under section 237 or 238 the defendant undertakes to take a licence on such terms as may be agreed or, in default of agreement, settled by the comptroller under that section:

(a) no injunction shall be granted against him,

(b) no order for delivery up shall be made under section 230, and

(2) An undertaking may be given at any time before final order in the proceedings, without any admission of liability.

(3) Nothing in this section affects the remedies available in respect of an infringement committed before licences of right were available.

Crown use of designs

240.- Crown use of designs.

(1) A government department, or a person authorised in writing by a government department, may without the licence of the design right owner:

(a) do anything for the purpose of supplying articles for the services of the Crown, or

(b) dispose of articles no longer required for the services of the Crown;and nothing done by virtue of this section infringes the design right.

(2) References in this Part to “the services of the Crown” are to:

(a) the defence of the realm,

(b) foreign defence purposes, and

(3) The reference to the supply of articles for “foreign defence purposes” is to their supply:

(a) for the defence of a country outside the realm in pursuance of an agreement or arrangement to which the government of that country and Her Majesty’s Government in the United Kingdom are parties; or

(b) for use by armed forces operating in pursuance of a resolution of the United Nations or one of its organs.

(4) The reference to the supply of articles for “health service purposes” are to their supply for the purpose of providing:

[F674(za) primary medical services or primary dental services under [F675the National Health Service Act 2006 or the National Health Service (Wales) Act 2006,][F676or primary medical services under Part 1 of the National Health Service (Scotland) Act 1978]]

F677[

(a) pharmaceutical services, general medical services or general dental services under:

[F678

(i) Chapter 1 of Part 7 of the National Health Service Act 2006, or Chapter 1 of Part 7 of the National Health Service (Wales) Act 2006 (in the case of pharmaceutical services),]

(ii) Part II of the National Health Service (Scotland) Act 1978 [F679(in the case of pharmaceutical services or general dental services)], or

(iii) the corresponding provisions of the law in force in Northern Ireland; or

(b) personal medical services or personal dental services in accordance with arrangements made under:

(i) F680. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(ii) section 17C of the 1978 Act [F681(in the case of personal dental services)], or

(iii) the corresponding provisions of the law in force in Northern Ireland][F682or

(c) local pharmaceutical services provided under[F683 the National Health Service Act 2006 or the National Health Service (Wales) Act 2006].]

(5) In this Part:

“Crown use”, in relation to a design, means the doing of anything by virtue of this section which would otherwise be an infringement of design right in the design; and

“the government department concerned”, in relation to such use, means the government department by whom or on whose authority the act was done.

(6) The authority of a government department in respect of Crown use of a design may be given to a person either before or after the use and whether or not he is authorised, directly or indirectly, by the design right owner to do anything in relation to the design.

(7) A person acquiring anything sold in the exercise of powers conferred by this section, and any person claiming under him, may deal with it in the same manner as if the design right were held on behalf of the Crown.

241.- Settlement of terms for Crown use.

(1) Where Crown use is made of a design, the government department concerned shall:

(a) notify the design right owner as soon as practicable, and

(b) give him such information as to the extent of the use as he may from time to time require,unless it appears to the department that it would be contrary to the public interest to do so or the identity of the design right owner cannot be ascertained on reasonable inquiry.

(2) Crown use of a design shall be on such terms as, either before or after the use, are agreed between the government department concerned and the design right owner with the approval of the Treasury or, in default of agreement, are determined by the court.In the application of this subsection to Northern Ireland the reference to the Treasury shall, where the government department referred to in that subsection is a Northern Ireland department, be construed as a reference to the Department of Finance and Personnel.

[F684 In the application of this subsection to Scotland, where the government department referred to in that subsection is any part of the Scottish Administration, the words “with the approval of the Treasury” are omitted.]

(3) Where the identity of the design right owner cannot be ascertained on reasonable inquiry, the government department concerned may apply to the court who may order that no royalty or other sum shall be payable in respect of Crown use of the design until the owner agrees terms with the department or refers the matter to the court for determination.

242.- Rights of third parties in case of Crown use.

(1) The provisions of any licence, assignment or agreement made between the design right owner (or anyone deriving title from him or from whom he derives title) and any person other than a government department are of no effect in relation to Crown use of a design, or any act incidental to Crown use, so far as they:

(a) restrict or regulate anything done in relation to the design, or the use of any model, document or other information relating to it, or

(b) provide for the making of payments in respect of, or calculated by reference to such use;and the copying or issuing to the public of copies of any such model or document in connection with the thing done, or any such use, shall be deemed not to be an infringement of any copyright in the model or document.

(2) Subsection (1) shall not be construed as authorising the disclosure of any such model, document or information in contravention of the licence, assignment or agreement.

(3) Where an exclusive licence is in force in respect of the design:

(a )if the licence was granted for royalties:

(i) any agreement between the design right owner and a government department under section 241 (settlement of terms for Crown use) requires the consent of the licensee, and

(ii) the licensee is entitled to recover from the design right owner such part of the payment for Crown use as may be agreed between them or, in default of agreement, determined by the court;

(b) if the licence was granted otherwise than for royalties:

(i) section 241 applies in relation to anything done which but for section 240 (Crown use) and subsection (1) above would be an infringement of the rights of the licensee with the substitution for references to the design right owner of references to the licensee, and

(ii) section 241 does not apply in relation to anything done by the licensee by virtue of an authority given under section 240.

(4) Where the design right has been assigned to the design right owner in consideration of royalties:

(a) section 241 applies in relation to Crown use of the design as if the references to the design right owner included the assignor, and any payment for Crown use shall be divided between them in such proportion as may be agreed or, in default of agreement, determined by the court; and

(b) section 241 applies in relation to any act incidental to Crown use as it applies in relation to Crown use of the design.

(5) Where any model, document or other information relating to a design is used in connection with Crown use of the design, or any act incidental to Crown use, section 241 applies to the use of the model, document or other information with the substitution for the references to the design right owner of references to the person entitled to the benefit of any provision of an agreement rendered inoperative by subsection (1) above.

(6) In this section:

“act incidental to Crown use” means anything done for the services of the Crown to the order of a government department by the design right owner in respect of a design;

“payment for Crown use” means such amount as is payable by the government department concerned by virtue of section 241; and

“royalties” includes any benefit determined by reference to the use of the design.

243.- Crown use: compensation for loss of profit.

(1) Where Crown use is made of a design, the government department concerned shall pay:

(a) to the design right owner, or

(b) if there is an exclusive licence in force in respect of the design, to the exclusive licensee,compensation for any loss resulting from his not being awarded a contract to supply the articles made to the design.

(2) Compensation is payable only to the extent that such a contract could have been fulfilled from his existing manufacturing capacity; but is payable notwithstanding the existence of circumstances rendering him ineligible for the award of such a contract.

(3) In determining the loss, regard shall be had to the profit which would have been made on such a contract and to the extent to which any manufacturing capacity was under-used.

(4) No compensation is payable in respect of any failure to secure contracts for the supply of articles made to the design otherwise than for the services of the Crown.

(5) The amount payable shall, if not agreed between the design right owner or licensee and the government department concerned with the approval of the Treasury, be determined by the court on a reference under section 252; and it is in addition to any amount payable under section 241 or 242.

(6) In the application of this section to Northern Ireland, the reference in subsection (5) to the Treasury shall, where the government department concerned is a Northern Ireland department, be construed as a reference to the Department of Finance and Personnel.

[F685

(7) In the application of this section to Scotland, where the government department referred to in subsection (5) is any part of the Scottish Administration, the words “with the approval of the Treasury” in that subsection are omitted.]

244.- Special provision for Crown use during emergency.

(1) During a period of emergency the powers exercisable in relation to a design by virtue of section 240 (Crown use) include power to do any act which would otherwise be an infringement of design right for any purpose which appears to the government department concerned necessary or expedient:

(a) for the efficient prosecution of any war in which Her Majesty may be engaged;

(b) for the maintenance of supplies and services essential to the life of the community;

(d) for promoting the productivity of industry, commerce and agriculture;

(e) for fostering and directing exports and reducing imports, or imports of any classes, from all or any countries and for redressing the balance of trade;

(f) generally for ensuring that the whole resources of the community are available for use, and are used, in a manner best calculated to serve the interests of the community; or

(g) for assisting the relief of suffering and the restoration and distribution of essential supplies and services in any country outside the United Kingdom which is in grave distress as the result of war.

(2) References in this Part to the services of the Crown include, as respects a period of emergency, those purposes; and references to “Crown use” include any act which would apart from this section be an infringement of design right.

(3) In this section “period of emergency” means a period beginning with such date as may be declared by Order in Council to be the beginning, and ending with such date as may be so declared to be the end, of a period of emergency for the purposes of this section.

(4) No Order in Council under this section shall be submitted to Her Majesty unless a draft of it has been laid before and approved by a resolution of each House of Parliament.

[F686 Miscellaneous

244A.- Exception for private acts, experiments and teaching

Design right is not infringed by:

(a) an act which is done privately and for purposes which are not commercial;

(b) an act which is done for experimental purposes; or

(i) the act of reproduction is compatible with fair trade practice and does not unduly prejudice the normal exploitation of the design, and

(ii) mention is made of the source.

244B.- Exception for overseas ships and aircraft

Design right is not infringed by:

(a) the use of equipment on ships or aircraft which are registered in another country but which are temporarily in the United Kingdom;

(b) the importation into the United Kingdom of spare parts or accessories for the purpose of repairing such ships or aircraft; or

General

245.- Power to provide for further exceptions.

(1) The Secretary of State may if it appears to him necessary in order to:

(a) comply with an international obligation of the United Kingdom, or

(b) secure or maintain reciprocal protection for British designs in other countries,by order provide that acts of a description specified in the order do not infringe design right.

(2) An order may make different provision for different descriptions of design or article.

(3) An order shall be made by statutory instrument and no order shall be made unless a draft of it has been laid before and approved by a resolution of each House of Parliament.

Chapter IV.- Jurisdiction of the Comptroller and the Court

Jurisdiction of the comptroller

246.- Jurisdiction to decide matters relating to design right.

(1) A party to a dispute as to any of the following matters may refer the dispute to the comptroller for his decision:

(a) the subsistence of design right,

(b) the term of design right, or

(c) the identity of the person in whom design right first vested;and the comptroller’s decision on the reference is binding on the parties to the dispute.

(2) No other court or tribunal shall decide any such matter except:

(a) on a reference or appeal from the comptroller,

(b) in infringement or other proceedings in which the issue arises incidentally, or

(3) The comptroller has jurisdiction to decide any incidental question of fact or law arising in the course of a reference under this section.

247.- Application to settle terms of licence of right.

(1) A person requiring a licence which is available as of right by virtue of:

(a) section 237 (licences available in last five years of design right), or

(b) an order under section 238 (licences made available in the public interest),may apply to the comptroller to settle the terms of the licence.

(2) No application for the settlement of the terms of a licence available by virtue of section 237 may be made earlier than one year before the earliest date on which the licence may take effect under that section.

(3) The terms of a licence settled by the comptroller shall authorise the licensee to do:

(a) in the case of licence available by virtue of section 237, everything which would be an infringement of the design right in the absence of a licence;

(b) in the case of a licence available by virtue of section 238, everything in respect of which a licence is so available.

(4) In settling the terms of a licence the comptroller shall have regard to such factors as may be prescribed by the Secretary of State by order made by statutory instrument.

(5) No such order shall be made unless a draft of it has been laid before and approved by a resolution of each House of Parliament.

(6) Where the terms of a licence are settled by the comptroller, the licence has effect:

(a) in the case of an application in respect of a licence available by virtue of section 237 made before the earliest date on which the licence may take effect under that section, from that date;

(b) in any other case, from the date on which the application to the comptroller was made.

248.- Settlement of terms where design right owner unknown.

(1) This section applies where a person making an application under section 247 (settlement of terms of licence of right) is unable on reasonable inquiry to discover the identity of the design right owner.

(2) The comptroller may in settling the terms of the licence order that the licence shall be free of any obligation as to royalties or other payments.

(3) If such an order is made the design right owner may apply to the comptroller to vary the terms of the licence with effect from the date on which his application is made.

(4) If the terms of a licence are settled by the comptroller and it is subsequently established that a licence was not available as of right, the licensee shall not be liable in damages for, or for an account of profits in respect of, anything done before he was aware of any claim by the design right owner that a licence was not available.

249.- Appeals as to terms of licence of right.

(1) An appeal lies from any decision of the comptroller under section 247 or 248 (settlement of terms of licence of right) to [F687a person appointed under section 27A of the Registered Designs Act 1949].

F688

(2). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[F689

249A.- Opinions service

The descriptions of designs which may be specified in regulations under subsection (1)(b) of section 28A of the Registered Designs Act 1949 (requests to the comptroller for opinions on designs) include, in particular:

(a) designs in which design right subsists in accordance with this Part, and

(b) designs in relation to which there is a question whether design right so subsists.]

250.- Rules

(1) The Secretary of State may make rules for regulating the procedure to be followed in connection with any proceeding before the comptroller under this Part.

(2) Rules may, in particular, make provision:

(a) prescribing forms;

(b) requiring fees to be paid;

(d) regulating the mode of giving evidence and empowering the comptroller to compel the attendance of witnesses and the discovery of and production of documents;

(e) providing for the appointment of advisers to assist the comptroller in proceedings before him;

(f) prescribing time limits for doing anything required to be done (and providing for the alteration of any such limit); and

(g) empowering the comptroller to award costs and to direct how, to what party and from what parties, costs are to be paid.

(3) Rules prescribing fees require the consent of the Treasury.

(4) The remuneration of an adviser appointed to assist the comptroller shall be determined by the Secretary of State with the consent of the Treasury and shall be defrayed out of money provided by Parliament.

(5)Rules shall be made by statutory instrument which shall be subject to annulment in pursuance of a resolution of either House of Parliament.

Jurisdiction of the court

251.- References and appeals on design right matters.

(1) In any proceedings before him under section 246 (reference of matter relating to design right), the comptroller may at any time order the whole proceedings or any question or issue (whether of fact or law) to be referred, on such terms as he may direct, to the High Court or, in Scotland, the Court of Session.

(2) The comptroller shall make such an order if the parties to the proceedings agree that he should do so.

(3) On a reference under this section the court may exercise any power available to the comptroller by virtue of this Part as respects the matter referred to it and, following its determination, may refer any matter back to the comptroller.

(4) An appeal lies from any decision of the comptroller in proceedings before him under section 246 (decisions on matters relating to design right) to [F690:

(a)] the High Court or, in Scotland, the Court of Session [F691, or

(b) a person appointed under section 27A of the Registered Designs Act 1949].

252.- Reference of disputes relating to Crown use.

(1) A dispute as to any matter which falls to be determined by the court in default of agreement under:

(a) section 241 (settlement of terms for Crown use),

(b) section 242 (rights of third parties in case of Crown use), or

(2) In determining a dispute between a government department and any person as to the terms for Crown use of a design the court shall have regard to:

(a) any sums which that person or a person from whom he derives title has received or is entitled to receive, directly or indirectly, from any government department in respect of the design; and

(b) whether that person or a person from whom he derives title has in the court’s opinion without reasonable cause failed to comply with a request of the department for the use of the design on reasonable terms.

(3) One of two or more joint owners of design right may, without the concurrence of the others, refer a dispute to the court under this section, but shall not do so unless the others are made parties; and none of those others is liable for any costs unless he takes part in the proceedings.

(4) Where the consent of an exclusive licensee is required by section 242(3)(a)(i) to the settlement by agreement of the terms for Crown use of a design, a determination by the court of the amount of any payment to be made for such use is of no effect unless the licensee has been notified of the reference and given an opportunity to be heard.

(5) On the reference of a dispute as to the amount recoverable as mentioned in section 242(3)(a)(ii) (right of exclusive licensee to recover part of amount payable to design right owner) the court shall determine what is just having regard to any expenditure incurred by the licensee:

(a) in developing the design, or

(b) in making payments to the design right owner in consideration of the licence (other than royalties or other payments determined by reference to the use of the design).

(6) In this section “the court” means:

(a) in England and Wales, the High [F692Court,]

(b) in Scotland, the Court of Session, and

Chapter V.- Miscellaneous and General

[F693 Unjustified threats

253.- Threats of infringement proceedings

(1) A communication contains a “threat of infringement proceedings” if a reasonable person in the position of a recipient would understand from the communication that:

(a) design right subsists in a design, and

(b) a person intends to bring proceedings (whether in a court in the United Kingdom or elsewhere) against another person for infringement of the design right by:

(i) an act done in the United Kingdom, or

(ii) an act which, if done, would be done in the United Kingdom.

(2) References in this section and in section 253C to a “recipient” include, in the case of a communication directed to the public or a section of the public, references to a person to whom the communication is directed.

253A.- Actionable threats

(1) Subject to subsections (2) to (5), a threat of infringement proceedings made by any person is actionable by any person aggrieved by the threat.

(2) A threat of infringement proceedings is not actionable if the infringement is alleged to consist of:

(a)making an article for disposal, or

(b)importing an article for disposal.

(3) A threat of infringement proceedings is not actionable if the infringement is alleged to consist of an act which, if done, would constitute an infringement of a kind mentioned in subsection (2)(a) or (b).

(4) A threat of infringement proceedings is not actionable if the threat:

(a) is made to a person who has done, or intends to do, an act mentioned in subsection (2)(a) or (b) in relation to an article, and

(b )is a threat of proceedings for an infringement alleged to consist of doing anything else in relation to that article.

(5) A threat of infringement proceedings which is not an express threat is not actionable if it is contained in a permitted communication.

(6) In sections 253C and 253D an “actionable threat” means a threat of infringement proceedings that is actionable in accordance with this section.

253B.- Permitted communications

(1) For the purposes of section 253A(5), a communication containing a threat of infringement proceedings is a “permitted communication” if:

(a) the communication, so far as it contains information that relates to the threat, is made for a permitted purpose;

(b) all of the information that relates to the threat is information that:

(i) is necessary for that purpose (see subsection (5)(a) to (c) for some examples of necessary information), and

(ii) the person making the communication reasonably believes is true.

(2) Each of the following is a “permitted purpose”:

(a) giving notice that design right subsists in a design;

(b) discovering whether, or by whom, design right in a design has been infringed by an act mentioned in section 253A(2)(a) or (b);

(c) giving notice that a person has a right in or under the design right in a design, where another person’s awareness of the right is relevant to any proceedings that may be brought in respect of the design right in the design.

(3) The court may, having regard to the nature of the purposes listed in subsection (2)(a) to (c), treat any other purpose as a “permitted purpose” if it considers that it is in the interests of justice to do so.

(4) But the following may not be treated as a “permitted purpose”:

(a) requesting a person to cease doing, for commercial purposes, anything in relation to an article made to a design,

(b) requesting a person to deliver up or destroy an article made to a design, or

(5) If any of the following information is included in a communication made for a permitted purpose, it is information that is “necessary for that purpose” (see subsection (1)(b)(i)):

(a) a statement that design right subsists in a design;

(b) details of the design, or of a right in or under the design right in the design, which:

(i) are accurate in all material respects, and

(ii) are not misleading in any material respect; and

(c) information enabling the identification of articles that are alleged to be infringing articles in relation to the design.

253C.- Remedies and defences

(1) Proceedings in respect of an actionable threat may be brought against the person who made the threat for:

(a) a declaration that the threat is unjustified;

(b) an injunction against the continuance of the threat;

(2) It is a defence for the person who made the threat to show that the act in respect of which proceedings were threatened constitutes (or if done would constitute) an infringement of design right.

(3) It is a defence for the person who made the threat to show:

(a) that, despite having taken reasonable steps, the person has not identified anyone who has done an act mentioned in section 253A(2)(a) or (b) in relation to the article which is the subject of the threat, and

(b) that the person notified the recipient, before or at the time of making the threat, of the steps taken.

253D.- Professional advisers

(1) Proceedings in respect of an actionable threat may not be brought against a professional adviser (or any person vicariously liable for the actions of that professional adviser) if the conditions in subsection (3) are met.

(2) In this section “professional adviser” means a person who, in relation to the making of the communication containing the threat:

(a) is acting in a professional capacity in providing legal services or the services of a trade mark attorney or a patent attorney, and

(b) is regulated in the provision of legal services, or the services of a trade mark attorney or a patent attorney, by one or more regulatory bodies (whether through membership of a regulatory body, the issue of a licence to practise or any other means).

(3) The conditions are that:

(a) in making the communication the professional adviser is acting on the instructions of another person, and

(b) when the communication is made the professional adviser identifies the person on whose instructions the adviser is acting.

(4) This section does not affect any liability of the person on whose instructions the professional adviser is acting.

(5) It is for a person asserting that subsection (1) applies to prove (if required) that at the material time:

(a) the person concerned was acting as a professional adviser, and

(b) the conditions in subsection (3) were met.

253E.- Supplementary: proceedings for delivery up etc.

In section 253(1)(b) the reference to proceedings for infringement of design right includes a reference to:

(a) proceedings for an order under section 230 (order for delivery up), and

(b) proceedings for an order under section 231 (order as to disposal of infringing articles).][F694 Licensee under licence of right not to claim connection with design right owner]

254.- Licensee under licence of right not to claim connection with design right owner.

(1) A person who has a licence in respect of a design by virtue of section 237 or 238 (licences of right) shall not, without the consent of the design right owner:

(a) apply to goods which he is marketing, or proposes to market, in reliance on that licence a trade description indicating that he is the licensee of the design right owner, or

(b) use any such trade description in an advertisement in relation to such goods.

(2) A contravention of subsection (1) is actionable by the design right owner.

(3) In this section “trade description”, the reference to applying a trade description to goods and “advertisement” have the same meaning as in the M31Trade Descriptions Act 1968.

Extent of operation of this Part

255.- Countries to which this Part extends.

(1) This Part extends to England and Wales, Scotland and Northern Ireland.

(2) Her Majesty may by Order in Council direct that this Part shall extend, subject to such exceptions and modifications as may be specified in the Order, to:

(a) any of the Channel Islands,

(b) the Isle of Man, or

(3) That power includes power to extend, subject to such exceptions and modifications as may be specified in the Order, any Order in Council made under section 221 (further provision as to qualification for design right protection) or section 256 (countries enjoying reciprocal protection).

(5) Where a country to which this Part extends ceases to be a colony of the United Kingdom, it shall continue to be treated as such a country for the purposes of this Part until:

(a) an Order in Council is made under section 256 designating it as a country enjoying reciprocal protection, or

(b) an Order in Council is made declaring that it shall cease to be so treated by reason of the fact that the provisions of this Part as part of the law of that country have been amended or repealed.

(6) A statutory instrument containing an Order in Council under subsection (5)(b) shall be subject to annulment in pursuance of a resolution of either House of Parliament.

256.- Countries enjoying reciprocal protection.

(1) Her Majesty may, if it appears to Her that the law of a country provides adequate protection for British designs, by Order in Council designate that country as one enjoying reciprocal protection under this Part.

(2) If the law of a country provides adequate protection only for certain classes of British design, or only for designs applied to certain classes of article, any Order designating that country shall contain provision limiting, to a corresponding extent, the protection afforded by this Part in relation to designs connected with that country.

(3) An Order under this section shall be subject to annulment in pursuance of a resolution of either House of Parliament.

257.- Territorial waters and the continental shelf.

(1) For the purposes of this Part the territorial waters of the United Kingdom shall be treated as part of the United Kingdom.

(3) The United Kingdom sector of the continental shelf means the areas designated by order under section 1(7) of the M32Continental Shelf Act 1964.

Interpretation

258.- Construction of references to design right owner.

(1) Where different persons are (whether in consequence of a partial assignment or otherwise) entitled to different aspects of design right in a work, the design right owner for any purpose of this Part is the person who is entitled to the right in the respect relevant for that purpose.

(2) Where design right (or any aspect of design right) is owned by more than one person jointly, references in this Part to the design right owner are to all the owners, so that, in particular, any requirement of the licence of the design right owner requires the licence of all of them.

259.- Joint designs.

(1) In this Part a “joint design” means a design produced by the collaboration of two or more designers in which the contribution of each is not distinct from that of the other or others.

(2) References in this Part to the designer of a design shall, except as otherwise provided, be construed in relation to a joint design as references to all the designers of the design.

260.- Application of provisions to articles in kit form.

(1) The provisions of this Part apply in relation to a kit, that is, a complete or substantially complete set of components intended to be assembled into an article, as they apply in relation to the assembled article.

(2) Subsection (1) does not affect the question whether design right subsists in any aspect of the design of the components of a kit as opposed to the design of the assembled article.

261.- Requirement of signature: application in relation to body corporate.

The requirement in the following provisions that an instrument be signed by or on behalf of a person is also satisfied in the case of a body corporate by the affixing of its seal:

section 222(3) (assignment of design right),

section 223(1) (assignment of future design right),

section 225(1) (grant of exclusive licence).

262.- Adaptation of expressions in relation to Scotland.

In the application of this Part to Scotland:

“account of profits” means accounting and payment of profits;

“accounts” means count, reckoning and payment;

“assignment” means assignation;

“costs” means expenses;

[F695 “declaration” means “declarator”;]

“defendant” means defender;

“delivery up” means delivery;

“injunction” means interdict;

“interlocutory relief” means interim remedy; and

“plaintiff” means pursuer.

263.- Minor definitions.

(1)In this Part:

“British design” means a design which qualifies for design right protection by reason of a connection with the United Kingdom of the designer or the person by whom F696… the designer is employed;

“business” includes a trade or profession;

F697…

“the comptroller” means the Comptroller-General of Patents, Designs and Trade Marks;

“computer-generated”, in relation to a design, means that the design is generated by computer in circumstances such that there is no human designer,

“country” includes any territory;

“the Crown” includes the Crown in right of Her Majesty’s Government in Northern Ireland [F698and the Crown in right of the Scottish Administration][F699and the Crown in right of the Welsh Assembly Government];

“design document” means any record of a design, whether in the form of a drawing, a written description, a photograph, data stored in a computer or otherwise;

“employee”, “employment” and “employer” refer to employment under a contract of service or of apprenticeship;

“government department” includes a Northern Ireland department [F700and any part of the Scottish Administration][F701and any part of the Welsh Assembly Government].

(2) References in this Part to “marketing”, in relation to an article, are to its being sold or let for hire, or offered or exposed for sale or hire, in the course of a business, and related expressions shall be construed accordingly; but no account shall be taken for the purposes of this Part of marketing which is merely colourable and not intended to satisfy the reasonable requirements of the public.

(3) References in this Part to an act being done in relation to an article for “commercial purposes” are to its being done with a view to the article in question being sold or hired in the course of a business.

264.- Index of defined expressions.

The following Table shows provisions defining or otherwise explaining expressions used in this Part (other than provisions defining or explaining an expression used only in the same section):

account of profits and accounts (in Scotland) section 262

assignment (in Scotland) section 262

British designs section 263(1)

business section 263(1)

commercial purposes section 263(3)

F702. . . F702. . .

the comptroller section 263(1)

computer-generated section 263(1)

costs (in Scotland) section 262

country section 263(1)

the Crown section 263(1)

Crown use sections 240(5) and 244(2)

defendant (in Scotland) section 262

delivery up (in Scotland) section 262

design section 213(2)

design document section 263(1)

designer sections 214 and 259(2)

design right section 213(1)

design right owner sections 234(2) and 258

employee, employment and employer section 263(1)

exclusive licence section 225(1)

government department section 263(1)

government department concerned (in relation to Crown use) section 240(5)

infringing article section 228

injunction (in Scotland) section 262

interlocutory relief (in Scotland) section 262

joint design section 259(1)

licence (of the design right owner) sections 222(4), 223(3) and 258

making articles to a design section 226(2)

marketing (and related expressions) section 263(2)

original section 213(4)

plaintiff (in Scotland) section 262

F703. . . F703. . .

qualifying person sections 217(1) and (2)

signed section 261

Part IV.- Registered Designs

Amendments of the Registered Designs Act 1949

F704

265. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

266.- Provisions with respect to certain designs registered in pursuance of application made before commencement.

(1) Where a design is registered under the Registered Designs Act 1949 in pursuance of an application made after 12th January 1988 and before the commencement of this part which could not have been registered under section 1 of that Act as substituted by section 265 above:

(a) the right in the registered design expires ten years after the commencement of this part, if it does not expire earlier in accordance with the 1949 Act, and

(b) any person is, after the commencement of this Part, entitled as of right to a licence to do anything which would otherwise infringe the right in the registered design.

(2) The terms of a licence available by virtue of this section shall, in default of agreement, be settled by the registrar on an application by the person requiring the licence; and the terms so settled shall authorise the licensee to do everything which would be an infringement of the right in the registered design in the absence of a licence.

(3) In settling the terms of a licence the registrar shall have regard to such factors as may be prescribed by the Secretary of State by order made by statutory instrument.No such order shall be made unless a draft of it has been laid before and approved by a resolution of each House of Parliament.

(4) Where the terms of a licence are settled by the registrar, the licence has effect from the date on which the application to the registrar was made.

(5) Section 11B of the 1949 Act (undertaking to take licence of right in infringement proceedings), as inserted by section 270 below, applies where a licence is available as of right under this section, as it applies where a licence is available as of right under section 11A of that Act.

(6) Where a licence is available as of right under this section, a person to whom a licence was granted before the commencement of this part may apply to the registrar for an order adjusting the terms of that licence.

(7) an appeal lies from any decision of the registrar under this section.

(8) This section shall be construed as one with the Registered Designs Act 1949.

267.- Authorship and first ownership of designs.

(1) Section 2 of the Registered Designs Act 1949 (proprietorship of designs) is amended as follows.

(2) For subsection (1) substitute:

“(1) The author of a design shall be treated for the purposes of this Act as the original proprietor of the design, subject to the following provisions.

(1A) Where a design is created in pursuance of a commission for money or money’s worth, the person commissioning the design shall be treated as the original proprietor of the design.

(1B) Where, in a case not falling within subsection (1A), a design is created by an employee in the course of his employment, his employer shall be treated as the original proprietor of the design.”.

(3) After subsection (2) insert:

“(3) In this Act the “author” of a design means the person who creates it.

(4) In the case of a design generated by computer in circumstances such that there is no human author, the person by whom the arrangements necessary for the creation of thee design are made shall be taken to be the author.”.

(4) The amendments made by this section do not apply in relation to an application for registration made before the commencement of this Part.

F705

268.- . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

269.- Duration of right in registered design.

(1) For section 8 of the M33Registered Designs Act 1949 (period of right) substitute:

“8 Duration of right in registered design.

(1) The right in a registered design subsists in the first instance for a period of five years from the date of the registration of the design.

(2) The period for which the right subsists may be extended for a second, third, fourth and fifth period of five years, by applying to the registrar for an extension and paying the prescribed renewal fee.

(3) If the first, second, third or fourth period expires without such application and payment being made, the right shall cease to have effect; and the registrar shall, in accordance with rules made by the Secretary of State, notify the proprietor of that fact.

(4) If during the period of six months immediately following the end of that period an application for extension is made and the prescribed renewal fee and any prescribed additional fee is paid, the right shall be treated as if it had never expired, with the result that:

(a) anything done under or in relation to the right during that further period shall be treated as valid,

(b) an act which would have constituted an infringement of the right if it had not expired shall be treated as an infringement, and

(c) an act which would have constituted use of the design for the services of the Crown if the right had not expired shall be treated as such use.

(5) Where it is shown that a registered design:

(a) was at the time it was registered a corresponding design in relation to an artistic work in which copyright subsists, and

(b) by reason of a previous use of that work would not have been registrable but for section 6(4) of this Act (registration despite certain prior applications of design),the right in the registered design expires when the copyright in that work expires, if that is earlier than the time at which it would otherwise expire, and it may not thereafter be renewed.

(6) The above provisions have effect subject to the proviso to section 4(1) (registration of same design in respect of other articles, &c.).

8A Restoration of lapsed right in design.

(1) Where the right in a registered design has expired by reason of a failure to extend, in accordance with section 8(2) or (4), the period for which the right subsists, an application for the restoration of the right in the design may be made to the registrar within the prescribed period.

(2) The application may be made by the person who was the registered proprietor of the design or by any other person who would have been entitled to the right in the design if it had not expired; and where the design was held by two or more persons jointly, the application may, with the leave of the registrar, be made by one or more of them without joining the others.

(3) Notice of the application shall be published by the registrar in the prescribed manner.

(4) If the registrar is satisfied that the proprietor took reasonable care to see that the period for which the right subsisted was extended in accordance with section 8(2) or (4), he shall, on payment of any unpaid renewal fee and any prescribed additional fee, order the restoration of the right in the design.

(5) The order may be made subject to such conditions as the registrar thinks fit, and if the proprietor of the design does not comply with any condition the registrar may revoke the order and give such consequential directions as he thinks fit.

(6) Rules altering the period prescribed for the purposes of subsection (1) may contain such transitional provisions and savings as appear to the Secretary of State to be necessary or expedient.

8B Effect of order for restoration of right.

(1) The effect of an order under section 8A for the restoration of the right in a registered design is as follows.

(2) Anything done under or in relation to the right during the period between expiry and restoration shall be treated as valid.

(3) Anything done during that period which would have constituted an infringement if the right had not expired shall be treated as an infringement:

(a) if done at a time when it was possible for an application for extension to be made under section 8(4); or

(b) if it was a continuation or repetition of an earlier infringing act.

(4) If, after it was no longer possible for such an application for extension to be made and before publication of notice of the application for restoration, a person:

(a) began in good faith to do an act which would have constituted an infringement of the right in the design if it had not expired, or

(b) made in good faith effective and serious preparations to do such an act,he has the right to continue to do the act or, as the case may be, to do the act, notwithstanding the restoration of the right in the design; but this does not extend to granting a licence to another person to do the act.

(5) If the act was done, or the preparations were made, in the course of a business, the person entitled to the right conferred by subsection (4) may:

(a) authorise the doing of that act by any partners of his for the time being in that business, and

(b) assign that right, or transmit it on death (or in the case of a body corporate on its dissolution), to any person who acquires that part of the business in the course of which the act was done or the preparations were made.

(6) Where an article is disposed of to another in exercise of the rights conferred by subsection (4) or subsection (5), that other and any person claiming through him may deal with the article in the same way as if it had been disposed of by the registered proprietor of the design.

(7) The above provisions apply in relation to the use of a registered design for the services of the Crown as they apply in relation to infringement of the right in the design.”.

(2) The above amendment does not apply in relation to the right in a design registered in pursuance of an application made before the commencement of this Part.

270.- Powers exercisable for protection of the public interest.

In the M34Registered Designs Act 1949 after section 11 insert:

“11A Powers exercisable for protection of the public interest.

(1) Where a report of the Monopolies and Mergers Commission has been laid before Parliament containing conclusions to the effect:

(a) on a monopoly reference, that a monopoly situation exists and facts found by the Commission operate or may be expected to operate against the public interest,

(b) on a merger reference, that a merger situation qualifying for investigation has been created and the creation of the situation, or particular elements in or consequences of it specified in the report, operate or may be expected to operate against the public interest,

(c) on a competition reference, that a person was engaged in an anti-competitive practice which operated or may be expected to operate against the public interest, or

(d) on a reference under section 11 of the Competition Act 1980 (reference of public bodies and certain other persons), that a person is pursuing a course of conduct which operates against the public interest,the appropriate Minister or Ministers may apply to the registrar to take action under this section.

(2) Before making an application the appropriate Minister or Ministers shall publish, in such a manner as he or they think appropriate, a notice describing the nature of the proposed application and shall consider any representations which may be made within 30 days of such publication by persons whose interests appear to him or them to be affected.

(3) If on an application under this section it appears to the registrar that the matters specified in the Commission’s report as being those which in the Commission’s opinion operate or operated or may be expected to operate against the public interest include:

(a) conditions in licences granted in respect of a registered design by its proprietor restricting the use of the design by the licensee or the right of the proprietor to grant other licences, or

(b) a refusal by the proprietor of a registered design to grant licences on reasonable terms,he may by order cancel or modify any such condition or may, instead or in addition, make an entry in the register to the effect that licences in respect of the design are to be available as of right.

(4) The terms of a licence available by virtue of this section shall, in default of agreement, be settled by the registrar on an application by the person requiring the licence; and terms so settled shall authorise the licensee to do everything which would be an infringement of the right in the registered design in the absence of a licence.

(5) Where the terms of a licence are settled by the registrar the licence has effect from the date on which the application to him was made.

(6) An appeal lies from any order of the registrar under this section.

(7) In this section “the appropriate Minister or Ministers” means the Minister or Ministers to whom the report of the Monopolies and Mergers Commission was made.

11B Undertaking to take licence of right in infringement proceedings.

(1) If in proceedings for infringement of the right in a registered design in respect of which a licence is available as of right under section 11A of this Act the defendant undertakes to take a licence on such terms as may be agreed or, in default of agreement, settled by the registrar under that section:

(a) no injunction shall be granted against him, and

(b) the amount recoverable against him by way of damages or on an account of profits shall not exceed double the amount which would have been payable by him as licensee if such a licence on those terms had been granted before the earliest infringement.

(2) An undertaking may be given at any time before final order in the proceedings, without any admission of liability.

(3) Nothing in this section affects the remedies available in respect of an infringement committed before licences of right were available.”.

271.- Crown use: compensation for loss of profit.

(1)In Schedule 1 to the M35Registered Designs Act 1949 (Crown use), after paragraph 2 insert:

“Compensation for loss of profit.

(1) Where Crown use is made of a registered design, the government department concerned shall pay:

(a) to the registered proprietor, or

(3) In determining the loss, regard shall be had to the profit which would have been made on such a contract and to the extent to which any manufacturing capacity was underused.

(4) No compensation is payable in respect of any failure to secure contracts for the supply of articles to which the design is applied otherwise than for the services of the Crown.

(5) The amount payable under this paragraph shall, if not agreed between the registered proprietor or licensee and the government department concerned with the approval of the Treasury, be determined by the court on a reference under paragraph 3; and it is in addition to any amount payable under paragraph 1 or 2 of this Schedule.

(6) In this paragraph:

“Crown use”, in relation to a design, means the doing of anything by virtue of paragraph 1 which would otherwise be an infringement of the right in the design; and

“the government department concerned”, in relation to such use, means the government department by whom or on whose authority the act was done.”.

(2) In paragraph 3 of that Schedule (reference of disputes as to Crown use), for sub-paragraph (1) substitute:

“(1) Any dispute as to:

(a) the exercise by a Government department, or a person authorised by a Government department, of the powers conferred by paragraph 1 of this Schedule,

(b) terms for the use of a design for the services of the Crown under that paragraph,

(c)the right of any person to receive any part of a payment made under paragraph 1(3), or

(d) the right of any person to receive a payment under paragraph 2A,may be referred to the court by either party to the dispute.”.

(3) The above amendments apply in relation to any Crown use of a registered design after the commencement of this section, even if the terms for such use were settled before commencement.

272.- Minor and consequential amendments.

The M36 Registered Designs Act 1949 is further amended in accordance with Schedule 3 which contains minor amendments and amendments consequential upon the provisions of this Act.

Supplementary

273.- Text of Registered Designs Act 1949 as amended.

Schedule 4 contains the text of the Registered Designs Act 1949 as amended.

Part V.- Patent Agents and Trade Mark Agents

Patent agents

274.- Persons permitted to carry on business of a patent agent.

(1) Any individual, partnership or body corporate may, subject to the following provisions of this Part [F706and to the Legal Services Act 2007] , carry on the business of acting as agent for others for the purpose of:

(a) applying for or obtaining patents, in the United Kingdom or elsewhere, or

(b) conducting proceedings before the comptroller relating to applications for, or otherwise in connection with, patents.

(2) This does not affect any restriction under the European Patent Convention as to who may act on behalf of another for any purpose relating to European patents.

[F707 275 The register of patent attorneys

(1) There is to continue to be a register of persons who act as agent for others for the purpose of applying for or obtaining patents.

(2) In this Part a registered patent attorney means an individual whose name is entered on the register kept under this section.

(3) The register is to be kept by the Chartered Institute of Patent Attorneys.

(4) The Secretary of State may, by order, amend subsection (3) so as to require the register to be kept by the person specified in the order.

(5) Before making an order under subsection (4), the Secretary of State must consult the Legal Services Board.

(6) An order under this section must be made by statutory instrument.

(7) An order under this section may not be made unless a draft of it has been laid before, and approved by a resolution of, each House of Parliament.][F708

275A.- Regulation of patent attorneys

(1) The person who keeps the register under section 275 may make regulations which regulate:

(a) the keeping of the register and the registration of persons;

(b) the carrying on of patent attorney work by registered persons.

(2) Those regulations may, amongst other things, make:

(a) provision as to the educational and training qualifications, and other requirements, which must be satisfied before an individual may be registered or for an individual to remain registered;

(b) provision as to the requirements which must be met by a body (corporate or unincorporate) before it may be registered, or for it to remain registered, including provision as to the management and control of the body;

(d) provision regulating the practice, conduct and discipline of registered persons or regulated persons;

(e) provision authorising in such cases as may be specified in the regulations the erasure from the register of the name of any person registered in it, or the suspension of a person’s registration;

(f) provision requiring the payment of such fees as may be specified in or determined in accordance with the regulations;

(g) provision about the provision to be made by registered persons in respect of complaints made against them;

(h) provision about the keeping by registered persons or regulated persons of records and accounts;

(i) provision for reviews of or appeals against decisions made under the regulations;

(j) provision as to the indemnification of registered persons or regulated persons against losses arising from claims in respect of civil liability incurred by them.

(3) Regulations under this section may make different provision for different purposes.

(4) Regulations under this section which are not regulatory arrangements within the meaning of the Legal Services Act 2007 are to be treated as such arrangements for the purposes of that Act.

(5) Before the appointed day, regulations under this section may be made only with the approval of the Secretary of State.

(6) The powers conferred to make regulations under this section are not to be taken to prejudice:

(a) any other power which the person who keeps the register may have to make rules or regulations (however they may be described and whether they are made under an enactment or otherwise);

(b) any rules or regulations made by that person under any such power.

(7) In this section:

“appointed day” means the day appointed for the coming into force of paragraph 1 of Schedule 4 to the Legal Services Act 2007;

“manager”, in relation to a body, has the same meaning as in the Legal Services Act 2007 (see section 207);

“patent attorney work” means work done in the course of carrying on the business of acting as agent for others for the purpose of:

(a) applying for or obtaining patents, in the United Kingdom or elsewhere, or

(b) conducting proceedings before the comptroller relating to applications for, or otherwise in connection with, patents;

“registered person” means:

(a) a registered patent attorney, or

(b) a body (corporate or unincorporate) registered in the register kept under section 275;

“regulated person” means a person who is not a registered person but is a manager or employee of a body which is a registered person.]

276.- Persons entitled to describe themselves as patent agents.

(1) An individual who is not a [F709registered patent attorney] shall not:

(a) carry on a business (otherwise than in partnership) under any name or other description which contains the words “patent agent” or “patent attorney”; or

(b) in the course of a business otherwise describe himself, or permit himself to be described, as a “patent agent” or “patent attorney”.

(2) A partnership [F710or other unincorporated body] shall not:

(a) carry on a business under any name or other description which contains the words “patent agent” or “patent attorney”; or

(b) in the course of a business otherwise describe itself, or permit itself to be described as, a firm of “patent agents” or “patent attorneys”,unless [F711the partnership or other body is registered in the register kept under section 275].

(3) A body corporate shall not:

(a) carry on a business (otherwise than in partnership) under any name or other description which contains the words “patent agent” or “patent attorney”; or

(b) in the course of a business otherwise describe itself, or permit itself to be described as, a “patent agent” or “patent attorney”,unless [F712the body corporate is registered in the register kept under section 275.]

(4) Subsection (3) does not apply to a company which began to carry on business as a patent agent before 17th November 1917 if the name of a director or the manager of the company who is a registered patent [F713attorney] is mentioned as being so registered in all professional advertisements, circulars or letters issued by or with the company’s consent on which its name appears.

(5) Where this section would be contravened by the use of the words “patent agent” or “patent attorney” in reference to an individual, partnership or body corporate, it is equally contravened by the use of other expressions in reference to that person, or his business or place of business, which are likely to be understood as indicating that he is entitled to be described as a “patent agent” or “patent attorney”.

(6) A person who contravenes this section commits an offence and is liable on summary conviction to a fine not exceeding level 5 on the standard scale; and proceedings for such an offence may be begun at any time within a year from the date of the offence.

(7) This section has effect subject to:

(a) section 277 (persons entitled to describe themselves as European patent attorneys, &c.), and

(b) section 278(1) (use of term “patent attorney” in reference to solicitors).

277.- Persons entitled to describe themselves as European patent attorneys, &c.

(1) The term “European patent attorney” or “European patent agent” may be used in the following cases without any contravention of section 276.

(2) An individual who is on the European list may:

(a) carry on business under a name or other description which contains the words “European patent attorney” or “European patent agent”, or

(b) otherwise describe himself, or permit himself to be described, as a “European patent attorney” or “European patent agent”.

(3) A partnership of which not less than the prescribed number or proportion of partners is on the European list may:

(a) carry on a business under a name or other description which contains the words “European patent attorneys” or “European patent agents”, or

(b) otherwise describe itself, or permit itself to be described, as a firm which carries on the business of a “European patent attorney” or “European patent agent”.

(4) A body corporate of which not less than the prescribed number or proportion of directors is on the European list may:

(a) carry on a business under a name or other description which contains the words “European patent attorney” or “European patent agent”, or

(b) otherwise describe itself, or permit itself to be described as, a company which carries on the business of a “European patent attorney” or “European patent agent”.

(5) Where the term “European patent attorney” or “European patent agent” may, in accordance with this section, be used in reference to an individual, partnership or body corporate, it is equally permissible to use other expressions in reference to that person, or to his business or place of business, which are likely to be understood as indicating that he is entitled to be described as a “European patent attorney” or “European patent agent.”

278.- Use of the term “patent attorney”: supplementary provisions.

(1) The term “patent attorney” may be used in reference to a solicitor, and a firm of solicitors may be described as a firm of “patent attorneys”, without any contravention of section 276.

(2) No offence is committed under the enactments restricting the use of certain expressions in reference to persons not qualified to act as solicitors:

(a) by the use of the term “patent attorney” in reference to a registered patent agent, or

(b) by the use of the term “European patent attorney” in reference to a person on the European list.

(3) The enactments referred to in subsection (2) are section 21 of the M37Solicitors Act 1974, section 31 of the M38Solicitors (Scotland) Act 1980 and Article 22 of the M39Solicitors (Northern Ireland) Order 1976.

279.- Power to prescribe conditions, &c. for mixed partnerships and bodies corporate.

F714. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

280.- Privilege for communications with patent agents.

(1) This section applies to communications as to any matter relating to the protection of any invention, design, technical information, [F715or trade mark], or as to

[F716(a)] any matter involving passing off [F717, and

(b) documents, material or information relating to any matter mentioned in paragraph (a).][F718(2) Where a patent attorney acts for a client in relation to a matter mentioned in subsection (1), any communication, document, material or information to which this section applies is privileged from disclosure in like manner as if the patent attorney had at all material times been acting as the client’s solicitor.]

(3) In subsection (2) “patent [F719attorney]” means:

(a) a registered patent [F719attorney] or a person who is on the European list,

(b) a partnership entitled to describe itself as a firm of patent [F720attorneys] or as a firm carrying on the business of a European patent attorney, F721. . .

[F722

(ba) an unincorporated body (other than a partnership) entitled to describe itself as a patent attorney, or]

(c) a body corporate entitled to describe itself as a patent [F719attorney] or as a company carrying on the business of a European patent attorney.

(4)F723. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

281.- Power of comptroller to refuse to deal with certain agents.

(1) This section applies to business under the M40Patents Act 1949, the M41Registered Designs Act 1949 or the M42Patents Act 1977.

(2) The Secretary of State may make rules authorising the comptroller to refuse to recognise as agent in respect of any business to which this section applies:

(a) a person who has been convicted of an offence under section 88 of the Patents Act 1949, section 114 of the Patents Act 1977 or section 276 of this Act;

(b)

[F724 a person] whose name has been erased from and not restored to, or who is suspended from, the register of patent [F725attorneys] on the ground of misconduct;

(c) a person who is found by the Secretary of State to have been guilty of such conduct as would, in the case of [F726 a person] registered in the register of patent [F725attorneys], render [F727the person] liable to have [F728the person’s] name erased from the register on the ground of misconduct;

(d) a partnership or body corporate of which one of the partners or directors is a person whom the comptroller could refuse to recognise under paragraph (a), (b) or (c) above.

(3) The rules may contain such incidental and supplementary provisions as appear to the Secretary of State to be appropriate and may, in particular, prescribe circumstances in which a person is or is not to be taken to have been guilty of misconduct.

(4) Rules made under this section shall be made by statutory instrument which shall be subject to annulment in pursuance of a resolution of either House of Parliament.

(5) The comptroller shall refuse to recognise as agent in respect of any business to which this section applies a person who neither resides nor has a place of business in the United Kingdom, the Isle of Man or another member State of the [F729European Union].

Trade mark agents

F730

282. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F731

283. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F732

284. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Supplementary

285.- Offences committed by partnerships and bodies corporate.

(1) Proceedings for an offence under this Part alleged to have been committed by a partnership shall be brought in the name of the partnership and not in that of the partners; but without prejudice to any liability of theirs under subsection (4) below.

(2) The following provisions apply for the purposes of such proceedings as in relation to a body corporate:

(a) any rules of court relating to the service of documents;

(b) in England, Wales or Northern Ireland, Schedule 3 to the M43Magistrates’ Courts Act 1980 or Schedule 4 to the M44Magistrates’ Courts (Northern Ireland) Order 1981 (procedure on charge of offence).

(3) A fine imposed on a partnership on its conviction in such proceedings shall be paid out of the partnership assets.

(4) Where a partnership is guilty of an offence under this Part, every partner, other than a partner who is proved to have been ignorant of or to have attempted to prevent the commission of the offence, is also guilty of the offence and liable to be proceeded against and punished accordingly.

(5) Where an offence under this Part committed by a body corporate is proved to have been committed with the consent or connivance of a director, manager, secretary or other similar officer of the body, or a person purporting to act in any such capacity, he as well as the body corporate is guilty of the offence and liable to be proceeded against and punished accordingly.

286.- Interpretation.

In this Part:

“the comptroller” means the Comptroller-General of Patents, Designs and Trade Marks;

“director”, in relation to a body corporate whose affairs are managed by its members, means any member of the body corporate;

“the European list” means the list of professional representatives maintained by the European Patent Office in pursuance of the European Patent Convention;

“registered patent [F733attorney”] has the meaning given by section 275 [F734(2)];

F735. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Part VI.- Patents

Patents county courts

F736

287.- Patents county courts: special jurisdiction.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F736

288.- Financial limits in relation to proceedings within special jurisdiction of patents county court.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F736

289.- Transfer of proceedings between High Court and patents county court.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[F737

290.- Limitation of costs where pecuniary claim could have been brought in patents county court.

(1) Where an action is commenced in the High Court which could have been commenced in a patents county court and in which a claim for a pecuniary remedy is made, then, subject to the provisions of this section, if the plaintiff recovers less than the prescribed amount, he is not entitled to recover any more costs than those to which he would have been entitled if the action had been brought in the county court.

(2) For this purpose a plaintiff shall be treated as recovering the full amount recoverable in respect of his claim without regard to any deduction made in respect of matters not falling to be taken into account in determining whether the action could have been commenced in a patents county court.

(3) This section does not affect any question as to costs if it appears to the High Court that there was reasonable ground for supposing the amount recoverable in respect of the plaintiff’s claim to be in excess of the prescribed amount.

(4) The High Court, if satisfied that there was sufficient reason for bringing the action in the High Court, may make an order allowing the costs or any part of the costs on the High Court scale or on such one of the county court scales as it may direct.

(5) This section does not apply to proceedings brought by the Crown.

(6) In this section “the prescribed amount” means such amount as may be prescribed by Her Majesty for the purposes of this section by Order in Council.

(7) No recommendation shall be made to Her Majesty to make an Order under this section unless a draft of the Order has been laid before and approved by a resolution of each House of Parliament.]

F738

291.- Proceedings in patents county court.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

292.- Rights and duties of registered patent agents in relation to proceedings in patents county court.

F739. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Licences of right in respect of certain patents

293.- Restriction of acts authorised by certain licences.

In paragraph 4(2)(c) of Schedule 1 to the M45Patents Act 1977 (licences to be available as of right where term of existing patent extended), at the end insert “, but subject to paragraph 4A below”, and after that paragraph insert:

“4A

(1) If the proprietor of a patent for an invention which is a product files a declaration with the Patent Office in accordance with this paragraph, the licences to which persons are entitled by virtue of paragraph 4(2)(c) above shall not extend to a use of the product which is excepted by or under this paragraph.

(2) Pharmaceutical use is excepted, that is:

(a) use as a medicinal product within the meaning of the Medicines Act 1968, and

(b) the doing of any other act mentioned in section 60(1)(a) above with a view to such use.

(3) The Secretary of State may by order except such other uses as he thinks fit; and an order may:

(a) specify as an excepted use any act mentioned in section 60(1)(a) above, and

(b) make different provision with respect to acts done in different circumstances or for different purposes.

(4) For the purposes of this paragraph the question what uses are excepted, so far as that depends on:

(a) orders under section 130 of the Medicines Act 1968 (meaning of “medicinal product”), or

(b) orders under sub-paragraph (3) above,shall be determined in relation to a patent at the beginning of the sixteenth year of the patent.

(5) A declaration under this paragraph shall be in the prescribed form and shall be filed in the prescribed manner and within the prescribed time limits.

(6) A declaration may not be filed:

(a) in respect of a patent which has at the commencement of section 293 of the Copyright, Designs and Patents Act 1988 passed the end of its fifteenth year; or

(b) if at the date of filing there is:

(i) an existing licence for any description of excepted use of the product, or

(ii) an outstanding application under section 46(3)(a) or (b) above for the settlement by the comptroller of the terms of a licence for any description of excepted use of the product,and, in either case, the licence took or is to take effect at or after the end of the sixteenth year of the patent.

(7) Where a declaration has been filed under this paragraph in respect of a patent:

(a) section 46(3)(c) above (restriction of remedies for infringement where licences available as of right) does not apply to an infringement of the patent in so far as it consists of the excepted use of the product after the filing of the declaration; and

(b) section 46(3)(d) above (abatement of renewal fee if licences available as of right) does not apply to the patent.”.

294.- When application may be made for settlement of terms of licence.

In Schedule 1 to the M46Patents Act 1977, after the paragraph inserted by section 293 above, insert:

“4B

(1) An application under section 46(3)(a) or (b) above for the settlement by the comptroller of the terms on which a person is entitled to a licence by virtue of paragraph 4(2)(c) above is ineffective if made before the beginning of the sixteenth year of the patent.

(2) This paragraph applies to applications made after the commencement of section 294 of the Copyright, Designs and Patents Act 1988 and to any application made before the commencement of that section in respect of a patent which has not at the commencement of that section passed the end of its fifteenth year.”.

Patents: miscellaneous amendments

295.- Patents: miscellaneous amendments.

The M47Patents Act 1949 and the M48Patents Act 1977 are amended in accordance with Schedule 5.

Part VII.- Miscellaneous and General

[F740 Circumvention of protection measures][F741

296.- Devices designed to circumvent copy-protection.

(1) This section applies where:

(a) a technical device has been applied to a computer program; and

(b) a person (A) knowing or having reason to believe that it will be used to make infringing copies:

(i) manufactures for sale or hire, imports, distributes, sells or lets for hire, offers or exposes for sale or hire, advertises for sale or hire or has in his possession for commercial purposes any means the sole intended purpose of which is to facilitate the unauthorised removal or circumvention of the technical device; or

(ii) publishes information intended to enable or assist persons to remove or circumvent the technical device.

(2) The following persons have the same rights against A as a copyright owner has in respect of an infringement of copyright:

(a) a person:

(i) issuing to the public copies of, or

(ii) communicating to the public,the computer program to which the technical device has been applied;

(b) the copyright owner or his exclusive licensee, if he is not the person specified in paragraph (a);

(c) the owner or exclusive licensee of any intellectual property right in the technical device applied to the computer program.

(3) The rights conferred by subsection (2) are concurrent, and sections 101(3) and 102(1) to (4) apply, in proceedings under this section, in relation to persons with concurrent rights as they apply, in proceedings mentioned in those provisions, in relation to a copyright owner and exclusive licensee with concurrent rights.

(4) Further, the persons in subsection (2) have the same rights under section 99 or 100 (delivery up or seizure of certain articles) in relation to any such means as is referred to in subsection (1) which a person has in his possession, custody or control with the intention that it should be used to facilitate the unauthorised removal or circumvention of any technical device which has been applied to a computer program, as a copyright owner has in relation to an infringing copy.

(5) The rights conferred by subsection (4) are concurrent, and section 102(5) shall apply, as respects anything done under section 99 or 100 by virtue of subsection (4), in relation to persons with concurrent rights as it applies, as respects anything done under section 99 or 100, in relation to a copyright owner and exclusive licensee with concurrent rights.

(6) In this section references to a technical device in relation to a computer program are to any device intended to prevent or restrict acts that are not authorised by the copyright owner of that computer program and are restricted by copyright.

(7) The following provisions apply in relation to proceedings under this section as in relation to proceedings under Part 1 (copyright):

(a) sections 104 to 106 of this Act (presumptions as to certain matters relating to copyright); and

(b) section 72 of the [F742Senior Courts Act 1981], section 15 of the Law Reform (Miscellaneous Provisions) (Scotland) Act 1985 and section 94A of the Judicature (Northern Ireland) Act 1978 (withdrawal of privilege against self-incrimination in certain proceedings relating to intellectual property);and section 114 of this Act applies, with the necessary modifications, in relation to the disposal of anything delivered up or seized by virtue of subsection (4).

(8) Expressions used in this section which are defined for the purposes of Part 1 of this Act (copyright) have the same meaning as in that Part.][F743

296ZA Circumvention of technological measures

(1) This section applies where:

(a) effective technological measures have been applied to a copyright work other than a computer program; and

(b) a person (B) does anything which circumvents those measures knowing, or with reasonable grounds to know, that he is pursuing that objective.

(2) This section does not apply where a person, for the purposes of research into cryptography, does anything which circumvents effective technological measures unless in so doing, or in issuing information derived from that research, he affects prejudicially the rights of the copyright owner.

(3) The following persons have the same rights against B as a copyright owner has in respect of an infringement of copyright:

(a) a person:

(i) issuing to the public copies of, or

(ii) communicating to the public,the work to which effective technological measures have been applied; and

(b) the copyright owner or his exclusive licensee, if he is not the person specified in paragraph (a).

(4) The rights conferred by subsection (3) are concurrent, and sections 101(3) and 102(1) to (4) apply, in proceedings under this section, in relation to persons with concurrent rights as they apply, in proceedings mentioned in those provisions, in relation to a copyright owner and exclusive licensee with concurrent rights.

(5) The following provisions apply in relation to proceedings under this section as in relation to proceedings under Part 1 (copyright):

(a) sections 104 to 106 of this Act (presumptions as to certain matters relating to copyright); and

(b) section 72 of the [F744Senior Courts Act 1981], section 15 of the Law Reform (Miscellaneous Provisions) (Scotland) Act 1985 and section 94A of the Judicature (Northern Ireland) Act 1978 (withdrawal of privilege against self-incrimination in certain proceedings relating to intellectual property).

(6) Subsections (1) to (4) and (5)(b) and any other provision of this Act as it has effect for the purposes of those subsections apply, with any necessary adaptations, to rights in performances, publication right and database right.

(7) The provisions of regulation 22 (presumptions relevant to database right) of the Copyright and Rights in Databases Regulations 1997 (SI 1997/3032) apply in proceedings brought by virtue of this section in relation to database right.

296ZB.- Devices and services designed to circumvent technological measures

(1) A person commits an offence if he:

(a) manufactures for sale or hire, or

(b) imports otherwise than for his private and domestic use, or

(i) sells or lets for hire, or

(ii) offers or exposes for sale or hire, or

(iii) advertises for sale or hire, or

(iv) possesses, or

(v) distributes, or

(d) distributes otherwise than in the course of a business to such an extent as to affect prejudicially the copyright owner,any device, product or component which is primarily designed, produced, or adapted for the purpose of enabling or facilitating the circumvention of effective technological measures.

(2) A person commits an offence if he provides, promotes, advertises or markets:

(a) in the course of a business, or

(b) otherwise than in the course of a business to such an extent as to affect prejudicially the copyright owner,a service the purpose of which is to enable or facilitate the circumvention of effective technological measures.

(3) Subsections (1) and (2) do not make unlawful anything done by, or on behalf of, law enforcement agencies or any of the intelligence services:

(a) in the interests of national security; or

(b) for the purpose of the prevention or detection of crime, the investigation of an offence, or the conduct of a prosecution, and in this subsection “ intelligence services ” has the meaning given in section 81 of the Regulation of Investigatory Powers Act 2000.

(4) A person guilty of an offence under subsection (1) or (2) is liable:

(a) on summary conviction, to imprisonment for a term not exceeding three months, or to a fine not exceeding the statutory maximum, or both;

(b) on conviction on indictment to a fine or imprisonment for a term not exceeding two years, or both.

(5) It is a defence to any prosecution for an offence under this section for the defendant to prove that he did not know, and had no reasonable ground for believing, that:

(a) the device, product or component; or

(b) the service,enabled or facilitated the circumvention of effective technological measures.

296ZC.- Devices and services designed to circumvent technological measures: search warrants and forfeiture

(1) The provisions of sections 297B (search warrants), 297C (forfeiture of unauthorised decoders: England and Wales or Northern Ireland) and 297D (forfeiture of unauthorised decoders: Scotland) apply to offences under section 296ZB with the following modifications.

(2) In section 297B the reference to an offence under section 297A(1) shall be construed as a reference to an offence under section 296ZB(1) or (2).

(3) In sections 297C(2)(a) and 297D(15) the references to an offence under section 297A(1) shall be construed as a reference to an offence under section 296ZB(1).

(4) In sections 297C and 297D references to unauthorised decoders shall be construed as references to devices, products or components for the purpose of circumventing effective technological measures.

296ZD.- Rights and remedies in respect of devices and services designed to circumvent technological measures

(1) This section applies where:

(a) effective technological measures have been applied to a copyright work other than a computer program; and

(b) a person (C) manufactures, imports, distributes, sells or lets for hire, offers or exposes for sale or hire, advertises for sale or hire, or has in his possession for commercial purposes any device, product or component, or provides services which:

(i) are promoted, advertised or marketed for the purpose of the circumvention of, or

(ii) have only a limited commercially significant purpose or use other than to circumvent, or

(iii) are primarily designed, produced, adapted or performed for the purpose of enabling or facilitating the circumvention of,those measures.

(2) The following persons have the same rights against C as a copyright owner has in respect of an infringement of copyright:

(a) a person:

(i) issuing to the public copies of, or

(ii) communicating to the public,the work to which effective technological measures have been applied;

(b) the copyright owner or his exclusive licensee, if he is not the person specified in paragraph (a); and

(c) the owner or exclusive licensee of any intellectual property right in the effective technological measures applied to the work.

(4) Further, the persons in subsection (2) have the same rights under section 99 or 100 (delivery up or seizure of certain articles) in relation to any such device, product or component which a person has in his possession, custody or control with the intention that it should be used to circumvent effective technological measures, as a copyright owner has in relation to any infringing copy.

(6) The following provisions apply in relation to proceedings under this section as in relation to proceedings under Part 1 (copyright):

(a) sections 104 to 106 of this Act (presumptions as to certain matters relating to copyright); and

(b) section 72 of the [F745Senior Courts Act 1981], section 15 of the Law Reform (Miscellaneous Provisions) (Scotland) Act 1985 and section 94A of the Judicature (Northern Ireland) Act 1978 (withdrawal of privilege against self-incrimination in certain proceedings relating to intellectual property);and section 114 of this Act applies, with the necessary modifications, in relation to the disposal of anything delivered up or seized by virtue of subsection (4).

(7) In section 97(1) (innocent infringement of copyright) as it applies to proceedings for infringement of the rights conferred by this section, the reference to the defendant not knowing or having reason to believe that copyright subsisted in the work shall be construed as a reference to his not knowing or having reason to believe that his acts enabled or facilitated an infringement of copyright.

(8) Subsections (1) to (5), (6)(b) and (7) and any other provision of this Act as it has effect for the purposes of those subsections apply, with any necessary adaptations, to rights in performances, publication right and database right.

(9) The provisions of regulation 22 (presumptions relevant to database right) of the Copyright and Rights in Databases Regulations 1997 (SI 1997/3032) apply in proceedings brought by virtue of this section in relation to database right.

296ZE.- Remedy where effective technological measures prevent permitted acts

(1) In this section:

[F746“ Marrakesh beneficiary” means a person who:

(a) is blind,

(b) has a visual impairment which cannot be improved so as to give the person visual function substantially equivalent to that of a person who has no such impairment, and who is, as a result, unable to read printed works to substantially the same degree as a person without such an impairment,

(c) has a perceptual or reading disability and is, as a result, unable to read printed works to substantially the same degree as a person without such disability, or

(d) is otherwise unable, due to a physical disability, to hold or manipulate a book or to focus or move their eyes to the extent that would normally be acceptable for reading;][F746 “Marrakesh work” means a work in the form of a book, journal, newspaper, magazine or other kind of writing, notation, including sheet music, and related illustrations, in any media, including in audio form such as audiobooks and in digital format, which is protected by copyright, related rights or database rights and which is published or otherwise lawfully made publicly available;]

“permitted act” means an act which may be done in relation to copyright works, notwithstanding the subsistence of copyright, by virtue of a provision of this Act listed in Part 1 of Schedule 5A;

“voluntary measure or agreement” means:

(a) any measure taken voluntarily by a copyright owner, his exclusive licensee or a person issuing copies of, or communicating to the public, a work other than a computer program, or

(b) any agreement between a copyright owner, his exclusive licensee or a person issuing copies of, or communicating to the public, a work other than a computer program and another party,

the effect of which is to enable a person to carry out a permitted act.

(2) Where the application of any effective technological measure to a copyright work other than a computer program prevents a person from carrying out a permitted act in relation to that work then that person or a person being a representative of a class of persons prevented from carrying out a permitted act may issue a notice of complaint to the Secretary of State.

(3) Following receipt of a notice of complaint, the Secretary of State may give to the owner of that copyright work or an exclusive licensee such directions as appear to the Secretary of State to be requisite or expedient for the purpose of:

(a) establishing whether any voluntary measure or agreement relevant to the copyright work the subject of the complaint subsists; or

(b) (where it is established there is no subsisting voluntary measure or agreement) ensuring that the owner or exclusive licensee of that copyright work makes available to the complainant the means of carrying out the permitted act the subject of the complaint to the extent necessary to so benefit from that permitted act.

(4) The Secretary of State may also give directions:

(a) as to the form and manner in which a notice of complaint in subsection (2) may be delivered to him;

(b) as to the form and manner in which evidence of any voluntary measure or agreement may be delivered to him; and

(c) generally as to the procedure to be followed in relation to a complaint made under this section;and shall publish directions given under this subsection in such manner as in his opinion will secure adequate publicity for them.

(5) It shall be the duty of any person to whom a direction is given under subsection (3)(a) or (b) to give effect to that direction.

(6) The obligation to comply with a direction given under subsection (3)(b) is a duty owed to the complainant or, where the complaint is made by a representative of a class of persons, to that representative and to each person in the class represented; and a breach of the duty is actionable accordingly (subject to the defences and other incidents applying to actions for breach of statutory duty).

(7) Any direction under this section may be varied or revoked by a subsequent direction under this section.

(8) Any direction given under this section shall be in writing.

(9) [F747Subject to subsection (9A),] This section does not apply to copyright works made available to the public on agreed contractual terms in such a way that members of the public may access them from a place and at a time individually chosen by them.

[F748(9A) But this section does apply where the application of any effective technological measure to a Marrakesh work prevents the making of an accessible copy of that work under sections 31A, 31B or 31BA, or paragraphs 3A, 3B or 3C of Schedule 2, for the benefit of a Marrakesh beneficiary.]

(10) This section applies only where a complainant has lawful access to the protected copyright work, or where the complainant is a representative of a class of persons, where the class of persons have lawful access to the work.

(11) Subsections (1) to (10) apply with any necessary adaptations to:

(a) rights in performances, and in this context the expression “ permitted act ” refers to an act that may be done by virtue of a provision of this Act listed in Part 2 of Schedule 5A;

(b) database right, and in this context the expression “ permitted act ” refers to an act that may be done by virtue of a provision of this Act listed in Part 3 of Schedule 5A; and

[F749 296ZEA.- Remedy where restrictive measures prevent or restrict personal copying

(1) This section applies where an individual is prevented from making a personal copy of a copyright work, or is restricted in the number of personal copies of it which may be made, because of a restrictive measure applied by or on behalf of the copyright owner.

(2) That individual, or a person being a representative of a class of such individuals, may issue a notice of complaint to the Secretary of State.

(a) establishing whether any voluntary measure or agreement relevant to the copyright work subsists, or

(b) (where it is established there is no subsisting voluntary measure or agreement) ensuring that the owner or exclusive licensee of that copyright work makes available to the complainant or the class of individuals represented by the complainant the means of benefiting from section 28B to the extent necessary to benefit from that section.

(4) In deciding whether to give such directions, the Secretary of State must consider whether the restrictive measure unreasonably prevents or restricts the making of personal copies, in particular having regard to:

(a) the right of the copyright owner to adopt adequate measures limiting the number of personal copies which may be made, and

(b) whether other copies of the work are commercially available on reasonable terms by or with the authority of the copyright owner in a form which does not prevent or unreasonably restrict the making of personal copies.

(5) The Secretary of State may also give directions:

(a) as to the form and manner in which a notice of complaint in subsection (2) may be delivered,

(b) as to the form and manner in which evidence of any voluntary measure or agreement may be delivered, and

(c) generally as to the procedure to be followed in relation to a complaint made under this section,and shall publish directions given under this subsection in such manner as the Secretary of State thinks will secure adequate publicity for them.

(6) Subsections (5) to (8) of section 296ZE:

(a) apply to directions under subsection (3)(a) or (b) as they apply to directions under section 296ZE(3)(a) or (b), and

(b) apply to directions under subsection (5) as they apply to directions under section 296ZE(4).

(7) This section does not apply to copyright works made available to the public on agreed contractual terms in such a way that members of the public may access them from a place and at a time individually chosen by them.

(8) In this section:

“restrictive measure” means any technology, device or component designed, in the normal course of its operation, to protect the rights of copyright owners, which has the effect of preventing a copyright work from being copied (in whole or in part) or restricting the number of copies which may be made;

“personal copy” means a copy of a copyright work which may be made under section 28B;

“voluntary measure or agreement” has the same meaning as in section 296ZE, except that the reference to carrying out a permitted act is to be read as a reference to making a personal copy.

(9) Subsections (1) to (8) apply with any necessary adaptations to:

(a)rights in performances, and in this context “personal copy” refers to a copy of a recording of a performance which may be made under paragraph 1B of Schedule 2 without infringing the rights conferred by Chapter 2 of Part II (rights in performances), and

(b)publication right.]

296ZF.- Interpretation of sections 296ZA to [F750 296ZEA]

(1) In sections 296ZA to 296ZE, “technological measures” are any technology, device or component which is designed, in the normal course of its operation, to protect a copyright work other than a computer program.

(2) Such measures are “effective” if the use of the work is controlled by the copyright owner through:

(a) an access control or protection process such as encryption, scrambling or other transformation of the work, or

(b) a copy control mechanism,which achieves the intended protection.

(3) In this section, the reference to:

(a) protection of a work is to the prevention or restriction of acts that are not authorised by the copyright owner of that work and are restricted by copyright; and

(b) use of a work does not extend to any use of the work that is outside the scope of the acts restricted by copyright.

(4) Expressions used in sections 296ZA to [F751 296ZEA] which are defined for the purposes of Part 1 of this Act (copyright) have the same meaning as in that Part.][F752.- Rights management information

296ZG.- Electronic rights management information

(1) This section applies where a person (D), knowingly and without authority, removes or alters electronic rights management information which:

(a) is associated with a copy of a copyright work, or

(b) appears in connection with the communication to the public of a copyright work, andwhere D knows, or has reason to believe, that by so doing he is inducing, enabling, facilitating or concealing an infringement of copyright.

(2) This section also applies where a person (E), knowingly and without authority, distributes, imports for distribution or communicates to the public copies of a copyright work from which electronic rights management information:

(a) associated with the copies, or

(b) appearing in connection with the communication to the public of the work,has been removed or altered without authority and where E knows, or has reason to believe, that by so doing he is inducing, enabling, facilitating or concealing an infringement of copyright.

(3) A person issuing to the public copies of, or communicating, the work to the public, has the same rights against D and E as a copyright owner has in respect of an infringement of copyright.

(4) The copyright owner or his exclusive licensee, if he is not the person issuing to the public copies of, or communicating, the work to the public, also has the same rights against D and E as he has in respect of an infringement of copyright.

(5) The rights conferred by subsections (3) and (4) are concurrent, and sections 101(3) and 102(1) to (4) apply, in proceedings under this section, in relation to persons with concurrent rights as they apply, in proceedings mentioned in those provisions, in relation to a copyright owner and exclusive licensee with concurrent rights.

(6) The following provisions apply in relation to proceedings under this section as in relation to proceedings under Part 1 (copyright):

(a) sections 104 to 106 of this Act (presumptions as to certain matters relating to copyright); and

(b) section 72 of the [F753Senior Courts Act 1981], section 15 of the Law Reform (Miscellaneous Provisions) (Scotland) Act 1985 and section 94A of the Judicature (Northern Ireland) Act 1978 (withdrawal of privilege against self-incrimination in certain proceedings relating to intellectual property).

(7) In this section:

(a) expressions which are defined for the purposes of Part 1 of this Act (copyright) have the same meaning as in that Part; and

(b) “rights management information” means any information provided by the copyright owner or the holder of any right under copyright which identifies the work, the author, the copyright owner or the holder of any intellectual property rights, or information about the terms and conditions of use of the work, and any numbers or codes that represent such information.

(8) Subsections (1) to (5) and (6)(b), and any other provision of this Act as it has effect for the purposes of those subsections, apply, with any necessary adaptations, to rights in performances, publication right and database right.

F755 296A.- Avoidance of certain terms.

(1) Where a person has the use of a computer program under an agreement, any term or condition in the agreement shall be void in so far as it purports to prohibit or restrict:

(a) the making of any back up copy of the program which it is necessary for him to have for the purposes of the agreed use;

(b) where the conditions in section 50B(2) are met, the decompiling of the program; or

[F756(c) the observing, studying or testing of the functioning of the program in accordance with section 50BA.]

(2) In this section, decompile, in relation to a computer program, has the same meaning as in section 50B]

F757.- [Databases]

296B [F758 Avoidance of certain terms relating to databases]

Where under an agreement a person has a right to use a database or part of a database, any term or condition in the agreement shall be void in so far as it purports to prohibit or restrict the performance of any act which would but for section 50D infringe the copyright in the database.

Fraudulent reception of transmissions

297.- Offence of fraudulently receiving programmes.

(1) A person who dishonestly receives a programme included in a broadcasting F759. . . service provided from a place in the United Kingdom with intent to avoid payment of any charge applicable to the reception of the programme commits an offence and is liable on summary conviction to a fine not exceeding level 5 on the standard scale.

(2) Where an offence under this section committed by a body corporate is proved to have been committed with the consent or connivance of a director, manager, secretary or other similar officer of the body, or a person purporting to act in any such capacity, he as well as the body corporate is guilty of the offence and liable to be proceeded against and punished accordingly.In relation to a body corporate whose affairs are managed by its members “director” means a member of the body corporate.

[F760

297A.- Unauthorised decoders.

(1) A person commits an offence if he:

(a) makes, imports, distributes, sells or lets for hire or offers or exposes for sale or hire any unauthorised decoder;

(b) has in his possession for commercial purposes any unauthorised decoder;

(d) advertises any unauthorised decoder for sale or hire or otherwise promotes any unauthorised decoder by means of commercial communications.

(2) A person guilty of an offence under subsection (1) is liable:

[F761

(a) on summary conviction, to imprisonment for a term not exceeding six months, or to a fine not exceeding the statutory maximum, or to both;]]

(b) on conviction on indictment, to imprisonment for a term not exceeding [F762ten] years, or to a fine, or to both.

(3) It is a defence to any prosecution for an offence under this section for the defendant to prove that he did not know, and had no reasonable ground for believing, that the decoder was an unauthorised decoder.

(4) In this section:

“apparatus” includes any device, component or electronic data (including software);

“conditional access technology” means any technical measure or arrangement whereby access to encrypted transmissions in an intelligbile form is made conditional on prior individual authorisation;

“decoder” means any apparatus which is designed or adapted to enable (whether on its own or with any other apparatus) an encrypted transmission to be decoded;

“encrypted” includes subjected to scrambling or the operation of cryptographic envelopes, electronic locks, passwords or any other analogous application;

“transmission” means:

(a) any programme included in a broadcasting F763. . . service which is provided from a place in the United Kingdom or any other member State; or

(b) an information society service (within the meaning of Directive 98/34/EC of the European Parliament and of the Council of 22nd June 1998 F764, as amended by Directive 98/48/EC of the European Parliament and of the Council of 20th July 1998 F765) which is provided from a place in the United Kingdom or any other member State; and

“unauthorised”, in relation to a decoder, means that the decoder is designed or adapted to enable an encrypted transmission, or any service of which it forms part, to be accessed in an intelligible form without payment of the fee (however imposed) which the person making the transmission, or on whose behalf it is made, charges for accessing the transmission or service (whether by the circumvention of any conditional access technology related to the transmission or service or by any other means).

[F766

297B.- Search warrants

(a) that an offence under section 297A(1) has been or is about to be committed in any premises, and

(2) The power conferred by subsection (1) does not, in England and Wales, extend to authorising a search for material of the kinds mentioned in section 9(2) of the Police and Criminal Evidence Act 1984 (c. 60) (certain classes of personal or confidential material).

(3) A warrant under subsection (1):

(a) may authorise persons to accompany any constable executing the warrant, and

(b) remains in force for [F767three months] from the date of its issue.

(4) In executing a warrant issued under subsection (1) a constable may seize an article if he reasonably believes that it is evidence that any offence under section 297A(1) has been or is about to be committed.

(5) In this section “ premises ” includes land, buildings, fixed or moveable structures, vehicles, vessels, aircraft and hovercraft. ][F768

297C.- Forfeiture of unauthorised decoders: England and Wales or Northern Ireland

(1) In England and Wales or Northern Ireland where unauthorised decoders have come into the possession of any person in connection with the investigation or prosecution of a relevant offence, that person may apply under this section for an order for the forfeiture of the unauthorised decoders.

(2) For the purposes of this section “relevant offence” means:

(a) an offence under section 297A(1) (criminal liability for making, importing, etc. unauthorised decoders),

(b) an offence under the Trade Descriptions Act 1968,

[F769(ba) an offence under the Business Protection from Misleading Marketing Regulations 2008,

(bb) an offence under the Consumer Protection from Unfair Trading Regulations 2008, or]

(3) An application under this section may be made:

(a) where proceedings have been brought in any court for a relevant offence relating to some or all of the unauthorised decoders, to that court, or

(b) where no application for the forfeiture of the unauthorised decoders has been made under paragraph (a), by way of complaint to a magistrates’ court.

(4) On an application under this section, the court shall make an order for the forfeiture of any unauthorised decoders only if it is satisfied that a relevant offence has been committed in relation to the unauthorised decoders.

(5) A court may infer for the purposes of this section that such an offence has been committed in relation to any unauthorised decoders if it is satisfied that such an offence has been committed in relation to unauthorised decoders which are representative of the unauthorised decoders in question (whether by reason of being of the same design or part of the same consignment or batch or otherwise).

(6) Any person aggrieved by an order made under this section by a magistrates’ court, or by a decision of such a court not to make such an order, may appeal against that order or decision:

(a) in England and Wales, to the Crown Court, or

(b) in Northern Ireland, to the county court.

(8) Subject to subsection (9), where any unauthorised decoders are forfeited under this section they shall be destroyed in accordance with such directions as the court may give.

(9) On making an order under this section the court may direct that the unauthorised decoders to which the order relates shall (instead of being destroyed) be forfeited to a person who has rights or remedies under section 298 in relation to the unauthorised decoders in question, or dealt with in such other way as the court considers appropriate.]

F770

297D.- Forfeiture of unauthorised decoders: Scotland

(1) In Scotland the court may make an order under this section for the forfeiture of unauthorised decoders.

(2) An order under this section may be made:

(a) on an application by the procurator-fiscal made in the manner specified in section 134 of the Criminal Procedure (Scotland) Act 1995 (c. 46), or

(b) where a person is convicted of a relevant offence, in addition to any other penalty which the court may impose.

(3) On an application under subsection (2)(a), the court shall make an order for the forfeiture of any unauthorised decoders only if it is satisfied that a relevant offence has been committed in relation to the unauthorised decoders.

(4) The court may infer for the purposes of this section that such an offence has been committed in relation to any unauthorised decoders if it is satisfied that such an offence has been committed in relation to unauthorised decoders which are representative of the unauthorised decoders in question (whether by reason of being of the same design or part of the same consignment or batch or otherwise).

(5) The procurator-fiscal making the application under subsection (2)(a) shall serve on any person appearing to him to be the owner of, or otherwise to have an interest in, the unauthorised decoders to which the application relates a copy of the application, together with a notice giving him the opportunity to appear at the hearing of the application to show cause why the unauthorised decoders should not be forfeited.

(7) Any person upon whom notice is served under subsection (5) and any other person claiming to be the owner of, or otherwise to have an interest in, unauthorised decoders to which an application under this section relates shall be entitled to appear at the hearing of the application to show cause why the unauthorised decoders should not be forfeited.

(8) The court shall not make an order following an application under subsection (2)(a):

(a) if any person on whom notice is served under subsection (5) does not appear, unless service of the notice on that person is proved, or

(b) if no notice under subsection (5) has been served, unless the court is satisfied that in the circumstances it was reasonable not to serve such notice.

(9) Where an order for the forfeiture of any unauthorised decoders is made following an application under subsection (2)(a), any person who appeared, or was entitled to appear, to show cause why the unauthorised decoders should not be forfeited may, within 21 days of the making of the order, appeal to the High Court by Bill of Suspension.

(10) Section 182(5)(a) to (e) of the Criminal Procedure (Scotland) Act 1995 shall apply to an appeal under subsection (9) as it applies to a stated case under Part 2 of that Act.

(11) An order following an application under subsection (2)(a) shall not take effect:

(a) until the end of the period of 21 days beginning with the day after the day on which the order is made, or

(b) if an appeal is made under subsection (9) above within that period, until the appeal is determined or abandoned.

(12) An order under subsection (2)(b) shall not take effect:

(a) until the end of the period within which an appeal against the order could be brought under the Criminal Procedure (Scotland) Act 1995 (c. 46), or

(b) if an appeal is made within that period, until the appeal is determined or abandoned.

(13) Subject to subsection (14), where any unauthorised decoders are forfeited under this section they shall be destroyed in accordance with such directions as the court may give.

(14) On making an order under this section the court may direct that the unauthorised decoders to which the order relates shall (instead of being destroyed) be forfeited to a person who has rights or remedies under section 298 in relation to the unauthorised decoders in question, or dealt with in such other way as the court considers appropriate.

(15) For the purposes of this section:

[F771“relevant offence” means:

(a) an offence under section 297A(1) (criminal liability for making, importing, etc unauthorised decoders),

(b) an offence under the Trade Descriptions Act 1968,

(d) an offence under the Consumer Protection from Unfair Trading Regulations 2008, or

(e) any offence involving dishonesty or deception;]

“the court” means:

(a) in relation to an order made on an application under subsection (2)(a), the sheriff, and

(b )in relation to an order made under subsection (2)(b), the court which imposed the penalty.

[F772

298.- Rights and remedies in respect of apparatus, &c. for unauthorised reception of transmissions.

(1) A person who:

(a) makes charges for the reception of programmes included in a broadcasting F773. . . service provided from a place in the United Kingdom or any other member State,

(b) sends encrypted tranmissions of any other description from a place in the United Kingdom or any other member State, or

(c) provides conditional access services from a place in the United Kingdom or any other member State,is entitled to the following rights and remedies.

(2) He has the same rights and remedies against a person:

(a)who:

(i) makes, imports, distributes, sells or lets for hire, offers or exposes for sale or hire, or advertises for sale or hire,

(ii) has in his possession for commercial purposes, or

(iii) instals, maintains or replaces for commercial purposes,any apparatus designed or adapted to enable or assist persons to access the programmes or other transmissions or circumvent conditional access technology related to the programmes or other transmissions when they are not entitled to do so, or

(b) who publishes or otherwise promotes by means of commercial communications any information which is calculated to enable or assist persons to access the programmes or other transmissions or circumvent conditional access technology related to the programmes or other transmissions when they are not entitled to do so,as a copyright owner has in respect of an infringement of copyright.

(3) Further, he has the same rights under section 99 or 100 (delivery up or seizure of certain articles) in relation to any such apparatus as a copyright owner has in relation to an infringing copy.

(4) Section 72 of the M49[F774Senior Courts Act 1981], section 15 of the M50Law Reform (Miscellaneous Provisions) (Scotland) Act 1985 and section 94A of the M51Judicature (Northern Ireland) Act 1978 (withdrawal of privilege against self-incrimination in certain proceedings relating to intellectual property) apply to proceedings under this section as to proceedings under Part I of this Act (copyright).

(5) In section 97(1) (innocent infringement of copyright) as it applies to proceedings for infringement of the rights conferred by this section, the reference to the defendant not knowing or having reason to believe that copyright subsisted in the work shall be construed as a reference to his not knowing or having reason to believe that his acts infringed the rights conferred by this section.

(6) Section 114 applies, with the necessary modifications, in relation to the disposal of anything delivered up or seized by virtue of subsection (3) above.

(7) In this section “apparatus”, “conditional access technology” and “encrypted” have the same meanings as in section 297A, “transmission” includes transmissions as defined in that section and “conditional access services” means services comprising the provision of conditional access technology.]

299.- Supplementary provisions as to fraudulent reception.

(1) Her Majesty may by Order in Council:

(a) provide that section 297 applies in relation to programmes included in services provided from a country or territory outside the United Kingdom, and

(b) provide that section 298 applies in relation to such programmes and to encrypted transmissions sent from such a country or territory.

F775(2). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(3) A statutory instrument containing an Order in Council under subsection (1) shall be subject to annulment in pursuance of a resolution of either House of Parliament.

(4) Where sections 297 and 298 apply in relation to a broadcasting service F776. . . , they also apply to any service run for the person providing that service, or a person providing programmes for that service, which consists wholly or mainly in the sending by means of a telecommunications system of sounds or visual images, or both.

(5) In sections 297 [F777, 297A] and 298, and this section, “programme”[F778and “broadcasting”], and related expressions, have the same meaning as in Part I (copyright).

Fraudulent application or use of trade mark

F779

300. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Provisions for the benefit of [F780 Great Ormond Street Hospital for Children]

301.- Provisions for the benefit of [F781Great Ormond Street Hospital for Children].

The provisions of Schedule 6 have effect for conferring on [F782GOSH Children’s Charity for the benefit of Great Ormond Street Hospital for Children] a right to a royalty in respect of the public performance, commercial publication [F783or communication to the public] of the play “Peter Pan” by Sir James Matthew Barrie, or of any adaptation of that work, notwithstanding that copyright in the work expired on 31st December 1987.

Financial assistance for certain international bodies

302.- Financial assistance for certain international bodies.

(1) The Secretary of State may give financial assistance, in the form of grants, loans or guarantees to:

(a) any international organisation having functions relating to trade marks or other intellectual property, or

(b) any [F784EU] institution or other body established under any of the [F784EU] Treaties having any such functions,with a view to the establishment or maintenance by that organisation, institution or body of premises in the United Kingdom.

(2) Any expenditure of the Secretary of State under this section shall be defrayed out of money provided by Parliament; and any sums received by the Secretary of State in consequence of this section shall be paid into the Consolidated Fund.

General

303.- Consequential amendments and repeals.

(1) The enactments specified in Schedule 7 are amended in accordance with that Schedule, the amendments being consequential on the provisions of this Act.

(2) The enactments specified in Schedule 8 are repealed to the extent specified.

304.- Extent.

(1) Provision as to the extent of Part I (copyright), Part II (rights in performances) and Part III (design right) is to be found in sections 157, 207 and 255 respectively; the extent of the other provisions of this Act is as follows.

(2) Parts IV to VII extend to England and Wales, Scotland and Northern Ireland, except that:

(a) sections 287 to 292 (patents county courts) extend to England and Wales only,

F785(b). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(3) The following provisions extend to the Isle of Man subject to any modifications contained in an Order made by Her Majesty in Council:

(a) sections 293 and 294 (patents: licences of right), and

(b) paragraphs 24 and 29 of Schedule 5 (patents: effect of filing international application for patent and power to extend time limits).

(4) Her Majesty may by Order in Council direct that the following provisions extend to the Isle of Man, with such exceptions and modifications as may be specified in the Order:

(a) Part IV (registered designs),

(b) Part V (patent agents),

(d) sections 297 to 299 (fraudulent reception of transmissions), and

(e) section 300 (fraudulent application or use of trade mark).

(5) Her Majesty may by Order in Council direct that sections 297 to 299 (fraudulent reception of transmissions) extend to any of the Channel Islands, with such exceptions and modifications as may be specified in the Order.

(6) Any power conferred by this Act to make provision by Order in Council for or in connection with the extent of provisions of this Act to a country outside the United Kingdom includes power to extend to that country, subject to any modifications specified in the Order, any provision of this Act which amends or repeals an enactment extending to that country.

305.- Commencement.

(1) The following provisions of this Act come into force on Royal Assent:

paragraphs 24 and 29 of Schedule 5 (patents: effect of filing international application for patent and power to extend time limits);

section 301 and Schedule 6 (provisions for the benefit of the Hospital for Sick Children).

(2) Sections 293 and 294 (licences of right) come into force at the end of the period of two months beginning with the passing of this Act.

(3) The other provisions of this Act come into force on such day as the Secretary of State may appoint by order made by statutory instrument, and different days may be appointed for different provisions and different purposes.

306.- Short title.

This Act may be cited as the Copyright, Designs and Patents Act 1988.

SCHEDULES.- Section 76A.- [F786 SCHEDULE ZA1 CERTAIN PERMITTED USES OF ORPHAN WORKS

PART 1.- GENERAL PROVISIONS

Certain permitted uses of orphan works by relevant bodies

1.-

(1) A relevant body does not infringe the copyright in a relevant work in its collection which is an orphan work by:

(a) making the orphan work available to the public; or

(b) reproducing the orphan work for the purposes of digitisation, making available, indexing, cataloguing, preservation or restoration.

(2) A relevant body does not infringe the rights conferred by Chapter 2 of Part 2 by doing either of the following in relation to a relevant work in its collection which is an orphan work:

(a) making the orphan work available to the public; or

(b) reproducing the orphan work for the purposes of digitisation, making available, indexing, cataloguing, preservation or restoration.

(3) A relevant body does not commit an offence under section 107 or 198 by using an orphan work in a way which, by virtue of this Schedule, does not infringe copyright or the rights conferred by Chapter 2 of Part 2.

(4) This paragraph is subject to paragraph 6 (further requirements for use of orphan works).

Meaning of “relevant body”, “relevant work” and “rightholder”

2.-

(1) In this Schedule “relevant body” means:

(a) a publicly accessible library, educational establishment or museum,

(b) an archive,

(d) a public service broadcasting organisation.

(2) Subject to sub-paragraph (4), in this Schedule “relevant work” means a work to which sub-paragraph (3) applies which is:

(a) a work in the form of a book, journal, newspaper, magazine or other writing which is contained in the collection of a publicly accessible library, educational establishment or museum, an archive or a film or audio heritage institution;

(b) a cinematographic or audiovisual work or a sound recording which is contained in the collection of a publicly accessible library, educational establishment or museum, an archive or a film or audio heritage institution; or

(c) a cinematographic or audiovisual work or a sound recording which was commissioned for exclusive exploitation by, or produced by, one or more public service broadcasting organisations on or before 31 December 2002 and is contained in the archives of that organisation or one or more of those organisations.

(3) This sub-paragraph applies to a work if:

(a) it is protected by copyright or rights conferred by Chapter 2 of Part 2, and

(b) the first publication or first broadcast of the work was in a member State.

(4) In this Schedule “relevant work” also includes a work listed in any of paragraphs (a) to (c) of sub-paragraph (2) which:

(a) is protected by copyright or rights conferred by Chapter 2 of Part 2, and

(b) has never been published or broadcast, but

as long as it is reasonable to assume that the rightholders would not oppose the use of the work as mentioned in paragraph 1(1) or (2).

(5) References in this Schedule to a relevant work include:

(a) a work that is embedded or incorporated in, or constitutes an integral part of, a relevant work, and

(b) a performance in relation to which rights are conferred by Chapter 2 of Part 2 and which is embedded or incorporated in, or constitutes an integral part of, a relevant work.

(6) In this Schedule “rightholder” in relation to a relevant work means:

(a) an owner of the copyright in the work,

(b) a licensee under an exclusive licence in relation to the work,

(d) a licensee under an exclusive licence in relation to those rights.

(7) In the application of sub-paragraph (6) to a performance by virtue of sub-paragraph (5), the reference in sub-paragraph (6)(c) to a performance recorded by the work is to be read as a reference to the performance.

(8) In this paragraph “public service broadcasting organisation” includes a public service broadcaster within the meaning of section 264 of the Communications Act 2003.

Meaning of “orphan work”

3.-

(1) For the purposes of this Schedule a relevant work is an orphan work if:

(a) there is a single rightholder in the work and the rightholder has not been identified or located, or

(b) there is more than one rightholder in the work and none of the rightholders has been identified or located,

despite a diligent search for the rightholder or rightholders having been carried out and recorded in accordance with paragraph 5.

(2) Subject as follows, a relevant work with more than one rightholder is also an orphan work for the purposes of this Schedule if:

(a) one or more of the rightholders has been identified or located, and

(b) one or more of the rightholders has not been identified or located despite a diligent search for the rightholder or rightholders having been carried out and recorded in accordance with paragraph 5.

Mutual recognition of orphan work status

4.- A relevant work which is designated as an orphan work in another member State is an orphan work for the purposes of this Schedule.

Diligent searches

5.-

(1) For the purposes of establishing whether a relevant work is an orphan work, a relevant body must ensure that a diligent search is carried out in good faith in respect of the work by consulting the appropriate sources for the category of work in question.

(2) The relevant body must carry out the diligent search prior to the use of the relevant work.

(3)T he sources that are appropriate for each category of relevant work must as a minimum include:

(a) the relevant databases maintained by the Office for Harmonization in the Internal Market; and

(b) where there is no record that the relevant work is an orphan work in the databases referred to in paragraph (a), the relevant sources listed in Part 2 of this Schedule for that category.

(4) The Comptroller-General of Patents, Designs and Trade Marks may issue guidance on the appropriate sources to be consulted under this paragraph for any particular category of work.

(5) Subject to sub-paragraphs (6) to (8), a search of the sources mentioned in sub-paragraph (3)(b) must be carried out in the member State in which the relevant work was first published or broadcast.

(6) If the relevant work is a cinematographic or audiovisual work and the producer of the work has his or her headquarters or habitual residence in a member State, the search must be carried out in the member State of the headquarters or habitual residence.

(7) If the relevant work falls within paragraph 2(4), the search must be carried out in the member State where the organisation that made the work publicly accessible with the consent of the rightholders is established.

(8) If there is evidence to suggest that relevant information on rightholders is to be found in other countries, a relevant body carrying out a search in accordance with sub-paragraph (3)(b) must also consult the sources of information available in those other countries.

(9) A relevant body that makes use of orphan works in accordance with this Schedule must maintain records of its diligent searches and must provide the following information to the Office for Harmonization in the Internal Market:

(a) the results of the diligent searches which the relevant body has carried out and which first established that a work is an orphan work;

(b) the use that the relevant body makes of the orphan works;

(c) any change, pursuant to paragraph 7, of the orphan work status of a relevant work that the relevant body has used and in respect of which the relevant body has been supplied with evidence by a rightholder in accordance with paragraph 7(2); and

(d) the contact information for the relevant body.

Further requirements for use of orphan works

6.-This Schedule does not prevent the use by a relevant body of an orphan work as mentioned in paragraph 1 from infringing copyright or the rights conferred by Chapter 2 of Part 2 if:

(a) the revenues generated in the course of the use of the orphan work are used otherwise than for the exclusive purpose of covering the costs of the relevant body in digitising orphan works and making them available to the public;

(b) the relevant body uses the orphan work in order to achieve aims which are not related to its public-interest mission (and the aims which are to be treated as related to its public interest mission include, in particular, the preservation of, the restoration of, and the provision of cultural and educational access to, works contained in its collection);

(c) any rightholder who has been identified or located has, in relation to the rightholder’s rights, not authorised the relevant body’s use of the orphan work as mentioned in paragraph 1; or

(d) the relevant body fails, in the course of the permitted use of the orphan work, to acknowledge the name of any author of or other rightholder in the work who has been identified.

End of orphan work status

7.-

(1) This paragraph applies to a rightholder who has not been identified or located in relation to a relevant work.

(2) A rightholder may put an end to the orphan work status of a relevant work by providing evidence of his or her ownership of the rights to the Office for Harmonization in the Internal Market or to the relevant body which carried out the diligent search which first established that the relevant work is an orphan work.

(3) A relevant body that is using or has used the orphan work must within a reasonable period provide the rightholder with fair compensation for that body’s use of the relevant work together with information on how the fair compensation has been calculated.

(4) If a relevant body and the rightholder cannot agree on the amount of compensation payable, either of them may apply to the Copyright Tribunal to determine the amount.

PART 2.- SOURCES TO BE SEARCHED DURING DILIGENT SEARCH

Category of relevant work Sources to be searched

1. Published books (a)legal deposit, library catalogues and authority files maintained by libraries and other institutions;

(b)the publishers’ and authors’ associations in the country in question;

(c) existing databases and registries, WATCH (Writers, Artists and their Copyright Holders), the ISBN (International Standard Book Number) and databases listing books in print;

(d)the databases of the relevant collecting societies, including reproduction rights organisations;

(e)sources that integrate multiple databases and registries, including VIAF (Virtual International Authority Files) and ARROW (Accessible Registries of Rights Information and Orphan Works).

2. Newspapers, magazines, journals

and periodicals (a) the ISSN (International Standard Serial Number) for periodical publications;

(b)indexes and catalogues from library holdings and collections;

(c)legal deposit;

(d)the publishers’ associations and the authors’ and journalists’ associations in the country in question;

(e)the databases of relevant collecting societies including reproduction rights organisations.

3. Visual works, including fine art,

photography, illustration, design,

architecture, sketches of the latter

works and other such works that are

contained in books, journals,

newspapers and magazines or other

works (a)the sources referred to in paragraphs 1 and 2;

(b)the databases of the relevant collecting societies, in particular for visual arts, and including reproduction rights organisations;

(c)the databases of picture agencies, where applicable.

4. Audiovisual works and sound

recordings (a)legal deposit;

(b)the producers’ associations in the country in question;

(c)databases of film or audio heritage institutions and national libraries;

(d)databases with relevant standards and identifiers such as ISAN (International Standard Audiovisual Number) for audiovisual material, ISWC (International Standard Music Work Code) for musical works and ISRC (International Standard Recording Code) for sound recordings;

(e)the databases of the relevant collecting societies, in particular for authors, performers, sound recording producers and audiovisual producers;

(f)credits and other information appearing on the work’s packaging;

(g)databases of other relevant associations representing a specific category of rightholders.

5. Relevant works which have not

been published or broadcast Those sources that are listed in paragraphs 1 to 4 above which are appropriate to a relevant work which is unpublished.][F787.- SCHEDULE A1.- Regulation of licensing bodies

Codes of practice

1.-

(1) The Secretary of State may by regulations make provision for a licensing body to be required to adopt a code of practice that complies with criteria specified in the regulations.

(2) The regulations may provide that, if a licensing body fails to adopt such a code of practice, any code of practice that is approved for the purposes of that licensing body by the Secretary of State, or by a person designated by the Secretary of State under the regulations, has effect as a code of practice adopted by the body.

(3) The regulations must provide that a code is not to be approved for the purposes of provision under sub-paragraph (2) unless it complies with criteria specified in the regulations.

2.- Regulations under paragraph 1 may make provision as to conditions that are to be satisfied, and procedures that are to be followed:

before a licensing body is required to adopt a code of practice as described in paragraph 1(1);

(b) before a code of practice has effect as one adopted by a licensing body as described in paragraph 1(2).

Licensing code ombudsman

3.-

(1) The Secretary of State may by regulations make provision:

(a) for the appointment of a person (the “licensing code ombudsman”) to investigate and determine disputes about a licensing body’s compliance with its code of practice;

(b) for the reference of disputes to the licensing code ombudsman;

(2) Provision made under this paragraph may in particular include provision:

(a) about eligibility for appointment as the licensing code ombudsman;

(b) about the disputes to be referred to the licensing code ombudsman;

(c) requiring any person to provide information, documents or assistance to the licensing code ombudsman for the purposes of an investigation or determination;

(d) requiring a licensing body to comply with a determination of the licensing code ombudsman;

(e) about the payment of expenses and allowances to the licensing code ombudsman.

Code reviewer

4.-

(1) The Secretary of State may by regulations make provision:

(a) for the appointment by the Secretary of State of a person (the “code reviewer”) to review and report to the Secretary of State on:

(i) the codes of practice adopted by licensing bodies, and

(ii) compliance with the codes of practice;

(b) for the carrying out of a review and the making of a report by that person.

(2) The regulations must provide for the Secretary of State, before appointing a person as the code reviewer, to consult persons whom the Secretary of State considers represent the interests of licensing bodies, licensees, members of licensing bodies, and the Intellectual Property Office.

(3) The regulations may, in particular, make provision:

(a) requiring any person to provide information, documents or assistance to the code reviewer for the purposes of a review or report;

(b) about the payment of expenses and allowances to the code reviewer.

(4) In this paragraph “ member ”, in relation to a licensing body, means a person on whose behalf the body is authorised to negotiate or grant licences.

Sanctions

5.-

(1) The Secretary of State may by regulations provide for the consequences of a failure by a licensing body to comply with:

(a) a requirement to adopt a code of practice under provision within paragraph 1(1);

(b) a code of practice that has been adopted by the body in accordance with a requirement under provision within paragraph 1(1), or that has effect as one adopted by the body under provision within paragraph 1(2);

(d) an authorisation under regulations under section 116A or 116B;

(e) a requirement imposed by regulations under section 116A or 116B;

(f) an authorisation under regulations under paragraph 1A or 1B of Schedule 2A;

(g) a requirement imposed by regulations under paragraph 1A or 1B of that Schedule.

(2) The regulations may in particular provide for:

(a) the imposition of financial penalties or other sanctions;

(b) the imposition of sanctions on a director, manager or similar officer of a licensing body or, where the body’s affairs are managed by its members, on a member.

(3) The regulations must include provision:

(a) for determining whether there has been a failure to comply with a requirement or code of practice for the purposes of any provision made under sub-paragraph (1);

(b) for determining any sanction that may be imposed in respect of the failure to comply;

(4) A financial penalty imposed under sub-paragraph (2) must not be greater than £50,000.

(5) The regulations may provide for a determination within sub-paragraph (3)(a) or (3)(b) to be made by the Secretary of State or by a person designated by the Secretary of State under the regulations.

(6) The regulations may make provision for requiring a person to give the person by whom a determination within sub-paragraph (3)(a) falls to be made (the “adjudicator”) any information that the adjudicator reasonably requires for the purpose of making that determination.

Fees

6.-

(1) The Secretary of State may by regulations require a licensing body to which regulations under any other paragraph of this Schedule apply to pay fees to the Secretary of State.

(2) The aggregate amount of fees payable under the regulations must not be more than the cost to the Secretary of State of administering the operation of regulations under this Schedule.

General

7.-

(1) The power to make regulations under this Schedule includes in particular power:

(a) to make incidental, supplementary or consequential provision, including provision extending or restricting the jurisdiction of the Copyright Tribunal or conferring powers on it;

(b) to make provision for bodies of a particular description, or carrying out activities of a particular description, not to be treated as licensing bodies for the purposes of requirements imposed under regulations under this Schedule;

(c) to make provision that applies only in respect of licensing bodies of a particular description, or only in respect of activities of a particular description;

(d) otherwise to make different provision for different purposes.

(2) Regulations under a paragraph of this Schedule may amend Part 1 or Part 2, or any other enactment or subordinate legislation passed or made before the paragraph in question comes into force, for the purpose of making consequential provision or extending or restricting the jurisdiction of the Copyright Tribunal or conferring powers on it.

(3) The power to make regulations is exercisable by statutory instrument.

(4) A statutory instrument containing regulations may not be made unless a draft of the instrument has been laid before and approved by a resolution of each House of Parliament.

8 References in this Schedule to a licensing body are to a body that is a licensing body for the purposes of Chapter 7 of Part 1 or Chapter 2 of Part 2, and references to licensees are to be construed accordingly.]

Section 170.- SCHEDULE 1

Introductory

1.-

(1) In this Schedule:

“the 1911 Act” means the M52Copyright Act 1911,

“the 1956 Act” means the M53Copyright Act 1956, and

“the new copyright provisions” means the provisions of this Act relating to copyright, that is, Part I (including this Schedule) and Schedules 3, 7 and 8 so far as they make amendments or repeals consequential on the provisions of Part I.

(2) References in this Schedule to “commencement”, without more, are to the date on which the new copyright provisions come into force.

(3) References in this Schedule to “existing works” are to works made before commencement; and for this purpose a work of which the making extended over a period shall be taken to have been made when its making was completed.

2.-

(1) In relation to the 1956 Act, references in this Schedule to a work include any work or other subject-matter within the meaning of that Act.

(2) In relation to the 1911 Act:

(a) references in this Schedule to copyright include the right conferred by section 24 of that Act in substitution for a right subsisting immediately before the commencement of that Act;

(b) references in this Schedule to copyright in a sound recording are to the copyright under that Act in records embodying the recording; and

(c) references in this Schedule to copyright in a film are to any copyright under that Act in the film (so far as it constituted a dramatic work for the purposes of that Act) or in photographs forming part of the film.

General principles: continuity of the law

3.- The new copyright provisions apply in relation to things existing at commencement as they apply in relation to things coming into existence after commencement, subject to any express provision to the contrary.

4.-

(1) The provisions of this paragraph have effect for securing the continuity of the law so far as the new copyright provisions re-enact (with or without modification) earlier provisions.

(2) A reference in an enactment, instrument or other document to copyright, or to a work or other subject-matter in which copyright subsists, which apart from this Act would be construed as referring to copyright under the 1956 Act shall be construed, so far as may be required for continuing its effect, as being, or as the case may require, including, a reference to copyright under this Act or to works in which copyright subsists under this Act.

(3) Anything done (including subordinate legislation made), or having effect as done, under or for the purposes of a provision repealed by this Act has effect as if done under or for the purposes of the corresponding provision of the new copyright provisions.

(4) References (expressed or implied) in this Act or any other enactment, instrument or document to any of the new copyright provisions shall, so far as the context permits, be construed as including, in relation to times, circumstances and purposes before commencement, a reference to corresponding earlier provisions.

(5) A reference (express or implied) in an enactment, instrument or other document to a provision repealed by this Act shall be construed, so far as may be required for continuing its effect, as a reference to the corresponding provision of this Act.

(6) The provisions of this paragraph have effect subject to any specific transitional provision or saving and to any express amendment made by this Act.

Subsistence of copyright

5.-

(1) Copyright subsists in an existing work after commencement only if copyright subsisted in it immediately before commencement.

(2) Sub-paragraph (1) does not prevent an existing work qualifying for copyright protection after commencement:

(a) under section 155 (qualification by virtue of first publication), F788…

(b) by virtue of an Order under section 159 (application of Part I to countries to which it does not extend) [F789, or][F790(c) where the work is an artistic work in which copyright subsists as a result of the disapplication of paragraph 6(1) by paragraph 6(1A)]

6.-

(1) Copyright shall not subsist by virtue of this Act in an artistic work made before 1st June 1957 which at the time when the work was made constituted a design capable of registration under the M54Registered Designs Act 1949 or under the enactments repealed by that Act, and was used, or intended to be used, as a model or pattern to be multiplied by an industrial process.

[F791(1A) Sub-paragraph (1) does not apply to an artistic work which was on 1st July 1995 protected under the law of another EEA state relating to copyright or related rights.]

(2) For this purpose a design shall be deemed to be used as a model or pattern to be multiplied by any industrial process:

(a) when the design is reproduced or is intended to be reproduced on more than 50 single articles, unless all the articles in which the design is reproduced or is intended to be reproduced together form only a single set of articles as defined in section 44(1) of the Registered Designs Act 1949, or

(b )when the design is to be applied to:

(i) printed paper hangings,

(ii) carpets, floor cloths or oil cloths, manufactured or sold in lengths or pieces,

(iii) textile piece goods, or textile goods manufactured or sold in lengths or pieces, or

(iv) lace, not made by hand.

7.-

(1) No copyright subsists in a film, as such, made before 1st June 1957.

(2) Where a film made before that date was an original dramatic work within the meaning of the 1911 Act, the new copyright provisions have effect in relation to the film as if it was an original dramatic work within the meaning of Part I.

(3) The new copyright provisions have effect in relation to photographs forming part of a film made before 1st June 1957 as they have effect in relation to photographs not forming part of a film.

8.-

(1) A film sound-track to which section 13(9) of the 1956 Act applied before commencement (film to be taken to include sounds in associated sound-track) shall be treated for the purposes of the new copyright provisions not as part of the film, but as a sound recording.

(2) However:

(a) copyright subsists in the sound recording only if copyright subsisted in the film immediately before commencement, and it continues to subsist until copyright in the film expires;

(b) the author and first owner of copyright in the film shall be treated as having been author and first owner of the copyright in the sound recording; and

(c) anything done before commencement under or in relation to the copyright in the film continues to have effect in relation to the sound recording as in relation to the film.

[F792

9.- No copyright subsists in:

(a) a wireless broadcast made before 1st June 1957, or

(b) a broadcast by cable made before 1st January 1985;

and any such broadcast shall be disregarded for the purposes of section 14(5) (duration of copyright in repeats).]

Authorship of work

10.- The question who was the author of an existing work shall be determined in accordance with the new copyright provisions for the purposes of the rights conferred by Chapter IV of Part I (moral rights), and for all other purposes shall be determined in accordance with the law in force at the time the work was made.

First ownership of copyright

11.-

(1) The question who was first owner of copyright in an existing work shall be determined in accordance with the law in force at the time the work was made.

(2) Where before commencement a person commissioned the making of a work in circumstances falling within:

(a) section 4(3) of the 1956 Act or paragraph (a) of the proviso to section 5(1) of the 1911 Act (photographs, portraits and engravings), or

(b) the proviso to section 12(4) of the 1956 Act (sound recordings),

those provisions apply to determine first ownership of copyright in any work made in pursuance of the commission after commencement.

Duration of copyright in existing works

12.-

(1) The following provisions have effect with respect to the duration of copyright in existing works.The question which provision applies to a work shall be determined by reference to the facts immediately before commencement; and expressions used in this paragraph which were defined for the purposes of the 1956 Act have the same meaning as in that Act.

(2)C opyright in the following descriptions of work continues to subsist until the date on which it would have expired under the 1956 Act:

(a) literary, dramatic or musical works in relation to which the period of 50 years mentioned in the proviso to section 2(3) of the 1956 Act (duration of copyright in works made available to the public after the death of the author) has begun to run;

(b) engravings in relation to which the period of 50 years mentioned in the proviso to section 3(4) of the 1956 Act (duration of copyright in works published after the death of the author) has begun to run;

(d) published sound recordings and sound recordings made before 1st June 1957;

(e) published films and films falling within section 13(3)(a) of the 1956 Act (films registered under former enactments relating to registration of films).

(3) Copyright in anonymous or pseudonymous literary, dramatic, musical or artistic works (other than photographs) continues to subsist:

(a) if the work is published, until the date on which it would have expired in accordance with the 1956 Act, and

(b) if the work is unpublished, until the end of the period of 50 years from the end of the calendar year in which the new copyright provisions come into force or, if during that period the work is first made available to the public within the meaning of [F793section 12(3)] (duration of copyright in works of unknown authorship), the date on which copyright expires in accordance with that provision;

unless, in any case, the identity of the author becomes known before that date, in which case [F794 section 12(2)] applies (general rule: life of the author [F795plus 70]).

(4) Copyright in the following descriptions of work continues to subsist until the end of the period of 50 years from the end of the calendar year in which the new copyright provisions come into force:

(a) literary, dramatic and musical works of which the author has died and in relation to which none of the acts mentioned in paragraphs (a) to (e) of the proviso to section 2(3) of the 1956 Act has been done;

(b) unpublished engravings of which the author has died;

(5) Copyright in the following descriptions of work continues to subsist until the end of the period of 50 years from the end of the calendar year in which the new copyright provisions come into force:

(a) unpublished sound recordings made on or after 1st June 1957;

(b) films not falling within sub-paragraph (2)(e) above,

unless the recording or film is published before the end of that period in which case copyright in it shall continue until the end of the period of 50 years from the end of the calendar year in which the recording or film is published.

(6) Copyright in any other description of existing work continues to subsist until the date on which copyright in that description of work expires in accordance with sections 12 to 15 of this Act.

(7) The above provisions do not apply to works subject to Crown or Parliamentary copyright (see paragraphs 41 to 43 below).

Perpetual copyright under the Copyright Act 1775

13.-

(1) The rights conferred on universities and colleges by the M55Copyright Act 1775 shall continue to subsist until the end of the period of 50 years from the end of the calendar year in which the new copyright provisions come into force and shall then expire.

(2) The provisions of the following Chapters of Part I:

Chapter III (acts permitted in relation to copyright works),

Chapter VI (remedies for infringement),

Chapter VII (provisions with respect to copyright licensing), and

Chapter VIII (the Copyright Tribunal),

apply in relation to those rights as they apply in relation to copyright under this Act.

Acts infringing copyright

14.-

(1) The provisions of Chapters II and III of Part I as to the acts constituting an infringement of copyright apply only in relation to acts done after commencement; the provisions of the 1956 Act continue to apply in relation to acts done before commencement.

(2) So much of section 18(2) as extends the restricted act of issuing copies to the public to include the rental to the public of copies of sound recordings, films or computer programs does not apply in relation to a copy of a sound recording, film or computer program acquired by any person before commencement for the purpose of renting it to the public.

(3) For the purposes of section 27 (meaning of “infringing copy”) the question whether the making of an article constituted an infringement of copyright, or would have done if the article had been made in the United Kingdom, shall be determined:

(a) in relation to an article made on or after 1st June 1957 and before commencement, by reference to the 1956 Act, and

(b) in relation to an article made before 1st June 1957, by reference to the 1911 Act.

(4) For the purposes of the application of sections 31(2), 51(2) and 62(3) (subsequent exploitation of things whose making was, by virtue of an earlier provision of the section, not an infringement of copyright) to things made before commencement, it shall be assumed that the new copyright provisions were in force at all material times.

(5) Section 55 (articles for producing material in a particular typeface) applies where articles have been marketed as mentioned in subsection (1) before commencement with the substitution for the period mentioned in subsection (3) of the period of 25 years from the end of the calendar year in which the new copyright provisions come into force.

(6) Section 56 (transfer of copies, adaptations, &c. of work in electronic form) does not apply in relation to a copy purchased before commencement.

(7) In section 65 (reconstruction of buildings) the reference to the owner of the copyright in the drawings or plans is, in relation to buildings constructed before commencement, to the person who at the time of the construction was the owner of the copyright in the drawings or plans under the 1956 Act, the 1911 Act or any enactment repealed by the 1911 Act.

15.-

(1) Section 57 (anonymous or pseudonymous works: acts permitted on assumptions as to expiry of copyright or death of author) has effect in relation to existing works subject to the following provisions.

(2) Subsection (1)(b)(i) (assumption as to expiry of copyright) does not apply in relation to:

(a) photographs, or

(b) the rights mentioned in paragraph 13 above (rights conferred by the M56Copyright Act 1775).

(3)F796. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

16.- The following provisions of section 7 of the 1956 Act continue to apply in relation to existing works:

(a) subsection (6) (copying of unpublished works from manuscript or copy in library, museum or other institution);

(b) subsection (7) (publication of work containing material to which subsection (6) applies), except paragraph (a) (duty to give notice of intended publication);

and subsection (9)(d) (illustrations) continues to apply for the purposes of those provisions.

17.- Where in the case of a dramatic or musical work made before 1st July 1912, the right conferred by the 1911 Act did not include the sole right to perform the work in public, the acts restricted by the copyright shall be treated as not including:

(a) performing the work in public,

[F797

(b) communicating the work to the public, or]

and where the right conferred by the 1911 Act consisted only of the sole right to perform the work in public, the acts restricted by the copyright shall be treated as consisting only of those acts.

18.- Where a work made before 1st July 1912 consists of an essay, article or portion forming part of and first published in a review, magazine or other periodical or work of a like nature, the copyright is subject to any right of publishing the essay, article, or portion in a separate form to which the author was entitled at the commencement of the 1911 Act, or would if that Act had not been passed, have become entitled under section 18 of the M57Copyright Act 1842.

Designs

19.-

(1) Section 51 (exclusion of copyright protection in relation to works recorded or embodied in design document or models) does not apply for ten years after commencement in relation to a design recorded or embodied in a design document or model before commencement.

(2) During those ten years the following provisions of Part III (design right) apply to any relevant copyright as in relation to design right:

(a) sections 237 to 239 (availability of licences of right), and

(b) sections 247 and 248 (application to comptroller to settle terms of licence of right).

(3) In section 237 as it applies by virtue of this paragraph, for the reference in subsection (1) to the last five years of the design right term there shall be substituted a reference to the last five years of the period of ten years referred to in sub-paragraph (1) above, or to so much of those last five years during which copyright subsists.

(4) In section 239 as it applies by virtue of this paragraph, for the reference in subsection (1)(b) to section 230 there shall be substituted a reference to section 99.

(5) Where a licence of right is available by virtue of this paragraph, a person to whom a licence was granted before commencement may apply to the comptroller for an order adjusting the terms of that licence.

(6) The provisions of sections 249 and 250 (appeals and rules) apply in relation to proceedings brought under or by virtue of this paragraph as to proceedings under Part III.

(7) A licence granted by virtue of this paragraph shall relate only to acts which would be permitted by section 51 if the design document or model had been made after commencement.

(8) Section 100 (right to seize infringing copies, &c.) does not apply during the period of ten years referred to in sub-paragraph (1) in relation to anything to which it would not apply if the design in question had been first recorded or embodied in a design document or model after commencement.

(9) Nothing in this paragraph affects the operation of any rule of law preventing or restricting the enforcement of copyright in relation to a design.

F798

20.-. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Abolition of statutory recording licence

21.- Section 8 of the 1956 Act (statutory licence to copy records sold by retail) continues to apply where notice under subsection (1)(b) of that section was given before the repeal of that section by this Act, but only in respect of the making of records:

(a) within one year of the repeal coming into force, and

(b) up to the number stated in the notice as intended to be sold.

Moral rights

22.-

(1) No act done before commencement is actionable by virtue of any provision of Chapter IV of Part I (moral rights).

(2) Section 43 of the 1956 Act (false attribution of authorship) continues to apply in relation to acts done before commencement.

23.-

(1) The following provisions have effect with respect to the rights conferred by:

(a) section 77 (right to be identified as author or director), and

(b) section 80 (right to object to derogatory treatment of work).

(2) The rights do not apply:

(a) in relation to a literary, dramatic, musical and artistic work of which the author died before commencement; or

(b) in relation to a film made before commencement.

(3) The rights in relation to an existing literary, dramatic, musical or artistic work do not apply:

(a) where copyright first vested in the author, to anything which by virtue of an assignment of copyright made or licence granted before commencement may be done without infringing copyright;

(b) where copyright first vested in a person other than the author, to anything done by or with the licence of the copyright owner.

(4) The rights do not apply to anything done in relation to a record made in pursuance of section 8 of the 1956 Act (statutory recording licence).

24.- The right conferred by section 85 (right to privacy of certain photographs and films) does not apply to photographs taken or films made before commencement.

Assignments and licences

25.-

(1) Any document made or event occurring before commencement which had any operation:

(a) affecting the ownership of the copyright in an existing work, or

(b) creating, transferring or terminating an interest, right or licence in respect of the copyright in an existing work,

has the corresponding operation in relation to copyright in the work under this Act.

(2) Expressions used in such a document shall be construed in accordance with their effect immediately before commencement.

26.-

(1) Section 91(1) of this Act (assignment of future copyright: statutory vesting of legal interest on copyright coming into existence) does not apply in relation to an agreement made before 1st June 1957.

(2) The repeal by this Act of section 37(2) of the 1956 Act (assignment of future copyright: devolution of right where assignee dies before copyright comes into existence) does not affect the operation of that provision in relation to an agreement made before commencement.

27.-

(1) Where the author of a literary, dramatic, musical or artistic work was the first owner of the copyright in it, no assignment of the copyright and no grant of any interest in it, made by him (otherwise than by will) after the passing of the 1911 Act and before 1st June 1957, shall be operative to vest in the assignee or grantee any rights with respect to the copyright in the work beyond the expiration of 25 years from the death of the author.

(2) The reversionary interest in the copyright expectant on the termination of that period may after commencement be assigned by the author during his life but in the absence of any assignment shall, on his death, devolve on his legal personal representatives as part of his estate.

(3) Nothing in this paragraph affects:

(a) an assignment of the reversionary interest by a person to whom it has been assigned,

(b) an assignment of the reversionary interest after the death of the author by his personal representatives or any person becoming entitled to it, or

(4) Nothing in this paragraph applies to the assignment of the copyright in a collective work or a licence to publish a work or part of a work as part of a collective work.

(5) In sub-paragraph (4) “collective work” means:

(a) any encyclopaedia, dictionary, yearbook, or similar work;

(b) a newspaper, review, magazine, or similar periodical; and

(c) any work written in distinct parts by different authors, or in which works or parts of works of different authors are incorporated.

28.-

(1) This paragraph applies where copyright subsists in a literary, dramatic, musical or artistic work made before 1st July 1912 in relation to which the author, before the commencement of the 1911 Act, made such an assignment or grant as was mentioned in paragraph (a) of the proviso to section 24(1) of that Act (assignment or grant of copyright or performing right for full term of the right under the previous law).

(2) If before commencement any event has occurred or notice has been given which by virtue of paragraph 38 of Schedule 7 to the 1956 Act had any operation in relation to copyright in the work under that Act, the event or notice has the corresponding operation in relation to copyright under this Act.

(3) Any right which immediately before commencement would by virtue of paragraph 38(3) of that Schedule have been exercisable in relation to the work, or copyright in it, is exercisable in relation to the work or copyright in it under this Act.

(4) If in accordance with paragraph 38(4) of that Schedule copyright would, on a date after the commencement of the 1956 Act, have reverted to the author or his personal representatives and that date falls after the commencement of the new copyright provisions:

(a) the copyright in the work shall revert to the author or his personal representatives, as the case may be, and

(b) any interest of any other person in the copyright which subsists on that date by virtue of any document made before the commencement of the 1911 Act shall thereupon determine.

29 Section 92(2) of this Act (rights of exclusive licensee against successors in title of person granting licence) does not apply in relation to an exclusive licence granted before commencement.

Bequests

30.-

(1) Section 93 of this Act (copyright to pass under will with original document or other material thing embodying unpublished work):

(a) does not apply where the testator died before 1st June 1957, and

(b) where the testator died on or after that date and before commencement, applies only in relation to an original document embodying a work.

(2) In the case of an author who died before 1st June 1957, the ownership after his death of a manuscript of his, where such ownership has been acquired under a testamentary disposition made by him and the manuscript is of a work which has not been published or performed in public, is prima facie proof of the copyright being with the owner of the manuscript.

Remedies for infringement

31.-

(1) Sections 96 and 97 of this Act (remedies for infringement) apply only in relation to an infringement of copyright committed after commencement; section 17 of the 1956 Act continues to apply in relation to infringements committed before commencement.

(2) Sections 99 and 100 of this Act (delivery up or seizure of infringing copies, &c.) apply to infringing copies and other articles made before or after commencement; section 18 of the 1956 Act, and section 7 of the 1911 Act, (conversion damages, &c.), do not apply after commencement except for the purposes of proceedings begun before commencement.

(3) Sections 101 to 102 of this Act (rights and remedies of exclusive licensee) apply where sections 96 to 100 of this Act apply; section 19 of the 1956 Act continues to apply where section 17 or 18 of that Act applies.

(4) Sections 104 to 106 of this Act (presumptions) apply only in proceedings brought by virtue of this Act; section 20 of the 1956 Act continues to apply in proceedings brought by virtue of that Act.

32.- Sections 101 and 102 of this Act (rights and remedies of exclusive licensee) do not apply to a licence granted before 1st June 1957.

33.-

(1) The provisions of section 107 of this Act (criminal liability for making or dealing with infringing articles, &c.) apply only in relation to acts done after commencement; section 21 of the 1956 Act (penalties and summary proceedings in respect of dealings which infringe copyright) continues to apply in relation to acts done before commencement.

(2) Section 109 of this Act (search warrants) applies in relation to offences committed before commencement in relation to which section 21A or 21B of the 1956 Act applied; sections 21A and 21B continue to apply in relation to warrants issued before commencement.

34.-

(1) The Lord Chancellor may, after consultation with the Lord Advocate, by rules make such provision as he considers necessary or expedient with respect to proceedings pending under Part IV of the 1956 Act immediately before commencement.

(2) Rules under this paragraph shall be made by statutory instrument which shall be subject to annulment in pursuance of a resolution of either House of Parliament.

Qualification for copyright protection

35.- Every work in which copyright subsisted under the 1956 Act immediately before commencement shall be deemed to satisfy the requirements of Part I of this Act as to qualification for copyright protection.

Dependent territories

36.-

(1) The 1911 Act shall remain in force as part of the law of any dependent territory in which it was in force immediately before commencement until:

(a) the new copyright provisions come into force in that territory by virtue of an Order under section 157 of this Act (power to extend new copyright provisions), or

(b) in the case of any of the Channel Islands, the Act is repealed by Order under sub-paragraph (3) below.

(2) An Order in Council in force immediately before commencement which extends to any dependent territory any provisions of the 1956 Act shall remain in force as part of the law of that territory until:

(a) the new copyright provisions come into force in that territory by virtue of an Order under section 157 of this Act (power to extend new copyright provisions), or

(b) in the case of the Isle of Man, the Order is revoked by Order under sub-paragraph (3) below;

and while it remains in force such an Order may be varied under the provisions of the 1956 Act under which it was made.

(3) If it appears to Her Majesty that provision with respect to copyright has been made in the law of any of the Channel Islands or the Isle of Man otherwise than by extending the provisions of Part I of this Act, Her Majesty may by Order in Council repeal the 1911 Act as it has effect as part of the law of that territory or, as the case may be, revoke the Order extending the 1956 Act there.

(4) A dependent territory in which the 1911 or 1956 Act remains in force shall be treated, in the law of the countries to which Part I extends, as a country to which that Part extends; and those countries shall be treated in the law of such a territory as countries to which the 1911 Act or, as the case may be, the 1956 Act extends.

(5) If a country in which the 1911 or 1956 Act is in force ceases to be a colony of the United Kingdom, section 158 of this Act (consequences of country ceasing to be colony) applies with the substitution for the reference in subsection (3)(b) to the provisions of Part I of this Act of a reference to the provisions of the 1911 or 1956 Act, as the case may be.

(6) In this paragraph “dependent territory” means any of the Channel Islands, the Isle of Man or any colony.

37.-

(1) This paragraph applies to a country which immediately before commencement was not a dependent territory within the meaning of paragraph 36 above but:

(a) was a country to which the 1956 Act extended, or

(b) was treated as such a country by virtue of paragraph 39(2) of Schedule 7 to that Act (countries to which the 1911 Act extended or was treated as extending);

and Her Majesty may by Order in Council conclusively declare for the purposes of this paragraph whether a country was such a country or was so treated.

(2) A country to which this paragraph applies shall be treated as a country to which Part I extends for the purposes of sections 154 to 156 (qualification for copyright protection) until:

(a) an Order in Council is made in respect of that country under section 159 (application of Part I to countries to which it does not extend), or

(b) an Order in Council is made declaring that it shall cease to be so treated by reason of the fact that the provisions of the 1956 Act or, as the case may be, the 1911 Act, which extended there as part of the law of that country have been repealed or amended.

(3) A statutory instrument containing an Order in Council under this paragraph shall be subject to annulment in pursuance of a resolution of either House of Parliament.

Territorial waters and the continental shelf

38.- Section 161 of this Act (application of Part I to things done in territorial waters or the United Kingdom sector of the continental shelf) does not apply in relation to anything done before commencement.

British ships, aircraft and hovercraft

39.- Section 162 (British ships, aircraft and hovercraft) does not apply in relation to anything done before commencement.

Crown copyright

40.-

(1) Section 163 of this Act (general provisions as to Crown copyright) applies to an existing work if:

(a) section 39 of the 1956 Act applied to the work immediately before commencement, and

(b) the work is not one to which section 164, 165 or 166 applies (copyright in Acts, Measures and Bills and Parliamentary copyright: see paragraphs 42 and 43 below).

(2) Section 163 (1)(b) (first ownership of copyright) has effect subject to any agreement entered into before commencement under section 39(6) of the 1956 Act.

41.-

(1) The following provisions have effect with respect to the duration of copyright in existing works to which section 163 (Crown copyright) applies.The question which provision applies to a work shall be determined by reference to the facts immediately before commencement; and expressions used in this paragraph which were defined for the purposes of the 1956 Act have the same meaning as in that Act.

(2) Copyright in the following descriptions of work continues to subsist until the date on which it would have expired in accordance with the 1956 Act:

(a) published literary, dramatic or musical works;

(b) artistic works other than engravings or photographs;

(d) published photographs and photographs taken before 1st June 1957;

(e) published sound recordings and sound recordings made before 1st June 1957;

(f) published films and films falling within section 13(3)(a) of the 1956 Act (films registered under former enactments relating to registration of films).

(3) Copyright in unpublished literary, dramatic or musical works continues to subsist until:

(a) the date on which copyright expires in accordance with section 163(3), or

(b) the end of the period of 50 years from the end of the calendar year in which the new copyright provisions come into force,

whichever is the later.

(a) unpublished engravings;

(b) unpublished photographs taken on or after 1st June 1957.

(5) Copyright in a film or sound recording not falling within sub-paragraph (2) above continues to subsist until the end of the period of 50 years from the end of the calendar year in which the new copyright provisions come into force, unless the film or recording is published before the end of that period, in which case copyright expires 50 years from the end of the calendar year in which it is published.

42.-

(1) Section 164 (copyright in Acts and Measures) applies to existing Acts of Parliament and Measures of the General Synod of the Church of England.

(2) References in that section to Measures of the General Synod of the Church of England include Church Assembly Measures.

Parliamentary copyright

43.-

(1) Section 165 of this Act (general provisions as to Parliamentary copyright) applies to existing unpublished literary, dramatic, musical or artistic works, but does not otherwise apply to existing works.

(2) Section 166 (copyright in Parliamentary Bills) does not apply:

(a) to a public Bill which was introduced into Parliament and published before commencement,

(b) to a private Bill of which a copy was deposited in either House before commencement, or

44.-

(1) Any work in which immediately before commencement copyright subsisted by virtue of section 33 of the 1956 Act shall be deemed to satisfy the requirements of section 168(1); but otherwise section 168 does not apply to works made or, as the case may be, published before commencement.

(2) Copyright in any such work which is unpublished continues to subsist until the date on which it would have expired in accordance with the 1956 Act, or the end of the period of 50 years from the end of the calendar year in which the new copyright provisions come into force, whichever is the earlier.

Meaning of “publication”

45.- Section 175(3) (construction of building treated as equivalent to publication) applies only where the construction of the building began after commencement.

Meaning of “unauthorised”

46.- For the purposes of the application of the definition in section 178 (minor definitions) of the expression “unauthorised” in relation to things done before commencement:

(a) paragraph (a) applies in relation to things done before 1st June 1957 as if the reference to the licence of the copyright owner were a reference to his consent or acquiescence;

(b) paragraph (b) applies with the substitution for the words from “or, in a case” to the end of the words “or any person lawfully claiming under him”; and

Section 189.- SCHEDULE 2.- Rights in performances: permitted acts

Introductory

1.-

(1) The provisions of this Schedule specify acts which may be done in relation to a performance or recording notwithstanding the rights conferred by [F799this Chapter]; they relate only to the question of infringement of those rights and do not affect any other right or obligation restricting the doing of any of the specified acts.

(2) No inference shall be drawn from the description of any act which may by virtue of this Schedule be done without infringing the rights conferred by [F799this Chapter] as to the scope of those rights.

(3) The provisions of this Schedule are to be construed independently of each other, so that the fact that an act does not fall within one provision does not mean that it is not covered by another provision.

[F800 Making of temporary copies

1A.- The rights conferred by [F801this Chapter] are not infringed by the making of a temporary copy of a recording of a performance which is transient or incidental, which is an integral and essential part of a technological process and the sole purpose of which is to enable:

(a) a transmission of the recording in a network between third parties by an intermediary; or

(b) a lawful use of the recording;

and which has no independent economic significance.][F802 Personal copies of recordings for private use

1B.-

(1) The making of a copy of a recording of a performance by an individual does not infringe the rights conferred by this Chapter provided that the copy:

(a) is a copy of:

(i) the individual’s own copy of the recording, or

(ii) a personal copy of the recording made by the individual,

(b) is made for the individual’s private use, and

(2) In this paragraph “the individual’s own copy” is a copy of a recording which:

(a) has been lawfully acquired by the individual on a permanent basis,

(b) is not an illicit recording, and

(c) has not been made under any provision of this Schedule which permits the making of a copy without infringing the rights conferred by this Chapter.

(3) In this paragraph a “personal copy” means a copy made under this paragraph.

(4) The rights conferred by this Chapter in a recording are infringed if an individual transfers a personal copy of the recording to another person (otherwise than on a private and temporary basis), except where the transfer is authorised by the rights owner.

(5) If the rights conferred by this Chapter are infringed as set out in sub-paragraph (4), a personal copy which has been transferred is for all purposes subsequently treated as an illicit recording.

(6) The rights conferred by this Chapter in a recording are also infringed if an individual, having made a personal copy of the recording, transfers the individual’s own copy of the recording to another person (otherwise than on a private and temporary basis) and, after that transfer and without the consent of the rights owner, retains any personal copy.

(7)I f the rights conferred by this Chapter are infringed as set out in sub-paragraph (6), any retained personal copy is for all purposes subsequently treated as an illicit recording.

(8) To the extent that a term of a contract purports to prevent or restrict the making of a copy which, by virtue of this paragraph, would not infringe any right conferred by this Chapter, that term is unenforceable.

(9) Expressions used but not defined in this paragraph have the same meaning as in section 28B.][F803 Research and private study

1C.

(1) Fair dealing with a performance or a recording of a performance for the purposes of research for a non-commercial purpose does not infringe the rights conferred by this Chapter.

(2) Fair dealing with a performance or recording of a performance for the purposes of private study does not infringe the rights conferred by this Chapter.

(3) Copying of a recording by a person other than the researcher or student is not fair dealing if:

(a) in the case of a librarian, or a person acting on behalf of a librarian, that person does anything which is not permitted under paragraph 6F (copying by librarians: single copies of published recordings), or

(b )in any other case, the person doing the copying knows or has reason to believe that it will result in copies of substantially the same material being provided to more than one person at substantially the same time and for substantially the same purpose.

(4) To the extent that a term of a contract purports to prevent or restrict the doing of any act which, by virtue of this paragraph, would not infringe any right conferred by this Chapter, that term is unenforceable.

(5) Expressions used in this paragraph have the same meaning as in section 29.

Copies for text and data analysis for non-commercial research

1D.-

(1) The making of a copy of a recording of a performance by a person who has lawful access to the recording does not infringe any rights conferred by this Chapter provided that the copy is made in order that a person who has lawful access to the recording may carry out a computational analysis of anything recorded in the recording for the sole purpose of research for a non-commercial purpose.

(2) Where a copy of a recording has been made under this paragraph, the rights conferred by this Chapter are infringed if:

(a) the copy is transferred to any other person, except where the transfer is authorised by the rights owner, or

(b) the copy is used for any purpose other than that mentioned in sub-paragraph (1), except where the use is authorised by the rights owner.

(3) If a copy of a recording made under this paragraph is subsequently dealt with:

(a) it is to be treated as an illicit recording for the purposes of that dealing, and

(b) if that dealing infringes any right conferred by this Chapter, it is to be treated as an illicit recording for all subsequent purposes.

(4) To the extent that a term of a contract purports to prevent or restrict the making of a copy which, by virtue of this paragraph, would not infringe any right conferred by this Chapter, that term is unenforceable.

(5) Expressions used in this paragraph have the same meaning as in section 29A.]

Criticism, reviews[F804, quotation] and news reporting

2.-

[F805(1) Fair dealing with a performance or recording for the purpose of criticism or review, of that or another performance or recording, or of a work, does not infringe any of the rights conferred by [F806this Chapter] provided that the performance or recording has been made available to the public.

[F807(1ZA) The rights conferred by this Chapter in a performance or a recording of a performance are not infringed by the use of a quotation from the performance or recording (whether for criticism or review or otherwise) provided that:

(a) the performance or recording has been made available to the public,

(b) the use of the quotation is fair dealing with the performance or recording, and

(1A) Fair dealing with a performance or recording for the purpose of reporting current events does not infringe any of the rights conferred by [F806this Chapter].][F808 (1B)To the extent that a term of a contract purports to prevent or restrict the doing of any act which, by virtue of sub-paragraph (1ZA), would not infringe any right conferred by this Chapter, that term is unenforceable.]

(2) Expressions used in this paragraph have the same meaning as in section 30.

[F809 Caricature, parody or pastiche

2A.-

(1) Fair dealing with a performance or a recording of a performance for the purposes of caricature, parody or pastiche does not infringe the rights conferred by this Chapter in the performance or recording.

(2) To the extent that a term of a contract purports to prevent or restrict the doing of any act which, by virtue of this paragraph, would not infringe any right conferred by this Chapter, that term is unenforceable.

(3) Expressions used in this paragraph have the same meaning as in section 30A.]

Incidental inclusion of performance or recording

3.-

(1) The rights conferred by [F810this Chapter] are not infringed by the incidental inclusion of a performance or recording in a sound recording, film [F811or broadcast].

(2) Nor are those rights infringed by anything done in relation to copies of, or the playing, showing [F812or communication to the public] of, anything whose making was, by virtue of sub-paragraph (1), not an infringement of those rights.

(3) A performance or recording so far as it consists of music, or words spoken or sung with music, shall not be regarded as incidentally included in a sound recording [F811or broadcast] if it is deliberately included.

(4) Expressions used in this paragraph have the same meaning as in section 31.

[F813 Disabled persons: copies of recordings for personal use

3A.-

(1) This paragraph applies if:

(a) a disabled person has lawful [F814access to] a copy of the whole or part of a recording of a performance, and

(b) the person’s disability prevents the person from [F815substantially] the same degree as a person who does not have that disability.

(2) The making of an accessible copy of the copy of the recording referred to in sub-paragraph (1)(a) does not infringe the rights conferred by this Chapter if:

(a) the copy is made by the disabled person [F816and] or by a person acting on behalf of the disabled person,

(b) the copy is made for the disabled person’s personal use, F817…

F818(c). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F819(3). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(4) The rights conferred by this Chapter are infringed by the transfer of an accessible copy of a recording made under this paragraph to any person other than:

(a) a person by or for whom an accessible copy of the recording may be made under this paragraph, or

(b) a person who intends to transfer the copy to a person falling within paragraph (a),

except where the transfer is authorised by the rights owner.

(5) An accessible copy of a recording made under this paragraph is to be treated for all purposes as an illicit recording if it is held by a person at a time when the person does not fall within sub-paragraph (4)(a) or (b).

(6) If an accessible copy of a recording made under this paragraph is subsequently dealt with:

(a) it is to be treated as an illicit recording for the purposes of that dealing, and

(b) if that dealing infringes any right conferred by this Chapter, it is to be treated as an illicit recording for all subsequent purposes.

Making [F820communicating, making available, distributing or lending] of accessible copies by authorised bodies

3B.-

[F821(1)If:

(a) an authorised body has lawful access to the whole or part of a work which has been published or otherwise made available, and

(b) the body complies with sub-paragraph (1A),

the body may, without infringing the rights conferred by this Chapter, make, communicate, make available, distribute or lend accessible copies of the work on a non-profit basis for the personal use of disabled persons in the United Kingdom or another member State of the European Union.

(1A) An authorised body complies with this sub-paragraph if it:

(a) distributes, communicates, makes available or lends accessible copies only to disabled persons or other authorised bodies,

(b) takes appropriate steps to discourage the unauthorised reproduction, distribution, communication to the public or making available to the public of accessible copies,

(d) publishes and updates, on its website if appropriate, or through other online or offline channels, information on how it complies with the obligations in paragraphs (a), (b) and (c).]

F822 (2). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F822 (3). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(4) For the purposes of [F823sub-paragraph (1)], [F824communicate, make available, distribute or lend] “for the personal use of disabled persons” [F825includes to communicate, make available, distribute or lend] to a person acting on behalf of a disabled person.

F826 (5). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F826 (6). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F826 (7). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(8) An authorised body which has made an accessible copy of a recording under this paragraph may [F827communicate, make available, distribute or lend] it to another authorised body [F828established in the United Kingdom or in another member State of the European Union] which is entitled to make accessible copies of the recording under this paragraph for the purposes of enabling that other body to make accessible copies of the recording.

F829 (9). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(10) If an accessible copy of a recording made under this paragraph is subsequently dealt with:

(a) it is to be treated as an illicit recording for the purposes of that dealing, and

(b) if that dealing infringes any right conferred by this Chapter, it is to be treated as an illicit recording for all subsequent purposes.

[F830 (11) In this paragraph “dealt with” means sold or let for hire or offered or exposed for sale or hire.]

Making [F831communicating, making available, distributing or lending] of intermediate copies by authorised bodies

3C.-

(1) An authorised body which is entitled to make an accessible copy of a recording of a performance under paragraph 3B may, without infringing the rights conferred by this Chapter, make a copy of the recording (“an intermediate copy”) if this is necessary in order to make the accessible copy.

(2) An authorised body which has made an intermediate copy of a recording under this paragraph may [F832 communicate, make available, distribute or lend it on a non-profit basis] it to another authorised body which is entitled to make accessible copies of the recording under paragraph 3B for the purposes of enabling that other body to make accessible copies of the recording.

(3) The rights conferred by this Chapter are infringed by the transfer of an intermediate copy made under this paragraph to a person other than another authorised body as permitted by sub-paragraph (2), except where the transfer is authorised by the rights owner.

F833 (4). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Accessible and intermediate copies: records

[F834

3D.-

(1) A person listed in sub-paragraph (2) may request an authorised body:

(a) making accessible copies under paragraph 3B, or

(b) making intermediate copies under paragraph 3C,

to provide the person with the information in sub-paragraph (4).

(2) On receipt of a request under sub-paragraph (1), an authorised body must provide the information to the person in an accessible way within in a reasonable time.

(3)T he persons who may make a request under sub-paragraph (1) are:

(a) disabled person;

(b) another authorised body;

(4) The information that must be provided by the authorised body is:

(a) the list of works for which it has accessible copies and the available formats, and

(b) the name and contact details of any authorised body established in another member State of the European Union from which, or to which, it has imported, exported or accessed an accessible copy.]

Paragraphs 3A to 3D: interpretation and general

3E.-

(1)This paragraph supplements paragraphs 3A to 3D and includes definitions.

(2) “Disabled person” means a person who has a physical or mental impairment which prevents the person from enjoying a recording of a performance to [F835substantially] the same degree as a person who does not have that impairment, and “disability” is to be construed accordingly.

(3) But a person is not to be regarded as disabled by reason only of an impairment of visual function which can be improved, [F836for example] by the use of corrective lenses, to a level that is normally acceptable for reading without a special level or kind of light.

(4) An “accessible copy” of a recording of a performance means a version of the recording which enables [F837disabled persons to access that version, including accessing it as feasibly and comfortably as a person who is not a disabled person].

(5) An accessible copy:

(a) may include facilities for navigating around the version of the recording, but

(b) must not include any changes to the recording which are not necessary to overcome the problems suffered by the disabled persons for whom the accessible copy is intended.

(6) To the extent that a term of a contract purports to prevent or restrict the doing of any act which, by virtue of paragraph 3A, 3B or 3C, would not infringe any right conferred by this Chapter, that term is unenforceable.

(7) “Authorised body” [F838has] the meaning given in section 31F, and other expressions used in paragraphs 3A to 3D but not defined in this paragraph have the same meaning as in sections 31A to 31BB.][F839 Illustration for instruction

4.-

(1) Fair dealing with a performance or a recording of a performance for the sole purpose of illustration for instruction does not infringe the rights conferred by this Chapter provided that the dealing is:

(a) for a non-commercial purpose, and

(b) by a person giving or receiving instruction (or preparing for giving or receiving instruction).

(3) Expressions used in this paragraph have the same meaning as in section 32.]

Playing or showing sound recording, film, [F840 or broadcast]at educational establishment

5.-

(1) The playing or showing of a sound recording, film [F841or broadcast] at an educational establishment for the purposes of instruction before an audience consisting of teachers and pupils at the establishment and other persons directly connected with the activities of the establishment is not a playing or showing of a performance in public for the purposes of infringement of the rights conferred by [F842this Chapter] .

(2) A person is not for this purpose directly connected with the activities of the educational establishment simply because he is the parent of a pupil at the establishment.

(3) Expressions used in this paragraph have the same meaning as in section 34 and any provision made under section 174(2) with respect to the application of that section also applies for the purposes of this paragraph.

[F843 Recording by educational establishments of broadcasts

6.-

(1) A recording of a broadcast, or a copy of such a recording, may be made by or on behalf of an educational establishment for the educational purposes of that establishment without infringing any of the rights conferred by this Chapter in relation to any performance or recording included in it, provided that the educational purposes are non-commercial.

(2) The rights conferred by this Chapter are not infringed where a recording of a broadcast or a copy of such a recording, made under sub-paragraph (1), is communicated by or on behalf of the educational establishment to its pupils or staff for the non-commercial educational purposes of that establishment.

(3) Sub-paragraph (2) only applies to a communication received outside the premises of the establishment if that communication is made by means of a secure electronic network accessible only by the establishment’s pupils and staff.

(4) Acts which would otherwise be permitted by this paragraph are not permitted if, or to the extent that, licences are available authorising the acts in question and the educational establishment responsible for those acts knew or ought to have been aware of that fact.

(5) If a recording made under this paragraph is subsequently dealt with:

(a) it is to be treated as an illicit recording for the purposes of that dealing, and

(b) if that dealing infringes any right conferred by this Chapter, it is to be treated as an illicit recording for all subsequent purposes.

(6) In this paragraph “dealt with” means:

(a) sold or let for hire,

(b) offered or exposed for sale or hire, or

(7) Expressions used in this paragraph (other than “dealt with”) have the same meaning as in section 35 and any provision made under section 174(2) with respect to the application of that section also applies for the purposes of this paragraph.

Copying and use of extracts of recordings by educational establishments

6ZA.-

(1) The copying of extracts of a recording of a performance by or on behalf of an educational establishment does not infringe any of the rights conferred by this Chapter in the recording provided that the copy is made for the purposes of instruction for a non-commercial purpose.

(2) The rights conferred by this Chapter are not infringed where an extract of a recording of a performance, made under sub-paragraph (1), is communicated by or on behalf of the educational establishment to its pupils or staff for the purposes of instruction for a non-commercial purpose.

(4) Not more than 5% of a recording may be copied under this paragraph by or on behalf of an educational establishment in any period of 12 months.

(5) Acts which would otherwise be permitted by this paragraph are not permitted if, or to the extent that, licences are available authorising the acts in question and the educational establishment responsible for those acts knew or ought to have been aware of that fact.

(6) The terms of a licence granted to an educational establishment authorising acts permitted by this paragraph are of no effect so far as they purport to restrict the proportion of a recording which may be copied (whether on payment or free of charge) to less than that which would be permitted by this paragraph.

(7) If a recording made under this paragraph is subsequently dealt with:

(a) it is to be treated as an illicit recording for the purposes of that dealing, and

(b) if that dealing infringes any right conferred by this Chapter, it is to be treated as an illicit recording for all subsequent purposes.

(8) In this paragraph “dealt with” means:

(a) sold or let for hire,

(b) offered or exposed for sale or hire, or

(9) Expressions used in this paragraph (other than “dealt with”) have the same meaning as in section 36 and any provision made under section 174(2) with respect to the application of that section also applies for the purposes of this paragraph.]

F844 [ Lending of copies by educational establishments ][F845

6A.-

(1) The rights conferred by [F846this Chapter] are not infringed by the lending of copies of a recording of a performance by an educational establishment.

(2) Expressions used in this paragraph have the same meaning as in section 36A; and any provision with respect to the application of that section made under section 174(2) (instruction given elsewhere than an educational establishment) applies also for the purposes of this paragraph.]

F847 [ Lending of copies by libraries or archives ][F848

6B.-

(1) The rights conferred by [F849 this Chapter ] are not infringed by the lending of copies of a recording of a performance by a F850 … library or archive (other than a public library) which is not conducted for profit.

[F851

(A1) The rights conferred by this Chapter are not infringed by the following acts by a public library in relation to a book within the public lending right scheme:

(a) lending the book;

(b) in relation to an audio-book or e-book, copying or issuing a copy of the book as an act incidental to lending it.

(A2) Expressions used in sub-paragraph (A1) have the same meaning as in section 40A(1).]

F852(2). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ].

[F853 Libraries and educational establishments etc : making recordings of performances available through dedicated terminals

6C.-

(1) The rights conferred by this Chapter in a recording of a performance are not infringed by an institution specified in sub-paragraph (2) communicating the recording to the public or making it available to the public by means of a dedicated terminal on its premises, if the conditions in sub-paragraph (3) are met.

(2) The institutions are:

(a) a library,

(b) an archive,

(d) an educational establishment.

(3) The conditions are that the recording or a copy of the recording:

(a) has been lawfully acquired by the institution,

(b) is communicated or made available to individual members of the public for the purposes of research or private study, and

(c) is communicated or made available in compliance with any purchase or licensing terms to which the recording is subject.

Copying by librarians: supply of single copies to other libraries

6D.-

(1) A librarian may, if the conditions in sub-paragraph (2) are met, make a single copy of the whole or part of a published recording of a performance and supply it to another library, without infringing any rights conferred by this Chapter in the recording.

(2) The conditions are:

(a) the copy is supplied in response to a request from a library which is not conducted for profit, and

(b) at the time of making the copy the librarian does not know, or could not reasonably find out, the name and address of a person entitled to authorise the making of a copy of the recording.

(3) Where a library makes a charge for supplying a copy under this paragraph, the sum charged must be calculated by reference to the costs attributable to the production of the copy.

Copying by librarians etc : replacement copies of recordings

6E.-

(1) A librarian, archivist or curator of a library, archive or museum may, without infringing any rights conferred by this Chapter, make a copy of a recording of a performance in that institution’s permanent collection:

(a) in order to preserve or replace that recording in that collection, or

(b )where a recording in the permanent collection of another library, archive or museum has been lost, destroyed or damaged, in order to replace the recording in the collection of that other library, archive or museum,

provided that the conditions in sub-paragraphs (2) and (3) are met.

(2) The first condition is that the recording is:

(a) included in the part of the collection kept wholly or mainly for the purposes of reference on the institution’s premises,

(b) included in a part of the collection not accessible to the public, or

(3) The second condition is that it is not reasonably practicable to purchase a copy of the recording to achieve either of the purposes mentioned in sub-paragraph (1).

(4) The reference in sub-paragraph (1)(b) to a library, archive or museum is to a library, archive or museum which is not conducted for profit.

(5) Where an institution makes a charge for supplying a copy to another library, archive or museum under sub-paragraph (1)(b), the sum charged must be calculated by reference to the costs attributable to the production of the copy.

(6) To the extent that a term of a contract purports to prevent or restrict the doing of any act which, by virtue of this paragraph, would not infringe any right conferred by this Chapter, that term is unenforceable.

Copying by librarians: single copies of published recordings

6F.-

(1) A librarian of a library which is not conducted for profit may, if the conditions in sub-paragraph (2) are met, make and supply a single copy of a reasonable proportion of a published recording without infringing any of the rights in the recording conferred by this Chapter.

(2) The conditions are:

(a) the copy is supplied in response to a request from a person who has provided the librarian with a declaration in writing which includes the information set out in sub-paragraph (3), and

(b) the librarian is not aware that the declaration is false in a material particular.

(3) The information which must be included in the declaration is:

(a) the name of the person who requires the copy and the material which that person requires,

(b) a statement that the person has not previously been supplied with a copy of that material by any library,

(4) Where a library makes a charge for supplying a copy under this paragraph, the sum charged must be calculated by reference to the costs attributable to the production of the copy.

(5) Where a person (“P”) makes a declaration under this paragraph that is false in a material particular and is supplied with a copy of a recording which would have been an illicit recording if made by P:

(a) P is liable for infringement of the rights conferred by this Chapter as if P had made the copy, and

(b) the copy supplied to P is to be treated as an illicit recording for all purposes.

Copying by librarians or archivists: single copies of unpublished recordings

6G.-

(1) A librarian or archivist may make and supply a single copy of the whole or part of a recording without infringing any of the rights conferred by this Chapter in the recording, provided that:

(a) the copy is supplied in response to a request from a person who has provided the librarian or archivist with a declaration in writing which includes the information set out in sub-paragraph (2), and

(b) the librarian or archivist is not aware that the declaration is false in a material particular.

(2) The information which must be included in the declaration is:

(a) the name of the person who requires the copy and the material which that person requires,

(b) a statement that the person has not previously been supplied with a copy of that material by any library or archive, and

(3) But the rights conferred by this Chapter are infringed if:

(a) the recording had been published or communicated to the public before the date it was deposited in the library or archive, or

(b) the rights owner has prohibited the copying of the recording,

and at the time of making the copy the librarian or archivist is, or ought to be, aware of that fact.

(4) Where a library or archive makes a charge for supplying a copy under this paragraph, the sum charged must be calculated by reference to the costs attributable to the production of the copy.

(a) P is liable for infringement of the rights conferred by this Chapter as if P had made the copy, and

(b) the copy supplied to P is to be treated as an illicit recording for all purposes.

Paragraphs 6B to 6G: interpretation

6H.-

Expressions used in paragraphs 6B to 6G have the same meaning as in sections 40A to 43.][F854 Certain permitted uses of orphan works

6I.-

(1) The rights conferred by this Chapter are not infringed by a relevant body in the circumstances set out in paragraph 1(2) of Schedule ZA1 (subject to paragraph 6 of that Schedule).

(2) “Relevant body” has the meaning given by that Schedule.]

Copy of work required to be made as condition of export

7.-

(1) If an article of cultural or historical importance or interest cannot lawfully be exported from the United Kingdom unless a copy of it is made and deposited in an appropriate library or archive, it is not an infringement of any right conferred by [F855this Chapter] to make that copy.

(2)Expressions used in this paragraph have the same meaning as in section 44.

Parliamentary and judicial proceedings

8.-

(1)The rights conferred by [F856this Chapter] are not infringed by anything done for the purposes of parliamentary or judicial proceedings or for the purpose of reporting such proceedings.

(2) Expressions used in this paragraph have the same meaning as in section 45.

Royal Commissions and statutory inquiries

9.-

(1) The rights conferred by [F857this Chapter] are not infringed by anything done for the purposes of the proceedings of a Royal Commission or statutory inquiry or for the purpose of reporting any such proceedings held in public.

(2) Expressions used in this paragraph have the same meaning as in section 46.

Public records

10.-

(1) Material which is comprised in public records within the meaning of the M58Public Records Act 1958, the M59Public Records (Scotland) Act 1937 or the M60Public Records Act (Northern Ireland) 1923 [F858, or in Welsh public records (as defined in [F859the Government of Wales Act 2006]), ] which are open to public inspection in pursuance of that Act, may be copied, and a copy may be supplied to any person, by or with the authority of any officer appointed under that Act, without infringing any right conferred by [F860this Chapter].

(2)Expressions used in this paragraph have the same meaning as in section 49.

Acts done under statutory authority

(2) Sub-paragraph (1) applies in relation to an enactment contained in Northern Ireland legislation as it applies to an Act of Parliament.

(3) Nothing in this paragraph shall be construed as excluding any defence of statutory authority otherwise available under or by virtue of any enactment.

(4) Expressions used in this paragraph have the same meaning as in section 50.

Transfer of copies of works in electronic form

12.-

(1) This paragraph applies where a recording of a performance in electronic form has been purchased on terms which, expressly or impliedly or by virtue of any rule of law, allow the purchaser to make further recordings in connection with his use of the recording.

(2) If there are no express terms:

(a) prohibiting the transfer of the recording by the purchaser, imposing obligations which continue after a transfer, prohibiting the assignment of any consent or terminating any consent on a transfer, or

(b) providing for the terms on which a transferee may do the things which the purchaser was permitted to do,

anything which the purchaser was allowed to do may also be done by a transferee without infringement of the rights conferred by [F862this Chapter], but any recording made by the purchaser which is not also transferred shall be treated as an illicit recording for all purposes after the transfer.

(3) The same applies where the original purchased recording is no longer usable and what is transferred is a further copy used in its place.

(4) The above provisions also apply on a subsequent transfer, with the substitution for references in sub-paragraph (2) to the purchaser of references to the subsequent transferor.

(5) This paragraph does not apply in relation to a recording purchased before the commencement of [F863this Chapter].

(6) Expressions used in this paragraph have the same meaning as in section 56.

Use of recordings of spoken works in certain cases

13.-

(1) Where a recording of the reading or recitation of a literary work is made for the purpose:

(a) of reporting current events, or

(b) of [F864communicating to the public] the whole or part of the reading or recitation,

it is not an infringement of the rights conferred by [F865this Chapter] to use the recording (or to copy the recording and use the copy) for that purpose, provided the following conditions are met.

(2) The conditions are that:

(a) the recording is a direct recording of the reading or recitation and is not taken from a previous recording or from a broadcast F866. . . ;

(b) the making of the recording was not prohibited by or on behalf of the person giving the reading or recitation;

(c) the use made of the recording is not of a kind prohibited by or on behalf of that person before the recording was made; and

(d) the use is by or with the authority of a person who is lawfully in possession of the recording.

(3) Expressions used in this paragraph have the same meaning as in section 58.

Recordings of folksongs

14.-

(1) A recording of a performance of a song may be made for the purpose of including it in an archive maintained by a [F867body not established or conducted for profit] without infringing any of the rights conferred by [F868this Chapter] , provided the conditions in sub-paragraph (2) below are met.

(2) The conditions are that:

(a) the words are unpublished and of unknown authorship at the time the recording is made,

(b) the making of the recording does not infringe any copyright, and

[F869 (3)A single copy of a recording made in reliance on sub-paragraph (1) and included in an archive referred to in that sub-paragraph may be made and supplied by the archivist without infringing any right conferred by this Chapter, provided that:

(a) the copy is supplied in response to a request from a person who has provided the archivist with a declaration in writing which includes the information set out in sub-paragraph (4), and

(b) the archivist is not aware that the declaration is false in a material particular.

(4) The information which must be included in the declaration is:

(a )the name of the person who requires the copy and the recording which is the subject of the request,

(b) a statement that the person has not previously been supplied with a copy of that recording by any archivist, and

(5) Where an archive makes a charge for supplying a copy under this paragraph, the sum charged must be calculated by reference to the costs attributable to the production of the copy.

(6) Where a person (“P”) makes a declaration under this paragraph that is false in a material particular and is supplied with a copy of a recording which would have been an illicit recording if made by P:

(a) P is liable for infringement of the rights conferred by this Chapter as if P had made the copy, and

(b) the copy supplied to P is to be treated as an illicit recording for all purposes.

(7) In this paragraph references to an archivist include a person acting on behalf of an archivist.

(8) Expressions used in this paragraph have the same meaning as in section 61.]

F870 [ Lending of certain recordings ]

F871

14A

(1) The Secretary of State may by order provide that in such cases as may be specified in the order the lending to the public of copies of films or sound recordings shall be treated as licensed by the performer subject only to the payment of such reasonable royalty or other payment as may be agreed or determined in default of agreement by the Copyright Tribunal.

(2) No such order shall apply if, or to the extent that, there is a licensing scheme certified for the purposes of this paragraph under paragraph 16 of Schedule 2A providing for the grant of licences.

(3) An order may make different provision for different cases and may specify cases by reference to any factor relating to the work, the copies lent, the lender or the circumstances of the lending.

(4) An order shall be made by statutory instrument; and no order shall be made unless a draft of it has been laid before and approved by a resolution of each House of Parliament.

(5) Nothing in this section affects any liability under section 184(1)(b) (secondary infringement: possessing or dealing with illicit recording) in respect of the lending of illicit recordings.

(6) Expressions used in this paragraph have the same meaning as in section 66.

Playing of sound recordings for purposes of club, society, &c

15.- F872. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Incidental recording for purposes of broadcast F873. . .

16.-

(1) A person who proposes to broadcast a recording of a performance F874. . . in circumstances not infringing the rights conferred by [F875this Chapter] shall be treated as having consent for the purposes of [F876this Chapter] for the making of a further recording for the purposes of the broadcast F874. . . .

(2) That consent is subject to the condition that the further recording:

(a) shall not be used for any other purpose, and

(b) shall be destroyed within 28 days of being first used for broadcasting the performance F874. . . .

(3) A recording made in accordance with this paragraph shall be treated as an illicit recording:

(a) for the purposes of any use in breach of the condition mentioned in sub-paragraph (2)(a), and

(b) for all purposes after that condition or the condition mentioned in sub-paragraph (2)(b) is broken.

(4) Expressions used in this paragraph have the same meaning as in section 68.

Recordings for purposes of supervision and control of broadcasts and [F877other services]

17.-

(1) The rights conferred by [F878this Chapter] are not infringed by the making or use by the British Broadcasting Corporation, for the purpose of maintaining supervision and control over programmes broadcast by them [F879or included in any on-demand programme service provided by them], of recordings of those programmes.

[F880

(2) The rights conferred by [F878this Chapter] are not infringed by anything done in pursuance of:

[F881

(a) section 167(1) of the Broadcasting Act 1990, section 115(4) or (6) or 117 of the Broadcasting Act 1996 or paragraph 20 of Schedule 12 to the Communications Act 2003;]

(b) a condition which, [F882 by virtue of section 334(1) of the Communications Act 2003 ] , is included in a licence granted under Part I or III of that Act or Part I or II of the Broadcasting Act 1996; F883 . . .

(c) a direction given under section 109(2) of the Broadcasting Act 1990 (power of [F884OFCOM] to require production of recordings etc ).

[F885

(d) section 334(3) [F886, 368O(1) or (3)] of the Communications Act 2003.][F887

(3) The rights conferred by [F878 this Chapter ] are not infringed by the use by OFCOM in connection with the performance of any of their functions under the Broadcasting Act 1990, the Broadcasting Act 1996 or the Communications Act 2003 of:

(a) any recording, script or transcript which is provided to them under or by virtue of any provision of those Acts; or

(b) any existing material which is transferred to them by a scheme made under section 30 of the Communications Act 2003.]]

(4) In subsection (3), “existing material” means:

(b) any recording or transcript which was provided to the Broadcasting Standards Commission under section 115(4) or (6) or 116(5) of the Broadcasting Act 1996.

[F888

(6) In this section “ on-demand programme service ” has the same meaning as in the Communications Act 2003 (see section 368A of that Act). ][F889 Recording for the purposes of time-shifting

17A.-

(1) The making in domestic premises for private and domestic use of a recording of a broadcast solely for the purpose of enabling it to be viewed or listened to at a more convenient time does not infringe any right conferred by [F890this Chapter] in relation to a performance or recording included in the broadcast.

(2) Where a recording which would otherwise be an illicit recording is made in accordance with this paragraph but is subsequently dealt with:

(a) it shall be treated as an illicit recording for the purposes of that dealing; and

(b) if that dealing infringes any right conferred by [F890this Chapter] , it shall be treated as an illicit recording for all subsequent purposes.

(3) In sub-paragraph (2), “ dealt with ” means sold or let for hire, offered or exposed for sale or hire or communicated to the public.

(4) Expressions used in this paragraph have the same meaning as in section 70.][F891 Photographs of broadcasts

17B.-

(1) The making in domestic premises for private and domestic use of a photograph of the whole or any part of an image forming part of a broadcast, or a copy of such a photograph, does not infringe any right conferred by [F892this Chapter] in relation to a performance or recording included in the broadcast.

(2) Where a recording which would otherwise be an illicit recording is made in accordance with this paragraph but is subsequently dealt with:

(a) it shall be treated as an illicit recording for the purposes of that dealing; and

(b )if that dealing infringes any right conferred by [F892this Chapter] , it shall be treated as an illicit recording for all subsequent purposes.

(3) In sub-paragraph (2), “ dealt with ” means sold or let for hire, offered or exposed for sale or hire or communicated to the public.

(4) Expressions used in this paragraph have the same meaning as in section 71.]

Free public showing or playing of broadcast F893. . .

18.-

(1) The showing or playing in public of a broadcast F894. . . to an audience who have not paid for admission to the place where the broadcast F894. . . is to be seen or heard does not infringe any right conferred by [F895this Chapter] in relation to a performance or recording included in:

(a) the broadcast F894. . . , or

(b) any sound recording [F896(except so far as it is an excepted sound recording)] or film which is played or shown in public by reception of the broadcast F894. . . .

[F897

(1A) The showing or playing in public of a broadcast to an audience who have not paid for admission to the place where the broadcast is to be seen or heard does not infringe any right conferred by [F895this Chapter] in relation to a performance or recording included in any excepted sound recording which is played in public by reception of the broadcast, if the playing or showing of that broadcast in public:

(a) F898 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(b) is necessary for the purposes of:

(i) repairing equipment for the reception of broadcasts;

(ii) demonstrating that a repair to such equipment has been carried out; or

(iii) demonstrating such equipment which is being sold or let for hire or offered or exposed for sale or hire.]

(2) The audience shall be treated as having paid for admission to a place:

(a) if they have paid for admission to a place of which that place forms part; or

(b) if goods or services are supplied at that place (or a place of which it forms part):

(i) at prices which are substantially attributable to the facilities afforded for seeing or hearing the broadcast F899. . . , or

(ii) at prices exceeding those usually charged there and which are partly attributable to those facilities.

(3) The following shall not be regarded as having paid for admission to a place:

(a) persons admitted as residents or inmates of the place;

(b) persons admitted as members of a club or society where the payment is only for membership of the club or society and the provision of facilities for seeing or hearing broadcasts F899. . . is only incidental to the main purposes of the club or society.

(4) Where the making of the broadcast F899. . . was an infringement of the rights conferred by [F895this Chapter] in relation to a performance or recording, the fact that it was heard or seen in public by the reception of the broadcast F899. . . shall be taken into account in assessing the damages for that infringement.

(5) Expressions used in this paragraph have the same meaning as in section 72.

[F900 Reception and re-transmission of [F901wireless broadcast by cable]]

F902

19.- . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F903

19A.- . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F904

Words in heading preceding Sch. 2 para. 20 repealed (31.10.2003) by The Copyright and Related Rights Regulations 2003 (S.I. 2003/2498) , reg. 2(2) , Sch. 2 (with regs. 31-40 )

F905 20.- . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[F906 Recording of broadcast for archival purposes

21.-

(1) A recording of a broadcast or a copy of such a recording may be made for the purpose of being placed in an archive maintained by a body which is not established or conducted for profit without infringing any right conferred by this Chapter in relation to a performance or recording included in the broadcast.

(3)Expressions used in this paragraph have the same meaning as in section 75.]

F907 [SCHEDULE 2A.- LICENSING OF PERFORMERS’ F908 … RIGHTS

Licensing schemes and licensing bodies

1.-

(1) In [F909this Chapter] a “licensing scheme” means a scheme setting out:

(a) the classes of case in which the operator of the scheme, or the person on whose behalf he acts, is willing to grant performers’ property right licences, and

(b) the terms on which licences would be granted in those classes of case;

and for this purpose a “scheme” includes anything in the nature of a scheme, whether described as a scheme or as a tariff or by any other name.

(2)In [F909this Chapter] a “licensing body” means a society or other organisation which has as its main object, or one of its main objects, the negotiating or granting, whether as owner or prospective owner of a performer’s property rights or as agent for him, of performers’ property right licences, and whose objects include the granting of licences covering the performances of more than one performer.

(3) In this paragraph “performers’ property right licences” means licences to do, or authorise the doing of, any of the things for which consent is required under section 182A, [F910182B, 182C or 182CA] .

(4) References in [F911this Chapter] to licences or licensing schemes covering the performances of more than one performer do not include licences or schemes covering only:

(a) performances recorded in a single recording,

(b) performances recorded in more than one recording where:

(i) the performers giving the performances are the same, or

(ii) the recordings are made by, or by employees of or commissioned by, a single individual, firm, company or group of companies. For purpose a group of companies means a holding company and its subsidiaries within the meaning of [F912 section 1159 of the Companies Act 2006].

[F913

(5) Schedule A1 confers powers to provide for the regulation of licensing bodies.][F914 Power to provide for licensing of orphan rights

1A.-

(1) The Secretary of State may by regulations provide for the grant of licences to do, or authorise the doing of, acts to which section 182, 182A, 182B, 182C, 182CA, 183 or 184 applies in respect of a performance, where:

(a) the performer’s consent would otherwise be required under that section, but

(b) the right to authorise or prohibit the act qualifies as an orphan right under the regulations.

(2) The regulations may:

(a) specify a person or a description of persons authorised to grant licences, or

(b)provide for a person designated in the regulations to specify a person or a description of persons authorised to grant licences.

(3) The regulations must provide that, for a right to qualify as an orphan right, it is a requirement that the owner of the right has not been found after a diligent search made in accordance with the regulations.

(4) The regulations must provide for any licence:

(a) to have effect as if granted by the missing owner;

(b) not to give exclusive rights;

(5) The regulations may apply in a case where it is not known whether a performer’s right subsists, and references to a right, to a missing owner and to an interest of a missing owner are to be read as including references to a supposed right, owner or interest.

Extended collective licensing

1B.-

(1) The Secretary of State may by regulations provide for a licensing body that applies to the Secretary of State under the regulations to be authorised to grant licences to do, or authorise the doing of, acts to which section 182, 182A, 182B, 182C, 182CA, 183 or 184 applies in respect of a performance, where the right to authorise or prohibit the act is not owned by the body or a person on whose behalf the body acts.

(2) An authorisation must specify the acts to which any of those sections applies that the licensing body is authorised to license.

(3) The regulations must provide for the rights owner to have a right to limit or exclude the grant of licences by virtue of the regulations.

(4) The regulations must provide for any licence not to give exclusive rights.

General provision about licensing

1C.-

(1) This paragraph and paragraph 1D apply to regulations under paragraphs 1A and 1B.

(3) The regulations may specify other matters to be taken into account in any decision to be made under the regulations as to whether to authorise a person to grant licences.

(4) The regulations must provide for the treatment of any royalties or other sums paid in respect of a licence, including:

(a) the deduction of administrative costs;

(b) the period for which sums must be held;

(6) The regulations may include other provision for the purposes of authorisation and licensing, including in particular provision:

(a) for determining the rights and obligations of any person if a right ceases to qualify as an orphan right (or ceases to qualify by reference to any rights owner), or if a rights owner exercises the right referred to in paragraph 1B(3), while a licence is in force;

(b) about maintenance of registers and access to them;

(d) for a right conferred by section 205C to be treated as having been asserted under section 205D;

(e) for the payment of fees to cover administrative expenses.

1D.-

(1) The power to make regulations includes power:

(a) to make incidental, supplementary or consequential provision, including provision extending or restricting the jurisdiction of the Copyright Tribunal or conferring powers on it;

(b) to make transitional, transitory or saving provision;

(3) Regulations may make provision by reference to guidance issued from time to time by any person.

(4) The power to make regulations is exercisable by statutory instrument.

(5) A statutory instrument containing regulations may not be made unless a draft of the instrument has been laid before and approved by a resolution of each House of Parliament.]

References and applications with respect to licensing schemes

2.- Paragraphs 3 to 8 (references and applications with respect to licensing schemes) apply to licensing schemes operated by licensing bodies in relation to a performer’s property rights which cover the performances of more than one performer, so far as they relate to licences for:

(a) copying a recording of the whole or any substantial part of a qualifying performance, F915 . . .

[F916

(aa) making such a recording available to the public in the way mentioned in section 182CA(1), or.]

(b) renting or lending copies of a recording to the public;

and in those paragraphs “licensing scheme” means a licensing scheme of any of those descriptions.

Reference of proposed licensing scheme to tribunal

3.-

(1)The terms of a licensing scheme proposed to be operated by a licensing body may be referred to the Copyright Tribunal by an organisation claiming to be representative of persons claiming that they require licences in cases of a description to which the scheme would apply, either generally or in relation to any description of case.

(2) The Tribunal shall first decide whether to entertain the reference, and may decline to do so on the ground that the reference is premature.

(3) If the Tribunal decides to entertain the reference it shall consider the matter referred and make such order, either confirming or varying the proposed scheme, either generally or so far as it relates to cases of the description to which the reference relates, as the Tribunal may determine to be reasonable in the circumstances.

(4) The order may be made so as to be in force indefinitely or for such period as the Tribunal may determine.

Reference of licensing scheme to tribunal

4.-

(1) If while a licensing scheme is in operation a dispute arises between the operator of the scheme and:

(a) a person claiming that he requires a licence in a case of a description to which the scheme applies, or

(b) an organisation claiming to be representative of such persons,

that person or organisation may refer the scheme to the Copyright Tribunal in so far as it relates to cases of that description.

(2) A scheme which has been referred to the Tribunal under this paragraph shall remain in operation until proceedings on the reference are concluded.

(4) The order may be made so as to be in force indefinitely or for such period as the Tribunal may determine.

Further reference of scheme to tribunal

5.-

(1) Where the Copyright Tribunal has on a previous reference of a licensing scheme under paragraph 3 or 4, or under this paragraph, made an order with respect to the scheme, then, while the order remains in force:

(a) the operator of the scheme,

(b) a person claiming that he requires a licence in a case of the description to which the order applies, or

may refer the scheme again to the Tribunal so far as it relates to cases of that description.

(2) A licensing scheme shall not, except with the special leave of the Tribunal, be referred again to the Tribunal in respect of the same description of cases:

(a) within twelve months from the date of the order on the previous reference, or

(b) if the order was made so as to be in force for 15 months or less, until the last three months before the expiry of the order.

(3) A scheme which has been referred to the Tribunal under this paragraph shall remain in operation until p roceedings on the reference are concluded.

(5) The order may be made so as to be in force indefinitely or for such period as the Tribunal may determine.

Application for grant of licence in connection with licensing scheme

6.-

(2) A person who claims, in a case excluded from a licensing scheme, that the operator of the scheme either:

(b) proposes terms for a licence which are unreasonable,

may apply to the Copyright Tribunal.

(3) A case shall be regarded as excluded from a licensing scheme for the purposes of sub-paragraph (2) if:

(a) the scheme provides for the grant of licences subject to terms excepting matters from the licence and the case falls within such an exception, or

(b) the case is so similar to those in which licences are granted under the scheme that it is unreasonable that it should not be dealt with in the same way.

(5) The order may be made so as to be in force indefinitely or for such period as the Tribunal may determine.

Application for review of order as to entitlement to licence

7.-

(1) Where the Copyright Tribunal has made an order under paragraph 6 that a person is entitled to a licence under a licensing scheme, the operator of the scheme or the original applicant may apply to the Tribunal to review its order.

(2) An application shall not be made, except with the special leave of the Tribunal:

(a)within twelve months from the date of the order, or of the decision on a previous application under this paragraph, or

(b) if the order was made so as to be in force for 15 months or less, or as a result of the decision on a previous application under this paragraph is due to expire within 15 months of that decision, until the last three months before the expiry date.

Effect of order of tribunal as to licensing scheme

8.-

(1) A licensing scheme which has been confirmed or varied by the Copyright Tribunal:

(a) under paragraph 3 (reference of terms of proposed scheme), or

(b) under paragraph 4 or 5 (reference of existing scheme to Tribunal),

shall be in force or, as the case may be, remain in operation, so far as it relates to the description of case in respect of which the order was made, so long as the order remains in force.

(2) While the order is in force a person who in a case of a class to which the order applies:

(b) complies with the other terms applicable to such a licence under the scheme,

shall be in the same position as regards infringement of performers’ property rights as if he had at all material times been the holder of a licence granted by the rights owner in question in accordance with the scheme.

If such a direction is made:

(a) any necessary repayments, or further payments, shall be made in respect of charges already paid, and

(b) the reference in sub-paragraph (2)(a) to the charges payable under the scheme shall be construed as a reference to the charges so payable by virtue of the order. No such direction may be made where sub-paragraph (4) below applies.

(4) An order of the Tribunal under paragraph 4 or 5 made with respect to a scheme which is certified for any purpose under paragraph 16 has effect, so far as it varies the scheme by reducing the charges payable for licences, from the date on which the reference was made to the Tribunal.

(5) Where the Tribunal has made an order under paragraph 6 (order as to entitlement to licence under licensing scheme) and the order remains in force, the person in whose favour the order is made shall if he:

(a) pays to the operator of the scheme any charges payable in accordance with the order or, if the amount cannot be ascertained, gives an undertaking to pay the charges when ascertained, and

(b) complies with the other terms specified in the order,

be in the same position as regards infringement of performers’ property rights as if he had at all material times been the holder of a licence granted by the rights owner in question on the terms specified in the order.

References and applications with respect to licensing by licensing bodies

9.- Paragraphs 10 to 13 (references and applications with respect to licensing by licensing bodies) apply to licences relating to a performer’s property rights which cover the performance of more than one performer granted by a licensing body otherwise than in pursuance of a licensing scheme, so far as the licences authorise:

(a) copying a recording of the whole or any substantial part of a qualifying performance, F917 . . .

[F918

(aa) making such a recording available to the public in the way mentioned in section 182CA(1), or.]

renting or lending copies of a recording to the public;

and references in those paragraphs to a licence shall be construed accordingly.

Reference to tribunal of proposed licence

10.-

(1) The terms on which a licensing body proposes to grant a licence may be referred to the Copyright Tribunal by the prospective licensee.

(2) The Tribunal shall first decide whether to entertain the reference, and may decline to do so on the ground that the reference is premature.

(3) If the Tribunal decides to entertain the reference it shall consider the terms of the proposed licence and make such order, either confirming or varying the terms as it may determine to be reasonable in the circumstances.

(4) The order may be made so as to be in force indefinitely or for such period as the Tribunal may determine.

Reference to tribunal of expiring licence

11.-

(2) Such an application may not be made until the last three months before the licence is due to expire.

(3) A licence in respect of which a reference has been made to the Tribunal shall remain in operation until proceedings on the reference are concluded.

(5) An order of the Tribunal under this paragraph may be made so as to be in force indefinitely or for such period as the Tribunal may determine.

Application for review of order as to licence

12.-

(1) Where the Copyright Tribunal has made an order under paragraph 10 or 11, the licensing body or the person entitled to the benefit of the order may apply to the Tribunal to review its order.

(2) An application shall not be made, except with the special leave of the Tribunal:

(a) within twelve months from the date of the order or of the decision on a previous application under this paragraph, or

(3) The Tribunal shall on an application for review confirm or vary its order as the Tribunal may determine to be reasonable in the circumstances.

Effect of order of tribunal as to licence

13.-

(1) Where the Copyright Tribunal has made an order under paragraph 10 or 11 and the order remains in force, the person entitled to the benefit of the order shall if he:

(a) pays to the licensing body any charges payable in accordance with the order or, if the amount cannot be ascertained, gives an undertaking to pay the charges when ascertained, and

(b) complies with the other terms specified in the order,

(2) The benefit of the order may be assigned:

(a) in the case of an order under paragraph 10, if assignment is not prohibited under the terms of the Tribunal’s order; and

(b)i n the case of an order under paragraph 11, if assignment was not prohibited under the terms of the original licence.

(3) The Tribunal may direct that an order under paragraph 10 or 11, or an order under paragraph 12 varying such an order, so far as it varies the amount of charges payable, has effect from a date before that on which it is made, but not earlier than the date on which the reference or application was made or, if later, on which the licence was granted or, as the case may be, was due to expire.

If such a direction is made:

(a) any necessary repayments, or further payments, shall be made in respect of charges already paid, and

(b) the reference in sub-paragraph (1)(a) to the charges payable in accordance with the order shall be construed, where the order is varied by a later order, as a reference to the charges so payable by virtue of the later order.

General considerations: unreasonable discrimination

14.-

(1) In determining what is reasonable on a reference or application under this Schedule relating to a licensing scheme or licence, the Copyright Tribunal shall have regard to:

(a) the availability of other schemes, or the granting of other licences, to other persons in similar circumstances, and

(b) the terms of those schemes or licences,

and shall exercise its powers so as to secure that there is no unreasonable discrimination between licensees, or prospective licensees, under the scheme or licence to which the reference or application relates and licensees under other schemes operated by, or other licences granted by, the same person.

(2) This does not affect the Tribunal’s general obligation in any case to have regard to all relevant circumstances.

Application to settle royalty or other sum payable for lending

15.-

(1) An application to settle the royalty or other sum payable in pursuance of paragraph 14A of Schedule 2 (lending of certain recordings) may be made to the Copyright Tribunal by the owner of a performer’s property rights or the person claiming to be treated as licensed by him.

(2) The Tribunal shall consider the matter and make such order as it may determine to be reasonable in the circumstances.

(4) An application under sub-paragraph (3) shall not, except with the special leave of the Tribunal, be made within twelve months from the date of the original order or of the order on a previous application under that sub-paragraph.

(5) An order under sub-paragraph (3) has effect from the date on which it is made or such later date as may be specified by the Tribunal.

Certification of licensing schemes

16.-

(1) A person operating or proposing to operate a licensing scheme may apply to the Secretary of State to certify the scheme for the purposes of [F919 paragraph F920 … 14A F921 … of Schedule 2 ( F920 … lending of certain recordings F921 … ) ] .

(2) The Secretary of State shall by order made by statutory instrument certify the scheme if he is satisfied that it:

(a) enables the works to which it relates to be identified with sufficient certainty by persons likely to require licences, and

(b) sets out clearly the charges (if any) payable and the other terms on which licences will be granted.

(3) The scheme shall be scheduled to the order and the certification shall come into operation for the purposes of [F922the relevant paragraph] of Schedule 2:

(a) on such date, not less than eight weeks after the order is made, as may be specified in the order, or

(b) if the scheme is the subject of a reference under paragraph 3 (reference of proposed scheme), any later date on which the order of the Copyright Tribunal under that paragraph comes into force or the reference is withdrawn.

(4) A variation of the scheme is not effective unless a corresponding amendment of the order is made; and the Secretary of State shall make such an amendment in the case of a variation ordered by the Copyright Tribunal on a reference under paragraph 3, 4 or 5, and may do so in any other case if he thinks fit.

(5) The order shall be revoked if the scheme ceases to be operated and may be revoked if it appears to the Secretary of State that it is no longer being operated according to its terms.

Powers exercisable in consequence of competition report

17.-

[F923

(1) Sub-paragraph (1A) applies where whatever needs to be remedied, mitigated or prevented by the Secretary of State, [F924 or (as the case may be) the Competition and Markets Authority ] under section 12(5) of the Competition Act 1980 or section 41(2), 55(2), 66(6), 75(2), 83(2), 138(2), 147(2) [F925 , 147A(2) ] or 160(2) of, or paragraph 5(2) or 10(2) of Schedule 7 to, the Enterprise Act 2002 (powers to take remedial action following references to the [F926 Competition and Markets Authority ] in connection with public bodies and certain other persons, mergers or market investigations etc. ) consists of or includes:

(a) conditions in licences granted by the owner of a performer’s property rights restricting the use to which a recording may be put by the licensee or the right of the owner to grant other licenses, or

(b) a refusal of an owner of a performer’s property rights to grant licences on reasonable terms.

(3) [F927 The Secretary of State[F928or (as the case may be) the Competition and Markets Authority.]] shall only exercise the powers available by virtue of this paragraph if he [F929or it] is satisfied that to do so does not contravene any Convention relating to performers’ rights to which the United Kingdom is a party.

(4) The terms of a licence available by virtue of this paragraph shall, in default of agreement, be settled by the Copyright Tribunal on an application by the person requiring the licence; and terms so settled shall authorise the licensee to do everything in respect of which a licence is so available.

(5) Where the terms of a licence are settled by the Tribunal, the licence has effect from the date on which the application to the Tribunal was made.

Section 272.- SCHEDULE 3.- Registered designs: minor and consequential amendments of 1949 Act

Section 3: proceedings for registration

F9301. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 4: registration of same design in respect of other articles, etc.

F9312. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 5: provisions for secrecy of certain designs

3.-

(1) Section 5 of the Registered Designs Act 1949 is amended as follows.

(2) For “a competent authority” or “the competent authority”, wherever occurring, substitute “ the Secretary of State ”; and in subsection (3)(c) for “that authority” substitute “ he ”.

(3) For subsection (2) substitute:

“(2)The Secretary of State shall by rules make provision for securing that where such directions are given:

(a)the representation or specimen of the design, and

(b)any evidence filed in support of the applicant’s contention that the appearance of an article is material (for the purposes of section 1(3) of this Act),shall not be open to public inspection at the Patent Office during the continuance in force of the directions.”

F932

(4). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(5) Omit subsection (5).

Section 6: provisions as to confidential disclosure, etc.

F933

4.-. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 9: exemption of innocent infringer from liability for damages

5.-In section 9 of the M61Registered Designs Act 1949 (exemption of innocent infringer from liability for damages), in subsections (1) and (2) for “copyright in a registered design” substitute “ the right in a registered design ”.

Section 11: cancellation of registration

F934

6.-. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 14: registration where application has been made in convention country

7.- In section 14 of the Registered Designs Act 1949 (registration where application has been made in convention country), for subsections (2) and (3) substitute:

“(2)Where an application for registration of a design is made by virtue of this section, the application shall be treated, for the purpose of determining whether that or any other design is new, as made on the date of the application for protection in the convention country or, if more than one such application was made, on the date of the first such application.

(3)Subsection (2) shall not be construed as excluding the power to give directions under section 3(4) of this Act in relation to an application made by virtue of this section.”.

Section 15: extension of time for application under s.14 in certain cases

8.- In section 15(1) of the M62Registered Designs Act 1949 (power to make rules empowering registrar to extend time for applications under s.14) for “the Board of Trade are satisfied” substitute “ the Secretary of State is satisfied ” and for “they” substitute “ he ”.

Section 16: protection of designs communicated under international agreements

F935

9.-. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 19: registration of assignments, &c.

10.-In section 19 of the Registered Designs Act 1949 (registration of assignments, &c.), after subsection (3) insert:

“(3A)Where design right subsists in a registered design, the registrar shall not register an interest under subsection (3) unless he is satisfied that the person entitled to that interest is also entitled to a corresponding interest in the design right.

(3B) Where design right subsists in a registered design and the proprietor of the registered design is also the design right owner, an assignment of the design right shall be taken to be also an assignment of the right in the registered design, unless a contrary intention appears.”.

Section 20: rectification of the register

11.-In section 20 of the Registered Designs Act 1949 (rectification of the register), after subsection (4) add:

“(5) A rectification of the register under this section has effect as follows:

(a) an entry made has effect from the date on which it should have been made,

(b) an entry varied has effect as if it had originally been made in its varied form, and

Section 22: inspection of registered designs

12.-

(1) Section 22 of the Registered Designs Act 1949 (inspection of registered designs) is amended as follows.

(2) For subsection (1) substitute:

“(1) Where a design has been registered under this Act, there shall be open to inspection at the Patent Office on and after the day on which the certificate of registration is issued:

(a) the representation or specimen of the design, and

(b) any evidence filed in support of the applicant’s contention that the appearance of an article is material (for the purposes of section 1(3) of this Act).This subsection has effect subject to the following provisions of this section and to any rules made under section 5(2) of this Act.”.

(3) In subsection (2), subsection (3) (twice) and subsection (4) for “representation or specimen of the design” substitute “ representation, specimen or evidence ”.

Section 23: information as to existence of right in registered design

13.-For section 23 of the M63Registered Designs Act 1949 (information as to existence of right in registered design) substitute:

“23 Information as to existence of right in registered design.

On the request of a person furnishing such information as may enable the registrar to identify the design, and on payment of the prescribed fee, the registrar shall inform him:

(a) whether the design is registered and, if so, in respect of what articles, and

(b) whether any extension of the period of the right in the registered design has been granted,and shall state the date of registration and the name and address of the registered proprietor.”.

Section 25: certificate of contested validity of registration

14.- In section 25 of the Registered Designs Act 1949 (certificate of contested validity of registration), in subsection (2) for “the copyright in the registered design”substitute “ the right in the registered design ”.

Section 26: remedy for groundless threats of infringement proceedings

15.-

(1)Section 26 of the Registered Designs Act 1949 (remedy for groundless threats of infringement proceedings) is amended as follows.

(2) In subsections (1) and (2) for “the copyright in a registered design” substitute “ the right in a registered design ”.

(3)After subsection (2) insert:

“(2A) Proceedings may not be brought under this section in respect of a threat to bring proceedings for an infringement alleged to consist of the making or importing of anything.”.

Section 27: the court

16.- For section 27 of the Registered Designs Act 1949 (the court) substitute:

“27 The court.

(1) In this Act “the court” means:

(a)in England and Wales the High Court or any patents county court having jurisdiction by virtue of an order under section 287 of the Copyright, Designs and Patents Act 1988,

(b)in Scotland, the Court of Session, and

(c)in Northern Ireland, the High Court.

(2) Provision may be made by rules of court with respect to proceedings in the High Court in England and Wales for references and applications under this Act to be dealt with by such judge of that court as the Lord Chancellor may select for the purpose.”.

Section 28: the Appeal Tribunal

17.-

(1) Section 28 of the Registered Designs Act 1949 (the Appeal Tribunal) is amended as follows.

(2) For subsection (2) (members of Tribunal) substitute:

“(2) The Appeal Tribunal shall consist of:

(a) one or more judges of the High Court nominated by the Lord Chancellor, and

(b) one judge of the Court of Session nominated by the Lord President of that Court.”.

3) In subsection (5) (costs), after “costs” (twice) insert “ or expenses ”, and for the words from “and any such order” to the end substitute:

“and any such order may be enforced:

(a) in England and Wales or Northern Ireland, in the same way as an order of the High Court;

(b) in Scotland, in the same way as a decree for expenses granted by the Court of Session.”.

(4) For subsection (10) (seniority of judges) substitute:

“(10) In this section “the High Court” means the High Court in England and Wales; and for the purposes of this section the seniority of judges shall be reckoned by reference to the dates on which they were appointed judges of that court or the Court of Session.”.

(5) The amendments to section 28 made by section 10(5) of the M64Administration of Justice Act 1970 (power to make rules as to right of audience) shall be deemed always to have extended to Northern Ireland.

Section 29: exercise of discretionary powers of registrar

18.- In section 29 of the M65 Registered Designs Act 1949 (exercise of discretionary powers of registrar) for “the registrar shall give” substitute “ rules made by the Secretary of State under this Act shall require the registrar to give ”.

Section 30: costs and security for costs

19.-For section 30 of the Registered Designs Act 1949 (costs and security for costs) substitute:

“30 Costs and security for costs.

(1) Rules made by the Secretary of State under this Act may make provision empowering the registrar, in any proceedings before him under this Act:

(a) to award any party such costs as he may consider reasonable, and

(b) to direct how and by what parties they are to be paid.

(2) Any such order of the registrar may be enforced:

(a) in England and Wales or Northern Ireland, in the same way as an order of the High Court;

(b) in Scotland, in the same way as a decree for expenses granted by the Court of Session.

(3) Rules made by the Secretary of State under this Act may make provision empowering the registrar to require a person, in such cases as may be prescribed, to give security for the costs of:

(a) an application for cancellation of the registration of a design,

(b) an application for the grant of a licence in respect of a registered design, or

(c) an appeal from any decision of the registrar under this Act,and enabling the application or appeal to be treated as abandoned in default of such security being given.”.

Section 31: evidence before registrar

20.- For section 31 of the M66Registered Designs Act 1949 (evidence before registrar) substitute:

“31 Evidence before registrar.

Rules made by the Secretary of State under this Act may make provision:

(a) as to the giving of evidence in proceedings before the registrar under this Act by affidavit or statutory declaration;

(b) conferring on the registrar the powers of an official referee of the Supreme Court as regards the examination of witnesses on oath and the discovery and production of documents; and

(c) applying in relation to the attendance of witnesses in proceedings before the registrar the rules applicable to the attendance of witnesses in proceedings before such a referee.”.

Section 32: power of registrar to refuse to deal with certain agents

21.- Section 32 of the Registered Designs Act 1949 (power of registrar to refuse to deal with certain agents) is repealed.

Section 33: offences under s.5 (secrecy of certain designs)

22.-

Section 33 of the Registered Designs Act 1949 (offences under s.5 (secrecy of certain designs)) is amended as follows.

In subsection (1), for paragraphs (a) and (b) substitute:

“(a) on conviction on indictment to imprisonment for a term not exceeding two years or a fine, or both;

(b) on summary conviction to imprisonment for a term not exceeding six months or a fine not exceeding the statutory maximum, or both.”.

(3)Omit subsection (2).

(4) The above amendments do not apply in relation to offences committed before the commencement of Part IV.

Section 34: falsification of register, &c.

23.-

(1) In section 34 of the Registered Designs Act 1949 (falsification of register, &c.) for “shall be guilty of a misdemeanour” substitute:“shall be guilty of an offence and liable:

(a) on conviction on indictment to imprisonment for a term not exceeding two years or a fine, or both;

(b) on summary conviction to imprisonment for a term not exceeding six months or a fine not exceeding the statutory maximum, or both.”.

(2) The above amendment does not apply in relation to offences committed before the commencement of Part IV.

Section 35: fine for falsely representing a design as registered

24.-

Section 35 of the M67Registered Designs Act 1949 (fine for falsely representing a design as registered) is amended as follows.

In subsection (1) for the words from “a fine not exceeding £50” substitute “ a fine not exceeding level 3 on the standard scale ”.

(3) In subsection (2):

(a) for “the copyright in a registered design” substitute “ the right in a registered design ”;

(b) for “subsisting copyright in the design” substitute “ subsisting right in the design under this Act ”; and

(4) The amendment in sub-paragraph (2) does not apply in relation to offences committed before the commencement of Part IV.

Section 35A: offence by body corporate – liability of officers

25.-

(1) In the Registered Designs Act 1949 after section 35 insert:

“35A Offence by body corporate: liability of officers.

(1) Where an offence under this Act committed by a body corporate is proved to have been committed with the consent or connivance of a director, manager, secretary or other similar officer of the body, or a person purporting to act in any such capacity, he as well as the body corporate is guilty of the offence and liable to be proceeded against and punished accordingly.

(2) In relation to a body corporate whose affairs are managed by its members “director” means a member of the body corporate.”.

(2) The above amendment does not apply in relation to offences committed before the commencement of Part IV.

Section 36: general power to make rules, &c.

26.-

(1) Section 36 of the Registered Designs Act 1949 (general power to make rules, &c.) is amended as follows.

(2) In subsection (1) for “the Board of Trade” and “the Board” substitute “ the Secretary of State ”, and for “as they think expedient” substitute “ as he thinks expedient ”.

(3) For the words in subsection (1) from “and in particular” to the end substitute the following subsections:

“(1A) Rules may, in particular, make provision:

(a) prescribing the form of applications for registration of designs and of any representations or specimens of designs or other documents which may be filed at the Patent Office, and requiring copies to be furnished of any such representations, specimens or documents;

(b) regulating the procedure to be followed in connection with any application or request to the registrar or in connection with any proceeding before him, and authorising the rectification of irregularities of procedure;

(d) regulating the keeping of the register of designs;

(e) authorising the publication and sale of copies of representations of designs and other documents in the Patent Office;

(f) prescribing anything authorised or required by this Act to be prescribed by rules.

(1B) The remuneration of an adviser appointed to assist the registrar shall be determined by the Secretary of State with the consent of the Treasury and shall be defrayed out of money provided by Parliament.”.

Section 37: provisions as to rules and Orders

27.-

(1) Section 37 of the M68Registered Designs Act 1949 (provisions as to rules and orders) is amended as follows.

(2) Omit subsection (1) (duty to advertise making of rules).

(3) In subsections (2), (3) and (4) for “the Board of Trade” substitute “ the Secretary of State ”.

Section 38: proceedings of the Board of Trade

28.- Section 38 of the Registered Designs Act 1949 (proceedings of the Board of Trade) is repealed.

Section 39: hours of business and excluded days

29.- In section 39 of the Registered Designs Act 1949 (hours of business and excluded days), in subsection (1) for “the Board of Trade” substitute “ the Secretary of State ”.

Section 40: fees

30.- In section 40 of the Registered Designs Act 1949 (fees) for “the Board of Trade” substitute “ the Secretary of State ”.

Section 44: interpretation

31.-

(1) In section 44 of the Registered Designs Act 1949 (interpretation), subsection (1) is amended as follows.

F936(2). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(3) At the appropriate place insert:

““author” in relation to a design, has the meaning given by section 2(3) and (4);”.

(4) Omit the definition of “copyright”.

F936(5). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(6) For the definition of “court” substitute:

““the court” shall be construed in accordance with section 27 of this Act;”.

(7) In the definition of “design” for “subsection (3) of section one of this Act” substitute “ section 1(1) of this Act ”.

(8) At the appropriate place insert:

““employee”, “employment” and “employer” refer to employment under a contract of service or of apprenticeship,”.

(9) Omit the definition of “Journal”.

(10) In the definition of “prescribed” for “the Board of Trade” substitute “ the Secretary of State ”.

Section 45: application to Scotland

32.- In section 45 of the M69Registered Designs Act 1949 (application to Scotland), omit paragraphs (1) and (2).

Section 46: application to Northern Ireland

33.-

(1) Section 46 of the Registered Designs Act 1949 (application to Northern Ireland) is amended as follows.

(2) Omit paragraphs (1) and (2).

(3) For paragraph (3) substitute:

“(3) References to enactments include enactments comprised in Northern Ireland legislation:”.

(4) After paragraph (3) insert:

“(3A) References to the Crown include the Crown in right of Her Majesty’s Government in Northern Ireland:”.

(5) In paragraph (4) for “a department of the Government of Northern Ireland” substitute “ a Northern Ireland department ”, and at the end add “ and in relation to a Northern Ireland department references to the Treasury shall be construed as references to the Department of Finance and Personnel ”.

Section 47: application to Isle of Man

34.-For section 47 of the Registered Designs Act 1949 (application to Isle of Man) substitute:

“47 Application to Isle of Man.

This Act extends to the Isle of Man, subject to any modifications contained in an Order made by Her Majesty in Council, and accordingly, subject to any such Order, references in this Act to the United Kingdom shall be construed as including the Isle of Man.”.

Section 47A: territorial waters and the continental shelf

35.- In the Registered Designs Act 1949, after section 47 insert:

“47A Territorial waters and the continental shelf.

(1) For the purposes of this Act the territorial waters of the United Kingdom shall be treated as part of the United Kingdom.

(2) This Act applies to things done in the United Kingdom sector of the continental shelf on a structure or vessel which is present there for purposes directly connected with the exploration of the sea bed or subsoil or the exploitation of their natural resources as it applies to things done in the United Kingdom.

(3) The United Kingdom sector of the continental shelf means the areas designated by order under section 1(7) of the Continental Shelf Act 1964.”.

Section 48: repeals, savings and transitional provisions

36.- In section 48 of the Registered Designs Act 1949 (repeals, savings and transitional provisions), omit subsection (1) (repeals).

Schedule 1: provisions as to Crown use of registered designs

37.-

(1) The First Schedule to the M70Registered Designs Act 1949 (provisions as to Crown use of registered designs) is amended as follows.

(2) In paragraph 2(1) after “copyright” insert “ or design right ”.

(3) In paragraph 3(1) omit “in such manner as may be prescribed by rules of court”.

(4) In paragraph 4(2) (definition of “period of emergency”) for the words from “the period ending” to “any other period” substitute “ a period ”.

(5) For paragraph 4(3) substitute:

“(3) No Order in Council under this paragraph shall be submitted to Her Majesty unless a draft of it has been laid before and approved by a resolution of each House of Parliament.”.

Schedule 2: enactments repealed

38.- Schedule 2 to the Registered Designs Act 1949 (enactments repealed) is repealed.

Section 273.- SCHEDULE 4.- The Registered Designs Act 1949 as amended Arrangement of Sections

Registrable designs and proceedings for registration

1 Designs registrable under Act.

2 Proprietorship of designs.

3 Proceedings for registration.

4 Registration of same design in respect of other articles.

5 Provision for secrecy of certain designs.

6 Provisions as to confidential disclosure, &c.

Effect of registration, &c.

7 Right given by registration.

8 Duration of right in registered design.

8A Restoration of lapsed right in design.

8B Effect of order for restoration of right.

9 Exemption of innocent infringer from liability for damages.

10 Compulsory licence in respect of registered design.

11 Cancellation of registration.

11A Powers exercisable for protection of the public interest.

11B Undertaking to take licence of right in infringement proceedings.

12 Use for services of the Crown.

International arrangements

13 Orders in Council as to convention countries.

14 Registration of design where application for protection in convention country has been made.

15 Extension of time for applications under s.14 in certain cases.

16 Protection of designs communicated under international agreements.

17 Register of designs.

18 Certificate of registration.

19 Registration of assignments, &c.

20 Rectification of register.

21 Power to correct clerical errors.

22 Inspection of registered designs.

23 Information as to existence of right in registered design.

24 ………………….. …

Legal proceedings and appeals

25 Certificate of contested validity of registration.

26 Remedy for groundless threats of infringement proceedings.

27 The court.

28 The Appeal Tribunal.

Powers and duties of registrar

29 Exercise of discretionary powers of registrar.

30 Costs and security for costs.

31 Evidence before registrar.

32 ………………….. …

33 Offences under s.5.

34 Falsification of register, &c.

35 Fine for falsely representing a design as registered.

35A Offence by body corporate: liability of officers.

Rules, &c.

36 General power of Secretary of State to make rules, &c.

37 Provisions as to rules and Orders.

38 ………………….. …

Supplemental

39 Hours of business and excluded days.

40 Fees.

41 Service of notices, &c., by post.

42 Annual report of registrar.

43 Savings.

44 Interpretation.

45 Application to Scotland.

46 Application to Northern Ireland.

47 Application to Isle of Man.

47A Territorial waters and the continental shelf.

48 Repeals, savings and transitional provisions.

49 Short title and commencement.

Schedules:

Schedule 1:Provisions as to the use of registered designs for the services of the Crown and as to rights of third parties in respect of such use.

Schedule 2:………………….. …

An Act to consolidate certain enactments relating to registered designs.

[16th December 1949]

Registrable designs and proceedings for registration

Designs registrable under Act.

1.-

(1) In this Act “design” means features of shape, configuration, pattern or ornament applied to an article by any industrial process, being features which in the finished article appeal to and are judged by the eye, but does not include:

(a) a method or principle of construction, or

(b) features of shape or configuration of an article which:

(i) are dictated solely by the function which the article has to perform, or

(ii) are dependent upon the appearance of another article of which the article is intended by the author of the design to form an integral part.

(2) A design which is new may, upon application by the person claiming to be the proprietor, be registered under this Act in respect of any article, or set of articles, specified in the application.

(3) A design shall not be registered in respect of an article if the appearance of the article is not material, that is, if aesthetic considerations are not normally taken into account to a material extent by persons acquiring or using articles of that description, and would not be so taken into account if the design were to be applied to the article.

(4) A design shall not be regarded as new for the purposes of this Act if it is the same as a design:

(a) registered in respect of the same or any other article in pursuance of a prior application, or

(b) published in the United Kingdom in respect of the same or any other article before the date of the application,or if it differs from such a design only in immaterial details or in features which are variants commonly used in the trade.

This subsection has effect subject to the provisions of sections 4, 6 and 16 of this Act.

(5) The Secretary of State may by rules provide for excluding from registration under this Act designs for such articles of a primarily literary or artistic character as the Secretary of State thinks fit.

Proprietorship of designs.

2.-

(1) The author of a design shall be treated for the purposes of this Act as the original proprietor of the design, subject to the following provisions.

(1A) Where a design is created in pursuance of a commission for money or money’s worth, the person commissioning the design shall be treated as the original proprietor of the design.

(1B) Where, in a case not falling within subsection (1A), a design is created by an employee in the course of his employment, his employer shall be treated as the original proprietor of the design.

(2) Where a design, or the right to apply a design to any article, becomes vested, whether by assignment, transmission or operation of law, in any person other than the original proprietor, either alone or jointly with the original proprietor, that other person, or as the case may be the original proprietor and that other person, shall be treated for the purposes of this Act as the proprietor of the design or as the proprietor of the design in relation to that article.

(3) In this Act the “author” of a design means the person who creates it.

(4) In the case of a design generated by computer in circumstances such that there is no human author, the person by whom the arrangements necessary for the creation of the design are made shall be taken to be the author.

Proceedings for registration.

3.-

(1) An application for the registration of a design shall be made in the prescribed form and shall be filed at the Patent Office in the prescribed manner.

(2) An application for the registration of a design in which design right subsists shall not be entertained unless made by the person claiming to be the design right owner.

(3) For the purpose of deciding whether a design is new, the registrar may make such searches, if any, as he thinks fit.

(4) The registrar may, in such cases as may be prescribed, direct that for the purpose of deciding whether a design is new an application shall be treated as made on a date earlier or later than that on which it was in fact made.

(5) The registrar may refuse an application for the registration of a design or may register the design in pursuance of the application subject to such modifications, if any, as he thinks fit; and a design when registered shall be registered as of the date on which the application was made or is treated as having been made.

(6) An application which, owing to any default or neglect on the part of the applicant, has not been completed so as to enable registration to be effected within such time as may be prescribed shall be deemed to be abandoned.

(7) An appeal lies from any decision of the registrar under this section.

Registration of same design in respect of other articles, etc.

4.-

(1) Where the registered proprietor of a design registered in respect of any article makes an application:

(a) for registration in respect of one or more other articles, of the registered design, or

(b) for registration in respect of the same or one or more other articles, of a design consisting of the registered design with modifications or variations not sufficient to alter the character or substantially to affect the identity thereof,the application shall not be refused and the registration made on that application shall not be invalidated by reason only of the previous registration or publication of the registered design:

Provided that the right in a design registered by virtue of this section shall not extend beyond the end of the period, and any extended period, for which the right subsists in the original registered design.

(2) Where any person makes an application for the registration of a design in respect of any article and either:

(a) that design has been previously registered by another person in respect of some other article; or

(b) the design to which the application relates consists of a design previously registered by another person in respect of the same or some other article with modifications or variations not sufficient to alter the character or substantially to affect the identity thereof,then, if at any time while the application is pending the applicant becomes the registered proprietor of the design previously registered, the foregoing provisions of this section shall apply as if at the time of making the application the applicant had been the registered proprietor of that design.

Provisions for secrecy of certain designs.

5.-

(1) Where, either before or after the commencement of this Act, an application for the registration of a design has been made, and it appears to the registrar that the design is one of a class notified to him by the Secretary of State as relevant for defence purposes, he may give directions for prohibiting or restricting the publication of information with respect to the design, or the communication of such information to any person or class of persons specified in the directions.

(2) The Secretary of State shall by rules make provision for securing that where such directions are given:

(a )the representation or specimen of the design, and

(b) any evidence filed in support of the applicant’s contention that the appearance of an article is material (for the purposes of section 1(3) of this Act),shall not be open to public inspection at the Patent Office during the continuance in force of the directions.

(3) Where the registrar gives any such directions as aforesaid, he shall give notice of the application and of the directions to the Secretary of State, and thereupon the following provisions shall have effect, that is to say::

(a) the Secretary of State shall, upon receipt of such notice, consider whether the publication of the design would be prejudicial to the defence of the realm and unless a notice under paragraph (c) of this subsection has previously been given by that authority to the registrar, shall reconsider that question before the expiration of nine months from the date of filing of the application for registration of the design and at least once in every subsequent year;

(b) for the purpose aforesaid, the Secretary of State may, at any time after the design has been registered or, with the consent of the applicant, at any time before the design has been registered, inspect the representation or specimen of the design, or any such evidence as is mentioned in subsection (2)(b) above, filed in pursuance of the application;

(c) if upon consideration of the design at any time it appears to the Secretary of State that the publication of the design would not, or would no longer, be prejudicial to the defence of the realm, he shall give notice to the registrar to that effect;

(d) on the receipt of any such notice the registrar shall revoke the directions and may, subject to such conditions, if any, as he thinks fit, extend the time for doing anything required or authorised to be done by or under this Act in connection with the application or registration, whether or not that time has previously expired.

(4) No person resident in the United Kingdom shall, except under the authority of a written permit granted by or on behalf of the registrar, make or cause to be made any application outside the United Kingdom for the registration of a design of any class prescribed for the purposes of this subsection unless:

(a) an application for registration of the same design has been made in the United Kingdom not less than six weeks before the application outside the United Kingdom; and

(b) either no directions have been given under subsection (1) of this section in relation to the application in the United Kingdom or all such directions have been revoked:

Provided that this subsection shall not apply in relation to a design for which an application for protection has first been filed in a country outside the United Kingdom by a person resident outside the United Kingdom.

… … … …

Provisions as to confidential disclosure, etc.

6.-

(1) An application for the registration of a design shall not be refused, and the registration of a design shall not be invalidated, by reason only of:

(a) the disclosure of the design by the proprietor to any other person in such circumstances as would make it contrary to good faith for that other person to use or publish the design;

(b) the disclosure of the design in breach of good faith by any person other than the proprietor of the design; or

(c) in the case of a new or original textile design intended for registration, the acceptance of a first and confidential order for goods bearing the design.

(2) An application for the registration of a design shall not be refused and the registration of a design shall not be invalidated by reason only:

(a) that a representation of the design, or any article to which the design has been applied, has been displayed, with the consent of the proprietor of the design, at an exhibition certified by the Secretary of State for the purposes of this subsection;

(b) that after any such display as aforesaid, and during the period of the exhibition, a representation of the design or any such article as aforesaid has been displayed by any person without the consent of the proprietor; or

(c) that a representation of the design has been published in consequence of any such display as is mentioned in paragraph (a) of this subsection,if the application for registration of the design is made not later than six months after the opening of the exhibition.

(3) An application for the registration of a design shall not be refused, and the registration of a design shall not be invalidated, by reason only of the communication of the design by the proprietor thereof to a government department or to any person authorised by a government department to consider the merits of the design, or of anything done in consequence of such a communication.

(4) Where an application is made by or with the consent of the owner of copyright in an artistic work for the registration of a corresponding design, the design shall not be treated for the purposes of this Act as being other than new by reason only of any use previously made of the artistic work, subject to subsection (5).

(5) Subsection (4) does not apply if the previous use consisted of or included the sale, letting for hire or offer or exposure for sale or hire of articles to which had been applied industrially:

(a) the design in question, or

(b) a design differing from it only in immaterial details or in features which are variants commonly used in the trade,and that previous use was made by or with the consent of the copyright owner.

(6) The Secretary of State may make provision by rules as to the circumstances in which a design is to be regarded for the purposes of this section as “applied industrially” to articles, or any description of articles.

Effect of registration, &c.

Right given by registration.

7.-

(1) The registration of a design under this Act gives the registered proprietor the exclusive right:

(a) to make or import:

(i) for sale or hire, or

(ii) for use for the purposes of a trade or business, or

(b) to sell, hire or offer or expose for sale or hire,an article in respect of which the design is registered and to which that design or a design not substantially different from it has been applied.

(2) The right in the registered design is infringed by a person who without the licence of the registered proprietor does anything which by virtue of subsection (1) is the exclusive right of the proprietor.

(3)The right in the registered design is also infringed by a person who, without the licence of the registered proprietor makes anything for enabling any such article to be made, in the United Kingdom or elsewhere, as mentioned in subsection (1).

(4) The right in the registered design is also infringed by a person who without the licence of the registered proprietor:

(a) does anything in relation to a kit that would be an infringement if done in relation to the assembled article (see subsection (1)), or

(b) makes anything for enabling a kit to be made or assembled, in the United Kingdom or elsewhere, if the assembled article would be such an article as is mentioned in subsection (1); and for this purpose a “kit” means a complete or substantially complete set of components intended to be assembled into an article.

(5) No proceedings shall be taken in respect of an infringement committed before the date on which the certificate of registration of the design under this Act is granted.

(6) The right in a registered design is not infringed by the reproduction of a feature of the design which, by virtue of section 1(1)(b), is left out of account in determining whether the design is registrable.

Duration of right in registered design.

8.-

(1) The right in a registered design subsists in the first instance for a period of five years from the date of the registration of the design.

(a) anything done under or in relation to the right during that further period shall be treated as valid,

(b) an act which would have constituted an infringement of the right if it had not expired shall be treated as an infringement, and

(c) an act which would have constituted use of the design for the services of the Crown if the right had not expired shall be treated as such use.

(5) Where it is shown that a registered design:

(a) was at the time it was registered a corresponding design in relation to an artistic work in which copyright subsists, and

(6) The above provisions have effect subject to the proviso to section 4(1) (registration of same design in respect of other articles, &c.).

Restoration of lapsed right in design.

8A.-

(3) Notice of the application shall be published by the registrar in the prescribed manner.

(6) Rules altering the period prescribed for the purposes of subsection (1) may contain such transitional provisions and savings as appear to the Secretary of State to be necessary or expedient.

Effect of order for restoration of right.

8B.-

(1) The effect of an order under section 8A for the restoration of the right in a registered design is as follows.

(2) Anything done under or in relation to the right during the period between expiry and restoration shall be treated as valid.

(3) Anything done during that period which would have constituted an infringement if the right had not expired shall be treated as an infringement:

(a) if done at a time when it was possible for an application for extension to be made under section 8(4); or

(b) if it was a continuation or repetition of an earlier infringing act.

(4) If after it was no longer possible for such an application for extension to be made, and before publication of notice of the application for restoration, a person:

(a) began in good faith to do an act which would have constituted an infringement of the right in the design if it had not expired, or

(5) If the act was done, or the preparations were made, in the course of a business, the person entitled to the right conferred by subsection (4) may:

(a) authorise the doing of that act by any partners of his for the time being in that business, and

(7) The above provisions apply in relation to the use of a registered design for the services of the Crown as they apply in relation to infringement of the right in the design.

Exemption of innocent infringer from liability for damages.

9.-

(1) In proceedings for the infringement of the right in a registered design damages shall not be awarded against a defendant who proves that at the date of the infringement he was not aware, and had no reasonable ground for supposing, that the design was registered; and a person shall not be deemed to have been aware or to have had reasonable grounds for supposing as aforesaid by reason only of the marking of an article with the word “registered” or any abbreviation thereof, or any word or words expressing or implying that the design applied to the article has been registered, unless the number of the design accompanied the word or words or the abbreviation in question.

(2) Nothing in this section shall affect the power of the court to grant an injunction in any proceedings for infringement of the right in a registered design.

Compulsory licence in respect of registered design.

10.-

(1) At any time after a design has been registered any person interested may apply to the registrar for the grant of a compulsory licence in respect of the design on the ground that the design is not applied in the United Kingdom by any industrial process or means to the article in respect of which it is registered to such an extent as is reasonable in the circumstances of the case; and the registrar may make such order on the application as he thinks fit.

(2) An order for the grant of a licence shall, without prejudice to any other method of enforcement, have effect as if it were a deed executed by the registered proprietor and all other necessary parties, granting a licence in accordance with the order.

(3) No order shall be made under this section which would be at variance with any treaty, convention, arrangement or engagement applying to the United Kingdom and any convention country.

(4) An appeal shall lie from any order of the registrar under this section.

Cancellation of registration.

11.-

(1) The registrar may, upon a request made in the prescribed manner by the registered proprietor, cancel the registration of a design.

(2) At any time after a design has been registered any person interested may apply to the registrar for the cancellation of the registration of the design on the ground that the design was not, at the date of the registration thereof, new…, or on any other ground on which the registrar could have refused to register the design; and the registrar may make such order on the application as he thinks fit.

(3) At any time after a design has been registered, any person interested may apply to the registrar for the cancellation of the registration on the ground that:

(a) the design was at the time it was registered a corresponding design in relation to an artistic work in which copyright subsisted, and

(b) the right in the registered design has expired in accordance with section 8(4) of this Act (expiry of right in registered design on expiry of copyright in artistic work);and the registrar may make such order on the application as he thinks fit.

(4) A cancellation under this section takes effect:

(a) in the case of cancellation under subsection (1), from the date of the registrar’s decision,

(b) in the case of cancellation under subsection (2), from the date of registration,

(c) in the case of cancellation under subsection (3), from the date on which the right in the registered design expired,or, in any case, from such other date as the registrar may direct.

(5) An appeal lies from any order of the registrar under this section.

Powers exercisable for protection of the public interest.

11A.-

(1) Where a report of the Monopolies and Mergers Commission has been laid before Parliament containing conclusions to the effect:

(a) on a monopoly reference, that a monopoly situation exists and facts found by the Commission operate or may be expected to operate against the public interest,

(c) on a competition reference, that a person was engaged in an anti-competitive practice which operated or may be expected to operate against the public interest, or

(2) Before making an application the appropriate Minister or Ministers shall publish, in such manner as he or they think appropriate, a notice describing the nature of the proposed application and shall consider any representations which may be made within 30 days of such publication by persons whose interests appear to him or them to be affected.

(3) If on an application under this section it appears to the registrar that the matters specified in the Commission’s report as being those which in the Commission’s opinion operate, or operated or may be expected to operate, against the public interest include:

(a) conditions in licences granted in respect of a registered design by its proprietor restricting the use of the design by the licensee or the right of the proprietor to grant other licences, or

(5) Where the terms of a licence are settled by the registrar, the licence has effect from the date on which the application to him was made.

(6) An appeal lies from any order of the registrar under this section.

(7) In this section “the appropriate Minister or Ministers” means the Minister or Ministers to whom the report of the Monopolies and Mergers Commission was made.

Undertaking to take licence of right in infringement proceedings.

11B.-

(a) no injunction shall be granted against him, and

(2) An undertaking may be given at any time before final order in the proceedings, without any admission of liability.

(3) Nothing in this section affects the remedies available in respect of an infringement committed before licences of right were available.

Use for services of the Crown.

12.-The provisions of the First Schedule to this Act shall have effect with respect to the use of registered designs for the services of the Crown and the rights of third parties in respect of such use.

International Arrangements

Orders in Council as to convention countries.

(1) His Majesty may, with a view to the fulfilment of a treaty, convention, arrangement or engagement, by Order in Council declare that any country specified in the Order is a convention country for the purposes of this Act:

Provided that a declaration may be made as aforesaid for the purposes either of all or of some only of the provisions of this Act, and a country in the case of which a declaration made for the purposes of some only of the provisions of this Act is in force shall be deemed to be a convention country for the purposes of those provisions only.

(2) His Majesty may by Order in Council direct that any of the Channel Islands, any colony,… shall be deemed to be a convention country for the purposes of all or any of the provisions of this Act; and an Order made under this subsection may direct that any such provisions shall have effect, in relation to the territory in question, subject to such conditions or limitations, if any, as may be specified in the Order.

(3) For the purposes of subsection (1) of this section, every colony, protectorate, territory subject to the authority or under the suzerainty of another country, and territory administered by another country… under the trusteeship system of the United Nations, shall be deemed to be a country in the case of which a declaration may be made under that subsection.

Registration of design where application for protection in convention country has been made.

14.-

(1) An application for registration of a design in respect of which protection has been applied for in a convention country may be made in accordance with the provisions of this Act by the person by whom the application for protection was made or his personal representative or assignee:

Provided that no application shall be made by virtue of this section after the expiration of six months from the date of the application for protection in a convention country or, where more than one such application for protection has been made, from the date of the first application.

(2) Where an application for registration of a design is made by virtue of this section, the application shall be treated, for the purpose of determining whether that or any other design is new, as made on the date of the application for protection in the convention country or, if more than one such application was made, on the date of the first such application.

(3) Subsection (2) shall not be construed as excluding the power to give directions under section 3(4) of this Act in relation to an application made by virtue of this section.

(4) Where a person has applied for protection for a design by an application which:

(a) in accordance with the terms of a treaty subsisting between two or more convention countries, is equivalent to an application duly made in any one of those convention countries; or

(b) in accordance with the law of any convention country, is equivalent to an application duly made in that convention country,he shall be deemed for the purposes of this section to have applied in that convention country.

Extension of time for applications under s.14 in certain cases.

15.-

(1) If the Secretary of State is satisfied that provision substantially equivalent to the provision to be made by or under this section has been or will be made under the law of any convention country, he may make rules empowering the registrar to extend the time for making application under subsection (1) of section 14 of this Act for registration of a design in respect of which protection has been applied for in that country in any case where the period specified in the proviso to that subsection expires during a period prescribed by the rules.

(2) Rules made under this section:

(a) may, where any agreement or arrangement has been made between His Majesty’s Government in the United Kingdom and the government of the convention country for the supply or mutual exchange of information or articles, provide, either generally or in any class of case specified in the rules, that an extension of time shall not be granted under this section unless the design has been communicated in accordance with the agreement or arrangement;

(b) may, either generally or in any class of case specified in the rules, fix the maximum extension which may be granted under this section;

(d) may empower the registrar to extend, in relation to an application made by virtue of this section, the time limited by or under the foregoing provisions of this Act for doing any act, subject to such conditions, if any, as may be imposed by or under the rules;

(e) may provide for securing that the rights conferred by registration on an application made by virtue of this section shall be subject to such restrictions or conditions as may be specified by or under the rules and in particular to restrictions and conditions for the protection of persons (including persons acting on behalf of His Majesty) who, otherwise than as the result of a communication made in accordance with such an agreement or arrangement as is mentioned in paragraph (a) of this subsection, and before the date of the application in question or such later date as may be allowed by the rules, may have imported or made articles to which the design is applied or may have made any application for registration of the design.

Protection of designs communicated under international agreements.

16.-

(1) Subject to the provisions of this section, the Secretary of State may make rules for securing that, where a design has been communicated in accordance with an agreement or arrangement made between His Majesty’s Government in the United Kingdom and the government of any other country for the supply or mutual exchange of information or articles,:

(a) an application for the registration of the design made by the person from whom the design was communicated or his personal representative or assignee shall not be prejudiced, and the registration of the design in pursuance of such an application shall not be invalidated, by reason only that the design has been communicated as aforesaid or that in consequence thereof:

(i) the design has been published or applied, or

(ii) an application for registration of the design has been made by any other person, or the design has been registered on such an application;

(b) any application for the registration of a design made in consequence of such a communication as aforesaid may be refused and any registration of a design made on such an application may be cancelled.

(2) Rules made under subsection (1) of this section may provide that the publication or application of a design, or the making of any application for registration thereof shall, in such circumstances and subject to such conditions or exceptions as may be prescribed by the rules, be presumed to have been in consequence of such a communication as is mentioned in that subsection.

(3) The powers of the Secretary of State under this section, so far as they are exercisable for the benefit of persons from whom designs have been communicated to His Majesty’s Government in the United Kingdom by the government of any other country, shall only be exercised if and to the extent that the Secretary of State is satisfied that substantially equivalent provision has been or will be made under the law of that country for the benefit of persons from whom designs have been communicated by His Majesty’s Government in the United Kingdom to the government of that country.

(4) References in the last foregoing subsection to the communication of a design to or by His Majesty’s Government or the government of any other country shall be construed as including references to the communication of the design by or to any person authorised in that behalf by the government in question.

17.-

(1) The registrar shall maintain the register of designs, in which shall be entered:

(a) the names and addresses of proprietors of registered designs;

(b) notices of assignments and of transmissions of registered designs; and

(2) No notice of any trust, whether express, implied or constructive, shall be entered in the register of designs, and the registrar shall not be affected by any such notice.

(3) The register need not be kept in documentary form.

(4) Subject to the provisions of this Act and to rules made by the Secretary of State under it, the public shall have a right to inspect the register at the Patent Office at all convenient times.

(5) Any person who applies for a certified copy of an entry in the register or a certified extract from the register shall be entitled to obtain such a copy or extract on payment of a fee prescribed in relation to certified copies and extracts; and rules made by the Secretary of State under this Act may provide that any person who applies for an uncertified copy or extract shall be entitled to such a copy or extract on payment of a fee prescribed in relation to uncertified copies and extracts.

(6) Applications under subsection (5) above or rules made by virtue of that subsection shall be made in such manner as may be prescribed.

(7) In relation to any portion of the register kept otherwise than in documentary form:

(a) the right of inspection conferred by subsection (4) above is a right to inspect the material on the register; and

(b) the right to a copy or extract conferred by subsection (5) above or rules is a right to a copy or extract in a form in which it can be taken away and in which it is visible and legible.

(8) Subject to subsection (11) below, the register shall be prima facie evidence of anything required or authorised to be entered in it and in Scotland shall be sufficient evidence of any such thing.

(9) A certificate purporting to be signed by the registrar and certifying that any entry which he is authorised by or under this Act to make has or has not been made, or that any other thing which he is so authorised to do has or has not been done, shall be prima facie evidence, and in Scotland shall be sufficient evidence, of the matters so certified.

(10)Each of the following:

(a) a copy of an entry in the register or an extract from the register which is supplied under subsection (5) above;

(b) a copy or any representation, specimen or document kept in the Patent Office or an extract from any such document,which purports to be a certified copy or certified extract shall, subject to subsection (11) below, be admitted in evidence without further proof and without production of any original; and in Scotland such evidence shall be sufficient evidence.

(11) In the application of this section to England and Wales nothing in it shall be taken as detracting from section 69 or 70 of the Police and Criminal Evidence Act 1984 or any provision made by virtue of either of them.

(12) In this section “certified copy” and “certified extract” means a copy and extract certified by the registrar and sealed with the seal of the Patent Office.

Certificate of registration.

18.-

(1) The registrar shall grant a certificate of registration in the prescribed form to the registered proprietor of a design when the design is registered.

(2) The registrar may, in a case where he is satisfied that the certificate of registration has been lost or destroyed, or in any other case in which he thinks it expedient, furnish one or more copies of the certificate.

Registration of assignments, etc.

19.-

(1) Where any person becomes entitled by assignment, transmission or operation of law to a registered design or to a share in a registered design, or becomes entitled as mortgagee, licensee or otherwise to any other interest in a registered design, he shall apply to the registrar in the prescribed manner for the registration of his title as proprietor or co-proprietor or, as the case may be, of notice of his interest, in the register of designs.

(2) Without prejudice to the provisions of the foregoing subsection, an application for the registration of the title of any person becoming entitled by assignment to a registered design or a share in a registered design, or becoming entitled by virtue of a mortgage, licence or other instrument to any other interest in a registered design, may be made in the prescribed manner by the assignor, mortgagor, licensor or other party to that instrument, as the case may be.

(3) Where application is made under this section for the registration of the title of any person, the registrar shall, upon proof of title to his satisfaction:

(a) where that person is entitled to a registered design or a share in a registered design, register him in the register of designs as proprietor or co-proprietor of the design, and enter in that register particulars of the instrument or event by which he derives title; or

(b) where that person is entitled to any other interest in the registered design, enter in that register notice of his interest, with particulars of the instrument (if any) creating it.

(3A) Where design right subsists in a registered design, the registrar shall not register an interest under subsection (3) unless he is satisfied that the person entitled to that interest is also entitled to a corresponding interest in the design right.

(4) Subject to any rights vested in any other person of which notice is entered in the register of designs, the person or persons registered as proprietor of a registered design shall have power to assign, grant licences under, or otherwise deal with the design, and to give effectual receipts for any consideration for any such assignment, licence or dealing.

Provided that any equities in respect of the design may be enforced in like manner as in respect of any other personal property.

(5) Except for the purposes of an application to rectify the register under the following provisions of this Act, a document in respect of which no entry has been made in the register of designs under subsection (3) of this section shall not be admitted in any court as evidence of the title of any person to a registered design or share of or interest in a registered design unless the court otherwise directs.

Rectification of register.

20.-

(1) The court may, on the application of any person aggrieved, order the register of designs to be rectified by the making of any entry therein or the variation or deletion of any entry therein.

(2) In proceedings under this section the court may determine any question which it may be necessary or expedient to decide in connection with the rectification of the register.

(3) Notice of any application to the court under this section shall be given in the prescribed manner to the registrar, who shall be entitled to appear and be heard on the application, and shall appear if so directed by the court.

(4) Any order made by the court under this section shall direct that notice of the order shall be served on the registrar in the prescribed manner; and the registrar shall, on receipt of the notice, rectify the register accordingly.

(5) A rectification of the register under this section has effect as follows:

(a) an entry made has effect from the date on which it should have been made,

(b) an entry varied has effect as if it had originally been made in its varied form, and

Power to correct clerical errors.

21.-

(1) The registrar may, in accordance with the provisions of this section, correct any error in an application for the registration or in the representation of a design, or any error in the register of designs.

(2) A correction may be made in pursuance of this section either upon a request in writing made by any person interested and accompanied by the prescribed fee, or without such a request.

(3) Where the registrar proposes to make any such correction as aforesaid otherwise than in pursuance of a request made under this section, he shall give notice of the proposal to the registered proprietor or the applicant for registration of the design, as the case may be, and to any other person who appears to him to be concerned, and shall give them an opportunity to be heard before making the correction.

Inspection of registered designs.

22.-

(1) Where a design has been registered under this Act, there shall be open to inspection at the Patent Office on and after the day on which the certificate of registration is issued:

(a) the representation or specimen of the design, and

(2) In the case of a design registered in respect of an article of any class prescribed for the purposes of this subsection, no representation, specimen or evidence filed in pursuance of the application shall, until the expiration of such period after the day on which the certificate of registration is issued as may be prescribed in relation to articles of that class, be open to inspection at the Patent Office except by the registered proprietor, a person authorised in writing by the registered proprietor, or a person authorised by the registrar or by the court:

Provided that where the registrar proposes to refuse an application for the registration of any other design on the ground that it is the same as the first-mentioned design or differs from that design only in immaterial details or in features which are variants commonly used in the trade, the applicant shall be entitled to inspect the representation or specimen of the first-mentioned design filed in pursuance of the application for registration of that design.

(3) In the case of a design registered in respect of an article of any class prescribed for the purposes of the last foregoing subsection, the representation, specimen or evidence shall not, during the period prescribed as aforesaid, be inspected by any person by virtue of this section except in the presence of the registrar or of an officer acting under him; and except in the case of an inspection authorised by the proviso to that subsection, the person making the inspection shall not be entitled to take a copy of the representation, specimen or evidence or any part thereof.

(4) Where an application for the registration of a design has been abandoned or refused, neither the application for registration nor any representation, specimen or evidence filed in pursuance thereof shall at any time be open to inspection at the Patent Office or be published by the registrar.

Information as to existence of right in registered design.

23.- On the request of a person furnishing such information as may enable the registrar to identify the design, and on payment of the prescribed fee, the registrar shall inform him:

(a) whether the design is registered and, if so, in respect of what articles, and

(b) whether any extension of the period of the right in the registered design has been granted,and shall state the date of registration and the name and address of the registered proprietor.

………………….. …

Legal proceedings and appeals

Certificate of contested validity of registration.

25.-

(1) If in any proceedings before the court the validity of the registration of a design is contested, and it is found by the court that the design is validly registered, the court may certify that the validity of the registration of the design was contested in those proceedings.

(2) Where any such certificate has been granted, then if in any subsequent proceedings before the court for infringement of the right in the registered design or for cancellation of the registration of the design, a final order or judgment is made or given in favour of the registered proprietor, he shall, unless the court otherwise directs, be entitled to his costs as between solicitor and client:

Provided that this subsection shall not apply to the costs of any appeal in any such proceedings as aforesaid.

Remedy for groundless threats of infringement proceedings.

(1) Where any person (whether entitled to or interested in a registered design or an application for registration of a design or not) by circulars, advertisements or otherwise threatens any other person with proceedings for infringement of the right in a registered design, any person aggrieved thereby may bring an action against him for any such relief as is mentioned in the next following subsection.

(2) Unless in any action brought by virtue of this section the defendant proves that the acts in respect of which proceedings were threatened constitute or, if done, would constitute, an infringement of the right in a registered design the registration of which is not shown by the plaintiff to be invalid, the plaintiff shall be entitled to the following relief, that is to say::

(a) a declaration to the effect that the threats are unjustifiable;

(b) an injunction against the continuance of the threats; and

(2A) Proceedings may not be brought under this section in respect of a threat to bring proceedings for an infringement alleged to consist of the making or importing of anything.

(3) For the avoidance of doubt it is hereby declared that a mere notification that a design is registered does not constitute a threat of proceedings within the meaning of this section.

The court.

27.-

(1) In this Act “the court” means:

(a) in England and Wales, the High Court or any patents county court having jurisdiction by virtue of an order under section 287 of the Copyright, Designs and Patents Act 1988,

(b) in Scotland, the Court of Session, and

The Appeal Tribunal.

28.-

(1) Any appeal from the registrar under this Act shall lie to the Appeal Tribunal.

(2) The Appeal Tribunal shall consist of:

(a) one or more judges of the High Court nominated by the Lord Chancellor, and

(b) one judge of the Court of Session nominated by the Lord President of that Court.

(2A) At any time when it consists of two or more judges, the jurisdiction of the Appeal Tribunal:

(a) where in the case of any particular appeal the senior of those judges so directs, shall be exercised in relation to that appeal by both of the judges, or (if there are more than two) by two of them, sitting together, and

(b) in relation to any appeal in respect of which no such direction is given, may be exercised by any one of the judges;and, in the exercise of that jurisdiction, different appeals may be heard at the same time by different judges.

(3) The expenses of the Appeal Tribunal shall be defrayed and the fees to be taken therein may be fixed as if the Tribunal were a court of the High Court.

(4) The Appeal Tribunal may examine witnesses on oath and administer oaths for that purpose.

(5) Upon any appeal under this Act the Appeal Tribunal may by order award to any party such costs or expenses as the Tribunal may consider reasonable and direct how and by what parties the costs or expenses are to be paid; and any such order may be enforced:

(a) in England and Wales or Northern Ireland, in the same way as an order of the High Court;

(b) in Scotland, in the same way as a decree for expenses granted by the Court of Session…………………… …

(7) Upon any appeal under this Act the Appeal Tribunal may exercise any power which could have been exercised by the registrar in the proceeding from which the appeal is brought.

(8) Subject to the foregoing provisions of this section the Appeal Tribunal may make rules for regulating all

matters relating to proceedings before it under this Act, including right of audience.

(8A) At any time when the Appeal Tribunal consists of two or more judges, the power to make rules under subsection (8) of this section shall be exercisable by the senior of those judges:

Provided that another of those judges may exercise that power if it appears to him that it is necessary for rules to be made and that the judge (or, if more than one, each of the judges) senior to him is for the time being prevented by illness, absence or otherwise from making them.

(9) An appeal to the Appeal Tribunal under this Act shall not be deemed to be a proceeding in the High Court.

(10) In this section “the High Court” means the High Court in England and Wales; and for the purposes of this section the seniority of judges shall be reckoned by reference to the dates on which they were appointed judges of that court or the Court of Session.

Powers and duties of Registrar

Exercise of discretionary powers of registrar.

29.-Without prejudice to any provisions of this Act requiring the registrar to hear any party to proceedings thereunder, or to give to any such party an opportunity to be heard, rules made by the Secretary of State under this Act shall require the registrar to give to any applicant for registration of a design an opportunity to be heard before exercising adversely to the applicant any discretion vested in the registrar by or under this Act.

Costs and security for costs.

30.-

(1) Rules made by the Secretary of State under this Act may make provision empowering the registrar, in anyproceedings before him under this Act:

(a) to award any party such costs as he may consider reasonable, and

(b) to direct how and by what parties they are to be paid.

(2) Any such order of the registrar may be enforced:

(a) in England and Wales or Northern Ireland, in the same way as an order of the High Court;

(b) in Scotland, in the same way as a decree for expenses granted by the Court of Session.

(3) Rules made by the Secretary of State under this Act may make provision empowering the registrar to require a person, in such cases as may be prescribed, to give security for the costs of:

(a) an application for cancellation of the registration of a design,

(b) an application for the grant of a licence in respect of a registered design, or

(c) an appeal from any decision of the registrar under this Act,and enabling the application or appeal to be treated as abandoned in default of such security being given.

Evidence before registrar.

31.- Rules made by the Secretary of State under this Act may make provision:

(a) as to the giving of evidence in proceedings before the registrar under this Act by affidavit or statutory declaration;

(b) conferring on the registrar the powers of an official referee of the [F937 Senior Courts] as regards the examination of witnesses on oath and the discovery and production of documents; and

(c) applying in relation to the attendance of witnesses in proceedings before the registrar the rules applicable to the attendance of witnesses in proceedings before such a referee…………………… …

Offences

Offences under s.5.

33.-

(1) If any person fails to comply with any direction given under section five of this Act or makes or causes to be made an application for the registration of a design in contravention of that section, he shall be guilty of an offence and liable:

(a) on conviction on indictment to imprisonment for a term not exceeding two years or a fine, or both;

(b) on summary conviction to imprisonment for a term not exceeding six months or a fine not exceeding the statutory maximum, or both…………………… …

Falsification of register, etc.

34.- If any person makes or causes to be made a false entry in the register of designs, or a writing falsely purporting to be a copy of an entry in that register, or produces or tenders or causes to be produced or tendered in evidence any such writing, knowing the entry or writing to be false, he shall be guilty of an offence and liable:

(a) on conviction on indictment to imprisonment for a term not exceeding two years or a fine, or both;

(b) on summary conviction to imprisonment for a term not exceeding six months or a fine not exceeding the statutory maximum, or both.

Fine for falsely representing a design as registered.

35.-

(1) If any person falsely represents that a design applied to any article sold by him is registered in respect of that article, he shall be liable on summary conviction to a fine not exceeding level 3 on the standard scale; and for the purposes of this provision a person who sells an article having stamped, engraved or impressed thereon or otherwise applied thereto the word “registered”, or any other word expressing or implying that the design applied to the article is registered, shall be deemed to represent that the design applied to the article is registered in respect of that article.

(2) If any person, after the right in a registered design has expired, marks any article to which the design has been applied with the word “registered”, or any word or words implying that there is a subsisting right in the design under this Act, or causes any such article to be so marked, he shall be liable on summary conviction to a fine not exceeding level 1 on the standard scale.

Offence by body corporate: liability of officers.

35A.-

(2) In relation to a body corporate whose affairs are managed by its members “director” means a member of the body corporate.

Rules, etc.

General power of Secretary of State to make rules, etc.

36.-

(1) Subject to the provisions of this Act, the Secretary of State may make such rules as he thinks expedient for regulating the business of the Patent Office in relation to designs and for regulating all matters by this Act placed under the direction or control of the registrar or the Secretary of State.

(1A).- Rules may, in particular, make provision:

(d) regulating the keeping of the register of designs;

(e) authorising the publication and sale of copies of representations of designs and other documents in the Patent Office;

(f) prescribing anything authorised or required by this Act to be prescribed by rules.

(2) Rules made under this section may provide for the establishment of branch offices for designs and may authorise any document or thing required by or under this Act to be filed or done at the Patent Office to be filed or done at the branch office at Manchester or any other branch office established in pursuance of the rules.

Provisions as to rules and Orders.

37.-

(1)………………….. …

(2)Any rules made by the Secretary of State in pursuance of section 15 or section 16 of this Act, and any order made, direction given, or other action taken under the rules by the registrar, may be made, given or taken so as to have effect as respects things done or omitted to be done on or after such date, whether before or after the coming into operation of the rules or of this Act, as may be specified in the rules.

(3) Any power to make rules conferred by this Act on the Secretary of State or on the Appeal Tribunal shall be exercisable by statutory instrument; and the Statutory Instruments Act 1946 shall apply to a statutory instrument containing rules made by the Appeal Tribunal in like manner as if the rules had been made by a Minister of the Crown.

(4) Any statutory instrument containing rules made by the Secretary of State under this Act shall be subject to annulment in pursuance of a resolution of either House of Parliament.

(5) Any Order in Council made under this Act may be revoked or varied by a subsequent Order in Council…………………… …

Supplemental

Hours of business and excluded days.

39.-

(1) Rules made by the Secretary of State under this Act may specify the hour at which the Patent Office shall be deemed to be closed on any day for purposes of the transaction by the public of business under this Act or of any class of such business, and may specify days as excluded days for any such purposes.

(2) Any business done under this Act on any day after the hour specified as aforesaid in relation to business of that class, or on a day which is an excluded day in relation to business of that class, shall be deemed to have been done on the next following day not being an excluded day; and where the time for doing anything under this Act expires on an excluded day, that time shall be extended to the next following day not being an excluded day.

Fees.

40.-There shall be paid in respect of the registration of designs and applications therefor, and in respect of other matters relating to designs arising under this Act, such fees as may be prescribed by rules made by the Secretary of State with the consent of the Treasury.

Service of notices, &c., by post.

41.- Any notice required or authorised to be given by or under this Act, and any application or other document so authorised or required to be made or filed, may be given, made or filed by post.

Annual report of registrar.

42.- The Comptroller-General of Patents, Designs and Trade Marks shall, in his annual report with respect to the execution of the Patents Act 1977, include a report with respect to the execution of this Act as if it formed a part of or was included in that Act.

Savings.

43.-

(1) Nothing in this Act shall be construed as authorising or requiring the registrar to register a design the use of which would, in his opinion, be contrary to law or morality.

(2) Nothing in this Act shall affect the right of the Crown or of any person deriving title directly or indirectly from the Crown to sell or use articles forfeited under the laws relating to customs or excise.

Interpretation.

44.-

(1) In this Act, except where the context otherwise requires, the following expressions have the meanings hereby respectively assigned by them, that is to say:

“Appeal Tribunal” means the Appeal Tribunal constituted and acting in accordance with section 28 of this Act as amended by the Administration of Justice Act 1969;

“article” means any article of manufacture and includes any part of an article if that part is made and sold separately;

“artistic work” has the same meaning as in Part I of the Copyright, Designs and Patents Act 1988;

“assignee” includes the personal representative of a deceased assignee, and references to the assignee of any person include references to the assignee of the personal representative or assignee of that person;

“author”, in relation to a design, has the meaning given by section 2(3) and (4);

………………….. …

“corresponding design”, in relation to an artistic work, means a design which if applied to an article would produce something which would be treated for the purposes of Part I of the Copyright, Designs and Patents Act 1988 as a copy of that work;

“the court” shall be construed in accordance with section 27 of this Act;

“design” has the meaning assigned to it by section 1(1) of this Act;

“employee”, “employment” and “employer” refer to employment under a contract of service or of apprenticeship;

………………….. …

“prescribed” means prescribed by rules made by the Secretary of State under this Act;

“proprietor” has the meaning assigned to it by section two of this Act;

“registered proprietor” means the person or persons for the time being entered in the register of designs as proprietor of the design;

“registrar” means the Comptroller-General of Patents Designs and Trade Marks;

“set of articles” means a number of articles of the same general character ordinarily on sale or intended to be used together, to each of which the same design, or the same design with modifications or variations not sufficient to alter the character or substantially to affect the identity thereof, is applied.

(2) Any reference in this Act to an article in respect of which a design is registered shall, in the case of a design registered in respect of a set of articles, be construed as a reference to any article of that set.

(3) Any question arising under this Act whether a number of articles constitute a set of articles shall be determined by the registrar; and notwithstanding anything in this Act any determination of the registrar under this subsection shall be final.

(4) For the purposes of subsection (1) of section 14 and of section 16 of this Act, the expression “personal representative”, in relation to a deceased person, includes the legal representative of the deceased appointed in any country outside the United Kingdom.

Application to Scotland.

45.- In the application of this Act to Scotland:

………………….. …

(3) The expression “injunction” means “interdict”; the expression “arbitrator”means “arbiter”;

the expression “plaintiff” means “pursuer”; the expression “defendant” means “defender”.

Application to Northern Ireland.

46.- In the application of this Act to Northern Ireland:

………………….. …

(3) References to enactments include enactments comprised in Northern Ireland legislation:

(3A) References to the Crown include the Crown in right of Her Majesty’s Government in Northern Ireland:

(4) References to a government department shall be construed as including references to a Northern Ireland department, and in relation to a Northern Ireland department references to the Treasury shall be construed as references to the Department of Finance and Personnel…. …………………..

Application to Isle of Man.

47.-This Act extends to the Isle of Man, subject to any modifications contained in an Order made by Her Majesty in Council, and accordingly, subject to any such Order, references in this Act to the United Kingdom shall be construed as including the Isle of Man.

Territorial waters and the continental shelf.

47A.-

(1) For the purposes of this Act the territorial waters of the United Kingdom shall be treated as part of the United Kingdom.

(2) This Act applies to things done in the United Kingdom sector of the continental shelf on a structure or vessel which is present there for purposes directly connected with theexploration of the sea bed or subsoil or the exploitation of their natural resources as it applies to things done in the United Kingdom.

(3) The United Kingdom sector of the continental shelf means the areas designated by order under section 1(7) of the Continental Shelf Act 1964.

Repeals, savings, and transitional provisions.

48.-

(1)………………….. …

(2) Subject to the provisions of this section, any Order in Council, rule, order, requirement, certificate, notice, decision, direction, authorisation, consent, application, request or thing made, issued, given or done under any enactment repealed by this Act shall, if in force at the commencement of this Act, and so far as it could have been made, issued, given or done under this Act, continue in force and have effect as if made, issued, given or done under the corresponding enactment of this Act.

(3) Any register kept under the Patents and Designs Act 1907 shall be deemed to form part of the corresponding register under this Act.

(4) Any design registered before the commencement of this Act shall be deemed to be registered under this Act in respect of articles of the class in which it is registered.

(5) Where, in relation to any design, the time for giving notice to the registrar under section 59 of the Patents and Designs Act 1907 expired before the commencement of this Act and the notice was not given, subsection (2) of section 6 of this Act shall not apply in relation to that design or any registration of that design.

(6) Any document referring to any enactment repealed by this Act shall be construed as referring to the corresponding enactment of this Act.

(7) Nothing in the foregoing provisions of this section shall be taken as prejudicing the operation of section 38 of the Interpretation Act 1889 (which relates to the effect of repeals).

Short title and commencement.

49.-

(1) This Act may be cited as the Registered Designs Act 1949.

(2) This Act shall come into operation on the first day of January, nineteen hundred and fifty, immediately after the coming into operation of the Patents and Designs Act 1949.

FIRST SCHEDULE.- Provisions as to the Use of Registered Designs for the Services of the Crown and as to the Rights of Third Parties in Respect of such Use

Use of registered designs for services of the Crown

1.-

(1) Notwithstanding anything in this Act, any Government department, and any person authorised in writing by a Government department, may use any registered design for the services of the Crown in accordance with the following provisions of this paragraph.

(2) If and so far as the design has before the date of registration thereof been duly recorded by or applied by or on behalf of a Government department otherwise than in consequence of the communication of the design directly or indirectly by the registered proprietor or any person from whom he derives title, any use of the design by virtue of this paragraph may be made free of any royalty or other payment to the registered proprietor.

(3) If and so far as the design has not been so recorded or applied as aforesaid, any use of the design made by virtue of this paragraph at any time after the date of registration thereof, or in consequence of any such communication as aforesaid, shall be made upon such terms as may be agreed upon, either before or after the use, between the Government department and the registered proprietor with the approval of the Treasury, or as may in default of agreement be determined by the court on a reference under paragraph 3 of this Schedule.

(4) The authority of a Government department in respect of a design may be given under this paragraph either before or after the design is registered and either before or after the acts in respect of which the authority is given are done, and may be given to any person whether or not he is authorised directly or indirectly by the registered proprietor to use the design.

(5) Where any use of a design is made by or with the authority of a Government department under this paragraph, then, unless it appears to the department that it would be contrary to the public interest so to do, the department shall notify the registered proprietor as soon as practicable after the use is begun, and furnish him with such information as to the extent of the use as he may from time to time require.

(6) For the purposes of this and the next following paragraph “the services of the Crown” shall be deemed to include:

(a) the supply to the government of any country outside the United Kingdom, in pursuance of an agreement or arrangement between Her Majesty’s Government in the United Kingdom and the government of that country, of articles required:

(i) for the defence of that country; or

(ii) for the defence of any other country whose government is party to any agreement or arrangement with Her Majesty’s said Government in respect of defence matters;

(b) the supply to the United Nations, or the government of any country belonging to that organisation, in pursuance of an agreement or arrangement between Her Majesty’s Government and that organisation or government, of articles required for any armed forces operating in pursuance of a resolution of that organisation or any organ of that organisation;

and the power of a Government department or a person authorised by a Government department under this paragraph to use a design shall include power to sell to any such government or to the said organisation any articles the supply of which is authorised by this sub-paragraph, and to sell to any person any articles made in the exercise of the powers conferred by this paragraph which are no longer required for the purpose for which they were made.

(7) The purchaser of any articles sold in the exercise of powers conferred by this paragraph, and any person claiming through him, shall have power to deal with them in the same manner as if the rights in the registered design were held on behalf of His Majesty.

Rights of third parties in respect of Crown use

2.-

(1) In relation to any use of a registered design, or a design in respect of which an application for registration is pending, made for the services of the Crown:

(a) by a Government department or a person authorised by a Government department under the last foregoing paragraph; or

(b) by the registered proprietor or applicant for registration to the order of a Government department,

the provisions of any licence, assignment or agreement made, whether before or after the commencement of this Act, between the registered proprietor or applicant for registration or any person who derives title from him or from whom he derives title and any person other than a Government department shall be of no effect so far as those provisions restrict or regulate the use of the design, or any model, document or information relating thereto, or provide for the making of payments in respect of any such use, or calculated by reference thereto; and the reproduction or publication of any model or document in connection with the said use shall not be deemed to be an infringement of any copyright or design right subsisting in the model or document.

(2) Where an exclusive licence granted otherwise than for royalties or other benefits determined by reference to the use of the design is in force under the registered design then:

(a) in relation to any use of the design which, but for the provisions of this and the last foregoing paragraph, would constitute an infringement of the rights of the licensee, sub-paragraph (3) of the last foregoing paragraph shall have effect as if for the reference to the registered proprietor there were substituted a reference to the licensee; and

(b) in relation to any use of the design by the licensee by virtue of an authority given under the last foregoing paragraph, that paragraph shall have effect as if the said sub-paragraph (3) were omitted.

(3) Subject to the provisions of the last foregoing sub-paragraph, where the registered design or the right to apply for or obtain registration of the design has been assigned to the registered proprietor in consideration of royalties or other benefits determined by reference to the use of the design, then:

(a) in relation to any use of the design by virtue of paragraph 1 of this Schedule, sub-paragraph (3) of that paragraph shall have effect as if the reference to the registered proprietor included a reference to the assignor, and any sum payable by virtue of that sub-paragraph shall be divided between the registered proprietor and the assignor in such proportion as may be agreed upon between them or as may in default of agreement be determined by the court on a reference under the next following paragraph; and

(b) in relation to any use of the design made for the services of the Crown by the registered proprietor to the order of a Government department, sub-paragraph (3) of paragraph 1 of this Schedule shall have effect as if that use were made by virtue of an authority given under that paragraph.

(4) Where, under sub-paragraph (3) of paragraph 1 of this Schedule, payments are required to be made by a Government department to a registered proprietor in respect of any use of a design, any person being the holder of an exclusive licence under the registered design (not being such a licence as is mentioned in sub-paragraph (2) of this paragraph) authorising him to make that use of the design shall be entitled to recover from the registered proprietor such part (if any) of those payments as may be agreed upon between that person and the registered proprietor, or as may in default of agreement be determined by the court under the next following paragraph to be just having regard to any expenditure incurred by that person:

(a) in developing the said design; or

(b) in making payments to the registered proprietor, other than royalties or other payments determined by reference to the use of the design, in consideration of the licence;

and if, at any time before the amount of any such payment has been agreed upon between the Government department and the registered proprietor, that person gives notice in writing of his interest to the department, any agreement as to the amount of that payment shall be of no effect unless it is made with his consent.

(5) In this paragraph “exclusive licence” means a licence from a registered proprietor which confers on the licensee, or on the licensee and persons authorised by him, to the exclusion of all other persons (including the registered proprietor), any right in respect of the registered design.

Compensation for loss of profit

2A.-

(1) Where Crown use is made of a registered design, the government department concerned shall pay:

(a) to the registered proprietor, or

(b) if there is an exclusive licence in force in respect of the design, to the exclusive licensee,

compensation for any loss resulting from his not being awarded a contract to supply the articles to which the design is applied.

(3) In determining the loss, regard shall be had to the profit which would have been made on such a contract and to the extent to which any manufacturing capacity was under-used.

(4) No compensation is payable in respect of any failure to secure contracts for the supply of articles to which the design is applied otherwise than for the services of the Crown.

(6) In this paragraph:

“Crown use”, in relation to a design, means the doing of anything by virtue of paragraph 1 which would otherwise be an infringement of the right in the design; and

“the government department concerned”, in relation to such use, means the government department by whom or on whose authority the act was done.

Reference of disputes as to Crown use

3.-

(1) Any dispute as to:

(a) the exercise by a Government department, or a person authorised by a Government department, of the powers conferred by paragraph 1 of this Schedule,

(b) terms for the use of a design for the services of the Crown under that paragraph,

(d) the right of any person to receive a payment under paragraph 2A,

may be referred to the court by either party to the dispute.

(2) In any proceedings under this paragraph to which a Government department are a party, the department may:

(a) if the registered proprietor is a party to the proceedings, apply for cancellation of the registration of the design upon any ground upon which the registration of a design may be cancelled on an application to the court under section twenty of this Act;

(b) in any case, put in issue the validity of the registration of the design without applying for its cancellation.

(3) If in such proceedings as aforesaid any question arises whether a design has been recorded or applied as mentioned in paragraph 1 of this Schedule, and the disclosure of any document recording the design, or of any evidence of the application thereof, would in the opinion of the department be prejudicial to the public interest, the disclosure may be made confidentially to counsel for the other party or to an independent expert mutually agreed upon.

(4) In determining under this paragraph any dispute between a Government department and any person as to terms for the use of a design for the services of the Crown, the court shall have regard to any benefit or compensation which that person or any person from whom he derives title may have received, or may be entitled to receive, directly or indirectly from any Government department in respect of the design in question.

(5) In any proceedings under this paragraph the court may at any time order the whole proceedings or any question or issue of fact arising therein to be referred to a special or official referee or an arbitrator on such terms as the court may direct; and references to the court in the foregoing provisions of this paragraph shall be construed accordingly.

Special provisions as to Crown use during emergency

4.-

(1) During any period of emergency within the meaning of this paragraph, the powers exercisable in relation to a design by a Government department, or a person authorised by a Government department under paragraph 1 of this Schedule shall include power to use the design for any purpose which appears to the department necessary or expedient:

(a) for the efficient prosecution of any war in which His Majesty may be engaged;

(b) for the maintenance of supplies and services essential to the life of the community;

(d) for promoting the productivity of industry, commerce and agriculture;

(e) for fostering and directing exports and reducing imports, or imports of any classes, from all or any countries and for redressing the balance of trade;

(f) generally for ensuring that the whole resources of the community are available for use, and are used, in a manner best calculated to serve the interests of the community; or

(g) for assisting the relief of suffering and the restoration and distribution of essential supplies and services in any part of His Majesty’s dominions or any foreign countries that are in grave distress as the result of war;

and any reference in this Schedule to the services of the Crown shall be construed as including a reference to the purposes aforesaid.

(2) In this paragraph the expression “period of emergency” means a period beginning on such date as may be declared by Order in Council to be the commencement, and ending on such date as may be so declared to be the termination, of a period of emergency for the purposes of this paragraph.

(3) No Order in Council under this paragraph shall be submitted to Her Majesty unless a draft of it has been laid before and approved by a resolution of each House of Parliament.

………………….. …

Section 295.- SCHEDULE 5.- Patents: miscellaneous amendments

Withdrawal of application before publication of specification

1.- In section 13(2) of the M71Patents Act 1949 (duty of comptroller to advertise acceptance of and publish complete specification) after the word “and”, in the first place where it occurs, insert “, unless the application is withdrawn,”.

Correction of clerical errors

2.-

(1) In section 15 of the M72Patents Act 1977 (filing of application), after subsection (3) insert:

“(3A) Nothing in subsection (2) or (3) above shall be construed as affecting the power of the comptroller under section 117(1) below to correct errors or mistakes with respect to the filing of drawings.”.

(2) The above amendment applies only in relation to applications filed after the commencement of this paragraph.

Supplementary searches

3.-

(1) Section 17 of the Patents Act 1977 (preliminary examination and search) is amended as follows.

(2) In subsection (7) (supplementary searches) for “subsection (4) above” substitute “subsections (4) and (5) above” and for “it applies” substitute “they apply”.

(3) After that subsection add:

“(8) A reference for a supplementary search in consequence of:

(a) an amendment of the application made by the applicant under section 18(3) or 19(1) below, or

(b) a correction of the application, or of a document filed in connection with the application, under section 117 below,shall be made only on payment of the prescribed fee, unless the comptroller directs otherwise.”.

4.- In section 18 of the Patents Act 1977 (substantive examination and grant or refusal of patent), after subsection (1) insert:

“(1A) If the examiner forms the view that a supplementary search under section 17 above is required for which a fee is payable, he shall inform the comptroller, who may decide that the substantive examination should not proceed until the fee is paid; and if he so decides, then unless within such period as he may allow:

(a) the fee is paid, or

(b) the application is amended so as to render the supplementary search unnecessary,he may refuse the application.”.

5.- In section 130(1) of the Patents Act 1977 (interpretation), in the definition of “search fee”, for “section 17 above” substitute “section 17(1) above”.

Application for restoration of lapsed patent

6.-

(1) Section 28 of the Patents Act 1977 (restoration of lapsed patents) is amended as follows.

(2) For subsection (1) (application for restoration within period of one year) substitute:

“(1) Where a patent has ceased to have effect by reason of a failure to pay any renewal fee, an application for the restoration of the patent may be made to the comptroller within the prescribed period.

(1A) Rules prescribing that period may contain such transitional provisions and savings as appear to the Secretary of State to be necessary or expedient.”.

(3).- After subsection (2) insert:

“(2A) Notice of the application shall be published by the comptroller in the prescribed manner.”.

(4) In subsection (3), omit paragraph (b) (requirement that failure to renew is due to circumstances beyond proprietor’s control) and the word “and” preceding it.

This amendment does not apply to a patent which has ceased to have effect in accordance with section 25(3) of the M73Patents Act 1977 (failure to renew within prescribed period) and in respect of which the period referred to in subsection (4) of that section (six months’ period of grace for renewal) has expired before commencement.

(5) Omit subsections (5) to (9) (effect of order for restoration).

7.- After that section insert:

“28A Effect of order for restoration of patent.

(1) The effect of an order for the restoration of a patent is as follows.

(2) Anything done under or in relation to the patent during the period between expiry and restoration shall be treated as valid.

(3) Anything done during that period which would have constituted an infringement if the patent had not expired shall be treated as an infringement:

(a) if done at a time when it was possible for the patent to be renewed under section 25(4), or

(b) if it was a continuation or repetition of an earlier infringing act.

(4) If after it was no longer possible for the patent to be so renewed, and before publication of notice of the application for restoration, a person:

(a) began in good faith to do an act which would have constituted an infringement of the patent if it had not expired, or

(b) made in good faith effective and serious preparations to do such an act,he has the right to continue to do the act or, as the case may be, to do the act, notwithstanding the restoration of the patent; but this right does not extend to granting a licence to another person to do the act.

(5) If the act was done, or the preparations were made, in the course of a business, the person entitled to the right conferred by subsection (4) may:

(a) authorise the doing of that act by any partners of his for the time being in that business, and

(6) Where a product is disposed of to another in exercise of the rights conferred by subsection (4) or (5), that other and any person claiming through him may deal with the product in the same way as if it had been disposed of by the registered proprietor of the patent.

(7) The above provisions apply in relation to the use of a patent for the services of the Crown as they apply in relation to infringement of the patent.”.

8.- In consequence of the above amendments:

(a) in section 60(6)(b) of the M74Patents Act 1977, for “section 28(6)” substitute “section 28A(4) or (5)”; and

(b) in sections 77(5), 78(6) and 80(4) of that Act, for the words from “section 28(6)” to the end substitute “section 28A(4) and (5) above, and subsections (6) and (7) of that section shall apply accordingly.”.

Determination of right to patent after grant

9.-

(1) Section 37 of the Patents Act 1977 (determination of right to patent after grant) is amended as follows.

(2) For subsection (1) substitute:

“(1) After a patent has been granted for an invention any person having or claiming a proprietary interest in or under the patent may refer to the comptroller the question:

(a) who is or are the true proprietor or proprietors of the patent,

(b) whether the patent should have been granted to the person or persons to whom it was granted, or

(c) whether any right in or under the patent should be transferred or granted to any other person or persons;and the comptroller shall determine the question and make such order as he thinks fit to give effect to the determination.”.

(3) Substitute “this section”:

(a) in subsections (4) and (7) for “subsection (1)(a) above”, and

(b) in subsection (8) for “subsection (1) above”.

10.- In section 74(6) (meaning of “entitlement proceedings”), for “section 37(1)(a) above” substitute “section 37(1) above”.

Employees’ inventions

11.-

(1) In section 39 of the Patents Act 1977 (right to employees’ inventions), after subsection (2) add:

“(3) Where by virtue of this section an invention belongs, as between him and his employer, to an employee, nothing done:

(a) by or on behalf of the employee or any person claiming under him for the purposes of pursuing an application for a patent, or

(b) by any person for the purpose of performing or working the invention,shall be taken to infringe any copyright or design right to which, as between him and his employer, his employer is entitled in any model or document relating to the invention.”.

(2) In section 43 of the M75Patents Act 1977 (supplementary provisions with respect to employees’ inventions), in subsection (4) (references to patents to include other forms of protection, whether in UK or elsewhere) for “in sections 40 to 42” substitute “in sections 39 to 42.”.

Undertaking to take licence in infringement proceedings

12.-

(1) Section 46 of the Patents Act 1977 (licences of right) is amended as follows.

(2) In subsection (3)(c) (undertaking to take licence in infringement proceedings) after the words “(otherwise than by the importation of any article” insert “from a country which is not a member State of the European Economic Community”.

(3) After subsection (3) insert:

“(3A) An undertaking under subsection (3)(c) above may be given at any time before final order in the proceedings, without any admission of liability.”.

Power of comptroller on grant of compulsory licence

13.- In section 49 of the Patents Act 1977 (supplementary provisions with respect to compulsory licences), omit subsection (3) (power to order that licence has effect to revoke existing licences and deprive proprietor of power to work invention or grant licences).

Powers exercisable in consequence of report of Monopolies and Mergers Commission

14.- For section 51 of the Patents Act 1977 (licences of right: application by Crown in consequence of report of Monopolies and Mergers Commission) substitute:

“51 Powers exercisable in consequence of report of Monopolies and Mergers Commission.

(1) Where a report of the Monopolies and Mergers Commission has been laid before Parliament containing conclusions to the effect:

(a) on a monopoly reference, that a monopoly situation exists and facts found by the Commission operate or may be expected to operate against the public interest,

(c) on a competition reference, that a person was engaged in an anti-competitive practice which operated or may be expected to operate against the public interest, or

(3) If on an application under this section it appears to the comptroller that the matters specified in the Commission’s report as being those which in the Commission’s opinion operate, or operated or may be expected to operate, against the public interest include:

(a) conditions in licences granted under a patent by its proprietor restricting the use of the invention by the licensee or the right of the proprietor to grant other licences, or

(b) a refusal by the proprietor of a patent to grant licences on reasonable termshe may by order cancel or modify any such condition or may, instead or in addition, make an entry in the register to the effect that licences under the patent are to be available as of right.

(4) In this section “the appropriate Minister or Ministers” means the Minister or Ministers to whom the report of the Commission was made.”.

Compulsory licensing: reliance on statements in competition report

15.- In section 53(2) of the M76Patents Act 1977 (compulsory licensing: reliance on statements in reports of Monopolies and Mergers Commission):

(a) for “application made in relation to a patent under sections 48 to 51 above” substitute “application made under section 48 above in respect of a patent”; and

(b) after “Part VIII of the Fair Trading Act 1973” insert “or section 17 of the Competition Act 1980”.

Crown use: compensation for loss of profit

16.- (1)In the Patents Act 1977, after section 57 insert:

“57A Compensation for loss of profit.

(1) Where use is made of an invention for the services of the Crown, the government department concerned shall pay:

(a) to the proprietor of the patent, or

(b) if there is an exclusive licence in force in respect of the patent, to the exclusive licensee,compensation for any loss resulting from his not being awarded a contract to supply the patented product or, as the case may be, to perform the patented process or supply a thing made by means of the patented process.

(2) Compensation is payable only to the extent that such a contract could have been fulfilled from his existing manufacturing or other capacity; but is payable notwithstanding the existence of circumstances rendering him ineligible for the award of such a contract.

(3) In determining the loss, regard shall be had to the profit which would have been made on such a contract and to the extent to which any manufacturing or other capacity was under-used.

(4) No compensation is payable in respect of any failure to secure contracts to supply the patented product or, as the case may be, to perform the patented process or supply a thing made by means of the patented process, otherwise than for the services of the Crown.

(5) The amount payable shall, if not agreed between the proprietor or licensee and the government department concerned with the approval of the Treasury, be determined by the court on a reference under section 58, and is in addition to any amount payable under section 55 or 57.

(6) In this section “the government department concerned”, in relation to any use of an invention for the services of the Crown, means the government department by whom or on whose authority the use was made.

(7) In the application of this section to Northern Ireland, the reference in subsection (5) above to the Treasury shall, where the government department concerned is a department of the Government of Northern Ireland, be construed as a reference to the Department of Finance and Personnel.”.

(2) In section 58 of the M77Patents Act 1977 (reference of disputes as to Crown use), for subsection (1) substitute:

“(1) Any dispute as to:

(a) the exercise by a government department, or a person authorised by a government department, of the powers conferred by section 55 above,

(b) terms for the use of an invention for the services of the Crown under that section,

(d) the right of any person to receive a payment under section 57A,may be referred to the court by either party to the dispute after a patent has been granted for the invention.”;

and in subsection (4) for “under this section” substitute “under subsection (1)(a), (b) or (c) above”.

(3) In section 58(11) of the Patents Act 1977 (exclusion of right to compensation for Crown use if relevant transaction, instrument or event not registered), after “section 57(3) above)” insert “, or to any compensation under section 57A above,”.

(4) The above amendments apply in relation to any use of an invention for the services of the Crown after the commencement of this section, even if the terms for such use were settled before commencement.

Right to continue use begun before priority date

17.- For section 64 of the Patents Act 1977 (right to continue use begun before priority date) substitute:

“64 Right to continue use begun before priority date.

(1) Where a patent is granted for an invention, a person who in the United Kingdom before the priority date of the invention:

(a) does in good faith an act which would constitute an infringement of the patent if it were in force, or

(b) makes in good faith effective and serious preparations to do such an act,has the right to continue to do the act or, as the case may be, to do the act, notwithstanding the grant of the patent; but this right does not extend to granting a licence to another person to do the act.

(2) If the act was done, or the preparations were made, in the course of a business, the person entitled to the right conferred by subsection (1) may:

(a) authorise the doing of that act by any partners of his for the time being in that business, and

(3) Where a product is disposed of to another in exercise of the rights conferred by subsection (1) or (2), that other and any person claiming through him may deal with the product in the same way as if it had been disposed of by the registered proprietor of the patent.”.

Revocation on grounds of grant to wrong person

18.- In section 72(1) of the M78Patents Act 1977 (grounds for revocation of patent), for paragraph (b) substitute:

“(b) that the patent was granted to a person who was not entitled to be granted that patent;”.

Revocation where two patents granted for same invention

19.- In section 73 of the Patents Act 1977 (revocation on initiative of comptroller), for subsections (2) and (3) (revocation of patent where European patent (UK) granted in respect of same invention) substitute:

“(2) If it appears to the comptroller that a patent under this Act and a European patent (UK) have been granted for the same invention having the same priority date, and that the applications for the patents were filed by the same applicant or his successor in title, he shall give the proprietor of the patent under this Act an opportunity of making observations and of amending the specification of the patent, and if the proprietor fails to satisfy the comptroller that there are not two patents in respect of the same invention, or to amend the specification so as to prevent there being two patents in respect of the same invention, the comptroller shall revoke the patent.

(3) The comptroller shall not take action under subsection (2) above before:

(a) the end of the period for filing an opposition to the European patent (UK) under the European Patent Convention, or

(b) if later, the date on which opposition proceedings are finally disposed of;and he shall not then take any action if the decision is not to maintain the European patent or if it is amended so that there are not two patents in respect of the same invention.

(4) The comptroller shall not take action under subsection (2) above if the European patent (UK) has been surrendered under section 29(1) above before the date on which by virtue of section 25(1) above the patent under this Act is to be treated as having been granted or, if proceedings for the surrender of the European patent (UK) have been begun before that date, until those proceedings are finally disposed of; and he shall not then take any action if the decision is to accept the surrender of the European patent.”.

Applications and amendments not to include additional matter

20.- For section 76 of the M79Patents Act 1977 (amendments of applications and patents not to include added matter) substitute:

“76 Amendments of applications and patents not to include added matter.

(1) An application for a patent which:

(a) is made in respect of matter disclosed in an earlier application, or in the specification of a patent which has been granted, and

(b) discloses additional matter, that is, matter extending beyond that disclosed in the earlier application, as filed, or the application for the patent, as filed,may be filed under section 8(3), 12 or 37(4) above, or as mentioned in section 15(4) above, but shall not be allowed to proceed unless it is amended so as to exclude the additional matter.

(2) No amendment of an application for a patent shall be allowed under section 17(3), 18(3) or 19(1) if it results in the application disclosing matter extending beyond that disclosed in the application as filed.

(3) No amendment of the specification of a patent shall be allowed under section 27(1), 73 or 75 if it:

(a) results in the specification disclosing additional matter, or

(b) extends the protection conferred by the patent.”.

Effect of European patent (UK)

21.-

(1) Section 77 of the Patents Act 1977 (effect of European patent (UK)) is amended as follows.

(2) For subsection (3) (effect of finding of partial validity on pending proceedings) substitute:

“(3) Where in the case of a European patent (UK):

(a) proceedings for infringement, or proceedings under section 58 above, have been commenced before the court or the comptroller and have not been finally disposed of, and

(b) it is established in proceedings before the European Patent Office that the patent is only partially valid,the provisions of section 63 or, as the case may be, of subsections (7) to (9) of section 58 apply as they apply to proceedings in which the validity of a patent is put in issue and in which it is found that the patent is only partially valid.”.

(3) For subsection (4) (effect of amendment or revocation under European Patent Convention) substitute:

“(4) Where a European patent (UK) is amended in accordance with the European Patent Convention, the amendment shall have effect for the purposes of Parts I and III of this Act as if the specification of the patent had been amended under this Act; but subject to subsection (6)(b) below.

(4A) Where a European patent (UK) is revoked in accordance with the European Patent Convention, the patent shall be treated for the purposes of Parts I and III of this Act as having been revoked under this Act.”.

(4) In subsection (6) (filing of English translation), in paragraph (b) (amendments) for “a translation of the amendment into English” substitute “a translation into English of the specification as amended”.

(5) In subsection (7) (effect of failure to file translation) for the words from “a translation” to “above” substitute “such a translation is not filed”.

The state of the art: material contained in patent applications

22.- In section 78 of the M80Patents Act 1977 (effect of filing an application for a European patent (UK)), for subsection (5) (effect of withdrawal of application, &c.) substitute:

“(5) Subsections (1) to (3) above shall cease to apply to an application for a European patent (UK), except as mentioned in subsection (5A) below, if:

(a) the application is refused or withdrawn or deemed to be withdrawn, or

(b) the designation of the United Kingdom in the application is withdrawn or deemed to be withdrawn,but shall apply again if the rights of the applicant are re-established under the European Patent Convention, as from their re-establishment.

(5A) The occurrence of any of the events mentioned in subsection (5)(a) or (b) shall not affect the continued operation of section 2(3) above in relation to matter contained in an application for a European patent (UK) which by virtue of that provision has become part of the state of the art as regards other inventions.”.

Jurisdiction in certain proceedings

23.- Section 88 of the Patents Act 1977 (jurisdiction in legal proceedings in connection with Community Patent Convention) is repealed.

Effect of filing international application for patent

24.-

(1) Section 89 of the Patents Act 1977 (effect of filing international application for patent) is amended as follows.

(2)After subsection (3) insert:

“(3A) If the relevant conditions are satisfied with respect to an application which is amended in accordance with the Treaty and the relevant conditions are not satisfied with respect to any amendment, that amendment shall be disregarded.”.

(3)After subsection (4) insert:

“(4A) In subsection (4)(a) “a copy of the application” includes a copy of the application published in accordance with the Treaty in a language other than that in which it was filed.”.

(4) For subsection (10) (exclusion of certain applications subject to European Patent Convention) substitute:

“(10) The foregoing provisions of this section do not apply to an application which falls to be treated as an international application for a patent (UK) by reason only of its containing an indication that the applicant wishes to obtain a European patent (UK); but without prejudice to the application of those provisions to an application which also separately designates the United Kingdom.”.

(5) The amendments in this paragraph shall be deemed always to have had effect.

(6) This paragraph shall be repealed by the order bringing the following paragraph into force.

25.- For section 89 of the M81Patents Act 1977 (effect of filing international application for patent) substitute:

“89 Effect of international application for patent.

(1) An international application for a patent (UK) for which a date of filing has been accorded under the Patent Co-operation Treaty shall, subject to:

section 89A (international and national phases of application), and

section 89B (adaptation of provisions in relation to international application),

be treated for the purposes of Parts I and III of this Act as an application for a patent under this Act.

(2) If the application, or the designation of the United Kingdom in it, is withdrawn or (except as mentioned in subsection (3)) deemed to be withdrawn under the Treaty, it shall be treated as withdrawn under this Act.

(3) An application shall not be treated as withdrawn under this Act if it, or the designation of the United Kingdom in it, is deemed to be withdrawn under the Treaty:

(a) because of an error or omission in an institution having functions under the Treaty, or

(b) because, owing to circumstances outside the applicant’s control, a copy of the application was not received by the International Bureau before the end of the time limited for that purpose under the Treaty,or in such other circumstances as may be prescribed.

(4) For the purposes of the above provisions an application shall not be treated as an international application for a patent (UK) by reason only of its containing an indication that the applicant wishes to obtain a European patent (UK), but an application shall be so treated if it also separately designates the United Kingdom.

(5) If an international application for a patent which designates the United Kingdom is refused a filing date under the Treaty and the comptroller determines that the refusal was caused by an error or omission in an institution having functions under the Treaty, he may direct that the application shall be treated as an application under this Act, having such date of filing as he may direct.

89A.- International and national phases of application.

(1) The provisions of the Patent Co-operation Treaty relating to publication, search, examination and amendment, and not those of this Act, apply to an international application for a patent (UK) during the international phase of the application.

(2) The international phase of the application means the period from the filing of the application in accordance with the Treaty until the national phase of the application begins.

(3) The national phase of the application begins:

(a) when the prescribed period expires, provided any necessary translation of the application into English has been filed at the Patent Office and the prescribed fee has been paid by the applicant; or

(b) on the applicant expressly requesting the comptroller to proceed earlier with the national phase of the application, filing at the Patent Office:

(i) a copy of the application, if none has yet been sent to the Patent Office in accordance with the Treaty, and

(ii) any necessary translation of the application into English,and paying the prescribed fee.

For this purpose a “copy of the application” includes a copy published in accordance with the Treaty in a language other than that in which it was originally filed.

(4) If the prescribed period expires without the conditions mentioned in subsection (3)(a) being satisfied, the application shall be taken to be withdrawn.

(5) Where during the international phase the application is amended in accordance with the Treaty, the amendment shall be treated as made under this Act if:

(a) when the prescribed period expires, any necessary translation of the amendment into English has been filed at the Patent Office, or

(b) where the applicant expressly requests the comptroller to proceed earlier with the national phase of the application, there is then filed at the Patent Office:

(i) a copy of the amendment, if none has yet been sent to the Patent Office in accordance with the Treaty, and

(ii) any necessary translation of the amendment into English;otherwise the amendment shall be disregarded.

(6) The comptroller shall on payment of the prescribed fee publish any translation filed at the Patent Office under subsection (3) or (5) above.

89B.- Adaptation of provisions in relation to international application.

(1) Where an international application for a patent (UK) is accorded a filing date under the Patent Co-operation Treaty:

(a) that date, or if the application is re-dated under the Treaty to a later date that later date, shall be treated as the date of filing the application under this Act,

(b) any declaration of priority made under the Treaty shall be treated as made under section 5(2) above, and where in accordance with the Treaty any extra days are allowed, the period of 12 months specified in section 5(2) shall be treated as altered accordingly, and

(c) any statement of the name of the inventor under the Treaty shall be treated as a statement filed under section 13(2) above.

(2) If the application, not having been published under this Act, is published in accordance with the Treaty it shall be treated, for purposes other than those mentioned in subsection (3), as published under section 16 above when the conditions mentioned in section 89A(3)(a) are complied with.

(3) For the purposes of section 55 (use of invention for service of the Crown) and section 69 (infringement of rights conferred by publication) the application, not having been published under this Act, shall be treated as published under section 16 above:

(a) if it is published in accordance with the Treaty in English, on its being so published; and

(b) if it is so published in a language other than English:

(i) on the publication of a translation of the application in accordance with section 89A(6) above, or

(ii) on the service by the applicant of a translation into English of the specification of the application on the government department concerned or, as the case may be, on the person committing the infringing act.The reference in paragraph (b)(ii) to the service of a translation on a government department or other person is to its being sent by post or delivered to that department or person.

(4) During the international phase of the application, section 8 above does not apply (determination of questions of entitlement in relation to application under this Act) and section 12 above (determination of entitlement in relation to foreign and convention patents) applies notwithstanding the application; but after the end of the international phase, section 8 applies and section 12 does not.

(5) When the national phase begins the comptroller shall refer the application for so much of the examination and search under section 17 and 18 above as he considers appropriate in view of any examination or search carried out under the Treaty.”.

Proceedings before the court or the comptroller

26.- In the M82Patents Act 1977, after section 99 (general powers of the court) insert:

“99A Power of Patents Court to order report.

(1) Rules of court shall make provision empowering the Patents Court in any proceedings before it under this Act, on or without the application of any party, to order the Patent Office to inquire into and report on any question of fact or opinion.

(2) Where the court makes such an order on the application of a party, the fee payable to the Patent Office shall be at such rate as may be determined in accordance with rules of court and shall be costs of the proceedings unless otherwise ordered by the court.

(3) Where the court makes such an order of its own motion, the fee payable to the Patent Office shall be at such rate as may be determined by the Lord Chancellor with the approval of the Treasury and shall be paid out of money provided by Parliament.

99B.- Power of Court of Session to order report.

(1) In any proceedings before the Court of Session under this Act the court may, either of its own volition or on the application of any party, order the Patent Office to inquire into and report on any question of fact or opinion.

(2) Where the court makes an order under subsection (1) above of its own volition the fee payable to the Patent Office shall be at such rate as may be determined by the Lord President of the Court of Session with the consent of the Treasury and shall be defrayed out of moneys provided by Parliament.

(3) Where the court makes an order under subsection (1) above on the application of a party, the fee payable to the Patent Office shall be at such rate as may be provided for in rules of court and shall be treated as expenses in the cause.”.

27.- For section 102 of the M83Patents Act 1977 (right of audience in patent proceedings) substitute:

“102 Right of audience, &c. in proceedings before comptroller.

(1) A party to proceedings before the comptroller under this Act, or under any treaty or international convention to which the United Kingdom is a party, may appear before the comptroller in person or be represented by any person whom he desires to represent him.

(2) No offence is committed under the enactments relating to the preparation of documents by persons not legally qualified by reason only of the preparation by any person of a document, other than a deed, for use in such proceedings.

(3) Subsection (1) has effect subject to rules made under section 281 of the Copyright, Designs and Patents Act 1988 (power of comptroller to refuse to recognise certain agents).

(4) In its application to proceedings in relation to applications for, or otherwise in connection with, European patents, this section has effect subject to any restrictions imposed by or under the European Patent Convention.

102A.- Right of audience, &c. in proceedings on appeal from the comptroller.

(1) A solicitor of the Supreme Court may appear and be heard on behalf of any party to an appeal under this Act from the comptroller to the Patents Court.

(2) A registered patent agent or a member of the Bar not in actual practice may do, in or in connection with proceedings on an appeal under this Act from the comptroller to the Patents Court, anything which a solicitor of the Supreme Court might do, other than prepare a deed.

(3) The Lord Chancellor may by regulations:

(a) provide that the right conferred by subsection (2) shall be subject to such conditions and restrictions as appear to the Lord Chancellor to be necessary or expedient, and

(b) apply to persons exercising that right such statutory provisions, rules of court and other rules of law and practice applying to solicitors as may be specified in the regulations;and different provision may be made for different descriptions of proceedings.

(4) Regulations under this section shall be made by statutory instrument which shall be subject to annulment in pursuance of a resolution of either House of Parliament.

(5) This section is without prejudice to the right of counsel to appear before the High Court.”.

Provision of information

28.- In section 118 of the M84Patents Act 1977 (information about patent applications, &c.), in subsection (3) (restriction on disclosure before publication of application: exceptions) for “section 22(6)(a) above” substitute “section 22(6) above”.

Power to extend time limits

29.- In section 123 of the Patents Act 1977 (rules), after subsection (3) insert:

“(3A) It is hereby declared that rules:

(a) authorising the rectification of irregularities of procedure, or

(b) providing for the alteration of any period of time,may authorise the comptroller to extend or further extend any period notwithstanding that the period has already expired.”.

Availability of samples of micro-organisms

30.- In the Patents Act 1977 after section 125 insert:

“125A Disclosure of invention by specification: availability of samples of micro-organisms.

(1) Provision may be made by rules prescribing the circumstances in which the specification of an application for a patent, or of a patent, for an invention which requires for its performance the use of a micro-organism is to be treated as disclosing the invention in a manner which is clear enough and complete enough for the invention to be performed by a person skilled in the art.

(2) The rules may in particular require the applicant or patentee:

(a) to take such steps as may be prescribed for the purposes of making available to the public samples of the micro-organism, and

(b) not to impose or maintain restrictions on the uses to which such samples may be put, except as may be prescribed.

(3) The rules may provide that, in such cases as may be prescribed, samples need only be made available to such persons or descriptions of persons as may be prescribed; and the rules may identify a description of persons by reference to whether the comptroller has given his certificate as to any matter.

(4) An application for revocation of the patent under section 72(1)(c) above may be made if any of the requirements of the rules cease to be complied with.”.

Section 296ZE.- [F938 SCHEDULE 5A.- PERMITTED ACTS TO WHICH SECTION 296ZE APPLIES

PART 1.- Copyright exceptions

section 29 (research and private study)

[F939

section 29A (copies for text and data analysis for non-commercial research)]

section 31A [F940(disabled persons: copies of works for personal use)”]

section 31B [F941(making and supply of accessible copies by authorised bodies)][F942

section 31BA (making and supply of intermediate copies by authorised bodies)][F943

section 32 (illustration for instruction)]

section 35 (recording by educational establishments of broadcasts)

[F944section 36 (copying and use of extracts of works by educational establishments)]

F945 …

[F939 section 41 (copying by librarians: supply of single copies to other libraries)]

F945 …

[F939 section 42 (copying by librarians etc : replacement copies of works) ]

[F939 section 42A (copying by librarians: single copies of published works)]

F945 …

[F939 section 43 (copying by librarians or archivists: single copies of unpublished works)]

section 44 (copy of work required to be made as condition of export)

section 45 (Parliamentary and judicial proceedings)

section 46 (Royal Commissions and statutory inquiries)

section 47 (material open to public inspection or on official register)

section 48 (material communicated to the Crown in the course of public business)

section 49 (public records)

section 50 (acts done under statutory authority)

section 61 (recordings of folksongs)

section 68 (incidental recording for purposes of broadcast)

section 69 (recording for purposes of supervision and control of broadcasts)

section 70 (recording for purposes o

f time-shifting)

section 71 (photographs of broadcasts)

F946 …

[F947 section 75 (recording of broadcast for archival purposes)]

PART 2.- Rights in performances exceptions

[F948paragraph 1C of Schedule 2 (research and private study)][F948paragraph 1D of Schedule 2 (copies for text and data analysis for non-commercial research)][F949[F950paragraph 3A of Schedule 2 (disabled persons: copies of recordings for personal use)][F950paragraph 3B of Schedule 2 (making and supply of accessible copies by authorised bodies)] [F950paragraph 3C of Schedule 2 (making and supply of intermediate copies by authorised bodies)]paragraph 4 of Schedule 2 (illustration for instruction)] [F951paragraph 6 of Schedule 2 (recording by educational establishments of broadcasts)] [F948paragraph 6ZA of Schedule 2 (copying and use of extracts of recordings by educational establishments)][F948paragraph 6D of Schedule 2 (copying by librarians: supply of single copies to other libraries)][F948paragraph 6E of Schedule 2 (copying by librarians etc: replacement copies of recordings)][F948paragraph 6F of Schedule 2 (copying by librarians: single copies of published recordings)][F948paragraph 6G of Schedule 2 (copying by librarians or archivists: single copies of unpublished recordings)]paragraph 7 of Schedule 2 (copy of work required to be made as condition of export)paragraph 8 of Schedule 2 (Parliamentary and judicial proceedings) paragraph 9 of Schedule 2 (Royal Commissions and statutory inquiries) paragraph 10 of Schedule 2 (public records) paragraph 11 of Schedule 2 (acts done under statutory authority) paragraph 14 of Schedule 2 (recordings of folksongs) paragraph 16 of Schedule 2 (incidental recording for purposes of broadcast) paragraph 17 of Schedule 2 (recordings for purposes of supervision and control of broadcasts)paragraph 17A of Schedule 2 (recording for the purposes of time-shifting) paragraph 17B of Schedule 2 (photographs of broadcasts) F952… paragraph 21 of Schedule 2 (recording of broadcast for archival purposes)]

PART 3.- Database right exceptions

regulation 20 of and Schedule 1 to the Copyright and Rights in Databases Regulations 1997 ( S.I. 1997/3032)

Section 301.- SCHEDULE 6.- Provisions for the Benefit of [F953Great Ormond Street Hospital for Children]

Interpretation

1.-

(1) In this Schedule:

[F954 “GOSH Children’s Charity” means Great Ormond Street Hospital Children’s Charity (company registration number 9338724);]

“the Hospital” means [F955Great Ormond Street Hospital for Children],

F956…

“the work” means the play “Peter Pan” by Sir James Matthew Barrie.

(2) Expressions used in this Schedule which are defined for the purposes of Part I of this Act (copyright) have the same meaning as in that Part.

Entitlement to royalty

2.-

(1) [F957GOSH Children’s Charity is] entitled, subject to the following provisions of this Schedule, to a royalty in respect of any public performance, commercial publication [F958or communication to the public] of the whole or any substantial part of the work or an adaptation of it.

(2) Where [F959GOSH Children’s Charity is] or would be entitled to a royalty, another form of remuneration may be agreed.

Exceptions

3.- No royalty is payable in respect of:

(a) anything which immediately before copyright in the work expired on 31st December 1987 could lawfully have been done without the licence, or further licence, of the [F960copyright owner at that time]; or

(b) anything which if copyright still subsisted in the work could, by virtue of any provision of Chapter III of Part I of this Act (acts permitted notwithstanding copyright), be done without infringing copyright.

Saving

4.- No royalty is payable in respect of anything done in pursuance of arrangements made before the passing of this Act.

Procedure for determining amount payable

5.-

(1) In default of agreement application may be made to the Copyright Tribunal which shall consider the matter and make such order regarding the royalty or other remuneration to be paid as it may determine to be reasonable in the circumstances.

(2) Application may subsequently be made to the Tribunal to vary its order, and the Tribunal shall consider the matter and make such order confirming or varying the original order as it may determine to be reasonable in the circumstances.

(3) An application for variation shall not, except with the special leave of the Tribunal, be made within twelve months from the date of the original order or of the order on a previous application for variation.

(4) A variation order has effect from the date on which it is made or such later date as may be specified by the Tribunal.

F961[

(5) The provisions of Chapter VIII of Part I (general provisions relating to the Copyright Tribunal) apply in relation to the Tribunal when exercising any jurisdiction under this paragraph.][F962 Sums received to be held for the benefit of the Hospital

6.- The sums received by GOSH Children’s Charity by virtue of this Schedule, after deduction of any relevant expenses, are to be held by it for the purposes of the Hospital.]

Right only for the benefit of the Hospital

7.-

(1) The right of [F963GOSH Children’s Charity] under this Schedule may not be assigned and shall cease if [F964GOSH Children’s Charity purports] to assign or charge it.

(2) The right F965… shall cease if the Hospital ceases to have a separate identity or ceases to have purposes which include the care of sick children.

F966(3). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 303(1).- SCHEDULE 7.-Consequential amendments: general

British Mercantile Marine Uniform Act 1919 (c.62)

1.- For section 2 of the British Mercantile Marine Uniform Act 1919 (copyright in distinctive marks of uniform) substitute:

2“ Right in registered design of distinctive marks of uniform.

The right of the Secretary of State in any design forming part of the British mercantile marine uniform which is registered under the Registered Designs Act 1949 is not limited to the period prescribed by section 8 of that Act but shall continue to subsist so long as the design remains on the register.”.

Chartered Associations (Protection of Names and Uniforms) Act 1926 (c.26)

2.- In section 1(5) of the Chartered Associations (Protection of Names and Uniforms) Act 1926 for “the copyright in respect thereof” substitute “ the right in the registered design ” .

Patents, Designs, Copyright and Trade Marks (Emergency) Act 1939 (c.107)

3.-

(1) The Patents, Designs, Copyright and Trade Marks (Emergency) Act 1939 is amended as follows.

(2) In section 1 (effect of licence where owner is enemy or enemy subject):

(a) in subsection (1) after “a copyright” and “the copyright” insert “ or design right ” ;

(b) in subsection (2) after “the copyright” insert “ or design right ” and for “or copyright” substitute “ , copyright or design right ” .

(3) In section 2 (power of comptroller to grant licences):

(a) in subsection (1) after “a copyright”, “the copyright” (twice) and “the said copyright” insert “ or design right ” and for “or copyright” (twice) substitute “ , copyright or design right ” ;

(b) in subsections (2) and (3) for “, or copyright” substitute “ , copyright or design right ” ;

(d) in subsection (8)(c) for “or work in which copyright subsists” substitute “ work in which copyright subsists or design in which design right subsists ” .

(4) In section 5 (effect of war on international arrangements):

(a) in subsection (1) for “section twenty-nine of the Copyright Act 1911” substitute “ section 159 or 256 of the Copyright, Designs and Patents Act 1988 (countries enjoying reciprocal copyright or design right protection) ” ;

(b) in subsection (2) after “copyright” (four times) insert “ or design right ” and for “the Copyright Act 1911” (twice) substitute “ Part I or III of the Copyright, Designs and Patents Act 1988 ” .

(5) In section 10(1) (interpretation) omit the definition of “copyright”, and for the definitions of “design”, “invention”, “patent” and “patentee” substitute:

“ “ design ” has in reference to a registered design the same meaning as in the Registered Designs Act 1949, and in reference to design right the same meaning as in Part III of the Copyright, Designs and Patents Act 1988;

“ invention ” and “ patent ” have the same meaning as in the Patents Act 1977. ”.

Crown Proceedings Act 1947 (c.44)

4.-

(1) In the Crown Proceedings Act 1947 for section 3 (provisions as to industrial property) substitute:

3“ Infringement of intellectual property rights.

(1) Civil proceedings lie against the Crown for an infringement committed by a servant or agent of the Crown, with the authority of the Crown, of:

(a) a patent,

(b) a registered trade mark or registered service mark,

(d) design right, or

(e) copyright;but save as provided by this subsection no proceedings lie against the Crown by virtue of this Act in respect of an infringement of any of those rights.

(2) Nothing in this section, or any other provision of this Act, shall be construed as affecting:

(a) the rights of a government department under section 55 of the Patents Act 1977, Schedule 1 to the Registered Designs Act 1949 or section 240 of the Copyright, Designs and Patents Act 1988 (Crown use of patents and designs), or

(b) the rights of the Secretary of State under section 22 of the Patents Act 1977 or section 5 of the Registered Designs Act 1949 (security of information prejudicial to defence or public safety).”.

(2) In the application of sub-paragraph (1) to Northern Ireland:

(a) the reference to the Crown Proceedings Act 1947 is to that Act as it applies to the Crown in right of Her Majesty’s Government in Northern Ireland, as well as to the Crown in right of Her Majesty’s Government in the United Kingdom, and

(b) in the substituted section 3 as it applies in relation to the Crown in right of Her Majesty’s Government in Northern Ireland, subsection (2)(b) shall be omitted.

Patents Act 1949 (c.87)

5.- In section 47 of the Patents Act 1949 (rights of third parties in respect of Crown use of patent), in the closing words of subsection (1) (which relate to the use of models or documents), after “copyright” insert “ or design right ” .

Public Libraries (Scotland) Act 1955 (c.27)

F967 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

London County Council (General Powers) Act 1958 (c.xxi)

7.- In section 36 of the London County Council (General Powers) Act 1958 (power as to libraries: provision and repair of things other than books) for subsection (5) substitute:

“(5) Nothing in this section shall be construed as authorising an infringement of copyright.”.

Public Libraries and Museums Act 1964 (c.75)

F968 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Marine, &c., Broadcasting (Offences) Act 1967 (c.41)

9F969 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Medicines Act 1968 (c.67)

10.-

(1) Section 92 of the Medicines Act 1968 (scope of provisions restricting promotion of sales of medicinal products) is amended as follows.

(2) In subsection (1) (meaning of “advertisement”) for the words from “or by the exhibition” to “service” substitute “ or by means of a photograph, film, sound recording, broadcast or cable programme, ” .

(3) F970 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(4) For subsection (6) substitute:

“(6) In this section “film”, “sound recording”, “broadcast”, “cable programme”, “cable programme service”, and related expressions, have the same meaning as in Part I of the Copyright, Designs and Patents Act 1988 (copyright).”.

Post Office Act 1969 (c.48)

11.- In Schedule 10 to the Post Office Act 1969 (special transitional provisions relating to use of patents and registered designs), in the closing words of paragraphs 8(1) and 18(1) (which relate to the use of models and documents), after “copyright” insert “ or design right ” .

Merchant Shipping Act 1970 (c.36)

12.- In section 87 of the Merchant Shipping Act 1970 (merchant navy uniform), for subsection (4) substitute:

“(4) Where any design forming part of the merchant navy uniform has been registered under the Registered Designs Act 1949 and the Secretary of State is the proprietor of the design, his right in the design is not limited to the period prescribed by section 8 of that Act but shall continue to subsist so long as the design remains registered.”.

Taxes Management Act 1970 (c.9)

13.- In section 16 of the Taxes Management Act 1970 (returns to be made in respect of certain payments):

(a) in subsection (1)(c), and

(b) in subsection (2)(b),

for “or public lending right” substitute “ , public lending right, right in a registered design or design right ” .

Tribunals and Inquiries Act 1971 (c.62)

F971 14. -. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Fair Trading Act 1973 (c.41)

15.- F972 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

House of Commons Disqualification Act 1975 (c.24)

16.- In Part II of Schedule 1 to the House of Commons Disqualification Act 1975 (bodies of which all members are disqualified), at the appropriate place insert “ The Copyright Tribunal ” .

Northern Ireland Assembly Disqualification Act 1975 (c.25)

17.- In Part II of Schedule 1 to the Northern Ireland Assembly Disqualification Act 1975 (bodies of which all members are disqualified), at the appropriate place insert “The Copyright Tribunal”.

Restrictive Trade Practices Act 1976 (c.34)

18.-

(1) The Restrictive Trade Practices Act 1976 is amended as follows.

(2) In Schedule 1 (excluded services) for paragraph 10 (services of patent agents) substitute:

“10The services of registered patent agents (within the meaning of Part V of the Copyright, Designs and Patents Act 1988) in their capacity as such.”;

and in paragraph 10A (services of European patent attorneys) for “section 84(7) of the Patents Act 1977” substitute “ Part V of the Copyright, Designs and Patents Act 1988 ” .

(3) In Schedule 3 (excepted agreements), after paragraph 5A insert:

“Design right

(1) This Act does not apply to:

(a) a licence granted by the owner or a licensee of any design right,

(b) an assignment of design right, or

(c) an agreement for such a licence or assignment,if the licence, assignment or agreement is one under which no such restrictions as are described in section 6(1) above are accepted, or no such information provisions as are described in section 7(1) above are made, except in respect of articles made to the design; but subject to the following provisions.

(2) Sub-paragraph (1) does not exclude a licence, assignment or agreement which is a design pooling agreement or is granted or made (directly or indirectly) in pursuance of a design pooling agreement.

(3) In this paragraph a “ design pooling agreement ” means an agreement:

(a) to which the parties are or include at least three persons(the “principal parties”) each of whom has an interest in one or more design rights, and

(b) by which each principal party agrees, in respect of design right in which he has, or may during the currency of the agreement acquire, an interest to grant an interest (directly or indirectly) to one or more of the other principal parties, or to one or more of those parties and to other persons.

(4) In this paragraph:

“assignment”, in Scotland, means assignation; and

“interest” means an interest as owner or licensee of design right.

(5) This paragraph applies to an interest held by or granted to more than one person jointly as if they were one person.

(6) References in this paragraph to the granting of an interest to a person indirectly are to its being granted to a third person for the purpose of enabling him to make a grant to the person in question.”.

Resale Prices Act 1976 (c. 53)

19.- In section 10(4) of the Resale Prices Act 1976 (patented articles: articles to be treated in same way), in paragraph (a) after “protected” insert “ by design right or ” .

Patents Act 1977 (c. 37)

20.- In section 57 of the Patents Act 1977 (rights of third parties in respect of Crown use of patent), in the closing words of subsection (1) (which relate to the use of models or documents), after “copyright” insert “ or design right ” .

21.- In section 105 of the Patents Act 1977 (privilege in Scotland for communications relating to patent proceedings), omit “within the meaning of section 104 above”, make the existing text subsection (1) and after it insert:

“(2)In this section:

“ patent proceedings ” means proceedings under this Act or any of the relevant conventions, before the court, the comptroller or the relevant convention court, whether contested or uncontested and including an application for a patent; and

“ the relevant conventions ” means the European Patent Convention, the Community Patent Convention and the Patent Co-operation Treaty. ”.

22.- In section 123(7) of the Patents Act 1977 (publication of case reports by the comptroller):

(a) for “and registered designs” substitute “ registered designs or design right ” ,

(b) for “and copyright” substitute “ , copyright and design right ” .

23.- In section 130(1) of the Patents Act 1977 (interpretation), in the definition of “court”, for paragraph (a) substitute:

“(a) as respects England and Wales, the High Court or any patents county court having jurisdiction by virtue of an order under section 287 of the Copyright, Designs and Patents Act 1988;”.

Unfair Contract Terms Act 1977 (c. 50)

24.- In paragraph 1 of Schedule 1 to the Unfair Contract Terms Act 1977 (scope of main provisions: excluded contracts), in paragraph (c) (contracts relating to grant or transfer of interest in intellectual property) after “copyright” insert “ or design right ” .

Judicature (Northern Ireland) Act 1978 (c. 23)

25.- In section 94A of the Judicature (Northern Ireland) Act 1978 (withdrawal of privilege against self-incrimination in certain proceedings relating to intellectual property), in subsection (5) (meaning of “intellectual property”) after “copyright” insert “ or design right ” .

Capital Gains Tax Act 1979 (c. 14)

F973 26.- . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

British Telecommunications Act 1981 (c. 38)

27.- F974 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[F975Senior Courts Act 1981] (c. 54)

28.-

(1) The [F976Senior Courts Act 1981] is amended as follows.

(2) In section 72 (withdrawal of privilege against self-incrimination in certain proceedings relating to intellectual property), in subsection (5) (meaning of “intellectual property”) after “copyright” insert “ , design right ” .

(3) In Schedule 1 (distribution of business in the High Court), in paragraph 1(i) (business assigned to the Chancery Division: causes and matters relating to certain intellectual property) for “or copyright” substitute “ , copyright or design right ” .

F977 29 , 30.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Companies Act 1985 (c. 6)

[F978 31.-

(1) Part XII of the Companies Act 1985 (registration of charges) is amended as follows.

(2) In section 396 (registration of charges in England and Wales: charges which must be registered), in subsection (1)(j) for the words from “on a patent” to the end substitute “ or on any intellectual property ” , and after subsection (3) insert:

“(3A) The following are “ intellectual property ” for the purposes of this section:

(a)any patent, trade mark, service mark, registered design, copyright or design right;

(b)any licence under or in respect of any such right.”.

(3)In section 410 (registration of charges in Scotland: charges which must be registered), in subsection (4)(c) (incorporeal moveable property) after subparagraph (vi) insert:

“(vii)a registered design or a licence in respect of such a design,

(viii)a design right or a licence under a design right,”.]

Law Reform (Miscellaneous Provisions) (Scotland) Act 1985 (c. 73)

32.- In section 15 of the Law Reform (Miscellaneous Provisions) (Scotland) Act 1985 (withdrawal of privilege against self-incrimination in certain proceedings relating to intellectual property), in subsection (5) (meaning of “intellectual property”) after “copyright” insert “ or design right ” .

Atomic Energy Authority Act 1986 (c. 3)

33.- In section 8(2) of the Atomic Energy Authority Act 1986 (powers of Authority as to exploitation of research: meaning of “intellectual property”), after “copyrights” insert “ , design rights ” .

Education and Libraries (Northern Ireland) Order 1986 ( S.I. 1986/594 (N.I.3))

F979 34.- . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Companies (Northern Ireland) Order 1986 ( S.I. 1986/1032 (N.I.6))

35.- F980 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Income and Corporation Taxes Act 1988 (c. 1)

36.-

(1)The Income and Corporation Taxes Act 1988 is amended as follows.

(2) In section 83 (fees and expenses deductible in computing profits and gains of trade) for “the extension of the period of copyright in a design” substitute “ an extension of the period for which the right in a registered design subsists ” .

(3)F981 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(4)F982 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(5)F982 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(6)F982 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(7) In section 821 (payments made under deduction of tax before passing of Act imposing income tax for that year), in subsection (3) (payments subject to adjustment) after paragraph (a) insert:

“(aa) any payment for or in respect of a right in a design to which section 537B applies; and”.

(8) In Schedule 19 (apportionment of income of close companies), in paragraph 10(4) (cessation or liquidation: debts taken into account although creditor is participator or associate), in paragraph (c) (payments for use of certain property) for the words from “tangible property” to “extend)” substitute:

“(i) tangible property,

(ii) copyright in a literary, dramatic, musical or artistic work within the meaning of Part I of the Copyright, Designs and Patents Act 1988 (or any similar right under the law of a country to which that Part does not extend), or

(iii) design right,”.

(9) In Schedule 25 (taxation of UK-controlled foreign companies: exempt activities), in paragraph 9(1)(a) (investment business: holding of property) for “patents or copyrights” substitute “ or intellectual property ” and after that subparagraph insert:

“(1A) In sub-paragraph (1)(a) above “ intellectual property ” means patents, registered designs, copyright and design right (or any similar rights under the law of a country outside the United Kingdom). ”.

Section 303(2).- SCHEDULE 8.- Repeals

1939 c. 107. Patents, Designs, Copyright and

Trade Marks (Emergency) Act 1939. In section 10(1), the definition of “copyright”.

1945 c. 16. Limitation (Enemies and War

Prisoners) Act 1945. In sections 2(1) and 4(a), the reference to section 10 of the Copyright Act 1911.

1949 c. 88. Registered Designs Act 1949. In section 3(2), the words “or original”.

Section 5(5).

In section 11(2), the words “or original”.

In section 14(3), the words “or the Isle of Man”.

Section 32.

Section 33(2).

Section 37(1).

Section 38.

In section 44(1), the definitions of “copyright” and “Journal”.

In section 45, paragraphs (1) and (2).

In section 46, paragraphs (1) and (2).

1949 c.

88-cont. Registered Designs Act 1949 Section 48(1).

In Schedule 1, in paragraph 3(1), the words “in such manner as may be prescribed by rules of court”.

Schedule 2.

1956 c. 74. Copyright Act 1956. The whole Act.

1957 c. 6. Ghana Independence Act 1957. In Schedule 2, paragraph 12.

1957 c. 60. Federation of Malaya Independence Act 1957. In Schedule 1, paragraphs 14 and 15.

1958 c. 44. Dramatic and Musical Performers’ Protection Act 1958. The whole Act.

1958 c. 51. Public Records Act 1958. Section 11.

Schedule 3.

1960 c. 52. Cyprus Independence Act 1960. In the Schedule, paragraph 13.

1960 c. 55. Nigeria Independence Act 1960. In Schedule 2, paragraphs 12 and 13.

1961 c. 1. Tanganyika Independence Act 1961. In Schedule 2, paragraphs 13 and 14.

1961 c. 16. Sierra Leone Independence Act 1961. In Schedule 3, paragraphs 13 and 14.

1961 c. 25. Patents and Designs (Renewals,

Extensions and Fees) Act 1961. The whole Act.

1962 c. 40. Jamaica Independence Act 1962. In Schedule 2, paragraph 13.

1962 c. 54. Trinidad and Tobago Independence

Act 1962. In Schedule 2, paragraph 13.

1963 c. 53. Performers’ Protection Act 1963. The whole Act.

1964 c. 46. Malawi Independence Act 1964. In Schedule 2, paragraph 13.

1964 c. 65. Zambia Independence Act 1964. In Schedule 1, paragraph 9.

. . .

F983.

1964 c. 93. Gambia Independence Act 1964. In Schedule 2, paragraph 12.

1966 c. 24. Lesotho Independence Act 1966. In the Schedule, paragraph 9.

1966 c. 37. Barbados Independence Act 1966. In Schedule 2, paragraph 12.

1967 c. 80. Criminal Justice Act 1967. In Parts I and IV of Schedule 3, the

entries relating to the Registered Designs Act 1949.

1968 c. 56. Swaziland Independence Act 1968. In the Schedule, paragraph 9.

1968 c. 67. Medicines Act 1968. In section 92(2)(a), the words from “or

embodied” to “film”.

Section 98.

1968 c. 68. Design Copyright Act 1968. The whole Act.

1971 c. 4. Copyright (Amendment) Act 1971. The whole Act.

1971 c. 23. Courts Act 1971. In Schedule 9, the entry relating to the

1971 c. 62. Tribunals and Inquiries Act 1971. In Schedule 1, paragraph 24.

1972 c. 32. Performers’ Protection Act 1972. The whole Act.

1975 c. 24. House of Commons

Disqualification Act 1975. In Part II of Schedule 1, the entry relating to the Performing Right Tribunal.

1975 c. 25. Northern Ireland Assembly

Disqualification Act 1975. In Part II of Schedule 1, the entry relating to the Performing Right Tribunal.

1977 c. 37. Patents Act 1977. Section 14(4) and (8).

In section 28(3), paragraph (b) and the word “and” preceding it.

Section 28(5) to (9).

Section 49(3).

Sections 72(3).

Sections 84 and 85.

Section 88.

Section 104.

In section 105, the words “within the meaning of section 104 above”.

Sections 114 and 115.

Section 123(2)(k).

In section 130(1), the definition of “patent agent”.

In section 130(7), the words “88(6) and (7),”.

In Schedule 5, paragraphs 1 and 2, in paragraph 3 the words “and 44(1)” and “in each case”, and paragraphs 7 and 8.

1979 c. 2. Customs and Excise Management

Act 1979. In Schedule 4, the entry relating to the Copyright Act 1956.

1980 c. 21. Competition Act 1980. Section 14.

1981 c. 68. Broadcasting Act 1981. Section 20(9)(a).

1982 c. 35. Copyright Act 1956 (Amendment) Act

1982. The whole Act.

1983 c. 42. Copyright (Amendment) Act 1983. The whole Act.

1984 c. 46. Cable and Broadcasting Act 1984. Section 8(8).

Section 16(4) and (5).

Sections 22 to 24.

Section 35(2) and (3).

Sections 53 and 54.

In section 56(2), the definition of “the 1956 Act”.

In Schedule 5, paragraphs 6, 7, 13 and 23.

1985 c. 21. Films Act 1985. Section 7(2).

1985 c. 41. Copyright (Computer Software)

Amendment Act 1985. The whole Act.

1985 c. 61. Administration of Justice Act 1985. Section 60.

1986 c. 39. Patents, Designs and Marks Act 1986. In Schedule 2, paragraph 1(2)(a), in

paragraph 1(2)(k) the words “subsection (1)(j) of section 396 and” and in paragraph 1(2)(1) the words “subsection (2)(i) of section 93”.

1988 c. 1. Income and Corporation Taxes Act

1988. In Schedule 29, paragraph 5.]

25Mar/19

Data Protection Act 2018, Chapter 12

25 marzo, 2019Gran Bretaña e Irlanda del Norte, LeyData Protection Act 2018José Cuervo

11Mar/19

La Resolución 68/167 de la ONU sobre el derecho a la privacidad en la era digital.

11 marzo, 2019ONU, ResoluciónAsamblea General, Carta de las Naciones Unidas, Declaración Universal de Derechos Humanos, Declaración y el Programa de Acción de Viena, Derechos humanos y las libertades fundamentales, ONU, Pacto Internacional de Derechos Civiles y Políticos, Pacto Internacional de Derechos Económicos, Sociales y CulturalesJosé Cuervo

La Resolución 68/167 de la ONU sobre el derecho a la privacidad en la era digital. Resolución aprobada por la Asamblea General el 18 de diciembre de 2013.

La Asamblea General,

Reafirmando los propósitos y principios de la Carta de las Naciones Unidas,

Reafirmando también los derechos humanos y las libertades fundamentales consagrados en la Declaración Universal de Derechos Humanos (1) y los tratados internacionales de derechos humanos pertinentes, incluidos el Pacto Internacional de Derechos Civiles y Políticos (2) y el Pacto Internacional de Derechos Económicos, Sociales y Culturales (2) ,

Reafirmando además la Declaración y el Programa de Acción de Viena (3) ,

Observando que el rápido ritmo del desarrollo tecnológico permite a las personas de todo el mundo utilizar las nuevas tecnologías de la información y las comunicaciones y, al mismo tiempo, incrementa la capacidad de los gobiernos, las empresas y las personas de llevar a cabo actividades de vigilancia, interceptación y recopilación de datos, lo que podría constituir una violación o una transgresión de los derechos humanos, en particular del derecho a la privacidad, establecido en el artículo 12 de la Declaración Universal de Derechos Humanos y el artículo 17 del Pacto Internacional de Derechos Civiles y Políticos, y que, por lo tanto, esta cuestión suscita cada vez más preocupación,

Reafirmando el derecho humano a la privacidad, según el cual nadie debe ser objeto de injerencias arbitrarias o ilegales en su vida privada, su familia, su domicilio o su correspondencia, y el derecho a la protección de la ley contra esas injerencias, y reconociendo que el ejercicio del derecho a la privacidad es importante para materializar el derecho a la libertad de expresión y para abrigar opiniones sin interferencias, y es una de las bases de una sociedad democrática,

Destacando la importancia del pleno respeto de la libertad de buscar, recibir y difundir información, incluida la importancia fundamental del acceso a la información y la participación democrática,

Acogiendo con beneplácito el informe del Relator Especial sobre la promoción y protección del derecho a la libertad de opinión y de expresión (4) relativo a las implicaciones de la vigilancia de las comunicaciones realizada por los Estados en el ejercicio de los derechos humanos a la privacidad y a la libertad de opinión y expresión, presentado al Consejo de Derechos Humanos en su 23º período de sesiones,

Poniendo de relieve que la vigilancia y la interceptación ilícitas o arbitrarias de las comunicaciones, así como la recopilación ilícita o arbitraria de datos personales, al constituir actos de intrusión grave, violan los derechos a la privacidad y a la libertad de expresión y pueden ser contrarios a los preceptos de una sociedad democrática,

Observando que, si bien las consideraciones relacionadas con la seguridad pública pueden justificar la recopilación y la protección de determinada información delicada, los Estados deben garantizar el pleno cumplimiento de sus obligaciones en virtud del derecho internacional de los derechos humanos,

Profundamente preocupada por los efectos negativos que pueden tener para el ejercicio y el goce de los derechos humanos la vigilancia y la interceptación de las comunicaciones, incluidas la vigilancia y la interceptación extraterritoriales de las comunicaciones y la recopilación de datos personales, en particular cuando se llevan a cabo a gran escala,

Reafirmando que los Estados deben cerciorarse de que toda medida que se adopte para luchar contra el terrorismo sea conforme con sus obligaciones con arreglo al derecho internacional, en particular el derecho internacional de los derechos humanos, el derecho internacional de los refugiados y el derecho internacional humanitario,

1. Reafirma el derecho a la privacidad, según el cual nadie debe ser objeto de injerencias arbitrarias o ilegales en su vida privada, su familia, su domicilio o su correspondencia, y el derecho a la protección de la ley contra tales injerencias, establecidos en el artículo 12 de la Declaración Universal de Derechos Humanos (1) y el artículo 17 del Pacto Internacional de Derechos Civiles y Políticos (2) ;

2. Reconoce la naturaleza global y abierta de la Internet y el rápido avance de las tecnologías de la información y las comunicaciones como fuerza impulsora de la aceleración de los progresos hacia el desarrollo en sus distintas formas;

3. Afirma que los derechos de las personas también deben estar protegidos en Internet, incluido el derecho a la privacidad;

4. Exhorta a todos los Estados a que:

a) Respeten y protejan el derecho a la privacidad, incluso en el contexto de las comunicaciones digitales;

b) Adopten medidas para poner fin a las violaciones de esos derechos y creen las condiciones necesarias para impedirlas, como cerciorarse de que la legislación nacional pertinente se ajuste a sus obligaciones en virtud del derecho internacional de los derechos humanos;

c) Examinen sus procedimientos, prácticas y legislación relativos a la vigilancia y la interceptación de las comunicaciones y la recopilación de datos personales, incluidas la vigilancia, interceptación y recopilación a gran escala, con miras a afianzar el derecho a la privacidad, velando por que se dé cumplimiento pleno y efectivo de todas sus obligaciones en virtud del derecho internacional de los derechos humanos;

d) Establezcan o mantengan mecanismos nacionales de supervisión independientes y efectivos capaces de asegurar la transparencia, cuando proceda, y la rendición de cuentas por las actividades de vigilancia de las comunicaciones y la interceptación y recopilación de datos personales que realice el Estado;

5. Solicita a la Alta Comisionada de las Naciones Unidas para los Derechos Humanos que presente al Consejo de Derechos Humanos en su 27º período de sesiones y a la Asamblea General en su sexagésimo noveno período de sesiones un informe sobre la protección y la promoción del derecho a la privacidad en el contexto de la vigilancia y la interceptación de las comunicaciones digitales y la recopilación de datos personales en los planos nacional y extraterritorial, incluso a gran escala, que incluya opiniones y recomendaciones, para que lo examinen los Estados Miembros;

6. Decide examinar la cuestión en su sexagésimo noveno período de sesiones, en relación con el subtema titulado “Cuestiones de derechos humanos, incluidos otros medios de mejorar el goce efectivo de los derechos humanos y las libertades fundamentales” del tema titulado “Promoción y protección de los derechos humanos”.

70ª sesión plenaria 18 de diciembre de 2013

(1) Resolución 217 A (III).

(2) Véase la resolución 2200 A (XXI), anexo.

(3) A/CONF.157/24 (Part I), cap. III.

(4) A/HRC/23/40.

08Ene/19

Medida Provisoria nº 869 de 27 de Dezembro de 2018

8 enero, 2019Brasil, Medida ProvisoriaDerecho Informático Brasil, Medida Provisoria nº 869 de 27 de Dezembro de 2018 (DOU 28.12.2018)José Cuervo

Medida Provisoria nº 869 de 27 de Dezembro de 2018 (DOU 28.12.2018).

Medida Provisoria 869/18

Altera a Lei nº 13.709, de 14 de agosto de 2018, para dispor sobre a proteção de dados pessoais e para criar a Autoridade Nacional de Proteção de Dados, e dá outras providências.

O PRESIDENTE DA REPÚBLICA, no uso da atribuição que lhe confere o Artigo 62 da Constituição, adota a seguinte Medida Provisória, com força de lei:

Artigo 1º A Lei nº 13.709, de 14 de agosto de 2018, passa a vigorar com as seguintes alterações:

“Artigo 3º ………………………………………………………………………………………………………..

………………………………………………………………………………………………………………………….

II – a atividade de tratamento tenha por objetivo a oferta ou o fornecimento de bens ou serviços ou o tratamento de dados de indivíduos localizados no território nacional; ou ……………………………………………………………………………………………………………………” (NR)

“Artigo 4º …………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………..

II – ………………………………………………………………………………………………………………….

……………………………………………………………………………………………………………………………

b) acadêmicos;

……………………………………………………………………………………………………………………………

§ 2º O tratamento dos dados a que se refere o inciso III do caput por pessoa jurídica de direito privado só será admitido em procedimentos sob a tutela de pessoa jurídica de direito público, hipótese na qual será observada a limitação de que trata o

§ 3º.

§ 3º Os dados pessoais constantes de bancos de dados constituídos para os fins de que trata o inciso III do caput não poderão ser tratados em sua totalidade por pessoas jurídicas de direito privado, não incluídas as controladas pelo Poder Público.” (NR)

“Artigo 5º …………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………..

VIII – encarregado: pessoa indicada pelo controlador para atuar como canal de comunicação entre o controlador, os titulares dos dados e a Autoridade Nacional de Proteção de Dados;

……………………………………………………………………………………………………………………………

XVIII – órgão de pesquisa: órgão ou entidade da administração pública direta ou indireta ou pessoa jurídica de direito privado sem fins lucrativos legalmente constituída sob as leis brasileiras, com sede e foro no País, que inclua em sua missão institucional ou em seu objetivo social ou estatutário a pesquisa básica ou aplicada de caráter histórico, científico, tecnológico ou estatístico; e

XIX – autoridade nacional: órgão da administração pública responsável por zelar, implementar e fiscalizar o cumprimento desta Lei.” (NR)

“Artigo 11. ………………………………………………………………………………………………………..

……………………………………………………………………………………………………………………………

§ 4º É vedada a comunicação ou o uso compartilhado entre controladores de dados pessoais sensíveis referentes à saúde com objetivo de obter vantagem econômica, exceto nas hipóteses de:

I – portabilidade de dados quando consentido pelo titular; ou

II – necessidade de comunicação para a adequada prestação de serviços de saúde suplementar.” (NR)

“Artigo 20. O titular dos dados tem direito a solicitar a revisão de decisões tomadas unicamente com base em tratamento automatizado de dados pessoais que afetem seus interesses, incluídas as decisões destinadas a definir o seu perfil pessoal, profissional, de consumo e de crédito ou os aspectos de sua personalidade.

……………………………………………………………………………………………………………………” (NR)

“Artigo 26. ………………………………………………………………………………………………………..

§ 1º ………………………………………………………………………………………………………………

……………………………………………………………………………………………………………………………

III – se for indicado um encarregado para as operações de tratamento de dados pessoais, nos termos do Artigo 39;

IV – quando houver previsão legal ou a transferência for respaldada em contratos, convênios ou instrumentos congêneres;

V – na hipótese de a transferência dos dados objetivar a prevenção de fraudes e irregularidades, ou proteger e resguardar a segurança e a integridade do titular dos dados; ou

VI – nos casos em que os dados forem acessíveis publicamente, observadas as disposições desta Lei.

……………………………………………………………………………………………………………………” (NR)

“Artigo 27. A comunicação ou o uso compartilhado de dados pessoais de pessoa jurídica de direito público a pessoa jurídica de direito privado dependerá de consentimento do titular, exceto:

……………………………………………………………………………………………………………………” (NR)

“Artigo 29. A autoridade nacional poderá solicitar, a qualquer momento, aos órgãos e às entidades do Poder Público a realização de operações de tratamento de dados pessoais, as informações específicas sobre o âmbito e a natureza dos dados e outros detalhes do tratamento realizado e poderá emitir parecer técnico complementar para garantir o cumprimento desta Lei.” (NR)

“Artigo 55-A. Fica criada, sem aumento de despesa, a Autoridade Nacional de Proteção de Dados – ANPD, órgão da administração pública federal, integrante da Presidência da República.” (NR)

“Artigo 55-B. É assegurada autonomia técnica à ANPD.” (NR)

“Artigo 55-C. ANPD é composta por:

I – Conselho Diretor, órgão máximo de direção;

II – Conselho Nacional de Proteção de Dados Pessoais e da Privacidade;

III – Corregedoria;

IV – Ouvidoria;

V – órgão de assessoramento jurídico próprio; e

VI – unidades administrativas e unidades especializadas necessárias à aplicação do disposto nesta Lei.” (NR)

“Artigo 55-D. O Conselho Diretor da ANPD será composto por cinco diretores, incluído o Diretor-Presidente.

§ 1º Os membros do Conselho Diretor da ANPD serão nomeados pelo Presidente da República e ocuparão cargo em comissão do Grupo-Direção e Assessoramento Superior – DAS de nível 5.” (NR)

§ 2º Os membros do Conselho Diretor serão escolhidos dentre brasileiros, de reputação ilibada, com nível superior de educação e elevado conceito no campo de especialidade dos cargos para os quais serão nomeados.

§ 3º O mandato dos membros do Conselho Diretor será de quatro anos.

§ 4º Os mandatos dos primeiros membros do Conselho Diretor nomeados serão de dois, de três, de quatro, de cinco e de seis anos, conforme estabelecido no ato de nomeação.

§ 5º Na hipótese de vacância do cargo no curso do mandato de membro do Conselho Diretor, o prazo remanescente será completado pelo sucessor.” (NR)

“Artigo 55-E. Os membros do Conselho Diretor somente perderão seus cargos em virtude de renúncia, condenação judicial transitada em julgado ou pena de demissão decorrente de processo administrativo disciplinar.

§ 1º Nos termos do caput, cabe ao Ministro de Estado Chefe da Casa Civil da Presidência da República instaurar o processo administrativo disciplinar, que será conduzido por comissão especial constituída por servidores públicos federais estáveis.

§ 2º Compete ao Presidente da República determinar o afastamento preventivo, caso necessário, e proferir o julgamento.” (NR)

“Artigo 55-F. Aplica-se aos membros do Conselho Diretor, após o exercício do cargo, o disposto no Artigo 6º da Lei nº 12.813, de 16 de maio de 2013.

Parágrafo único. A infração ao disposto no caput caracteriza ato de improbidade administrativa.” (NR)

“Artigo 55-G. Ato do Presidente da República disporá sobre a estrutura regimental da ANPD.

Parágrafo único. Até a data de entrada em vigor de sua estrutura regimental, a ANPD receberá o apoio técnico e administrativo da Casa Civil da Presidência da República para o exercício de suas atividades.” (NR)

“Artigo 55-H. Os cargos em comissão e as funções de confiança da ANPD serão remanejados de outros órgãos e entidades do Poder Executivo federal.” (NR)

“Artigo 55-I. Os ocupantes dos cargos em comissão e das funções de confiança da ANPD serão indicados pelo Conselho Diretor e nomeados ou designados pelo Diretor-Presidente.” (NR)

“Artigo 55-J. Compete à ANPD:

I – zelar pela proteção dos dados pessoais;

II – editar normas e procedimentos sobre a proteção de dados pessoais;

III – deliberar, na esfera administrativa, sobre a interpretação desta Lei, suas competências e os casos omissos;

IV – requisitar informações, a qualquer momento, aos controladores e operadores de dados pessoais que realizem operações de tratamento de dados pessoais;

V – implementar mecanismos simplificados, inclusive por meio eletrônico, para o registro de reclamações sobre o tratamento de dados pessoais em desconformidade com esta Lei;

VI – fiscalizar e aplicar sanções na hipótese de tratamento de dados realizado em descumprimento à legislação, mediante processo administrativo que assegure o contraditório, a ampla defesa e o direito de recurso;

VII – comunicar às autoridades competentes as infrações penais das quais tiver conhecimento;

VIII – comunicar aos órgãos de controle interno o descumprimento do disposto nesta Lei praticado por órgãos e entidades da administração pública federal;

IX – difundir na sociedade o conhecimento sobre as normas e as políticas públicas de proteção de dados pessoais e sobre as medidas de segurança;

X – estimular a adoção de padrões para serviços e produtos que facilitem o exercício de controle e proteção dos titulares sobre seus dados pessoais, consideradas as especificidades das atividades e o porte dos controladores;

XI – elaborar estudos sobre as práticas nacionais e internacionais de proteção de dados pessoais e privacidade;

XII – promover ações de cooperação com autoridades de proteção de dados pessoais de outros países, de natureza internacional ou transnacional;

XIII – realizar consultas públicas para colher sugestões sobre temas de relevante interesse público na área de atuação da ANPD;

XIV – realizar, previamente à edição de resoluções, a oitiva de entidades ou órgãos da administração pública que sejam responsáveis pela regulação de setores específicos da atividade econômica;

XV – articular-se com as autoridades reguladoras públicas para exercer suas competências em setores específicos de atividades econômicas e governamentais sujeitas à regulação; e

XVI – elaborar relatórios de gestão anuais acerca de suas atividades.

§ 1º A ANPD, na edição de suas normas, deverá observar a exigência de mínima intervenção, assegurados os fundamentos e os princípios previstos nesta Lei e o disposto no Artigo 170 da Constituição.

§ 2º A ANPD e os órgãos e entidades públicos responsáveis pela regulação de setores específicos da atividade econômica e governamental devem coordenar suas atividades, nas correspondentes esferas de atuação, com vistas a assegurar o cumprimento de suas atribuições com a maior eficiência e promover o adequado funcionamento dos setores regulados, conforme legislação específica, e o tratamento de dados pessoais, na forma desta Lei.

§ 3º A ANPD manterá fórum permanente de comunicação, inclusive por meio de cooperação técnica, com órgãos e entidades da administração pública que sejam responsáveis pela regulação de setores específicos da atividade econômica e governamental, a fim de facilitar as competências regulatória, fiscalizatória e punitiva da ANPD.

§ 4º No exercício das competências de que trata o caput, a autoridade competente deverá zelar pela preservação do segredo empresarial e do sigilo das informações, nos termos da lei, sob pena de responsabilidade.

§ 5º As reclamações colhidas conforme o disposto no inciso V do caput poderão ser analisadas de forma agregada e as eventuais providências delas decorrentes poderão ser adotadas de forma padronizada.” (NR)

“Artigo 55-K. A aplicação das sanções previstas nesta Lei compete exclusivamente à ANPD, cujas demais competências prevalecerão, no que se refere à proteção de dados pessoais, sobre as competências correlatas de outras entidades ou órgãos da administração pública.

Parágrafo único. A ANPD articulará sua atuação com o Sistema Nacional de Defesa do Consumidor do Ministério da Justiça e com outros órgãos e entidades com competências sancionatórias e normativas afetas ao tema de proteção de dados pessoais, e será o órgão central de interpretação desta Lei e do estabelecimento de normas e diretrizes para a sua implementação.” (NR)

“Artigo 58-A. O Conselho Nacional de Proteção de Dados Pessoais e da Privacidade será composto por vinte e três representantes, titulares suplentes, dos seguintes órgãos:

I – seis do Poder Executivo federal;

II – um do Senado Federal;

III – um da Câmara dos Deputados;

IV – um do Conselho Nacional de Justiça;

V – um do Conselho Nacional do Ministério Público;

VI – um do Comitê Gestor da Internet no Brasil;

VII – quatro de entidades da sociedade civil com atuação comprovada em proteção de dados pessoais;

VIII – quatro de instituições científicas, tecnológicas e de inovação; e

IX – quatro de entidades representativas do setor empresarial relacionado à área de tratamento de dados pessoais.

§ 1º Os representantes serão designados pelo Presidente da República.

§ 2º Os representantes de que tratam os incisos I a VI do caput e seus suplentes serão indicados pelos titulares dos respectivos órgãos e entidades da administração pública.

§ 3º Os representantes de que tratam os incisos VII, VIII e IX do caput e seus suplentes:

I – serão indicados na forma de regulamento;

II – terão mandato de dois anos, permitida uma recondução; e

III – não poderão ser membros do Comitê Gestor da Internet no Brasil.

§ 4º A participação no Conselho Nacional de Proteção de Dados Pessoais e da Privacidade será considerada prestação de serviço público relevante, não remunerada.” (NR)

“Artigo 58-B. Compete ao Conselho Nacional de Proteção de Dados Pessoais e da Privacidade:

I – propor diretrizes estratégicas e fornecer subsídios para a elaboração da Política Nacional de Proteção de Dados Pessoais e da Privacidade e para a atuação da ANPD;

II – elaborar relatórios anuais de avaliação da execução das ações da Política Nacional de Proteção de Dados Pessoais e da Privacidade;

III – sugerir ações a serem realizadas pela ANPD;

IV – elaborar estudos e realizar debates e audiências públicas sobre a proteção de dados pessoais e da privacidade; e

V – disseminar o conhecimento sobre a proteção de dados pessoais e da privacidade à população em geral.” (NR)

“Artigo 65. Esta Lei entra em vigor:

I – quanto aos Artigo 55-A, Artigo 55-B, Artigo 55-C, Artigo 55-D, Artigo 55-E, Artigo 55-F, Artigo 55-G, Artigo 55-H, Artigo 55-I, Artigo 55-J, Artigo 55-K, Artigo 58-A e Artigo 58-B, no dia 28 de dezembro de 2018; e

II – vinte e quatro meses após a data de sua publicação quanto aos demais artigos.” (NR)

Artigo 2º A Lei nº 13.502, de 1º de novembro de 2017, passa a vigorar com as seguintes alterações:

“Artigo 2º ……………………………………………………………………………………………………….

…………………………………………………………………………………………………………………………

V – o Gabinete de Segurança Institucional;

VI – a Secretaria Especial da Aquicultura e da Pesca; e

VII – a Autoridade Nacional de Proteção de Dados Pessoais.

………………………………………………………………………………………………………………..” (NR)

“Seção VI – A Da Autoridade Nacional de Proteção de Dados Pessoais

Artigo 12-A. À Autoridade Nacional de Proteção de Dados Pessoais compete exercer as competências estabelecidas na Lei nº 13.709, de 14 de agosto de 2018.” (NR)

Artigo 3º Ficam revogados os seguintes dispositivos da Lei nº 13.709, de 2018:

I – o § 4º do Artigo 4º;

II – os § 1º e § 2º do Artigo 7º; e

III – o Artigo 62.

Artigo 4º Esta Medida Provisória entra em vigor na data de sua publicação.

Brasília, 27 de dezembro de 2018; 197º da Independência e 130º da República.

MICHEL TEMER

Esteves Pedro Colnago Junior

01Ene/19

Número 20, segundo semestre de 2018

1 enero, 2019RevistaDerecho Informático, Informática Jurídica, Revista Electrónica Semestral Informática JurídicaJosé Cuervo

ISSN 1989-5852
Título clave: Revista informática jurídica
Tít. abreviado: Rev. inform. jurid.

Introducción

En este vigésimo número de la Revista, aparecen artículos de colaboradores por orden alfabético.

Un agradecimiento especial a los 25 colaboradores que han aportado sus artículos para hacer posible la publicación semestral de esta revista, que ya lleva 10 años

Un cordial saludo para todos y gracias por vuestra colaboración.

Aprovecho la ocasión para desearos felices fiestas y un Venturoso año 2019

José Cuervo Álvarez

Batista Avila, Yordan

Profesor Auxiliar de la Universidad de Granma. Sede “Blas Roca Calderío”

G énesis de la cultura informática en las Universidades (30.10.2018) (Trabajo en colaboración con Lic. Yoendris Hechavarría Derronselet y MSc. Luis Alberto Palacio Ramírez)

Casí Ladrón de Guevara, Yosvanys

Profesor Auxiliar. Máster en Nuevas Tecnologías para la Educación, profesor auxiliar. Universidad de Granma. “Sede Blas Roca Calderío”

Relaciones interdisciplinarias entre las disciplinas de educación laboral e informática (07.11.2018) (Trabajo en colaboración con Yoendris Hechavarria Derronselet)

Castro Dieguez, Fidel Enrique

Software educativo sobre plataforma libre para la asignatura Investigación de Operaciones (19.09.2018) (Trabajo en colaboración con Ing. Yamira Medel Viltres, MSc. Danilo Fornaris Montero, e Ing. Omar Plá Hernández)

Sistema de gestión de información de los grupos electrógenos en la Dirección Territorial de ETECSA en Granma (13.11.2018) (Trabajo en colaboración con Ing. Liusvani Victor Verdecia Jiménez e Ing. Yamira Medel Viltres)

Fonseca Hernández, Juan Antonio

Árboles y su implementación en Object Pascal (31.01.2018) (Trabajo en colaboración con Noralys Muñiz Maldonado y Marcos Antonio León Fonseca)

Archivos de recursos y de configuración en Delphi (31.01.2018) (Trabajo en colaboración con Marcos Antonio León Fonseca y Noralys Muñoz Maldonado)

Fornaris Montero, Danilo

Software educativo sobre plataforma libre para la asignatura Investigación de Operaciones (19.09.2018) (Trabajo en colaboración con Ing. Yamira Medel Viltres, MSc. Fidel Enrique Castro Dieguez, e Ing. Omar Plá Hernández)

García Pérez, Celia Maliuska

Universidad de Granma, Carretera a Manzanillo kilómetro 17 1/2 Peralejo. Bayamo. Granma. Cuba

S istema Informático para el cálculo en la tecnología del molde para la obtención de piezas fundidas en la empresa de servicios técnicos “Cmdte. Manuel Fajardo Rivero” (13.11.2018) (Trabajo en colaboración con José Eduardo Márquez Delgado)

González Mojena, Yanetsys

Sistema de gestión de información para el control de las ilegalidades en el Instituto de Planificación Física (19.09.2018) (Trabajo en colaboración con MS.c. Angel Enrique Fiqueredo Leon)

Hechavarría Derronselet, Yoendris

Licenciado en Educación Laboral. Profesor Asistente de la Universidad de Granma Sede “Blas Roca Calderío”

G énesis de la cultura informática en las Universidades (30.10.2018) (Trabajo en colaboración con MSc. Yordan Batista Avila y MSc. Luis Alberto Palacio Ramírez)

Relaciones interdisciplinarias entre las disciplinas de educación laboral e informática (07.11.2018) (Trabajo en colaboración con Yosvanis Casí Ladrón de Guevara)

Márquez Delgado, José Eduardo

Universidad de Granma, Carretera a Manzanillo kilómetro 17 1/2 Peralejo. Bayamo. Granma. Cuba

Sistema Informático para el cálculo en la tecnología del molde para la obtención de piezas fundidas en la empresa de servicios técnicos “Cmdte. Manuel Fajardo Rivero” (13.11.2018) (Trabajo en colaboración con Celia Maliuska García Pérez)

Martínez Álvarez, Manuel Jacinto

Consultor Seguridad GCR

Áudea Seguridad de la Información

Metadatos, (in) seguridad y fotografías digitales (13.07.2018)

Medel Viltres, Yamira

Software educativo sobre plataforma libre para la asignatura Investigación de Operaciones (19.09.2018) (Trabajo en colaboración con MSc. Fidel Enrique Castro Dieguez, MSc. Danilo Fornaris Montero, e Ing. Omar Plá Hernández)

Medela, Marina

Legal Department

Áudea Seguridad de la Información

Data brokers, mercaderes de la intimidad (14 de febrero de 2018)

El conflicto de intereses del DPO (14 de febrero de 2018)

¿Qué hay detrás de las fake news? (13.07.2018)

Moratilla, José Carlos

Departamento Legal. Áudea Seguridad de la Informació

GDPR: ¿Una norma totalmente disruptiva? (13.07.2018)

Palacio Ramírez, Luis Alberto

Profesor Asistente de la Universidad de Granma. Sede “Blas Roca Calderío”

G énesis de la cultura informática en las Universidades (30.10.2018) (Trabajo en colaboración con Lic. Yoendris Hechavarría Derronselet y MSc. Yordan Batista Avila)

Plá Hernández, Omar

Reinaldo Filho, Demócrito

Lei de Proteção de Dados Pessoais aproxima o Brasil dos Países Civilizados (01.08.2018)

EUA se preparam para aprovar Lei sobre proteção de dados pessoais semelhante à Europeia? (07.11.2018)

Rodríguez Ramírez, María Isabel

Las visitas virtuales interactivas en 360º como herramienta para la difusión del Patrimonio Cultural (11.07.2018) (Trabajo en colaboración con Arelys Vázquez Riverón)

Saavedra, Fernando

Cybersecurity Manager. Áudea Seguridad de la Información

Nuevo Phising con chantaje (20.11.2018)

¿Qué son los muleros bancarios? (20.11.2018)

Sala Simón, Iker

GRC Department. Áudea Seguridad de la Información

Indicadores de Compromiso en la gestión de riesgos (20.11.2018)

Vázquez Riverón, Arelys

Las visitas virtuales interactivas en 360º como herramienta para la difusión del Patrimonio Cultural (11.07.2018) (Trabajo en colaboración con María Isabel Rodríguez Ramirez)

Verdecia Jiménez, Liusvani Victor

Sistema de gestión de información de los grupos electrógenos en la Dirección Territorial de ETECSA en Granma (13.11.2018) (Trabajo en colaboración con MSc. Fidel Enrique Castro Dieguez e Ing. Yamira Medel Viltres)

Zato, Cristina

Legal Department, Áudea Seguridad de la información

Smart Cities y el regreso a 1984 (13.07.2018)

27Dic/18

Ley 1915 de 12 de julio de 2018

27 diciembre, 2018Colombia, LeyDerecho Informático de Colombia, Legislación Informática de Colombia, Ley 1915 de 12 de julio de 2018, por la cual se modifica la Ley 23 de 1982 y se establecen otras disposiciones en materia de Derecho de Autor y Derechos Conexos.José Cuervo

Ley 1915 de 12 de julio de 2018, por la cual se modifica la Ley 23 de 1982 y se establecen otras disposiciones en materia de Derecho de Autor y Derechos Conexos.

EL CONGRESO DE COLOMBIA

DECRETA:

CAPÍTULO I.- Disposiciones relativas al derecho de autor y los derechos conexos

Artículo 1°.

Adiciónese al artículo 10 de la ley 23 de 1982 el siguiente parágrafo:

Parágrafo. En todo proceso relativo al derecho de autor, y ante cualquier jurisdicción nacional se presumirá, salvo prueba en contrario, que la persona bajo cuyo nombre, seudónimo o su equivalente se haya divulgado la obra, será el titular de los derechos de autor. También se presumirá, salvo prueba en contrario, que la obra se encuentra protegida.

Artículo 2°.

Adiciónese al artículo 11 de la ley 23 de 1982 el siguiente parágrafo:

Parágrafo. Cuando la protección de un fonograma o una interpretación o ejecución fijada en un fonograma se otorgue en virtud del criterio de primera publicación o fijación, se considerará que dicha interpretación, ejecución o fonograma es publicada por primera vez en Colombia, cuando la publicación se realice’ dentro de los treinta (30) días siguientes a la publicación inicial en otro país.

Artículo 3°.

Modifíquese el artículo 12 de la ley 23 de 1982 el cual quedará así:

Artículo 12. El autor o, en su caso, sus derechohabientes, tienen sobre las obras literarias y artísticas el derecho exclusivo de autorizar, o prohibir:

a) la reproducción de la obra bajo cualquier manera o forma, permanente o temporal, mediante cualquier procedimiento incluyendo el almacenamiento temporal en forma electrónica.

b) la comunicación al público de la obra por cualquier medio o procedimiento, ya sean estos alámbricos o inalámbricos, incluyendo la puesta a disposición al público, de tal forma que los miembros del público puedan tener acceso a ella desde el lugar y en el momento que cada uno de ellos elija.

c) la distribución pública del original y copias de sus obras, mediante la venta o a través de cualquier forma de transferencia de propiedad.

d) La importación de copias hechas sin autorización del titular del derecho.

e) El alquiler comercial al público del original o de los ejemplares de sus obras.

f) La traducción, adaptación, arreglo u otra transformación de la obra.

Parágrafo. El derecho a controlar la distribución de un soporte material se agota con la primera venta hecha por el titular del derecho o con su consentimiento, únicamente respecto de las sucesivas reventas, pero no agota ni afecta el derecho exclusivo de autorizar o prohibir el alquiler comercial y préstamo público de los ejemplares vendidos.

Artículo 4°.

Modifíquese el artículo 27 de la Ley 23 de 1982, el cual quedará así:

Artículo 27. En todos los casos en que una obra literaria o artística tenga por titular del derecho de autor a una persona jurídica, el plazo de protección será de 70 años contados a partir del final del año calendario de la primera publicación autorizada de la obra.

Si dentro de los 50 años siguientes a la creación de la obra no ha existido publicación autorizada, el plazo de protección será de 70 años a partir del final del año calendario de la creación de la obra.

Artículo 5°.

Adiciónese al Capítulo XII de la Ley 23 de 1982, un artículo 164 BIS el cual quedará así:

Artículo 164 BIS. Para los efectos de la presente ley se entiende por:

a) Radiodifusión. La transmisión al público por medios inalámbricos o por satélite de los sonidos o sonidos e imágenes, o representaciones de los mismos; incluyendo la transmisión inalámbrica de señales codificadas, donde el medio de decodificación es suministrado al público por el organismo de radiodifusión o con su consentimiento; radiodifusión no incluye las transmisiones por las redes de computación o cualquier transmisión en donde tanto el lugar como el momento de recepción pueden ser seleccionados individualmente por miembros del público.

b) Comunicación al público de una interpretación o ejecución fijada en un fonograma o de un fonograma. Solamente para los efectos del artículo 173 de la presente ley, es la transmisión al público, por cualquier medio que no sea la radiodifusión, de sonidos de una interpretación o ejecución o los sonidos o las representaciones de sonidos fijadas en un fonograma. Para los efectos de los derechos reconocidos a los artistas intérpretes o ejecutantes y productores de fonogramas, la comunicación al público incluye también hacer que los sonidos o las representaciones de sonidos fijados en un fonograma resulten audibles al público.

c) Comunicación al público de una interpretación fijada en obras y grabaciones audiovisuales. La transmisión al público por cualquier medio y por cualquier procedimiento de una interpretación fijada en una obra o grabación audiovisual.

Artículo 6°.

Modifíquese el artículo 165 de la Ley 23 de 1982, el cual quedará así:

Artículo 165. La protección ofrecida por las normas de este capítulo no afectará en modo alguno la protección del derecho del autor sobre las obras literarias, científicas y artísticas consagradas por la presente ley. En consecuencia, ninguna de las disposiciones contenidas en él podrá interpretarse en menoscabo de esa protección.

A fin de no establecer ninguna jerarquía entre el derecho de autor, por una parte, y los derechos de los artistas, intérpretes o ejecutantes y productores de fonogramas, por otra parte, en aquellos casos en donde sea necesaria la autorización tanto del autor de una obra contenida en un fonograma como del artista intérprete o ejecutante o productor titular de los derechos del fonograma, el requerimiento de la autorización del autor no deja de existir debido a que también se requiera la autorización del artista intérprete o ejecutante o del productor de fonogramas.

Así mismo, en aquellos casos en donde sea necesaria la autorización tanto del autor de una obra contenida en un fonograma como del artista intérprete o ejecutante o del productor titular de los derechos del fonograma, el requerimiento de la autorización del artista intérprete o ejecutante o productor de fonogramas no deja de existir debido a que también se requiera la autorización del autor.

Artículo 7°.

Modifíquese el artículo 166 de la Ley 23 de 1982, el cual quedará así:

Artículo 166. Los artistas intérpretes o ejecutantes, tienen respecto de sus interpretaciones o ejecuciones el derecho exclusivo de autorizar o prohibir:

a) La radiodifusión y la comunicación al público de sus interpretaciones o ejecuciones no fijadas, excepto cuando la interpretación o ejecución constituya por sí misma una ejecución o interpretación radiodifundida;

b) La fijación de sus ejecuciones o interpretaciones no fijadas;

c) La reproducción de sus interpretaciones o ejecuciones fijadas por cualquier manera o forma, permanente o temporal, mediante cualquier procedimiento incluyendo el almacenamiento temporal en forma electrónica;

d) La distribución pública del original y copias de sus interpretaciones o ejecuciones fijadas en fonograma, mediante la venta o a través de cualquier forma de transferencia de propiedad;

e) El alquiler comercial al público del original y de los ejemplares de sus Interpretaciones o ejecuciones fijadas en fonogramas, incluso después de su distribución realizada por el artista intérprete o ejecutante o con su autorización;

f) La puesta a disposición al público de sus interpretaciones o ejecuciones fijadas en fonogramas, de tal forma que los miembros del público puedan tener acceso a ella desde el lugar y en el momento que cada uno de ellos elija.

Artículo 8°.

Modifíquese el artículo 172 de la Ley 23 de 1982, el cual quedará así:

Artículo 172. El productor de fonogramas tiene el derecho exclusivo de autorizar o prohibir:

a) La reproducción del fonograma por cualquier manera o forma, temporal o permanente, mediante cualquier procedimiento incluyendo el almacenamiento temporal en forma electrónica;

b) La distribución pública del original y copias de sus fonogramas, mediante la venta o a través de cualquier forma de transferencia de propiedad;

c) La importación de copias del fonograma;

d) El alquiler comercial al público del original y de los ejemplares de sus fonogramas incluso después de su distribución realizada por ellos mismos o con su autorización;

e) La puesta a disposición al público de sus fonogramas, de tal forma que los miembros del público puedan tener acceso a ellos desde el lugar y en el momento que cada uno de ellos elija.

Artículo 9°.

Adiciónese al artículo 175 de la Ley 23 de 1982 el siguiente parágrafo:

Parágrafo. En todo proceso relativo a los derechos conexos, y ante cualquier jurisdicción se presumirá, salvo prueba en contrario, que las personas bajo cuyo nombre o seudónimo o marca u otra designación, se hubiere divulgado la interpretación o ejecución o el fonograma, serán titulares de los derechos conexos. También se presumirá, salvo prueba en contrario, que la interpretación, ejecución o el fonograma se encuentran protegidos.

Artículo 10.

Adiciónese al artículo 182 de la Ley 23 de 1982 el siguiente parágrafo 2°:

Parágrafo 2°. Las personas naturales o jurídicas, a las que en virtud de acto o contrato se les transfirieron derechos patrimoniales de autor o conexos, serán consideradas como titulares de derechos ante cualquier jurisdicción.

Artículo 11.

Modifíquese el artículo 2° de la Ley 44 de 1993 que modifica el artículo 29 de la Ley 23 de 1982, el cual quedará así:

Artículo 2°. Los derechos consagrados a favor de los artistas intérpretes o ejecutantes, los productores de fonogramas y los organismos de radiodifusión tendrán la siguiente duración:

a) Cuando el titular sea persona natural, la protección se dispensará durante su vida y 80 años más, contados a partir del primero de enero del año siguiente a su muerte.

b) Cuando el titular sea persona jurídica, el plazo de protección será de:

1.- 70 años contados a partir del final del año calendario, de la primera publicación autorizada de la interpretación, ejecución o del fonograma. A falta de tal publicación autorizada dentro de los 50 años contados a partir de la realización de la interpretación, ejecución, o del fonograma, el plazo será de 70 años a partir del final del año calendario en que se realizó la interpretación o ejecución o el fonograma;

2.- 70 años contados a partir del final del año calendario en que se haya realizado la primera emisión de radiodifusión.

Artículo 12.- Medidas tecnológicas e información sobre gestión de derechos.

Independientemente de que concurra una infracción al derecho de autor o a los derechos conexos, incurrirá en responsabilidad civil quien realice cualquiera de las siguientes conductas:

a) Sin autorización eluda las medidas tecnológicas efectivas impuestas para controlar el acceso a una obra, interpretación o ejecución o fonograma protegidos, o que protegen cualquier derecho de autor o cualquier derecho conexo al derecho de autor frente a usos no autorizados.

b) Fabrique, importe, distribuya, ofrezca al público, suministre o de otra manera comercialice dispositivos, productos o componentes, u ofrezca al público o suministre servicios que, respecto de cualquier medida tecnológica efectiva:

1.- Sean promocionados, publicitados o comercializados con el propósito de eludir dicha medida; o

2.- Tengan un limitado propósito o uso comercialmente significativo diferente al de eludir dicha medida; o

3.- Sean diseñados, producidos, ejecutados principalmente con el fin de permitir o facilitar la elusión de dicha medida;

c) Con conocimiento de causa, o teniendo motivos razonables para saber:

1.- Suprima o altere sin autorización cualquier información sobre la gestión de derechos.

2.- Distribuya o importe para su distribución, información sobre gestión de derechos que ha sido suprimida o alterada sin autorización.

3.- Distribuya, importe para su distribución, emita, comunique o ponga a disposición del público copias de las obras, interpretaciones o ejecuciones o fonogramas, con información sobre gestión de derechos suprimida o alterada sin autorización.

Parágrafo 1º.

Para los efectos de la presente ley se entenderá por medida tecnológica efectiva la tecnología, dispositivo o componente que, en el curso normal de su operación, sea apta para controlar el acceso a una obra, interpretación o ejecución o fonograma protegido, o para proteger cualquier derecho de autor o cualquier derecho conexo frente a usos no autorizados y que no pueda ser eludida accidentalmente.

Parágrafo 2°.

Para los efectos de la presente ley se entenderá por información sobre la gestión de derechos la información que identifica la obra, interpretación o ejecución o fonograma; al autor de la obra, al artista intérprete o ejecutante de la interpretación o ejecución, o al productor del fonograma; o al titular de cualquier derecho sobre la obra, interpretación o ejecución o fonograma; o información sobre los términos y condiciones de utilización de las obras, interpretaciones o ejecuciones o fonogramas; o cualquier número o código que represente dicha información, cuando cualquiera de estos elementos de. información estén adjuntos a un ejemplar de la obra, interpretación . o ejecución o fonograma o figuren en relación con la comunicación o puesta a disposición al público de una obra, interpretación o ejecución o fonograma.

Parágrafo 3°.- Medidas cautelares.

En los procesos civiles que se adelanten como consecuencia de la infracción a los derechos patrimoniales de autor y derechos conexos, o por la realización de las actividades descritas en este artículo de la presente ley, son aplicables las medidas cautelares propias de los procesos declarativos establecidas por el Código General del Proceso.

Artículo 13.

Excepciones a la responsabilidad por la elusión de las medidas tecnológicas. Las excepciones a la responsabilidad consagrada en los literales a) y b) del artículo anterior son las siguientes, las cuales serán aplicadas en consonancia con los parágrafos de este artículo.

a) Actividades de buena fe no infractoras de ingeniería inversa realizadas a la copia de un programa de computación obtenida legalmente, siempre que los elementos particulares de dicho programa no hubiesen estado a disposición inmediata de la persona involucrada en dichas actividades, con el único propósito de lograr la interoperabilidad de un programa de computación creado independientemente con otros programas.

b) Actividades de buena fe no infractoras, realizadas por un investigador que haya obtenido legalmente una copia, interpretación o ejecución no fijada o muestra de una obra, interpretación o ejecución o fonograma, y que haya hecho un esfuerzo de buena fe por obtener autorización para realizar dichas actividades, en la medida necesaria, y con el único propósito de identificar y analizar fallas y vulnerabilidades de las tecnologías para codificar y decodificar la información.

c) La inclusión de un componente o parte con el único fin de prevenir el acceso de menores al contenido inapropiado en línea en una tecnología, producto, servicio o dispositivo que por sí mismo sea diferente de los mencionados en el literal b) del artículo 12.

d) Actividades de buena fe no infractoras autorizadas por el dueño de una computadora, sistema de cómputo o red de cómputo con el único fin de probar, investigar o corregir la seguridad de dicha computadora, sistema de cómputo o red de cómputo.

e) El acceso por parte de bibliotecas, archivos o instituciones de todos los niveles educativos, sin fines de lucro, a una obra, interpretación o ejecución o fonograma a la cual no tendrían acceso de otro modo, con el único fin de tomar decisiones sobre adquisiciones.

f) Actividades no infractoras con el único fin de identificar y deshabilitar la capacidad de realizar de manera no divulgada la recolección o difusión de datos de identificación personal que reflejen las actividades en línea de una persona natural, de manera que no tenga otro efecto en la capacidad de cualquier persona de obtener acceso a cualquier obra.

g) Usos no infractores de una clase particular de obra, interpretación o ejecución, fonograma o emisión, teniendo en cuenta la existencia de evidencia sustancial de un impacto adverso real o potencial en aquellos usos no infractores.

El Gobierno nacional a través de la Unidad Administrativa Especial Dirección Nacional de Derecho de Autor hará una revisión periódica, en intervalos de no más de tres años, para determinar la necesidad y conveniencia de emitir un concepto en que se consagren los usos no infractores que han de ser objeto de la excepción prevista en este literal. Los usos no infractores mencionados en el concepto de la Dirección Nacional de Derecho de Autor serán permanentes, pero susceptibles de revocación, si desaparece la excepción o limitación al derecho de autor o a los derechos conexos en que se fundamentó la excepción de la medida tecnológica o si hay evidencia sustancial de que la necesidad de su existencia ha desaparecido.

Para esta revisión la Unidad Administrativa Especial Dirección Nacional de Derecho de Autor evaluará las inquietudes que sean planteadas a través de la Subcomisión de Derecho de Autor de la Comisión Intersectorial de Propiedad Intelectual (CIPI), la que a través de un proceso de socialización amplio y suficiente, recogerá en un documento las inquietudes manifestadas por los beneficiarios de las limitaciones y excepciones, así como por los titulares de derechos.

h) Usos no infractores de una obra, interpretación o ejecución, fonograma o emisión, amparados por las limitaciones y excepciones establecidas por la ley en favor de toda persona en situación de discapacidad en los términos de la Ley 1346 de 2009 y la Ley 1618 de 2013, que, en razón a las barreras definidas en dichas leyes, no pueda acceder a las obras en los modos, medios y formatos de comunicación adecuados a su tipo de discapacidad y conforme a su elección.

i) La actividad legalmente autorizada de investigación, protección, seguridad de la información o inteligencia, llevada a cabo por empleados, agentes o contratistas del gobierno. Para los efectos de este numeral la seguridad de la información comprende, entre otras actividades, pruebas de vulnerabilidad, hacking ético y análisis forense, llevadas a cabo para identificar y abordar la vulnerabilidad de una computadora, un sistema de cómputo o una red de cómputo gubernamentales.

Parágrafo 1°.

Todas las excepciones a las conductas establecidas en el presente artículo aplican para las medidas tecnológicas efectivas que controlen el acceso a una obra, interpretación ejecución o fonograma.

Parágrafo 2°.

A las actividades relacionadas en el artículo 12 literal b), cuando se refieran a medidas tecnológicas que controlen el acceso a una obra, interpretación, ejecución o fonograma, solo se aplicarán las excepciones establecidas en los literales a), b), c), d) del presente artículo.

Parágrafo 3°.

A las actividades relacionadas en el artículo 12 literal b), cuando se refieran a medidas tecnológicas que protegen cualquier derecho de autor o cualquier derecho conexo al derecho de autor frente a usos no autorizados, solo se aplicará la excepción establecida en el literal a) del presente artículo.

Parágrafo 4°.

Las medidas tecnológicas adoptadas para restringir usos no autorizados que protegen cualquier derecho de autor o cualquier derecho conexo podrán ser eludidas cuando el uso de una obra, interpretación o ejecución, fonograma o emisión, esté amparado en una limitación o excepción establecida en la ley o cuando se trate de la reproducción, por cualquier medio, de una obra literaria o científica, ordenada u obtenida por el interesado en un solo ejemplar para su uso privado y sin fines de lucro. En virtud de este parágrafo, las medidas tecnológicas no podrán ser eludidas en el ejercicio de la limitación y excepción consagrada en el artículo 44 de la Ley 23 de 1982.

Artículo 14.

Las disposiciones de los artículos 1° a 13 de la presente ley se aplicarán a todas las obras, interpretaciones, ejecuciones, fonogramas y emisiones que; al momento de la entrada en vigencia de la presente ley no hayan pasado al dominio público.

Artículo 15.- Obligación de informar.

Quien incorpore una medida tecnológica para controlar el acceso o los usos no autorizados de las obras, interpretaciones o ejecuciones, fonogramas o emisiones de los organismos de radiodifusión está obligado a informar sobre su existencia y alcance. El alcance de esta información, así como la responsabilidad de los titulares de derechos estará enmarcada dentro de los parámetros establecidos en la Ley 1480 de 2011, por medio de la cual se expide el Estatuto del Consumidor y se dictan otras disposiciones, así como aquellas normas que la modifiquen o sustituyan.

Artículo 16.- Limitaciones y excepciones al derecho de autor y los derechos conexos.

Sin perjuicio de las limitaciones y excepciones establecidas en la Decisión Andina 351 de 1993, en la Ley 23 de 1982 y en la Ley 1680 de 2013, se crean las siguientes:

a) La reproducción temporal en forma electrónica de una obra. interpretación o ejecución, fonograma o emisión fijada, que sea transitoria o accesoria, que forme parte integrante y esencial de un proceso tecnológico y cuya única finalidad consista en facilitar una transmisión en una red informática entre terceras partes por un intermediario, o una utilización lícita de una obra, interpretación o ejecución, fonograma, o emisión fijada que no tengan por sí mismos una significación económica independiente.

Para los fines del presente literal, se entiende que la reproducción temporal en forma electrónica incluye, los procesos tecnológicos que sean necesarios en la operación ordinaria de computadores, dispositivos digitales o de internet, siempre y cuando se cumplan con los requisitos mencionados en el párrafo anterior.

b) El préstamo sin ánimo de lucro, por una biblioteca, archivo o centro de documentación de copias o ejemplares de obras, interpretaciones o ejecuciones artísticas, fonogramas y emisiones fijadas, siempre que figuren en las colecciones permanentes de esta o hagan parte de un programa de cooperación bibliotecaria y hubiesen sido lícitamente adquiridas.

c) La puesta a disposición por parte de bibliotecas, archivos o centros de documentación, a través de terminales especializados instalados en sus propios locales, para fines de investigación o estudio personal de sus usuarios, de obras, fonogramas, grabaciones audiovisuales y emisiones fijadas, lícitamente adquiridas y que no estén sujetas a condiciones de adquisición o licencia.

d) Se permitirá la transformación de obras literarias y artísticas divulgadas, siempre que se realice con fines de parodia y caricatura, y no implique un riesgo de confusión con la obra originaria.

e) Se permitirá la reproducción por medios reprográficos para la enseñanza o para la realización de exámenes por instituciones de todos los niveles educativos, en la medida justificada por el fin que se persiga, de artículos lícitamente publicados en periódicos o colecciones periódicas, breves extractos de obras lícitamente publicadas, y obras aisladas de carácter plástico, fotográfico o figurativo, a condición que tal utilización se haga conforme a los usos honrados y que la misma no sea objeto de venta u otra transacción a título oneroso, ni tenga directa o indirectamente fines de lucro. Lo anterior siempre que se incluya el nombre del autor y la fuente.

Artículo 17.- Actualización de limitaciones y excepciones.

El Gobierno Nacional, a través de la Dirección Nacional de Derecho de Autor, convocará cada tres años a una audiencia pública con el fin de realizar una revisión periódica de las limitaciones y excepciones al derecho de autor y los derechos conexos, con el objetivo de determinar la necesidad y conveniencia de presentar ante el Congreso de la República un proyecto de ley que reforme, elimine o consagre limitaciones y excepciones al derecho de autor.

Dicho proyecto deberá observar las reglas establecidas en los tratados internacionales ratificados por Colombia para incorporar limitaciones y excepciones al derecho de autor y a los derechos conexos, y tendrá como finalidad armonizar las prerrogativas consagradas en favor de los autores y titulares, de los usuarios frente al acceso a la información, los avances tecnológicos y otros derechos fundamentales.

El proceso de revisión periódica deberá contar con la participación activa de la sociedad civil y titulares derechos de autor y derechos conexos, con quienes se podrán generar acuerdos comunes en torno a la modificación de las limitaciones y excepciones.

Así mismo la Dirección Nacional de Derecho de Autor facilitará, cuando a ello hubiere lugar, espacios de diálogo con las entidades del Estado que considere necesarias, para evaluar las limitaciones y excepciones al derecho de autor y los derechos conexos.

CAPÍTULO II.- Disposiciones relativas a obras huérfanas

Artículo 18.- Obras huérfanas.

Para los efectos de esta ley se entenderá por obras huérfanas las obras o fonogramas que estén protegidas por el derecho de autor o derechos conexos y que hayan sido publicadas por primera vez en Colombia o, a falta de publicación, cuya primera radiodifusión haya tenido lugar en Colombia, en los que ninguno de los titulares de los derechos sobre dicha obra o fonograma está identificado o si, de estarlo uno o más de ellos no ha sido localizado a pesar de haber efectuado una búsqueda diligente de los mismos, debidamente registrada con arreglo al artículo 21.

Artículo 19.- Identificación de los titulares.

Si existen varios titulares de derechos sobre una misma obra o un mismo fonograma y no todos ellos han sido identificados o, a pesar de haber sido identificados, no han sido localizados tras haber efectuado una búsqueda diligente, debidamente registrada con arreglo al artículo 21, la obra o el fonograma se podrán utilizar de conformidad con la presente ley, siempre que los titulares de derechos que hayan sido identificados y localizados hayan autorizado, en relación con los derechos que ostenten.

Artículo 20.- Personas autorizadas y ámbito de aplicación para hacer uso de obras huérfanas.

Podrán hacer usos de las obras huérfanas que se encuentren en sus repositorios, las bibliotecas, centros de enseñanza y museos, accesibles al público, así como archivos, organismos de conservación del patrimonio cinematográfico o sonoro y organismos públicos de radiodifusión, con domicilio en Colombia, con el fin de alcanzar objetivos relacionados con su misión siempre y cuando este sea de interés público, y se trate de:

a) Obras publicadas en forma de libros, revistas especializadas, periódicos, revistas u otro material impreso que figuren en las colecciones de bibliotecas, centros de enseñanza o museos, accesibles al público, así como en las colecciones de archivos o de organismos de conservación del patrimonio cinematográfico o sonoro;

b) Obras cinematográficas o audiovisuales y los fonogramas que figuren en ¡ las colecciones de bibliotecas, centros de enseñanza o museos, accesibles al público, así como en las colecciones de archivos o de organismos de conservación del patrimonio cinematográfico o sonoro;

c) Obras cinematográficas o audiovisuales y los fonogramas producidos por organismos públicos de radiodifusión que figuren en sus archivos y que estén protegidas por derechos de autor o derechos conexos a los derechos de autor y que hayan sido publicadas por primera vez en el país o, a falta de publicación, cuya primera radiodifusión haya tenido lugar en Colombia.

Parágrafo 1°.

Las obras y los fonogramas a que se hace referencia en los literales a), b) y c), que nunca hayan sido publicados ni radiodifundidos en Colombia, pero que hayan sido puestos a disposición del público por las entidades mencionadas en otros países, con el consentimiento de los titulares de derechos, siempre y cuando sea razonable suponer que los titulares de derechos no se opondrían a los usos contemplados en el artículo 23.

Parágrafo 2°.

Las normas de este capítulo se aplicarán también a las obras y otras prestaciones protegidas que estén insertadas o incorporadas en las obras o los fonogramas a que se refieren los apartados anteriores o que formen parte integral de estos.

Artículo 21.- Búsqueda diligente.

A efectos de determinar si · una obra o un fonograma son obras huérfanas, las entidades mencionadas en el artículo 20, efectuarán una búsqueda diligente y de buena fe por cada obra u otra prestación protegida, consultando para ello las fuentes adecuadas en función de la categoría de obra y de cada prestación protegida independientemente consideradas. La búsqueda diligente se efectuará con carácter previo al uso de la obra o del fonograma.

La búsqueda diligente se efectuará, en el lugar de la primera publicación o, a falta de publicación, de primera radiodifusión. Sin embargo, si existen pruebas que sugieran que en otros países existe información pertinente sobre los titulares de derechos, deberá efectuarse asimismo una consulta de las fuentes de información disponibles en esos países.

En el caso a que se refiere el artículo 20, parágrafo 10, la búsqueda diligente deberá efectuarse en el país en el que se encuentre establecida la entidad que haya puesto la obra o el fonograma a disposición del público con el consentimiento del titular de derechos.

El Gobierno nacional, a través del Ministerio del Interior y con la coordinación de la Dirección Nacional de Derecho de Autor, reglamentará la materia indicando cuáles son las fuentes de información que resultan adecuadas para la búsqueda de autores y titulares en cada categoría de obras o fonogramas en consulta con los titulares de derechos y los usuarios, e incluirán como mínimo, la información del registro nacional de derecho de autor, así como las bases de datos de las diferentes sociedades de gestión colectiva.

Artículo 22.- Prueba de la búsqueda diligente.

Las entidades mencionadas en el artículo 20, inscribirán en el registro nacional de derecho de autor, administrado por la Dirección Nacional de Derecho de Autor, previo a realizar los usos consagrados en el artículo 23 de la presente ley, sus búsquedas diligentes y tendrán a disposición del público en general, la siguiente información:

a) Los resultados de las búsquedas diligentes que dichas entidades hayan efectuado y que hayan llevado a la conclusión de que una obra o un fonograma debe considerarse obra huérfana;

b) El uso que las entidades hacen de las obras o fonogramas huérfanas, de conformidad con la presente ley;

c) Cualquier cambio, de conformidad con el artículo 24, en la condición de obra huérfana de las obras y los fonogramas que utilicen las entidades;

d) La información de contacto pertinente de la entidad en cuestión.

El Gobierno nacional apropiará los recursos necesarios para dicha labor y, a través del Ministerio del Interior, con la coordinación de la Dirección Nacional de Derecho de Autor, reglamentará la forma de realizar el mencionado registro.

Artículo 23.- Utilización de obras huérfanas.

Las entidades a que se refiere el artículo 20, podrán realizar, sin autorización del autor o titular, los usos que se establecen a continuación, en relación con las obras huérfanas que figuren en sus colecciones:

a) Puesta a disposición del público de la obra huérfana.

b) Reproducción, a efectos de digitalización. puesta a disposición del público, indexación, catalogación, conservación o restauración.

Parágrafo 1°.

Las entidades a que se refiere el artículo 20, podrán hacer uso de una obra huérfana con arreglo del presente artículo únicamente a fines del ejercicio de su misión de interés público, en particular la conservación y restauración de las obras y los fonogramas que figuren en su colección, y la facilitación del acceso a los mismos con fines culturales y educativos. las entidades podrán obtener ingresos en el transcurso de dichos usos, a los efectos exclusivos de cubrir los costes derivados de la digitalización de las obras huérfanas y de su puesta a disposición del público.

Parágrafo 2°.

Cualquier utilización de una obra huérfana por parte de las entidades a que se refiere el artículo 20, se entenderá sin perjuicio de indicar el nombre de los autores y otros titulares de derechos que sí han sido identificados.

Artículo 24.- Fin de la condición de obra huérfana.

Los titulares de derechos sobre una obra o un fonograma que se consideren obras huérfanas tendrán en todo momento la posibilidad de poner fin a dicha condición de obra huérfana en lo que se refiere a sus derechos.

Artículo 25.- Compensación por uso de una obra huérfana.

Los titulares de derechos que pongan fin a la condición de obra huérfana de sus obras u otras prestaciones protegidas recibirán una compensación equitativa por el uso que las entidades a que se refiere el artículo 20 hayan hecho de dichas obras y otras prestaciones protegidas con arreglo al artículo 23 de la presente ley. El Gobierno nacional, a través del Ministerio del Interior, con la coordinación de la Dirección Nacional de Derecho de Autor, reglamentará la materia.

Artículo 26.- Continuación de la vigencia de otras disposiciones legales.

Las disposiciones de este capítulo se entenderán sin perjuicio de las disposiciones relativas, en particular, a los derechos de patente, las marcas comerciales, los modelos de utilidad, los diseños industriales, la protección del patrimonio nacional, los requisitos sobre depósito legal, la legislación sobre prácticas restrictivas y competencia desleal, el secreto comercial, la. seguridad, la confidencialidad, la protección de datos y el derecho a la intimidad, el acceso a los documentos públicos y el derecho de contratos, así como a las normas relativas a la libertad de prensa y la libertad de expresión en los medios de comunicación.

Artículo 27.- Aplicación en el tiempo.

Las disposiciones sobre obras huérfanas se aplicarán con respecto a todas las obras y todos los fonogramas a que se refiere el artículo 20 que estén protegidos por la legislación sobre derecho de autor y derechos conexos a la fecha de expedición de la presente ley, así como para las que sean creadas con posterioridad a la entrada en vigor de esta.

CAPÍTULO III.- Depósito legal

Artículo 28.

Modifíquese el artículo 7º de la ley 44 de 1993, el cual quedará así:

El editor, el productor de obras audiovisuales, el productor fonográfico y videograbador, establecidos en el país, de toda obra, fonograma o videograma que hayan sido divulgadas y circulen en Colombia, deberá cumplir, dentro de los 60 días hábiles siguientes a su publicación, transmisión pública, reproducción o importación, con el depósito legal de las mismas ante las entidades y en la cantidad definida en la reglamentación que para el efecto expedirá el Gobierno nacional.

El incumplimiento de las obligaciones derivadas del depósito legal será sancionado por el Ministerio de Cultura, con un salario mínimo legal diario vigente por cada día de retraso en el cumplimiento de tales obligaciones y hasta el momento en que se verifique su cumplimiento, sin superar 10 salarios mínimos mensuales por cada ejemplar que incumpla el depósito. El responsable del depósito legal que no haya cumplido esta obligación no podrá participar directamente o por interpuesta persona en procesos de contratación estatal para la adquisición de libros y dotaciones bibliotecarias, hasta tanto cumpla con dicha obligación y en su caso, hubiera pagado en su totalidad las sanciones pecuniarias impuestas. La mencionada sanción será impuesta mediante resolución motivada, la cual puede ser objeto de recursos en vía gubernativa.

En caso de incumplimiento del depósito legal y una vez finalizado el plazo señalado, la Biblioteca Nacional de Colombia con la finalidad de preservar la memoria cultural de la Nación podrá realizar la reproducción de las obras, fonogramas o videogramas que no hayan sido depositadas por quienes tenían la obligación legal de hacerlo.

La Biblioteca Nacional de Colombia con la finalidad de garantizar el acceso al patrimonio cultural podrá hacer la puesta a disposición para su consulta en sala, a través de terminales especializados instalados en sus propios locales de las obras, fonogramas o videogramas, tomando las medidas efectivas para impedir cualquier otro tipo de utilización que atente contra la explotación normal de la obra o cause un perjuicio injustificado a los intereses legítimos del autor o titular del derecho.

El Gobierno nacional, en cabeza del Ministerio del Interior – Unidad Administrativa Especial Dirección Nacional de Derecho de Autor y el Ministerio de Cultura – Biblioteca Nacional de Colombia, reglamentarán el depósito legal.

CAPÍTULO IV.- Disposiciones relativas a la observancia del derecho de autor y los derechos conexos

Artículo 29.- Procedimiento ante la jurisdicción.

Las cuestiones que se susciten con motivo de la aplicación de esta ley serán resueltas por la jurisdicción ordinaria o por las autoridades administrativas en ejercicio de funciones jurisdiccionales.

Artículo 30.- Solicitud de información.

Sin perjuicio de lo establecido en el artículo 33 de la Constitución Política, las autoridades judiciales competentes para resolver los procesos de infracción en materia de derecho de autor y/o derechos conexos, estarán facultadas para ordenarle al infractor que proporcione cualquier información que posea respecto de cualquier persona involucrada en la infracción, así como de los medios o instrumentos de producción o canales de distribución utilizados para ello.

Artículo 31.- Destrucción de implementos y mercancía infractora.

En los procesos sobre infracciones al derecho de autor, los derechos conexos, la elusión de medidas tecnológicas o la supresión o alteración de cualquier información sobre la gestión de derechos, el juez estará facultado para ordenar que los materiales e implementos que hayan sido utilizados en la fabricación o creación de dichas mercancías infractoras sean destruidos, a cargo de la parte vencida y sin compensación alguna, o en circunstancias excepcionales, sin compensación alguna, se disponga su retiro de los canales comerciales.

En el caso de mercancías consideradas infractoras, el juez deberá ordenar su destrucción, a cargo de quien resulte condenado en el proceso, a menos que el titular de derecho consienta en que se disponga de ellas de otra forma. En ningún caso los jueces podrán permitir la exportación de las mercancías infractoras o permitir que tales mercancías se sometan a otros procedimientos aduaneros, salvo en circunstancias excepcionales.

Artículo 32.- Indemnizaciones preestablecidas.

La indemnización que se cause como consecuencia de la infracción a los derechos patrimoniales de autor y derechos conexos o por las conductas descritas en la presente ley, relacionadas con las medidas tecnologías y la información para la gestión de derechos, podrá sujetarse al sistema de indemnizaciones preestablecidas o a las reglas generales sobre prueba de la indemnización de perjuicios, a elección del titular del derecho infringido. El Gobierno nacional dentro de los doce (12) meses siguientes a la promulgación de esta ley reglamentará la materia.

Artículo 33.

El artículo 3° de la Ley 1032 de 2006 que modificó el artículo 272 de la Ley 599 de 2000, quedará así:

Artículo 3º Violación a los mecanismos de protección de derecho de autor y derechos conexos, y otras defraudaciones. Incurrirá en prisión de cuatro (4) a ocho (8) años y multa de veintiséis punto sesenta y seis (26.66) a mil (1.000) salarios mínimos legales mensuales vigentes, quien con el fin de lograr una ventaja comercial o ganancia económica privada y salvo las excepciones previstas en la ley:

1.- Eluda sin autorización las medidas tecnológicas efectivas impuestas para controlar el acceso a una obra, interpretación o ejecución o fonograma protegidos, o que protege cualquier derecho de autor o cualquier derecho conexo al derecho de autor frente a usos no autorizados.

2.- Fabrique, importe, distribuya, ofrezca al público, suministre o de otra manera comercialice dispositivos, productos o componentes, u ofrezca al público o suministre servicios que, respecto de cualquier medida tecnológica efectiva:

a) Sean promocionados, publicitados o comercializados con el propósito de eludir dicha medida; o

b) Tengan un limitado propósito o uso comercialmente significativo diferente al de eludir dicha medida; o

c) Sean diseñados, producidos, ejecutados principalmente con el fin de permitir o facilitar la elusión de dicha medida.

3.- Suprima o altere sin autorización cualquier información sobre la gestión de derechos.

4.- Distribuya o importe para su distribución información sobre gestión de derechos sabiendo que dicha información ha sido suprimida o alterada sin autorización.

5.- Distribuya, importe para su distribución, emita, comunique o ponga a disposición del público copias de las obras, interpretaciones o ejecuciones o fonogramas, sabiendo que la información sobre gestión de derechos ha sido suprimida o alterada sin autorización.

6.- Fabrique, ensamble, modifique, importe, exporte, venda, arriende o distribuya por otro medio un dispositivo o sistema tangible o intangible, a sabiendas o con razones para saber que la función principal del dispositivo o sistema es asistir en la descodificación de una señal codificada de satélite portadora de programas codificados sin la autorización del distribuidor legítimo de dicha señal.

7.- Recepcione o posteriormente distribuya una señal de satélite portadora de un programa que se originó como señal por satélite codificada a sabiendas que ha sido descodificada sin la autorización del distribuidor legítimo de la señal.

8.- Presente declaraciones o informaciones destinadas directa o indirectamente al pago, recaudación, liquidación o distribución de derechos económicos de autor o derechos conexos, alterando o falseando, por cualquier medio o procedimiento, los datos necesarios para estos efectos.

9.- Fabrique, importe, distribuya, ofrezca al público, suministre o de otra manera comercialice etiquetas falsificadas adheridas o diseñadas para ser adheridas a un fonograma, a una copia de un programa de computación, a la documentación o empaque de un programa de computación, a la copia de una película u otra obra audiovisual.

10.- Fabrique, importe, distribuya, ofrezca al público, suministre o de otra manera comercialice documentos o empaques falsificados para un programa de computación.

Artículo 34.

Modifíquese el artículo 22 de la Ley 44 de 1993, el cual quedará así:

Artículo 22. Prescriben a los 10 años, a partir de la notificación al interesado del proyecto de repartición o distribución, en favor de las sociedades de gestión colectiva de derecho de autor o derechos conexos, y en contra de los socios, las remuneraciones no cobradas por ellos.

La prescripción de obras o prestaciones no identificadas será de 3 años contados a partir de la publicación del listado de obras o prestaciones no identificadas en la página web de la sociedad de gestión colectiva. En caso de litigio corresponderá a la sociedad de gestión colectiva demostrar que hizo todo lo razonable para identificar el autor o titular de la obra o prestación.

Artículo 35.

El artículo 27 de la Ley 44 de 1993, quedará así:

Con el objeto de garantizar el pago y el debido recaudo de las remuneraciones provenientes por conceptos de derecho de autor y derechos conexos, las sociedades de gestión colectiva de derecho de autor o derechos conexos podrán constituir entidades recaudadoras y/o hacer convenios con empresas que puedan ofrecer licencias de derecho de autor y derechos conexos. En las entidades recaudadoras podrán tener asiento las sociedades reconocidas por la Dirección Nacional de Derecho de Autor. El Gobierno nacional determinará la forma y condiciones de la constitución, organización, administración y funcionamiento de las entidades recaudadoras y ejercerá sobre ellas inspección y vigilancia a través de la Dirección Nacional de Derecho de Autor.

Las entidades recaudadoras podrán negociar con los distintos usuarios, si así lo disponen sus asociados.

Artículo 36.

Adiciónese un parágrafo 2° al artículo 271 del Código Penal, el cual quedará así:

Parágrafo 2°. La reproducción por medios informáticos de las obras contenidas en el presente artículo será punible cuando el autor lo realice con el ánimo de obtener un beneficio económico directo o indirecto, o lo haga a escala comercial.

Artículo 37.- Vigencia.

La presente ley rige a partir de la fecha de su publicación y deroga los artículos 58 a 71 y 243 de la Ley 23 de 1982, así como las disposiciones que le sean contrarias.

EL PRESIDENTE DEL H. SENAD DE LA REPÚBLlCA, EFRAIN JOSE CEPEDA SARABIA

EL SECRETARIO GENERAL DEL H. SENADO DE LA REPÚBLlCA, GREGORIO ELJACH PACHECO

LA PRESIDENTA (E) DE LA H. CÁMARA DE REPRESENTANTES, LINA MARÍA BARRERA RUEDA

EL SECRETARIO GENERAL DE LA H. CÁMARA DE REPRESENTANTES, JORGE HUMBERTO MANTILLA SERRANO

LEY Nº 1915 POR LA CUAL SE MODIFICA LA LEY 23 DE 1982 Y SE ESTABLECEN OTRAS DISPOSICIONES EN MATERIA DE DERECHO DE AUTOR Y DERECHOS CONEXOS

REPÚBLICA DE COLOMBIA – GOBIERNO NACIONAL

PUBLÍQUESE Y CÚMPLASE

Dada en Bogotá, D.C., a los 12 DE JULIO 2018

EL MINISTRO DEL INTERIOR, GUILLERMO ABEL RIVERA FLÓREZ

EL MINISTRO DE JUSTICIA Y DEL DERECHO, ENRIQUE GIL BOTERO

LA MINISTRA DE COMERCIO, INDUSTRIA Y TURISMO, MARIA LORENA GUTIERREZ BOTERO

EL VICEMINISTRO DE CONECTIVIDAD Y DIGITALIZACIÓN DEL MINISTERIO DE TECNOLOGÍAS, DE LA INFORMACIÓN Y LAS COMUNICACIONES, ENCARGADO DEL EMPLEO DE MINISTRO DE TECNOLOGÍAS DE LA INFORMACIÓN Y LAS COMUNICACIONES, JUAN SEBASTIAN ROZO RENGIFO

LA MINISTRA DE CULTURA, MARIANA GARCÉS CÓRDOBA

22Dic/18

Real Decreto 1398/2018, de 23 de noviembre

22 diciembre, 2018España, Real Decretoaprobado por el Real Decreto Legislativo 1/1996, de 12 de abril, de 23 de noviembre, Derecho Informático España, en cuanto al sistema de compensación equitativa por copia privada., Legislación Informática de España, por el que se desarrolla el artículo 25 del texto refundido de la Ley de Propiedad Intelectual, Real Decreto 1398/2018José Cuervo

Real Decreto 1398/2018, de 23 de noviembre, por el que se desarrolla el artículo 25 del texto refundido de la Ley de Propiedad Intelectual, aprobado por el Real Decreto Legislativo 1/1996, de 12 de abril, en cuanto al sistema de compensación equitativa por copia privada.

La Directiva 2001/29/CE, del Parlamento Europeo y del Consejo, de 22 de mayo, relativa a la armonización de determinados aspectos de los derechos de autor y derechos afines a los derechos de autor en la sociedad de la información, permite a los Estados miembros de la Unión Europea limitar o exceptuar el derecho exclusivo de reproducción en el caso de copias efectuadas por una persona física para uso privado y siempre que los titulares del citado derecho reciban a cambio una compensación equitativa. En el ordenamiento jurídico español, este límite de copia privada se reconoce en el artículo 31, apartados 2 y 3, del texto refundido de la Ley de Propiedad Intelectual, aprobado por el Real Decreto Legislativo 1/1996, de 12 de abril, y la correspondiente compensación equitativa por la vigencia del límite se regula en el artículo 25 del mismo texto refundido.

El Real Decreto-ley 12/2017, de 3 de julio, por el que se modifica el texto refundido de la Ley de Propiedad Intelectual, aprobado por el Real Decreto Legislativo 1/1996, de 12 de abril, en cuanto al sistema de compensación equitativa por copia privada, modificó el artículo 25 del citado texto refundido. En términos generales, sustituyó el anterior modelo de compensación equitativa financiada con cargo a los Presupuestos Generales del Estado por un modelo basado en el pago de un importe a satisfacer por los fabricantes, importadores y distribuidores de equipos, aparatos y soportes materiales de reproducción.

La disposición final primera del Real Decreto-ley 12/2017, de 3 de julio, habilita al Gobierno para que, en el plazo de un año desde su entrada en vigor, desarrolle reglamentariamente las modificaciones introducidas en el texto refundido de la Ley de Propiedad Intelectual. Asimismo, también le habilita para que determine por primera vez, con carácter no transitorio, los equipos, aparatos y soportes materiales sujetos al pago de la compensación equitativa, las cantidades que los sujetos deudores del pago de esta compensación deberán abonar por este concepto a los sujetos acreedores de la misma y la distribución de la compensación entre las distintas modalidades de reproducción.

En su cumplimiento, este real decreto afronta la primera parte del referido mandato, esto es, el desarrollo reglamentario de las modificaciones introducidas por el Real Decreto-ley 12/2017, de 3 de julio, en el texto refundido de la Ley de Propiedad Intelectual.

El capítulo I se refiere a disposiciones generales, y recoge lo relativo al objeto, la determinación de las publicaciones asimiladas a libros, definiciones aplicables y la distribución de esta compensación dentro de cada modalidad de reproducción, según la categoría del sujeto acreedor (autores –y conjuntamente con ellos, en determinados casos, los editores–, productores y artistas intérpretes o ejecutantes).

El capítulo II regula el procedimiento para hacer efectiva la compensación equitativa por copia privada. Éste se basa en un sistema de presentación de relaciones trimestrales por parte de los sujetos deudores y por los distribuidores que culmina con la emisión de las correspondientes facturas de abono o de devolución de la compensación equitativa. Asimismo, regula el procedimiento para hacer efectivo el derecho a la obtención del certificado de exceptuación y del reembolso del pago de la compensación equitativa, previstos, respectivamente, en las letras b) y c) del apartado 7 y en el apartado 8 del artículo 25 del texto refundido de la Ley de Propiedad Intelectual.

El capítulo III regula el procedimiento para resolver los conflictos que pudieran surgir entre la persona jurídica constituida por las entidades de gestión de derechos de propiedad intelectual para ejercer las funciones establecidas en el artículo 25.10 del texto refundido de la Ley de Propiedad Intelectual, y los solicitantes de certificados de exceptuación y de reembolsos del pago de la compensación equitativa por copia privada. Se prevé que el ejercicio de la competencia para resolver este procedimiento, atribuida al Ministerio de Cultura y Deporte por el artículo 25.12 del texto refundido de la Ley de Propiedad Intelectual, corresponde a la Dirección General de Industrias Culturales y Cooperación.

El capítulo IV determina el porcentaje de la compensación equitativa por copia privada que las entidades de gestión deberán dedicar a determinadas actividades y servicios de carácter asistencial hacia sus socios y de formación y promoción de autores y artistas intérpretes o ejecutantes, en cumplimiento de la obligación prevista en el artículo 178.2 del texto refundido de la Ley de Propiedad Intelectual. Concretamente, dicho porcentaje se fija en un veinte por ciento.

Este real decreto forma parte del Plan Anual Normativo 2018 aprobado por el Consejo de Ministros el 7 de diciembre de 2017. Asimismo, cumple con los principios de buena regulación a los que se refiere el artículo 129 de la Ley 39/2015, de 1 de octubre, del Procedimiento Administrativo Común de las Administraciones Públicas. Así, cumple con los principios de necesidad y eficiencia puesto que con su aprobación se adoptan las medidas normativas necesarias para completar, en parte, el obligado desarrollo reglamentario de la nueva regulación de la compensación por copia privada introducida por el Real Decreto-ley 12/2017, de 3 de julio. Las modificaciones que se introducen son las imprescindibles para realizar el necesario desarrollo reglamentario, de tal modo que se respeta el principio de proporcionalidad. Por último, se respetan los principios de seguridad jurídica, transparencia y eficiencia puesto que las reformas introducidas son coherentes con el resto del ordenamiento jurídico; las partes interesadas han participado, en primer lugar, durante la consulta pública previa y, en segundo lugar, en el trámite posterior de información pública; y se introducen las cargas administrativas estrictamente necesarias para hacer efectiva la compensación equitativa por copia privada. Asimismo, y de conformidad con lo previsto en la disposición adicional trigésima novena de la Ley 6/2018, de 27 de junio, de Presupuestos Generales del Estado para 2018, las medidas incluidas en este real decreto no suponen un aumento neto de los gastos de personal.

Este real decreto se dicta al amparo de lo dispuesto en el artículo 149.1.9.ª de la Constitución Española, que atribuye al Estado la competencia exclusiva en materia de legislación sobre propiedad intelectual e industrial, y según la habilitación reglamentaria prevista en la disposición final primera del Real Decreto-ley 12/2017, de 3 de julio.

En la tramitación del procedimiento de elaboración de este real decreto se realizó la consulta previa, de acuerdo con el artículo 26.2 de la Ley 50/1997, de 27 de noviembre, del Gobierno y se llevó a cabo un trámite de información pública. Además, emitió dictamen la Sección Primera de la Comisión de Propiedad Intelectual; fue informado por el Consejo de Consumidores y Usuarios, así como por las Secretarías Generales Técnicas de los departamentos ministeriales competentes; y, finalmente, emitió dictamen preceptivo el Consejo de Estado, de conformidad con el artículo 22 de la Ley Orgánica 3/1980, de 22 de abril, del Consejo de Estado.

La Comisión Delegada del Gobierno para Asuntos Económicos fue informada de este real decreto en su reunión del día 24 de mayo de 2018.

En su virtud, a propuesta del Ministro de Cultura y Deporte y de la Ministra de Economía y Empresa, con la aprobación previa prevista en el artículo 26.5, quinto párrafo, de la Ley 50/1997, de 27 de noviembre, de acuerdo con el Consejo de Estado, y previa deliberación del Consejo de Ministros, en su reunión del día 23 de noviembre de 2018,

DISPONGO:

CAPÍTULO I.- Disposiciones generales

Artículo 1.- Objeto

El presente real decreto tiene como objeto desarrollar reglamentariamente el artículo 25 del texto refundido de la Ley de Propiedad Intelectual, aprobado por el Real Decreto Legislativo 1/1996, de 12 de abril y, en concreto, regular, además de las disposiciones generales del presente capítulo:

a) El procedimiento para hacer efectiva la compensación equitativa por copia privada, que incluirá el procedimiento para la obtención de los certificados de exceptuación y del reembolso del pago de dicha compensación por los sujetos a los que se le reconoce tal beneficio regulados, respectivamente, en las letras b) y c) del apartado 7 y en el apartado 8 del artículo 25 del referido texto refundido.

b) El procedimiento para resolver los conflictos que surjan entre la persona jurídica constituida según lo previsto en el artículo 25.10 del texto refundido de la Ley de Propiedad Intelectual y los solicitantes de certificados de exceptuación y de reembolso del pago de la compensación equitativa por copia privada.

c) El porcentaje de la compensación equitativa por copia privada que las entidades de gestión de derechos de propiedad intelectual deberán destinar a las actividades y servicios a que se refiere el artículo 178.1, letras a) y b), del texto refundido de la Ley de Propiedad Intelectual.

Artículo 2.- Publicaciones asimiladas a libro

A los efectos del artículo 25.1 del texto refundido de la Ley de Propiedad Intelectual y de este real decreto, se entenderán asimiladas a los libros las publicaciones, tanto en soporte papel como en formato digital, de contenido cultural, científico o técnico siempre y cuando:

a) Estén editadas en serie continua con un mismo título a intervalos regulares o irregulares, de forma que los ejemplares de la serie lleven una numeración consecutiva o estén fechados, con periodicidad mínima mensual y máxima semestral.

b) Tengan al menos 48 páginas por ejemplar en soporte papel, o extensión similar en formato digital.

Artículo 3.- Otras definiciones

A los efectos de este real decreto se entenderá por:

a) Certificado de exceptuación: cada uno de los certificados mencionados en el artículo 25.7, letras a) a c), del texto refundido de la Ley de Propiedad Intelectual, que podrán ser de titularidad de los siguientes sujetos:

1.º Entidades que integran el sector público según se establece en la Ley 9/2017, de 8 de noviembre, de Contratos del Sector Público, por la que se transponen al ordenamiento jurídico español las Directivas del Parlamento Europeo y del Consejo 2014/23/UE y 2014/24/UE, de 26 de febrero de 2014, así como el Congreso de los Diputados, el Senado, el Consejo General del Poder Judicial, el Tribunal de Cuentas, el Defensor del Pueblo, las Asambleas legislativas de las Comunidades Autónomas y las instituciones autonómicas análogas al Tribunal de Cuentas y al Defensor del Pueblo.

2.º Personas jurídicas o físicas que actúen como consumidores finales, que justifiquen el destino exclusivamente profesional de los equipos, aparatos o soportes materiales que adquieran y siempre que estos no se pongan, de derecho o de hecho, a disposición de usuarios privados y que estén manifiestamente reservados a usos distintos a la realización de copias privadas.

3.º Sujetos que cuenten con la preceptiva autorización para llevar a efecto la correspondiente reproducción de obras, prestaciones artísticas, fonogramas o videogramas, según proceda, en el ejercicio de su actividad.

b) Compensación: la reconocida en el artículo 25 del texto refundido de la Ley de Propiedad Intelectual por la vigencia del límite al derecho de reproducción por copia privada reconocido en el artículo 31, apartados 2 y 3, del citado texto refundido.

c) Distribuidores: los distribuidores, mayoristas y minoristas, sucesivos adquirentes de los equipos, aparatos y soportes materiales.

d) Entidades de gestión: las entidades legalmente constituidas que tienen establecimiento en territorio español y que poseen la autorización del Ministerio de Cultura y Deporte, prevista en el artículo 147 del texto refundido de la Ley de Propiedad Intelectual, para gestionar, en nombre propio o ajeno, derechos de explotación u otros de carácter patrimonial, por cuenta y en interés de varios autores u otros titulares de derechos de propiedad intelectual.

e) Equipos, aparatos y soportes materiales: según el artículo 25.1 del texto refundido de la Ley de Propiedad Intelectual, los objetos idóneos para realizar las reproducciones amparadas por la vigencia del límite al derecho de reproducción por copia privada y que estarán sujetos al pago de la compensación.

Los equipos, aparatos y soportes sujetos al pago de la compensación, las cantidades que los deudores deberán abonar por este concepto a los acreedores y la distribución de dicha compensación entre las distintas modalidades de reproducción se determinarán mediante la Orden del Ministerio de la Presidencia, Relaciones con las Cortes e Igualdad prevista en el artículo 25.4 del texto refundido de la Ley de Propiedad Intelectual.

f) Modalidades de reproducción: cada una de las tres modalidades de reproducción de obras divulgadas que se mencionan en el artículo 25.1 del texto refundido de la Ley de Propiedad Intelectual:

1.º Reproducción de libros o publicaciones asimiladas a libros.

2.º Reproducción de fonogramas o de otros soportes sonoros.

3.º Reproducción de videogramas o de otros soportes visuales o audiovisuales.

g) Persona jurídica: la persona jurídica constituida por las entidades de gestión de conformidad con el artículo 25.10 del texto refundido de la Ley de Propiedad Intelectual y la disposición adicional única del Real Decreto-ley 12/2017, de 3 de julio, por el que se modifica el texto refundido de la Ley de Propiedad Intelectual, aprobado por el Real Decreto Legislativo 1/1996, de 12 de abril, en cuanto al sistema de compensación equitativa por copia privada.

h) Responsables solidarios: según el artículo 25.3, segundo párrafo, del texto refundido de la Ley de Propiedad Intelectual, los distribuidores que no acrediten haber satisfecho la compensación a un sujeto deudor.

i) Sujetos acreedores: según el artículo 25.2 del texto refundido de la Ley de Propiedad Intelectual:

1.º Los autores de obras divulgadas en alguno de los formatos descritos en la letra f), conjuntamente y, en los casos y modalidades de reproducción en que corresponda, con los editores.

2.º Los productores de fonogramas y videogramas.

3.º Los artistas intérpretes o ejecutantes cuyas actuaciones hayan sido fijadas en dichos fonogramas y videogramas.

j) Sujetos deudores: según el artículo 25.4 del texto refundido de la Ley de Propiedad Intelectual, los fabricantes en España, en tanto actúen como distribuidores comerciales, así como los adquirentes fuera del territorio español, para su distribución comercial o utilización dentro de éste, de equipos, aparatos y soportes materiales.

Artículo 4.- Distribución de la compensación en cada modalidad de reproducción según la categoría del acreedor

1.- La distribución de la compensación en cada modalidad de reproducción según la categoría del sujeto acreedor, se realizará de la siguiente manera:

a) En la modalidad de fonogramas y demás soportes sonoros, el 40 por ciento para los autores, el 30 por ciento para los artistas intérpretes o ejecutantes y el 30 por ciento para los productores.

b) En la modalidad de videogramas y demás soportes visuales o audiovisuales, un tercio para los autores, un tercio para los artistas intérpretes o ejecutantes y un tercio para los productores.

c) En la modalidad de libros y publicaciones asimiladas, el 55 por ciento para los autores y el 45 por ciento para los editores.

2.- Conforme a los porcentajes de distribución previstos en el apartado anterior, las entidades de gestión concurrentes en la gestión de derechos de una misma categoría de acreedores de una misma modalidad de reproducción, determinarán de mutuo acuerdo los porcentajes o sistema de reparto correspondientes a cada una de ellas.

3.- En caso de que las entidades de gestión concurrentes en la gestión de derechos de una categoría de acreedores de una misma modalidad de reproducción no alcancen el acuerdo indicado en el apartado anterior, la determinación de los porcentajes o sistema de reparto por cada modalidad podrá establecerse por la Sección Primera de la Comisión de Propiedad Intelectual, de conformidad con lo previsto en el artículo 194.2 del texto refundido de la Ley de Propiedad Intelectual o mediante laudo de otro órgano arbitral, de conformidad con la normativa vigente en materia de arbitraje. El laudo establecerá, al menos, los porcentajes o sistema de reparto de la cantidad de la compensación asignada a cada modalidad, permitiendo reconocer las obligaciones y el pago a las entidades de gestión de conformidad con sus términos.

CAPÍTULO II.- Procedimiento para hacer efectiva la compensación

Artículo 5.- Obligaciones de facturación e información

1.- Los sujetos deudores y los distribuidores deberán incluir el importe de la compensación de forma separada en la factura que, conforme a la normativa vigente en materia de facturación, entreguen a su cliente, salvo que éste disponga de un certificado vigente de exceptuación.

El importe de la compensación derivada del suministro o la importación de equipos, aparatos y soportes materiales quedará sujeto al Impuesto sobre el Valor Añadido, al Impuesto General Indirecto Canario, o al Impuesto sobre la Producción, los Servicios y la Importación, según proceda.

2.- Cuando el cliente sea consumidor final que no disponga de un certificado vigente de exceptuación, los sujetos deudores y los distribuidores deberán poner a su disposición un documento con la siguiente información:

a) El derecho a solicitar un certificado de exceptuación, conforme a lo previsto en el artículo 25.7 del texto refundido de la Ley de Propiedad Intelectual y en el presente real decreto.

b) El derecho a obtener, si no se dispone de certificado de exceptuación, el reembolso del pago de la compensación, conforme a lo previsto en el artículo 25.8 del texto refundido de la Ley de Propiedad Intelectual y en el presente real decreto.

3.- La persona jurídica difundirá en su portal de internet un modelo del documento conforme a lo previsto en el apartado anterior.

4.- En ningún caso los distribuidores aceptarán de sus respectivos proveedores el suministro de equipos, aparatos y soportes materiales sometidos al pago de la compensación si no vienen facturados conforme a lo previsto en el apartado 1.

Sin perjuicio de lo dispuesto en el párrafo anterior, cuando el importe de la compensación no aparezca de forma separada en la factura, se presumirá, salvo prueba en contrario, que la compensación derivada de los equipos, aparatos y soportes materiales que comprenda no ha sido satisfecha.

Artículo 6.- Comunicación de la relación de equipos, aparatos y soportes materiales respecto de los que haya nacido la obligación de pago de la compensación

1.- Los sujetos deudores presentarán a la persona jurídica, dentro de los treinta días naturales siguientes a la finalización de cada trimestre natural, una relación de las unidades de equipos, aparatos y soportes materiales, incluyendo sus características técnicas y capacidad, en la medida que sea relevante para la determinación de la cuantía de la compensación aplicable, respecto de los cuales haya nacido la obligación de pago de la compensación durante dicho trimestre.

Con el mismo detalle, deducirán las cantidades correspondientes a las unidades:

a) Destinadas fuera del territorio español. Respecto de estas unidades, deberá aportarse copia de la factura, albaranes o cualquier otra documentación que acredite que se ha perfeccionado la exportación.

b) Vendidas o que se haya cedido su uso y disfrute a sujetos que sean titulares de un certificado vigente de exceptuación. Respecto de estas unidades, deberán detallar la siguiente información:

1.º La fecha y número de la factura.

2.º Número de identificación fiscal y nombre y apellidos o razón o denominación social del titular del certificado de exceptuación.

Los sujetos deudores referidos en el artículo 25.6.b) del texto refundido de la Ley de Propiedad Intelectual harán una declaración a la persona jurídica de las unidades de equipos, aparatos y soportes materiales adquiridos dentro de los treinta días naturales siguientes al nacimiento de la obligación.

2.- Los distribuidores presentarán a la persona jurídica, dentro de los treinta días naturales siguientes a la finalización de cada trimestre natural, una relación de las unidades de equipos, aparatos y soportes materiales respecto de las que haya nacido la obligación de pago de la compensación durante dicho trimestre, de la siguiente manera:

a) Respecto de las unidades adquiridas por ellos en territorio español, de deudores que no les hayan repercutido y hecho constar en la factura la correspondiente compensación, deberán presentar la relación conforme a lo previsto en el apartado 1.

b) Respecto de las unidades adquiridas por ellos en territorio español, de deudores que sí les hayan repercutido y hecho constar en la factura la correspondiente compensación, deberán detallar aquellas unidades destinadas fuera del territorio español y aquéllas que hayan vendido o cedido su uso y disfrute a sujetos que dispusieran de un certificado vigente de exceptuación, de acuerdo con lo previsto en el segundo párrafo del apartado 1 y, además, deberán acreditar haber satisfecho previamente la compensación.

3.- Una vez recibidas las relaciones trimestrales de unidades previstas en los apartados 1 y 2, la persona jurídica las remitirá a las entidades de gestión al objeto de que hagan las comprobaciones necesarias.

Artículo 7.- Pago de la compensación

1.- Cuando, tras realizar las comprobaciones necesarias de las relaciones trimestrales de unidades recibidas, las entidades de gestión constaten la existencia de una obligación de pago de la compensación a su favor, emitirán una factura a nombre del deudor o del responsable solidario con el importe a pagar por éste.

2.- Las entidades de gestión realizarán una comunicación unificada de la facturación al sujeto deudor o al responsable solidario a través de la persona jurídica.

3.- El pago se efectuará por el sujeto deudor o por el responsable solidario en el plazo de un mes desde la recepción de la comunicación unificada de la facturación, salvo que se aprecie error en alguna de las facturas comunicadas En este último caso, el cómputo del plazo para el pago de esa factura comenzará desde la recepción de la misma una vez corregida.

4.- Los sujetos deudores y los responsables solidarios se considerarán depositarios de la compensación devengada hasta el efectivo pago de ésta.

Artículo 8.- Devolución de la compensación

1.- Cuando, tras realizar las comprobaciones necesarias de las relaciones trimestrales de unidades recibidas, las entidades de gestión constaten la existencia de una obligación de devolución del importe de la compensación, deberán solicitar la emisión de la correspondiente factura al sujeto deudor o al distribuidor.

2.- El pago de la devolución se efectuará por las entidades de gestión en el plazo de un mes desde la recepción de la factura del sujeto deudor o del distribuidor, salvo que no se haya acreditado el haber satisfecho previamente la compensación o se aprecie error en la factura. En este último caso, el cómputo del plazo comenzará desde la recepción de la factura corregida.

3.- Las entidades de gestión se considerarán depositarias del importe de la devolución hasta el efectivo pago de ésta.

Artículo 9.- Declaración y facturación complementaria o rectificativa

1.- La persona jurídica comunicará a las entidades de gestión, tras el ejercicio de las funciones de control que le atribuye el artículo 25.11 del texto refundido de la Ley de Propiedad Intelectual, las unidades no declaradas o exceptuadas erróneamente por los sujetos deudores o los distribuidores, o las unidades facturadas en exceso o indebidamente por las entidades de gestión a un sujeto deudor o a un responsable solidario.

2.- La persona jurídica remitirá a las entidades de gestión la documentación de soporte que justifique esas diferencias de comprobación para que se emitan las correspondientes facturas complementarias o rectificativas según el caso.

Artículo 10.- Procedimiento de obtención y utilización del certificado de exceptuación

1.- Para obtener el certificado de exceptuación previsto en el artículo 3.a)2.º, el sujeto interesado deberá remitir a la persona jurídica una solicitud que, preferentemente, deberá firmarse electrónicamente, y que deberá incluir la siguiente información:

a) Número de identificación fiscal y nombre y apellidos o razón o denominación social.

b) Indicación del objeto social o una declaración de actividad del solicitante.

c) Declaración, bajo la responsabilidad del solicitante, sobre los siguientes aspectos:

1.º El régimen de utilización de los equipos, aparatos y soportes materiales que vaya a adquirir, que deberán ser destinados a usos exclusivamente profesionales y manifiestamente distintos a la realización de copias privadas.

2.º Que no pondrá dichos equipos, aparatos y soportes materiales, ni de hecho ni de derecho, a disposición de usuarios privados.

3.º Que se someterá a las facultades de control reconocidas a la persona jurídica por el artículo 25.11 del texto refundido de la Ley de Propiedad Intelectual.

d) En el caso de que el solicitante emplee trabajadores por cuenta ajena a cuya disposición vaya a poner los equipos, aparatos o soportes materiales que vaya a adquirir, declaración de que, bajo su responsabilidad, esos trabajadores tienen conocimiento de la siguiente información:

1.º Que los equipos, aparatos o soportes materiales que su empleador les facilita para el desarrollo de sus funciones profesionales deberán utilizarse exclusivamente para tal finalidad.

2.º Que no está permitido el uso para fines privados de los citados equipos, aparatos o soportes materiales.

2.- La persona jurídica difundirá en su portal de Internet un modelo normalizado de solicitud de certificado de exceptuación que cumpla con los requisitos previstos en el apartado anterior.

3.- Para obtener el certificado de exceptuación previsto en el artículo 3.a)3.º, el solicitante deberá remitir a la persona jurídica una solicitud a la que deberá acompañar una copia de la autorización para llevar a efecto la correspondiente reproducción de obras, prestaciones artísticas, fonogramas o videogramas en el ejercicio de su actividad.

4.- Una vez recibida la solicitud de emisión de un certificado de exceptuación, la persona jurídica dispondrá de quince días hábiles para conceder o denegar el certificado y comunicar su decisión al solicitante.

5.- La persona jurídica solamente podrá denegar la concesión del certificado en los siguientes supuestos:

a) Cuando la solicitud no incluya toda la información exigida en el presente artículo.

b) Cuando las declaraciones responsables no reflejen lo exigido en el presente artículo.

c) Cuando el solicitante hubiera sido objeto previamente de una revocación del certificado de exceptuación, salvo que las causas que la motivaron hubieran desaparecido.

En los supuestos previstos en las letras a) y b) anteriores, la persona jurídica deberá otorgar previamente al solicitante un plazo de siete días hábiles para que subsane su solicitud.

La denegación se comunicará al solicitante junto con una justificación adecuada de los motivos de tal decisión y, asimismo, le informará del derecho a plantear, en el plazo de un mes a contar desde la comunicación de la denegación, un conflicto ante el Ministerio de Cultura y Deporte, en virtud del artículo 25.12 del texto refundido de la Ley de Propiedad Intelectual.

6.- El certificado expedido por la persona jurídica tendrá la siguiente duración:

a) El certificado previsto en el artículo 3.a) 2.º tendrá una duración indefinida siempre que su titular no modifique su actividad profesional de manera que no destine a un uso exclusivamente profesional los equipos aparatos o soportes materiales que adquiera. En este último caso, deberá comunicar a la persona jurídica dicha modificación en el plazo de siete días hábiles.

b) El certificado previsto en el artículo 3.a) 3.º tendrá la misma duración que la autorización de reproducción de la que derive.

No obstante, si la persona jurídica, en el ejercicio de sus facultades de control, detectara que el titular de un certificado vigente de exceptuación no cumple con los requisitos necesarios para poseerlo, podrá revocarlo siempre que, con carácter previo, haya permitido al titular hacer las alegaciones y aportar los documentos que estime oportunos para su defensa. La revocación, una vez sea definitiva, deberá hacerse constar de forma inmediata en el listado previsto en el apartado 8.

7.- El certificado de exceptuación solamente podrá hacerse valer en las operaciones comerciales que se realicen tras la fecha de su emisión. Deberá presentarse y estar vigente en el momento de la firma del contrato de compraventa o de cesión de uso y disfrute y, en todo caso, con carácter previo a la emisión de la factura. La vigencia del certificado se verificará mediante consulta del listado a que se refiere el apartado siguiente.

8.- La persona jurídica mantendrá en su portal de internet un listado actualizado de los sujetos que dispongan de un certificado vigente de exceptuación, con indicación de su número de identificación fiscal. Asimismo, deberá garantizar de forma fehaciente la fecha de actualización de dicho listado e informar de las actualizaciones del mismo, en el momento que se produzcan, a los sujetos deudores y a los distribuidores.

9.- La factura que se emita con razón de la transacción en la que se haga valer el certificado de exceptuación deberá hacerse a nombre del titular del mismo.

10.- En defecto de certificado, los sujetos beneficiarios de la exceptuación podrán utilizar el procedimiento de reembolso.

Artículo 11.- Procedimiento de reembolso del pago de la compensación

1.- La solicitud de reembolso del pago de la compensación se remitirá a la persona jurídica. Dicha solicitud, que deberá firmarse, preferentemente, de forma electrónica, deberá acompañarse de la siguiente información:

a) Número de identificación fiscal y nombre y apellidos o razón o denominación social.

b) Indicación del objeto social o una declaración de actividad del solicitante.

c) Copia de la factura de adquisición de los equipos, aparatos o soportes materiales.

d) Declaración, bajo responsabilidad del solicitante, sobre los siguientes aspectos:

1.º Que el destino dado a los equipos, aparatos o soportes materiales adquiridos es exclusivamente profesional y manifiestamente distinto a la realización de copias privadas.

2.º Que no ha puesto dichos equipos, aparatos y soportes materiales, ni de hecho ni de derecho, a disposición de usuarios privados.

3.º Que se someterá a las facultades de control reconocidas a la persona jurídica por el artículo 25.11 del texto refundido de la Ley de Propiedad Intelectual.

e) En el caso de que el solicitante emplee trabajadores por cuenta ajena a cuya disposición haya puesto los equipos, aparatos o soportes materiales que haya adquirido, declaración de que, bajo su responsabilidad, estos trabajadores tienen conocimiento de los siguientes aspectos:

1.º Que los equipos, aparatos o soportes materiales que su empleador les facilita para el desarrollo de sus funciones profesionales deben utilizarse exclusivamente para tal finalidad.

2.º Que no está permitido el uso para fines privados de los citados equipos, aparatos o soportes materiales.

2.- La persona jurídica difundirá en su portal de Internet un modelo normalizado de solicitud de reembolso que cumpla con los requisitos previstos en el apartado anterior.

3.- La persona jurídica dispondrá de un plazo de un mes desde la recepción de la solicitud para realizar las comprobaciones necesarias para acreditar la existencia o inexistencia del derecho al reembolso y comunicar su decisión al solicitante.

4.- Si se acredita la existencia del derecho al reembolso, la persona jurídica, cuando lo comunique al solicitante, le requerirá la emisión de la correspondiente factura para proceder a su pago.

5.- La persona jurídica sólo podrá denegar el reembolso de la compensación en los siguientes supuestos:

a) Cuando la solicitud de reembolso no incluya toda la información exigida en el presente artículo.

b) Cuando las declaraciones responsables no reflejen lo exigido en el presente artículo.

c) Cuando el importe de la solicitud de reembolso sea inferior al previsto en el penúltimo párrafo del artículo 25.8 del texto refundido de la Ley de Propiedad Intelectual con la salvedad prevista en dicho artículo.

d) Cuando, una vez analizada la solicitud, no se acredite la existencia del derecho al reembolso.

En los supuestos previstos en las letras a) y b) anteriores, se otorgará al solicitante un plazo de siete días hábiles para que subsane su solicitud.

La denegación se comunicará al solicitante junto con una justificación adecuada de los motivos de la misma y, asimismo, le informará del derecho a plantear, en el plazo de un mes a contar desde la comunicación de la denegación, un conflicto ante el Ministerio de Cultura y Deporte en virtud del artículo 25.12 del texto refundido de la Ley de Propiedad Intelectual.

Artículo 12.- Obligación de confidencialidad

1.- Las entidades de gestión y la persona jurídica respetarán el carácter confidencial de cualquier información que conozcan en el ejercicio de sus funciones, y su tratamiento, en todo caso, estará sujeto al cumplimiento de la normativa de defensa de la competencia y de protección de datos.

2.- Los deudores, los distribuidores y los titulares de certificados de exceptuación no podrán hacer valer el secreto de contabilidad empresarial contemplado en el artículo 32, apartado 1, del Código de Comercio, cuando la persona jurídica ejerza las facultades de control que se le reconocen en el artículo 25.11 del texto refundido de la Ley de Propiedad Intelectual.

Artículo 13.- Convenios de colaboración sobre la compensación

1.- La persona jurídica promoverá la celebración de convenios de colaboración con los siguientes sujetos, entre otros:

a) Sujetos deudores y distribuidores o asociaciones representativas de los mismos.

b) Colegios Profesionales, Cámaras de Comercio o corporaciones equivalentes; asociaciones de profesionales; o cualquier otra asociación representativa de usuarios de equipos, aparatos y soportes materiales.

2.- Los convenios de colaboración tendrán por objeto, entre otros aspectos, los siguientes:

a) Aportar eficiencia a la gestión para hacer efectiva la compensación y, en particular, la devolución de la misma. Como medida en este sentido, podrán regularse mecanismos que permitan a los sujetos deudores y a los distribuidores exceptuar del pago de la compensación las sucesivas transacciones relativas a los equipos, aparatos y soportes materiales respecto de los que pueda acreditarse de antemano que, en última instancia, van a ser destinados fuera del territorio español o a sujetos que sean titulares de un certificado vigente de exceptuación.

b) Informar y facilitar la obtención de certificados de exceptuación y prestar servicios para agrupar el reembolso del pago de la compensación.

c) Desarrollar acciones formativas.

CAPÍTULO III.- Procedimiento para la resolución de conflictos relacionados con la concesión de certificados de exceptuación y reembolsos del pago de la compensación

Artículo 14.- Iniciación y finalización del procedimiento

1.- La Dirección General de Industrias Culturales y Cooperación será el órgano competente para resolver los conflictos que surjan entre la persona jurídica y los solicitantes de certificados de exceptuación y de reembolsos del pago de la compensación.

2.- El procedimiento administrativo para resolver el conflicto se tramitará de conformidad con lo previsto en la Ley 39/2015, de 1 de octubre, del Procedimiento Administrativo Común de las Administraciones Públicas y de acuerdo con las especialidades procedimentales reguladas en este artículo.

3.- La solicitud de resolución de conflicto deberá presentarse ante la Dirección General de Industrias Culturales y Cooperación en el plazo de un mes desde la notificación de la denegación del certificado de exceptuación o del reembolso. La solicitud deberá adjuntar, al menos, los siguientes documentos:

a) Copia de la solicitud de certificado de exceptuación o de reembolso cursada a la persona jurídica con todos los documentos que la acompañaron.

b) Copia del documento emitido por la persona jurídica denegando la solicitud cursada.

4.- El plazo máximo para que la Dirección General de Industrias Culturales y Cooperación emita y notifique la decisión resolviendo el conflicto será de seis meses a computar desde la recepción completa de la solicitud.

5.- La resolución de la Dirección General de Industrias Culturales y Cooperación, que vinculará a todas las partes y pondrá fin a la vía administrativa, podrá declarar la existencia o inexistencia del derecho a obtener el certificado de exceptuación o el reembolso del pago de la compensación. En el caso de declarar la existencia del derecho a obtener el reembolso, conminará a la persona jurídica al pago de la cuantía que en Derecho corresponda al solicitante del mismo.

CAPÍTULO IV.- Porcentaje de la compensación equitativa que las entidades de gestión deben dedicar a determinadas actividades y servicios

Artículo 15.- Realización de actividades de asistencia y fomento por parte de las entidades de gestión

1.- Las entidades de gestión, directamente o por medio de otras entidades deberán, según lo establecido en el artículo 178 del texto refundido de la Ley de Propiedad Intelectual:

a) Promover actividades o servicios de carácter asistencial en beneficio de sus miembros.

b) Atender actividades de formación y promoción de autores y artistas intérpretes o ejecutantes.

2.- Las entidades de gestión deberán dedicar a las dos modalidades de actividades a que se refiere el apartado anterior, por partes iguales, el veinte por ciento del importe de la compensación.

3.- En el primer trimestre de cada año, las entidades de gestión remitirán a la Dirección General de Industrias Culturales y Cooperación la información referida al ejercicio anterior que a continuación se relaciona:

a) Memoria pormenorizada de las actividades o servicios a que se refieren los apartados a) y b) del apartado 1.

b) Cantidades desglosadas que se hayan afectado a dichas actividades o servicios de acuerdo con lo previsto en el apartado 2, y

c) Relación pormenorizada de titulares beneficiarios.

4.- Asimismo deberán remitir a la Dirección General de Industrias Culturales y Cooperación cualquier otra información que ésta requiera en relación con la realización de actividades de asistencia y fomento a la que están obligadas las entidades de gestión.

DISPOSICIONES ADICIONALES

Disposición adicional primera.- Realización de actividades de asistencia y fomento por parte de las entidades de gestión de derechos de propiedad intelectual

La obligación regulada en el artículo 15.2 de este real decreto resultará de aplicación a la compensación equitativa que las entidades de gestión hayan recaudado desde la entrada en vigor de la disposición transitoria segunda del Real Decreto-ley 12/2017, de 3 de julio, por el que se modifica el texto refundido de la Ley de Propiedad Intelectual, aprobado por el Real Decreto Legislativo 1/1996, de 12 de abril, en cuanto al sistema de compensación equitativa por copia privada.

Disposición adicional segunda.- Función de la Sección Primera de la Comisión de Propiedad Intelectual en materia de compensación equitativa por copia privada

Las reuniones de la Sección Primera de la Comisión de Propiedad Intelectual cuyo objeto sea la emisión del informe preceptivo previsto en el artículo 25.4 del texto refundido de la Ley de Propiedad Intelectual tendrán como tales el mismo tratamiento que las reuniones de dicho órgano colegiado que tengan como objeto el ejercicio de su función de determinación de tarifas.

Disposición adicional tercera.- No incremento del gasto público

Las medidas incluidas en este real decreto no podrán suponer un aumento neto de los gastos de personal.

Disposición transitoria única.- Plazo máximo para resolver las solicitudes de reembolso

Durante el plazo de seis meses a computar desde la fecha de entrada en vigor del presente real decreto, el plazo máximo para resolver las solicitudes de reembolso, cursadas conforme al procedimiento regulado en el artículo 11 de este real decreto, será de dos meses.

Disposición derogatoria única.- Derogación normativa

Quedan derogadas las disposiciones de igual o inferior rango que se opongan al presente real decreto y, en particular, los preceptos vigentes del Real Decreto 1434/1992, de 27 de noviembre, de desarrollo de los artículos 24, 25 y 140 de la Ley 22/1987, de 11 de noviembre, de Propiedad Intelectual, en la versión dada a los mismos por la Ley 20/1992, de 7 de julio; y el Real Decreto 1802/1995, de 3 de noviembre, por el que se establece el sistema para la determinación de la remuneración compensatoria por copia privada en las ciudades de Ceuta y Melilla.

DISPOSICIONES FINALES

Disposición final primera.- Reparto de la compensación entre modalidades de reproducción

1.- El acuerdo que, en su caso, exista entre las entidades de gestión autorizadas por el Ministerio de Cultura y Deporte para determinar el reparto de la compensación equitativa regulada en el apartado 1 de la disposición transitoria segunda del Real Decreto-ley 12/2017, de 3 de julio, entre las distintas modalidades de reproducción, deberá remitirse al Ministerio de Cultura y Deporte, a la Secretaría de Estado para el Avance Digital y a las principales asociaciones representativas de sujetos deudores y distribuidores en el plazo de cinco días tras la entrada en vigor de este real decreto.

2.- Una vez resueltas todas las solicitudes de reembolso correspondientes a la compensación equitativa regulada en el apartado 1 de la disposición transitoria segunda del Real Decreto-ley 12/2017, de 3 de julio, que hubiera sido recaudada hasta la entrada en vigor del presente real decreto, las entidades de gestión liberarán el saldo remanente de la provisión dotada en cumplimiento del apartado 5 de dicha disposición transitoria que no haya sido consumido en la atención de reembolsos.

Disposición final segunda.- Título competencial

Disposición final tercera.- Entrada en vigor

El presente real decreto entrará en vigor el 2 de enero de 2019.

22Dic/18

Acuerdo GOV/143/2018, de 27 de noviembre

22 diciembre, 2018Acuerdo, Cataluña, EspañaAcuerdo GOV/143/2018, de 27 de noviembreJosé Cuervo

Acuerdo GOV/143/2018, de 27 de noviembre, por el que se impulsa el Programa internet segura para la sensibilización y concienciación de la ciudadanía en materia de ciberseguridad y se crea la Comisión de Coordinación Interdepartamental del Programa Internet Segura. (Diari Oficial de la Generalitat de Catalunya Núm. 7758 – 29.11.2018)

DEPARTAMENTO DE POLÍTICAS DIGITALES Y ADMINISTRACIÓN PÚBLICA

El desarrollo de la sociedad digital se configura como una revolución social que se caracteriza por la masiva y libre circulación de informaciones, ideas y conocimiento a través de redes, infraestructuras, dispositivos y nuevas aplicaciones. Dicho desarrollo está afectado por varios retos y amenazas; el más relevante de ellos es, actualmente, el de la seguridad y la calidad de las tecnologías de la información y la comunicación (TIC).

Los poderes públicos apuestan por la plena implantación de esta sociedad digital y utilizan cada día más las herramientas que los prestadores de servicios ponen a su disposición. El uso cotidiano de estas tecnologías y el tratamiento de la información que hacen de ellas convierten los servicios y las infraestructuras TIC en elementos esenciales para el actual desarrollo económico y para la convivencia social. La dependencia de estos servicios e infraestructuras los convierte en básicos para garantizar la continuidad de las actividades, para ofrecer seguridad jurídica en las acciones de los ciudadanos y el tráfico mercantil, así como para garantizar el progreso y el desarrollo de la ciudadanía de Cataluña en esta sociedad digital.

La ciberseguridad es uno de los pilares sobre los que debe construirse la sociedad digital que se quiere en Cataluña y, por eso, hace falta que los poderes públicos lleven a cabo las actuaciones necesarias para garantizarla, de manera simultánea al desarrollo de la tecnología y los nuevos servicios. Con esta finalidad, el 17 de marzo de 2009 el Gobierno de la Generalidad aprobó el Plan de seguridad de la información en Cataluña, cuya ejecución corresponde a la Fundación Centro de Seguridad de la Información de Cataluña (CESICAT).

Para la consecución de los fines fundacionales, sus estatutos determinan que el CESICAT desarrolla las actividades que el Patronato considera necesarias directamente y/o en colaboración con otras entidades, instituciones o personas, de acuerdo con lo que dispone la normativa sobre fundaciones.

En concreto, sus estatutos indican que el CESICAT tiene, entre sus objetivos, incrementar la confianza y protección de la ciudadanía catalana en la sociedad de la información, con una atención especial a los colectivos con más riesgos —por ejemplo, los niños y los jóvenes— mediante el establecimiento de programas de concienciación y apoyo específicamente dirigidos a estos colectivos, y actuar en apoyo de la lucha contra todas las formas de delincuencia informática, de forma coordinada con los agentes competentes, reforzando las capacidades de detección y denuncia de ilícitos de todo tipo, filtraje de contenidos y análisis forense de evidencias electrónicas.

En la ejecución de este cometido, el CESICAT fue designado el año 2011 centro de internet segura para el territorio de Cataluña, en el ámbito del Programa Safer Internet Centre, impulsado por la Comisión Europea.

Como centro de internet segura, el CESICAT puso en funcionamiento un programa de concienciación y una línea de atención telefónica con el fin de dar apoyo e información a la ciudadanía sobre los riesgos que plantea la sociedad digital en materia de ciberseguridad.

Asimismo, el CESICAT ha participado en numerosos acontecimientos para fomentar estos contenidos y concienciar sobre esta materia —por ejemplo, en la Fiesta de los Súpers, que coordina la Corporación Catalana de Medios Audiovisuales.

El CESICAT ha producido, desde su origen, una gran cantidad de contenidos y ha creado portales y canales de comunicación —por ejemplo, el portal internetsegura.cat— para poner a disposición de la ciudadanía la información adecuada.

Sin perjuicio de ello, es necesario un impulso de este programa y las campañas que incluye por parte de la Generalidad de Cataluña, así como una coordinación con otros departamentos o entidades del sector público que, o bien realizan acciones en materia de concienciación en ciberseguridad que deben coordinarse en el marco del Programa internet segura, o bien resultan medios imprescindibles con el fin de garantizar el adecuado impacto del programa de concienciación.

Por todos estos motivos, este Acuerdo del Gobierno tiene como objetivo impulsar el Programa internet segura como programa oficial de la Generalidad de Cataluña en materia de concienciación en ciberseguridad y fijar medidas de coordinación con otros departamentos o entidades de la Generalidad de Cataluña y de impulso para desplegarlo correctamente en los sectores destinatarios del Programa.

A propuesta del consejero de Políticas Digitales y Administración Pública, el Gobierno

Acuerda:

1.- Impulsar el Programa internet segura, desarrollado y ejecutado por la Fundación Centro de Seguridad de la Información de Cataluña (CESICAT), como programa oficial de la Generalidad de Cataluña para sensibilizar y concienciar a la ciudadanía en materia de ciberseguridad.

El Programa internet segura tiene las siguientes finalidades:

a) Crear cultura de ciberseguridad.

b) Aumentar la concienciación en materia de ciberseguridad en diferentes colectivos de la sociedad catalana, incluyendo a las administraciones locales, las empresas y la ciudadanía. El Programa internet segura tiene especialmente en cuenta a aquellos colectivos vulnerables a los riesgos que plantea la ciberseguridad a la sociedad catalana.

c) Establecer programas de formación de formadores en materia de ciberseguridad, identificar a colectivos clave que puedan llevar a cabo el efecto multiplicativo, y aumentar la capilaridad del contenido. A este efecto, el Programa internet segura se coordinará con otros liderados por la Dirección General de la Sociedad Digital —por ejemplo, el programa de puntos TIC— o con programas que puedan ser impulsados por otros departamentos.

d) Promover la colaboración con otras administraciones o entidades públicas o privadas con el fin de maximizar el impacto del Programa internet segura. Con esta finalidad, se podrán firmar convenios de colaboración con otras administraciones para garantizar el mayor impacto y capilaridad del Programa internet segura y alcanzar un nivel de concienciación adecuado en el entorno de la Administración pública.

e) Cualquier otra de carácter análogo y directamente relacionada con las anteriores que se pueda entender incluida en el Programa.

2.- Crear la Comisión de Coordinación Interdepartamental del Programa Internet Segura para permitir la compartición de información, la coordinación de acciones y el establecimiento de iniciativas conjuntas en el ámbito del Programa internet segura. La Comisión de Coordinación Interdepartamental del Programa Internet Segura se adscribe al Departamento de Políticas Digitales y Administración Pública, que la lidera de forma coordinada con el CESICAT.

3.- La Comisión de Coordinación Interdepartamental del Programa Internet Segura tiene las funciones siguientes:

a) Coordinar la elaboración de un plan de trabajo para identificar las campañas que debe llevar a cabo el CESICAT, los objetivos esperados de cada una de ellas y las actuaciones que se desarrollarán.

b) Colaborar en la ejecución de las campañas que se acuerden de conformidad con su ámbito de responsabilidad.

c) Facilitar al CESICAT los medios y la información adecuada para lograr los objetivos del Programa.

4.- La Comisión de Coordinación Interdepartamental del Programa Internet Segura está formada por:

a) Un representante del Departamento de Políticas Digitales y Administración Pública, que asume la presidencia.

b) Un representante del CESICAT, que asume la vicepresidencia.

c) Un representante de la unidad directiva competente en materia de medios de comunicación.

d) Un representante de la unidad directiva competente en materia de mando de las unidades policiales.

e) Un representante de la unidad directiva competente en materia de políticas educativas.

f) Un representante de la unidad directiva o entidad competente en materia de formación o promoción de formación tecnológica en el ámbito de la salud.

g) Un representante de la unidad directiva competente en materia de infancia, adolescencia y juventud.

h) Un representante de la unidad directiva competente en materia de empresa y competitividad.

i) Un funcionario/aria de la Secretaría de Telecomunicaciones, Ciberseguridad y Sociedad Digital, que actuará como secretario/aria, con voz y sin voto. El secretario/aria de la Comisión será nombrado/ada por la persona titular de la unidad directiva mencionada. El ejercicio de las funciones de secretario/aria de la Comisión no comportará la creación ni la ocupación de un puesto de trabajo específico a este efecto.

El rango orgánico mínimo de los representantes de la Comisión de Coordinación Interdepartamental del Programa internet segura es el de director general.

5.- Para desplegar las diferentes actuaciones, la Comisión podrá solicitar el asesoramiento de expertos de reconocido prestigio que puedan aportar su visión.

6.- La Secretaría de Telecomunicaciones, Ciberseguridad y Sociedad Digital da apoyo técnico y logístico a la Comisión de Coordinación Interdepartamental del Programa Internet Segura.

7.- Los miembros de la Comisión de Coordinación Interdepartamental del Programa Internet Segura y los expertos a los que se hace referencia en el apartado quinto no perciben ninguna retribución por el ejercicio de sus funciones y no tienen ningún derecho de naturaleza económica en razón de la asistencia a las reuniones de la Comisión ni tienen derecho a ningún tipo de indemnización.

8.- La Comisión de Coordinación Interdepartamental del Programa Internet Segura, en todo lo que no prevé este Acuerdo, se rige por lo que dispone la normativa vigente en materia de órganos colegiados aplicable a la Generalidad de Cataluña.

9.- Disponer la publicación de este Acuerdo en el Diari Oficial de la Generalitat de Catalunya.

Barcelona, 27 de noviembre de 2018

Víctor Cullell i Comellas, Secretario del Gobierno

22Dic/18

Reglamento de Ejecución (UE) 2018/151 de la Comisión de 30 de Enero de 2018

22 diciembre, 2018Reglamento de Ejecución UEDerecho Informático España, Legislación Informática España, Reglamento de Ejecución (UE) 2018/151 de la Comisión de 30 de Enero de 2018José Cuervo

Reglamento de Ejecución (UE) 2018/151 de la Comisión de 30 de enero de 2018 por el que se establecen normas para la aplicación de la Directiva (UE) 2016/1148 del Parlamento Europeo y del Consejo en lo que respecta a la especificación de los elementos que han de tener en cuenta los proveedores de servicios digitales para gestionar los riesgos existentes para la seguridad de las redes y sistemas de información, así como de los parámetros para determinar si un incidente tiene un impacto significativo. (Diario Oficial de la Unión Europea 31.1.2018).

LA COMISIÓN EUROPEA,

Visto el Tratado de Funcionamiento de la Unión Europea,

Vista la Directiva (UE) 2016/1148 del Parlamento Europeo y del Consejo, de 6 de julio de 2016, relativa a las medidas destinadas a garantizar un elevado nivel común de seguridad de las redes y sistemas de información en la Unión (1), y en particular su artículo 16, apartado 8,

Considerando lo siguiente:

(1) De conformidad con la Directiva (UE) 2016/1148, los proveedores de servicios digitales pueden tomar las medidas técnicas y de organización que consideren adecuadas y proporcionadas para gestionar los riesgos existentes para la seguridad de sus redes y sistemas de información, siempre que dichas medidas garanticen un nivel adecuado de seguridad y tengan en cuenta los elementos previstos en dicha Directiva.

(2) Cuando determinen las medidas técnicas y de organización adecuadas y proporcionadas, los proveedores de servicios digitales deben plantear la seguridad de la información de forma sistemática, utilizando un enfoque basado en los riesgos.

(3) Con el fin de garantizar la seguridad de los sistemas e instalaciones, los proveedores de servicios digitales deben realizar procedimientos de evaluación y análisis. Estas actividades deben atañer a la gestión sistemática de las redes y sistemas de información, la seguridad física y del entorno, la seguridad de abastecimiento y los controles de acceso.

(4) Cuando se realice un análisis de riesgos dentro de la gestión sistemática de las redes y sistemas de información, se debe animar a los proveedores de servicios digitales a que determinen riesgos concretos y cuantifiquen su importancia, por ejemplo identificando amenazas para los activos críticos y la forma en que pueden afectar a las operaciones, y determinando la mejor manera de atenuar dichas amenazas en función de las capacidades disponibles y de las necesidades de recursos.

(5) Las políticas en materia de recursos humanos pueden referirse a la gestión de capacidades e incluir aspectos relativos al desarrollo de capacidades de seguridad y a la sensibilización. Cuando se tomen decisiones sobre un conjunto adecuado de políticas en materia de seguridad de las operaciones, debe animarse a los proveedores de servicios digitales a que tengan en cuenta aspectos de la gestión de cambios, la gestión de la vulnerabilidad, la formalización de prácticas operativas y administrativas y la cartografía del sistema.

(6) Las políticas relativas a la arquitectura de la seguridad pueden incluir, en particular, la segregación de redes y sistemas, así como medidas de seguridad específicas para operaciones críticas como las de administración. La segregación de redes y sistemas puede permitir a un proveedor de servicios digitales hacer distinciones entre elementos como los flujos de datos y los recursos informáticos que pertenecen a un cliente, a un grupo de clientes, al proveedor de servicios digitales o a terceros.

(7) Las medidas adoptadas en relación con la seguridad física y del entorno deben garantizar la seguridad de las redes y sistemas de información de una organización frente a los daños provocados por incidentes como robos, incendios, inundaciones u otros efectos de fenómenos meteorológicos, fallos de telecomunicaciones o de suministro de electricidad.

(8) La seguridad de suministros tales como la energía eléctrica, el combustible o la refrigeración puede englobar la seguridad de la cadena de suministro, que incluye en particular la seguridad de los contratistas y subcontratistas terceros y la gestión de estos. La trazabilidad de los suministros críticos se refiere a la capacidad del proveedor de servicios digitales de determinar y registrar las fuentes de tales suministros.

(9) Los usuarios de servicios digitales deben englobar a las personas físicas y jurídicas que sean clientes o subscriptores de un mercado en línea o un servicio de computación en nube o que sean visitantes del sitio web de un motor de búsqueda en línea con el fin de realizar búsquedas por palabras clave.

(10) A la hora de definir la importancia del impacto de un incidente, los casos que figuran en el presente Reglamento deben considerarse como una lista no exhaustiva de incidentes significativos. De la aplicación del presente Reglamento y del trabajo del Grupo de cooperación deben extraerse conclusiones en lo referente a la recopilación de información de mejores prácticas sobre los riesgos e incidentes y las discusiones sobre las modalidades para informar sobre notificaciones de incidentes a que hace referencia el artículo 11, apartado 3, letras i) y m), de la Directiva (UE) 2016/1148. El resultado podría ser unas orientaciones exhaustivas sobre los umbrales cuantitativos de los parámetros de notificación que pueden dar lugar a la obligación de notificación para los proveedores de servicios digitales en virtud del artículo 16, apartado 3, de la Directiva (UE) 2016/1148. En su caso, la Comisión también podría estudiar la revisión de los umbrales fijados en el presente Reglamento.

(11) Con el fin de que las autoridades competentes estén informadas de nuevos riesgos potenciales, debe animarse a los proveedores de servicios digitales a que notifiquen voluntariamente cualquier incidente cuyas características hubieran sido desconocidas previamente para ellos, como nuevos exploits, vectores de ataque, actores de amenazas, vulnerabilidades y peligros.

(12) El presente Reglamento debe aplicarse a partir del día siguiente a la fecha de expiración del plazo de transposición de la Directiva (UE) 2016/1148.

(13) Las medidas previstas en el presente Reglamento se ajustan al dictamen del Comité de Seguridad de las Redes y Sistemas de Información a que se hace referencia en el artículo 22 de la Directiva (UE) 2016/1148.

HA ADOPTADO EL PRESENTE REGLAMENTO:

Artículo 1.- Objeto

El presente Reglamento precisa los elementos que han de tener en cuenta los proveedores de servicios digitales a la hora de establecer y adoptar medidas para garantizar un nivel de seguridad de las redes y sistemas de información que utilizan en el marco de la oferta de los servicios contemplados en el anexo III de la Directiva (UE) 2016/1148, y detalla los parámetros para determinar si un incidente tiene un impacto significativo en la prestación de dichos servicios.

Artículo 2.- Elementos de seguridad

1.- La seguridad de los sistemas e instalaciones a que hace referencia el artículo 16, apartado 1, letra a), de la Directiva (UE) 2016/1148 se refiere a la seguridad de las redes y sistemas de información y de su entorno físico, e incluirá los siguientes elementos:

a) la gestión sistemática de redes y sistemas de información, es decir, una cartografía de los sistemas de información y la creación de un conjunto de políticas adecuadas en materia de gestión de la seguridad de la información, incluidos el análisis de riesgos, los recursos humanos, la seguridad de las operaciones, la arquitectura de la seguridad, la gestión segura del ciclo de vida de datos y sistemas, y, si procede, el cifrado y su gestión;

b) la seguridad física y del entorno, es decir, la disponibilidad de un conjunto de medidas para proteger la seguridad de las redes y sistemas de información de los proveedores de servicios digitales frente a los daños, utilizando un enfoque basado en los riesgos que abarque todos los peligros y tenga en cuenta, por ejemplo, los fallos del sistema, los errores humanos, las acciones malintencionadas o los fenómenos naturales;

c) la seguridad de abastecimiento, es decir, el establecimiento y mantenimiento de políticas adecuadas con el fin de garantizar la accesibilidad y, en su caso, la trazabilidad de los suministros críticos utilizados en la prestación de los servicios;

d) el control del acceso a las redes y sistemas de información, es decir, la disponibilidad de un conjunto de medidas para garantizar que el acceso físico y lógico a las redes y sistemas de información, incluida la seguridad administrativa de las redes y sistemas de información, se autorice y restrinja sobre la base de requisitos de actividad de negocio y de seguridad.

2.- En relación con la gestión de incidentes a que hace referencia el artículo 16, apartado 1, letra b), de la Directiva (UE) 2016/1148, las medidas adoptadas por los proveedores de servicios digitales incluirán:

a) procesos y procedimientos de detección mantenidos y ensayados para garantizar el conocimiento oportuno y adecuado de sucesos anómalos;

b) procesos y políticas sobre la notificación de incidentes y la detección de deficiencias y vulnerabilidades en sus sistemas de información;

c) una respuesta acorde con procedimientos establecidos y la comunicación de los resultados de la medida adoptada;

d) la evaluación de la gravedad del incidente, documentando las enseñanzas extraídas del análisis del incidente, y la recopilación de información pertinente que pueda servir como prueba y apoyo a un proceso de mejora continua.

3.- La gestión de la continuidad de las actividades a que hace referencia el artículo 16, apartado 1, letra c), de la Directiva (UE) 2016/1148 se refiere a la capacidad de una organización de mantener o, en su caso, restablecer, después de un incidente perturbador, la prestación de los servicios a niveles aceptables preestablecidos, e incluirá:

a) el establecimiento y la utilización de planes de contingencia basados en un análisis de impacto en la actividad para garantizar la continuidad de los servicios prestados por proveedores de servicios digitales, que serán evaluados y ensayados con carácter periódico, por ejemplo mediante ejercicios;

b) capacidades de recuperación en caso de catástrofe, que serán evaluadas y ensayadas con carácter periódico, por ejemplo mediante ejercicios.

4.- La supervisión, auditorías y pruebas a que hace referencia el artículo 16, apartado 1, letra d), de la Directiva (UE) 2016/1148 incluirán el establecimiento y el mantenimiento de políticas sobre:

a) la realización de una secuencia programada de observaciones o mediciones para evaluar si las redes y sistemas de información están funcionando según lo previsto;

b) la inspección y verificación para comprobar si se está siguiendo una norma o una serie de directrices, si los registros son exactos, y si los objetivos de eficiencia y eficacia se están cumpliendo;

c) un proceso destinado a revelar fallos en los mecanismos de seguridad de una red y sistema de información que proteja los datos y mantenga la funcionalidad según lo previsto; dicho proceso incluirá procesos técnicos y personal encargado del flujo de operaciones.

5.- Las normas internacionales a que hace referencia el artículo 16, apartado 1, letra e), de la Directiva (UE) 2016/1148 designan las normas adoptadas por un organismo internacional de normalización contemplado en el artículo 2, apartado 1, letra a), del Reglamento (UE) nº 1025/2012 del Parlamento Europeo y del Consejo (2). De conformidad con el artículo 19 de la Directiva (UE) 2016/1148, también podrán utilizarse normas y especificaciones aceptadas a nivel europeo o internacional que sean pertinentes en materia de seguridad de las redes y sistemas de información, incluidas normas nacionales existentes.

6.- Los proveedores de servicios digitales garantizarán la disponibilidad de documentación adecuada para permitir que la autoridad competente verifique la conformidad con los elementos de seguridad a que se refieren los apartados 1, 2, 3, 4 y 5.

Artículo 3.- Parámetros que han de ser tenidos en cuenta para determinar si el impacto de un incidente es significativo

1.- En relación con el número de usuarios afectados por un incidente, en particular los usuarios que dependen del servicio para la prestación de sus propios servicios, a que hace referencia el artículo 16, apartado 4, letra a), de la Directiva (UE) 2016/1148, el proveedor de servicios digitales deberá estar en condiciones de estimar cualquiera de estos elementos:

a) el número de personas físicas y jurídicas afectadas con las que se haya celebrado un contrato de prestación de servicios, o

b) el número de usuarios afectados que hayan utilizado el servicio basándose en particular en el tráfico de datos previo.

2.- La duración de un incidente a que hace referencia el artículo 16, apartado 4, letra b), de la Directiva (UE) 2016/1148 designa el plazo transcurrido desde la perturbación de la correcta prestación del servicio en cuanto a su disponibilidad, autenticidad, integridad o confidencialidad hasta el momento de su restablecimiento.

3.- En relación con la extensión geográfica con respecto a la zona afectada por el incidente a que hace referencia el artículo 16, apartado 4, letra c), de la Directiva (UE) 2016/1148, el proveedor de servicios digitales deberá estar en condiciones de determinar si el incidente afecta a la prestación de sus servicios en Estados miembros concretos.

4.- El grado de perturbación del funcionamiento del servicio a que hace referencia el artículo 16, apartado 4, letra d), de la Directiva (UE) 2016/1148 se medirá en relación con una o varias de las siguientes características afectadas por un incidente: la disponibilidad, autenticidad, integridad o confidencialidad de los datos o de los servicios correspondientes.

5.- En relación con el alcance del impacto sobre las actividades económicas y sociales a que se hace referencia en el artículo 16, apartado 4, letra e), de la Directiva (UE) 2016/1148, el proveedor de servicios digitales deberá poder concluir, basándose en indicaciones tales como el carácter de sus relaciones contractuales con el cliente o, en su caso, el número de usuarios potencialmente afectados, si el incidente ha causado pérdidas significativas materiales o inmateriales a los usuarios, por ejemplo relativas a la salud, a la seguridad o daños a la propiedad.

6.- A los efectos de los apartados 1, 2, 3, 4 y 5, no se exigirá a los proveedores de servicios digitales que recopilen información adicional a la que no tengan acceso.

Artículo 4.- Impacto significativo de un incidente

1.- Se considerará que un incidente tiene un impacto significativo cuando se haya producido al menos una de las siguientes situaciones:

a) El servicio prestado por el proveedor de servicios digitales ha estado indisponible durante más de 5 000 000 horas de usuario, donde la expresión “horas de usuario” se refiere al número de usuarios afectados en la Unión por una duración de sesenta minutos.

b) El incidente ha dado lugar a una pérdida de autenticidad, integridad o confidencialidad de los datos almacenados, transmitidos o tratados, o de los servicios correspondientes ofrecidos, o accesibles mediante una red y sistema de información del proveedor de servicios digitales, que ha afectado a más de 100 000 usuarios en la Unión.

c) El incidente ha creado un riesgo para la seguridad pública o de pérdida de vidas humanas.

d) El incidente ha causado daños materiales como mínimo a un usuario en la Unión, y el daño causado a dicho usuario es superior a 1 000 000 EUR.

2.- Partiendo de las mejores prácticas recopiladas por el Grupo de cooperación en el ejercicio de sus funciones de conformidad con el artículo 11, apartado 3, de la Directiva (UE) 2016/1148 y de los debates en virtud del artículo 11, apartado 3, letra m), de la misma Directiva, la Comisión podrá revisar los umbrales establecidos en el apartado 1.

Artículo 5.- Entrada en vigor

1.- El presente Reglamento entrará en vigor a los veinte días de su publicación en el Diario Oficial de la Unión Europea.

2.- Será aplicable a partir del 10 de mayo de 2018.

El presente Reglamento será obligatorio en todos sus elementos y directamente aplicable en cada Estado miembro.

Hecho en Bruselas, el 30 de enero de 2018.

Por la Comisión

El Presidente, Jean-Claude JUNCKER

————————————————————————————————————————-

(1) DO L 194 de 19.7.2016, p. 1.

(2) Reglamento (UE) nº 1025/2012 del Parlamento Europeo y del Consejo, de 25 de octubre de 2012, sobre la normalización europea, por el que se modifican las Directivas 89/686/CEE y 93/15/CEE del Consejo y las Directivas 94/9/CE, 94/25/CE, 95/16/CE, 97/23/CE, 98/34/CE, 2004/22/CE, 2007/23/CE, 2009/23/CE y 2009/105/CE del Parlamento Europeo y del Consejo y por el que se deroga la Decisión 87/95/CEE del Consejo y la Decisión nº 1673/2006/CE del Parlamento Europeo y del Consejo (DO L 316 de 14.11.2012, p. 12).

10Dic/18

Ley Orgánica 6/1985, de 1 de julio, del Poder Judicial

10 diciembre, 2018España, Leyde 1 de julio, del Poder Judicial, Derecho Informático de España, Legislación Informática de España, Ley Orgánica 6/1985José Cuervo

Ley Orgánica 6/1985, de 1 de julio, del Poder Judicial (Modificada por Disposición Final Cuarta de la Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales).

JUAN CARLOS I, REY DE ESPAÑA

A todos los que la presente vieren y entendieren,

Sabed: Que las Cortes Generales han aprobado y Yo vengo en sancionar la siguiente Ley Orgánica:

EXPOSICIÓN DE MOTIVOS

El artículo 1.º de la Constitución afirma que España se constituye en un Estado social y democrático de Derecho que propugna como valores superiores de su ordenamiento jurídico la libertad, la justicia, la igualdad y el pluralismo político.

El Estado de Derecho, al implicar, fundamentalmente, separación de los poderes del Estado, imperio de la Ley como expresión de la soberanía popular, sujeción de todos los poderes públicos, a la Constitución y al resto del ordenamiento jurídico y garantía procesal efectiva de los derechos fundamentales y de las libertades públicas, requiere la existencia de unos órganos que, institucionalmente caracterizados por su independencia, tengan un emplazamiento constitucional que les permita ejecutar y aplicar imparcialmente las normas que expresan la voluntad popular, someter a todos los poderes públicos al cumplimiento de la ley, controlar la legalidad de la actuación administrativa y ofrecer a todas las personas tutela efectiva en el ejercicio de sus derechos e intereses legítimos.

El conjunto de órganos que desarrollan esa función constituye el Poder Judicial del que se ocupa el título VI de nuestra Constitución, configurándolo como uno de los tres poderes del Estado y encomendándole, con exclusividad, el ejercicio de la potestad jurisdiccional en todo tipo de procesos, juzgando y haciendo ejecutar lo juzgado, según las normas de competencia y procedimiento que las leyes establezcan.

El artículo 122 de la Constitución española dispone de que la Ley Orgánica del Poder Judicial determinará la constitución, funcionamiento y gobierno de los Juzgados y Tribunales, el estatuto jurídico de los Jueces y Magistrados de carrera, que formarán un cuerpo único, y del personal al servicio de la Administración de Justicia, así como el estatuto y el régimen de incompatibilidades de los miembros del Consejo General del Poder Judicial y sus funciones, en particular en materia de nombramientos, ascensos, inspección y régimen disciplinario.

Las exigencias del desarrollo constitucional demandaron la aprobación de una Ley Orgánica que regulara la elección, composición y funcionamiento del Consejo General del Poder Judicial, aun antes de que se procediese a la organización integral del Poder Judicial. Tal Ley Orgánica tiene, en no pocos aspectos, un carácter provisional que se reconoce explícitamente en sus disposiciones transitorias, las cuales remiten a la futura Ley Orgánica del Poder Judicial.

La presente Ley Orgánica satisface, por tanto, un doble objetivo: pone fin a la situación de provisionalidad hasta ahora existente en la organización y funcionamiento del Poder Judicial y cumple el mandato constitucional.

En la actualidad, el Poder Judicial está regulado por la Ley Provisional sobre organización del Poder Judicial de 18 de septiembre de 1870, por la Ley Adicional a la Orgánica del Poder Judicial de 14 de octubre de 1882, por la Ley de Bases para la reforma de la Justicia Municipal de 19 de Julio de 1944 y por numerosas disposiciones legales y reglamentarias que, con posterioridad, se dictaron de forma dispersa en relación con la misma materia.

Estas normas no se ajustan a las demandas de la sociedad española de hoy. Desde el régimen liberal de separación de poderes, entonces recién conquistado, que promulgó aquellas Leyes, se ha transitado, un siglo después, a un Estado Social y Democrático de Derecho, que es la organización política de una Nación que desea establecer una sociedad democrática avanzada y en la que los poderes públicos están obligados a promover las condiciones para que la libertad y la igualdad del individuo y de los grupos sean reales y efectivas, a remover los obstáculos que impidan o dificulten su plenitud y a facilitar la participación de todos los ciudadanos en la vida política, económica y social. El cumplimiento de estos objetivos constitucionales precisa de un Poder Judicial adaptado a una sociedad predominantemente industrial y urbana y diseñado en atención a los cambios producidos en la distribución territorial de su población, en la división social del trabajo y en las concepciones éticas de los ciudadanos.

A todo ello hay que añadir la notable transformación que se ha producido, por obra de la Constitución, en la distribución territorial del poder. La existencia de Comunidades Autónomas que tienen asignadas por la Constitución y los Estatutos competencias en relación con la Administración de Justicia obliga a modificar la legislación vigente a ese respecto. Tanto la Constitución como los Estatutos de Autonomía prevén la existencia de los Tribunales Superiores de Justicia que, según nuestra Carta Magna, culminarán la organización judicial en el ámbito territorial de la Comunidad Autónoma.

La ineludible e inaplazable necesidad de acomodar la organización del Poder Judicial a estas previsiones constitucionales y estatutarias es, pues, un imperativo más que justifica la aprobación de la presente Ley Orgánica.

Por último, hay que señalar que ésta es solamente una de las normas que, en unión de otras muchas, tiene que actualizar el cuerpo legislativo –tanto sustantivo como procesal– español y adecuarlo a la realidad jurídica, económica y social. Será preciso para ello una ardua labor de reforma de la legislación española, parte de la cual ha sido ya acometida, al objeto de lograr un todo armónico caracterizado por su uniformidad.

III

Las grandes líneas de la Ley están expresadas en su título preliminar. Se recogen en él los principios que se consagran en la Constitución. El primero de ellos es la independencia, que constituye la característica esencial del Poder Judicial en cuanto tal. Sus exigencias se desenvuelven a través de mandatos concretos que delimitan con el rigor preciso su exacto contenido. Así, se precisa que la independencia en el ejercicio de la función jurisdiccional se extiende frente a todos, incluso frente a los propios órganos jurisdiccionales, lo que implica la imposibilidad de que ni los propios Jueces o Tribunales corrijan, a no ser con ocasión del recurso que legalmente proceda, la actuación de sus inferiores, quedando igualmente excluida la posibilidad de circulares o instrucciones con carácter general y relativas a la aplicación o interpretación de la ley.

De la forma en que la Ley Orgánica regula la independencia del Poder Judicial se puede afirmar que posee una característica: su plenitud. Plenitud que se deriva de la obligación que se impone a los poderes públicos y a los particulares de respetar la independencia del Poder Judicial y de la absoluta sustracción del estatuto jurídico de Jueces y Magistrados a toda posible interferencia que parta de los otros poderes del Estado, de tal suerte que a la clásica garantía –constitucionalmente reconocida– de inamovilidad se añade una regulación, en virtud de la cual se excluye toda competencia del poder ejecutivo sobre la aplicación del estatuto orgánico de aquéllos. En lo sucesivo, pues, la carrera profesional de Jueces y Magistrados estará plena y regladamente gobernada por la norma o dependerá, con exclusividad absoluta, de las decisiones que en el ámbito discrecional estatutariamente delimitado adopte el Consejo General del Poder Judicial.

La importancia que la plenitud de la independencia judicial tendrá en nuestro ordenamiento debe ser valorada completándola con el carácter de totalidad con que la Ley dota a la potestad jurisdiccional. Los Tribunales, en efecto, controlan sin excepciones la potestad reglamentaria y la actividad administrativa, con lo que ninguna actuación del poder ejecutivo quedará sustraída a la fiscalización de un poder independiente y sometido exclusivamente al imperio de la Ley. Habrá que convenir que el Estado de Derecho proclamado en la Constitución alcanza, como organización regida por la ley que expresa la voluntad popular y como sistema en el que el Gobierno de los hombres es sustituido por el imperio de la ley, la máxima potencialidad posible.

Corolarios de la independencia judicial son otros preceptos del título preliminar que concretan sus distintas perspectivas. Así, la unidad de la jurisdicción, que, en consecuencia con el mandato constitucional, es absoluta, con la única salvedad de la competencia de la jurisdicción militar, que queda limitada al ámbito estrictamente castrense regulado por la ley y a los supuestos de estado de sitio; la facultad que se reconoce a los Jueces y Tribunales de requerir la colaboración de particulares y poderes públicos; y, en fin, la regulación del procedimiento y de las garantías en él previstas, para los supuestos de expropiación de los derechos reconocidos frente a la Administración Pública en una sentencia firme.

Una de las características de la Constitución española es la superación del carácter meramente programático que antaño se asignó a las normas constitucionales, la asunción de una eficacia jurídica directa e inmediata y, como resumen, la posición de indiscutible supremacía de que goza en el ordenamiento jurídico. Todo ello hace de nuestra Constitución una norma directamente aplicable, con preferencia a cualquier otra.

Todos estos caracteres derivan del propio tenor del texto constitucional. En primer lugar, del artículo 9.1 que prescribe que «los ciudadanos y los poderes públicos están sujetos a la Constitución y al resto del ordenamiento». Otras disposiciones constitucionales, como la que deroga cuantas normas se opongan al texto constitucional o la que regula los procedimientos de declaración de inconstitucionalidad, completan el efecto del citado párrafo 1 del Artículo 9.º y cierran el sistema que hace de la Carta Magna la norma suprema de nuestro ordenamiento con todos los efectos jurídicos a ello inherentes.

El Título preliminar de la presente Ley Orgánica singulariza en el Poder Judicial la vinculación genérica del Artículo 9.1 de la Constitución, disponiendo que las Leyes y Reglamentos habrán de aplicarse según los preceptos y principios constitucionales y conforme a la interpretación de los mismos que realice el Tribunal Constitucional. Se ratifica así la importancia de los valores propugnados por la Constitución como superiores, y de todos los demás principios generales del Derecho que de ellos derivan, como fuente del Derecho, lo que dota plenamente al ordenamiento de las características de plenitud y coherencia que le son exigibles y garantiza la eficacia de los preceptos constitucionales y la uniformidad en la interpretación de los mismos.

Además, se dispone que sólo procederá el planteamiento de la cuestión de inconstitucionalidad cuando no sea posible acomodar, por la vía interpretativa, la norma controvertida al mandato constitucional. Se refuerza, con ello, la vinculación del juzgador para con la norma fundamental, y se introduce en esa sujeción un elemento dinámico de protección activa, que trasciende del mero respeto pasivo por la Ley suprema.

El valor de la Constitución como norma suprema del ordenamiento se manifiesta, también, en otros preceptos complementarios. Así, se configura la infracción de precepto constitucional como motivo suficiente del recurso de casación y se menciona expresamente la directa aplicabilidad de los derechos fundamentales, haciéndose explícita protección del contenido esencial que salvaguarda la Constitución.

El Estado se organiza territorialmente, a efectos judiciales, en municipios, partidos, provincias y Comunidades Autónomas, sobre los que ejercen potestad jurisdiccional Juzgados de Paz, Juzgados de Primera Instancia e Instrucción, de lo Contencioso-Administrativo, de lo Social, de Vigilancia Penitenciaria y de Menores, Audiencias Provinciales y Tribunales Superiores de Justicia. Sobre todo el territorio nacional ejercen potestad jurisdiccional la Audiencia Nacional y el Tribunal Supremo.

La Ley contiene en este punto innovaciones importantes. Así, se democratiza el procedimiento de designación de los Jueces de Paz; se suprimen los Juzgados de Distrito, que se transforman en Juzgados de Primera Instancia o de Instrucción; se crean Juzgados unipersonales de lo Contencioso-Administrativo, así como de lo Social, sustitutivos estos últimos de las Magistraturas de Trabajo; se atribuyen competencias en materia civil a las Audiencias Provinciales y, en fin, se modifica la esfera de la Audiencia Nacional, creando en la misma una Sala de lo Social, y manteniendo las Salas de lo Penal y de lo Contencioso-Administrativo.

Sin embargo, las modificaciones más relevantes son las derivadas de la configuración territorial del Estado en Comunidades Autónomas que realiza la Constitución y que, lógicamente, se proyecta sobre la organización territorial del Poder Judicial.

La Ley Orgánica cumple en este punto las exigencias constitucionales y estatutarias. Por ello, y como decisiones más relevantes, se crean los Tribunales Superiores de Justicia, que culminarán la organización judicial en la Comunidad Autónoma, lo que implica la desaparición de las Audiencias Territoriales hasta ahora existentes como órganos jurisdiccionales supraprovinciales de ámbito no nacional.

A ello hay que añadir la regulación de la participación reconocida a las Comunidades Autónomas en la delimitación de las demarcaciones territoriales, así como las competencias que se les asignan en referencia a la gestión de los medios materiales.

Con esta nueva organización judicial, necesitada del desarrollo que llevará a cabo la futura Ley de planta y demarcación judicial –que el Gobierno se compromete a remitir a las Cortes Generales en el plazo de un año–, se pretende poner a disposición del pueblo español una red de órganos judiciales que, junto a la mayor inmediación posible, garantice sobre todo la realización efectiva de los derechos fundamentales reconocidos en el artículo 24 de la Constitución Española, entre ellos, destacadamente, el derecho a un juicio público sin dilaciones indebidas y con todas las garantías.

Para garantizar la independencia del Poder Judicial, la Constitución crea el Consejo General del Poder Judicial, al que encomienda el gobierno del mismo, y remite a la Ley Orgánica el desarrollo de las normas contenidas en su artículo 122.2 y 3.

En cumplimiento de tales mandatos, la presente Ley Orgánica reconoce al Consejo General todas las atribuciones necesarias para la aplicación del estatuto orgánico de los Jueces y Magistrados, en particular en materia de nombramientos, ascensos, inspección y régimen disciplinario. La Ley concibe las facultades de inspección de Juzgados y Tribunales, no como una mera actividad represiva, sino, más bien, como una potestad que incorpora elementos de perfeccionamiento de la organización que se inspecciona.

Para la elección de los doce miembros del Consejo General del Poder Judicial que, de acuerdo con el artículo 122.2 de la Constitución Española, deben ser elegidos «entre Jueces y Magistrados de todas las categorías judiciales», la Ley, informada por un principio democrático, partiendo de la base de que se trata del órgano de gobierno de un Poder del Estado, recordando que los poderes del Estado emanan del pueblo y en atención al carácter de representantes del pueblo soberano que ostentan las Cortes Generales, atribuye a éstas la selección de dichos miembros de procedencia judicial del Consejo General. La exigencia de una muy cualificada mayoría de tres quintos –a la que la Constitución requiere para la elección de los otros miembros– garantiza, a la par que la absoluta coherencia con el carácter general del sistema democrático, la convergencia de fuerzas diversas y evita la conformación de un Consejo General que responda a una mayoría parlamentaria concreta y coyuntural. La Ley regula también el estatuto de los miembros del Consejo y la composición y atribuciones de los órganos en que se articula. Igualmente, se refuerza la mayoría necesaria para la propuesta de nombramiento del Presidente del Tribunal Supremo y del Consejo General del Poder Judicial y otros cargos institucionales. Por último, se atribuye a la Sala de lo Contencioso-Administrativo del Tribunal Supremo la competencia para conocer de los recursos que se interpongan contra los actos y disposiciones emanados del pleno o de la comisión disciplinaria del Consejo General del Poder Judicial no susceptibles de alzada.

Resta añadir que la entrada en vigor de esta Ley Orgánica significará la derogación de la Ley del mismo carácter 1/1980, de 10 de enero, cuya provisionalidad ya ha sido puesta de manifiesto.

La Ley Orgánica modifica el sistema de designación de las Salas de Gobierno, introduciendo parcialmente los métodos electivos. Ello está aconsejado por las funciones gubernativas y no jurisdiccionales que vienen llamadas a cumplir, así como por las nuevas competencias que esta misma Ley Orgánica les atribuye. En estas condiciones, habida cuenta de que la actividad de las Salas de Gobierno afecta fundamentalmente a Jueces y Magistrados y no incide directamente sobre los particulares, se adopta un sistema parcial de elección abierto y mayoritario, en el que desempeña un papel notable el conocimiento personal de electores y elegidos.

La materialización de los principios de pluralismo y participación de que se quiere impregnar el gobierno del Poder Judicial impone una profunda modificación de la actual regulación del derecho de asociación profesional que el artículo 127.1 de la Constitución reconoce a Jueces, Magistrados y Fiscales. El régimen transitorio de libertad asociativa hasta ahora existente contiene restricciones injustificadas a las que se pone fin. De ahí que esta Ley Orgánica reconozca el derecho de libre asociación profesional con la única limitación de no poder llevar a cabo actuaciones políticas ni tener vinculaciones con partidos políticos o sindicatos. Las asociaciones profesionales quedarán válidamente constituidas desde que se inscriban en el registro que será llevado al efecto por el Consejo General del Poder Judicial.

VII

La realización práctica del derecho, constitucionalmente reconocido, a la tutela judicial efectiva, requiere como presupuesto indispensable que todos los órganos jurisdiccionales estén provistos de sus correspondientes titulares, Jueces o Magistrados. Muy graves perjuicios se producen en la seguridad jurídica, en el derecho a un juicio sin dilaciones, cuando los Juzgados y Tribunales se encuentran vacantes durante prolongados lapsos de tiempo, con la correspondiente acumulación de asuntos pendientes y retraso en la Administración de Justicia. Ello ha obligado a recurrir a fórmulas de sustituciones o prórrogas de jurisdicción especialmente inconvenientes en aquellos territorios en los que tiene lugar un progresivo y creciente incremento del trabajo. Resulta por todo ello indemorable afrontar y resolver tal problema.

Los hechos demuestran que los clásicos mecanismos de selección de personal judicial no permiten que la sociedad española se dote de Jueces y Magistrados en número suficiente. Es obligado, pues, recurrir a mecanismos complementarios. A tal fin, la Ley Orgánica prevé un sistema de acceso a la carrera judicial de juristas de reconocido prestigio. Ello permitirá, en primer lugar, hacer frente a las necesidades y cubrir las vacantes que de otra forma no podrían serlo; en segundo término, incorporar a función tan relevante como la judicial a quienes, en otros campos jurídicos, han demostrado estar en condiciones de ofrecer capacidad y competencia acreditadas; por último, lograr entre la carrera judicial y el resto del universo jurídico la ósmosis que, a buen seguro, se dará cuando se integren en la judicatura quienes, por haber ejercido el Derecho en otros sectores, aportarán perspectivas diferentes e incorporarán distintas sensibilidades a un ejercicio que se caracteriza por la riqueza conceptual y la diversidad de enfoques. Los requisitos exigidos, y el hecho de que operarán aquí las mismas garantías de selección objetiva y rigurosa que rigen el clásico camino de la oposición libre, aseguran simultáneamente la imparcialidad del elector y la capacidad del elegido. No se hace con ello, en definitiva, otra cosa que incorporar a nuestro sistema de selección mecanismos experimentados con éxito de antiguo no solo en varios países, sino, incluso, entre nosotros mismos, y precisamente en el Tribunal Supremo.

Sin embargo, el sistema básico de ingreso en la carrera judicial sigue siendo el de oposición libre entre licenciados en Derecho, completada por la aprobación de un curso en el centro de estudios judiciales y con las prácticas en un órgano jurisdiccional.

El acceso a la categoría de Magistrado se verifica en las proporciones siguientes: de cada cuatro vacantes, dos se proveerán con los Jueces que ocupen el primer lugar en el escalafón dentro de la categoría; la tercera, por medio de pruebas selectivas y de especialización en los órdenes contencioso-administrativo y social entre los Jueces, y la cuarta, por concurso entre juristas de reconocida competencia y con más de diez años de ejercicio.

Por lo que se refiere al régimen de provisión de destinos, se sigue manteniendo como criterio básico, en lo que respecta a Juzgados, Audiencias y Tribunales Superiores de Justicia, el de la antigüedad. Ello no obsta, sin embargo, para que se introduzca también, como sistema de promoción en la carrera judicial, la especialización que es, por un lado, necesaria a la vista de la magnitud y complejidad de la legislación de nuestros días y, por otra parte, conveniente en cuanto introduce elementos de estímulo en orden a la permanente formación de Jueces y Magistrados.

Por lo demás, la regulación de la carrera judicial se realiza bajo el criterio básico de su homologación con las normas comunes que rigen el resto de los funcionarios públicos, manteniendo tan solo aquellas peculiaridades que se derivan de su específica función.

VIII

Los cuatro primeros Libros de la Ley regulan cuanto se refiere a la organización, gobierno y régimen de los órganos que integran el Poder Judicial y de su órgano de gobierno. Los Libros V y VI establecen el marco básico regulador de aquellos otros órganos, cuerpos de funcionarios y profesionales que, sin integrar el Poder Judicial, colaboran de diversas formas con él, haciendo posible la efectividad de su tutela en los términos establecidos por la Constitución.

La Ley se refiere así, en primer lugar, al Ministerio Fiscal, que tiene por misión promover la acción de la justicia en defensa de la legalidad, de los derechos de los ciudadanos y el interés público, y la de velar por la independencia de los Tribunales y la satisfacción del interés social conforme a lo previsto por el artículo 124 de la Constitución.

Consagra también la Ley de la función de los Abogados y Procuradores, a los que se reserva la dirección y defensa de la representación de las partes, pues a ellos corresponde garantizar la asistencia jurídica al ciudadano en el proceso, de forma obligatoria cuando así lo exija y, en todo caso, como derecho a la defensa y asistencia letrada expresamente reconocido por la Constitución.

La Policía Judicial, como institución que coopera y auxilia a la Administración de Justicia, se ve potenciada por el establecimiento de unidades funcionalmente dependientes de las autoridades judiciales y del Ministerio Fiscal.

Regula también la Ley el personal que sirve a la Administración de Justicia, comprendiendo en él a los Secretarios, así como a los Médicos Forenses, Oficiales, Auxiliares y Agentes, cuerpos todos ellos de funcionarios que en sus respectivas competencias auxilian y colaboran con los Jueces y Tribunales.

Las funciones de los Secretarios merecen especial regulación en el Título IV del Libro III, pues a ellos corresponde la fe pública judicial al mismo tiempo que la ordenación e impulso del procedimiento, viéndose reforzadas sus funciones de dirección procesal.

Junto a las previsiones básicas sobre la estructura y funciones de los cuerpos de Oficiales, Auxiliares y Agentes, así como de los Médicos Forenses, la Ley establece la previsión de que otros técnicos puedan servir a la Administración de Justicia, constituyendo al efecto cuerpos y escalas, o bajo contrato laboral. Con ello se trata de garantizar y potenciar la estructura del personal al servicio de los órganos judiciales y su cada vez más necesaria especialización.

El ciudadano es el destinatario de la Administración de Justicia. La Constitución exige y esta Ley Orgánica consagra los principios de oralidad y publicidad, para lo que se acentúa la necesaria inmediación que ha de desarrollarse en las leyes procesales y, junto a ello, se regula por primera vez la responsabilidad patrimonial del Estado que pueda derivarse del error judicial o del funcionamiento anormal de la Administración de Justicia, sin perjuicio de la responsabilidad individual de Jueces y Magistrados de carácter civil, penal y disciplinaria, complementándose de esta forma un Poder Judicial plenamente responsable.

Las disposiciones adicionales, transitorias y final de la Ley regulan los problemas de su aplicación sincrónica, haciendo posible la adecuación de la organización judicial vigente a la que esta Ley establece y previendo expresamente las leyes de desarrollo que han de implantar en su totalidad la nueva organización del Poder Judicial.

LIBRO I.- DE LA EXTENSIÓN Y LÍMITES DE LA JURISDICCIÓN Y DE LA PLANTA Y ORGANIZACIÓN DE LOS JUZGADOS Y TRIBUNALES

TÍTULO I.- De la extensión y límites de la jurisdicción

TÍTULO II.- De la planta y organización territorial

TÍTULO III.- De los conflictos de jurisdicción y de los conflictos y cuestiones de competencia

TÍTULO IV.- De la composición y atribuciones de los órganos jurisdiccionales

CAPÍTULO I.- Del Tribunal Supremo

Artículo 58.

La Sala de lo Contencioso-administrativo del Tribunal Supremo conocerá:

Primero. En única instancia, de los recursos contencioso-administrativos contra actos y disposiciones del Consejo de Ministros, de las Comisiones Delegadas del Gobierno y del Consejo General del Poder Judicial y contra los actos y disposiciones de los órganos competentes del Congreso de los Diputados y del Senado, del Tribunal Constitucional, del Tribunal de Cuentas y del Defensor del Pueblo en los términos y materias que la Ley establezca y de aquellos otros recursos que excepcionalmente le atribuya la Ley.

Segundo. De los recursos de casación y revisión en los términos que establezca la Ley.

Tercero. De la solicitud de autorización para la declaración prevista en la disposición adicional quinta de la Ley Orgánica de Protección de Datos Personales y Garantía de los Derechos Digitales, cuando tal solicitud sea formulada por el Consejo General del Poder Judicial. (Se añade este apartado en virtud de Disposición final cuarta de la Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales)

CAPÍTULO II.- De la Audiencia Nacional

Artículo 66.

La Sala de lo Contencioso-Administrativo de la Audiencia Nacional conocerá:

a) En única instancia, de los recursos contencioso-administrativos contra disposiciones y actos de los Ministros y Secretarios de Estado que la ley no atribuya a los Juzgados Centrales de lo Contencioso-Administrativo.

b) En única instancia, de los recursos contencioso-administrativos contra los actos dictados por la Comisión de Vigilancia de Actividades de Financiación del Terrorismo. Conocerá, asimismo, de la posible prórroga de los plazos que le plantee dicha Comisión de Vigilancia respecto de las medidas previstas en los artículos 1 y 2 de la Ley 12/2003, de prevención y bloqueo de la financiación del terrorismo.

c) De los recursos devolutivos que la ley establezca contra las resoluciones de los Juzgados Centrales de lo Contencioso-Administrativo.

d) De los recursos no atribuidos a los Tribunales Superiores de Justicia en relación a los convenios entre las Administraciones públicas y a las resoluciones del Tribunal Económico-Administrativo Central.

e) De las cuestiones de competencia que se puedan plantear entre los Juzgados Centrales de lo Contencioso-Administrativo y de aquellos otros recursos que excepcionalmente le atribuya la ley.

f) De la solicitud de autorización para la declaración prevista en la disposición adicional quinta de la Ley Orgánica de Protección de Datos Personales y Garantía de los Derechos Digitales, cuando tal solicitud sea formulada por la Agencia Española de Protección de Datos. (Se añade este apartado en virtud de Disposición final cuarta de la Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales)

Artículo 66.

La Sala de lo Contencioso-Administrativo de la Audiencia Nacional conocerá:

c) De los recursos devolutivos que la ley establezca contra las resoluciones de los Juzgados Centrales de lo Contencioso-Administrativo.

e) De las cuestiones de competencia que se puedan plantear entre los Juzgados Centrales de lo Contencioso-Administrativo y de aquellos otros recursos que excepcionalmente le atribuya la ley.

CAPÍTULO III.- De los Tribunales Superiores de Justicia

Artículo 74.

1. Las Salas de lo Contencioso-administrativo de los Tribunales Superiores de Justicia conocerán, en única instancia, de los recursos que se deduzcan en relación con:

a) Los actos de las Entidades locales y de las Administraciones de las Comunidades Autónomas, cuyo conocimiento no esté atribuido a los Juzgados de lo Contencioso-administrativo.

b) Las disposiciones generales emanadas de las Comunidades Autónomas y de las Entidades locales.

c) Los actos y disposiciones de los órganos de gobierno de las Asambleas legislativas de las Comunidades Autónomas y de las instituciones autonómicas análogas al Tribunal de Cuentas y al Defensor del Pueblo, en materia de personal, administración y gestión patrimonial.

d) Los actos y resoluciones dictados por los Tribunales Económico-Administrativos Regionales y Locales que pongan fin a la vía económico administrativa.

e) Las resoluciones dictadas en alzada por el Tribunal Económico-Administrativo Central en materia de tributos cedidos.

f) Los actos y disposiciones de las Juntas Electorales Provinciales y de Comunidades Autónomas, así como los recursos contencioso-electorales contra acuerdos de las Juntas Electorales sobre proclamación de electos y elección y proclamación de Presidentes de Corporaciones locales en los términos de la legislación electoral.

g) Los convenios entre Administraciones públicas cuyas competencias se ejerzan en el ámbito territorial de la correspondiente Comunidad Autónoma.

h) La prohibición o la propuesta de modificación de reuniones previstas en la Ley Orgánica reguladora del Derecho de Reunión.

i) Los actos y resoluciones dictados por órganos de la Administración General del Estado cuya competencia se extienda a todo el territorio nacional y cuyo nivel orgánico sea inferior a Ministro o Secretario de Estado, en materias de personal, propiedades especiales y expropiación forzosa.

j) Cualesquiera otras actuaciones administrativas no atribuidas expresamente a la competencia de otros órganos de este orden jurisdiccional.

k) De la solicitud de autorización para la declaración prevista en la disposición adicional quinta de la Ley Orgánica de Protección de Datos Personales y Garantía de los Derechos Digitales, cuando tal solicitud sea formulada por la autoridad de protección de datos de la Comunidad Autónoma respectiva. (Se añade una letra k) al apartado 1, en virtud de Disposición final cuarta de la Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales)

2. Conocerán, en segunda instancia, de las apelaciones promovidas contra sentencias y autos dictados por los Juzgados de lo Contencioso-administrativo y de los correspondientes recursos de queja.

3. También les corresponde, con arreglo a lo establecido en esta Ley, el conocimiento de los recursos de revisión contra las sentencias firmes de los Juzgados de lo Contencioso-administrativo.

4. Conocerán de las cuestiones de competencia entre los Juzgados de lo Contencioso-administrativo con sede en la Comunidad Autónoma.

5. Conocerán del recurso de casación para la unificación de doctrina en los casos previstos en la Ley reguladora de la Jurisdicción Contencioso-administrativa.

6. Conocerán del recurso de casación en interés de la Ley en los casos previstos en la Ley reguladora de la Jurisdicción Contencioso-administrativa.

7. Corresponde a las Salas de lo Contencioso-administrativo de los Tribunales Superiores de Justicia autorizar, mediante auto, el requerimiento de información por parte de autoridades autonómicas de protección de datos a los operadores que presten servicios de comunicaciones electrónicas disponibles al público y de los prestadores de servicios de la sociedad de la información, cuando ello sea necesario de acuerdo con la legislación específica. (Se añade un nuevo apartado 7 en virtud de Disposición final cuarta de la Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales)

LIBRO III. DEL RÉGIMEN DE LOS JUZGADOS Y TRIBUNALES

TÍTULO III.- DE LAS ACTUACIONES JUDICIALES

CAPÍTULO PRIMERO.- DE LA ORALIDAD, PUBLICIDAD Y LENGUA OFICIAL

Artículo 230

1. Los Juzgados y Tribunales y las Fiscalías están obligados a utilizar cualesquiera medios técnicos, electrónicos, informáticos y telemáticos, puestos a su disposición para el desarrollo de su actividad y ejercicio de sus funciones, con las limitaciones que a la utilización de tales medios establecen el Capítulo I bis de este Título, la Ley Orgánica 15/1999, de 13 de diciembre, de Protección de Datos de Carácter Personal y las demás leyes que resulten de aplicación.

Las instrucciones generales o singulares de uso de las nuevas tecnologías que el Consejo General del Poder Judicial o la Fiscalía General del Estado dirijan a los Jueces y Magistrados o a los Fiscales, respectivamente, determinando su utilización, serán de obligado cumplimiento.

2. Los documentos emitidos por los medios anteriores, cualquiera que sea su soporte, gozarán de la validez y eficacia de un documento original siempre que quede garantizada su autenticidad, integridad y el cumplimiento de los requisitos exigidos por las leyes procesales.

3. Las actuaciones orales y vistas grabadas y documentadas en soporte digital no podrán transcribirse.

4. Los procesos que se tramiten con soporte informático garantizarán la identificación y el ejercicio de la función jurisdiccional por el órgano que la ejerce, así como la confidencialidad, privacidad y seguridad de los datos de carácter personal que contengan en los términos que establezca la ley.

5. Las personas que demanden la tutela judicial de sus derechos e intereses podrán relacionarse con la Administración de Justicia a través de los medios técnicos a que se refiere el apartado 1 cuando sean compatibles con los que dispongan los Juzgados y Tribunales y se respeten las garantías y requisitos previstos en el procedimiento que se trate.

6. Los programas y aplicaciones informáticos que se utilicen en la Administración de Justicia deberán ser previamente informados por el Consejo General del Poder Judicial.

Los sistemas informáticos que se utilicen en la Administración de Justicia deberán ser compatibles entre sí para facilitar su comunicación e integración, en los términos que determine el Comité Técnico Estatal de la Administración de Justicia Electrónica.

09Dic/18

Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales

9 diciembre, 2018España, Leyde 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales, Derecho Informático Español, Ley Orgánica 3/2018José Cuervo

FELIPE VI, REY DE ESPAÑA

A todos los que la presente vieren y entendieren.

Sabed: Que las Cortes Generales han aprobado y Yo vengo en sancionar la siguiente ley orgánica.

PREÁMBULO

La protección de las personas físicas en relación con el tratamiento de datos personales es un derecho fundamental protegido por el artículo 18.4 de la Constitución española. De esta manera, nuestra Constitución fue pionera en el reconocimiento del derecho fundamental a la protección de datos personales cuando dispuso que «la ley limitará el uso de la informática para garantizar el honor y la intimidad personal y familiar de los ciudadanos y el pleno ejercicio de sus derechos». Se hacía así eco de los trabajos desarrollados desde finales de la década de 1960 en el Consejo de Europa y de las pocas disposiciones legales adoptadas en países de nuestro entorno.

El Tribunal Constitucional señaló en su Sentencia 94/1998, de 4 de mayo, que nos encontramos ante un derecho fundamental a la protección de datos por el que se garantiza a la persona el control sobre sus datos, cualesquiera datos personales, y sobre su uso y destino, para evitar el tráfico ilícito de los mismos o lesivo para la dignidad y los derechos de los afectados; de esta forma, el derecho a la protección de datos se configura como una facultad del ciudadano para oponerse a que determinados datos personales sean usados para fines distintos a aquel que justificó su obtención. Por su parte, en la Sentencia 292/2000, de 30 de noviembre, lo considera como un derecho autónomo e independiente que consiste en un poder de disposición y de control sobre los datos personales que faculta a la persona para decidir cuáles de esos datos proporcionar a un tercero, sea el Estado o un particular, o cuáles puede este tercero recabar, y que también permite al individuo saber quién posee esos datos personales y para qué, pudiendo oponerse a esa posesión o uso.

A nivel legislativo, la concreción y desarrollo del derecho fundamental de protección de las personas físicas en relación con el tratamiento de datos personales tuvo lugar en sus orígenes mediante la aprobación de la Ley Orgánica 5/1992, de 29 de octubre, reguladora del tratamiento automatizado de datos personales, conocida como LORTAD. La Ley Orgánica 5/1992 fue reemplazada por la Ley Orgánica 15/1999, de 5 de diciembre, de protección de datos personales, a fin de trasponer a nuestro derecho a la Directiva 95/46/CE del Parlamento Europeo y del Consejo, de 24 de octubre de 1995, relativa a la protección de las personas físicas en lo que respecta al tratamiento de datos personales y a la libre circulación de estos datos. Esta ley orgánica supuso un segundo hito en la evolución de la regulación del derecho fundamental a la protección de datos en España y se complementó con una cada vez más abundante jurisprudencia procedente de los órganos de la jurisdicción contencioso-administrativa.

Por otra parte, también se recoge en el artículo 8 de la Carta de los Derechos Fundamentales de la Unión Europea y en el artículo 16.1 del Tratado de Funcionamiento de la Unión Europea. Anteriormente, a nivel europeo, se había adoptado la Directiva 95/46/CE citada, cuyo objeto era procurar que la garantía del derecho a la protección de datos personales no supusiese un obstáculo a la libre circulación de los datos en el seno de la Unión, estableciendo así un espacio común de garantía del derecho que, al propio tiempo, asegurase que en caso de transferencia internacional de los datos, su tratamiento en el país de destino estuviese protegido por salvaguardas adecuadas a las previstas en la propia directiva.

En los últimos años de la pasada década se intensificaron los impulsos tendentes a lograr una regulación más uniforme del derecho fundamental a la protección de datos en el marco de una sociedad cada vez más globalizada. Así, se fueron adoptando en distintas instancias internacionales propuestas para la reforma del marco vigente. Y en este marco la Comisión lanzó el 4 de noviembre de 2010 su Comunicación titulada «Un enfoque global de la protección de los datos personales en la Unión Europea», que constituye el germen de la posterior reforma del marco de la Unión Europea. Al propio tiempo, el Tribunal de Justicia de la Unión ha venido adoptando a lo largo de los últimos años una jurisprudencia que resulta fundamental en su interpretación.

El último hito en esta evolución tuvo lugar con la adopción del Reglamento (UE) 2016/679 del Parlamento Europeo y del Consejo, de 27 de abril de 2016, relativo a la protección de las personas físicas en lo que respecta al tratamiento de sus datos personales y a la libre circulación de estos datos y por el que se deroga la Directiva 95/46/CE (Reglamento general de protección de datos), así como de la Directiva (UE) 2016/680 del Parlamento Europeo y del Consejo, de 27 de abril de 2016, relativa a la protección de las personas físicas en lo que respecta al tratamiento de datos personales por parte de las autoridades competentes para fines de prevención, investigación, detección o enjuiciamiento de infracciones penales o de ejecución de sanciones penales, y a la libre circulación de dichos datos y por la que se deroga la Decisión Marco 2008/977/JAI del Consejo.

III

El Reglamento general de protección de datos pretende con su eficacia directa superar los obstáculos que impidieron la finalidad armonizadora de la Directiva 95/46/CE del Parlamento Europeo y del Consejo, de 24 de octubre de 1995, relativa a la protección de las personas físicas en lo que respecta al tratamiento de datos personales y a la libre circulación de esos datos. La transposición de la directiva por los Estados miembros se ha plasmado en un mosaico normativo con perfiles irregulares en el conjunto de la Unión Europea lo que, en último extremo, ha conducido a que existan diferencias apreciables en la protección de los derechos de los ciudadanos.

Asimismo, se atiende a nuevas circunstancias, principalmente el aumento de los flujos transfronterizos de datos personales como consecuencia del funcionamiento del mercado interior, los retos planteados por la rápida evolución tecnológica y la globalización, que ha hecho que los datos personales sean el recurso fundamental de la sociedad de la información. El carácter central de la información personal tiene aspectos positivos, porque permite nuevos y mejores servicios, productos o hallazgos científicos. Pero tiene también riesgos, pues las informaciones sobre los individuos se multiplican exponencialmente, son más accesibles, por más actores, y cada vez son más fáciles de procesar mientras que es más difícil el control de su destino y uso.

El Reglamento general de protección de datos supone la revisión de las bases legales del modelo europeo de protección de datos más allá de una mera actualización de la vigente normativa. Procede a reforzar la seguridad jurídica y transparencia a la vez que permite que sus normas sean especificadas o restringidas por el Derecho de los Estados miembros en la medida en que sea necesario por razones de coherencia y para que las disposiciones nacionales sean comprensibles para sus destinatarios. Así, el Reglamento general de protección de datos contiene un buen número de habilitaciones, cuando no imposiciones, a los Estados miembros, a fin de regular determinadas materias, permitiendo incluso en su considerando 8, y a diferencia de lo que constituye principio general del Derecho de la Unión Europea que, cuando sus normas deban ser especificadas, interpretadas o, excepcionalmente, restringidas por el Derecho de los Estados miembros, estos tengan la posibilidad de incorporar al derecho nacional previsiones contenidas específicamente en el reglamento, en la medida en que sea necesario por razones de coherencia y comprensión.

En este punto hay que subrayar que no se excluye toda intervención del Derecho interno en los ámbitos concernidos por los reglamentos europeos. Al contrario, tal intervención puede ser procedente, incluso necesaria, tanto para la depuración del ordenamiento nacional como para el desarrollo o complemento del reglamento de que se trate. Así, el principio de seguridad jurídica, en su vertiente positiva, obliga a los Estados miembros a integrar el ordenamiento europeo en el interno de una manera lo suficientemente clara y pública como para permitir su pleno conocimiento tanto por los operadores jurídicos como por los propios ciudadanos, en tanto que, en su vertiente negativa, implica la obligación para tales Estados de eliminar situaciones de incertidumbre derivadas de la existencia de normas en el Derecho nacional incompatibles con el europeo. De esta segunda vertiente se colige la consiguiente obligación de depurar el ordenamiento jurídico. En definitiva, el principio de seguridad jurídica obliga a que la normativa interna que resulte incompatible con el Derecho de la Unión Europea quede definitivamente eliminada «mediante disposiciones internas de carácter obligatorio que tengan el mismo valor jurídico que las disposiciones internas que deban modificarse» (Sentencias del Tribunal de Justicia de 23 de febrero de 2006, asunto Comisión vs. España; de 13 de julio de 2000, asunto Comisión vs. Francia; y de 15 de octubre de 1986, asunto Comisión vs. Italia). Por último, los reglamentos, pese a su característica de aplicabilidad directa, en la práctica pueden exigir otras normas internas complementarias para hacer plenamente efectiva su aplicación. En este sentido, más que de incorporación cabría hablar de «desarrollo» o complemento del Derecho de la Unión Europea.

La adaptación al Reglamento general de protección de datos, que será aplicable a partir del 25 de mayo de 2018, según establece su artículo 99, requiere, en suma, la elaboración de una nueva ley orgánica que sustituya a la actual. En esta labor se han preservado los principios de buena regulación, al tratarse de una norma necesaria para la adaptación del ordenamiento español a la citada disposición europea y proporcional a este objetivo, siendo su razón última procurar seguridad jurídica.

Internet, por otra parte, se ha convertido en una realidad omnipresente tanto en nuestra vida personal como colectiva. Una gran parte de nuestra actividad profesional, económica y privada se desarrolla en la Red y adquiere una importancia fundamental tanto para la comunicación humana como para el desarrollo de nuestra vida en sociedad. Ya en los años noventa, y conscientes del impacto que iba a producir Internet en nuestras vidas, los pioneros de la Red propusieron elaborar una Declaración de los Derechos del Hombre y del Ciudadano en Internet.

Hoy identificamos con bastante claridad los riesgos y oportunidades que el mundo de las redes ofrece a la ciudadanía. Corresponde a los poderes públicos impulsar políticas que hagan efectivos los derechos de la ciudadanía en Internet promoviendo la igualdad de los ciudadanos y de los grupos en los que se integran para hacer posible el pleno ejercicio de los derechos fundamentales en la realidad digital. La transformación digital de nuestra sociedad es ya una realidad en nuestro desarrollo presente y futuro tanto a nivel social como económico. En este contexto, países de nuestro entorno ya han aprobado normativa que refuerza los derechos digitales de la ciudadanía.

Los constituyentes de 1978 ya intuyeron el enorme impacto que los avances tecnológicos provocarían en nuestra sociedad y, en particular, en el disfrute de los derechos fundamentales. Una deseable futura reforma de la Constitución debería incluir entre sus prioridades la actualización de la Constitución a la era digital y, específicamente, elevar a rango constitucional una nueva generación de derechos digitales. Pero, en tanto no se acometa este reto, el legislador debe abordar el reconocimiento de un sistema de garantía de los derechos digitales que, inequívocamente, encuentra su anclaje en el mandato impuesto por el apartado cuarto del artículo 18 de la Constitución Española y que, en algunos casos, ya han sido perfilados por la jurisprudencia ordinaria, constitucional y europea.

Esta ley orgánica consta de noventa y siete artículos estructurados en diez títulos, veintidós disposiciones adicionales, seis disposiciones transitorias, una disposición derogatoria y dieciséis disposiciones finales.

El Título I, relativo a las disposiciones generales, comienza regulando el objeto de la ley orgánica, que es, conforme a lo que se ha indicado, doble. Así, en primer lugar, se pretende lograr la adaptación del ordenamiento jurídico español al Reglamento (UE) 2016/679 del Parlamento Europeo y el Consejo, de 27 de abril de 2016, Reglamento general de protección de datos, y completar sus disposiciones. A su vez, establece que el derecho fundamental de las personas físicas a la protección de datos personales, amparado por el artículo 18.4 de la Constitución, se ejercerá con arreglo a lo establecido en el Reglamento (UE) 2016/679 y en esta ley orgánica. Las comunidades autónomas ostentan competencias de desarrollo normativo y ejecución del derecho fundamental a la protección de datos personales en su ámbito de actividad y a las autoridades autonómicas de protección de datos que se creen les corresponde contribuir a garantizar este derecho fundamental de la ciudadanía. En segundo lugar, es también objeto de la ley garantizar los derechos digitales de la ciudadanía, al amparo de lo dispuesto en el artículo 18.4 de la Constitución.

Destaca la novedosa regulación de los datos referidos a las personas fallecidas, pues, tras excluir del ámbito de aplicación de la ley su tratamiento, se permite que las personas vinculadas al fallecido por razones familiares o de hecho o sus herederos puedan solicitar el acceso a los mismos, así como su rectificación o supresión, en su caso con sujeción a las instrucciones del fallecido. También excluye del ámbito de aplicación los tratamientos que se rijan por disposiciones específicas, en referencia, entre otras, a la normativa que transponga la citada Directiva (UE) 2016/680, previéndose en la disposición transitoria cuarta la aplicación a estos tratamientos de la Ley Orgánica 15/1999, de 13 de diciembre, hasta que se apruebe la citada normativa.

En el Título II, «Principios de protección de datos», se establece que a efectos del Reglamento (UE) 2016/679 no serán imputables al responsable del tratamiento, siempre que este haya adoptado todas las medidas razonables para que se supriman o rectifiquen sin dilación, la inexactitud de los datos obtenidos directamente del afectado, cuando hubiera recibido los datos de otro responsable en virtud del ejercicio por el afectado del derecho a la portabilidad, o cuando el responsable los obtuviese del mediador o intermediario cuando las normas aplicables al sector de actividad al que pertenezca el responsable del tratamiento establezcan la posibilidad de intervención de un intermediario o mediador o cuando los datos hubiesen sido obtenidos de un registro público. También se recoge expresamente el deber de confidencialidad, el tratamiento de datos amparado por la ley, las categorías especiales de datos y el tratamiento de datos de naturaleza penal, se alude específicamente al consentimiento, que ha de proceder de una declaración o de una clara acción afirmativa del afectado, excluyendo lo que se conocía como «consentimiento tácito», se indica que el consentimiento del afectado para una pluralidad de finalidades será preciso que conste de manera específica e inequívoca que se otorga para todas ellas, y se mantiene en catorce años la edad a partir de la cual el menor puede prestar su consentimiento.

Se regulan asimismo las posibles habilitaciones legales para el tratamiento fundadas en el cumplimiento de una obligación legal exigible al responsable, en los términos previstos en el Reglamento (UE) 2016/679, cuando así lo prevea una norma de Derecho de la Unión Europea o una ley, que podrá determinar las condiciones generales del tratamiento y los tipos de datos objeto del mismo así como las cesiones que procedan como consecuencia del cumplimiento de la obligación legal, Este es el caso, por ejemplo, de las bases de datos reguladas por ley y gestionadas por autoridades públicas que responden a objetivos específicos de control de riesgos y solvencia, supervisión e inspección del tipo de la Central de Información de Riesgos del Banco de España regulada por la Ley 44/2002, de 22 de noviembre, de Medidas de Reforma del Sistema Financiero, o de los datos, documentos e informaciones de carácter reservado que obren en poder de la Dirección General de Seguros y Fondos de Pensiones de conformidad con lo previsto en la Ley 20/2015, de 14 de julio, de ordenación, supervisión y solvencia de las entidades aseguradoras y reaseguradoras.

Se podrán igualmente imponer condiciones especiales al tratamiento, tales como la adopción de medidas adicionales de seguridad u otras, cuando ello derive del ejercicio de potestades públicas o del cumplimiento de una obligación legal y solo podrá considerarse fundado en el cumplimiento de una misión realizada en interés público o en el ejercicio de poderes públicos conferidos al responsable, en los términos previstos en el reglamento europeo, cuando derive de una competencia atribuida por la ley. Y se mantiene la prohibición de consentir tratamientos con la finalidad principal de almacenar información identificativa de determinadas categorías de datos especialmente protegidos, lo que no impide que los mismos puedan ser objeto de tratamiento en los demás supuestos previstos en el Reglamento (UE) 2016/679. Así, por ejemplo, la prestación del consentimiento no dará cobertura a la creación de «listas negras» de sindicalistas, si bien los datos de afiliación sindical podrán ser tratados por el empresario para hacer posible el ejercicio de los derechos de los trabajadores al amparo del artículo 9.2.b) del Reglamento (UE) 2016/679 o por los propios sindicatos en los términos del artículo 9.2.d) de la misma norma europea.

También en relación con el tratamiento de categorías especiales de datos, el artículo 9.2 consagra el principio de reserva de ley para su habilitación en los supuestos previstos en el Reglamento (UE) 2016/679. Dicha previsión no sólo alcanza a las disposiciones que pudieran adoptarse en el futuro, sino que permite dejar a salvo las distintas habilitaciones legales actualmente existentes, tal y como se indica específicamente, respecto de la legislación sanitaria y aseguradora, en la disposición adicional decimoséptima. El Reglamento general de protección de datos no afecta a dichas habilitaciones, que siguen plenamente vigentes, permitiendo incluso llevar a cabo una interpretación extensiva de las mismas, como sucede, en particular, en cuanto al alcance del consentimiento del afectado o el uso de sus datos sin consentimiento en el ámbito de la investigación biomédica. A tal efecto, el apartado 2 de la Disposición adicional decimoséptima introduce una serie de previsiones encaminadas a garantizar el adecuado desarrollo de la investigación en materia de salud, y en particular la biomédica, ponderando los indudables beneficios que la misma aporta a la sociedad con las debidas garantías del derecho fundamental a la protección de datos.

El Título III, dedicado a los derechos de las personas, adapta al Derecho español el principio de transparencia en el tratamiento del reglamento europeo, que regula el derecho de los afectados a ser informados acerca del tratamiento y recoge la denominada «información por capas» ya generalmente aceptada en ámbitos como el de la videovigilancia o la instalación de dispositivos de almacenamiento masivo de datos (tales como las «cookies»), facilitando al afectado la información básica, si bien, indicándole una dirección electrónica u otro medio que permita acceder de forma sencilla e inmediata a la restante información.

Se hace uso en este Título de la habilitación permitida por el considerando 8 del Reglamento (UE) 2016/679 para complementar su régimen, garantizando la adecuada estructura sistemática del texto. A continuación, la ley orgánica contempla los derechos de acceso, rectificación, supresión, oposición, derecho a la limitación del tratamiento y derecho a la portabilidad.

En el Título IV se recogen «Disposiciones aplicables a tratamientos concretos», incorporando una serie de supuestos que en ningún caso debe considerarse exhaustiva de todos los tratamientos lícitos. Dentro de ellos cabe apreciar, en primer lugar, aquellos respecto de los que el legislador establece una presunción «iuris tantum» de prevalencia del interés legítimo del responsable cuando se lleven a cabo con una serie de requisitos, lo que no excluye la licitud de este tipo de tratamientos cuando no se cumplen estrictamente las condiciones previstas en el texto, si bien en este caso el responsable deberá llevar a cabo la ponderación legalmente exigible, al no presumirse la prevalencia de su interés legítimo. Junto a estos supuestos se recogen otros, tales como la videovigilancia, los ficheros de exclusión publicitaria o los sistemas de denuncias internas en que la licitud del tratamiento proviene de la existencia de un interés público, en los términos establecidos en el artículo 6.1.e) del Reglamento (UE) 2016/679. Finalmente, se hace referencia en este Título a la licitud de otros tratamientos regulados en el Capítulo IX del reglamento, como los relacionados con la función estadística o con fines de archivo de interés general. En todo caso, el hecho de que el legislador se refiera a la licitud de los tratamientos no enerva la obligación de los responsables de adoptar todas las medidas de responsabilidad activa establecidas en el Capítulo IV del reglamento europeo y en el Título V de esta ley orgánica.

El Título V se refiere al responsable y al encargado del tratamiento. Es preciso tener en cuenta que la mayor novedad que presenta el Reglamento (UE) 2016/679 es la evolución de un modelo basado, fundamentalmente, en el control del cumplimiento a otro que descansa en el principio de responsabilidad activa, lo que exige una previa valoración por el responsable o por el encargado del tratamiento del riesgo que pudiera generar el tratamiento de los datos personales para, a partir de dicha valoración, adoptar las medidas que procedan. Con el fin de aclarar estas novedades, la ley orgánica mantiene la misma denominación del Capítulo IV del Reglamento, dividiendo el articulado en cuatro capítulos dedicados, respectivamente, a las medidas generales de responsabilidad activa, al régimen del encargado del tratamiento, a la figura del delegado de protección de datos y a los mecanismos de autorregulación y certificación. La figura del delegado de protección de datos adquiere una destacada importancia en el Reglamento (UE) 2016/679 y así lo recoge la ley orgánica, que parte del principio de que puede tener un carácter obligatorio o voluntario, estar o no integrado en la organización del responsable o encargado y ser tanto una persona física como una persona jurídica. La designación del delegado de protección de datos ha de comunicarse a la autoridad de protección de datos competente. La Agencia Española de Protección de Datos mantendrá una relación pública y actualizada de los delegados de protección de datos, accesible por cualquier persona. Los conocimientos en la materia se podrán acreditar mediante esquemas de certificación. Asimismo, no podrá ser removido, salvo en los supuestos de dolo o negligencia grave. Es de destacar que el delegado de protección de datos permite configurar un medio para la resolución amistosa de reclamaciones, pues el interesado podrá reproducir ante él la reclamación que no sea atendida por el responsable o encargado del tratamiento.

El Título VI, relativo a las transferencias internacionales de datos, procede a la adaptación de lo previsto en el Reglamento (UE) 2016/679 y se refiere a las especialidades relacionadas con los procedimientos a través de los cuales las autoridades de protección de datos pueden aprobar modelos contractuales o normas corporativas vinculantes, supuestos de autorización de una determinada transferencia, o información previa.

El Título VII se dedica a las autoridades de protección de datos, que siguiendo el mandato del Reglamento (UE) 2016/679 se han de establecer por ley nacional. Manteniendo el esquema que se venía recogiendo en sus antecedentes normativos, la ley orgánica regula el régimen de la Agencia Española de Protección de Datos y refleja la existencia de las autoridades autonómicas de protección de datos y la necesaria cooperación entre las autoridades de control. La Agencia Española de Protección de Datos se configura como una autoridad administrativa independiente con arreglo a la Ley 40/2015, de 1 de octubre, de Régimen Jurídico del Sector Público, que se relaciona con el Gobierno a través del Ministerio de Justicia.

El Título VIII regula el «Procedimientos en caso de posible vulneración de la normativa de protección de datos». El Reglamento (UE) 2016/679 establece un sistema novedoso y complejo, evolucionando hacia un modelo de «ventanilla única» en el que existe una autoridad de control principal y otras autoridades interesadas. También se establece un procedimiento de cooperación entre autoridades de los Estados miembros y, en caso de discrepancia, se prevé la decisión vinculante del Comité Europeo de Protección de Datos. En consecuencia, con carácter previo a la tramitación de cualquier procedimiento, será preciso determinar si el tratamiento tiene o no carácter transfronterizo y, en caso de tenerlo, qué autoridad de protección de datos ha de considerarse principal.

La regulación se limita a delimitar el régimen jurídico; la iniciación de los procedimientos, siendo posible que la Agencia Española de Protección de Datos remita la reclamación al delegado de protección de datos o a los órganos o entidades que tengan a su cargo la resolución extrajudicial de conflictos conforme a lo establecido en un código de conducta; la inadmisión de las reclamaciones; las actuaciones previas de investigación; las medidas provisionales, entre las que destaca la orden de bloqueo de los datos; y el plazo de tramitación de los procedimientos y, en su caso, su suspensión. Las especialidades del procedimiento se remiten al desarrollo reglamentario.

El Título IX, que contempla el régimen sancionador, parte de que el Reglamento (UE) 2016/679 establece un sistema de sanciones o actuaciones correctivas que permite un amplio margen de apreciación. En este marco, la ley orgánica procede a describir las conductas típicas, estableciendo la distinción entre infracciones muy graves, graves y leves, tomando en consideración la diferenciación que el Reglamento general de protección de datos establece al fijar la cuantía de las sanciones. La categorización de las infracciones se introduce a los solos efectos de determinar los plazos de prescripción, teniendo la descripción de las conductas típicas como único objeto la enumeración de manera ejemplificativa de algunos de los actos sancionables que deben entenderse incluidos dentro de los tipos generales establecidos en la norma europea. La ley orgánica regula los supuestos de interrupción de la prescripción partiendo de la exigencia constitucional del conocimiento de los hechos que se imputan a la persona, pero teniendo en cuenta la problemática derivada de los procedimientos establecidos en el reglamento europeo, en función de si el procedimiento se tramita exclusivamente por la Agencia Española de Protección de Datos o si se acude al procedimiento coordinado del artículo 60 del Reglamento general de protección de datos.

El Reglamento (UE) 2016/679 establece amplios márgenes para la determinación de la cuantía de las sanciones. La ley orgánica aprovecha la cláusula residual del artículo 83.2 de la norma europea, referida a los factores agravantes o atenuantes, para aclarar que entre los elementos a tener en cuenta podrán incluirse los que ya aparecían en el artículo 45.4 y 5 de la Ley Orgánica 15/1999, y que son conocidos por los operadores jurídicos.

Finalmente, el Título X de esta ley acomete la tarea de reconocer y garantizar un elenco de derechos digitales de los ciudadanos conforme al mandato establecido en la Constitución. En particular, son objeto de regulación los derechos y libertades predicables al entorno de Internet como la neutralidad de la Red y el acceso universal o los derechos a la seguridad y educación digital así como los derechos al olvido, a la portabilidad y al testamento digital. Ocupa un lugar relevante el reconocimiento del derecho a la desconexión digital en el marco del derecho a la intimidad en el uso de dispositivos digitales en el ámbito laboral y la protección de los menores en Internet. Finalmente, resulta destacable la garantía de la libertad de expresión y el derecho a la aclaración de informaciones en medios de comunicación digitales.

Las disposiciones adicionales se refieren a cuestiones como las medidas de seguridad en el ámbito del sector público, protección de datos y transparencia y acceso a la información pública, cómputo de plazos, autorización judicial en materia de transferencias internacionales de datos, la protección frente a prácticas abusivas que pudieran desarrollar ciertos operadores, o los tratamientos de datos de salud, entre otras.

De conformidad con la disposición adicional decimocuarta, la normativa relativa a las excepciones y limitaciones en el ejercicio de los derechos que hubiese entrado en vigor con anterioridad a la fecha de aplicación del reglamento europeo y en particular los artículos 23 y 24 de la Ley Orgánica 15/1999, de 13 de diciembre, de Protección de Datos de Carácter Personal, seguirá vigente en tanto no sea expresamente modificada, sustituida o derogada. La pervivencia de esta normativa supone la continuidad de las excepciones y limitaciones que en ella se contienen hasta que se produzca su reforma o abrogación, si bien referida a los derechos tal y como se regulan en el Reglamento (UE) 2016/679 y en esta ley orgánica. Así, por ejemplo, en virtud de la referida disposición adicional, las Administraciones tributarias responsables de los ficheros de datos con trascendencia tributaria a que se refiere el artículo 95 de la Ley 58/2003, de 17 de diciembre, General Tributaria, podrán, en relación con dichos datos, denegar el ejercicio de los derechos a que se refieren los artículos 15 a 22 del Reglamento (UE) 2016/679, cuando el mismo obstaculice las actuaciones administrativas tendentes a asegurar el cumplimiento de las obligaciones tributarias y, en todo caso, cuando el afectado esté siendo objeto de actuaciones inspectoras.

Las disposiciones transitorias están dedicadas, entre otras cuestiones, al estatuto de la Agencia Española de Protección de Datos, el régimen transitorio de los procedimientos o los tratamientos sometidos a la Directiva (UE) 2016/680. Se recoge una disposición derogatoria y, a continuación, figuran las disposiciones finales sobre los preceptos con carácter de ley ordinaria, el título competencial y la entrada en vigor.

Asimismo, se introducen las modificaciones necesarias de la Ley 1/2000, de 7 de enero, de Enjuiciamiento Civil y la Ley 29/1998, de 13 de julio, reguladora de la Jurisdicción Contencioso-administrativa, la Ley Orgánica, 6/1985, de 1 de julio, del Poder Judicial, la Ley 19/2013, de 9 de diciembre, de transparencia, acceso a la información pública y buen gobierno, la Ley Orgánica 5/1985, de 19 de junio, del Régimen Electoral General, la Ley 14/1986, de 25 de abril, General de Sanidad, la Ley 41/2002, de 14 de noviembre, básica reguladora de la autonomía del paciente y de derechos y obligaciones en materia de información y documentación clínica y la Ley 39/2015, de 1 de octubre, del Procedimiento Administrativo Común de las Administraciones Públicas.

Finalmente, y en relación con la garantía de los derechos digitales, también se introducen modificaciones en la Ley Orgánica 2/2006, de 3 de mayo, de Educación, la Ley Orgánica 6/2001, de 21 de diciembre, de Universidades, así como en el Texto Refundido de la Ley del Estatuto de los Trabajadores y en el Texto Refundido de la Ley del Estatuto Básico del Empleado Público.

TÍTULO I.- Disposiciones generales

Artículo 1.- Objeto de la ley.

La presente ley orgánica tiene por objeto:

a) Adaptar el ordenamiento jurídico español al Reglamento (UE) 2016/679 del Parlamento Europeo y el Consejo, de 27 de abril de 2016, relativo a la protección de las personas físicas en lo que respecta al tratamiento de sus datos personales y a la libre circulación de estos datos, y completar sus disposiciones.

El derecho fundamental de las personas físicas a la protección de datos personales, amparado por el artículo 18.4 de la Constitución, se ejercerá con arreglo a lo establecido en el Reglamento (UE) 2016/679 y en esta ley orgánica.

b) Garantizar los derechos digitales de la ciudadanía conforme al mandato establecido en el artículo 18.4 de la Constitución.

Artículo 2.- Ámbito de aplicación de los Títulos I a IX y de los artículos 89 a 94.

1. Lo dispuesto en los Títulos I a IX y en los artículos 89 a 94 de la presente ley orgánica se aplica a cualquier tratamiento total o parcialmente automatizado de datos personales, así como al tratamiento no automatizado de datos personales contenidos o destinados a ser incluidos en un fichero.

2. Esta ley orgánica no será de aplicación:

a) A los tratamientos excluidos del ámbito de aplicación del Reglamento general de protección de datos por su artículo 2.2, sin perjuicio de lo dispuesto en los apartados 3 y 4 de este artículo.

b) A los tratamientos de datos de personas fallecidas, sin perjuicio de lo establecido en el artículo 3.

c) A los tratamientos sometidos a la normativa sobre protección de materias clasificadas.

3. Los tratamientos a los que no sea directamente aplicable el Reglamento (UE) 2016/679 por afectar a actividades no comprendidas en el ámbito de aplicación del Derecho de la Unión Europea, se regirán por lo dispuesto en su legislación específica si la hubiere y supletoriamente por lo establecido en el citado reglamento y en la presente ley orgánica. Se encuentran en esta situación, entre otros, los tratamientos realizados al amparo de la legislación orgánica del régimen electoral general, los tratamientos realizados en el ámbito de instituciones penitenciarias y los tratamientos derivados del Registro Civil, los Registros de la Propiedad y Mercantiles.

4. El tratamiento de datos llevado a cabo con ocasión de la tramitación por los órganos judiciales de los procesos de los que sean competentes, así como el realizado dentro de la gestión de la Oficina Judicial, se regirán por lo dispuesto en el Reglamento (UE) 2016/679 y la presente ley orgánica, sin perjuicio de las disposiciones de la Ley Orgánica 6/1985, de 1 julio, del Poder Judicial, que le sean aplicables.

Artículo 3.- Datos de las personas fallecidas.

1. Las personas vinculadas al fallecido por razones familiares o de hecho así como sus herederos podrán dirigirse al responsable o encargado del tratamiento al objeto de solicitar el acceso a los datos personales de aquella y, en su caso, su rectificación o supresión.

Como excepción, las personas a las que se refiere el párrafo anterior no podrán acceder a los datos del causante, ni solicitar su rectificación o supresión, cuando la persona fallecida lo hubiese prohibido expresamente o así lo establezca una ley. Dicha prohibición no afectará al derecho de los herederos a acceder a los datos de carácter patrimonial del causante.

2. Las personas o instituciones a las que el fallecido hubiese designado expresamente para ello podrán también solicitar, con arreglo a las instrucciones recibidas, el acceso a los datos personales de este y, en su caso su rectificación o supresión.

Mediante real decreto se establecerán los requisitos y condiciones para acreditar la validez y vigencia de estos mandatos e instrucciones y, en su caso, el registro de los mismos.

3. En caso de fallecimiento de menores, estas facultades podrán ejercerse también por sus representantes legales o, en el marco de sus competencias, por el Ministerio Fiscal, que podrá actuar de oficio o a instancia de cualquier persona física o jurídica interesada.

En caso de fallecimiento de personas con discapacidad, estas facultades también podrán ejercerse, además de por quienes señala el párrafo anterior, por quienes hubiesen sido designados para el ejercicio de funciones de apoyo, si tales facultades se entendieran comprendidas en las medidas de apoyo prestadas por el designado.

TÍTULO II.- Principios de protección de datos

Artículo 4.- Exactitud de los datos.

1. Conforme al artículo 5.1.d) del Reglamento (UE) 2016/679 los datos serán exactos y, si fuere necesario, actualizados.

2. A los efectos previstos en el artículo 5.1.d) del Reglamento (UE) 2016/679, no será imputable al responsable del tratamiento, siempre que este haya adoptado todas las medidas razonables para que se supriman o rectifiquen sin dilación, la inexactitud de los datos personales, con respecto a los fines para los que se tratan, cuando los datos inexactos:

a) Hubiesen sido obtenidos por el responsable directamente del afectado.

b) Hubiesen sido obtenidos por el responsable de un mediador o intermediario en caso de que las normas aplicables al sector de actividad al que pertenezca el responsable del tratamiento establecieran la posibilidad de intervención de un intermediario o mediador que recoja en nombre propio los datos de los afectados para su transmisión al responsable. El mediador o intermediario asumirá las responsabilidades que pudieran derivarse en el supuesto de comunicación al responsable de datos que no se correspondan con los facilitados por el afectado.

c) Fuesen sometidos a tratamiento por el responsable por haberlos recibido de otro responsable en virtud del ejercicio por el afectado del derecho a la portabilidad conforme al artículo 20 del Reglamento (UE) 2016/679 y lo previsto en esta ley orgánica.

d) Fuesen obtenidos de un registro público por el responsable.

Artículo 5.- Deber de confidencialidad.

1. Los responsables y encargados del tratamiento de datos así como todas las personas que intervengan en cualquier fase de este estarán sujetas al deber de confidencialidad al que se refiere el artículo 5.1.f) del Reglamento (UE) 2016/679.

2. La obligación general señalada en el apartado anterior será complementaria de los deberes de secreto profesional de conformidad con su normativa aplicable.

3. Las obligaciones establecidas en los apartados anteriores se mantendrán aun cuando hubiese finalizado la relación del obligado con el responsable o encargado del tratamiento.

Artículo 6.- Tratamiento basado en el consentimiento del afectado.

1. De conformidad con lo dispuesto en el artículo 4.11 del Reglamento (UE) 2016/679, se entiende por consentimiento del afectado toda manifestación de voluntad libre, específica, informada e inequívoca por la que este acepta, ya sea mediante una declaración o una clara acción afirmativa, el tratamiento de datos personales que le conciernen.

2. Cuando se pretenda fundar el tratamiento de los datos en el consentimiento del afectado para una pluralidad de finalidades será preciso que conste de manera específica e inequívoca que dicho consentimiento se otorga para todas ellas.

3. No podrá supeditarse la ejecución del contrato a que el afectado consienta el tratamiento de los datos personales para finalidades que no guarden relación con el mantenimiento, desarrollo o control de la relación contractual.

Artículo 7.- Consentimiento de los menores de edad.

1. El tratamiento de los datos personales de un menor de edad únicamente podrá fundarse en su consentimiento cuando sea mayor de catorce años.

Se exceptúan los supuestos en que la ley exija la asistencia de los titulares de la patria potestad o tutela para la celebración del acto o negocio jurídico en cuyo contexto se recaba el consentimiento para el tratamiento.

2. El tratamiento de los datos de los menores de catorce años, fundado en el consentimiento, solo será lícito si consta el del titular de la patria potestad o tutela, con el alcance que determinen los titulares de la patria potestad o tutela.

Artículo 8.- Tratamiento de datos por obligación legal, interés público o ejercicio de poderes públicos.

1. El tratamiento de datos personales solo podrá considerarse fundado en el cumplimiento de una obligación legal exigible al responsable, en los términos previstos en el artículo 6.1.c) del Reglamento (UE) 2016/679, cuando así lo prevea una norma de Derecho de la Unión Europea o una norma con rango de ley, que podrá determinar las condiciones generales del tratamiento y los tipos de datos objeto del mismo así como las cesiones que procedan como consecuencia del cumplimiento de la obligación legal. Dicha norma podrá igualmente imponer condiciones especiales al tratamiento, tales como la adopción de medidas adicionales de seguridad u otras establecidas en el capítulo IV del Reglamento (UE) 2016/679.

2. El tratamiento de datos personales solo podrá considerarse fundado en el cumplimiento de una misión realizada en interés público o en el ejercicio de poderes públicos conferidos al responsable, en los términos previstos en el artículo 6.1 e) del Reglamento (UE) 2016/679, cuando derive de una competencia atribuida por una norma con rango de ley.

Artículo 9.- Categorías especiales de datos.

1. A los efectos del artículo 9.2.a) del Reglamento (UE) 2016/679, a fin de evitar situaciones discriminatorias, el solo consentimiento del afectado no bastará para levantar la prohibición del tratamiento de datos cuya finalidad principal sea identificar su ideología, afiliación sindical, religión, orientación sexual, creencias u origen racial o étnico.

Lo dispuesto en el párrafo anterior no impedirá el tratamiento de dichos datos al amparo de los restantes supuestos contemplados en el artículo 9.2 del Reglamento (UE) 2016/679, cuando así proceda.

2. Los tratamientos de datos contemplados en las letras g), h) e i) del artículo 9.2 del Reglamento (UE) 2016/679 fundados en el Derecho español deberán estar amparados en una norma con rango de ley, que podrá establecer requisitos adicionales relativos a su seguridad y confidencialidad.

En particular, dicha norma podrá amparar el tratamiento de datos en el ámbito de la salud cuando así lo exija la gestión de los sistemas y servicios de asistencia sanitaria y social, pública y privada, o la ejecución de un contrato de seguro del que el afectado sea parte.

Artículo 10.- Tratamiento de datos de naturaleza penal.

1. El tratamiento de datos personales relativos a condenas e infracciones penales, así como a procedimientos y medidas cautelares y de seguridad conexas, para fines distintos de los de prevención, investigación, detección o enjuiciamiento de infracciones penales o de ejecución de sanciones penales, solo podrá llevarse a cabo cuando se encuentre amparado en una norma de Derecho de la Unión, en esta ley orgánica o en otras normas de rango legal.

2. El registro completo de los datos referidos a condenas e infracciones penales, así como a procedimientos y medidas cautelares y de seguridad conexas a que se refiere el artículo 10 del Reglamento (UE) 2016/679, podrá realizarse conforme con lo establecido en la regulación del Sistema de registros administrativos de apoyo a la Administración de Justicia.

3. Fuera de los supuestos señalados en los apartados anteriores, los tratamientos de datos referidos a condenas e infracciones penales, así como a procedimientos y medidas cautelares y de seguridad conexas solo serán posibles cuando sean llevados a cabo por abogados y procuradores y tengan por objeto recoger la información facilitada por sus clientes para el ejercicio de sus funciones.

TÍTULO III.- Derechos de las personas

CAPÍTULO I.- Transparencia e información

Artículo 11.- Transparencia e información al afectado.

1. Cuando los datos personales sean obtenidos del afectado el responsable del tratamiento podrá dar cumplimiento al deber de información establecido en el artículo 13 del Reglamento (UE) 2016/679 facilitando al afectado la información básica a la que se refiere el apartado siguiente e indicándole una dirección electrónica u otro medio que permita acceder de forma sencilla e inmediata a la restante información.

2. La información básica a la que se refiere el apartado anterior deberá contener, al menos:

a) La identidad del responsable del tratamiento y de su representante, en su caso.

b) La finalidad del tratamiento.

c) La posibilidad de ejercer los derechos establecidos en los artículos 15 a 22 del Reglamento (UE) 2016/679.

Si los datos obtenidos del afectado fueran a ser tratados para la elaboración de perfiles, la información básica comprenderá asimismo esta circunstancia. En este caso, el afectado deberá ser informado de su derecho a oponerse a la adopción de decisiones individuales automatizadas que produzcan efectos jurídicos sobre él o le afecten significativamente de modo similar, cuando concurra este derecho de acuerdo con lo previsto en el artículo 22 del Reglamento (UE) 2016/679.

3. Cuando los datos personales no hubieran sido obtenidos del afectado, el responsable podrá dar cumplimiento al deber de información establecido en el artículo 14 del Reglamento (UE) 2016/679 facilitando a aquel la información básica señalada en el apartado anterior, indicándole una dirección electrónica u otro medio que permita acceder de forma sencilla e inmediata a la restante información.

En estos supuestos, la información básica incluirá también:

a) Las categorías de datos objeto de tratamiento.

b) Las fuentes de las que procedieran los datos.

CAPÍTULO II.- Ejercicio de los derechos

Artículo 12.- Disposiciones generales sobre ejercicio de los derechos.

1. Los derechos reconocidos en los artículos 15 a 22 del Reglamento (UE) 2016/679, podrán ejercerse directamente o por medio de representante legal o voluntario.

2. El responsable del tratamiento estará obligado a informar al afectado sobre los medios a su disposición para ejercer los derechos que le corresponden. Los medios deberán ser fácilmente accesibles para el afectado. El ejercicio del derecho no podrá ser denegado por el solo motivo de optar el afectado por otro medio.

3. El encargado podrá tramitar, por cuenta del responsable, las solicitudes de ejercicio formuladas por los afectados de sus derechos si así se estableciere en el contrato o acto jurídico que les vincule.

4. La prueba del cumplimiento del deber de responder a la solicitud de ejercicio de sus derechos formulado por el afectado recaerá sobre el responsable.

5. Cuando las leyes aplicables a determinados tratamientos establezcan un régimen especial que afecte al ejercicio de los derechos previstos en el Capítulo III del Reglamento (UE) 2016/679, se estará a lo dispuesto en aquellas.

6. En cualquier caso, los titulares de la patria potestad podrán ejercitar en nombre y representación de los menores de catorce años los derechos de acceso, rectificación, cancelación, oposición o cualesquiera otros que pudieran corresponderles en el contexto de la presente ley orgánica.

7. Serán gratuitas las actuaciones llevadas a cabo por el responsable del tratamiento para atender las solicitudes de ejercicio de estos derechos, sin perjuicio de lo dispuesto en los artículos 12.5 y 15.3 del Reglamento (UE) 2016/679 y en los apartados 3 y 4 del artículo 13 de esta ley orgánica.

Artículo 13.- Derecho de acceso.

1. El derecho de acceso del afectado se ejercitará de acuerdo con lo establecido en el artículo 15 del Reglamento (UE) 2016/679.

Cuando el responsable trate una gran cantidad de datos relativos al afectado y este ejercite su derecho de acceso sin especificar si se refiere a todos o a una parte de los datos, el responsable podrá solicitarle, antes de facilitar la información, que el afectado especifique los datos o actividades de tratamiento a los que se refiere la solicitud.

2. El derecho de acceso se entenderá otorgado si el responsable del tratamiento facilitara al afectado un sistema de acceso remoto, directo y seguro a los datos personales que garantice, de modo permanente, el acceso a su totalidad. A tales efectos, la comunicación por el responsable al afectado del modo en que este podrá acceder a dicho sistema bastará para tener por atendida la solicitud de ejercicio del derecho.

No obstante, el interesado podrá solicitar del responsable la información referida a los extremos previstos en el artículo 15.1 del Reglamento (UE) 2016/679 que no se incluyese en el sistema de acceso remoto.

3. A los efectos establecidos en el artículo 12.5 del Reglamento (UE) 2016/679 se podrá considerar repetitivo el ejercicio del derecho de acceso en más de una ocasión durante el plazo de seis meses, a menos que exista causa legítima para ello.

Cuando el afectado elija un medio distinto al que se le ofrece que suponga un coste desproporcionado, la solicitud será considerada excesiva, por lo que dicho afectado asumirá el exceso de costes que su elección comporte. En este caso, solo será exigible al responsable del tratamiento la satisfacción del derecho de acceso sin dilaciones indebidas.

Artículo 14.- Derecho de rectificación.

Al ejercer el derecho de rectificación reconocido en el artículo 16 del Reglamento (UE) 2016/679, el afectado deberá indicar en su solicitud a qué datos se refiere y la corrección que haya de realizarse. Deberá acompañar, cuando sea preciso, la documentación justificativa de la inexactitud o carácter incompleto de los datos objeto de tratamiento.

Artículo 15.- Derecho de supresión.

1. El derecho de supresión se ejercerá de acuerdo con lo establecido en el artículo 17 del Reglamento (UE) 2016/679.

2. Cuando la supresión derive del ejercicio del derecho de oposición con arreglo al artículo 21.2 del Reglamento (UE) 2016/679, el responsable podrá conservar los datos identificativos del afectado necesarios con el fin de impedir tratamientos futuros para fines de mercadotecnia directa.

Artículo 16.- Derecho a la limitación del tratamiento.

1. El derecho a la limitación del tratamiento se ejercerá de acuerdo con lo establecido en el artículo 18 del Reglamento (UE) 2016/679.

2. El hecho de que el tratamiento de los datos personales esté limitado debe constar claramente en los sistemas de información del responsable.

Artículo 17.- Derecho a la portabilidad.

El derecho a la portabilidad se ejercerá de acuerdo con lo establecido en el artículo 20 del Reglamento (UE) 2016/679.

Artículo 18.- Derecho de oposición.

El derecho de oposición, así como los derechos relacionados con las decisiones individuales automatizadas, incluida la realización de perfiles, se ejercerán de acuerdo con lo establecido, respectivamente, en los artículos 21 y 22 del Reglamento (UE) 2016/679.

TÍTULO IV.- Disposiciones aplicables a tratamientos concretos

Artículo 19.- Tratamiento de datos de contacto, de empresarios individuales y de profesionales liberales.

1. Salvo prueba en contrario, se presumirá amparado en lo dispuesto en el artículo 6.1.f) del Reglamento (UE) 2016/679 el tratamiento de los datos de contacto y en su caso los relativos a la función o puesto desempeñado de las personas físicas que presten servicios en una persona jurídica siempre que se cumplan los siguientes requisitos:

a) Que el tratamiento se refiera únicamente a los datos necesarios para su localización profesional.

b) Que la finalidad del tratamiento sea únicamente mantener relaciones de cualquier índole con la persona jurídica en la que el afectado preste sus servicios.

2. La misma presunción operará para el tratamiento de los datos relativos a los empresarios individuales y a los profesionales liberales, cuando se refieran a ellos únicamente en dicha condición y no se traten para entablar una relación con los mismos como personas físicas.

3. Los responsables o encargados del tratamiento a los que se refiere el artículo 77.1 de esta ley orgánica podrán también tratar los datos mencionados en los dos apartados anteriores cuando ello se derive de una obligación legal o sea necesario para el ejercicio de sus competencias.

Artículo 20.- Sistemas de información crediticia.

1. Salvo prueba en contrario, se presumirá lícito el tratamiento de datos personales relativos al incumplimiento de obligaciones dinerarias, financieras o de crédito por sistemas comunes de información crediticia cuando se cumplan los siguientes requisitos:

a) Que los datos hayan sido facilitados por el acreedor o por quien actúe por su cuenta o interés.

b) Que los datos se refieran a deudas ciertas, vencidas y exigibles, cuya existencia o cuantía no hubiese sido objeto de reclamación administrativa o judicial por el deudor o mediante un procedimiento alternativo de resolución de disputas vinculante entre las partes.

c) Que el acreedor haya informado al afectado en el contrato o en el momento de requerir el pago acerca de la posibilidad de inclusión en dichos sistemas, con indicación de aquéllos en los que participe.

La entidad que mantenga el sistema de información crediticia con datos relativos al incumplimiento de obligaciones dinerarias, financieras o de crédito deberá notificar al afectado la inclusión de tales datos y le informará sobre la posibilidad de ejercitar los derechos establecidos en los artículos 15 a 22 del Reglamento (UE) 2016/679 dentro de los treinta días siguientes a la notificación de la deuda al sistema, permaneciendo bloqueados los datos durante ese plazo.

d) Que los datos únicamente se mantengan en el sistema mientras persista el incumplimiento, con el límite máximo de cinco años desde la fecha de vencimiento de la obligación dineraria, financiera o de crédito.

e) Que los datos referidos a un deudor determinado solamente puedan ser consultados cuando quien consulte el sistema mantuviese una relación contractual con el afectado que implique el abono de una cuantía pecuniaria o este le hubiera solicitado la celebración de un contrato que suponga financiación, pago aplazado o facturación periódica, como sucede, entre otros supuestos, en los previstos en la legislación de contratos de crédito al consumo y de contratos de crédito inmobiliario.

Cuando se hubiera ejercitado ante el sistema el derecho a la limitación del tratamiento de los datos impugnando su exactitud conforme a lo previsto en el artículo 18.1.a) del Reglamento (UE) 2016/679, el sistema informará a quienes pudieran consultarlo con arreglo al párrafo anterior acerca de la mera existencia de dicha circunstancia, sin facilitar los datos concretos respecto de los que se hubiera ejercitado el derecho, en tanto se resuelve sobre la solicitud del afectado.

f) Que, en el caso de que se denegase la solicitud de celebración del contrato, o éste no llegara a celebrarse, como consecuencia de la consulta efectuada, quien haya consultado el sistema informe al afectado del resultado de dicha consulta.

2. Las entidades que mantengan el sistema y las acreedoras, respecto del tratamiento de los datos referidos a sus deudores, tendrán la condición de corresponsables del tratamiento de los datos, siendo de aplicación lo establecido por el artículo 26 del Reglamento (UE) 2016/679.

Corresponderá al acreedor garantizar que concurren los requisitos exigidos para la inclusión en el sistema de la deuda, respondiendo de su inexistencia o inexactitud.

3. La presunción a la que se refiere el apartado 1 de este artículo no ampara los supuestos en que la información crediticia fuese asociada por la entidad que mantuviera el sistema a informaciones adicionales a las contempladas en dicho apartado, relacionadas con el deudor y obtenidas de otras fuentes, a fin de llevar a cabo un perfilado del mismo, en particular mediante la aplicación de técnicas de calificación crediticia.

Artículo 21.- Tratamientos relacionados con la realización de determinadas operaciones mercantiles.

1. Salvo prueba en contrario, se presumirán lícitos los tratamientos de datos, incluida su comunicación con carácter previo, que pudieran derivarse del desarrollo de cualquier operación de modificación estructural de sociedades o la aportación o transmisión de negocio o de rama de actividad empresarial, siempre que los tratamientos fueran necesarios para el buen fin de la operación y garanticen, cuando proceda, la continuidad en la prestación de los servicios.

2. En el caso de que la operación no llegara a concluirse, la entidad cesionaria deberá proceder con carácter inmediato a la supresión de los datos, sin que sea de aplicación la obligación de bloqueo prevista en esta ley orgánica.

Artículo 22.- Tratamientos con fines de videovigilancia.

1. Las personas físicas o jurídicas, públicas o privadas, podrán llevar a cabo el tratamiento de imágenes a través de sistemas de cámaras o videocámaras con la finalidad de preservar la seguridad de las personas y bienes, así como de sus instalaciones.

2. Solo podrán captarse imágenes de la vía pública en la medida en que resulte imprescindible para la finalidad mencionada en el apartado anterior.

No obstante, será posible la captación de la vía pública en una extensión superior cuando fuese necesario para garantizar la seguridad de bienes o instalaciones estratégicos o de infraestructuras vinculadas al transporte, sin que en ningún caso pueda suponer la captación de imágenes del interior de un domicilio privado.

3. Los datos serán suprimidos en el plazo máximo de un mes desde su captación, salvo cuando hubieran de ser conservados para acreditar la comisión de actos que atenten contra la integridad de personas, bienes o instalaciones. En tal caso, las imágenes deberán ser puestas a disposición de la autoridad competente en un plazo máximo de setenta y dos horas desde que se tuviera conocimiento de la existencia de la grabación.

No será de aplicación a estos tratamientos la obligación de bloqueo prevista en el artículo 32 de esta ley orgánica.

4. El deber de información previsto en el artículo 12 del Reglamento (UE) 2016/679 se entenderá cumplido mediante la colocación de un dispositivo informativo en lugar suficientemente visible identificando, al menos, la existencia del tratamiento, la identidad del responsable y la posibilidad de ejercitar los derechos previstos en los artículos 15 a 22 del Reglamento (UE) 2016/679. También podrá incluirse en el dispositivo informativo un código de conexión o dirección de internet a esta información.

En todo caso, el responsable del tratamiento deberá mantener a disposición de los afectados la información a la que se refiere el citado reglamento.

5. Al amparo del artículo 2.2.c) del Reglamento (UE) 2016/679, se considera excluido de su ámbito de aplicación el tratamiento por una persona física de imágenes que solamente capten el interior de su propio domicilio.

Esta exclusión no abarca el tratamiento realizado por una entidad de seguridad privada que hubiera sido contratada para la vigilancia de un domicilio y tuviese acceso a las imágenes.

6. El tratamiento de los datos personales procedentes de las imágenes y sonidos obtenidos mediante la utilización de cámaras y videocámaras por las Fuerzas y Cuerpos de Seguridad y por los órganos competentes para la vigilancia y control en los centros penitenciarios y para el control, regulación, vigilancia y disciplina del tráfico, se regirá por la legislación de transposición de la Directiva (UE) 2016/680, cuando el tratamiento tenga fines de prevención, investigación, detección o enjuiciamiento de infracciones penales o de ejecución de sanciones penales, incluidas la protección y la prevención frente a las amenazas contra la seguridad pública. Fuera de estos supuestos, dicho tratamiento se regirá por su legislación específica y supletoriamente por el Reglamento (UE) 2016/679 y la presente ley orgánica.

7. Lo regulado en el presente artículo se entiende sin perjuicio de lo previsto en la Ley 5/2014, de 4 de abril, de Seguridad Privada y sus disposiciones de desarrollo.

8. El tratamiento por el empleador de datos obtenidos a través de sistemas de cámaras o videocámaras se somete a lo dispuesto en el artículo 89 de esta ley orgánica.

Artículo 23.- Sistemas de exclusión publicitaria.

1. Será lícito el tratamiento de datos personales que tenga por objeto evitar el envío de comunicaciones comerciales a quienes hubiesen manifestado su negativa u oposición a recibirlas.

A tal efecto, podrán crearse sistemas de información, generales o sectoriales, en los que solo se incluirán los datos imprescindibles para identificar a los afectados. Estos sistemas también podrán incluir servicios de preferencia, mediante los cuales los afectados limiten la recepción de comunicaciones comerciales a las procedentes de determinadas empresas.

2. Las entidades responsables de los sistemas de exclusión publicitaria comunicarán a la autoridad de control competente su creación, su carácter general o sectorial, así como el modo en que los afectados pueden incorporarse a los mismos y, en su caso, hacer valer sus preferencias.

La autoridad de control competente hará pública en su sede electrónica una relación de los sistemas de esta naturaleza que le fueran comunicados, incorporando la información mencionada en el párrafo anterior. A tal efecto, la autoridad de control competente a la que se haya comunicado la creación del sistema lo pondrá en conocimiento de las restantes autoridades de control para su publicación por todas ellas.

3. Cuando un afectado manifieste a un responsable su deseo de que sus datos no sean tratados para la remisión de comunicaciones comerciales, este deberá informarle de los sistemas de exclusión publicitaria existentes, pudiendo remitirse a la información publicada por la autoridad de control competente.

4. Quienes pretendan realizar comunicaciones de mercadotecnia directa, deberán previamente consultar los sistemas de exclusión publicitaria que pudieran afectar a su actuación, excluyendo del tratamiento los datos de los afectados que hubieran manifestado su oposición o negativa al mismo. A estos efectos, para considerar cumplida la obligación anterior será suficiente la consulta de los sistemas de exclusión incluidos en la relación publicada por la autoridad de control competente.

No será necesario realizar la consulta a la que se refiere el párrafo anterior cuando el afectado hubiera prestado, conforme a lo dispuesto en esta ley orgánica, su consentimiento para recibir la comunicación a quien pretenda realizarla.

Artículo 24.- Sistemas de información de denuncias internas.

1. Será lícita la creación y mantenimiento de sistemas de información a través de los cuales pueda ponerse en conocimiento de una entidad de Derecho privado, incluso anónimamente, la comisión en el seno de la misma o en la actuación de terceros que contratasen con ella, de actos o conductas que pudieran resultar contrarios a la normativa general o sectorial que le fuera aplicable. Los empleados y terceros deberán ser informados acerca de la existencia de estos sistemas de información.

2. El acceso a los datos contenidos en estos sistemas quedará limitado exclusivamente a quienes, incardinados o no en el seno de la entidad, desarrollen las funciones de control interno y de cumplimiento, o a los encargados del tratamiento que eventualmente se designen a tal efecto. No obstante, será lícito su acceso por otras personas, o incluso su comunicación a terceros, cuando resulte necesario para la adopción de medidas disciplinarias o para la tramitación de los procedimientos judiciales que, en su caso, procedan.

Sin perjuicio de la notificación a la autoridad competente de hechos constitutivos de ilícito penal o administrativo, solo cuando pudiera proceder la adopción de medidas disciplinarias contra un trabajador, dicho acceso se permitirá al personal con funciones de gestión y control de recursos humanos.

3. Deberán adoptarse las medidas necesarias para preservar la identidad y garantizar la confidencialidad de los datos correspondientes a las personas afectadas por la información suministrada, especialmente la de la persona que hubiera puesto los hechos en conocimiento de la entidad, en caso de que se hubiera identificado.

4. Los datos de quien formule la comunicación y de los empleados y terceros deberán conservarse en el sistema de denuncias únicamente durante el tiempo imprescindible para decidir sobre la procedencia de iniciar una investigación sobre los hechos denunciados.

En todo caso, transcurridos tres meses desde la introducción de los datos, deberá procederse a su supresión del sistema de denuncias, salvo que la finalidad de la conservación sea dejar evidencia del funcionamiento del modelo de prevención de la comisión de delitos por la persona jurídica. Las denuncias a las que no se haya dado curso solamente podrán constar de forma anonimizada, sin que sea de aplicación la obligación de bloqueo prevista en el artículo 32 de esta ley orgánica.

Transcurrido el plazo mencionado en el párrafo anterior, los datos podrán seguir siendo tratados, por el órgano al que corresponda, conforme al apartado 2 de este artículo, la investigación de los hechos denunciados, no conservándose en el propio sistema de información de denuncias internas.

5. Los principios de los apartados anteriores serán aplicables a los sistemas de denuncias internas que pudieran crearse en las Administraciones Públicas.

Artículo 25.- Tratamiento de datos en el ámbito de la función estadística pública.

1. El tratamiento de datos personales llevado a cabo por los organismos que tengan atribuidas las competencias relacionadas con el ejercicio de la función estadística pública se someterá a lo dispuesto en su legislación específica, así como en el Reglamento (UE) 2016/679 y en la presente ley orgánica.

2. La comunicación de los datos a los órganos competentes en materia estadística solo se entenderá amparada en el artículo 6.1 e) del Reglamento (UE) 2016/679 en los casos en que la estadística para la que se requiera la información venga exigida por una norma de Derecho de la Unión Europea o se encuentre incluida en los instrumentos de programación estadística legalmente previstos.

De conformidad con lo dispuesto en el artículo 11.2 de la Ley 12/1989, de 9 de mayo, de la Función Estadística Pública, serán de aportación estrictamente voluntaria y, en consecuencia, solo podrán recogerse previo consentimiento expreso de los afectados los datos a los que se refieren los artículos 9 y 10 del Reglamento (UE) 2016/679.

3. Los organismos competentes para el ejercicio de la función estadística pública podrán denegar las solicitudes de ejercicio por los afectados de los derechos establecidos en los artículos 15 a 22 del Reglamento (UE) 2016/679 cuando los datos se encuentren amparados por las garantías del secreto estadístico previstas en la legislación estatal o autonómica.

Artículo 26. -Tratamiento de datos con fines de archivo en interés público por parte de las Administraciones Públicas.

Será lícito el tratamiento por las Administraciones Públicas de datos con fines de archivo en interés público, que se someterá a lo dispuesto en el Reglamento (UE) 2016/679 y en la presente ley orgánica con las especialidades que se derivan de lo previsto en la Ley 16/1985, de 25 de junio, del Patrimonio Histórico Español, en el Real Decreto 1708/2011, de 18 de noviembre, por el que se establece el Sistema Español de Archivos y se regula el Sistema de Archivos de la Administración General del Estado y de sus Organismos Públicos y su régimen de acceso, así como la legislación autonómica que resulte de aplicación.

Artículo 27.- Tratamiento de datos relativos a infracciones y sanciones administrativas.

1. A los efectos del artículo 86 del Reglamento (UE) 2016/679, el tratamiento de datos relativos a infracciones y sanciones administrativas, incluido el mantenimiento de registros relacionados con las mismas, exigirá:

a) Que los responsables de dichos tratamientos sean los órganos competentes para la instrucción del procedimiento sancionador, para la declaración de las infracciones o la imposición de las sanciones.

b) Que el tratamiento se limite a los datos estrictamente necesarios para la finalidad perseguida por aquel.

2. Cuando no se cumpla alguna de las condiciones previstas en el apartado anterior, los tratamientos de datos referidos a infracciones y sanciones administrativas habrán de contar con el consentimiento del interesado o estar autorizados por una norma con rango de ley, en la que se regularán, en su caso, garantías adicionales para los derechos y libertades de los afectados.

3. Fuera de los supuestos señalados en los apartados anteriores, los tratamientos de datos referidos a infracciones y sanciones administrativas solo serán posibles cuando sean llevados a cabo por abogados y procuradores y tengan por objeto recoger la información facilitada por sus clientes para el ejercicio de sus funciones.

TÍTULO V.- Responsable y encargado del tratamiento

CAPÍTULO I.- Disposiciones generales. Medidas de responsabilidad activa

Artículo 28.- Obligaciones generales del responsable y encargado del tratamiento.

1. Los responsables y encargados, teniendo en cuenta los elementos enumerados en los artículos 24 y 25 del Reglamento (UE) 2016/679, determinarán las medidas técnicas y organizativas apropiadas que deben aplicar a fin de garantizar y acreditar que el tratamiento es conforme con el citado reglamento, con la presente ley orgánica, sus normas de desarrollo y la legislación sectorial aplicable. En particular valorarán si procede la realización de la evaluación de impacto en la protección de datos y la consulta previa a que se refiere la Sección 3 del Capítulo IV del citado reglamento.

2. Para la adopción de las medidas a que se refiere el apartado anterior los responsables y encargados del tratamiento tendrán en cuenta, en particular, los mayores riesgos que podrían producirse en los siguientes supuestos:

a) Cuando el tratamiento pudiera generar situaciones de discriminación, usurpación de identidad o fraude, pérdidas financieras, daño para la reputación, pérdida de confidencialidad de datos sujetos al secreto profesional, reversión no autorizada de la seudonimización o cualquier otro perjuicio económico, moral o social significativo para los afectados.

b) Cuando el tratamiento pudiese privar a los afectados de sus derechos y libertades o pudiera impedirles el ejercicio del control sobre sus datos personales.

c) Cuando se produjese el tratamiento no meramente incidental o accesorio de las categorías especiales de datos a las que se refieren los artículos 9 y 10 del Reglamento (UE) 2016/679 y 9 y 10 de esta ley orgánica o de los datos relacionados con la comisión de infracciones administrativas.

d) Cuando el tratamiento implicase una evaluación de aspectos personales de los afectados con el fin de crear o utilizar perfiles personales de los mismos, en particular mediante el análisis o la predicción de aspectos referidos a su rendimiento en el trabajo, su situación económica, su salud, sus preferencias o intereses personales, su fiabilidad o comportamiento, su solvencia financiera, su localización o sus movimientos.

e) Cuando se lleve a cabo el tratamiento de datos de grupos de afectados en situación de especial vulnerabilidad y, en particular, de menores de edad y personas con discapacidad.

f) Cuando se produzca un tratamiento masivo que implique a un gran número de afectados o conlleve la recogida de una gran cantidad de datos personales.

g) Cuando los datos personales fuesen a ser objeto de transferencia, con carácter habitual, a terceros Estados u organizaciones internacionales respecto de los que no se hubiese declarado un nivel adecuado de protección.

h) Cualesquiera otros que a juicio del responsable o del encargado pudieran tener relevancia y en particular aquellos previstos en códigos de conducta y estándares definidos por esquemas de certificación.

Artículo 29.- Supuestos de corresponsabilidad en el tratamiento.

La determinación de las responsabilidades a las que se refiere el artículo 26.1 del Reglamento (UE) 2016/679 se realizará atendiendo a las actividades que efectivamente desarrolle cada uno de los corresponsables del tratamiento.

Artículo 30.- Representantes de los responsables o encargados del tratamiento no establecidos en la Unión Europea.

1. En los supuestos en que el Reglamento (UE) 2016/679 sea aplicable a un responsable o encargado del tratamiento no establecido en la Unión Europea en virtud de lo dispuesto en su artículo 3.2 y el tratamiento se refiera a afectados que se hallen en España, la Agencia Española de Protección de Datos o, en su caso, las autoridades autonómicas de protección de datos podrán imponer al representante, solidariamente con el responsable o encargado del tratamiento, las medidas establecidas en el Reglamento (UE) 2016/679.

Dicha exigencia se entenderá sin perjuicio de la responsabilidad que pudiera en su caso corresponder al responsable o al encargado del tratamiento y del ejercicio por el representante de la acción de repetición frente a quien proceda.

2. Asimismo, en caso de exigencia de responsabilidad en los términos previstos en el artículo 82 del Reglamento (UE) 2016/679, los responsables, encargados y representantes responderán solidariamente de los daños y perjuicios causados.

Artículo 31.- Registro de las actividades de tratamiento.

1. Los responsables y encargados del tratamiento o, en su caso, sus representantes deberán mantener el registro de actividades de tratamiento al que se refiere el artículo 30 del Reglamento (UE) 2016/679, salvo que sea de aplicación la excepción prevista en su apartado 5.

El registro, que podrá organizarse en torno a conjuntos estructurados de datos, deberá especificar, según sus finalidades, las actividades de tratamiento llevadas a cabo y las demás circunstancias establecidas en el citado reglamento.

Cuando el responsable o el encargado del tratamiento hubieran designado un delegado de protección de datos deberán comunicarle cualquier adición, modificación o exclusión en el contenido del registro.

2. Los sujetos enumerados en el artículo 77.1 de esta ley orgánica harán público un inventario de sus actividades de tratamiento accesible por medios electrónicos en el que constará la información establecida en el artículo 30 del Reglamento (UE) 2016/679 y su base legal.

Artículo 32.- Bloqueo de los datos.

1. El responsable del tratamiento estará obligado a bloquear los datos cuando proceda a su rectificación o supresión.

2. El bloqueo de los datos consiste en la identificación y reserva de los mismos, adoptando medidas técnicas y organizativas, para impedir su tratamiento, incluyendo su visualización, excepto para la puesta a disposición de los datos a los jueces y tribunales, el Ministerio Fiscal o las Administraciones Públicas competentes, en particular de las autoridades de protección de datos, para la exigencia de posibles responsabilidades derivadas del tratamiento y solo por el plazo de prescripción de las mismas.

Transcurrido ese plazo deberá procederse a la destrucción de los datos.

3. Los datos bloqueados no podrán ser tratados para ninguna finalidad distinta de la señalada en el apartado anterior.

4. Cuando para el cumplimiento de esta obligación, la configuración del sistema de información no permita el bloqueo o se requiera una adaptación que implique un esfuerzo desproporcionado, se procederá a un copiado seguro de la información de modo que conste evidencia digital, o de otra naturaleza, que permita acreditar la autenticidad de la misma, la fecha del bloqueo y la no manipulación de los datos durante el mismo.

5. La Agencia Española de Protección de Datos y las autoridades autonómicas de protección de datos, dentro del ámbito de sus respectivas competencias, podrán fijar excepciones a la obligación de bloqueo establecida en este artículo, en los supuestos en que, atendida la naturaleza de los datos o el hecho de que se refieran a un número particularmente elevado de afectados, su mera conservación, incluso bloqueados, pudiera generar un riesgo elevado para los derechos de los afectados, así como en aquellos casos en los que la conservación de los datos bloqueados pudiera implicar un coste desproporcionado para el responsable del tratamiento.

CAPÍTULO II.- Encargado del tratamiento

Artículo 33.- Encargado del tratamiento.

1. El acceso por parte de un encargado de tratamiento a los datos personales que resulten necesarios para la prestación de un servicio al responsable no se considerará comunicación de datos siempre que se cumpla lo establecido en el Reglamento (UE) 2016/679, en la presente ley orgánica y en sus normas de desarrollo.

2. Tendrá la consideración de responsable del tratamiento y no la de encargado quien en su propio nombre y sin que conste que actúa por cuenta de otro, establezca relaciones con los afectados aun cuando exista un contrato o acto jurídico con el contenido fijado en el artículo 28.3 del Reglamento (UE) 2016/679. Esta previsión no será aplicable a los encargos de tratamiento efectuados en el marco de la legislación de contratación del sector público.

Tendrá asimismo la consideración de responsable del tratamiento quien figurando como encargado utilizase los datos para sus propias finalidades.

3. El responsable del tratamiento determinará si, cuando finalice la prestación de los servicios del encargado, los datos personales deben ser destruidos, devueltos al responsable o entregados, en su caso, a un nuevo encargado.

No procederá la destrucción de los datos cuando exista una previsión legal que obligue a su conservación, en cuyo caso deberán ser devueltos al responsable, que garantizará su conservación mientras tal obligación persista.

4. El encargado del tratamiento podrá conservar, debidamente bloqueados, los datos en tanto pudieran derivarse responsabilidades de su relación con el responsable del tratamiento.

5. En el ámbito del sector público podrán atribuirse las competencias propias de un encargado del tratamiento a un determinado órgano de la Administración General del Estado, la Administración de las comunidades autónomas, las Entidades que integran la Administración Local o a los Organismos vinculados o dependientes de las mismas mediante la adopción de una norma reguladora de dichas competencias, que deberá incorporar el contenido exigido por el artículo 28.3 del Reglamento (UE) 2016/679.

CAPÍTULO III.- Delegado de protección de datos

Artículo 34.- Designación de un delegado de protección de datos.

1. Los responsables y encargados del tratamiento deberán designar un delegado de protección de datos en los supuestos previstos en el artículo 37.1 del Reglamento (UE) 2016/679 y, en todo caso, cuando se trate de las siguientes entidades:

a) Los colegios profesionales y sus consejos generales.

b) Los centros docentes que ofrezcan enseñanzas en cualquiera de los niveles establecidos en la legislación reguladora del derecho a la educación, así como las Universidades públicas y privadas.

c) Las entidades que exploten redes y presten servicios de comunicaciones electrónicas conforme a lo dispuesto en su legislación específica, cuando traten habitual y sistemáticamente datos personales a gran escala.

d) Los prestadores de servicios de la sociedad de la información cuando elaboren a gran escala perfiles de los usuarios del servicio.

e) Las entidades incluidas en el artículo 1 de la Ley 10/2014, de 26 de junio, de ordenación, supervisión y solvencia de entidades de crédito.

f) Los establecimientos financieros de crédito.

g) Las entidades aseguradoras y reaseguradoras.

h) Las empresas de servicios de inversión, reguladas por la legislación del Mercado de Valores.

i) Los distribuidores y comercializadores de energía eléctrica y los distribuidores y comercializadores de gas natural.

j) Las entidades responsables de ficheros comunes para la evaluación de la solvencia patrimonial y crédito o de los ficheros comunes para la gestión y prevención del fraude, incluyendo a los responsables de los ficheros regulados por la legislación de prevención del blanqueo de capitales y de la financiación del terrorismo.

k) Las entidades que desarrollen actividades de publicidad y prospección comercial, incluyendo las de investigación comercial y de mercados, cuando lleven a cabo tratamientos basados en las preferencias de los afectados o realicen actividades que impliquen la elaboración de perfiles de los mismos.

l) Los centros sanitarios legalmente obligados al mantenimiento de las historias clínicas de los pacientes.

Se exceptúan los profesionales de la salud que, aun estando legalmente obligados al mantenimiento de las historias clínicas de los pacientes, ejerzan su actividad a título individual.

m) Las entidades que tengan como uno de sus objetos la emisión de informes comerciales que puedan referirse a personas físicas.

n) Los operadores que desarrollen la actividad de juego a través de canales electrónicos, informáticos, telemáticos e interactivos, conforme a la normativa de regulación del juego.

ñ) Las empresas de seguridad privada.

o) Las federaciones deportivas cuando traten datos de menores de edad.

2. Los responsables o encargados del tratamiento no incluidos en el párrafo anterior podrán designar de manera voluntaria un delegado de protección de datos, que quedará sometido al régimen establecido en el Reglamento (UE) 2016/679 y en la presente ley orgánica.

3. Los responsables y encargados del tratamiento comunicarán en el plazo de diez días a la Agencia Española de Protección de Datos o, en su caso, a las autoridades autonómicas de protección de datos, las designaciones, nombramientos y ceses de los delegados de protección de datos tanto en los supuestos en que se encuentren obligadas a su designación como en el caso en que sea voluntaria.

4. La Agencia Española de Protección de Datos y las autoridades autonómicas de protección de datos mantendrán, en el ámbito de sus respectivas competencias, una lista actualizada de delegados de protección de datos que será accesible por medios electrónicos.

5. En el cumplimiento de las obligaciones de este artículo los responsables y encargados del tratamiento podrán establecer la dedicación completa o a tiempo parcial del delegado, entre otros criterios, en función del volumen de los tratamientos, la categoría especial de los datos tratados o de los riesgos para los derechos o libertades de los interesados.

Artículo 35.- Cualificación del delegado de protección de datos.

El cumplimiento de los requisitos establecidos en el artículo 37.5 del Reglamento (UE) 2016/679 para la designación del delegado de protección de datos, sea persona física o jurídica, podrá demostrarse, entre otros medios, a través de mecanismos voluntarios de certificación que tendrán particularmente en cuenta la obtención de una titulación universitaria que acredite conocimientos especializados en el derecho y la práctica en materia de protección de datos.

Artículo 36.- Posición del delegado de protección de datos.

1. El delegado de protección de datos actuará como interlocutor del responsable o encargado del tratamiento ante la Agencia Española de Protección de Datos y las autoridades autonómicas de protección de datos. El delegado podrá inspeccionar los procedimientos relacionados con el objeto de la presente ley orgánica y emitir recomendaciones en el ámbito de sus competencias.

2. Cuando se trate de una persona física integrada en la organización del responsable o encargado del tratamiento, el delegado de protección de datos no podrá ser removido ni sancionado por el responsable o el encargado por desempeñar sus funciones salvo que incurriera en dolo o negligencia grave en su ejercicio. Se garantizará la independencia del delegado de protección de datos dentro de la organización, debiendo evitarse cualquier conflicto de intereses.

3. En el ejercicio de sus funciones el delegado de protección de datos tendrá acceso a los datos personales y procesos de tratamiento, no pudiendo oponer a este acceso el responsable o el encargado del tratamiento la existencia de cualquier deber de confidencialidad o secreto, incluyendo el previsto en el artículo 5 de esta ley orgánica.

4. Cuando el delegado de protección de datos aprecie la existencia de una vulneración relevante en materia de protección de datos lo documentará y lo comunicará inmediatamente a los órganos de administración y dirección del responsable o el encargado del tratamiento.

Artículo 37.- Intervención del delegado de protección de datos en caso de reclamación ante las autoridades de protección de datos.

1. Cuando el responsable o el encargado del tratamiento hubieran designado un delegado de protección de datos el afectado podrá, con carácter previo a la presentación de una reclamación contra aquéllos ante la Agencia Española de Protección de Datos o, en su caso, ante las autoridades autonómicas de protección de datos, dirigirse al delegado de protección de datos de la entidad contra la que se reclame.

En este caso, el delegado de protección de datos comunicará al afectado la decisión que se hubiera adoptado en el plazo máximo de dos meses a contar desde la recepción de la reclamación.

2. Cuando el afectado presente una reclamación ante la Agencia Española de Protección de Datos o, en su caso, ante las autoridades autonómicas de protección de datos, aquellas podrán remitir la reclamación al delegado de protección de datos a fin de que este responda en el plazo de un mes.

Si transcurrido dicho plazo el delegado de protección de datos no hubiera comunicado a la autoridad de protección de datos competente la respuesta dada a la reclamación, dicha autoridad continuará el procedimiento con arreglo a lo establecido en el Título VIII de esta ley orgánica y en sus normas de desarrollo.

3. El procedimiento ante la Agencia Española de Protección de Datos será el establecido en el Título VIII de esta ley orgánica y en sus normas de desarrollo. Asimismo, las comunidades autónomas regularán el procedimiento correspondiente ante sus autoridades autonómicas de protección de datos.

CAPÍTULO IV.- Códigos de conducta y certificación

Artículo 38. Códigos de conducta.

1. Los códigos de conducta regulados por la sección 5.ª del Capítulo IV del Reglamento (UE) 2016/679 serán vinculantes para quienes se adhieran a los mismos.

Dichos códigos podrán dotarse de mecanismos de resolución extrajudicial de conflictos.

2. Dichos códigos podrán promoverse, además de por las asociaciones y organismos a los que se refiere el artículo 40.2 del Reglamento (UE) 2016/679, por empresas o grupos de empresas así como por los responsables o encargados a los que se refiere el artículo 77.1 de esta ley orgánica.

Asimismo, podrán ser promovidos por los organismos o entidades que asuman las funciones de supervisión y resolución extrajudicial de conflictos a los que se refiere el artículo 41 del Reglamento (UE) 2016/679.

Los responsables o encargados del tratamiento que se adhieran al código de conducta se obligan a someter al organismo o entidad de supervisión las reclamaciones que les fueran formuladas por los afectados en relación con los tratamientos de datos incluidos en su ámbito de aplicación en caso de considerar que no procede atender a lo solicitado en la reclamación, sin perjuicio de lo dispuesto en el artículo 37 de esta ley orgánica. Además, sin menoscabo de las competencias atribuidas por el Reglamento (UE) 2016/679 a las autoridades de protección de datos, podrán voluntariamente y antes de llevar a cabo el tratamiento, someter al citado organismo o entidad de supervisión la verificación de la conformidad del mismo con las materias sujetas al código de conducta.

En caso de que el organismo o entidad de supervisión rechace o desestime la reclamación, o si el responsable o encargado del tratamiento no somete la reclamación a su decisión, el afectado podrá formularla ante la Agencia Española de Protección de Datos o, en su caso, las autoridades autonómicas de protección de datos.

La autoridad de protección de datos competente verificará que los organismos o entidades que promuevan los códigos de conducta han dotado a estos códigos de organismos de supervisión que reúnan los requisitos establecidos en el artículo 41.2 del Reglamento (UE) 2016/679.

3. Los códigos de conducta serán aprobados por la Agencia Española de Protección de Datos o, en su caso, por la autoridad autonómica de protección de datos competente.

4. La Agencia Española de Protección de Datos o, en su caso, las autoridades autonómicas de protección de datos someterán los proyectos de código al mecanismo de coherencia mencionado en el artículo 63 de Reglamento (UE) 2016/679 en los supuestos en que ello proceda según su artículo 40.7. El procedimiento quedará suspendido en tanto el Comité Europeo de Protección de Datos no emita el dictamen al que se refieren los artículos 64.1.b) y 65.1.c) del citado reglamento.

Cuando sea una autoridad autonómica de protección de datos la que someta el proyecto de código al mecanismo de coherencia, se estará a lo dispuesto en el artículo 60 de esta ley orgánica.

5. La Agencia Española de Protección de Datos y las autoridades autonómicas de protección de datos mantendrán registros de los códigos de conducta aprobados por las mismas, que estarán interconectados entre sí y coordinados con el registro gestionado por el Comité Europeo de Protección de Datos conforme al artículo 40.11 del citado reglamento.

El registro será accesible a través de medios electrónicos.

6. Mediante real decreto se establecerán el contenido del registro y las especialidades del procedimiento de aprobación de los códigos de conducta.

Artículo 39.- Acreditación de instituciones de certificación.

Sin perjuicio de las funciones y poderes de acreditación de la autoridad de control competente en virtud de los artículos 57 y 58 del Reglamento (UE) 2016/679, la acreditación de las instituciones de certificación a las que se refiere el artículo 43.1 del citado reglamento podrá ser llevada a cabo por la Entidad Nacional de Acreditación (ENAC), que comunicará a la Agencia Española de Protección de Datos y a las autoridades de protección de datos de las comunidades autónomas las concesiones, denegaciones o revocaciones de las acreditaciones, así como su motivación.

TÍTULO VI.- Transferencias internacionales de datos

Artículo 40.- Régimen de las transferencias internacionales de datos.

Las transferencias internacionales de datos se regirán por lo dispuesto en el Reglamento (UE) 2016/679, en la presente ley orgánica y sus normas de desarrollo aprobadas por el Gobierno, y en las circulares de la Agencia Española de Protección de Datos y de las autoridades autonómicas de protección de datos, en el ámbito de sus respectivas competencias.

En todo caso se aplicarán a los tratamientos en que consista la propia transferencia las disposiciones contenidas en dichas normas, en particular las que regulan los principios de protección de datos.

Artículo 41.- Supuestos de adopción por la Agencia Española de Protección de Datos.

1. La Agencia Española de Protección de Datos y las autoridades autonómicas de protección de datos podrán adoptar, conforme a lo dispuesto en el artículo 46.2.c) del Reglamento (UE) 2016/679, cláusulas contractuales tipo para la realización de transferencias internacionales de datos, que se someterán previamente al dictamen del Comité Europeo de Protección de Datos previsto en el artículo 64 del citado reglamento.

2. La Agencia Española de Protección de Datos y las autoridades autonómicas de protección de datos podrán aprobar normas corporativas vinculantes de acuerdo con lo previsto en el artículo 47 del Reglamento (UE) 2016/679.

El procedimiento se iniciará a instancia de una entidad situada en España y tendrá una duración máxima de nueve meses. Quedará suspendido como consecuencia de la remisión del expediente al Comité Europeo de Protección de Datos para que emita el dictamen al que se refiere el artículo 64.1.f) del Reglamento (UE) 2016/679, y continuará tras su notificación a la Agencia Española de Protección de Datos o a la autoridad autonómica de protección de datos competente.

Artículo 42.- Supuestos sometidos a autorización previa de las autoridades de protección de datos.

1. Las transferencias internacionales de datos a países u organizaciones internacionales que no cuenten con decisión de adecuación aprobada por la Comisión o que no se amparen en alguna de las garantías previstas en el artículo anterior y en el artículo 46.2 del Reglamento (UE) 2016/679, requerirán una previa autorización de la Agencia Española de Protección de Datos o, en su caso, autoridades autonómicas de protección de datos, que podrá otorgarse en los siguientes supuestos:

a) Cuando la transferencia pretenda fundamentarse en la aportación de garantías adecuadas con fundamento en cláusulas contractuales que no correspondan a las cláusulas tipo previstas en el artículo 46.2, letras c) y d), del Reglamento (UE) 2016/679.

b) Cuando la transferencia se lleve a cabo por alguno de los responsables o encargados a los que se refiere el artículo 77.1 de esta ley orgánica y se funde en disposiciones incorporadas a acuerdos internacionales no normativos con otras autoridades u organismos públicos de terceros Estados, que incorporen derechos efectivos y exigibles para los afectados, incluidos los memorandos de entendimiento.

El procedimiento tendrá una duración máxima de seis meses.

2. La autorización quedará sometida a la emisión por el Comité Europeo de Protección de Datos del dictamen al que se refieren los artículos 64.1.e), 64.1.f) y 65.1.c) del Reglamento (UE) 2016/679. La remisión del expediente al citado comité implicará la suspensión del procedimiento hasta que el dictamen sea notificado a la Agencia Española de Protección de Datos o, por conducto de la misma, a la autoridad de control competente, en su caso.

Artículo 43.- Supuestos sometidos a información previa a la autoridad de protección de datos competente.

Los responsables del tratamiento deberán informar a la Agencia Española de Protección de Datos o, en su caso, a las autoridades autonómicas de protección de datos, de cualquier transferencia internacional de datos que pretendan llevar a cabo sobre la base de su necesidad para fines relacionados con intereses legítimos imperiosos perseguidos por aquéllos y la concurrencia del resto de los requisitos previstos en el último párrafo del artículo 49.1 del Reglamento (UE) 2016/679. Asimismo, informarán a los afectados de la transferencia y de los intereses legítimos imperiosos perseguidos.

Esta información deberá facilitarse con carácter previo a la realización de la transferencia.

Lo dispuesto en este artículo no será de aplicación a las actividades llevadas a cabo por las autoridades públicas en el ejercicio de sus poderes públicos, de acuerdo con el artículo 49.3 del Reglamento (UE) 2016/679.

TÍTULO VII.- Autoridades de protección de datos

CAPÍTULO I.- La Agencia Española de Protección de Datos

Sección 1.ª Disposiciones generales

Artículo 44. Disposiciones generales.

1. La Agencia Española de Protección de Datos es una autoridad administrativa independiente de ámbito estatal, de las previstas en la Ley 40/2015, de 1 de octubre, de Régimen Jurídico del Sector Público, con personalidad jurídica y plena capacidad pública y privada, que actúa con plena independencia de los poderes públicos en el ejercicio de sus funciones.

Su denominación oficial, de conformidad con lo establecido en el artículo 109.3 de la Ley 40/2015, de 1 de octubre, de Régimen Jurídico del Sector Público, será «Agencia Española de Protección de Datos, Autoridad Administrativa Independiente».

Se relaciona con el Gobierno a través del Ministerio de Justicia.

2. La Agencia Española de Protección de Datos tendrá la condición de representante común de las autoridades de protección de datos del Reino de España en el Comité Europeo de Protección de Datos.

3. La Agencia Española de Protección de Datos y el Consejo General del Poder Judicial colaborarán en aras del adecuado ejercicio de las respectivas competencias que la Ley Orgánica 6/1985, de 1 julio, del Poder Judicial, les atribuye en materia de protección de datos personales en el ámbito de la Administración de Justicia.

Artículo 45.- Régimen jurídico.

1. La Agencia Española de Protección de Datos se rige por lo dispuesto en el Reglamento (UE) 2016/679, la presente ley orgánica y sus disposiciones de desarrollo.

Supletoriamente, en cuanto sea compatible con su plena independencia y sin perjuicio de lo previsto en el artículo 63.2 de esta ley orgánica, se regirá por las normas citadas en el artículo 110.1 de la Ley 40/2015, de 1 de octubre, de Régimen Jurídico del Sector Público.

2. El Gobierno, a propuesta de la Agencia Española de Protección de Datos, aprobará su Estatuto mediante real decreto.

Artículo 46.- Régimen económico presupuestario y de personal.

1. La Agencia Española de Protección de Datos elaborará y aprobará su presupuesto y lo remitirá al Gobierno para que sea integrado, con independencia, en los Presupuestos Generales del Estado.

2. El régimen de modificaciones y de vinculación de los créditos de su presupuesto será el establecido en el Estatuto de la Agencia Española de Protección de Datos.

Corresponde a la Presidencia de la Agencia Española de Protección de Datos autorizar las modificaciones presupuestarias que impliquen hasta un tres por ciento de la cifra inicial de su presupuesto total de gastos, siempre que no se incrementen los créditos para gastos de personal. Las restantes modificaciones que no excedan de un cinco por ciento del presupuesto serán autorizadas por el Ministerio de Hacienda y, en los demás casos, por el Gobierno.

3. La Agencia Española de Protección de Datos contará para el cumplimiento de sus fines con las asignaciones que se establezcan con cargo a los Presupuestos Generales del Estado, los bienes y valores que constituyan su patrimonio y los ingresos, ordinarios y extraordinarios derivados del ejercicio de sus actividades, incluidos los derivados del ejercicio de las potestades establecidos en el artículo 58 del Reglamento (UE) 2016/679.

4. El resultado positivo de sus ingresos se destinará por la Agencia Española de Protección de Datos a la dotación de sus reservas con el fin de garantizar su plena independencia.

5. El personal al servicio de la Agencia Española de Protección de Datos será funcionario o laboral y se regirá por lo previsto en el texto refundido de la Ley del Estatuto Básico del Empleado Público, aprobado por Real Decreto Legislativo 5/2015, de 30 de octubre, y demás normativa reguladora de los funcionarios públicos y, en su caso, por la normativa laboral.

6. La Agencia Española de Protección Datos elaborará y aprobará su relación de puestos de trabajo, en el marco de los criterios establecidos por el Ministerio de Hacienda, respetando el límite de gasto de personal establecido en el presupuesto. En dicha relación de puestos de trabajo constarán, en todo caso, aquellos puestos que deban ser desempeñados en exclusiva por funcionarios públicos, por consistir en el ejercicio de las funciones que impliquen la participación directa o indirecta en el ejercicio de potestades públicas y la salvaguarda de los intereses generales del Estado y de las Administraciones Públicas.

7. Sin perjuicio de las competencias atribuidas al Tribunal de Cuentas, la gestión económico-financiera de la Agencia Española de Protección de Datos estará sometida al control de la Intervención General de la Administración del Estado en los términos que establece la Ley 47/2003, de 26 de noviembre, General Presupuestaria.

Artículo 47.- Funciones y potestades de la Agencia Española de Protección de Datos.

Corresponde a la Agencia Española de Protección de Datos supervisar la aplicación de esta ley orgánica y del Reglamento (UE) 2016/679 y, en particular, ejercer las funciones establecidas en el artículo 57 y las potestades previstas en el artículo 58 del mismo reglamento, en la presente ley orgánica y en sus disposiciones de desarrollo.

Asimismo, corresponde a la Agencia Española de Protección de Datos el desempeño de las funciones y potestades que le atribuyan otras leyes o normas de Derecho de la Unión Europea.

Artículo 48.- La Presidencia de la Agencia Española de Protección de Datos.

1. La Presidencia de la Agencia Española de Protección de Datos la dirige, ostenta su representación y dicta sus resoluciones, circulares y directrices.

2. La Presidencia de la Agencia Española de Protección de Datos estará auxiliada por un Adjunto en el que podrá delegar sus funciones, a excepción de las relacionadas con los procedimientos regulados por el Título VIII de esta ley orgánica, y que la sustituirá en el ejercicio de las mismas en los términos previstos en el Estatuto Orgánico de la Agencia Española de Protección de Datos.

Ambos ejercerán sus funciones con plena independencia y objetividad y no estarán sujetos a instrucción alguna en su desempeño. Les será aplicable la legislación reguladora del ejercicio del alto cargo de la Administración General del Estado.

3. La Presidencia de la Agencia Española de Protección de Datos y su Adjunto serán nombrados por el Gobierno, a propuesta del Ministerio de Justicia, entre personas de reconocida competencia profesional, en particular en materia de protección de datos.

Dos meses antes de producirse la expiración del mandato o, en el resto de las causas de cese, cuando se haya producido éste, el Ministerio de Justicia ordenará la publicación en el Boletín Oficial del Estado de la convocatoria pública de candidatos.

Previa evaluación del mérito, capacidad, competencia e idoneidad de los candidatos, el Gobierno remitirá al Congreso de los Diputados una propuesta de Presidencia y Adjunto acompañada de un informe justificativo que, tras la celebración de la preceptiva audiencia de los candidatos, deberá ser ratificada por la Comisión de Justicia en votación pública por mayoría de tres quintos de sus miembros en primera votación o, de no alcanzarse ésta, por mayoría absoluta en segunda votación, que se realizará inmediatamente después de la primera. En este último supuesto, los votos favorables deberán proceder de Diputados pertenecientes, al menos, a dos grupos parlamentarios diferentes.

4. La Presidencia y el Adjunto de la Agencia Española de Protección de Datos serán nombrados por el Consejo de Ministros mediante real decreto.

5. El mandato de la Presidencia y del Adjunto de la Agencia Española de Protección de Datos tiene una duración de cinco años y puede ser renovado para otro período de igual duración.

La Presidencia y el Adjunto solo cesarán antes de la expiración de su mandato, a petición propia o por separación acordada por el Consejo de Ministros, por:

a) Incumplimiento grave de sus obligaciones,

b) incapacidad sobrevenida para el ejercicio de su función,

c) incompatibilidad, o

d) condena firme por delito doloso.

En los supuestos previstos en las letras a), b) y c) será necesaria la ratificación de la separación por las mayorías parlamentarias previstas en el apartado 3 de este artículo.

6. Los actos y disposiciones dictados por la Presidencia de la Agencia Española de Protección de Datos ponen fin a la vía administrativa, siendo recurribles, directamente, ante la Sala de lo Contencioso-administrativo de la Audiencia Nacional.

Artículo 49.- Consejo Consultivo de la Agencia Española de Protección de Datos.

1. La Presidencia de la Agencia Española de Protección de Datos estará asesorada por un Consejo Consultivo compuesto por los siguientes miembros:

a) Un Diputado, propuesto por el Congreso de los Diputados.

b) Un Senador, propuesto por el Senado.

c) Un representante designado por el Consejo General del Poder Judicial.

d) Un representante de la Administración General del Estado con experiencia en la materia, propuesto por el Ministro de Justicia.

e) Un representante de cada Comunidad Autónoma que haya creado una Autoridad de protección de datos en su ámbito territorial, propuesto de acuerdo con lo que establezca la respectiva Comunidad Autónoma.

f) Un experto propuesto por la Federación Española de Municipios y Provincias.

g) Un experto propuesto por el Consejo de Consumidores y Usuarios.

h) Dos expertos propuestos por las Organizaciones Empresariales.

i) Un representante de los profesionales de la protección de datos y de la privacidad, propuesto por la asociación de ámbito estatal con mayor número de asociados.

j) Un representante de los organismos o entidades de supervisión y resolución extrajudicial de conflictos previstos en el Capítulo IV del Título V, propuesto por el Ministro de Justicia.

k) Un experto, propuesto por la Conferencia de Rectores de las Universidades Españolas.

l) Un representante de las organizaciones que agrupan a los Consejos Generales, Superiores y Colegios Profesionales de ámbito estatal de las diferentes profesiones colegiadas, propuesto por el Ministro de Justicia.

m) Un representante de los profesionales de la seguridad de la información, propuesto por la asociación de ámbito estatal con mayor número de asociados.

n) Un experto en transparencia y acceso a la información pública propuesto por el Consejo de Transparencia y Buen Gobierno.

ñ) Dos expertos propuestos por las organizaciones sindicales más representativas.

2. A los efectos del apartado anterior, la condición de experto requerirá acreditar conocimientos especializados en el Derecho y la práctica en materia de protección de datos mediante el ejercicio profesional o académico.

3. Los miembros del Consejo Consultivo serán nombrados por orden del Ministro de Justicia, publicada en el Boletín Oficial del Estado.

4. El Consejo Consultivo se reunirá cuando así lo disponga la Presidencia de la Agencia Española de Protección de Datos y, en todo caso, una vez al semestre.

5. Las decisiones tomadas por el Consejo Consultivo no tendrán en ningún caso carácter vinculante.

6. En todo lo no previsto por esta ley orgánica, el régimen, competencias y funcionamiento del Consejo Consultivo serán los establecidos en el Estatuto Orgánico de la Agencia Española de Protección de Datos.

Artículo 50.- Publicidad.

La Agencia Española de Protección de Datos publicará las resoluciones de su Presidencia que declaren haber lugar o no a la atención de los derechos reconocidos en los artículos 15 a 22 del Reglamento (UE) 2016/679, las que pongan fin a los procedimientos de reclamación, las que archiven las actuaciones previas de investigación, las que sancionen con apercibimiento a las entidades a que se refiere el artículo 77.1 de esta ley orgánica, las que impongan medidas cautelares y las demás que disponga su Estatuto.

Sección 2.ª- Potestades de investigación y planes de auditoría preventiva

Artículo 51. Ámbito y personal competente.

1. La Agencia Española de Protección de Datos desarrollará su actividad de investigación a través de las actuaciones previstas en el Título VIII y de los planes de auditoría preventivas.

2. La actividad de investigación se llevará a cabo por los funcionarios de la Agencia Española de Protección de Datos o por funcionarios ajenos a ella habilitados expresamente por su Presidencia.

3. En los casos de actuaciones conjuntas de investigación conforme a lo dispuesto en el artículo 62 del Reglamento (UE) 2016/679, el personal de las autoridades de control de otros Estados Miembros de Unión Europea que colabore con la Agencia Española de Protección de Datos ejercerá sus facultades con arreglo a lo previsto en la presente ley orgánica y bajo la orientación y en presencia del personal de esta.

4. Los funcionarios que desarrollen actividades de investigación tendrán la consideración de agentes de la autoridad en el ejercicio de sus funciones, y estarán obligados a guardar secreto sobre las informaciones que conozcan con ocasión de dicho ejercicio, incluso después de haber cesado en él.

Artículo 52.- Deber de colaboración.

1. Las Administraciones Públicas, incluidas las tributarias y de la Seguridad Social, y los particulares estarán obligados a proporcionar a la Agencia Española de Protección de Datos los datos, informes, antecedentes y justificantes necesarios para llevar a cabo su actividad de investigación.

Cuando la información contenga datos personales la comunicación de dichos datos estará amparada por lo dispuesto en el artículo 6.1 c) del Reglamento (UE) 2016/679.

2. En el marco de las actuaciones previas de investigación, cuando no haya podido realizar la identificación por otros medios, la Agencia Española de Protección de Datos podrá recabar de las Administraciones Públicas, incluidas las tributarias y de la Seguridad Social, las informaciones y datos que resulten imprescindibles con la exclusiva finalidad de lograr la identificación de los responsables de las conductas que pudieran ser constitutivas de infracción del Reglamento (UE) 2016/679 y de la presente ley orgánica.

En el supuesto de las Administraciones tributarias y de la Seguridad Social, la información se limitará a la que resulte necesaria para poder identificar inequívocamente contra quién debe dirigirse la actuación de la Agencia Española de Protección de Datos en los supuestos de creación de entramados societarios que dificultasen el conocimiento directo del presunto responsable de la conducta contraria al Reglamento (UE) 2016/679 y a la presente ley orgánica.

3. Cuando no haya podido realizar la identificación por otros medios, la Agencia Española de Protección de Datos podrá recabar de los operadores que presten servicios de comunicaciones electrónicas disponibles al público y de los prestadores de servicios de la sociedad de la información los datos que obren en su poder y que resulten imprescindibles para la identificación del presunto responsable de la conducta contraria al Reglamento (UE) 2016/679 y a la presente ley orgánica cuando se hubiere llevado a cabo mediante la utilización de un servicio de la sociedad de la información o la realización de una comunicación electrónica. A tales efectos, los datos que la Agencia Española de Protección de Datos podrá recabar al amparo de este apartado son los siguientes:

a) Cuando la conducta se hubiera realizado mediante la utilización de un servicio de telefonía fija o móvil:

1.º El número de teléfono de origen de la llamada en caso de que el mismo se hubiese ocultado.

2.º El nombre, número de documento identificativo y dirección del abonado o usuario registrado al que corresponda ese número de teléfono.

3.º La mera confirmación de que se ha realizado una llamada específica entre dos números en una determinada fecha y hora.

b) Cuando la conducta se hubiera realizado mediante la utilización de un servicio de la sociedad de la información:

1.º La identificación de la dirección de protocolo de Internet desde la que se hubiera llevado a cabo la conducta y la fecha y hora de su realización.

2.º Si la conducta se hubiese llevado a cabo mediante correo electrónico, la identificación de la dirección de protocolo de Internet desde la que se creó la cuenta de correo y la fecha y hora en que la misma fue creada.

3.º El nombre, número de documento identificativo y dirección del abonado o del usuario registrado al que se le hubiera asignado la dirección de Protocolo de Internet a la que se refieren los dos párrafos anteriores.

Estos datos deberán ser cedidos, previo requerimiento motivado de la Agencia Española de Protección de Datos, exclusivamente en el marco de actuaciones de investigación iniciadas como consecuencia de una denuncia presentada por un afectado respecto de una conducta de una persona jurídica o respecto a la utilización de sistemas que permitan la divulgación sin restricciones de datos personales. En el resto de los supuestos la cesión de estos datos requerirá la previa obtención de autorización judicial otorgada conforme a las normas procesales cuando resultara exigible.

Quedan excluidos de lo previsto en este apartado los datos de tráfico que los operadores estuviesen tratando con la exclusiva finalidad de dar cumplimiento a las obligaciones previstas en la Ley 25/2007, de 18 de octubre, de conservación de datos relativos a las comunicaciones electrónicas y a las redes públicas de comunicaciones, cuya cesión solamente podrá tener lugar de acuerdo con lo dispuesto en ella, previa autorización judicial solicitada por alguno de los agentes facultados a los que se refiere el artículo 6 de dicha ley.

Artículo 53.- Alcance de la actividad de investigación.

1. Quienes desarrollen la actividad de investigación podrán recabar las informaciones precisas para el cumplimiento de sus funciones, realizar inspecciones, requerir la exhibición o el envío de los documentos y datos necesarios, examinarlos en el lugar en que se encuentren depositados o en donde se lleven a cabo los tratamientos, obtener copia de ellos, inspeccionar los equipos físicos y lógicos y requerir la ejecución de tratamientos y programas o procedimientos de gestión y soporte del tratamiento sujetos a investigación.

2. Cuando fuese necesario el acceso por el personal que desarrolla la actividad de investigación al domicilio constitucionalmente protegido del inspeccionado, será preciso contar con su consentimiento o haber obtenido la correspondiente autorización judicial.

3. Cuando se trate de órganos judiciales u oficinas judiciales el ejercicio de las facultades de inspección se efectuará a través y por mediación del Consejo General del Poder Judicial.

Artículo 54.- Planes de auditoría.

1. La Presidencia de la Agencia Española de Protección de Datos podrá acordar la realización de planes de auditoría preventiva, referidos a los tratamientos de un sector concreto de actividad. Tendrán por objeto el análisis del cumplimiento de las disposiciones del Reglamento (UE) 2016/679 y de la presente ley orgánica, a partir de la realización de actividades de investigación sobre entidades pertenecientes al sector inspeccionado o sobre los responsables objeto de la auditoría.

2. A resultas de los planes de auditoría, la Presidencia de la Agencia Española de Protección de Datos podrá dictar las directrices generales o específicas para un concreto responsable o encargado de los tratamientos precisas para asegurar la plena adaptación del sector o responsable al Reglamento (UE) 2016/679 y a la presente ley orgánica.

En la elaboración de dichas directrices la Presidencia de la Agencia Española de Protección de Datos podrá solicitar la colaboración de los organismos de supervisión de los códigos de conducta y de resolución extrajudicial de conflictos, si los hubiere.

3. Las directrices serán de obligado cumplimiento para el sector o responsable al que se refiera el plan de auditoría.

Sección 3.ª- Otras potestades de la Agencia Española de Protección de Datos

Artículo 55.- Potestades de regulación. Circulares de la Agencia Española de Protección de Datos.

1. La Presidencia de la Agencia Española de Protección de Datos podrá dictar disposiciones que fijen los criterios a que responderá la actuación de esta autoridad en la aplicación de lo dispuesto en el Reglamento (UE) 2016/679 y en la presente ley orgánica, que se denominarán «Circulares de la Agencia Española de Protección de Datos».

2. Su elaboración se sujetará al procedimiento establecido en el Estatuto de la Agencia Española de Protección de Datos, que deberá prever los informes técnicos y jurídicos que fueran necesarios y la audiencia a los interesados.

3. Las circulares serán obligatorias una vez publicadas en el Boletín Oficial del Estado.

Artículo 56.- Acción exterior.

1. Corresponde a la Agencia Española de Protección de Datos la titularidad y el ejercicio de las funciones relacionadas con la acción exterior del Estado en materia de protección de datos.

Asimismo a las comunidades autónomas, a través de las autoridades autonómicas de protección de datos, les compete ejercitar las funciones como sujetos de la acción exterior en el marco de sus competencias de conformidad con lo dispuesto en la Ley 2/2014, de 25 de marzo, de la Acción y del Servicio Exterior del Estado, así como celebrar acuerdos internacionales administrativos en ejecución y concreción de un tratado internacional y acuerdos no normativos con los órganos análogos de otros sujetos de derecho internacional, no vinculantes jurídicamente para quienes los suscriben, sobre materias de su competencia en el marco de la Ley 25/2014, de 27 de noviembre, de Tratados y otros Acuerdos Internacionales.

2. La Agencia Española de Protección de Datos es el organismo competente para la protección de las personas físicas en lo relativo al tratamiento de datos personales derivado de la aplicación de cualquier Convenio Internacional en el que sea parte el Reino de España que atribuya a una autoridad nacional de control esa competencia y la representante común de las autoridades de Protección de Datos en el Comité Europeo de Protección de Datos, conforme a lo dispuesto en el artículo 68.4 del Reglamento (UE) 2016/679.

La Agencia Española de Protección de Datos informará a las autoridades autonómicas de protección de datos acerca de las decisiones adoptadas en el Comité Europeo de Protección de Datos y recabará su parecer cuando se trate de materias de su competencia.

3. Sin perjuicio de lo dispuesto en el apartado 1, la Agencia Española de Protección de Datos:

a) Participará en reuniones y foros internacionales de ámbito distinto al de la Unión Europea establecidos de común acuerdo por las autoridades de control independientes en materia de protección de datos.

b) Participará, como autoridad española, en las organizaciones internacionales competentes en materia de protección de datos, en los comités o grupos de trabajo, de estudio y de colaboración de organizaciones internacionales que traten materias que afecten al derecho fundamental a la protección de datos personales y en otros foros o grupos de trabajo internacionales, en el marco de la acción exterior del Estado.

c) Colaborará con autoridades, instituciones, organismos y Administraciones de otros Estados a fin de impulsar, promover y desarrollar el derecho fundamental a la protección de datos, en particular en el ámbito iberoamericano, pudiendo suscribir acuerdos internacionales administrativos y no normativos en la materia.

CAPÍTULO II.- Autoridades autonómicas de protección de datos

Sección 1.ª- Disposiciones generales

Artículo 57.- Autoridades autonómicas de protección de datos.

1. Las autoridades autonómicas de protección de datos personales podrán ejercer, las funciones y potestades establecidas en los artículos 57 y 58 del Reglamento (UE) 2016/679, de acuerdo con la normativa autonómica, cuando se refieran a:

a) Tratamientos de los que sean responsables las entidades integrantes del sector público de la correspondiente Comunidad Autónoma o de las Entidades Locales incluidas en su ámbito territorial o quienes presten servicios a través de cualquier forma de gestión directa o indirecta.

b) Tratamientos llevados a cabo por personas físicas o jurídicas para el ejercicio de las funciones públicas en materias que sean competencia de la correspondiente Administración Autonómica o Local.

c) Tratamientos que se encuentren expresamente previstos, en su caso, en los respectivos Estatutos de Autonomía.

2. Las autoridades autonómicas de protección de datos podrán dictar, en relación con los tratamientos sometidos a su competencia, circulares con el alcance y los efectos establecidos para la Agencia Española de Protección de Datos en el artículo 55 de esta ley orgánica.

Artículo 58.- Cooperación institucional.

La Presidencia de la Agencia Española de Protección de Datos convocará, por iniciativa propia o cuando lo solicite otra autoridad, a las autoridades autonómicas de protección de datos para contribuir a la aplicación coherente del Reglamento (UE) 2016/679 y de la presente ley orgánica. En todo caso, se celebrarán reuniones semestrales de cooperación.

La Presidencia de la Agencia Española de Protección de Datos y las autoridades autonómicas de protección de datos podrán solicitar y deberán intercambiarse mutuamente la información necesaria para el cumplimiento de sus funciones y, en particular, la relativa a la actividad del Comité Europeo de Protección de Datos. Asimismo, podrán constituir grupos de trabajo para tratar asuntos específicos de interés común.

Artículo 59.- Tratamientos contrarios al Reglamento (UE) 2016/679.

Cuando la Presidencia de la Agencia Española de Protección de Datos considere que un tratamiento llevado a cabo en materias que fueran competencia de las autoridades autonómicas de protección de datos vulnera el Reglamento (UE) 2016/679 podrá requerirlas a que adopten, en el plazo de un mes, las medidas necesarias para su cesación.

Si la autoridad autonómica no atendiere en plazo el requerimiento o las medidas adoptadas no supusiesen la cesación en el tratamiento ilícito, la Agencia Española de Protección de Datos podrá ejercer las acciones que procedan ante la jurisdicción contencioso-administrativa.

Sección 2.ª- Coordinación en el marco de los procedimientos establecidos en el Reglamento (UE) 2016/679

Artículo 60.- Coordinación en caso de emisión de dictamen por el Comité Europeo de Protección de Datos.

Se practicarán por conducto de la Agencia Española de Protección de Datos todas las comunicaciones entre el Comité Europeo de Protección de Datos y las autoridades autonómicas de protección de datos cuando éstas, como autoridades competentes, deban someter su proyecto de decisión al citado comité o le soliciten el examen de un asunto en virtud de lo establecido en los apartados 1 y 2 del artículo 64 del Reglamento (UE) 2016/679.

En estos casos, la Agencia Española de Protección de Datos será asistida por un representante de la Autoridad autonómica en su intervención ante el Comité.

Artículo 61.- Intervención en caso de tratamientos transfronterizos.

1. Las autoridades autonómicas de protección de datos ostentarán la condición de autoridad de control principal o interesada en el procedimiento establecido por el artículo 60 del Reglamento (UE) 2016/679 cuando se refiera a un tratamiento previsto en el artículo 57 de esta ley orgánica que se llevara a cabo por un responsable o encargado del tratamiento de los previstos en el artículo 56 del Reglamento (UE) 2016/679, salvo que desarrollase significativamente tratamientos de la misma naturaleza en el resto del territorio español.

2. Corresponderá en estos casos a las autoridades autonómicas intervenir en los procedimientos establecidos en el artículo 60 del Reglamento (UE) 2016/679, informando a la Agencia Española de Protección de Datos sobre su desarrollo en los supuestos en que deba aplicarse el mecanismo de coherencia.

Artículo 62.- Coordinación en caso de resolución de conflictos por el Comité Europeo de Protección de Datos.

1. Se practicarán por conducto de la Agencia Española de Protección de Datos todas las comunicaciones entre el Comité Europeo de Protección de Datos y las autoridades autonómicas de protección de datos cuando estas, como autoridades principales, deban solicitar del citado Comité la emisión de una decisión vinculante según lo previsto en el artículo 65 del Reglamento (UE) 2016/679.

2. Las autoridades autonómicas de protección de datos que tengan la condición de autoridad interesada no principal en un procedimiento de los previstos en el artículo 65 del Reglamento (UE) 2016/679 informarán a la Agencia Española de Protección de Datos cuando el asunto sea remitido al Comité Europeo de Protección de Datos, facilitándole la documentación e información necesarias para su tramitación.

La Agencia Española de Protección de Datos será asistida por un representante de la autoridad autonómica interesada en su intervención ante el mencionado comité.

TÍTULO VIII.- Procedimientos en caso de posible vulneración de la normativa de protección de datos

Artículo 63.- Régimen jurídico.

1. Las disposiciones de este Título serán de aplicación a los procedimientos tramitados por la Agencia Española de Protección de Datos en los supuestos en los que un afectado reclame que no ha sido atendida su solicitud de ejercicio de los derechos reconocidos en los artículos 15 a 22 del Reglamento (UE) 2016/679, así como en los que aquella investigue la existencia de una posible infracción de lo dispuesto en el mencionado reglamento y en la presente ley orgánica.

2. Los procedimientos tramitados por la Agencia Española de Protección de Datos se regirán por lo dispuesto en el Reglamento (UE) 2016/679, en la presente ley orgánica, por las disposiciones reglamentarias dictadas en su desarrollo y, en cuanto no las contradigan, con carácter subsidiario, por las normas generales sobre los procedimientos administrativos.

3. El Gobierno regulará por real decreto los procedimientos que tramite la Agencia Española de Protección de Datos al amparo de este Título, asegurando en todo caso los derechos de defensa y audiencia de los interesados.

Artículo 64.- Forma de iniciación del procedimiento y duración.

1. Cuando el procedimiento se refiera exclusivamente a la falta de atención de una solicitud de ejercicio de los derechos establecidos en los artículos 15 a 22 del Reglamento (UE) 2016/679, se iniciará por acuerdo de admisión a trámite, que se adoptará conforme a lo establecido en el artículo 65 de esta ley orgánica.

En este caso el plazo para resolver el procedimiento será de seis meses a contar desde la fecha en que hubiera sido notificado al reclamante el acuerdo de admisión a trámite. Transcurrido ese plazo, el interesado podrá considerar estimada su reclamación.

2. Cuando el procedimiento tenga por objeto la determinación de la posible existencia de una infracción de lo dispuesto en el Reglamento (UE) 2016/679 y en la presente ley orgánica, se iniciará mediante acuerdo de inicio adoptado por propia iniciativa o como consecuencia de reclamación.

Si el procedimiento se fundase en una reclamación formulada ante la Agencia Española de Protección de Datos, con carácter previo, esta decidirá sobre su admisión a trámite, conforme a lo dispuesto en el artículo 65 de esta ley orgánica.

Cuando fuesen de aplicación las normas establecidas en el artículo 60 del Reglamento (UE) 2016/679, el procedimiento se iniciará mediante la adopción del proyecto de acuerdo de inicio de procedimiento sancionador, del que se dará conocimiento formal al interesado a los efectos previstos en el artículo 75 de esta ley orgánica.

Admitida a trámite la reclamación así como en los supuestos en que la Agencia Española de Protección de Datos actúe por propia iniciativa, con carácter previo al acuerdo de inicio, podrá existir una fase de actuaciones previas de investigación, que se regirá por lo previsto en el artículo 67 de esta ley orgánica.

El procedimiento tendrá una duración máxima de nueve meses a contar desde la fecha del acuerdo de inicio o, en su caso, del proyecto de acuerdo de inicio. Transcurrido ese plazo se producirá su caducidad y, en consecuencia, el archivo de actuaciones.

3. El procedimiento podrá también tramitarse como consecuencia de la comunicación a la Agencia Española de Protección de Datos por parte de la autoridad de control de otro Estado miembro de la Unión Europea de la reclamación formulada ante la misma, cuando la Agencia Española de Protección de Datos tuviese la condición de autoridad de control principal para la tramitación de un procedimiento conforme a lo dispuesto en los artículos 56 y 60 del Reglamento (UE) 2016/679. Será en este caso de aplicación lo dispuesto en el apartado 1 y en los párrafos primero, tercero, cuarto y quinto del apartado 2.

4. Los plazos de tramitación establecidos en este artículo así como los de admisión a trámite regulados por el artículo 65.5 y de duración de las actuaciones previas de investigación previstos en el artículo 67.2, quedarán automáticamente suspendidos cuando deba recabarse información, consulta, solicitud de asistencia o pronunciamiento preceptivo de un órgano u organismo de la Unión Europea o de una o varias autoridades de control de los Estados miembros conforme con lo establecido en el Reglamento (UE) 2016/679, por el tiempo que medie entre la solicitud y la notificación del pronunciamiento a la Agencia Española de Protección de Datos.

Artículo 65.- Admisión a trámite de las reclamaciones.

1. Cuando se presentase ante la Agencia Española de Protección de Datos una reclamación, esta deberá evaluar su admisibilidad a trámite, de conformidad con las previsiones de este artículo.

2. La Agencia Española de Protección de Datos inadmitirá las reclamaciones presentadas cuando no versen sobre cuestiones de protección de datos personales, carezcan manifiestamente de fundamento, sean abusivas o no aporten indicios racionales de la existencia de una infracción.

3. Igualmente, la Agencia Española de Protección de Datos podrá inadmitir la reclamación cuando el responsable o encargado del tratamiento, previa advertencia formulada por la Agencia Española de Protección de Datos, hubiera adoptado las medidas correctivas encaminadas a poner fin al posible incumplimiento de la legislación de protección de datos y concurra alguna de las siguientes circunstancias:

a) Que no se haya causado perjuicio al afectado en el caso de las infracciones previstas en el artículo 74 de esta ley orgánica.

b) Que el derecho del afectado quede plenamente garantizado mediante la aplicación de las medidas.

4. Antes de resolver sobre la admisión a trámite de la reclamación, la Agencia Española de Protección de Datos podrá remitir la misma al delegado de protección de datos que hubiera, en su caso, designado el responsable o encargado del tratamiento o al organismo de supervisión establecido para la aplicación de los códigos de conducta a los efectos previstos en los artículos 37 y 38.2 de esta ley orgánica.

La Agencia Española de Protección de Datos podrá igualmente remitir la reclamación al responsable o encargado del tratamiento cuando no se hubiera designado un delegado de protección de datos ni estuviera adherido a mecanismos de resolución extrajudicial de conflictos, en cuyo caso el responsable o encargado deberá dar respuesta a la reclamación en el plazo de un mes.

5. La decisión sobre la admisión o inadmisión a trámite, así como la que determine, en su caso, la remisión de la reclamación a la autoridad de control principal que se estime competente, deberá notificarse al reclamante en el plazo de tres meses. Si transcurrido este plazo no se produjera dicha notificación, se entenderá que prosigue la tramitación de la reclamación con arreglo a lo dispuesto en este Título a partir de la fecha en que se cumpliesen tres meses desde que la reclamación tuvo entrada en la Agencia Española de Protección de Datos.

Artículo 66.- Determinación del alcance territorial.

1. Salvo en los supuestos a los que se refiere el artículo 64.3 de esta ley orgánica, la Agencia Española de Protección de Datos deberá, con carácter previo a la realización de cualquier otra actuación, incluida la admisión a trámite de una reclamación o el comienzo de actuaciones previas de investigación, examinar su competencia y determinar el carácter nacional o transfronterizo, en cualquiera de sus modalidades, del procedimiento a seguir.

2. Si la Agencia Española de Protección de Datos considera que no tiene la condición de autoridad de control principal para la tramitación del procedimiento remitirá, sin más trámite, la reclamación formulada a la autoridad de control principal que considere competente, a fin de que por la misma se le dé el curso oportuno. La Agencia Española de Protección de Datos notificará esta circunstancia a quien, en su caso, hubiera formulado la reclamación.

El acuerdo por el que se resuelva la remisión a la que se refiere el párrafo anterior implicará el archivo provisional del procedimiento, sin perjuicio de que por la Agencia Española de Protección de Datos se dicte, en caso de que así proceda, la resolución a la que se refiere el apartado 8 del artículo 60 del Reglamento (UE) 2016/679.

Artículo 67.- Actuaciones previas de investigación.

1. Antes de la adopción del acuerdo de inicio de procedimiento, y una vez admitida a trámite la reclamación si la hubiese, la Agencia Española de Protección de Datos podrá llevar a cabo actuaciones previas de investigación a fin de lograr una mejor determinación de los hechos y las circunstancias que justifican la tramitación del procedimiento.

La Agencia Española de Protección de Datos actuará en todo caso cuando sea precisa la investigación de tratamientos que implique un tráfico masivo de datos personales.

2. Las actuaciones previas de investigación se someterán a lo dispuesto en la Sección 2.ª del Capítulo I del Título VII de esta ley orgánica y no podrán tener una duración superior a doce meses a contar desde la fecha del acuerdo de admisión a trámite o de la fecha del acuerdo por el que se decida su iniciación cuando la Agencia Española de Protección de Datos actúe por propia iniciativa o como consecuencia de la comunicación que le hubiera sido remitida por la autoridad de control de otro Estado miembro de la Unión Europea, conforme al artículo 64.3 de esta ley orgánica.

Artículo 68.- Acuerdo de inicio del procedimiento para el ejercicio de la potestad sancionadora.

1. Concluidas, en su caso, las actuaciones a las que se refiere el artículo anterior, corresponderá a la Presidencia de la Agencia Española de Protección de Datos, cuando así proceda, dictar acuerdo de inicio de procedimiento para el ejercicio de la potestad sancionadora, en que se concretarán los hechos, la identificación de la persona o entidad contra la que se dirija el procedimiento, la infracción que hubiera podido cometerse y su posible sanción.

2. Cuando la Agencia Española de Protección de Datos ostente la condición de autoridad de control principal y deba seguirse el procedimiento previsto en el artículo 60 del Reglamento (UE) 2016/679, el proyecto de acuerdo de inicio de procedimiento sancionador se someterá a lo dispuesto en el mismo.

Artículo 69.- Medidas provisionales y de garantía de los derechos.

1. Durante la realización de las actuaciones previas de investigación o iniciado un procedimiento para el ejercicio de la potestad sancionadora, la Agencia Española de Protección de Datos podrá acordar motivadamente las medidas provisionales necesarias y proporcionadas para salvaguardar el derecho fundamental a la protección de datos y, en especial, las previstas en el artículo 66.1 del Reglamento (UE) 2016/679, el bloqueo cautelar de los datos y la obligación inmediata de atender el derecho solicitado.

2. En los casos en que la Agencia Española de Protección de Datos considere que la continuación del tratamiento de los datos personales, su comunicación o transferencia internacional comportara un menoscabo grave del derecho a la protección de datos personales, podrá ordenar a los responsables o encargados de los tratamientos el bloqueo de los datos y la cesación de su tratamiento y, en caso de incumplirse por estos dichos mandatos, proceder a su inmovilización.

3. Cuando se hubiese presentado ante la Agencia Española de Protección de Datos una reclamación que se refiriese, entre otras cuestiones, a la falta de atención en plazo de los derechos establecidos en los artículos 15 a 22 del Reglamento (UE) 2016/679, la Agencia Española de Protección de Datos podrá acordar en cualquier momento, incluso con anterioridad a la iniciación del procedimiento para el ejercicio de la potestad sancionadora, mediante resolución motivada y previa audiencia del responsable del tratamiento, la obligación de atender el derecho solicitado, prosiguiéndose el procedimiento en cuanto al resto de las cuestiones objeto de la reclamación.

TÍTULO IX.- Régimen sancionador

Artículo 70. Sujetos responsables.

1. Están sujetos al régimen sancionador establecido en el Reglamento (UE) 2016/679 y en la presente ley orgánica:

a) Los responsables de los tratamientos.

b) Los encargados de los tratamientos.

c) Los representantes de los responsables o encargados de los tratamientos no establecidos en el territorio de la Unión Europea.

d) Las entidades de certificación.

e) Las entidades acreditadas de supervisión de los códigos de conducta.

2. No será de aplicación al delegado de protección de datos el régimen sancionador establecido en este Título.

Artículo 71.- Infracciones.

Constituyen infracciones los actos y conductas a las que se refieren los apartados 4, 5 y 6 del artículo 83 del Reglamento (UE) 2016/679, así como las que resulten contrarias a la presente ley orgánica.

Artículo 72.- Infracciones consideradas muy graves.

1. En función de lo que establece el artículo 83.5 del Reglamento (UE) 2016/679 se consideran muy graves y prescribirán a los tres años las infracciones que supongan una vulneración sustancial de los artículos mencionados en aquel y, en particular, las siguientes:

a) El tratamiento de datos personales vulnerando los principios y garantías establecidos en el artículo 5 del Reglamento (UE) 2016/679.

b) El tratamiento de datos personales sin que concurra alguna de las condiciones de licitud del tratamiento establecidas en el artículo 6 del Reglamento (UE) 2016/679.

c) El incumplimiento de los requisitos exigidos por el artículo 7 del Reglamento (UE) 2016/679 para la validez del consentimiento.

d) La utilización de los datos para una finalidad que no sea compatible con la finalidad para la cual fueron recogidos, sin contar con el consentimiento del afectado o con una base legal para ello.

e) El tratamiento de datos personales de las categorías a las que se refiere el artículo 9 del Reglamento (UE) 2016/679, sin que concurra alguna de las circunstancias previstas en dicho precepto y en el artículo 9 de esta ley orgánica.

f) El tratamiento de datos personales relativos a condenas e infracciones penales o medidas de seguridad conexas fuera de los supuestos permitidos por el artículo 10 del Reglamento (UE) 2016/679 y en el artículo 10 de esta ley orgánica.

g) El tratamiento de datos personales relacionados con infracciones y sanciones administrativas fuera de los supuestos permitidos por el artículo 27 de esta ley orgánica.

h) La omisión del deber de informar al afectado acerca del tratamiento de sus datos personales conforme a lo dispuesto en los artículos 13 y 14 del Reglamento (UE) 2016/679 y 12 de esta ley orgánica.

i) La vulneración del deber de confidencialidad establecido en el artículo 5 de esta ley orgánica.

j) La exigencia del pago de un canon para facilitar al afectado la información a la que se refieren los artículos 13 y 14 del Reglamento (UE) 2016/679 o por atender las solicitudes de ejercicio de derechos de los afectados previstos en los artículos 15 a 22 del Reglamento (UE) 2016/679, fuera de los supuestos establecidos en su artículo 12.5.

k) El impedimento o la obstaculización o la no atención reiterada del ejercicio de los derechos establecidos en los artículos 15 a 22 del Reglamento (UE) 2016/679.

l) La transferencia internacional de datos personales a un destinatario que se encuentre en un tercer país o a una organización internacional, cuando no concurran las garantías, requisitos o excepciones establecidos en los artículos 44 a 49 del Reglamento (UE) 2016/679.

m) El incumplimiento de las resoluciones dictadas por la autoridad de protección de datos competente en ejercicio de los poderes que le confiere el artículo 58.2 del Reglamento (UE) 2016/679.

n) El incumplimiento de la obligación de bloqueo de los datos establecida en el artículo 32 de esta ley orgánica cuando la misma sea exigible.

ñ) No facilitar el acceso del personal de la autoridad de protección de datos competente a los datos personales, información, locales, equipos y medios de tratamiento que sean requeridos por la autoridad de protección de datos para el ejercicio de sus poderes de investigación.

o) La resistencia u obstrucción del ejercicio de la función inspectora por la autoridad de protección de datos competente.

p) La reversión deliberada de un procedimiento de anonimización a fin de permitir la reidentificación de los afectados.

2. Tendrán la misma consideración y también prescribirán a los tres años las infracciones a las que se refiere el artículo 83.6 del Reglamento (UE) 2016/679.

Artículo 73.- Infracciones consideradas graves.

En función de lo que establece el artículo 83.4 del Reglamento (UE) 2016/679 se consideran graves y prescribirán a los dos años las infracciones que supongan una vulneración sustancial de los artículos mencionados en aquel y, en particular, las siguientes:

a) El tratamiento de datos personales de un menor de edad sin recabar su consentimiento, cuando tenga capacidad para ello, o el del titular de su patria potestad o tutela, conforme al artículo 8 del Reglamento (UE) 2016/679.

b) No acreditar la realización de esfuerzos razonables para verificar la validez del consentimiento prestado por un menor de edad o por el titular de su patria potestad o tutela sobre el mismo, conforme a lo requerido por el artículo 8.2 del Reglamento (UE) 2016/679.

c) El impedimento o la obstaculización o la no atención reiterada de los derechos de acceso, rectificación, supresión, limitación del tratamiento o a la portabilidad de los datos en tratamientos en los que no se requiere la identificación del afectado, cuando este, para el ejercicio de esos derechos, haya facilitado información adicional que permita su identificación.

d) La falta de adopción de aquellas medidas técnicas y organizativas que resulten apropiadas para aplicar de forma efectiva los principios de protección de datos desde el diseño, así como la no integración de las garantías necesarias en el tratamiento, en los términos exigidos por el artículo 25 del Reglamento (UE) 2016/679.

e) La falta de adopción de las medidas técnicas y organizativas apropiadas para garantizar que, por defecto, solo se tratarán los datos personales necesarios para cada uno de los fines específicos del tratamiento, conforme a lo exigido por el artículo 25.2 del Reglamento (UE) 2016/679.

f) La falta de adopción de aquellas medidas técnicas y organizativas que resulten apropiadas para garantizar un nivel de seguridad adecuado al riesgo del tratamiento, en los términos exigidos por el artículo 32.1 del Reglamento (UE) 2016/679.

g) El quebrantamiento, como consecuencia de la falta de la debida diligencia, de las medidas técnicas y organizativas que se hubiesen implantado conforme a lo exigido por el artículo 32.1 del Reglamento (UE) 2016/679.

h) El incumplimiento de la obligación de designar un representante del responsable o encargado del tratamiento no establecido en el territorio de la Unión Europea, conforme a lo previsto en el artículo 27 del Reglamento (UE) 2016/679.

i) La falta de atención por el representante en la Unión del responsable o del encargado del tratamiento de las solicitudes efectuadas por la autoridad de protección de datos o por los afectados.

j) La contratación por el responsable del tratamiento de un encargado de tratamiento que no ofrezca las garantías suficientes para aplicar las medidas técnicas y organizativas apropiadas conforme a lo establecido en el Capítulo IV del Reglamento (UE) 2016/679.

k) Encargar el tratamiento de datos a un tercero sin la previa formalización de un contrato u otro acto jurídico escrito con el contenido exigido por el artículo 28.3 del Reglamento (UE) 2016/679.

l) La contratación por un encargado del tratamiento de otros encargados sin contar con la autorización previa del responsable, o sin haberle informado sobre los cambios producidos en la subcontratación cuando fueran legalmente exigibles.

m) La infracción por un encargado del tratamiento de lo dispuesto en el Reglamento (UE) 2016/679 y en la presente ley orgánica, al determinar los fines y los medios del tratamiento, conforme a lo dispuesto en el artículo 28.10 del citado reglamento.

n) No disponer del registro de actividades de tratamiento establecido en el artículo 30 del Reglamento (UE) 2016/679.

ñ) No poner a disposición de la autoridad de protección de datos que lo haya solicitado, el registro de actividades de tratamiento, conforme al apartado 4 del artículo 30 del Reglamento (UE) 2016/679.

o) No cooperar con las autoridades de control en el desempeño de sus funciones en los supuestos no previstos en el artículo 72 de esta ley orgánica.

p) El tratamiento de datos personales sin llevar a cabo una previa valoración de los elementos mencionados en el artículo 28 de esta ley orgánica.

q) El incumplimiento del deber del encargado del tratamiento de notificar al responsable del tratamiento las violaciones de seguridad de las que tuviera conocimiento.

r) El incumplimiento del deber de notificación a la autoridad de protección de datos de una violación de seguridad de los datos personales de conformidad con lo previsto en el artículo 33 del Reglamento (UE) 2016/679.

s) El incumplimiento del deber de comunicación al afectado de una violación de la seguridad de los datos de conformidad con lo previsto en el artículo 34 del Reglamento (UE) 2016/679 si el responsable del tratamiento hubiera sido requerido por la autoridad de protección de datos para llevar a cabo dicha notificación.

t) El tratamiento de datos personales sin haber llevado a cabo la evaluación del impacto de las operaciones de tratamiento en la protección de datos personales en los supuestos en que la misma sea exigible.

u) El tratamiento de datos personales sin haber consultado previamente a la autoridad de protección de datos en los casos en que dicha consulta resulta preceptiva conforme al artículo 36 del Reglamento (UE) 2016/679 o cuando la ley establezca la obligación de llevar a cabo esa consulta.

v) El incumplimiento de la obligación de designar un delegado de protección de datos cuando sea exigible su nombramiento de acuerdo con el artículo 37 del Reglamento (UE) 2016/679 y el artículo 34 de esta ley orgánica.

w) No posibilitar la efectiva participación del delegado de protección de datos en todas las cuestiones relativas a la protección de datos personales, no respaldarlo o interferir en el desempeño de sus funciones.

x) La utilización de un sello o certificación en materia de protección de datos que no haya sido otorgado por una entidad de certificación debidamente acreditada o en caso de que la vigencia del mismo hubiera expirado.

y) Obtener la acreditación como organismo de certificación presentando información inexacta sobre el cumplimiento de los requisitos exigidos por el artículo 43 del Reglamento (UE) 2016/679.

z) El desempeño de funciones que el Reglamento (UE) 2016/679 reserva a los organismos de certificación, sin haber sido debidamente acreditado conforme a lo establecido en el artículo 39 de esta ley orgánica.

aa) El incumplimiento por parte de un organismo de certificación de los principios y deberes a los que está sometido según lo previsto en los artículos 42 y 43 de Reglamento (UE) 2016/679.

ab) El desempeño de funciones que el artículo 41 del Reglamento (UE) 2016/679 reserva a los organismos de supervisión de códigos de conducta sin haber sido previamente acreditado por la autoridad de protección de datos competente.

ac) La falta de adopción por parte de los organismos acreditados de supervisión de un código de conducta de las medidas que resulten oportunas en caso que se hubiera producido una infracción del código, conforme exige el artículo 41.4 del Reglamento (UE) 2016/679.

Artículo 74.- Infracciones consideradas leves.

Se consideran leves y prescribirán al año las restantes infracciones de carácter meramente formal de los artículos mencionados en los apartados 4 y 5 del artículo 83 del Reglamento (UE) 2016/679 y, en particular, las siguientes:

a) El incumplimiento del principio de transparencia de la información o el derecho de información del afectado por no facilitar toda la información exigida por los artículos 13 y 14 del Reglamento (UE) 2016/679.

b) La exigencia del pago de un canon para facilitar al afectado la información exigida por los artículos 13 y 14 del Reglamento (UE) 2016/679 o por atender las solicitudes de ejercicio de derechos de los afectados previstos en los artículos 15 a 22 del Reglamento (UE) 2016/679, cuando así lo permita su artículo 12.5, si su cuantía excediese el importe de los costes afrontados para facilitar la información o realizar la actuación solicitada.

c) No atender las solicitudes de ejercicio de los derechos establecidos en los artículos 15 a 22 del Reglamento (UE) 2016/679, salvo que resultase de aplicación lo dispuesto en el artículo 72.1.k) de esta ley orgánica.

d) No atender los derechos de acceso, rectificación, supresión, limitación del tratamiento o a la portabilidad de los datos en tratamientos en los que no se requiere la identificación del afectado, cuando este, para el ejercicio de esos derechos, haya facilitado información adicional que permita su identificación, salvo que resultase de aplicación lo dispuesto en el artículo 73 c) de esta ley orgánica.

e) El incumplimiento de la obligación de notificación relativa a la rectificación o supresión de datos personales o la limitación del tratamiento exigida por el artículo 19 del Reglamento (UE) 2016/679.

f) El incumplimiento de la obligación de informar al afectado, cuando así lo haya solicitado, de los destinatarios a los que se hayan comunicado los datos personales rectificados, suprimidos o respecto de los que se ha limitado el tratamiento.

g) El incumplimiento de la obligación de suprimir los datos referidos a una persona fallecida cuando ello fuera exigible conforme al artículo 3 de esta ley orgánica.

h) La falta de formalización por los corresponsables del tratamiento del acuerdo que determine las obligaciones, funciones y responsabilidades respectivas con respecto al tratamiento de datos personales y sus relaciones con los afectados al que se refiere el artículo 26 del Reglamento (UE) 2016/679 o la inexactitud en la determinación de las mismas.

i) No poner a disposición de los afectados los aspectos esenciales del acuerdo formalizado entre los corresponsables del tratamiento, conforme exige el artículo 26.2 del Reglamento (UE) 2016/679.

j) La falta del cumplimiento de la obligación del encargado del tratamiento de informar al responsable del tratamiento acerca de la posible infracción por una instrucción recibida de este de las disposiciones del Reglamento (UE) 2016/679 o de esta ley orgánica, conforme a lo exigido por el artículo 28.3 del citado reglamento.

k) El incumplimiento por el encargado de las estipulaciones impuestas en el contrato o acto jurídico que regula el tratamiento o las instrucciones del responsable del tratamiento, salvo que esté legalmente obligado a ello conforme al Reglamento (UE) 2016/679 y a la presente ley orgánica o en los supuestos en que fuese necesario para evitar la infracción de la legislación en materia de protección de datos y se hubiese advertido de ello al responsable o al encargado del tratamiento.

l) Disponer de un Registro de actividades de tratamiento que no incorpore toda la información exigida por el artículo 30 del Reglamento (UE) 2016/679.

m) La notificación incompleta, tardía o defectuosa a la autoridad de protección de datos de la información relacionada con una violación de seguridad de los datos personales de conformidad con lo previsto en el artículo 33 del Reglamento (UE) 2016/679.

n) El incumplimiento de la obligación de documentar cualquier violación de seguridad, exigida por el artículo 33.5 del Reglamento (UE) 2016/679.

ñ) El incumplimiento del deber de comunicación al afectado de una violación de la seguridad de los datos que entrañe un alto riesgo para los derechos y libertades de los afectados, conforme a lo exigido por el artículo 34 del Reglamento (UE) 2016/679, salvo que resulte de aplicación lo previsto en el artículo 73 s) de esta ley orgánica.

o) Facilitar información inexacta a la Autoridad de protección de datos, en los supuestos en los que el responsable del tratamiento deba elevarle una consulta previa, conforme al artículo 36 del Reglamento (UE) 2016/679.

p) No publicar los datos de contacto del delegado de protección de datos, o no comunicarlos a la autoridad de protección de datos, cuando su nombramiento sea exigible de acuerdo con el artículo 37 del Reglamento (UE) 2016/679 y el artículo 34 de esta ley orgánica.

q) El incumplimiento por los organismos de certificación de la obligación de informar a la autoridad de protección de datos de la expedición, renovación o retirada de una certificación, conforme a lo exigido por los apartados 1 y 5 del artículo 43 del Reglamento (UE) 2016/679.

r) El incumplimiento por parte de los organismos acreditados de supervisión de un código de conducta de la obligación de informar a las autoridades de protección de datos acerca de las medidas que resulten oportunas en caso de infracción del código, conforme exige el artículo 41.4 del Reglamento (UE) 2016/679.

Artículo 75.- Interrupción de la prescripción de la infracción.

Interrumpirá la prescripción la iniciación, con conocimiento del interesado, del procedimiento sancionador, reiniciándose el plazo de prescripción si el expediente sancionador estuviere paralizado durante más de seis meses por causas no imputables al presunto infractor.

Cuando la Agencia Española de Protección de Datos ostente la condición de autoridad de control principal y deba seguirse el procedimiento previsto en el artículo 60 del Reglamento (UE) 2016/679 interrumpirá la prescripción el conocimiento formal por el interesado del proyecto de acuerdo de inicio que sea sometido a las autoridades de control interesadas.

Artículo 76.- Sanciones y medidas correctivas.

1. Las sanciones previstas en los apartados 4, 5 y 6 del artículo 83 del Reglamento (UE) 2016/679 se aplicarán teniendo en cuenta los criterios de graduación establecidos en el apartado 2 del citado artículo.

2. De acuerdo a lo previsto en el artículo 83.2.k) del Reglamento (UE) 2016/679 también podrán tenerse en cuenta:

a) El carácter continuado de la infracción.

b) La vinculación de la actividad del infractor con la realización de tratamientos de datos personales.

c) Los beneficios obtenidos como consecuencia de la comisión de la infracción.

d) La posibilidad de que la conducta del afectado hubiera podido inducir a la comisión de la infracción.

e) La existencia de un proceso de fusión por absorción posterior a la comisión de la infracción, que no puede imputarse a la entidad absorbente.

f) La afectación a los derechos de los menores.

g) Disponer, cuando no fuere obligatorio, de un delegado de protección de datos.

h) El sometimiento por parte del responsable o encargado, con carácter voluntario, a mecanismos de resolución alternativa de conflictos, en aquellos supuestos en los que existan controversias entre aquellos y cualquier interesado.

3. Será posible, complementaria o alternativamente, la adopción, cuando proceda, de las restantes medidas correctivas a las que se refiere el artículo 83.2 del Reglamento (UE) 2016/679.

4. Será objeto de publicación en el Boletín Oficial del Estado la información que identifique al infractor, la infracción cometida y el importe de la sanción impuesta cuando la autoridad competente sea la Agencia Española de Protección de Datos, la sanción fuese superior a un millón de euros y el infractor sea una persona jurídica.

Cuando la autoridad competente para imponer la sanción sea una autoridad autonómica de protección de datos, se estará a su normativa de aplicación.

Artículo 77.- Régimen aplicable a determinadas categorías de responsables o encargados del tratamiento.

1. El régimen establecido en este artículo será de aplicación a los tratamientos de los que sean responsables o encargados:

a) Los órganos constitucionales o con relevancia constitucional y las instituciones de las comunidades autónomas análogas a los mismos.

b) Los órganos jurisdiccionales.

c) La Administración General del Estado, las Administraciones de las comunidades autónomas y las entidades que integran la Administración Local.

d) Los organismos públicos y entidades de Derecho público vinculadas o dependientes de las Administraciones Públicas.

e) Las autoridades administrativas independientes.

f) El Banco de España.

g) Las corporaciones de Derecho público cuando las finalidades del tratamiento se relacionen con el ejercicio de potestades de derecho público.

h) Las fundaciones del sector público.

i) Las Universidades Públicas.

j) Los consorcios.

k) Los grupos parlamentarios de las Cortes Generales y las Asambleas Legislativas autonómicas, así como los grupos políticos de las Corporaciones Locales.

2. Cuando los responsables o encargados enumerados en el apartado 1 cometiesen alguna de las infracciones a las que se refieren los artículos 72 a 74 de esta ley orgánica, la autoridad de protección de datos que resulte competente dictará resolución sancionando a las mismas con apercibimiento. La resolución establecerá asimismo las medidas que proceda adoptar para que cese la conducta o se corrijan los efectos de la infracción que se hubiese cometido.

La resolución se notificará al responsable o encargado del tratamiento, al órgano del que dependa jerárquicamente, en su caso, y a los afectados que tuvieran la condición de interesado, en su caso.

3. Sin perjuicio de lo establecido en el apartado anterior, la autoridad de protección de datos propondrá también la iniciación de actuaciones disciplinarias cuando existan indicios suficientes para ello. En este caso, el procedimiento y las sanciones a aplicar serán las establecidas en la legislación sobre régimen disciplinario o sancionador que resulte de aplicación.

Asimismo, cuando las infracciones sean imputables a autoridades y directivos, y se acredite la existencia de informes técnicos o recomendaciones para el tratamiento que no hubieran sido debidamente atendidos, en la resolución en la que se imponga la sanción se incluirá una amonestación con denominación del cargo responsable y se ordenará la publicación en el Boletín Oficial del Estado o autonómico que corresponda.

4. Se deberán comunicar a la autoridad de protección de datos las resoluciones que recaigan en relación con las medidas y actuaciones a que se refieren los apartados anteriores.

5. Se comunicarán al Defensor del Pueblo o, en su caso, a las instituciones análogas de las comunidades autónomas las actuaciones realizadas y las resoluciones dictadas al amparo de este artículo.

6. Cuando la autoridad competente sea la Agencia Española de Protección de Datos, esta publicará en su página web con la debida separación las resoluciones referidas a las entidades del apartado 1 de este artículo, con expresa indicación de la identidad del responsable o encargado del tratamiento que hubiera cometido la infracción.

Cuando la competencia corresponda a una autoridad autonómica de protección de datos se estará, en cuanto a la publicidad de estas resoluciones, a lo que disponga su normativa específica.

Artículo 78.- Prescripción de las sanciones.

1. Las sanciones impuestas en aplicación del Reglamento (UE) 2016/679 y de esta ley orgánica prescriben en los siguientes plazos:

a) Las sanciones por importe igual o inferior a 40.000 euros, prescriben en el plazo de un año.

b) Las sanciones por importe comprendido entre 40.001 y 300.000 euros prescriben a los dos años.

c) Las sanciones por un importe superior a 300.000 euros prescriben a los tres años.

2. El plazo de prescripción de las sanciones comenzará a contarse desde el día siguiente a aquel en que sea ejecutable la resolución por la que se impone la sanción o haya transcurrido el plazo para recurrirla.

3. La prescripción se interrumpirá por la iniciación, con conocimiento del interesado, del procedimiento de ejecución, volviendo a transcurrir el plazo si el mismo está paralizado durante más de seis meses por causa no imputable al infractor.

TÍTULO X.- Garantía de los derechos digitales

Artículo 79.- Los derechos en la Era digital.

Los derechos y libertades consagrados en la Constitución y en los Tratados y Convenios Internacionales en que España sea parte son plenamente aplicables en Internet. Los prestadores de servicios de la sociedad de la información y los proveedores de servicios de Internet contribuirán a garantizar su aplicación.

Artículo 80.- Derecho a la neutralidad de Internet.

Los usuarios tienen derecho a la neutralidad de Internet. Los proveedores de servicios de Internet proporcionarán una oferta transparente de servicios sin discriminación por motivos técnicos o económicos.

Artículo 81.- Derecho de acceso universal a Internet.

1. Todos tienen derecho a acceder a Internet independientemente de su condición personal, social, económica o geográfica.

2. Se garantizará un acceso universal, asequible, de calidad y no discriminatorio para toda la población.

3. El acceso a Internet de hombres y mujeres procurará la superación de la brecha de género tanto en el ámbito personal como laboral.

4. El acceso a Internet procurará la superación de la brecha generacional mediante acciones dirigidas a la formación y el acceso a las personas mayores.

5. La garantía efectiva del derecho de acceso a Internet atenderá la realidad específica de los entornos rurales.

6. El acceso a Internet deberá garantizar condiciones de igualdad para las personas que cuenten con necesidades especiales.

Artículo 82.- Derecho a la seguridad digital.

Los usuarios tienen derecho a la seguridad de las comunicaciones que transmitan y reciban a través de Internet. Los proveedores de servicios de Internet informarán a los usuarios de sus derechos.

Artículo 83.- Derecho a la educación digital.

1. El sistema educativo garantizará la plena inserción del alumnado en la sociedad digital y el aprendizaje de un uso de los medios digitales que sea seguro y respetuoso con la dignidad humana, los valores constitucionales, los derechos fundamentales y, particularmente con el respeto y la garantía de la intimidad personal y familiar y la protección de datos personales. Las actuaciones realizadas en este ámbito tendrán carácter inclusivo, en particular en lo que respecta al alumnado con necesidades educativas especiales.

Las Administraciones educativas deberán incluir en el diseño del bloque de asignaturas de libre configuración la competencia digital a la que se refiere el apartado anterior, así como los elementos relacionados con las situaciones de riesgo derivadas de la inadecuada utilización de las TIC, con especial atención a las situaciones de violencia en la red.

2. El profesorado recibirá las competencias digitales y la formación necesaria para la enseñanza y transmisión de los valores y derechos referidos en el apartado anterior.

3. Los planes de estudio de los títulos universitarios, en especial, aquellos que habiliten para el desempeño profesional en la formación del alumnado, garantizarán la formación en el uso y seguridad de los medios digitales y en la garantía de los derechos fundamentales en Internet.

4. Las Administraciones Públicas incorporarán a los temarios de las pruebas de acceso a los cuerpos superiores y a aquéllos en que habitualmente se desempeñen funciones que impliquen el acceso a datos personales materias relacionadas con la garantía de los derechos digitales y en particular el de protección de datos.

Artículo 84.- Protección de los menores en Internet.

1. Los padres, madres, tutores, curadores o representantes legales procurarán que los menores de edad hagan un uso equilibrado y responsable de los dispositivos digitales y de los servicios de la sociedad de la información a fin de garantizar el adecuado desarrollo de su personalidad y preservar su dignidad y sus derechos fundamentales.

2. La utilización o difusión de imágenes o información personal de menores en las redes sociales y servicios de la sociedad de la información equivalentes que puedan implicar una intromisión ilegítima en sus derechos fundamentales determinará la intervención del Ministerio Fiscal, que instará las medidas cautelares y de protección previstas en la Ley Orgánica 1/1996, de 15 de enero, de Protección Jurídica del Menor.

Artículo 85.- Derecho de rectificación en Internet.

1. Todos tienen derecho a la libertad de expresión en Internet.

2. Los responsables de redes sociales y servicios equivalentes adoptarán protocolos adecuados para posibilitar el ejercicio del derecho de rectificación ante los usuarios que difundan contenidos que atenten contra el derecho al honor, la intimidad personal y familiar en Internet y el derecho a comunicar o recibir libremente información veraz, atendiendo a los requisitos y procedimientos previstos en la Ley Orgánica 2/1984, de 26 de marzo, reguladora del derecho de rectificación.

Cuando los medios de comunicación digitales deban atender la solicitud de rectificación formulada contra ellos deberán proceder a la publicación en sus archivos digitales de un aviso aclaratorio que ponga de manifiesto que la noticia original no refleja la situación actual del individuo. Dicho aviso deberá aparecer en lugar visible junto con la información original.

Artículo 86.- Derecho a la actualización de informaciones en medios de comunicación digitales.

Toda persona tiene derecho a solicitar motivadamente de los medios de comunicación digitales la inclusión de un aviso de actualización suficientemente visible junto a las noticias que le conciernan cuando la información contenida en la noticia original no refleje su situación actual como consecuencia de circunstancias que hubieran tenido lugar después de la publicación, causándole un perjuicio.

En particular, procederá la inclusión de dicho aviso cuando las informaciones originales se refieran a actuaciones policiales o judiciales que se hayan visto afectadas en beneficio del interesado como consecuencia de decisiones judiciales posteriores. En este caso, el aviso hará referencia a la decisión posterior.

Artículo 87.- Derecho a la intimidad y uso de dispositivos digitales en el ámbito laboral.

1. Los trabajadores y los empleados públicos tendrán derecho a la protección de su intimidad en el uso de los dispositivos digitales puestos a su disposición por su empleador.

2. El empleador podrá acceder a los contenidos derivados del uso de medios digitales facilitados a los trabajadores a los solos efectos de controlar el cumplimiento de las obligaciones laborales o estatutarias y de garantizar la integridad de dichos dispositivos.

3. Los empleadores deberán establecer criterios de utilización de los dispositivos digitales respetando en todo caso los estándares mínimos de protección de su intimidad de acuerdo con los usos sociales y los derechos reconocidos constitucional y legalmente. En su elaboración deberán participar los representantes de los trabajadores.

El acceso por el empleador al contenido de dispositivos digitales respecto de los que haya admitido su uso con fines privados requerirá que se especifiquen de modo preciso los usos autorizados y se establezcan garantías para preservar la intimidad de los trabajadores, tales como, en su caso, la determinación de los períodos en que los dispositivos podrán utilizarse para fines privados.

Los trabajadores deberán ser informados de los criterios de utilización a los que se refiere este apartado.

Artículo 88.- Derecho a la desconexión digital en el ámbito laboral.

1. Los trabajadores y los empleados públicos tendrán derecho a la desconexión digital a fin de garantizar, fuera del tiempo de trabajo legal o convencionalmente establecido, el respeto de su tiempo de descanso, permisos y vacaciones, así como de su intimidad personal y familiar.

2. Las modalidades de ejercicio de este derecho atenderán a la naturaleza y objeto de la relación laboral, potenciarán el derecho a la conciliación de la actividad laboral y la vida personal y familiar y se sujetarán a lo establecido en la negociación colectiva o, en su defecto, a lo acordado entre la empresa y los representantes de los trabajadores.

3. El empleador, previa audiencia de los representantes de los trabajadores, elaborará una política interna dirigida a trabajadores, incluidos los que ocupen puestos directivos, en la que definirán las modalidades de ejercicio del derecho a la desconexión y las acciones de formación y de sensibilización del personal sobre un uso razonable de las herramientas tecnológicas que evite el riesgo de fatiga informática. En particular, se preservará el derecho a la desconexión digital en los supuestos de realización total o parcial del trabajo a distancia así como en el domicilio del empleado vinculado al uso con fines laborales de herramientas tecnológicas.

Artículo 89.- Derecho a la intimidad frente al uso de dispositivos de videovigilancia y de grabación de sonidos en el lugar de trabajo.

1. Los empleadores podrán tratar las imágenes obtenidas a través de sistemas de cámaras o videocámaras para el ejercicio de las funciones de control de los trabajadores o los empleados públicos previstas, respectivamente, en el artículo 20.3 del Estatuto de los Trabajadores y en la legislación de función pública, siempre que estas funciones se ejerzan dentro de su marco legal y con los límites inherentes al mismo. Los empleadores habrán de informar con carácter previo, y de forma expresa, clara y concisa, a los trabajadores o los empleados públicos y, en su caso, a sus representantes, acerca de esta medida.

En el supuesto de que se haya captado la comisión flagrante de un acto ilícito por los trabajadores o los empleados públicos se entenderá cumplido el deber de informar cuando existiese al menos el dispositivo al que se refiere el artículo 22.4 de esta ley orgánica.

2. En ningún caso se admitirá la instalación de sistemas de grabación de sonidos ni de videovigilancia en lugares destinados al descanso o esparcimiento de los trabajadores o los empleados públicos, tales como vestuarios, aseos, comedores y análogos.

3. La utilización de sistemas similares a los referidos en los apartados anteriores para la grabación de sonidos en el lugar de trabajo se admitirá únicamente cuando resulten relevantes los riesgos para la seguridad de las instalaciones, bienes y personas derivados de la actividad que se desarrolle en el centro de trabajo y siempre respetando el principio de proporcionalidad, el de intervención mínima y las garantías previstas en los apartados anteriores. La supresión de los sonidos conservados por estos sistemas de grabación se realizará atendiendo a lo dispuesto en el apartado 3 del artículo 22 de esta ley.

Artículo 90.- Derecho a la intimidad ante la utilización de sistemas de geolocalización en el ámbito laboral.

1. Los empleadores podrán tratar los datos obtenidos a través de sistemas de geolocalización para el ejercicio de las funciones de control de los trabajadores o los empleados públicos previstas, respectivamente, en el artículo 20.3 del Estatuto de los Trabajadores y en la legislación de función pública, siempre que estas funciones se ejerzan dentro de su marco legal y con los límites inherentes al mismo.

2. Con carácter previo, los empleadores habrán de informar de forma expresa, clara e inequívoca a los trabajadores o los empleados públicos y, en su caso, a sus representantes, acerca de la existencia y características de estos dispositivos. Igualmente deberán informarles acerca del posible ejercicio de los derechos de acceso, rectificación, limitación del tratamiento y supresión.

Artículo 91.- Derechos digitales en la negociación colectiva.

Los convenios colectivos podrán establecer garantías adicionales de los derechos y libertades relacionados con el tratamiento de los datos personales de los trabajadores y la salvaguarda de derechos digitales en el ámbito laboral.

Artículo 92.- Protección de datos de los menores en Internet.

Los centros educativos y cualesquiera personas físicas o jurídicas que desarrollen actividades en las que participen menores de edad garantizarán la protección del interés superior del menor y sus derechos fundamentales, especialmente el derecho a la protección de datos personales, en la publicación o difusión de sus datos personales a través de servicios de la sociedad de la información.

Cuando dicha publicación o difusión fuera a tener lugar a través de servicios de redes sociales o servicios equivalentes deberán contar con el consentimiento del menor o sus representantes legales, conforme a lo prescrito en el artículo 7 de esta ley orgánica.

Artículo 93.- Derecho al olvido en búsquedas de Internet.

1. Toda persona tiene derecho a que los motores de búsqueda en Internet eliminen de las listas de resultados que se obtuvieran tras una búsqueda efectuada a partir de su nombre los enlaces publicados que contuvieran información relativa a esa persona cuando fuesen inadecuados, inexactos, no pertinentes, no actualizados o excesivos o hubieren devenido como tales por el transcurso del tiempo, teniendo en cuenta los fines para los que se recogieron o trataron, el tiempo transcurrido y la naturaleza e interés público de la información.

Del mismo modo deberá procederse cuando las circunstancias personales que en su caso invocase el afectado evidenciasen la prevalencia de sus derechos sobre el mantenimiento de los enlaces por el servicio de búsqueda en Internet.

Este derecho subsistirá aun cuando fuera lícita la conservación de la información publicada en el sitio web al que se dirigiera el enlace y no se procediese por la misma a su borrado previo o simultáneo.

2. El ejercicio del derecho al que se refiere este artículo no impedirá el acceso a la información publicada en el sitio web a través de la utilización de otros criterios de búsqueda distintos del nombre de quien ejerciera el derecho.

Artículo 94.- Derecho al olvido en servicios de redes sociales y servicios equivalentes.

1. Toda persona tiene derecho a que sean suprimidos, a su simple solicitud, los datos personales que hubiese facilitado para su publicación por servicios de redes sociales y servicios de la sociedad de la información equivalentes.

2. Toda persona tiene derecho a que sean suprimidos los datos personales que le conciernan y que hubiesen sido facilitados por terceros para su publicación por los servicios de redes sociales y servicios de la sociedad de la información equivalentes cuando fuesen inadecuados, inexactos, no pertinentes, no actualizados o excesivos o hubieren devenido como tales por el transcurso del tiempo, teniendo en cuenta los fines para los que se recogieron o trataron, el tiempo transcurrido y la naturaleza e interés público de la información.

Del mismo modo deberá procederse a la supresión de dichos datos cuando las circunstancias personales que en su caso invocase el afectado evidenciasen la prevalencia de sus derechos sobre el mantenimiento de los datos por el servicio.

Se exceptúan de lo dispuesto en este apartado los datos que hubiesen sido facilitados por personas físicas en el ejercicio de actividades personales o domésticas.

3. En caso de que el derecho se ejercitase por un afectado respecto de datos que hubiesen sido facilitados al servicio, por él o por terceros, durante su minoría de edad, el prestador deberá proceder sin dilación a su supresión por su simple solicitud, sin necesidad de que concurran las circunstancias mencionadas en el apartado 2.

Artículo 95.- Derecho de portabilidad en servicios de redes sociales y servicios equivalentes.

Los usuarios de servicios de redes sociales y servicios de la sociedad de la información equivalentes tendrán derecho a recibir y transmitir los contenidos que hubieran facilitado a los prestadores de dichos servicios, así como a que los prestadores los transmitan directamente a otro prestador designado por el usuario, siempre que sea técnicamente posible.

Los prestadores podrán conservar, sin difundirla a través de Internet, copia de los contenidos cuando dicha conservación sea necesaria para el cumplimiento de una obligación legal.

Artículo 96.- Derecho al testamento digital.

1. El acceso a contenidos gestionados por prestadores de servicios de la sociedad de la información sobre personas fallecidas se regirá por las siguientes reglas:

a) Las personas vinculadas al fallecido por razones familiares o de hecho, así como sus herederos podrán dirigirse a los prestadores de servicios de la sociedad de la información al objeto de acceder a dichos contenidos e impartirles las instrucciones que estimen oportunas sobre su utilización, destino o supresión.

Como excepción, las personas mencionadas no podrán acceder a los contenidos del causante, ni solicitar su modificación o eliminación, cuando la persona fallecida lo hubiese prohibido expresamente o así lo establezca una ley. Dicha prohibición no afectará al derecho de los herederos a acceder a los contenidos que pudiesen formar parte del caudal relicto.

b) El albacea testamentario así como aquella persona o institución a la que el fallecido hubiese designado expresamente para ello también podrá solicitar, con arreglo a las instrucciones recibidas, el acceso a los contenidos con vistas a dar cumplimiento a tales instrucciones.

c) En caso de personas fallecidas menores de edad, estas facultades podrán ejercerse también por sus representantes legales o, en el marco de sus competencias, por el Ministerio Fiscal, que podrá actuar de oficio o a instancia de cualquier persona física o jurídica interesada.

d) En caso de fallecimiento de personas con discapacidad, estas facultades podrán ejercerse también, además de por quienes señala la letra anterior, por quienes hubiesen sido designados para el ejercicio de funciones de apoyo si tales facultades se entendieran comprendidas en las medidas de apoyo prestadas por el designado.

2. Las personas legitimadas en el apartado anterior podrán decidir acerca del mantenimiento o eliminación de los perfiles personales de personas fallecidas en redes sociales o servicios equivalentes, a menos que el fallecido hubiera decidido acerca de esta circunstancia, en cuyo caso se estará a sus instrucciones.

El responsable del servicio al que se le comunique, con arreglo al párrafo anterior, la solicitud de eliminación del perfil, deberá proceder sin dilación a la misma.

3. Mediante real decreto se establecerán los requisitos y condiciones para acreditar la validez y vigencia de los mandatos e instrucciones y, en su caso, el registro de los mismos, que podrá coincidir con el previsto en el artículo 3 de esta ley orgánica.

4. Lo establecido en este artículo en relación con las personas fallecidas en las comunidades autónomas con derecho civil, foral o especial, propio se regirá por lo establecido por estas dentro de su ámbito de aplicación.

Artículo 97.- Políticas de impulso de los derechos digitales.

1. El Gobierno, en colaboración con las comunidades autónomas, elaborará un Plan de Acceso a Internet con los siguientes objetivos:

a) superar las brechas digitales y garantizar el acceso a Internet de colectivos vulnerables o con necesidades especiales y de entornos familiares y sociales económicamente desfavorecidos mediante, entre otras medidas, un bono social de acceso a Internet;

b) impulsar la existencia de espacios de conexión de acceso público; y

c) fomentar medidas educativas que promuevan la formación en competencias y habilidades digitales básicas a personas y colectivos en riesgo de exclusión digital y la capacidad de todas las personas para realizar un uso autónomo y responsable de Internet y de las tecnologías digitales.

2. Asimismo se aprobará un Plan de Actuación dirigido a promover las acciones de formación, difusión y concienciación necesarias para lograr que los menores de edad hagan un uso equilibrado y responsable de los dispositivos digitales y de las redes sociales y de los servicios de la sociedad de la información equivalentes de Internet con la finalidad de garantizar su adecuado desarrollo de la personalidad y de preservar su dignidad y derechos fundamentales.

3. El Gobierno presentará un informe anual ante la comisión parlamentaria correspondiente del Congreso de los Diputados en el que se dará cuenta de la evolución de los derechos, garantías y mandatos contemplados en el presente Título y de las medidas necesarias para promover su impulso y efectividad.

Disposición adicional primera.- Medidas de seguridad en el ámbito del sector público.

1. El Esquema Nacional de Seguridad incluirá las medidas que deban implantarse en caso de tratamiento de datos personales para evitar su pérdida, alteración o acceso no autorizado, adaptando los criterios de determinación del riesgo en el tratamiento de los datos a lo establecido en el artículo 32 del Reglamento (UE) 2016/679.

2. Los responsables enumerados en el artículo 77.1 de esta ley orgánica deberán aplicar a los tratamientos de datos personales las medidas de seguridad que correspondan de las previstas en el Esquema Nacional de Seguridad, así como impulsar un grado de implementación de medidas equivalentes en las empresas o fundaciones vinculadas a los mismos sujetas al Derecho privado.

En los casos en los que un tercero preste un servicio en régimen de concesión, encomienda de gestión o contrato, las medidas de seguridad se corresponderán con las de la Administración pública de origen y se ajustarán al Esquema Nacional de Seguridad.

Disposición adicional segunda.- Protección de datos y transparencia y acceso a la información pública.

La publicidad activa y el acceso a la información pública regulados por el Título I de la Ley 19/2013, de 9 de diciembre, de transparencia, acceso a la información pública y buen gobierno, así como las obligaciones de publicidad activa establecidas por la legislación autonómica, se someterán, cuando la información contenga datos personales, a lo dispuesto en los artículos 5.3 y 15 de la Ley 19/2013, en el Reglamento (UE) 2016/679 y en la presente ley orgánica.

Disposición adicional tercera.- Cómputo de plazos.

Los plazos establecidos en el Reglamento (UE) 2016/679 o en esta ley orgánica, con independencia de que se refieran a relaciones entre particulares o con entidades del sector público, se regirán por las siguientes reglas:

a) Cuando los plazos se señalen por días, se entiende que estos son hábiles, excluyéndose del cómputo los sábados, los domingos y los declarados festivos.

b) Si el plazo se fija en semanas, concluirá el mismo día de la semana en que se produjo el hecho que determina su iniciación en la semana de vencimiento.

c) Si el plazo se fija en meses o años, concluirá el mismo día en que se produjo el hecho que determina su iniciación en el mes o el año de vencimiento. Si en el mes de vencimiento no hubiera día equivalente a aquel en que comienza el cómputo, se entenderá que el plazo expira el último día del mes.

d) Cuando el último día del plazo sea inhábil, se entenderá prorrogado al primer día hábil siguiente.

Disposición adicional cuarta.- Procedimiento en relación con las competencias atribuidas a la Agencia Española de Protección de Datos por otras leyes.

Lo dispuesto en el Título VIII y en sus normas de desarrollo será de aplicación a los procedimientos que la Agencia Española de Protección de Datos hubiera de tramitar en ejercicio de las competencias que le fueran atribuidas por otras leyes.

Disposición adicional quinta.- Autorización judicial en relación con decisiones de la Comisión Europea en materia de transferencia internacional de datos.

1. Cuando una autoridad de protección de datos considerase que una decisión de la Comisión Europea en materia de transferencia internacional de datos, de cuya validez dependiese la resolución de un procedimiento concreto, infringiese lo dispuesto en el Reglamento (UE) 2016/679, menoscabando el derecho fundamental a la protección de datos, acordará inmediatamente la suspensión del procedimiento, a fin de solicitar del órgano judicial autorización para declararlo así en el seno del procedimiento del que esté conociendo. Dicha suspensión deberá ser confirmada, modificada o levantada en el acuerdo de admisión o inadmisión a trámite de la solicitud de la autoridad de protección de datos dirigida al tribunal competente.

Las decisiones de la Comisión Europea a las que puede resultar de aplicación este cauce son:

a) aquellas que declaren el nivel adecuado de protección de un tercer país u organización internacional, en virtud del artículo 45 del Reglamento (UE) 2016/679;

b) aquellas por las que se aprueben cláusulas tipo de protección de datos para la realización de transferencias internacionales de datos, o

c) aquellas que declaren la validez de los códigos de conducta a tal efecto.

2. La autorización a la que se refiere esta disposición solamente podrá ser concedida si, previo planteamiento de cuestión prejudicial de validez en los términos del artículo 267 del Tratado de Funcionamiento de la Unión Europea, la decisión de la Comisión Europea cuestionada fuera declarada inválida por el Tribunal de Justicia de la Unión Europea.

Disposición adicional sexta.- Incorporación de deudas a sistemas de información crediticia.

No se incorporarán a los sistemas de información crediticia a los que se refiere el artículo 20.1 de esta ley orgánica deudas en que la cuantía del principal sea inferior a cincuenta euros.

El Gobierno, mediante real decreto, podrá actualizar esta cuantía.

Disposición adicional séptima.- Identificación de los interesados en las notificaciones por medio de anuncios y publicaciones de actos administrativos.

1. Cuando sea necesaria la publicación de un acto administrativo que contuviese datos personales del afectado, se identificará al mismo mediante su nombre y apellidos, añadiendo cuatro cifras numéricas aleatorias del documento nacional de identidad, número de identidad de extranjero, pasaporte o documento equivalente. Cuando la publicación se refiera a una pluralidad de afectados estas cifras aleatorias deberán alternarse.

Cuando se trate de la notificación por medio de anuncios, particularmente en los supuestos a los que se refiere el artículo 44 de la Ley 39/2015, de 1 de octubre, del Procedimiento Administrativo Común de las Administraciones Públicas, se identificará al afectado exclusivamente mediante el número completo de su documento nacional de identidad, número de identidad de extranjero, pasaporte o documento equivalente.

Cuando el afectado careciera de cualquiera de los documentos mencionados en los dos párrafos anteriores, se identificará al afectado únicamente mediante su nombre y apellidos. En ningún caso debe publicarse el nombre y apellidos de manera conjunta con el número completo del documento nacional de identidad, número de identidad de extranjero, pasaporte o documento equivalente.

2. A fin de prevenir riesgos para víctimas de violencia de género, el Gobierno impulsará la elaboración de un protocolo de colaboración que defina procedimientos seguros de publicación y notificación de actos administrativos, con la participación de los órganos con competencia en la materia.

Disposición adicional octava.- Potestad de verificación de las Administraciones Públicas.

Cuando se formulen solicitudes por cualquier medio en las que el interesado declare datos personales que obren en poder de las Administraciones Públicas, el órgano destinatario de la solicitud podrá efectuar en el ejercicio de sus competencias las verificaciones necesarias para comprobar la exactitud de los datos.

Disposición adicional novena.- Tratamiento de datos personales en relación con la notificación de incidentes de seguridad.

Cuando, de conformidad con lo dispuesto en la legislación nacional que resulte de aplicación, deban notificarse incidentes de seguridad, las autoridades públicas competentes, equipos de respuesta a emergencias informáticas (CERT), equipos de respuesta a incidentes de seguridad informática (CSIRT), proveedores de redes y servicios de comunicaciones electrónicas y proveedores de tecnologías y servicios de seguridad, podrán tratar los datos personales contenidos en tales notificaciones, exclusivamente durante el tiempo y alcance necesarios para su análisis, detección, protección y respuesta ante incidentes y adoptando las medidas de seguridad adecuadas y proporcionadas al nivel de riesgo determinado.

Disposición adicional décima.- Comunicaciones de datos por los sujetos enumerados en el artículo 77.1.

Los responsables enumerados en el artículo 77.1 de esta ley orgánica podrán comunicar los datos personales que les sean solicitados por sujetos de derecho privado cuando cuenten con el consentimiento de los afectados o aprecien que concurre en los solicitantes un interés legítimo que prevalezca sobre los derechos e intereses de los afectados conforme a lo establecido en el artículo 6.1 f) del Reglamento (UE) 2016/679.

Disposición adicional undécima.- Privacidad en las comunicaciones electrónicas.

Lo dispuesto en la presente ley orgánica se entenderá sin perjuicio de la aplicación de las normas de Derecho interno y de la Unión Europea reguladoras de la privacidad en el sector de las comunicaciones electrónicas, sin imponer obligaciones adicionales a las personas físicas o jurídicas en materia de tratamiento en el marco de la prestación de servicios públicos de comunicaciones electrónicas en redes públicas de comunicación en ámbitos en los que estén sujetas a obligaciones específicas establecidas en dichas normas.

Disposición adicional duodécima.- Disposiciones específicas aplicables a los tratamientos de los registros de personal del sector público.

1. Los tratamientos de los registros de personal del sector público se entenderán realizados en el ejercicio de poderes públicos conferidos a sus responsables, de acuerdo con lo previsto en el artículo 6.1.e) del Reglamento (UE) 2016/679.

2. Los registros de personal del sector público podrán tratar datos personales relativos a infracciones y condenas penales e infracciones y sanciones administrativas, limitándose a los datos estrictamente necesarios para el cumplimiento de sus fines.

3. De acuerdo con lo previsto en el artículo 18.2 del Reglamento (UE) 2016/679, y por considerarlo una razón de interés público importante, los datos cuyo tratamiento se haya limitado en virtud del artículo 18.1 del citado reglamento, podrán ser objeto de tratamiento cuando sea necesario para el desarrollo de los procedimientos de personal.

Disposición adicional decimotercera.- Transferencias internacionales de datos tributarios.

Las transferencias de datos tributarios entre el Reino de España y otros Estados o entidades internacionales o supranacionales, se regularán por los términos y con los límites establecidos en la normativa sobre asistencia mutua entre los Estados de la Unión Europea, o en el marco de los convenios para evitar la doble imposición o de otros convenios internacionales, así como por las normas sobre la asistencia mutua establecidas en el Capítulo VI del Título III de la Ley 58/2003, de 17 de diciembre, General Tributaria.

Disposición adicional decimocuarta.- Normas dictadas en desarrollo del artículo 13 de la Directiva 95/46/CE.

Las normas dictadas en aplicación del artículo 13 de la Directiva 95/46/CE del Parlamento Europeo y del Consejo, de 24 de octubre de 1995, relativa a la protección de las personas físicas en lo que respecta al tratamiento de datos personales y a la libre circulación de estos datos, que hubiesen entrado en vigor con anterioridad a 25 de mayo de 2018, y en particular los artículos 23 y 24 de la Ley Orgánica 15/1999, de 13 de diciembre, de Protección de Datos de Carácter Personal, siguen vigentes en tanto no sean expresamente modificadas, sustituidas o derogadas.

Disposición adicional decimoquinta.- Requerimiento de información por parte de la Comisión Nacional del Mercado de Valores.

Cuando no haya podido obtener por otros medios la información necesaria para realizar sus labores de supervisión o inspección, la Comisión Nacional del Mercado de Valores podrá recabar de los operadores que presten servicios de comunicaciones electrónicas disponibles al público y de los prestadores de servicios de la sociedad de la información, los datos que obren en su poder relativos a la comunicación electrónica o servicio de la sociedad de la información proporcionados por dichos prestadores que sean distintos a su contenido y resulten imprescindibles para el ejercicio de dichas labores.

La cesión de estos datos requerirá la previa obtención de autorización judicial otorgada conforme a las normas procesales.

Disposición adicional decimosexta.- Prácticas agresivas en materia de protección de datos.

A los efectos previstos en el artículo 8 de la Ley 3/1991, de 10 de enero, de Competencia Desleal, se consideran prácticas agresivas las siguientes:

a) Actuar con intención de suplantar la identidad de la Agencia Española de Protección de Datos o de una autoridad autonómica de protección de datos en la realización de cualquier comunicación a los responsables y encargados de los tratamientos o a los interesados.

b) Generar la apariencia de que se está actuando en nombre, por cuenta o en colaboración con la Agencia Española de Protección de Datos o una autoridad autonómica de protección de datos en la realización de cualquier comunicación a los responsables y encargados de los tratamientos en que la remitente ofrezca sus productos o servicios.

c) Realizar prácticas comerciales en las que se coarte el poder de decisión de los destinatarios mediante la referencia a la posible imposición de sanciones por incumplimiento de la normativa de protección de datos personales.

d) Ofrecer cualquier tipo de documento por el que se pretenda crear una apariencia de cumplimiento de las disposiciones de protección de datos de forma complementaria a la realización de acciones formativas sin haber llevado a cabo las actuaciones necesarias para verificar que dicho cumplimiento se produce efectivamente.

e) Asumir, sin designación expresa del responsable o el encargado del tratamiento, la función de delegado de protección de datos y comunicarse en tal condición con la Agencia Española de Protección de Datos o las autoridades autonómicas de protección de datos.

Disposición adicional decimoséptima.- Tratamientos de datos de salud.

1. Se encuentran amparados en las letras g), h), i) y j) del artículo 9.2 del Reglamento (UE) 2016/679 los tratamientos de datos relacionados con la salud y de datos genéticos que estén regulados en las siguientes leyes y sus disposiciones de desarrollo:

a) La Ley 14/1986, de 25 de abril, General de Sanidad.

b) La Ley 31/1995, de 8 de noviembre, de Prevención de Riesgos Laborales.

c) La Ley 41/2002, de 14 de noviembre, básica reguladora de la autonomía del paciente y de derechos y obligaciones en materia de información y documentación clínica.

d) La Ley 16/2003, de 28 de mayo, de cohesión y calidad del Sistema Nacional de Salud.

e) La Ley 44/2003, de 21 de noviembre, de ordenación de las profesiones sanitarias.

f) La Ley 14/2007, de 3 de julio, de Investigación biomédica.

g) La Ley 33/2011, de 4 de octubre, General de Salud Pública.

h) La Ley 20/2015, de 14 de julio, de ordenación, supervisión y solvencia de las entidades aseguradoras y reaseguradoras.

i) El texto refundido de la Ley de garantías y uso racional de los 105 medicamentos y productos sanitarios, aprobado por Real Decreto Legislativo 1/2015, de 24 de julio.

j) El texto refundido de la Ley General de derechos de las personas con discapacidad y de su inclusión social, aprobado por Real Decreto Legislativo 1/2013 de 29 de noviembre.

2. El tratamiento de datos en la investigación en salud se regirá por los siguientes criterios:

a) El interesado o, en su caso, su representante legal podrá otorgar el consentimiento para el uso de sus datos con fines de investigación en salud y, en particular, la biomédica. Tales finalidades podrán abarcar categorías relacionadas con áreas generales vinculadas a una especialidad médica o investigadora.

b) Las autoridades sanitarias e instituciones públicas con competencias en vigilancia de la salud pública podrán llevar a cabo estudios científicos sin el consentimiento de los afectados en situaciones de excepcional relevancia y gravedad para la salud pública.

c) Se considerará lícita y compatible la reutilización de datos personales con fines de investigación en materia de salud y biomédica cuando, habiéndose obtenido el consentimiento para una finalidad concreta, se utilicen los datos para finalidades o áreas de investigación relacionadas con el área en la que se integrase científicamente el estudio inicial.

En tales casos, los responsables deberán publicar la información establecida por el artículo 13 del Reglamento (UE) 2016/679 del Parlamento Europeo y del Consejo, de 27 de abril de 2016, relativo a la protección de las personas físicas en lo que respecta al tratamiento de sus datos personales y a la libre circulación de estos datos, en un lugar fácilmente accesible de la página web corporativa del centro donde se realice la investigación o estudio clínico, y, en su caso, en la del promotor, y notificar la existencia de esta información por medios electrónicos a los afectados. Cuando estos carezcan de medios para acceder a tal información, podrán solicitar su remisión en otro formato.

Para los tratamientos previstos en esta letra, se requerirá informe previo favorable del comité de ética de la investigación.

d) Se considera lícito el uso de datos personales seudonimizados con fines de investigación en salud y, en particular, biomédica.

El uso de datos personales seudonimizados con fines de investigación en salud pública y biomédica requerirá:

1.º Una separación técnica y funcional entre el equipo investigador y quienes realicen la seudonimización y conserven la información que posibilite la reidentificación.

2.º Que los datos seudonimizados únicamente sean accesibles al equipo de investigación cuando:

i) Exista un compromiso expreso de confidencialidad y de no realizar ninguna actividad de reidentificación.

ii) Se adopten medidas de seguridad específicas para evitar la reidentificación y el acceso de terceros no autorizados.

Podrá procederse a la reidentificación de los datos en su origen, cuando con motivo de una investigación que utilice datos seudonimizados, se aprecie la existencia de un peligro real y concreto para la seguridad o salud de una persona o grupo de personas, o una amenaza grave para sus derechos o sea necesaria para garantizar una adecuada asistencia sanitaria.

e) Cuando se traten datos personales con fines de investigación en salud, y en particular la biomédica, a los efectos del artículo 89.2 del Reglamento (UE) 2016/679, podrán excepcionarse los derechos de los afectados previstos en los artículos 15, 16, 18 y 21 del Reglamento (EU) 2016/679 cuando:

1.º Los citados derechos se ejerzan directamente ante los investigadores o centros de investigación que utilicen datos anonimizados o seudonimizados.

2.º El ejercicio de tales derechos se refiera a los resultados de la investigación.

3.º La investigación tenga por objeto un interés público esencial relacionado con la seguridad del Estado, la defensa, la seguridad pública u otros objetivos importantes de interés público general, siempre que en este último caso la excepción esté expresamente recogida por una norma con rango de Ley.

f) Cuando conforme a lo previsto por el artículo 89 del Reglamento (UE) 2016/679, se lleve a cabo un tratamiento con fines de investigación en salud pública y, en particular, biomédica se procederá a:

1.º Realizar una evaluación de impacto que determine los riesgos derivados del tratamiento en los supuestos previstos en el artículo 35 del Reglamento (UE) 2016/679 o en los establecidos por la autoridad de control. Esta evaluación incluirá de modo específico los riesgos de reidentificación vinculados a la anonimización o seudonimización de los datos.

2.º Someter la investigación científica a las normas de calidad y, en su caso, a las directrices internacionales sobre buena práctica clínica.

3.º Adoptar, en su caso, medidas dirigidas a garantizar que los investigadores no acceden a datos de identificación de los interesados.

4.º Designar un representante legal establecido en la Unión Europea, conforme al artículo 74 del Reglamento (UE) 536/2014, si el promotor de un ensayo clínico no está establecido en la Unión Europea. Dicho representante legal podrá coincidir con el previsto en el artículo 27.1 del Reglamento (UE) 2016/679.

g) El uso de datos personales seudonimizados con fines de investigación en salud pública y, en particular, biomédica deberá ser sometido al informe previo del comité de ética de la investigación previsto en la normativa sectorial.

En defecto de la existencia del mencionado Comité, la entidad responsable de la investigación requerirá informe previo del delegado de protección de datos o, en su defecto, de un experto con los conocimientos previos en el artículo 37.5 del Reglamento (UE) 2016/679.

h) En el plazo máximo de un año desde la entrada en vigor de esta ley, los comités de ética de la investigación, en el ámbito de la salud, biomédico o del medicamento, deberán integrar entre sus miembros un delegado de protección de datos o, en su defecto, un experto con conocimientos suficientes del Reglamento (UE) 2016/679 cuando se ocupen de actividades de investigación que comporten el tratamiento de datos personales o de datos seudonimizados o anonimizados.

Disposición adicional decimoctava.- Criterios de seguridad.

La Agencia Española de Protección de Datos desarrollará, con la colaboración, cuando sea precisa, de todos los actores implicados, las herramientas, guías, directrices y orientaciones que resulten precisas para dotar a los profesionales, microempresas y pequeñas y medianas empresas de pautas adecuadas para el cumplimiento de las obligaciones de responsabilidad activa establecidas en el Título IV del Reglamento (UE) 2016/679 y en el Título V de esta ley orgánica.

Disposición adicional decimonovena.- Derechos de los menores ante Internet.

En el plazo de un año desde la entrada en vigor de esta ley orgánica, el Gobierno remitirá al Congreso de los Diputados un proyecto de ley dirigido específicamente a garantizar los derechos de los menores ante el impacto de Internet, con el fin de garantizar su seguridad y luchar contra la discriminación y la violencia que sobre los mismos es ejercida mediante las nuevas tecnologías.

Disposición adicional vigésima.- Especialidades del régimen jurídico de la Agencia Española de Protección de Datos.

1. No será de aplicación a la Agencia Española de Protección de Datos el artículo 50.2.c) de la Ley 40/2015, de 1 de octubre, de Régimen Jurídico del Sector Público.

2. La Agencia Española de Protección de Datos podrá adherirse a los sistemas de contratación centralizada establecidos por las Administraciones Públicas y participar en la gestión compartida de servicios comunes prevista en el artículo 85 de la Ley 40/2015, de 1 de octubre, de Régimen Jurídico del Sector Público.

Disposición adicional vigésima primera.- Educación digital.

Las Administraciones educativas darán cumplimiento al mandato contenido en el párrafo segundo del apartado 1 del artículo 83 de esta ley orgánica en el plazo de un año a contar desde la entrada en vigor de la misma.

Disposición adicional vigésima segunda.- Acceso a los archivos públicos y eclesiásticos.

Las autoridades públicas competentes facilitarán el acceso a los archivos públicos y eclesiásticos en relación con los datos que se soliciten con ocasión de investigaciones policiales o judiciales de personas desaparecidas, debiendo atender las solicitudes con prontitud y diligencia las instituciones o congregaciones religiosas a las que se realicen las peticiones de acceso.

Disposición transitoria primera.- Estatuto de la Agencia Española de Protección de Datos.

1. El Estatuto de la Agencia Española de Protección de Datos, aprobado por Real Decreto 428/1993, de 26 de marzo, continuará vigente en lo que no se oponga a lo establecido en el Título VIII de esta ley orgánica.

2. Lo dispuesto en los apartados 2, 3 y 5 del artículo 48 y en el artículo 49 de esta ley orgánica se aplicará una vez expire el mandato de quien ostente la condición de Director de la Agencia Española de Protección de Datos a la entrada en vigor de la misma.

Disposición transitoria segunda.- Códigos tipo inscritos en las autoridades de protección de datos conforme a la Ley Orgánica 15/1999, de 13 de diciembre, de Protección de Datos de Carácter Personal.

Los promotores de los códigos tipo inscritos en el registro de la Agencia Española de Protección de Datos o en las autoridades autonómicas de protección de datos deberán adaptar su contenido a lo dispuesto en el artículo 40 del Reglamento (UE) 2016/679 en el plazo de un año a contar desde la entrada en vigor de esta ley orgánica.

Si, transcurrido dicho plazo, no se hubiera solicitado la aprobación prevista en el artículo 38.4 de esta ley orgánica, se cancelará la inscripción y se comunicará a sus promotores.

Disposición transitoria tercera.- Régimen transitorio de los procedimientos.

1. Los procedimientos ya iniciados a la entrada en vigor de esta ley orgánica se regirán por la normativa anterior, salvo que esta ley orgánica contenga disposiciones más favorables para el interesado.

2. Lo dispuesto en el apartado anterior será asimismo de aplicación a los procedimientos respecto de los cuales ya se hubieren iniciado las actuaciones previas a las que se refiere la Sección 2.ª del Capítulo III del Título IX del Reglamento de desarrollo de la Ley Orgánica 15/1999, de 13 de diciembre, de Protección de Datos de Carácter Personal, aprobado por Real Decreto 1720/2007, de 21 de diciembre.

Disposición transitoria cuarta.- Tratamientos sometidos a la Directiva (UE) 2016/680.

Los tratamientos sometidos a la Directiva (UE) 2016/680 del Parlamento Europeo y del Consejo, de 27 de abril de 2016, relativa a la protección de las personas físicas en lo que respecta al tratamiento de datos personales por parte de las autoridades competentes para fines de prevención, investigación, detección o enjuiciamiento de infracciones penales o de ejecución de sanciones penales, y a la libre circulación de dichos datos y por la que se deroga la Decisión Marco 2008/977/JAI del Consejo, continuarán rigiéndose por la Ley Orgánica 15/1999, de 13 de diciembre, y en particular el artículo 22, y sus disposiciones de desarrollo, en tanto no entre en vigor la norma que trasponga al Derecho español lo dispuesto en la citada directiva.

Disposición transitoria quinta.- Contratos de encargado del tratamiento.

Los contratos de encargado del tratamiento suscritos con anterioridad al 25 de mayo de 2018 al amparo de lo dispuesto en el artículo 12 de la Ley Orgánica 15/1999, de 13 de diciembre, de Protección de Datos de Carácter Personal mantendrán su vigencia hasta la fecha de vencimiento señalada en los mismos y en caso de haberse pactado de forma indefinida, hasta el 25 de mayo de 2022.

Durante dichos plazos cualquiera de las partes podrá exigir a la otra la modificación del contrato a fin de que el mismo resulte conforme a lo dispuesto en el artículo 28 del Reglamento (UE) 2016/679 y en el Capítulo II del Título V de esta ley orgánica.

Disposición transitoria sexta.- Reutilización con fines de investigación en materia de salud y biomédica de datos personales recogidos con anterioridad a la entrada en vigor de esta ley orgánica.

Se considerará lícita y compatible la reutilización con fines de investigación en salud y biomédica de datos personales recogidos lícitamente con anterioridad a la entrada en vigor de esta ley orgánica cuando concurra alguna de las circunstancias siguientes:

a) Que dichos datos personales se utilicen para la finalidad concreta para la que se hubiera prestado consentimiento.

b) Que, habiéndose obtenido el consentimiento para una finalidad concreta, se utilicen tales datos para finalidades o áreas de investigación relacionadas con la especialidad médica o investigadora en la que se integrase científicamente el estudio inicial.

Disposición derogatoria única.- Derogación normativa.

1. Sin perjuicio de lo previsto en la disposición adicional decimocuarta y en la disposición transitoria cuarta, queda derogada la Ley Orgánica 15/1999, de 13 de diciembre, de Protección de Datos de Carácter Personal.

2. Queda derogado el Real Decreto-ley 5/2018, de 27 de julio, de medidas urgentes para la adaptación del Derecho español a la normativa de la Unión Europea en materia de protección de datos.

3. Asimismo, quedan derogadas cuantas disposiciones de igual o inferior rango contradigan, se opongan, o resulten incompatibles con lo dispuesto en el Reglamento (UE) 2016/679 y en la presente ley orgánica.

Disposición final primera.- Naturaleza de la presente ley.

La presente ley tiene el carácter de ley orgánica.

No obstante, tienen carácter de ley ordinaria:

– El Título IV,

– el Título VII, salvo los artículos 52 y 53, que tienen carácter orgánico,

– el Título VIII,

– el Título IX,

– los artículos 79, 80, 81, 82, 88, 95, 96 y 97 del Título X,

– las disposiciones adicionales, salvo la disposición adicional segunda y la disposición adicional decimoséptima, que tienen carácter orgánico,

– las disposiciones transitorias,

– y las disposiciones finales, salvo las disposiciones finales primera, segunda, tercera, cuarta, octava, décima y decimosexta, que tienen carácter orgánico.

Disposición final segunda.- Título competencial.

1. Esta ley orgánica se dicta al amparo del artículo 149.1.1.ª de la Constitución, que atribuye al Estado la competencia exclusiva para la regulación de las condiciones básicas que garanticen la igualdad de todos los españoles en el ejercicio de los derechos y en el cumplimiento de los deberes constitucionales.

2. El Capítulo I del Título VII, el Título VIII, la disposición adicional cuarta y la disposición transitoria primera sólo serán de aplicación a la Administración General del Estado y a sus organismos públicos.

3. Los artículos 87 a 90 se dictan al amparo de la competencia exclusiva que el artículo 149.1.7.ª y 18.ª de la Constitución reserva al Estado en materia de legislación laboral y bases del régimen estatutario de los funcionarios públicos respectivamente.

4. La disposición adicional quinta y las disposiciones finales séptima y sexta se dictan al amparo de la competencia que el artículo 149.1.6.ª de la Constitución atribuye al Estado en materia de legislación procesal.

5. La disposición adicional tercera se dicta al amparo del artículo 149.1.18.ª de la Constitución.

6. El artículo 96 se dicta al amparo del artículo 149.1.8.ª de la Constitución.

Disposición final tercera.- Modificación de la Ley Orgánica 5/1985, de 19 de junio, del Régimen Electoral General.

Se modifica la Ley Orgánica 5/1985, de 19 de junio, del Régimen Electoral General que queda redactada como sigue:

Uno. El apartado 3 del artículo treinta y nueve queda redactado como sigue:

“3. Dentro del plazo anterior, cualquier persona podrá formular reclamación dirigida a la Delegación Provincial de la Oficina del Censo Electoral sobre sus datos censales, si bien solo podrán ser tenidas en cuenta las que se refieran a la rectificación de errores en los datos personales, a los cambios de domicilio dentro de una misma circunscripción o a la no inclusión del reclamante en ninguna Sección del Censo de la circunscripción pese a tener derecho a ello. También serán atendidas las solicitudes de los electores que se opongan a su inclusión en las copias del censo electoral que se faciliten a los representantes de las candidaturas para realizar envíos postales de propaganda electoral. No serán tenidas en cuenta para la elección convocada las que reflejen un cambio de residencia de una circunscripción a otra, realizado con posterioridad a la fecha de cierre del censo para cada elección, debiendo ejercer su derecho en la sección correspondiente a su domicilio anterior.”

Dos. Se añade un nuevo artículo cincuenta y ocho bis, con el contenido siguiente:

“Artículo cincuenta y ocho bis.- Utilización de medios tecnológicos y datos personales en las actividades electorales.

1. La recopilación de datos personales relativos a las opiniones políticas de las personas que lleven a cabo los partidos políticos en el marco de sus actividades electorales se encontrará amparada en el interés público únicamente cuando se ofrezcan garantías adecuadas.

2. Los partidos políticos, coaliciones y agrupaciones electorales podrán utilizar datos personales obtenidos en páginas web y otras fuentes de acceso público para la realización de actividades políticas durante el periodo electoral.

3. El envío de propaganda electoral por medios electrónicos o sistemas de mensajería y la contratación de propaganda electoral en redes sociales o medios equivalentes no tendrán la consideración de actividad o comunicación comercial.

4. Las actividades divulgativas anteriormente referidas identificarán de modo destacado su naturaleza electoral.

5. Se facilitará al destinatario un modo sencillo y gratuito de ejercicio del derecho de oposición.”

Disposición final cuarta.- Modificación de la Ley Orgánica 6/1985, de 1 de julio, del Poder Judicial.

Se modifica la Ley Orgánica, 6/1985, de 1 de julio, del Poder Judicial, en los siguientes términos:

Uno. Se añade un apartado tercero al artículo 58, con la siguiente redacción:

“Artículo 58.

Dos. Se añade una letra f) al artículo 66, con la siguiente redacción:

“Artículo 66.

Tres. Se añaden una letra k) al apartado 1 y un nuevo apartado 7 al artículo 74, con la siguiente redacción:

“Artículo 74.

1. […]

[…]

Cuatro. Se añade un nuevo apartado 7 al artículo 90:

“7. Corresponde a los Juzgados Centrales de lo Contencioso-administrativo autorizar, mediante auto, el requerimiento de información por parte de la Agencia Española de Protección de Datos y otras autoridades administrativas independientes de ámbito estatal a los operadores que presten servicios de comunicaciones electrónicas disponibles al público y de los prestadores de servicios de la sociedad de la información, cuando ello sea necesario de acuerdo con la legislación específica.”

Disposición final quinta.- Modificación de la Ley 14/1986, de 25 de abril, General de Sanidad.

Se añade un nuevo Capítulo II al Título VI de la Ley 14/1986, de 25 de abril, General de Sanidad con el siguiente contenido:

“CAPÍTULO II.- Tratamiento de datos de la investigación en salud

Artículo 105 bis.

El tratamiento de datos personales en la investigación en salud se regirá por lo dispuesto en la Disposición adicional decimoséptima de la Ley Orgánica de Protección de Datos Personales y Garantía de los Derechos Digitales.”

Disposición final sexta.- Modificación de la Ley 29/1998, de 13 de julio, reguladora de la Jurisdicción Contencioso-administrativa.

La Ley 29/1998, de 13 de julio, reguladora de la Jurisdicción Contencioso-administrativa, se modifica en los siguientes términos:

Uno. Se añade un nuevo apartado 7 al artículo 10:

“7. Conocerán de la solicitud de autorización al amparo del artículo 122 ter, cuando sea formulada por la autoridad de protección de datos de la Comunidad Autónoma respectiva.”

Dos. Se añade un nuevo apartado 5 al artículo 11:

“5. Conocerá de la solicitud de autorización al amparo del artículo 122 ter, cuando sea formulada por la Agencia Española de Protección de Datos.”

Tres. Se añade un nuevo apartado 4 al artículo 12:

“4. Conocerá de la solicitud de autorización al amparo del artículo 122 ter, cuando sea formulada por el Consejo General del Poder Judicial.”

Cuatro. Se introduce un nuevo artículo 122 ter, con el siguiente tenor:

“Artículo 122 ter. Procedimiento de autorización judicial de conformidad de una decisión de la Comisión Europea en materia de transferencia internacional de datos.

1. El procedimiento para obtener la autorización judicial a que se refiere la disposición adicional quinta de la Ley Orgánica de Protección de Datos Personales y Garantía de los Derechos Digitales, se iniciará con la solicitud de la autoridad de protección de datos dirigida al Tribunal competente para que se pronuncie acerca de la conformidad de una decisión de la Comisión Europea en materia de transferencia internacional de datos con el Derecho de la Unión Europea. La solicitud irá acompañada de copia del expediente que se encontrase pendiente de resolución ante la autoridad de protección de datos.

2. Serán partes en el procedimiento, además de la autoridad de protección de datos, quienes lo fueran en el procedimiento tramitado ante ella y, en todo caso, la Comisión Europea.

3. El acuerdo de admisión o inadmisión a trámite del procedimiento confirmará, modificará o levantará la suspensión del procedimiento por posible vulneración de la normativa de protección de datos tramitado ante la autoridad de protección de datos, del que trae causa este procedimiento de autorización judicial.

4. Admitida a trámite la solicitud, el Tribunal competente lo notificará a la autoridad de protección de datos a fin de que dé traslado a quienes interviniesen en el procedimiento tramitado ante la misma para que se personen en el plazo de tres días. Igualmente, se dará traslado a la Comisión Europea a los mismos efectos.

5. Concluido el plazo mencionado en la letra anterior, se dará traslado de la solicitud de autorización a las partes personadas a fin de que en el plazo de diez días aleguen lo que estimen procedente, pudiendo solicitar en ese momento la práctica de las pruebas que estimen necesarias.

6. Transcurrido el período de prueba, si alguna de las partes lo hubiese solicitado y el órgano jurisdiccional lo estimase pertinente, se celebrará una vista. El Tribunal podrá decidir el alcance de las cuestiones sobre las que las partes deberán centrar sus alegaciones en dicha vista.

7. Finalizados los trámites mencionados en los tres apartados anteriores, el Tribunal competente adoptará en el plazo de diez días una de estas decisiones:

a) Si considerase que la decisión de la Comisión Europea es conforme al Derecho de la Unión Europea, dictará sentencia declarándolo así y denegando la autorización solicitada.

b) En caso de considerar que la decisión es contraria al Derecho de la Unión Europea, dictará auto de planteamiento de cuestión prejudicial de validez de la citada decisión ante el Tribunal de Justicia de la Unión Europea, en los términos del artículo 267 del Tratado de Funcionamiento de la Unión Europea.

La autorización solamente podrá ser concedida si la decisión de la Comisión Europea cuestionada fuera declarada inválida por el Tribunal de Justicia de la Unión Europea.

8. El régimen de recursos será el previsto en esta ley.”

Disposición final séptima.- Modificación de la Ley 1/2000, de 7 de enero, de Enjuiciamiento Civil.

Se modifica el artículo 15 bis de la Ley 1/2000, de 7 de enero, de Enjuiciamiento Civil, que queda redactado como sigue:

“Artículo 15 bis. Intervención en procesos de defensa de la competencia y de protección de datos.

1. La Comisión Europea, la Comisión Nacional de los Mercados y la Competencia y los órganos competentes de las comunidades autónomas en el ámbito de sus competencias podrán intervenir en los procesos de defensa de la competencia y de protección de datos, sin tener la condición de parte, por propia iniciativa o a instancia del órgano judicial, mediante la aportación de información o presentación de observaciones escritas sobre cuestiones relativas a la aplicación de los artículos 101 y 102 del Tratado de Funcionamiento de la Unión Europea o los artículos 1 y 2 de la Ley 15/2007, de 3 de julio, de Defensa de la Competencia. Con la venia del correspondiente órgano judicial, podrán presentar también observaciones verbales. A estos efectos, podrán solicitar al órgano jurisdiccional competente que les remita o haga remitir todos los documentos necesarios para realizar una valoración del asunto de que se trate.

La aportación de información no alcanzará a los datos o documentos obtenidos en el ámbito de las circunstancias de aplicación de la exención o reducción del importe de las multas previstas en los artículos 65 y 66 de la Ley 15/2007, de 3 de julio, de Defensa de la Competencia.

2. La Comisión Europea, la Comisión Nacional de los Mercados y la Competencia y los órganos competentes de las comunidades autónomas aportarán la información o presentarán las observaciones previstas en el número anterior diez días antes de la celebración del acto del juicio a que se refiere el artículo 433 o dentro del plazo de oposición o impugnación del recurso interpuesto.

3. Lo dispuesto en los anteriores apartados en materia de procedimiento será asimismo de aplicación cuando la Comisión Europea, la Agencia Española de Protección de Datos y las autoridades autonómicas de protección de datos, en el ámbito de sus competencias, consideren precisa su intervención en un proceso que afecte a cuestiones relativas a la aplicación del Reglamento (UE) 2016/679 del Parlamento Europeo y del Consejo, de 27 de abril de 2016.”

Disposición final octava.- Modificación de la Ley Orgánica 6/2001, de 21 de diciembre, de Universidades.

Se incluye una nueva letra l) en el apartado 2 del artículo 46 de la Ley Orgánica 6/2001, de 21 de diciembre, de Universidades, con el contenido siguiente:

“l) La formación en el uso y seguridad de los medios digitales y en la garantía de los derechos fundamentales en Internet.”

Disposición final novena.- Modificación de la Ley 41/2002, de 14 de noviembre, básica reguladora de la autonomía del paciente y de derechos y obligaciones en materia de información y documentación clínica.

Se modifica el apartado 3 del artículo 16 de la Ley 41/2002, de 14 de noviembre, básica reguladora de la autonomía del paciente y de derechos y obligaciones en materia de información y documentación clínica, que pasa a tener el siguiente tenor:

“Artículo 16. […]

El acceso a la historia clínica con fines judiciales, epidemiológicos, de salud pública, de investigación o de docencia, se rige por lo dispuesto en la legislación vigente en materia de protección de datos personales, y en la Ley 14/1986, de 25 de abril, General de Sanidad, y demás normas de aplicación en cada caso. El acceso a la historia clínica con estos fines obliga a preservar los datos de identificación personal del paciente, separados de los de carácter clinicoasistencial, de manera que, como regla general, quede asegurado el anonimato, salvo que el propio paciente haya dado su consentimiento para no separarlos.

Se exceptúan los supuestos de investigación previstos en el apartado 2 de la Disposición adicional decimoséptima de la Ley Orgánica de Protección de Datos Personales y Garantía de los Derechos Digitales.

Asimismo se exceptúan los supuestos de investigación de la autoridad judicial en los que se considere imprescindible la unificación de los datos identificativos con los clinicoasistenciales, en los cuales se estará a lo que dispongan los jueces y tribunales en el proceso correspondiente. El acceso a los datos y documentos de la historia clínica queda limitado estrictamente a los fines específicos de cada caso.

Cuando ello sea necesario para la prevención de un riesgo o peligro grave para la salud de la población, las Administraciones sanitarias a las que se refiere la Ley 33/2011, de 4 de octubre, General de Salud Pública, podrán acceder a los datos identificativos de los pacientes por razones epidemiológicas o de protección de la salud pública. El acceso habrá de realizarse, en todo caso, por un profesional sanitario sujeto al secreto profesional o por otra persona sujeta, asimismo, a una obligación equivalente de secreto, previa motivación por parte de la Administración que solicitase el acceso a los datos.”

Disposición final décima.- Modificación de la Ley Orgánica 2/2006, de 3 de mayo, de Educación.

Se incluye una nueva letra l) en el apartado 1 del artículo 2 de la Ley Orgánica 2/2006, de 3 de mayo, de Educación, que queda redactado como sigue:

“l) La capacitación para garantizar la plena inserción del alumnado en la sociedad digital y el aprendizaje de un uso seguro de los medios digitales y respetuoso con la dignidad humana, los valores constitucionales, los derechos fundamentales y, particularmente, con el respeto y la garantía de la intimidad individual y colectiva.”

Disposición final undécima.- Modificación de la Ley 19/2013, de 9 de diciembre, de transparencia, acceso a la información pública y buen gobierno.

Se modifica la Ley 19/2013, de 9 de diciembre, de transparencia, acceso a la información pública y buen gobierno, en los siguientes términos:

Uno. Se añade un nuevo artículo 6 bis, con la siguiente redacción:

“Artículo 6 bis. Registro de actividades de tratamiento.

Los sujetos enumerados en el artículo 77.1 de la Ley Orgánica de Protección de Datos Personales y Garantía de los Derechos Digitales, publicarán su inventario de actividades de tratamiento en aplicación del artículo 31 de la citada Ley Orgánica.”

Dos. El apartado 1 del artículo 15 queda redactado como sigue:

“1. Si la información solicitada contuviera datos personales que revelen la ideología, afiliación sindical, religión o creencias, el acceso únicamente se podrá autorizar en caso de que se contase con el consentimiento expreso y por escrito del afectado, a menos que dicho afectado hubiese hecho manifiestamente públicos los datos con anterioridad a que se solicitase el acceso.

Si la información incluyese datos personales que hagan referencia al origen racial, a la salud o a la vida sexual, incluyese datos genéticos o biométricos o contuviera datos relativos a la comisión de infracciones penales o administrativas que no conllevasen la amonestación pública al infractor, el acceso solo se podrá autorizar en caso de que se cuente con el consentimiento expreso del afectado o si aquel estuviera amparado por una norma con rango de ley.”

Disposición final duodécima.- Modificación de la Ley 39/2015, de 1 de octubre, del Procedimiento Administrativo Común de las Administraciones Públicas.

Se modifican los apartados 2 y 3 del artículo 28 de la Ley 39/2015, de 1 de octubre, del Procedimiento Administrativo Común de las Administraciones Públicas, que pasan a tener la siguiente redacción:

“Artículo 28. […]

2. Los interesados tienen derecho a no aportar documentos que ya se encuentren en poder de la Administración actuante o hayan sido elaborados por cualquier otra Administración. La administración actuante podrá consultar o recabar dichos documentos salvo que el interesado se opusiera a ello. No cabrá la oposición cuando la aportación del documento se exigiera en el marco del ejercicio de potestades sancionadoras o de inspección.

Las Administraciones Públicas deberán recabar los documentos electrónicamente a través de sus redes corporativas o mediante consulta a las plataformas de intermediación de datos u otros sistemas electrónicos habilitados al efecto.

Cuando se trate de informes preceptivos ya elaborados por un órgano administrativo distinto al que tramita el procedimiento, estos deberán ser remitidos en el plazo de diez días a contar desde su solicitud. Cumplido este plazo, se informará al interesado de que puede aportar este informe o esperar a su remisión por el órgano competente.

3. Las Administraciones no exigirán a los interesados la presentación de documentos originales, salvo que, con carácter excepcional, la normativa reguladora aplicable establezca lo contrario.

Asimismo, las Administraciones Públicas no requerirán a los interesados datos o documentos no exigidos por la normativa reguladora aplicable o que hayan sido aportados anteriormente por el interesado a cualquier Administración. A estos efectos, el interesado deberá indicar en qué momento y ante qué órgano administrativo presentó los citados documentos, debiendo las Administraciones Públicas recabarlos electrónicamente a través de sus redes corporativas o de una consulta a las plataformas de intermediación de datos u otros sistemas electrónicos habilitados al efecto, salvo que conste en el procedimiento la oposición expresa del interesado o la ley especial aplicable requiera su consentimiento expreso. Excepcionalmente, si las Administraciones Públicas no pudieran recabar los citados documentos, podrán solicitar nuevamente al interesado su aportación.”

Disposición final decimotercera.- Modificación del texto refundido de la Ley del Estatuto de los Trabajadores.

Se añade un nuevo artículo 20 bis al texto refundido de la Ley del Estatuto de los Trabajadores, aprobado por Real Decreto Legislativo 2/2015, de 23 de octubre, con el siguiente contenido:

“Artículo 20 bis. Derechos de los trabajadores a la intimidad en relación con el entorno digital y a la desconexión.

Los trabajadores tienen derecho a la intimidad en el uso de los dispositivos digitales puestos a su disposición por el empleador, a la desconexión digital y a la intimidad frente al uso de dispositivos de videovigilancia y geolocalización en los términos establecidos en la legislación vigente en materia de protección de datos personales y garantía de los derechos digitales.”

Disposición final decimocuarta.- Modificación del texto refundido de la Ley del Estatuto Básico del Empleado Público.

Se añade una nueva letra j bis) en el artículo 14 del texto refundido de la Ley del Estatuto Básico del Empleado Público, aprobado por Real Decreto Legislativo 5/2015, de 30 de octubre, que quedará redactada como sigue:

“j bis) A la intimidad en el uso de dispositivos digitales puestos a su disposición y frente al uso de dispositivos de videovigilancia y geolocalización, así como a la desconexión digital en los términos establecidos en la legislación vigente en materia de protección de datos personales y garantía de los derechos digitales.”

Disposición final decimoquinta.- Desarrollo normativo.

Se habilita al Gobierno para desarrollar lo dispuesto en los artículos 3.2, 38.6, 45.2, 63.3, 96.3 y disposición adicional sexta, en los términos establecidos en ellos.

Disposición final decimosexta.- Entrada en vigor.

La presente ley orgánica entrará en vigor el día siguiente al de su publicación en el Boletín Oficial del Estado.

Por tanto,

Mando a todos los españoles, particulares y autoridades, que guarden y hagan guardar esta ley orgánica.

Madrid, 5 de diciembre de 2018.

FELIPE R.

El Presidente del Gobierno, PEDRO SÁNCHEZ PÉREZ-CASTEJÓN

25Nov/18

Real Decreto-ley 5/2018, de 27 de julio, de medidas urgentes para la adaptación del Derecho español a la normativa de la Unión Europea en materia de protección de datos

25 noviembre, 2018España, Real Decretode 27 de julio, de medidas urgentes para la adaptación del Derecho español a la normativa de la Unión Europea en materia de protección de datos, Derecho Informático España, Legislación Derecho Informático, Real Decreto-Ley, Real Decreto-ley 5/2018José Cuervo

Real Decreto-ley 5/2018, de 27 de julio, de medidas urgentes para la adaptación del Derecho español a la normativa de la Unión Europea en materia de protección de datos (Boletín Oficial del Estado número 183, de 30 de julio de 2018)

(Derogado por la Disposición derogatoria única de la Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales)

PREÁMBULO

El Reglamento (UE) 2016/679 del Parlamento Europeo y del Consejo, de 27 de abril de 2016, relativo a la protección de las personas físicas en lo que respecta al tratamiento de sus datos personales y a la libre circulación de estos datos y por el que se deroga la Directiva 95/46/CE (Reglamento General de Protección de Datos), es plenamente aplicable en España desde el pasado 25 de mayo.

El Reglamento General de Protección de Datos supone una profunda modificación del régimen vigente en materia de protección de datos personales, no sólo desde el punto de vista sustantivo y de cumplimiento por los sujetos obligados, sino particularmente en lo que afecta a la actividad de supervisión por parte de las autoridades de control que el mismo regula.

Además, la plena aplicación del Reglamento General de Protección de Datos implica que hayan de considerarse desplazadas por él aquellas disposiciones de Derecho interno que no resulten conformes con el régimen que el mismo establece. Así sucedería con muchos de los preceptos de la Ley Orgánica 15/1999, de 13 de diciembre, de Protección de Datos de Carácter Personal y su Reglamento de desarrollo, aprobado por Real Decreto 1720/2007, de 21 de diciembre.

Por otra parte, numerosos preceptos del reglamento europeo se remiten a su desarrollo, obligatorio o potestativo, por los Estados miembros, conteniendo un total de cincuenta y seis remisiones a los ordenamientos nacionales. De entre estas remisiones, el reglamento impone a los Estados miembros, entre otras cuestiones, la regulación del estatuto de las autoridades de control, la determinación del régimen aplicable a los inspectores de un tercer Estado que lleven a cabo actividades conjuntas de investigación o la designación de la autoridad que representará al Estado miembro en el Comité Europeo de Protección de Datos.

Otras disposiciones del Reglamento General de Protección de Datos exigen una adecuación del Derecho interno, aun cuando no exista una remisión directa y expresa al mismo. Así, si bien el reglamento europeo establece un régimen sancionador en que se tipifican las conductas típicas, no regula cuestiones tan esenciales como los plazos de prescripción de dichas infracciones, al considerar que dicha cuestión corresponde al ordenamiento de los Estados Miembros. Del mismo modo, establece un procedimiento de cooperación entre los Estados miembros en los supuestos de tratamientos denominados transfronterizos, con la participación de todas las autoridades implicadas, pero no regula el modo en que el Derecho interno de los Estados habrá de verse afectado como consecuencia de los trámites previstos en la propia norma europea para estos procedimientos.

La necesidad de adaptar el marco normativo interno al Reglamento General de Protección de Datos supuso la aprobación por el Consejo de Ministros en su sesión de 10 de noviembre de 2017 de un proyecto de ley orgánica, remitido a las Cortes Generales, que actualmente se encuentra en tramitación parlamentaria.

Teniendo en cuenta lo anterior, y sin perjuicio de que los aspectos que configuran el contenido esencial del derecho fundamental a la protección de datos de carácter personal hayan de incorporarse a una ley orgánica, no es menos cierto que en determinadas cuestiones que no son objeto de reserva de ley orgánica resulta imprescindible la adopción urgente de una norma con rango de ley que permita la adaptación del Derecho español al Reglamento General de Protección de Datos. En otras palabras, el objeto de este real decreto-ley se ciñe a la adecuación de nuestro ordenamiento al reglamento europeo en aquellos aspectos concretos que, sin rango orgánico, no admiten demora y debe entenderse sin perjuicio de la necesidad de una legislación orgánica de protección de datos que procure la plena adaptación de la normativa interna a los estándares fijados en la materia por la Unión Europea a través de una disposición directamente aplicable.

El real decreto-ley comprende catorce artículos estructurados en tres capítulos, dos disposiciones adicionales, dos transitorias, una derogatoria y una final. Su contenido afecta únicamente a cuestiones cuya inmediata incorporación al Derecho interno resulta imprescindible para la adecuada aplicación en España del Reglamento General de Protección de Datos y que no están excluidas del ámbito del legislador de urgencia por el artículo 86 de la Constitución Española.

El Capítulo I atiende a la necesidad de identificar al personal competente para el ejercicio de los poderes de investigación que el Reglamento General de Protección de Datos otorga en su artículo 58.1 a las autoridades de control. Ello exige que el Derecho interno regule el modo en que podrán ejercerse dichos poderes, qué personas ejercerán la actividad de investigación e inspección y en qué consistirán esas atribuciones expresamente establecidas en el reglamento europeo desde el punto de vista del ordenamiento español. Asimismo, y en aplicación del artículo 62.3 del Reglamento General de Protección de Datos, es preciso determinar el régimen aplicable al personal de las autoridades de supervisión de otros Estados miembros que participen en actuaciones conjuntas de investigación.

El Capítulo II articula el novedoso régimen sancionador establecido en el Reglamento General de Protección de Datos, reemplazando los tipos infractores actualmente contenidos en la Ley Orgánica 15/1999 por la remisión a los que están establecidos en los apartados 4, 5 y 6 del artículo 83 de dicho reglamento, lo que resulta de todo punto necesario. Además, existen dos cuestiones sobre las que es ineludible la adopción de disposiciones por el Derecho interno que garanticen la efectividad de este régimen sancionador y la seguridad jurídica en su aplicación. La primera se refiere a la necesaria delimitación de los sujetos que pudieran incurrir en la responsabilidad derivada de la aplicación de dicho régimen sancionador. La segunda reviste aún mayor importancia y se refiere a la necesidad de determinar los plazos de prescripción de las infracciones y sanciones previstas en la norma europea.

El Capítulo III contiene la regulación del procedimiento en caso de que exista una posible vulneración del Reglamento General de Protección de Datos. En este punto, es preciso tener en cuenta que el reglamento distingue en la práctica tres tipos de tratamientos a los que aplicaría distintas normas procedimentales: los tratamientos transfronterizos, definidos por el artículo 4.23 del Reglamento general de Protección de Datos, los transfronterizos con relevancia local en un Estado miembro, a los que se refiere el artículo 56 del mismo, y aquéllos que tendrían la condición de exclusivamente nacionales, entre los que figuran en todo caso los previstos en el artículo 55 de la norma europea. El reglamento europeo prevé una serie de trámites específicos para los dos primeros supuestos entre los que se encuentran los necesarios para determinar la competencia de la autoridad de control principal, así como los que permiten la adopción de una decisión consensuada entre las autoridades principal e interesadas en el procedimiento. En estos casos la regulación europea establece la obligación de que la autoridad principal someta los distintos proyectos de decisión a las restantes autoridades, que dispondrán de plazos tasados para la emisión de «observaciones pertinentes motivadas», y previéndose el sometimiento de la resolución al Comité Europeo de Protección de Datos en caso de no alcanzarse un acuerdo entre todas ellas.

Estas previsiones han de trasladarse a la normas que regulen el procedimiento en caso de plantearse una reclamación ante la Agencia Española de Protección de Datos así como en los supuestos en que, sin haber recibido reclamación, tenga la condición de autoridad principal respecto de la reclamación recibida en otro Estado Miembros o considere que ha de intervenir como interesada en un procedimiento ya abierto.

Todo ello impone la necesidad de incorporar al procedimiento fases específicas como la admisión a trámite de las reclamaciones o la posibilidad de archivo provisional del expediente en los supuestos en que la Agencia Española de Protección de Datos no tramite la reclamación pero pueda tener que resolver sobre la misma. En particular, es indispensable incluir en las normas de procedimiento su suspensión en los supuestos en que proceda recabar el parecer de las autoridades de otros Estados miembros durante todo el tiempo previsto para su obtención, dado que en caso contrario existe una muy alta probabilidad de caducidad de los procedimientos, con las consecuencias negativas que ello conlleva no sólo para la aplicabilidad en España de las normas de protección de datos, sino para la garantía del derecho fundamental de los ciudadanos europeos en su conjunto en aquellos casos en que la Agencia Española de Protección de Datos tuviera la condición de autoridad de control principal.

En definitiva, este último capítulo tiene como objetivo hacer posible la aplicación de las especialidades del régimen procedimental del Reglamento General de Protección de Datos, en un contexto en el que, siendo la norma europea directamente aplicable, ya se han puesto en marcha procedimientos de especial trascendencia al amparo de este régimen.

Por último, en cumplimiento del artículo 68.4 del Reglamento General de Protección de Datos, la disposición adicional primera designa como representante de España en el Comité Europeo a la Agencia Española de Protección de Datos, que informará a las autoridades autonómicas acerca de las decisiones adoptadas en dicho organismo de la Unión y recabará su parecer cuando se trate de materias de su competencia. Por su parte, la disposición adicional segunda contiene previsiones en lo relativo a la publicidad de las resoluciones de la Agencia Española de Protección de Datos, con el fin de garantizar la transparencia de su actuación, ante el nuevo marco procedimental configurado por el Reglamento General de Protección de Datos.

En consecuencia, a la vista de los hechos descritos, la extraordinaria y urgente necesidad de este real decreto-ley resulta plenamente justificada. Dada la plena aplicación del Reglamento General de Protección de Datos desde el 25 de mayo de 2018, hasta la completa adecuación a él de nuestro ordenamiento, que solamente será posible a través de una nueva legislación orgánica, es ineludible la adopción de una disposición con rango de ley que permita la adaptación del Derecho español en varias cuestiones a la normativa de la Unión Europea en materia de protección de datos, para garantizar de forma efectiva el derecho del artículo 18.4 de la Constitución en un marco de seguridad jurídica. En coherencia con ello, la vigencia de este real decreto-ley se limita al período que medie entre el día siguiente de su publicación en el Boletín Oficial del Estado y la entrada en vigor de la nueva ley orgánica que se encuentra en tramitación parlamentaria.

Además, este real decreto-ley no afecta al ordenamiento de las instituciones básicas del Estado, a los derechos, deberes y libertades de los ciudadanos regulados en el Título I de la Constitución, al régimen de las Comunidades Autónomas ni al Derecho electoral general.

En definitiva, de todo lo anterior resulta que, en este caso, el real decreto-ley representa un instrumento constitucionalmente lícito, en tanto que pertinente y adecuado para la consecución del fin que justifica la legislación de urgencia, que no es otro, tal como reiteradamente ha exigido nuestro Tribunal Constitucional, que subvenir a un situación concreta, dentro de los objetivos gubernamentales, que por razones difíciles de prever requiere una acción normativa inmediata en un plazo más breve que el requerido por la vía normal o por el procedimiento de urgencia para la tramitación parlamentaria de las Leyes.

Por tanto, en el conjunto y en cada una de las medidas que se adoptan, concurren, por su naturaleza y finalidad, las circunstancias de extraordinaria y urgente necesidad que exige el artículo 86 de la Constitución Española como presupuestos habilitantes para la aprobación de un real decreto-ley.

En su virtud, en uso de la autorización contenida en el artículo 86 de la Constitución Española, a propuesta de la Ministra de Justicia, previa deliberación del Consejo de Ministros en su reunión del día 27 de julio de 2018,

DISPONGO:

CAPÍTULO I.- INSPECCIÓN EN MATERIA DE PROTECCIÓN DE DATOS

Artículo 1.- Ámbito y personal competente para el ejercicio de la actividad de investigación de la Agencia Española de Protección de Datos.

1.- La actividad de investigación de la Agencia Española de Protección de Datos se llevará a cabo por los funcionarios de la Agencia o por funcionarios ajenos a ella habilitados expresamente por su Director.

2.- En los casos de actuaciones conjuntas de investigación conforme a lo dispuesto en el artículo 62 del Reglamento (UE) 2016/679, el personal de las autoridades de control de otros Estados Miembros de Unión Europea que colabore con la Agencia ejercerá sus facultades con arreglo a lo previsto en la normativa española y bajo la orientación y en presencia del personal de ésta.

3.- Los funcionarios que desarrollen actividades de investigación tendrán la consideración de agentes de la autoridad en el ejercicio de sus funciones, y estarán obligados a guardar secreto sobre las informaciones que conozcan con ocasión de dicho ejercicio, incluso después de haber cesado en él.

Artículo 2.- Alcance de la actividad de investigación.

Quienes desarrollen la actividad de investigación podrán recabar las informaciones precisas para el cumplimiento de sus funciones, realizar inspecciones, requerir la exhibición o el envío de los documentos y datos necesarios, examinarlos en el lugar en que se encuentren depositados o en donde se lleven a cabo los tratamientos, obtener copia de ellos, inspeccionar los equipos físicos y lógicos y requerir la ejecución de tratamientos y programas o procedimientos de gestión y soporte del tratamiento sujetos a investigación. Los poderes de investigación en lo que se refiere a la entrada en domicilios deben ejercerse de conformidad con las normas procesales, en particular, en los casos en los que sea precisa la autorización judicial previa. Cuando se trate de órganos judiciales u Oficinas Judiciales el ejercicio de las facultades de inspección se efectuará a través y por mediación del Consejo General del Poder Judicial.

CAPÍTULO II.- RÉGIMEN SANCIONADOR EN MATERIA DE PROTECCIÓN DE DATOS

Artículo 3.- Sujetos responsables.

1.- Están sujetos al régimen sancionador establecido en el Reglamento (UE) 2016/679 y la normativa española de protección de datos:

a) Los responsables de los tratamientos.

b) Los encargados de los tratamientos.

c) Los representantes de los responsables o encargados de los tratamientos no establecidos en el territorio de la Unión Europea.

d) Las entidades de certificación.

e) Las entidades acreditadas de supervisión de los códigos de conducta.

2.- No será de aplicación al delegado de protección de datos el régimen sancionador en esta materia.

Artículo 4.- Infracciones.

Constituyen infracciones las vulneraciones del Reglamento (UE) 2016/679 a las que se refieren los apartados 4, 5 y 6 de su artículo 83.

Artículo 5.- Prescripción de las infracciones.

1.- Las infracciones previstas en los apartados 5 y 6 del artículo 83 del Reglamento (UE) 2016/679 prescribirán a los tres años.

2.- Las infracciones previstas en el artículo 83.4 Reglamento (UE) 2016/679 prescribirán a los dos años.

3.- Interrumpirá la prescripción la iniciación, con conocimiento del interesado, del procedimiento sancionador, reiniciándose el plazo de prescripción si el expediente sancionador estuviere paralizado durante más de seis meses por causas no imputables al presunto infractor.

Artículo 6.- Prescripción de las sanciones.

1.- Las sanciones impuestas en aplicación del Reglamento (UE) 2016/679 prescriben en los siguientes plazos:

a) Las sanciones por importe igual o inferior a 40.000 euros, prescriben en el plazo de un año.

b) Las sanciones por importe comprendido entre 40.001 y 300.000 euros prescriben a los dos años.

c) Las sanciones por un importe superior a 300.000 euros prescriben a los tres años.

2.- El plazo de prescripción de las sanciones comenzará a contarse desde el día siguiente a aquel en que sea ejecutable la resolución por la que se impone la sanción o haya transcurrido el plazo para recurrirla.

3.- La prescripción se interrumpirá por la iniciación, con conocimiento del interesado, del procedimiento de ejecución, volviendo a transcurrir el plazo si el mismo está paralizado durante más de seis meses por causa no imputable al infractor.

CAPÍTULO III.- PROCEDIMIENTOS EN CASO DE POSIBLE VULNERACIÓN DE LA NORMATIVA DE PROTECCIÓN DE DATOS

Artículo 7.- Régimen jurídico.

1.- Las disposiciones de este capítulo serán de aplicación a los procedimientos tramitados por la Agencia Española de Protección de Datos en los supuestos en los que un afectado reclame que no ha sido atendida su solicitud de ejercicio de los derechos reconocidos en los artículos 15 a 22 del Reglamento (UE) 2016/679, así como en los que aquélla investigue la existencia de una posible infracción de lo dispuesto en el mencionado reglamento y la normativa española de protección de datos.

2.- Los procedimientos tramitados por la Agencia Española de Protección de Datos se regirán por lo dispuesto en el Reglamento (UE) 2016/679, en la normativa española de protección de datos y, en cuanto no las contradigan, con carácter subsidiario, por las normas generales sobre los procedimientos administrativos.

Artículo 8.- Forma de iniciación del procedimiento y duración.

1.- Cuando el procedimiento se refiera exclusivamente a la falta de atención de una solicitud de ejercicio de los derechos establecidos en los artículos 15 a 22 del Reglamento (UE) 2016/679, se iniciará por acuerdo de admisión a trámite, que se adoptará conforme a lo establecido en el artículo siguiente.

2.- Cuando el procedimiento tenga por objeto la determinación de la posible existencia de una infracción de lo dispuesto en el Reglamento (UE) 2016/679 y la normativa española de protección de datos, se iniciará mediante acuerdo de inicio adoptado por propia iniciativa o como consecuencia de reclamación.

Si el procedimiento se fundase en una reclamación formulada ante la Agencia Española de Protección de Datos, con carácter previo, ésta decidirá sobre su admisión a trámite, conforme a lo dispuesto en el artículo siguiente.

3.- El procedimiento podrá también tramitarse como consecuencia de la comunicación a la Agencia Española de Protección de Datos por parte de la autoridad de control de otro Estado miembro de la Unión Europea de la reclamación formulada ante la misma, cuando la Agencia Española de Protección de Datos tuviese la condición de autoridad de control principal para la tramitación de un procedimiento conforme a lo dispuesto en los artículos 56 y 60 del Reglamento (UE) 2016/679. Será en este caso de aplicación lo dispuesto en el apartado 1 y en los párrafos primero, tercero, cuarto y quinto del apartado 2.

4.- Los plazos de tramitación establecidos en este artículo así como los de admisión a trámite regulado por el apartado 5 del artículo siguiente y de duración de las actuaciones previas de investigación previsto en el artículo 11.2 de este real decreto-ley, quedarán automáticamente suspendidos cuando deba recabarse información, consulta, solicitud de asistencia o pronunciamiento preceptivo de un órgano u organismo de la Unión Europea o de una o varias autoridades de control de los Estados miembros conforme con lo establecido en el Reglamento (UE) 2016/679, por el tiempo que medie entre la solicitud y la notificación del pronunciamiento a la Agencia Española de Protección de Datos.

Artículo 9.- Admisión a trámite de las reclamaciones.

1.- Cuando se presentase ante la Agencia Española de Protección de datos una reclamación, ésta deberá evaluar su admisibilidad a trámite, de conformidad con las previsiones de este artículo.

2.- La Agencia Española de Protección de Datos inadmitirá las reclamaciones presentadas cuando no versen sobre cuestiones de protección de datos de carácter personal, carezcan manifiestamente de fundamento, sean abusivas o no aporten indicios racionales de la existencia de una infracción.

3.- Igualmente, la Agencia Española de Protección de Datos podrá inadmitir la reclamación cuando el responsable o encargado del tratamiento, previa advertencia formulada por la Agencia, hubiera adoptado las medidas correctivas encaminadas a poner fin al posible incumplimiento de la legislación de protección de datos y concurra alguna de las siguientes circunstancias:

a) Que no se haya causado perjuicio al afectado.

b) Que el derecho del afectado quede plenamente garantizado mediante la aplicación de las medidas.

4.- Antes de resolver sobre la admisión a trámite de la reclamación, la Agencia Española de Protección de Datos podrá remitir la misma al delegado de protección de datos que hubiera, en su caso, designado el responsable o encargado del tratamiento o al organismo de supervisión establecido para la aplicación de los códigos de conducta, a fin de que den respuesta a la reclamación en el plazo de un mes.

5.- La decisión sobre la admisión o inadmisión a trámite, así como la que determine, en su caso, la remisión de la reclamación a la Autoridad de control principal que se estime competente, deberá notificarse al reclamante en el plazo de tres meses. Si, transcurrido este plazo, no se produjera dicha notificación, se entenderá que prosigue la tramitación de la reclamación con arreglo a lo dispuesto en este capítulo a partir de la fecha en que se cumpliesen tres meses desde que la reclamación tuvo entrada en la Agencia Española de Protección de Datos.

Artículo 10.- Determinación del alcance territorial.

1.- Salvo en los supuestos a los que se refiere el artículo 8.3 de este real decreto-ley, la Agencia Española de Protección de Datos deberá, con carácter previo a la realización de cualquier otra actuación, incluida la admisión a trámite de una reclamación o el comienzo de actuaciones previas de investigación, examinar su competencia y determinar el carácter nacional o transfronterizo, en cualquiera de sus modalidades, del procedimiento a seguir.

2.- Si la Agencia considera que no tiene la condición de autoridad de control principal para la tramitación del procedimiento remitirá, sin más trámite, la reclamación formulada a la Autoridad de control principal que considere competente, a fin de que por la misma se le dé el curso oportuno. La Agencia notificará esta circunstancia a quien, en su caso, hubiera formulado la reclamación.

El acuerdo por el que se resuelva la remisión a la que se refiere el párrafo anterior implicará el archivo provisional del procedimiento, sin perjuicio de que por la Agencia se dicte, en caso de que así proceda, la resolución a la que se refiere el apartado 8 del artículo 60 del Reglamento (UE) 2016/679.

Artículo 11.- Actuaciones previas de investigación.

1.- Antes de la adopción del acuerdo de inicio de procedimiento, y una vez admitida a trámite la reclamación si la hubiese, la Agencia Española de Protección de Datos podrá llevar a cabo actuaciones previas de investigación a fin de lograr una mejor determinación de los hechos y las circunstancias que justifican la tramitación del procedimiento.

La Agencia Española de Protección de Datos actuará en todo caso cuando sea precisa la investigación de tratamientos que implique un tratamiento masivo de datos personales.

2.- Las actuaciones previas de investigación se someterán a lo dispuesto en el capítulo I y no podrán tener una duración superior a doce meses a contar desde la fecha del acuerdo de admisión a trámite o de la fecha del acuerdo por el que se decida su iniciación cuando la Agencia actúe por propia iniciativa o como consecuencia de la comunicación que le hubiera sido remitida por la autoridad de control de otro Estado miembro de la Unión Europea, conforme al artículo 8.3 de este real decreto-ley.

Artículo 12.- Acuerdo de inicio del procedimiento para el ejercicio de la potestad sancionadora.

1.- Concluidas, en su caso, las actuaciones a las que se refiere el artículo anterior, corresponderá al Director de la Agencia Española de Protección de Datos, cuando así proceda, dictar acuerdo de inicio de procedimiento para el ejercicio de la potestad sancionadora, en que se concretarán los hechos, la identificación de la persona o entidad contra la que se dirija el procedimiento, la infracción que hubiera podido cometerse y su posible sanción.

2.- Cuando la Agencia Española de Protección de Datos ostente la condición de autoridad de control principal y deba seguirse el procedimiento previsto en el artículo 60 del Reglamento (UE) 2016/679, el proyecto de acuerdo de inicio de procedimiento sancionador se someterá a lo dispuesto en el mismo.

Artículo 13.- Medidas provisionales

1.- Durante la realización de las actuaciones previas de investigación o iniciado un procedimiento para el ejercicio de la potestad sancionadora, la Agencia Española de Protección de Datos podrá acordar motivadamente las medidas provisionales necesarias y proporcionadas para salvaguardar el derecho fundamental a la protección de datos y, en especial, las previstas en el artículo 66.1 del Reglamento (UE) 2016/679, el bloqueo cautelar de los datos y la obligación inmediata de atender el derecho solicitado.

2.- En los casos en que la Agencia Española de Protección de Datos considere que la continuación del tratamiento de los datos de carácter personal, su comunicación o transferencia internacional comportara un menoscabo grave del derecho a la protección de datos de carácter personal, podrá ordenar a los responsables o encargados de los tratamientos el bloqueo de los datos y la cesación de su tratamiento y, caso de incumplirse por éstos dichos mandatos, proceder a su inmovilización.

3.- Cuando se hubiese presentado ante la Agencia Española de Protección de Datos una reclamación que se refiriese, entre otras cuestiones, a la falta de atención en plazo de los derechos establecidos en los artículos 15 a 22 del Reglamento (UE) 2016/679, la Agencia Española de Protección de Datos podrá acordar en cualquier momento, incluso con anterioridad a la iniciación del procedimiento para el ejercicio de la potestad sancionadora, mediante resolución motivada y previa audiencia del responsable del tratamiento, la obligación de atender el derecho solicitado, prosiguiéndose el procedimiento en cuanto al resto de las cuestiones objeto de la reclamación.

Artículo 14.- Procedimiento en relación con las competencias atribuidas a la Agencia Española de Protección de Datos por otras leyes.

Lo dispuesto en este capítulo será de aplicación a los procedimientos que la Agencia Española de Protección de Datos hubiera de tramitar en ejercicio de las competencias que le fueran atribuidas por otras leyes.

Disposición adicional primera.- Representación española en el Comité Europeo de Protección de Datos.

La Agencia Española de Protección de Datos tendrá la condición de representante común de las autoridades de protección de datos en el Comité Europeo de Protección de Datos.

Disposición adicional segunda.- Publicación de resoluciones de la Agencia Española de Protección de Datos.

La Agencia Española de Protección de Datos publicará las resoluciones de su Director que declaren haber lugar o no a la atención de los derechos reconocidos en los artículos 15 a 22 del Reglamento (UE) 2016/679, las que pongan fin a los procedimientos de reclamación, las que archiven las actuaciones previas de investigación, las que sancionen con apercibimiento a las entidades a que se refiere el artículo 46 de la Ley Orgánica 15/1999, de 13 de diciembre, de Protección de Datos de Carácter Personal, las que impongan medidas cautelares y las demás que disponga su Estatuto.

Disposición transitoria primera.- Régimen transitorio de los procedimientos.

1.- Los procedimientos ya iniciados a la entrada en vigor de este real decreto-ley se regirán por la normativa anterior, salvo que el régimen establecido en el mismo contenga disposiciones más favorables para el interesado.

2.- Lo dispuesto en el apartado anterior será asimismo de aplicación a los procedimientos respecto de los cuales ya se hubieren iniciado las actuaciones previas a las que se refiere la Sección 2.ª del Capítulo III del Título IX del Reglamento de desarrollo de la Ley Orgánica 15/1999, de 13 de diciembre, de protección de datos de carácter personal, aprobado por Real Decreto 1720/2007, de 21 de diciembre.

Disposición transitoria segunda.- Contratos de encargado del tratamiento.

Disposición derogatoria única.- Derogación normativa.

Quedan derogadas todas las normas de igual o inferior rango que se opongan a lo establecido en el presente real decreto-ley, y en particular, los siguientes artículos de la Ley Orgánica 15/1999, de 13 de diciembre, de Protección de Datos de Carácter Personal:

a) El artículo 40.

b) Los artículos 43 al 49, con excepción del artículo 46.

Disposición final única.- Vigencia.

El presente real decreto-ley entrará en vigor al día siguiente de su publicación en el «Boletín Oficial del Estado» y lo estará hasta la vigencia de la nueva legislación orgánica de protección de datos que tenga por objeto adaptar el ordenamiento jurídico español al Reglamento (UE) 2016/679 del Parlamento Europeo y el Consejo, de 27 de abril de 2016, relativo a la protección de las personas físicas en lo que respecta al tratamiento de sus datos personales y a la libre circulación de estos datos, y completar sus disposiciones.

Dado en Madrid, el 27 de julio de 2018.

FELIPE R.

El Presidente del Gobierno, PEDRO SÁNCHEZ PÉREZ-CASTEJÓN

11Nov/18

Universidad Internacional de la Rioja (UNIR) La Universidad en Internet

11 noviembre, 2018MastersUniversidad Internacional de la Rioja (UNIR)José Cuervo

MÁSTER UNIVERSITARIOS

Máster Universitario en Protección de Datos

Máster Universitario en Propiedad Intelectual y Derecho de las Nuevas Tecnologías

Máster Universitario en Seguridad Informática

Máster Universitario en Análisis y Visualización de Datos Masivos / Visual Analytics & Big Data

ESTUDIOS AVANZADOS

Programa Avanzado en Reglamento General de Protección de Datos

08Nov/18

B0009

8 noviembre, 2018Certificados RevistaCertificado Revista Electrónica Informática JurídicaJosé Cuervo

B0009

07Nov/18

EUA se preparam para aprovar Lei sobre proteção de dados pessoais semelhante à Europeia?

7 noviembre, 2018Protección de Datos, TrabajosEUA se preparam para aprovar Lei sobre proteção de dados pessoais semelhante à Europeia?, Trabajos de Protección de DatosJosé Cuervo

EUA SE PREPARAM PARA APROVAR LEI SOBRE PROTEÇÃO DE DADOS PESSOAIS SEMELHANTE À EUROPEIA?

Demócrito Reinaldo Filho

Desembargador do TJPE

A semana passada foi marcada por uma declaração do CEO da Apple, Tim Cook, proferida durante uma conferência sobre privacidade em Bruxelas[1], de que as grandes empresas de tecnologia estavam criando um “complexo industrial de dados”. Sem dar nomes a quem acusava (embora tenha ficado perceptível de que se referia às empresas concorrentes Google e Facebook), afirmou que essas empresas utilizam os dados das pessoas com “eficiência militar” e que, “levado ao extremo, esse processo cria um perfil digital duradouro que permite que as empresas o conheçam melhor do que você pode se conhecer”[2]. Tim Cook defendeu a edição de uma lei federal nos EUA que proteja as pessoas contra ameaças à privacidade, à semelhança do novo regulamento europeu de proteção de dados pessoais (o RGPD)[3].

Esse movimento do executivo da Apple apenas demonstra a mudança de estratégia das “Bigtech”, diante do movimento pela aprovação de leis de proteção à privacidade individual. A Apple, embora não tenha como modelo único de negócio a monetização dos dados pessoais dos usuários por meio da venda de publicidade dirigida, também não é nenhum exemplo quando se trata da defesa das liberdades individuais. Tem sido criticada por ceder à pressão do Governo chinês para remover de sua plataforma (a App Store) aplicativos que permitem a anonimização das pessoas, contribuindo dessa maneira para o vigilantismo exercido pela China sobre seus cidadãos[4]. A atitude do executivo revela que as empresas de tecnologia enxergam agora que a aprovação de leis robustas de proteção de dados pessoais é uma tendência irreversível e universal. Depois do escândalo da Cambridge Analytica[5], que levou Mark Zukerberg a depor perante o congresso dos EUA e do parlamento inglês, bem como do vazamento de dados na rede social Google+[6], que permitiu o acesso a terceiros de dados pessoais, os congressistas norte-americanos acordaram para o problema. Muitos agora já defendem medidas legislativas para prevenir abusos com a utilização de dados pessoais, daí a mudança de postura das empresas de tecnologia. Se antes mostravam-se contrárias a todo e qualquer tipo de legislação garantidora da privacidade individual, parece terem chegado à conclusão de que é melhor aceitar algum tipo de regulamento. Agora querem participar das discussões e influenciar no processo legislativo de modo a aprovar lei menos rigorosa[7].

Era previsível, assim, uma iniciativa legislativa no âmbito federal, que se concretizou esta semana. Na quinta (dia 01.11), o Senador Ron Wyden (democrata do Oregon) apresentou um projeto de lei prevendo pesadas sanções para empresas que violarem a privacidade dos usuários de seus produtos e serviços. A Lei, que recebeu o nome de Consumer Data Protection Act[8], somente vai se aplicável a empresas com faturamento superior a 50 milhões de dólares e com mais de 1 milhão de usuários.

Não se trata de uma lei geral de proteção de dados, pois não estabelece princípios gerais e regras sobre coleta e uso de informações pessoais, não havendo semelhança com o regulamento europeu (o RGPD), a não ser na parte em que prevê multas para coibir atos de coleta indevida de dados. O projeto em essência cuida de ampliar os poderes da Federal Trade Comission (FTC)[9], espécie de agência reguladora de defesa de interesses de consumidores, possibilitando a esse órgão servir como regulador de assuntos ligados à privacidade. Atualmente, a FTC não dispõe de poderes para aplicar multas por violação à privacidade dos consumidores.

O projeto impõe às empresas que coletam dados a apresentação de relatórios anuais, acompanhados de declaração do CPO (Chief Privacy Officer), que pode pagar multa ou sofrer pena de prisão se contiver informações inexatas. As multas por descumprimento aos preceitos da lei e regulamentos da FTC podem chegar a 4% do faturamento da empresa.

O que existe de mais original no projeto do Senador Ron Wyden é a criação do cadastro “Do Not Track”, para permitir que a pessoa que não deseje ver seus dados sendo repassados a terceiros manifeste sua opção por ser deixado de fora (“opt out”). O projeto prevê que, num prazo de até dois anos após sua aprovação, a FTC deverá construir um website onde as pessoas possam manifestar sua opção por não terem seus dados transferidos. A intenção é boa, mas de duvidosa eficácia prática, pois os escândalos de vazamento de dados e uso indevido de informações pessoais que têm surgido nos últimos tempos são decorrentes de falhas de segurança ou comportamento inadequado das empresas de tecnologia. Além do mais, o projeto prevê uma série de exceções ao impedimento da transferência de dados.

O Senador Ron Wyden justificou que seu projeto traz finalmente uma significativa proteção à privacidade dos consumidores norte-americanos. O projeto, é certo, constitui uma resposta direta ao oceano de escândalos de invasão de privacidade e vazamento de dados pessoais que as grandes empresas de tecnologia norte-americanas se envolveram na última década. Todavia, é muito cedo para compartilhar do otimismo do Senador.

O problema é que os Estados Unidos não têm um conjunto sistematizado de leis de proteção à privacidade, como ocorre na União Europeia. Diferentemente dos países do bloco europeu, lá não existe um regulamento geral, aplicável a todas as atividades de processamento de dados. A opção foi por regular cada setor de maneira estanque, daí que existe uma lei para o setor bancário, uma para o setor médico, outra para o setor de seguros e assim por diante. O modelo europeu é considerado mais eficaz e tem servido como padrão universal, sendo copiado pela legislação de diversos outros países, como aconteceu recentemente no Brasil, que aprovou em julho deste ano sua Lei Geral de Proteção de Dados (LGPD)[10].

A inexistência de uma lei geral de proteção de dados pessoais enfraquece a luta pela proteção da privacidade dos cidadãos norte-americanos. De qualquer maneira, o projeto do Senador Wyden é um primeiro passo na direção certa, para combater a formação do “complexo industrial de dados” que mencionou Tim Cook.

Recife, 30.10.18.

[1] A declaração de Tim Cook foi feita no dia 24 de outubro, durante um encontro que reuniu autoridades de proteção de dados pessoais do mundo todo – 40th International Conference of Data Protection and Privacy Commissioners (ICDPPC).

[2] Ver notícia publicada em 24.10.18, publicada em: https://www.technocracy.news/apple-ceo-tim-cook-personal-data-is-being-weaponized-against-us-with-military-efficiency/

[3] RGPD é a abreviatura para Regulamento Geral de Proteção de Dados, que entrou em vigor em 25 de maio deste ano.

[4] A Apple tem sido criticada por remover de sua App Store aplicativos que possibilitam aos usuários encriptar suas mensagens, dificultando o rastreamento de suas comunicações pelo Governo chinês. Ver notícia em 06.11.17, publicada em: https://9to5mac.com/2017/12/06/apple-china-criticisms-response/

[5] A Cambridge Alnalytica era é uma empresa inglesa que se apropriou de milhões de perfis de usuários do Facebook e utilizou seus dados para influenciar a eleição de Donald Trump e o plebiscito do Brexit. Ver notícia em: https://www.theguardian.com/news/2018/mar/17/cambridge-analytica-facebook-influence-us-election

[6] O Google + é o serviço de rede social da Google, que foi desativado depois que uma brecha de segurança expôs informações de cerca de 500 mil usuários. Ver notícia publicada em 08.10.18, acessível em: https://www.techtudo.com.br/noticias/2018/10/google-encerra-google-apos-vazamento-de-dados.ghtml

[7] As empresas de tecnologia querem aprovar uma lei federal que suplante leis estaduais, como a Lei da Califórnia, aprovada em junho deste ano, considerada a mais rigorosa do país. Ver notícia em: https://www.cnet.com/news/us-privacy-law-is-on-the-horizon-heres-how-tech-companies-want-to-shape-it/

[8] O texto integral do projeto de Lei pode ser acessado em: https://assets.documentcloud.org/documents/5026543/Wyden-Privacy-Bill.pdf

[9] De fato, o objetivo do projeto é emendar o Federal Trade Commission Act, uma lei de 1914 que criou essa agência (a FTC). A Lei, sancionada por Woodrow Wilson, proíbe métodos injustos de concorrência e atos ou práticas desleais que afetem o comércio.

[10] Ver artigo de nossa autoria sobre a LGPD, sob o título “Lei de Proteção de Dados aproxima o Brasil dos países civilizados”, publicado no site Jus Navigandi, em julho deste ano, acessível em: https://jus.com.br/artigos/67668/lei-de-protecao-de-dados-pessoais-aproxima-o-brasil-dos-paises-civilizados

07Nov/18

IMN. Instituto dos Magistrados do Nordeste

7 noviembre, 2018MastersIMN. Instituto dos Magistrados do Nordeste, Pos gradosJosé Cuervo

Novas turmas de pós-graduação do IMN-Instituto dos Magistrados do Nordeste começam em fevereiro/19

Estão sendo oferecidas pós-graduações em Direito Processual Civil, Direito do Trabalho e Previdenciário, Direito Médico e da Saúde, Direito Registral e Imobiliário e Direito Penal e Processo Penal. As aulas serão ministradas no auditório do Instituto, no bairro do Pina (Av. Domingos Ferreira, 341). As inscrições já estão abertas.

Maiores informações pelo tel. (81) 992904309, no site www.imn.org.br ou pelo e-mail: [email protected]

Estude pós graduação:

Especialização lato sensu em:

Direito da Informática

23Oct/18

Decreto 90 del 18 de enero de 2018

23 octubre, 2018Colombia, DecretoDecreto 90 del 18 de enero de 2018, del Ministerio de Comercio, Derecho Informático de Colombia, Industria y Turismo, Legislación Informática de Colombia, por el cual se modifican los artículos 2.2.2.26.1.2 y 2.2.2.26.3.1 del Decreto 1074 de 2015 - Decreto Único Reglamentario del Sector ComercioJosé Cuervo

Decreto 90 del 18 de enero de 2018, del Ministerio de Comercio, Industria y Turismo, por el cual se modifican los artículos 2.2.2.26.1.2 y 2.2.2.26.3.1 del Decreto 1074
de 2015 – Decreto Único Reglamentario del Sector Comercio, Industria y Turismo.

EL PRESIDENTE DE LA REPÚBLICA DE COLOMBIA

En ejercicio de sus facultades constitucionales y legales, en especial, las conferidas en el numeral 11 del artículo 189 de la Constitución Política, y el artículo 25 de la Ley 1581 de 2012, y

CONSIDERANDO

Que el artículo 2.2.2.26.1.2 del Decreto 1074 de 2015, establece el ámbito de aplicación del Registro Nacional de Bases de Datos, creado por Ley Estatutaria 1581 de 2012 “Por la cual se dictan disposiciones generales para la protección de datos personales”, el cual comprende las bases de datos que contengan datos personales cuyo tratamiento automatizado o manual se realice por personas naturales o jurídicas, de naturaleza pública o privada, en el territorio colombiano o fuera de él, siempre que al Responsable o al Encargado del tratamiento le sea aplicable la legislación colombiana en virtud de normas y tratados internacionales.

Que el artículo 2.2.2.26.3.1 del Decreto 1074 de 2015 establece el plazo para que los Responsables del Tratamiento inscriban sus bases de datos en el Registro Nacional de Bases de Datos, de acuerdo con las instrucciones que para el efecto imparta la Superintendencia de Industria y Comercio, entidad que tiene a cargo la administración del Registro Nacional de Bases de Datos.

Que en atención a múltiples solicitudes recibidas en la mencionada Superintendencia ha sido ampliado en dos oportunidades el plazo de inscripción inicialmente establecido para que los Responsables del Tratamiento de la información personal inscribieran sus bases de datos en dicho registro, con el fin de aumentar la divulgación y socialización de esta obligación legal y garantizar un alto grado de cumplimiento de la citada disposición entre los destinatarios de la norma.

Que pese a la divulgación y socialización de esta obligación realizada por la Superintendencia de Industria y Comercio dentro de los términos de extensión del referido plazo, el número de Responsables de Tratamiento que han inscrito sus bases de datos representa solo el veinticinco por ciento (25%) del total de personas jurídicas y menos del uno por ciento (1%) de personas naturales.

Que teniendo en cuenta criterios de priorización acordes a los riesgos en la administración de la información personal, la carga asumida por los sujetos obligados para llevar a cabo el registro de sus bases de datos, así como los resultados obtenidos en el proceso de registro de tal información hasta la fecha, se hace necesario modificar el ámbito de aplicación y el plazo señalados en los artículos 2.2.2.26.1.2 y 2.2.2.26.3.1 del Decreto 1074 de 2015, con el fin de reducir el universo de vigilados que deben cumplir con la especial obligación de registrar sus bases de datos en el sistema dispuesto por la Superintendencia de Industria y Comercio y garantizar un alto grado de cumplimiento de esta obligación legal.

Que la Ley 905 de 2004, modificada por la Ley 1111 de 2006, establece en el artículo 2 los parámetros con base en los cuales se define la Micro, Pequeña y Mediana Empresa, dentro de los que se incluye el valor de los activos totales así: i) Mediana Empresa: Activos totales por valor entre 100.000 a 610.000 Unidades de Valor Tributario (UVT); ii) Pequeña Empresa: Activos totales por valor entre quinientos uno (501) Y menos de cinco mil (5.000) salarios mínimos mensuales legales vigentes y, iii) Microempresa: Activos totales excluida la vivienda por valor inferior a quinientos (500) salarios mínimos mensuales legales vigentes.

Que, a fin de limitar el universo de vigilados que deben cumplir con la obligación de registrar sus bases de datos, se tendrá en cuenta el parámetro dispuesto en la Ley 905 de 2004 relativo a los activos totales, para excluir las sociedades y entidades sin ánimo de lucro que cumplan lo establecido para las micro y pequeñas empresas. Igualmente, serán excluidas las personas naturales.

Que en virtud de la modificación del ámbito de aplicación, los Responsables del tratamiento que no resulten obligados a efectuar el registro de sus bases de datos en el RNBD, pero que ya realizaron este trámite, no estarán obligados a efectuar la actualización de que trata el artículo 2.2.2.26.3.3 del Decreto 1074 de 2015 – Decreto Único Reglamentario del sector Comercio, Industria y Turismo y la información registrada no estará disponible para consulta.

Que la limitación del universo de vigilados frente al deber de registrar sus bases de datos no implica de ninguna manera que las personas jurídicas y naturales que se exceptúan de efectuar dicho registro mediante el presente decreto queden relevadas del cumplimiento de los demás deberes establecidos para los Responsables del Tratamiento de datos personales.

En consecuencia, si bien no están obligadas a registrar sus bases de datos ante la Superintendencia de Industria y Comercio, siguen sujetas al cumplimiento de las disposiciones contenidas en la Ley 1581 de 2012. Que las normas del presente Decreto fueron sometidas a Consulta Pública por el término de quince (15) días, de conformidad con lo dispuesto en el artículo 8 de la Ley 1471 de 2011 y el Decreto 270 de 2017.

DECRETA

Artículo 1.

Modifíquese el artículo 2.2.2.26.1.2 del Decreto 1074 de 2015 – Decreto Único Reglamentario del Sector Comercio, Industria y Turismo, el cual quedará así:

“Artículo 2.2.2.26.1.2. Ámbito de aplicación. Serán objeto de inscripción en el Registro Nacional de Bases de Datos, las bases de datos que contengan datos personales cuyo Tratamiento automatizado o manual sea realizado por los Responsables del tratamiento que reúnan las siguientes características:

a) Sociedades y entidades sin ánimo de lucro que tengan activos totales superiores a 100.000 Unidades de Valor Tributario (UVT).

b) Personas jurídicas de naturaleza pública”.

Artículo 2.

Modifíquese el artículo 2.2.2.26.3.1 del Decreto 1074 de 2015 – Decreto Único Reglamentario del Sector Comercio, Industria y Turismo el cual quedará así:

“Artículo 2.2.2.26.3.1. Plazo de inscripción. La inscripción de las bases de datos en el Registro Nacional de Bases de Datos se llevará a cabo en los siguientes plazos:

a) Los Responsables del Tratamiento, sociedades y entidades sin ánimo de lucro que tengan activos totales superiores a 610.000 Unidades de Valor Tributario (UVT), deberán realizar la referida inscripción a más tardar el treinta (30) de septiembre de 2018, de acuerdo con las instrucciones impartidas por la Superintendencia de Industria y Comercio;

b) Los Responsables del Tratamiento, sociedades y entidades sin ánimo de lucro que tengan activos totales superiores a 100.000 y hasta 610.000 Unidades de Valor Tributario (UVT), deberán realizar la referida inscripción a más tardar el treinta (30) de noviembre de 2018, de conformidad con las instrucciones impartidas por la Superintendencia de Industria y Comercio;

c) Los Responsables del Tratamiento, personas jurídicas de naturaleza pública, deberán realizar la referida inscripción a más tardar el treinta y uno (31) de enero de 2019, de conformidad con las instrucciones impartidas por la Superintendencia de Industria y Comercio.

Las bases de datos que se creen con posterioridad al vencimiento de los plazos referidos en los literales a), b) y c) del presente artículo, deberán inscribirse dentro de los dos (2) meses siguientes, contados a partir de su creación”.

Artículo 3.- Vigencias y derogatorias.

El presente decreto rige a partir de su publicación y deroga todas las disposiciones que le sean contrarias.

PUBLÍQUESE y CÚMPLASE

Dado en Bogotá D.C. al 18 de enero de 2018

El Viceministro de Desarrollo Empresarial encargado de las funciones del despacho de la Ministra de Comercio, Industria y Turismo, Daniel Arango Ángel

23Oct/18

Proyecto de Ley Estatutaria nº de 2018

23 octubre, 2018Colombia, Proyecto de Leycomercial, crediticia, de servicios y la proveniente de terceros países y se dictan otras disposiciones., Derecho Informático de Colombia, Legislación Informática de Colombia, por medio de la cual se modifica y adiciona la Ley Estatutaria 1266 de 2008, Proyecto de Ley Estatutaria nº de 2018, y se dictan disposiciones generales del Hábeas Data con relación a la información financieraJosé Cuervo

Proyecto de Ley Estatutaria nº de 2018, por medio de la cual se modifica y adiciona la Ley Estatutaria 1266 de 2008, y se dictan disposiciones generales del Hábeas Data con relación a la información financiera, crediticia, comercial, de servicios y la proveniente de terceros países y se dictan otras disposiciones.

El Congreso de Colombia

DECRETA:

Artículo 1º. Objeto.

La presente ley tiene por objeto modificar y adicionar la Ley 1266 de 2008, fortaleciendo el derecho al hábeas data.

Artículo 2º.

Adiciónese un literal (K) al artículo 3º de la Ley 1266 de 2008, el cual quedará así:

k) Previa comunicación al titular. Para efectos de la presente ley, la previa comunicación al titular de la información se entenderá como una notificación, y se regirá por la normativa vigente sobre el tema.

Artículo 3º.

Modifíquese y adiciónense tres parágrafos al artículo 13 de la Ley 1266 de 2008, que quedará así:

Artículo 13. Permanencia de la información. La información de carácter positivo permanecerá de manera indefinida en los Bancos de Datos de los operadores de información. Los datos cuyo contenido haga referencia al tiempo de mora, tipo de cobro, estado de la cartera, y en general aquellos datos referentes a una situación de incumplimiento de obligaciones, se regirán por un término máximo de permanencia, vencido el cual deberá ser retirada de los Bancos de Datos por el operador, de forma que los usuarios no puedan acceder o consultar dicha información.

El término de permanencia de esta información será igual al tiempo de mora, máximo dos (2) años contados a partir de la fecha en que sean pagadas las cuotas vencidas o sea extinguida la obligación.

Parágrafo 1°. El dato negativo y los datos cuyo contenido haga referencia al tiempo de mora, tipo de cobro, estado de la cartera, y en general aquellos datos referentes a una situación de incumplimiento de obligaciones, caducarán una vez cumplido el término de cinco (5) años, contados a partir del momento en que entre en mora la obligación, cumplido este término deberán ser eliminados de la base de datos. Lo anterior, toda vez que no se hayan iniciado acciones de cobro judicial, caso en el cual el dato caducará de inmediato una vez terminado el proceso.

Parágrafo 2°. En las obligaciones inferiores o iguales al veinte por ciento (20%) de un (1) salario mínimo legal mensual vigente, el dato negativo será suprimido de inmediato una vez sea extinguida la obligación.

Parágrafo 3°. Toda información negativa o desfavorable que se encuentre en bases de datos y se relacione con calificaciones, récord (scorings-score) o cualquier tipo de medición financiera, comercial o crediticia, deberá ser actualizada al nivel de riesgo preexistente al reporte negativo de manera simultánea con el retiro del dato negativo o con la cesación del hecho que generó la disminución de la medición.

Artículo 4º.

Adiciónese el numeral 11 al artículo 8° de la Ley 1266 de 2008, el cual quedará así:

Numeral 11. Reportar la información negativa de los titulares, máximo (18) meses después de hacerse exigible la obligación.

Artículo 5º.

Adiciónese el numeral 6 y un parágrafo al artículo 9° de la Ley 1266 de 2008, el cual quedará así:

Numeral 6. Acceder a la información contenida en las Centrales de Riesgo para los fines permitidos por la ley y para el estudio de riesgo financiero, crediticio o comercial. La revisión continua de esta información no podrá ser causal de disminución en la calificación de riesgo, récord (scorings-Score) o cualquier tipo de medición, ni podrá alterar en nada los estudios financieros o crediticios.

Parágrafo. En ningún caso se podrá consultar esta información para fines de toma de decisiones laborales.

Artículo 6º.

Modifíquese el parágrafo 2º del artículo 10 de la Ley 1266 de 2008, el cual quedará así:

Parágrafo 2°. La consulta de la información financiera, crediticia, comercial, de servicios y la proveniente de terceros países por parte del titular, en toda ocasión y por todos los medios será gratuita.

Artículo 7º.

Adiciónese un parágrafo al artículo 12 de la Ley 1266 de 2008, el cual quedará así:

Parágrafo. El incumplimiento de la previa comunicación al titular de la información en los casos en que la obligación ya haya sido extinguida, dará lugar al retiro inmediato del reporte negativo; para los casos en que se genere el reporte sin el cumplimiento de la notificación y no se haya extinguido la obligación, se deberá retirar el reporte y cumplir con la notificación antes de volver a realizarlo.

Artículo 8º.

Adiciónese el parágrafo 5 al artículo 14 de la Ley 1266 de 2008, el cual quedará sí:

Parágrafo 5º. El Gobierno Nacional deberá promover la firma de convenios internacionales que permitan que toda información positiva, que se encuentre en bases de datos en el exterior y se relacione con, calificaciones, record (Scorings-Score) o cualquier tipo de medición financiera, comercial o crediticia de titulares colombianos radicados o residenciados en esos países, se homologue en Colombia y sea tenida en cuenta para mejorar la calificación, record (Scorings-Score) o cualquier tipo de medición del comportamiento del titular que se utilice para la toma de decisiones y análisis de riesgo.

Artículo 9º.

Adiciónese el numeral 7 en el numeral II del artículo 16 de la Ley 1266 de 2008, el cual quedará sí:

Numeral 7. De los casos de suplantación. En el caso que el titular sea víctima del delito de Falsedad Personal contemplado en el Código Penal, y le sea exigido el pago de obligaciones como resultado de la conducta punible de la que es víctima, deberá presentar denuncia ante autoridad competente y elevar petición de corrección ante la fuente adjuntando los soportes correspondientes.

La fuente deberá cotejar los documentos utilizados para adquirir las obligaciones, con los documentos allegados por el titular en la petición, los cuales se tendrán como prueba sumaria para probar la falsedad, la fuente deberá denunciar el delito de estafa del que ha sido víctima.

Con la solicitud debidamente sustentada por el titular, el dato negativo, récord (Scorings- Score) y cualquier otro dato que refleje el comportamiento del titular, deberán ser modificados por la fuente reflejando que la víctima de falsedad no es quien adquirió las obligaciones, y se incluirá una leyenda dentro del registro personal que diga -Víctima de Falsedad Personal-.

Artículo 10º.

Actualización y rectificación de los datos. Las fuentes de información deberán reportar como mínimo una vez al mes al operador las novedades acerca de los datos, para que el operador los actualice en el menor tiempo posible término.

Artículo 11.

Régimen de transición. Los titulares de la información que a la entrada en vigencia de esta ley hubieran extinguido sus obligaciones objeto de reporte, y cuya información negativa hubiere permanecido en los Bancos de Datos por lo menos seis (6) meses contados a partir de la extinción de las obligaciones, serán beneficiarios de la caducidad inmediata de la información negativa.

Los titulares que tengan extintas sus obligaciones objeto de reporte, cuya información negativa no hubiere permanecido en los Bancos de Datos al menos seis (6) meses después de la extinción de las obligaciones, permanecerán con dicha información negativa por el tiempo que les hiciere falta para cumplir los seis (6) meses, contados a partir de la extinción de las obligaciones. En el caso que las obligaciones registren mora inferior a seis (6) meses, la información negativa permanecerá por el mismo tiempo de mora contado a partir de la extinción de las obligaciones.

Los titulares de la información que extingan sus obligaciones objeto de reporte dentro de los seis (6) meses siguientes a la entrada en vigencia de la presente ley, permanecerán con dicha información negativa en los Bancos de Datos por el término máximo de seis (6) meses, contados a partir de la fecha de extinción de tales obligaciones. Cumplido este plazo de máximo seis (6) meses, el dato negativo deberá ser retirado automáticamente de los Bancos de Datos.

Artículo 12.

Vigencia y derogatoria. Esta ley rige a partir de la fecha de publicación y deroga las disposiciones que le sean contrarias.

Luis Fernando Velasco Chaves, Senador de la República

David Alejandro Barguil Assis, Senador de la Republica

06Oct/18

Organización Estados Americanos (OEA)

6 octubre, 2018MastersCurso Derecho Informático, Organización Estados Americanos (OEA)José Cuervo

Introducción a los Datos Abiertos Ed. 6

Este curso tiene una duración de 6 semanas, del 30 octubre al 7 de diciembre de 2018

02Oct/18

Ley 1918 de 24 de julio de 2018

2 octubre, 2018Colombia, Leyadoptado el 23 de noviembre de 2001, Derecho Informático de Colombia, en Budapest., Legislación Informática de Colombia, Ley 1918 de 24 de julio de 2018, por medio de la cual se aprueba el "Convenio sobre la Ciberdelincuencia"José Cuervo

Ley 1918 de 24 de julio de 2018, por medio de la cual se aprueba el «Convenio sobre la Ciberdelincuencia», adoptado el 23 de noviembre de 2001, en Budapest.

El Congreso de Colombia

Visto el texto del «Convenio sobre la Ciberdelincuencia», adoptado el 23 de noviembre de 2001, en Budapest.

Se adjunta copia fiel y completa del texto certificado en español del Convenio, por la Jefe de Área de la Oficina de Interpretación de Lenguas del Ministerio de Asuntos Exteriores del Reino de España, certificado por la Coordinadora del Grupo Interno de Trabajo de Tratados de la Dirección de Asuntos Jurídicos Internacionales del Ministerio de Relaciones Exteriores, documento que reposa en el Archivo del Grupo Interno de Trabajo de Tratados y consta en dieciséis (16) folios.

El presente proyecto de ley consta de veinticuatro (24) folios.

PROYECTO DE LEY NÚMERO 58 DE 2017 por medio de la cual se aprueba el «Convenio sobre la Ciberdelincuencia», adoptado el 23 de noviembre de 2001, en Budapest. El Congreso de la República

Visto el texto del «Convenio sobre la Ciberdelincuencia», adoptado el 23 de noviembre de 2001, en Budapest.

Se adjunta copia fiel y completa del texto en español del Convenio, certificado por la Jefe de Área de la Oficina de Interpretación de Lenguas del Ministerio de Asuntos Exteriores del Reino de España, certificado por la Coordinadora del Grupo Interno de Trabajo de Tratados de la Dirección de Asuntos Jurídicos Internacionales del Ministerio de Relaciones Exteriores, documento que reposa en el Archivo del Grupo Interno de Trabajo de Tratados y consta en dieciséis (16) folios.

El presente proyecto de ley consta de veinticuatro (24) folios.

CONVENIO SOBRE LA CIBERDELINCUENCIA, BUDAPEST 23 DE NOVIEMBRE DE 2001

DECRETA:

Artículo 1°. Apruébase el “Convenio sobre la Ciberdelincuencia”, adoptado el 23 de noviembre de 2001, en Budapest.

Artículo 2°. De conformidad con lo dispuesto en el artículo 1° de la Ley 7ª de 1944, el “Convenio sobre la Ciberdelincuencia”, adoptado el 23 de noviembre de 2001, en Budapest, que por el artículo 1° de esta ley se aprueba, obligará a la República de Colombia a partir de la fecha en que se perfeccione el vínculo internacional respecto del mismo.

Artículo 3°. La presente ley rige a partir de la fecha de su publicación.

El Presidente del honorable Senado de la República, Efraín José Cepeda Sarabia.

El Secretario General del honorable Senado de la República, Gregorio Eljach Pacheco.

La Presidenta (E) de la honorable Cámara de Representantes, Lina María Barrera Rueda.

El Secretario General de la honorable Cámara de Representantes, Jorge Humberto Mantilla Serrano.

REPÚBLICA DE COLOMBIA – GOBIERNO NACIONAL

Comuníquese y cúmplase.

Ejecútese, previa revisión de la Corte Constitucional, conforme al artículo 241-10 de la Constitución Política.

Dada en Bogotá, D. C., a 24 de julio de 2018.

La Ministra de Educación Nacional de la República de Colombia, delegataria de funciones presidenciales, mediante Decreto número 1255 de 2018, Yaneth Giha Tovar.

La Viceministra de Relaciones Exteriores del Ministerio de Relaciones Exteriores, encargada de las funciones del Despacho de la Ministra de Relaciones Exteriores, Patti Londoño Jaramillo.

El Ministro de Justicia y del Derecho, Enrique Gil Botero.

El Ministro de Defensa Nacional, Luis Carlos Villegas Echeverri.

El Viceministro de Conectividad y Digitalización del Ministerio de Tecnologías de la Información y las Comunicaciones, encargado del Empleo del Despacho del Ministro de Tecnologías de la Información y las Comunicaciones, Juan Sebastián Rozo Rengifo.

02Oct/18

Resolución 670 de 14 de diciembre de 2017

2 octubre, 2018Colombia, Resoluciónde la Procuraduría General de la Nación, Derecho Informático de Colombia, Legislación Informática de Colombia, por medio de la cual se adopta el manual de políticas y procedimientos para la protección de datos personales, Resolución 670 de 14 de diciembre de 2017José Cuervo

Resolución 670 de 14 de diciembre de 2017, de la Procuraduría General de la Nación, por medio de la cual se adopta el manual de políticas y procedimientos para la protección de datos personales.

EL PROCURADOR GENERAL DE LA NACIÓN

En uso de las atribuciones constitucionales y legales; en especial las contenidas en el numeral 7 del artículo 7 del Decreto Ley 262 de 2000 y,

CONSIDERANDO

Que la Constitución Política dispone en el artículo 15 que toda persona tiene derecho a conocer, actualizar y rectificar las informaciones que se hayan recogido sobre ellas en bancos de datos y en archivos de entidades públicas y privadas.

Que a su vez el artículo 20 de la Carta Magna garantiza a toda persona el derecho fundamental de informar y recibir información veraz e imparcial.

Que en desarrollo de los preceptos constitucionales antes citados, el Congreso de la República expidió la Ley 1266 de 2008, por medio de la cual se dictaron disposiciones generales frente al habeas data y reguló el manejo de la información contenida en bases de datos personales.

Que así mismo el Congreso de la República expidió la Ley Estatutaria 1581 de 2012, a través de la cual dictó disposiciones generales para la protección de datos personales y dispuso como deberes de los sujetos obligados, entre otros, el contenido en el artículo 17, literal k) que expresamente señala: «Adoptar un manual interno de políticas y procedimientos para garantizar el adecuado cumplimiento de la presente ley y en especial, para la atención de consultas y reclamos»

Que con el fin de regular el derecho de acceso a la información pública y reglamentar las excepciones a la publicidad de la información, el Congreso de la República expidió la Ley 1712 de 2014 «Por medio de la cual se crea la Ley de Transparencia y del Derecho de Acceso a la Información Pública Nacional y se dictan otras disposiciones».

Con el fin de dar cumplimiento a la normativa antes señalada, la Procuraduría General de la Nación adopta el manual de Políticas y Procedimientos para la Protección de Datos Personales, documento que establece la forma como se recopilan, manejan y conservan los datos personales de los sujetos que la entidad en desarrollo de sus funciones constitucionales y legales requiere de su uso; y señala el procedimiento por el cual el interesado puede acudir ante la administración para solicitar el acceso, inclusión, exclusión, corrección, adición, actualización y certificación de sus datos, así como la limitación en las posibilidades de divulgación, publicación o cesión de los mismos, de conformidad con los principios que regulan el proceso de administración de datos personales que allí mismo se señalan.

Que el numeral 7 del artículo 7 del Decreto Ley 262 de 2000, facultan al Procurador General de la Nación para expedir los actos administrativos, órdenes, directivas y circulares que sean necesarios para el funcionamiento de la Entidad y para desarrollar las funciones atribuidas por la ley.

En mérito de lo expuesto,

RESUELVE

Artículo Primero

Adoptar el Manual de Políticas y Procedimientos para la Protección de Datos Personales, el cual hace parte integral del presente acto.

Artículo Segundo

La presente resolución rige a partir de su publicación

Dada en Bogotá, D. C. a los 14 de diciembre de 2017

Publíquese y Cúmplase.

Fernando Carrillo Flórez, Procurador General de la Nación.

01Oct/18

Ley de 30 de septiembre de 2009, de firma electrónica para el Estado de Baja California

1 octubre, 2018Ley, Méxicode 15 de febrero de 2013)., de fecha 6 de noviembre de 2009, de firma electrónica para el Estado de Baja California. (Publicada en el Periódico Oficial nº 49, Derecho Informático de Baja California, Derecho Informático de México, Legislación Informática de Baja California, Legislación Informática de México, Ley de 30 de septiembre de 2009, publicado en el Periódico Oficial nº 9, Secc I, Sección I). (Reformada por Decreto nº 414, Tomo CXVIJosé Cuervo

Ley de 30 de septiembre de 2009, de firma electrónica para el Estado de Baja California. (Publicada en el Periódico Oficial nº 49, de fecha 6 de noviembre de 2009, Tomo CXVI, Sección I). (Reformada por Decreto nº 414 , publicado en el Periódico Oficial nº 9, Secc I, de 15 de febrero de 2013).

CAPÍTULO PRIMERO.- DISPOSICIONES GENERALES

ARTÍCULO 1.- La presente Ley es de orden público, y tiene por objeto regular el uso de la Firma Electrónica en trámites, servicios y documentos de la Administración Pública Estatal, así como establecer las bases mediante las cuales, los Ayuntamientos en el ámbito de sus respectivas competencias, emitirán las disposiciones reglamentarias correspondientes.

(Reformado por Decreto nº 414, publicado en el Periódico Oficial nº 9, de fecha 15 de febrero de 2013, Sección I, Tomo CXX)

ARTÍCULO 2.- Para los efectos de esta Ley, se entenderán por:

I.- Acuse de Recibo: El generado por Medios Electrónicos o Sistemas de Información para el Emisor, a efecto de constatar la fecha y hora en que un Mensaje de Datos es recibido por el Destinatario;

II.- Administración Pública Estatal: El Gobernador del Estado, así como las Dependencias del Poder Ejecutivo y Entidades Paraestatales;

III.- Agentes Certificadores: Las Dependencias del Estado y Entidades Paraestatales, que determine la Autoridad Certificadora;

IV.- Autoridad Certificadora: La Secretaría de Planeación y Finanzas a través de la Subsecretaría de Innovación y Modernización Tecnológica Gubernamental,

V.- Certificado de Firma Electrónica: El documento digital firmado electrónicamente por la Autoridad Certificadora o los Agentes Certificadores, mediante el cual se confirma el vínculo existente entre el Firmante y la Firma Electrónica Certificada;

VI.- Datos de Creación de la Firma Electrónica: Los datos únicos que con cualquier tecnología el Firmante genera de manera secreta y utiliza para crear su Firma Electrónica, a fin de lograr el vínculo entre la misma y el Firmante;

VII.- Datos de Verificación de la Firma Electrónica: Los datos únicos que con cualquier tecnología se utilizan para verificar que la Firma Electrónica corresponda a sus Datos de Creación de la Firma Electrónica;

VIII.- Destinatario: A quien se dirige el Mensaje de Datos;

IX.- Emisor: Persona que origina un Mensaje de Datos;

X.- Firma Electrónica: La certificación de datos electrónicos tales como número, claves, contraseñas o cualquier otro que asociados a un Mensaje de Datos, son utilizados como medio de identificación para reconocer a su autor, legitimando su consentimiento y obligándose en términos de las manifestaciones que en dicho Mensaje de Datos se contienen;

XI.- Firmante: Quien utiliza una Firma Electrónica en nombre propio, o el de la persona a que represente de conformidad con la legislación aplicable;

XII.- Ley: Ley de Firma Electrónica para el Estado de Baja California;

XIII.- Medios Electrónicos: Equipos de cómputo, enlaces, microondas, vías satelitales o cualquier tecnología, a través de la cual se transmitan o reciban Mensajes de Datos;

XIV.- Mensajes de Datos: La información generada, enviada, recibida o archivada por Medios Electrónicos;

XV.- Sistemas de Información: Los programas informáticos utilizados para generar, enviar, recibir, archivar o procesar de alguna forma Mensajes de Datos;

XVI.- Titular: La persona física o moral en cuyo favor se expide un Certificado de Firma Electrónica;

XVII.- Trámites: Cualquier solicitud, promoción o acto que las personas físicas o morales realicen directamente o por Medios Electrónicos ante la Administración Pública Estatal, de conformidad con las disposiciones de esta Ley, y

XVIII.- Servicio: Actividad llevada a cabo por la Administración Pública Estatal destinada a satisfacer las necesidades de la colectividad a través de sus funciones propias o mediante la atención de trámites que en el ámbito de su competencia le requieran.

ARTÍCULO 3.- Las disposiciones de esta Ley no son aplicables a:

I.- Las funciones de investigación y persecución de los delitos;

II.- Los procedimientos administrativos seguidos en forma de juicio, ante las autoridades de la administración pública Estatal, salvo que las leyes que regulan dichos procedimientos lo permitan;

III.- Los procedimientos de responsabilidades de los servidores públicos, y

IV.- Aquellos actos en los cuales una ley especial requiera la firma autógrafa o manuscrita sobre el documento en papel o requieran la concurrencia personal de los servidores públicos o los particulares.

ARTÍCULO 4.- La aplicación de la presente Ley se regirá por los siguientes principios:

I.- Autenticidad: Es la certeza de atribuir la autoría del contenido de un Mensaje de Datos al Firmante, siéndole atribuibles las consecuencias jurídicas que del mismo se derivan, por ser expresión de su voluntad libre de vicios;

II.- Confidencialidad: Es la característica que existe cuando la información permanece controlada y es protegida de su acceso y distribución no autorizada;

III.- Conservación: Es el resguardo del Mensaje de Datos a efecto de que su existencia sea permanente y susceptible de reproducción;

IV.- Equivalencia Funcional: Consiste en equiparar los efectos jurídicos de los documentos escritos con los Mensajes de Datos, y de la firma autógrafa con la Firma Electrónica;

V.- Integridad: Es la cualidad de que un Mensaje de Datos permanezca completo e inalterado, con independencia de los cambios que pudiera sufrir el medio electrónico que lo contiene como resultado del proceso de comunicación, archivo o presentación; y,

VI.- Neutralidad Tecnológica: Consistente en no privilegiar el uso exclusivo de cierta tecnología.

CAPÍTULO SEGUNDO.- DE LA FIRMA ELECTRÓNICA

ARTÍCULO 5.- Los funcionarios y empleados de la Administración Pública Estatal podrán utilizar la Firma Electrónica en los trámites y servicios que brinden a la ciudadanía, en las comunicaciones internas de carácter oficial, así como en los documentos que en el ejercicio de sus funciones expidan.

Las personas físicas o morales podrán hacer uso de la Firma Electrónica en la realización de trámites ante la Administración Pública Estatal, siempre y cuando se les autorice para tal efecto.

ARTÍCULO 6.- La Firma Electrónica tendrá los mismos efectos jurídicos que una firma autógrafa consignada en documentos escritos.

Cualquier tipo de información contenida en un Mensaje de Datos firmado electrónicamente, o la constancia que de ellos se haga tendrán el mismo valor jurídico y la misma eficacia probatoria que la ley otorga a los documentos escritos en soporte de papel y con firma autógrafa.

ARTÍCULO 7.- Para la obtención del Certificado de Firma Electrónica, se requiere la comparecencia del particular o de su representante, debiendo invariablemente presentar a la Autoridad Certificadora o a los Agentes Certificadores para su verificación, la documentación que acredite la identidad, y en su caso existencia y facultades de su representante.

Los Mensajes de Datos que contengan una Firma Electrónica tendrán valor probatorio pleno.

ARTÍCULO 8.- Las personas interesadas en obtener la Firma Electrónica, deberán suscribir ante la Autoridad Certificadora o los Agentes Certificadores, un documento en el que:

I.- Expresarán que es su libre voluntad contar con un Certificado de Firma Electrónica;

II.- Se obligan a proporcionar información veraz y exacta para la obtención de la Firma Electrónica;

III.- Reconocerán como propios y auténticos los Mensajes de Datos que contengan su Firma Electrónica;

IV.- Aceptarán que el uso de la Firma Electrónica por persona distinta, quedará bajo su exclusiva responsabilidad, y que de ocurrir ese supuesto se atribuirá la autoría de los Mensajes de Datos;

V.- Se obligarán a notificar para efectos de su invalidación, la pérdida o cualquier otra situación que pudiera implicar la reproducción o el uso indebido del Certificado de Firma Electrónica.

VI.- Autorizarán que las notificaciones, citaciones o requerimientos se les hagan a través de Medios Electrónicos o Sistemas de Información, mismas que se practicarán en los términos, plazos y condiciones previstas en los acuerdos a que se refiere esta Ley; y,

VII.- Las demás que determinen las leyes.

ARTÍCULO 9.- El Firmante tendrá las siguientes obligaciones:

I.- Cumplir con los términos y condiciones a que se sujeta el uso de la Firma Electrónica;

II.- Actuar con diligencia y los cuidados necesarios para evitar la utilización no autorizada de la Firma Electrónica;

III.- Cerciorarse de que las declaraciones hechas en relación con la obtención de la Firma Electrónica son exactas;

IV.- Asumir cualquier tipo de responsabilidad y cumplir con las obligaciones derivadas del mal uso que se haga de la Firma Electrónica; y,

V.- Las demás que determinen las leyes y ordenamientos.

CAPÍTULO TERCERO.- DEL USO DE LA FIRMA ELECTRÓNICA

ARTÍCULO 10.- La Administración Pública Estatal podrá establecer el uso de la Firma Electrónica, a fin de hacer más eficiente la atención de los trámites y servicios que brinde a la ciudadanía, para las comunicaciones internas de carácter oficial, así como en los documentos que en el ejercicio de sus funciones expidan los servidores públicos.

El Sistema Educativo Estatal podrá expedir los certificados escolares y demás constancias, diplomas, títulos o grados académicos mediante el sistema de firma electrónica.

Todos los documentos electrónicos y en general los que emitan los servidores públicos habilitados bajo el sistema de firma electrónica deberán especificar su fecha y hora de creación.

El uso de la Firma Electrónica para la realización de Trámites será optativo para las personas físicas o morales, salvo los casos que establezcan las disposiciones aplicables.

ARTÍCULO 11.- Atendiendo a la naturaleza de los trámites y servicios, la Autoridad Certificadora en coordinación con los titulares de las Dependencias del Estado y Entidades Paraestatales, según corresponda, emitirán los Acuerdos mediante los cuales se establezcan las disposiciones de carácter general que se deberán observar en la obtención, implementación y uso de la Firma Electrónica en los trámites y servicios, comunicaciones internas de carácter oficial, así como en los documentos que en el ejercicio de sus funciones expidan los servidores públicos.

ARTÍCULO 12.- Los Acuerdos mediante los cuales se establezcan las disposiciones de carácter general a que se refiere el artículo anterior, deberán señalar como mínimo lo siguiente:

I.- Los trámites y servicios que podrán realizarse, así como los documentos que podrán expedirse a través del uso de la Firma Electrónica, previéndose los requisitos que deberán cumplirse para ello;

II.- Las condiciones, plazos y términos bajo los cuales la Administración Pública Estatal atenderá los trámites y servicios referidos en la fracción que antecede;

III.- Las bases técnicas para el establecimiento del uso de la Firma Electrónica; y

IV.- La facultad de la Autoridad Certificadora de verificar su cumplimiento.

ARTÍCULO 13.- Atendiendo a la naturaleza del trámite o servicio, los Mensajes de Datos podrán hacerse constar mediante archivos electrónicos con Firma Electrónica o en forma impresa de datos que contenga dicha firma y sello.

Los documentos que tienen un medio en papel, firma autógrafa o rúbrica podrán ser habilitados para tener un formato electrónico si cuenta con la firma electrónica de conformidad con la presente Ley.

Las Dependencias y Entidades de la Administración Pública Estatal para hacer más accesibles y ágiles los actos, comunicaciones, trámites, prestación de servicios y la expedición de cualquier documento, podrán en el ámbito de su competencia, suscribirlos por medio de firma electrónica.

ARTÍCULO 14.- La Autoridad Certificadora podrá implementar un Sistema de Información, con el objeto de que los interesados puedan verificar la autenticidad de los Mensajes de Datos que contengan Firma Electrónica.

ARTÍCULO 15.- Todo Mensaje de Datos se tendrá por expedido en el lugar donde el Emisor tenga su domicilio legal y por recibido en el lugar donde el Destinatario tenga el suyo.

ARTÍCULO 16.-Para hacer constar la recepción de un Mensaje de Datos se deberá generar un Acuse de Recibo, mismo que deberá contener los siguientes elementos:

I.- Nombre, denominación o razón social del Emisor;

II.- Registro Federal de Contribuyentes del Emisor, cuando así se requiera;

III.- Nombre o denominación del Destinatario;

IV.- Tipo de Trámite o asunto;

V.- Fecha y hora de la recepción;

VI.- Caracteres de identificación del acuse; y,

VII.- Los demás que se determinen en los Acuerdos a que se refiere el artículo 11 de esta Ley.

ARTÍCULO 17.- Cuando los particulares realicen Trámites en hora o día inhábil por Medios Electrónicos y Sistemas de Información con Firma Electrónica, que no sean factibles de ser procesados electrónicamente en forma inmediata por la autoridad competente, se tendrán por presentados en la primera hora hábil del día siguiente hábil, a aquel en que se genera el Acuse de Recibo.

Para los efectos de este artículo, las horas y días inhábiles serán las establecidas en las disposiciones legales aplicables al Trámite correspondiente.

ARTÍCULO 18.- La Administración Pública Estatal deberá conservar en archivos electrónicos los Mensajes de Datos que contengan Firma Electrónica, así como los documentos con formato electrónico que cuenten con dicha firma, preservándose su fecha y hora de creación, número de oficio y demás elementos necesarios para garantizar su Autenticidad e Integridad en los términos de esta Ley.

De considerarlo necesario, podrá respaldarse en forma impresa.

La Administración Pública Estatal exhibirá los archivos electrónicos que obren en su poder o bien, la impresión de éstos debidamente certificados cuando así lo requiera la autoridad competente.

ARTÍCULO 19.- Cuando los Mensajes de Datos con Firma Electrónica presenten problemas técnicos, deberá requerirse al Emisor, a efecto de que subsane la deficiencia respectiva, o en su caso, envíe de nuevo el Mensaje de Datos de que se trate, dentro del plazo que se determine en los Acuerdos a que hace referencia el artículo 11 de la presente Ley. En caso contrario el Trámite se tendrá por no presentado, quedando sin efecto el Acuse de Recibo que se hubiese generado.

Cuando los Mensajes de Datos con Firma Electrónica enviados por la Administración Pública Estatal presenten problemas técnicos, el Destinatario deberá solicitarle en un término no mayor a veinticuatro horas, que subsane la deficiencia respectiva o en su caso, envíe de nueva cuenta el Mensaje de Datos de que se trate.

CAPÍTULO CUARTO.- DE LOS CERTIFICADOS DE FIRMA ELECTRÓNICA

ARTÍCULO 20.- Los efectos del Certificado de Firma Electrónica son:

I.- Autentificar que la Firma Electrónica pertenece a determinada persona; y,

II.- Establecer la vigencia de la Firma Electrónica.

ARTÍCULO 21.- Los Certificados de Firma Electrónica deberán contener:

I.- La expresión de que tienen esa naturaleza;

II.- El código único de identificación;

III.- Los datos de autorización de quien lo expide;

IV.- La Firma Electrónica de la Autoridad Certificadora o del Agente Certificador que lo expide;

V.- El nombre, denominación o razón social del Titular. Se podrá consignar en el Certificado de Firma Electrónica cualquier otra circunstancia personal del titular o de su representante, en caso de que sea significativa en función del propio certificado y siempre que aquel otorgue su consentimiento;

VI.- En los supuestos de representación, la indicación del documento que la acredite, el nombre del Firmante, y las facultades para actuar en nombre de la persona a la que represente, misma que se considerará como Titular;

VII.- Los Datos de Verificación de la Firma Electrónica;

VIII.- El período de vigencia;

IX.- En su caso, los límites de uso; y,

X.- Los demás elementos que determine la Autoridad Certificadora.

ARTÍCULO 22.- El Certificado de Firma Electrónica tendrá una vigencia de dos años, no obstante podrá extinguirse por cualquiera de las siguientes causas:

I.- Cuando así lo solicite su Titular, o el Firmante en los casos de representación;

II.- Por revocación de la Autoridad Certificadora o los Agentes Certificadores, cuando se dejen de reunir las condiciones que sirvieron de base para su otorgamiento, o bien el Titular o Firmante incumplan las obligaciones que les impone esta Ley;

III.- Resolución judicial o administrativa;

IV.- Fallecimiento del Firmante o su representando;

V.- Incapacidad legal superviniente del Titular, o del Firmante en el caso de representación;

VI.- Terminación de la representación, o extinción de la persona moral representada;

VII.- Expiración de su vigencia; y,

VIII.- Cualquiera otra que impida su debida utilización.

Antes de que concluya el período de vigencia de un Certificado de Firma Electrónica, su Titular podrá solicitar uno nuevo.

En el supuesto mencionado en el párrafo anterior, la Autoridad Certificadora o los Agentes Certificadores podrán, mediante reglas de carácter general, relevar a los Titulares del Certificado de Firma Electrónica de la comparecencia personal ante dichos entes para acreditar su identidad y, en el caso de las personas morales, la representación legal correspondiente, cuando los Titulares cumplan con los requisitos que se establezcan en las propias reglas.

Si dichos órganos no emiten las reglas de carácter general, se estará a lo dispuesto por los artículos 7 y 8 de esta Ley.

ARTÍCULO 23.- La revocación de los Certificados de Firma Electrónica se sujetará a lo siguiente:

I.- La autoridad que otorgó el Certificado de Firma Electrónica notificará a su Titular, o al Firmante en los casos de representación, el inicio del procedimiento de revocación y la causa que motiva el mismo;

II.- El Titular o Firmante en los casos de representación contará con tres días hábiles para manifestar lo que a su derecho convenga, aportando en su caso los elementos que estime pertinentes, los cuales deberán estar relacionados con el hecho que se pretende probar; y,

III.- Transcurrido dicho plazo se resolverá lo conducente.

IV.- A partir de que se notifique el inicio del procedimiento respectivo, se suspenderán temporalmente los efectos del Certificado de Firma Electrónica, en tanto se resuelve la revocación.

ARTÍCULO 24.- La extinción de un Certificado de Firma Electrónica surtirá efectos desde la fecha en que la Autoridad Certificadora o los Agentes Certificadores tengan conocimiento de la causa que la origina, debiendo hacerse constar tal circunstancia en el Registro de Certificados.

Tratándose del fallecimiento del Firmante o su representado, la extinción surtirá efectos a partir de que este ocurra.

ARTÍCULO 25.- La Autoridad Certificadora expedirá los Certificados de Firma Electrónica a los servidores públicos de la Administración Pública Estatal que en el ámbito de sus respectivas competencias estén legalmente facultados para rubricar documentos.

Cuando algún servidor público deje de prestar sus servicios a la Administración Pública, se procederá a la cancelación inmediata del Certificado de Firma Electrónica que se le hubiera expedido con tal carácter.

La Autoridad Certificadora deberá dar aviso a la Secretaría General de Gobierno de la expedición, suspensión, revocación, cancelación o extinción de los Certificados de Firma Electrónica de los servidores públicos para los efectos del registro y legalización de firmas a que se refiere el artículo 19 fracción XIII de la Ley Orgánica de la Administración Pública del Estado de Baja California.

ARTÍCULO 26.- La Autoridad Certificadora o los Agentes Certificadores, suspenderán temporalmente un Certificado de Firma Electrónica cuando lo solicite el Titular, el Firmante en los casos de representación o cuando así proceda en términos de esta Ley. La suspensión deberá inscribirse en el Registro de Certificados de Firma Electrónica.

ARTÍCULO 27.- El Titular del Poder Ejecutivo del Estado por conducto de la Autoridad Certificadora, podrá celebrar convenios con la Federación, las Entidades Federativas, el Distrito Federal y los Municipios a efecto de que la Firma Electrónica utilizada por dichas autoridades, pueda ser manejada por los particulares en términos de esta Ley, o bien para que se utilice en la Federación, las Entidades Federativas, el Distrito Federal y los Municipios.

CAPÍTULO QUINTO.- DE LOS TITULARES DE CERTIFICADOS DE FIRMA ELECTRÓNICA

ARTÍCULO 28.- Los Titulares de Certificados de Firma Electrónica, respecto de la Autoridad Certificadora y los Agentes Certificadores tendrán derecho a:

I.- Solicitar la expedición de la constancia de la existencia y un registro del Certificado;

II.- Solicitar la modificación de datos y elementos del Certificado de Firma Electrónica cuando así se convenga a sus intereses;

III.- Recibir información sobre términos y condiciones bajo los cuales se otorgará la certificación;

IV.- La confidencialidad sobre la información proporcionada para la obtención de la Firma Electrónica;

V.- Conocer los medios a través de los cuales podrá solicitar aclaraciones, presentar quejas o reportes; y,

VI.- Que se les notifique la suspensión, cancelación o extinción de su certificado.

ARTÍCULO 29.- Son obligaciones de los Titulares de Certificados de Firma Electrónica:

I.- Proporcionar datos veraces, completos y exactos;

II.- Mantener el control exclusivo de sus Datos de Creación de Firma Electrónica;

III.- Solicitar la extinción de su Certificado de Firma Electrónica en caso de pérdida, robo o cualquier circunstancia que pueda comprometer la privacidad de sus datos de creación de Firma Electrónica;

IV.- Verificar que el Firmante en el caso de representación, cumpla con las obligaciones que le establece esta Ley;

V.- Actualizar los datos contenidos en el Certificado de Firma Electrónica; y,

VI.- Las demás que determine la Autoridad Certificadora en los términos de esta Ley.

CAPÍTULO SEXTO.- DE LA AUTORIDAD CERTIFICADORA Y LOS AGENTES CERTIFICADORES

ARTÍCULO 30.- La Autoridad Certificadora, tendrá las siguientes atribuciones y obligaciones:

I.- Autorizar en los términos de la Ley a las Dependencias y Entidades, para la expedición de Certificados de Firma Electrónica;

II.- Revocar la autorización a que se refiere la fracción anterior, cuando se dejen de reunir las condiciones que sirvieron de base para su otorgamiento;

III.- Llevar un Registro de Certificados de Firma Electrónica y de Agentes Certificadores;

IV.- Vigilar el cumplimiento de las obligaciones de los Agentes Certificadores;

V.- Establecer los estándares tecnológicos y operativos de la infraestructura de los Medios Electrónicos y/o Sistemas de Información, así como de la Firma Electrónica;

VI.- Guardar la confidencialidad respecto de la información que haya recibido para el otorgamiento de un Certificado de Firma Electrónica;

VII.- Poner a disposición del Firmante los dispositivos de creación y de verificación de Firma Electrónica;

VIII.- Informar sobre las características y condiciones de uso del Certificado de Firma Electrónica;

IX.- Registrar toda la información y documentación relativa a los Certificados de Firma Electrónica; y,

X.- Las demás que deriven de esta Ley y otras disposiciones aplicables.

Artículo 31.- Las disposiciones técnicas que se establezcan en materia de Medios Electrónicos, en términos del segundo párrafo del artículo 22 de la Ley de Adquisiciones, Arrendamientos y Servicios para el Estado de Baja California, deberán ser emitidas por la Autoridad Certificadora conjuntamente con la Oficialía Mayor del Poder Ejecutivo.

ARTÍCULO 32.- Sólo las Dependencias del Estado y Entidades Paraestatales, podrán ser autorizadas como Agentes Certificadores, siempre y cuando cuenten con elementos humanos, materiales, económicos que determine la Autoridad Certificadora.

ARTÍCULO 33.- Los Agentes Certificadores tendrán las siguientes atribuciones y obligaciones:

I.- Expedir los Certificados de Firma Electrónica en los términos que establece esta Ley;

II.- Remitir a la Autoridad Certificadora la información relativa a la expedición, suspensión o extinción de los Certificados de Firma Electrónica, para su inscripción en el Registro de Certificados de Firma Electrónica;

III.- Guardar la confidencialidad respecto de la información que haya recibido para el otorgamiento del Certificado de Firma Electrónica;

IV.- Poner a disposición del Firmante los dispositivos de creación y de verificación de Firma Electrónica;

V.- Informar sobre las características y condiciones de uso del Certificado de Firma Electrónica;

VI.- Facilitar a la Autoridad Certificadora la información que le permita verificar el cumplimiento de sus obligaciones en los términos de esta Ley;

VII.- Resguardar toda la información y documentación relativa a los Certificados de Firma Electrónica que expidan;

VIII.- Cumplir con las obligaciones que deriven de esta Ley y demás disposiciones aplicables.

CAPÍTULO SÉPTIMO.- DE LOS MEDIOS DE DEFENSA

ARTÍCULO 34.- La negativa de la Autoridad Certificadora o los Agentes Certificadores para expedir un Certificado de Firma Electrónica, o la resolución que recaiga al procedimiento de revocación del Certificado de Firma Electrónica, sólo podrá ser impugnada por los particulares en los términos de la Ley del Procedimiento para los Actos de la Administración Pública del Estado de Baja California.

CAPÍTULO OCTAVO.- DEL USO DE MEDIOS ELECTRÓNICOS Y LA FIRMA ELECTRÓNICA EN EL ÁMBITO MUNICIPAL

ARTÍCULO 35.- Los Ayuntamientos que implementen el uso de la Firma Electrónica, en el ámbito de su competencia, expedirán la normatividad que deberá regir esta materia, de conformidad con las siguientes bases:

I.- Los términos y condiciones a que se sujetará el uso de la Firma Electrónica;

II.- La Autoridad competente para expedir los Certificados de Firma Electrónica;

III.- En su caso, el régimen de actuación de las dependencias y entidades que funjan como Agentes Certificadores; y,

IV.- Las demás disposiciones que consideren necesarias para lograr el cumplimiento del objeto de la Ley.

TRANSITORIOS

ARTÍCULO PRIMERO.- La presente Ley entrará en vigor al día siguiente de su publicación en el Periódico Oficial del Estado.

ARTÍCULO SEGUNDO.- Los trámites que a la fecha de la entrada en vigor del presente ordenamiento sean realizados por Medios Electrónicos, continuarán realizándose de este modo, hasta en tanto se establezcan las disposiciones de carácter general que determinen los trámites que podrán sujetarse al uso de la Firma Electrónica.

DADO en el Salón de Sesiones “Lic. Benito Juárez García” del H. Poder Legislativo del Estado de Baja California, en la Ciudad de Mexicali, B.C., a los treinta días del mes de septiembre de dos mil nueve, rúbrica la Mesa Directiva del Primero Periodo Ordinario de Sesiones del Tercer Año de Ejercicio Constitucional, el día quince de octubre de dos mil nueve.

DIP. ANTONIO RICARDO CANO JIMÉNEZ, PRESIDENTE

DIP. RUBÉN ERNESTO ARMENTA ZANABIA, SECRETARIO

DE CONFORMIDAD CON LO DISPUESTO POR LA FRACCION I DEL ARTÍCULO 49 DE LA CONSTITUCIÓN POLÍTICA DEL ESTADO, IMPRÍMASE Y PUBLÍQUESE.

MEXICALI, BAJA CALIFORNIA, A LOS VEINTISÉIS DIAS DEL MES DE OCTUBRE DEL AÑO DOS MIL NUEVE.

GOBERNADOR DEL ESTADO, JOSE GUADALUPE OSUNA MILLÁN

SECRETARIO GENERAL DE GOBIERNO, JOSE FRANCISCO BLAKE MORA

01Oct/18

Decreto nº 491 de 26 de mayo de 2010, Ley de Firma Electrónica Avanzada para el Estado de Durango

1 octubre, 2018Ley, Méxicode fecha 3 de junio de 2010) (Modificado por el Decreto 145, Decreto nº 491 de 26 de mayo de 2010, Derecho Informático de Durango, Derecho Informático Mexicano, Legislación Informática de Durango, Legislación Informática de México, Ley de Firma Electrónica Avanzada para el Estado de Durango. (Publicado en el Periódico Oficial nº 44, publicado en el Periódico Oficial nº 44 de 1 de junio de 2017 y la última actualización mediante Decreto 491, publicado en el periódico Oficial nº 57 del 19 de julio de 2018).José Cuervo

Decreto nº 491 de 26 de mayo de 2010, Ley de Firma Electrónica Avanzada para el Estado de Durango. (Publicado en el Periódico Oficial nº 44, de fecha 3 de junio de 2010) (Modificado por el Decreto 145, publicado en el Periódico Oficial nº 44 de 1 de junio de 2017 y la última actualización mediante Decreto 491, publicado en el periódico Oficial nº 57 del 19 de julio de 2018).

CAPÍTULO I.- DISPOSICIONES GENERALES

ARTÍCULO 1.- La presente Ley es de orden público e interés general, y tiene por objeto:

I.- Agilizar, eficientar y simplificar por medio de la firma electrónica avanzada los actos, convenios, comunicaciones, trámites y la prestación de servicios públicos que corresponden al Poder Ejecutivo, al Poder Legislativo, al Poder Judicial, a los Órganos Constitucionales Autónomos, a los Ayuntamientos y a las dependencias y entidades de la administración pública estatal o municipal;

(Reformado por Decreto nº 145, publicado en el Periódico Oficial nº 44 de 1 de junio de 2017).

II.- Expedir certificados digitales a personas físicas.

III.- Implementar el uso de la firma electrónica avanzada en los actos establecidos en el presente ordenamiento; y

IV.- Los servicios relacionados con la firma electrónica avanzada

(Reformado por Decreto nº 412, publicado en el Periódico Oficial nº 57 de 19 de julio de 2018)

ARTÍCULO 2.- Son sujetos de esta Ley:

I.- El Poder Ejecutivo;

II.- El Poder Legislativo;

III. El Poder Judicial;

IV.- Los Órganos Constitucionales Autónomos;

(Reformado por Decreto nº 145, publicado en el Periódico Oficial nº 44 de 1 de junio de 2017).

V.- Los Ayuntamientos;

VI.- Los servidores públicos de las dependencias señaladas en las fracciones I a la V del presente Artículo que, en la realización de los actos a que se refiere esta Ley utilicen la firma electrónica avanzada; y

VII.- Los particulares que decidan utilizar la firma electrónica avanzada, por medios electrónicos, en los términos del presente ordenamiento.

ARTÍCULO 3.- Cuando la ley exija la forma escrita para los actos, contratos y la firma de los documentos relativos, esos supuestos se tendrán por cumplidos tratándose de mensaje de datos siempre que éste sea íntegro, atribuible a las personas obligadas y accesibles para su ulterior consulta.

ARTÍCULO 4.- Quedan exceptuados de la aplicación de esta Ley los trámites, actos o procedimientos, que por disposición legal expresa exija firma autógrafa, así como aquellos actos en los cuales una disposición jurídica exija cualquier otra formalidad que no sea susceptible de cumplirse mediante la Firma Electrónica Avanzada.

ARTÍCULO 5.- Para los efectos de esta Ley, se entenderá por:

I.- Autoridad certificadora: Es la dependencia, unidad administrativa u órgano designado por cada ente público sujeto a esta Ley, que tiene a su cargo el servicio de certificación de firmas electrónicas, que vincula al firmante con el uso de su firma electrónica avanzada en las operaciones que realice, administra la parte tecnológica del procedimiento y ejerce el proceso de autenticidad;

II.- Certificado Digital: El documento emitido de manera electrónica por la Autoridad Certificadora, mediante el cual se confirma el vínculo existente entre el Firmante y sus Datos de Creación de firma a través de los Datos de verificación de firma en él contenidos;

III.- Datos de creación de Firma Electrónica Avanzada o Clave Privada: cadena de bits o datos únicos que el firmante genera de manera secreta y utiliza para crear su firma electrónica avanzada, a fin de lograr el vínculo entre dicha firma electrónica avanzada y el firmante;

IV.- Datos de verificación de Firma Electrónica Avanzada o Clave Pública: cadena de bits o datos únicos contenidos en un certificado digital que permiten la verificación de la autenticidad de la firma electrónica avanzada del firmante;

V.- Dependencias: Las que integran la Administración Pública Estatal y Municipal en términos de sus respectivas Leyes Orgánicas;

VI.- Destinatario: La persona designada por el firmante para recibir el mensaje de datos, pero que no esté actuando a título de intermediario con respecto a dicho mensaje;

VII.- Dispositivo de creación de firma electrónica avanzada: El programa o sistema informático que sirve para aplicar los datos de creación de firma electrónica avanzada;

VIII.- Dispositivo de verificación de firma electrónica avanzada: El programa o sistema informático que sirve para aplicar los datos de verificación de firma electrónica avanzada;

IX.- Entidades: Los organismos descentralizados, las empresas de participación estatal mayoritaria y los fideicomisos públicos que tengan el carácter de entidad paraestatal de la Administración Pública Estatal y Municipal, en términos de sus respectivas Leyes Orgánicas;

X.- Entes: El Poder Ejecutivo, Legislativo y Judicial, los Órganos Constitucionales Autónomos y los Ayuntamientos;

(Reformado por Decreto nº 145, publicado en el Periódico Oficial nº 44 de 1 de junio de 2017).

XI.- Firma Electrónica Avanzada: El conjunto de datos electrónicos consignados o lógicamente asociados al mensaje de datos, utilizados como medio de identificación del firmante, los cuales son generados y mantenidos bajo su estricto y exclusivo control, siendo detectable cualquier modificación ulterior al mensaje de datos o a la propia firma, produciendo los mismos efectos jurídicos que la firma autógrafa;

XII.- Firmante: La persona que actúa en nombre propio y que utiliza la firma electrónica avanzada para firmar documentos electrónicos o mensajes datos;

XIII.- Medios electrónicos: Los dispositivos tecnológicos utilizados para la transmisión, almacenamiento, gestión de datos e información, a través de cualquier tecnología electrónica o transporte de datos;

XIV. Mensaje de datos: La información generada, enviada, recibida, archivada y comunicada por medios electrónicos, ópticos, o cualquier otra tecnología;

XV.- Página Web: el sitio en Internet que contiene información, aplicaciones y, en su caso, vínculos a otras páginas;

XVI.- Medios electrónicos: Los dispositivos tecnológicos para transmisión, almacenamiento, gestión de datos e información, a través de cualquier tecnología electrónica o transporte de datos;

XVII.- Sistema de información: Todo sistema o programa en el que se realice captura, almacenamiento, custodia, seguridad, consulta, reproducción, verificación, administración y transmisión de información, datos o documentos electrónicos;

XVIII.- Sujetos Obligados: los servidores públicos y particulares que utilicen la firma electrónica avanzada, en términos de lo previsto en las fracciones VI y VII del Artículo 2 de esta Ley; y

XIX.- Titular: La persona a cuyo favor se expide un certificado de firma electrónica avanzada.

CAPÍTULO II.- DEL USO DE LOS MEDIOS ELECTRÓNICOS Y LA FIRMA ELECTRÓNICA AVANZADA

ARTÍCULO 6.- En los actos, convenios, comunicaciones, trámites y la prestación de los servicios públicos que correspondan a los entes y cualquier entidad o dependencia, podrá emplearse la firma electrónica avanzada contenida en un mensaje de datos.

La firma electrónica avanzada podrá ser utilizada indistintamente en documentos electrónicos, mensajes de datos, actos, convenios, comunicaciones, trámites y demás servicios públicos que corresponda su aplicación a los Sujetos Obligados, mismos que producirán los mismos efectos que los exhibidos con firma autógrafa y, en consecuencia, tendrán el mismo valor probatorio, que las disposiciones jurídicas aplicables les otorgan.

Los entes podrán expedir documentos por medios electrónicos que contengan la firma electrónica avanzada cuando reúnan los requisitos señalados en esta Ley.

ARTÍCULO 7.- La firma electrónica avanzada deberá regirse por los principios de; neutralidad tecnológica, autonomía de la voluntad de las partes, compatibilidad internacional y equivalencia funcional, las características de; autenticidad, confidencialidad, no repudio y el requisito de; integridad, definidas conforme a lo que a continuación se desarrolla:

I.- La neutralidad tecnológica, implica la posibilidad de utilizar cualquier tecnología para la emisión de certificados digitales y para la prestación de los servicios relacionados con la firma electrónica avanzada, sin que se favorezca a alguna en particular, es decir, por disposición de ley u orden de autoridad no podrá obligarse el uso de una tecnología en particular;

II.- La equivalencia funcional del Mensaje de Datos en relación con la información documentada en medios no electrónicos y de la Firma Electrónica en relación con la firma autógrafa;

III.- Autonomía de la voluntad de las partes consiste en considerar que toda persona sólo puede obligarse en virtud de su propio querer libremente manifestado. Sólo la voluntad de un sujeto de derecho es apta para producir obligaciones.

IV.- Compatibilidad internacional, basada en estándares internacionales se refiere de manera genérica a la compatibilidad de los programas o software utilizado para la creación de las firmas electrónicas y su registro a fin de permitir que las operaciones internacionales por vías electrónicas mantengan un mínimo de seguridad jurídica que permita su desarrollo.

V.- La autenticidad, ofrece la certeza de que un documento electrónico o un mensaje de datos que ha sido firmado electrónicamente con firma electrónica avanzada, le es atribuible su contenido y las consecuencias jurídicas que del mismo se deriven, al firmante;

VI.- La confidencialidad, es la característica que existe cuando, de así convenirlo las partes, la información permanece controlada y es protegida de su acceso y distribución no autorizada;

VII.- No repudio, consiste en que la firma electrónica avanzada contenida en documentos electrónicos garantiza la autoría e integridad del documento y que dicha firma corresponde exclusivamente al firmante; y

VIII.- La integridad, se considera cuando el contenido de un mensaje de datos ha permanecido completo e inalterado, con independencia de los cambios que hubiere podido sufrir el medio que lo contiene, como resultado del proceso de comunicación, archivo o presentación.

ARTÍCULO 7 BIS.- A efecto que los sujetos a que hace referencia el Artículo 2 de la presente Ley, puedan hacer uso de firma electrónica avanzada, en los actos señalados en el correlativo 6 de la misma, deberán contar con:

a) Un certificado digital vigente, emitido conforme a lo establecido en esta Ley y su Reglamento; y

b) Contar con datos de creación de firma o clave privada, generada y mantenida en un dispositivo bajo su exclusivo control.

(Adicionado por Decreto nº 412, publicado en el Periódico Oficial nº 57 de 29 de julio de 2018)

ARTÍCULO 8.- La utilización de los medios electrónicos en ningún caso podrá implicar la existencia de restricciones o discriminaciones de cualquier naturaleza en el acceso de los particulares a la prestación de servicios públicos o a cualquier trámite, acto o actuación de cualquier autoridad estatal o municipal.

ARTÍCULO 9.- El uso de medios electrónicos a que se refiere esta Ley será potestativo para los particulares, quienes podrán optar por el uso de medios electrónicos en los actos, señalados en el Artículo 6 de esta Ley. Siendo obligatorio para la autoridad llevar a cabo su correcta aplicación.

(Reformado por Decreto nº 412, publicado en el Periódico Oficial nº 57 de 29 de julio de 2018)

ARTÍCULO 10.- En las comunicaciones entre los entes y cualquier entidad o dependencia, se podrá hacer uso de los medios electrónicos mediante un mensaje de datos que contenga la firma electrónica avanzada del servidor público competente.

ARTÍCULO 11.- Para hacer más accesibles, ágiles y sencillos los actos, convenios, comunicaciones, trámites y la prestación de los servicios públicos que corresponden a los entes y cualquier entidad o dependencia, se podrá utilizar la firma electrónica avanzada contenida en un mensaje de datos y el uso de medios electrónicos, en los términos de los reglamentos que en el ámbito de sus respectivas competencias se expidan.

ARTÍCULO 12.- Los entes y cualquier entidad o dependencia, deberán verificar la firma electrónica avanzada, la vigencia del certificado de firma electrónica avanzada y, en su caso, la fecha electrónica en los actos, convenios, comunicaciones, trámites y la prestación de los servicios públicos que correspondan a éstos; así como en las solicitudes y promociones que en relación con los mismos realicen los particulares.

ARTÍCULO 13.- Los documentos presentados por los particulares por medios electrónicos que contengan la firma electrónica avanzada, producirán en términos de esta Ley, los mismos efectos que los documentos firmados de manera autógrafa, para tal efecto los sujetos señalados en las fracciones I a la V del Artículo 2, de la presente Ley, determinarán en cuáles actos los particulares podrán usar la firma electrónica avanzada.

Las autoridades podrán expedir documentos por medios electrónicos que contengan la firma electrónica avanzada cuando reúnan los requisitos señalados en esta Ley.

ARTÍCULO 14.- Cuando los particulares realicen comunicaciones o soliciten la prestación de servicios públicos o promuevan cualquier trámite por medios electrónicos en hora o día inhábil, se tendrán por presentados en la primera hora hábil del siguiente día hábil.

Para los casos no previstos por esta Ley, se entenderán conforme a lo señalado en la Ley de Justicia Administrativa del Estado de Durango.

CAPÍTULO III.- DE LOS MENSAJES DE DATOS

ARTÍCULO 15.- Los mensajes de datos tendrán el mismo valor jurídico y la misma eficacia probatoria que la Ley otorga a los documentos escritos en soporte de papel y con firma autógrafa, salvo los casos que prevé la presente ley.

ARTÍCULO 16.- La reproducción en formato impreso del mensaje de datos tendrá valor probatorio pleno cuando se ha conservado en su integridad la información contenida en el mismo a partir de que se generó por primera vez en su forma definitiva como tal, y no sea impugnada la autenticidad o exactitud del mensaje y de la firma electrónica.

ARTÍCULO 17.- Para que surta efectos un mensaje de datos, se requiere de un acuse de recibo electrónico, entendiéndose como tal el generado por el sistema de información del destinatario. Se considera que el mensaje de datos ha sido enviado y recibido, cuando se pruebe la existencia del acuse de recibo electrónico respectivo.

ARTÍCULO 18.- En lo referente al acuse de recibo de mensajes de datos, si al enviar o antes de enviar un mensaje de datos, el emisor solicita o acuerda con el destinatario que se acuse recibo del mensaje de datos, pero no se ha acordado entre estos una forma o método determinado para efectuarlo, se podrá acusar recibo mediante todo acto del destinatario, que baste para indicar al emisor que se ha recibido el mensaje de datos.

ARTÍCULO 19.- El contenido de los mensajes de datos que contengan firma electrónica avanzada, relativos a los actos, convenios, comunicaciones, trámites, prestación de los servicios públicos y las solicitudes y promociones que se realicen utilizando medios electrónicos, deberán conservarse en archivos electrónicos y hacerse constar íntegramente en forma impresa, integrando expediente, cuando así lo soliciten expresamente los interesados o lo determine la autoridad competente.

ARTÍCULO 20.- Todo mensaje de datos se tendrá por expedido en el lugar donde el emisor tenga su domicilio real, legal o convencional y por recibido en el lugar donde el destinatario tenga el suyo, salvo prueba o acuerdo en contrario.

ARTÍCULO 21.- Se presumirá que un mensaje de datos proviene del emisor si ha sido enviado:

I.- Por el propio emisor;

II.- Usando medios de identificación, tales como claves o contraseñas del emisor o por alguna persona facultada para actuar en nombre del emisor respecto a ese mensaje de datos, o

III.- Por un sistema de información programado por el emisor o en su nombre para que opere automáticamente.

ARTÍCULO 22.- Los mensajes de datos tendrán valor probatorio pleno, salvo lo que dispongan al respecto otras leyes en la materia que ellas regulan, cuando se acredite lo siguiente:

I.- Que contengan la firma electrónica avanzada;

II.- La fiabilidad del método en que hayan sido generados, archivados o conservados; y

III. Que se ha conservado la integridad de la información a partir del momento en que se generaron por primera vez en su forma definitiva como tales o en alguna otra forma.

ARTÍCULO 23.- Se presumirá salvo prueba en contrario, que un mensaje de datos proviene de una persona determinada, cuando contenga su firma electrónica avanzada.

ARTÍCULO 24.- El momento de recepción de un mensaje de datos se determinará de la forma siguiente:

I.- Al ingresar en el sistema de información designado por el destinatario; y

II.- De no haber un sistema de información designado, en el momento en que el destinatario se manifieste sabedor de dicha información.

ARTÍCULO 25.- Cuando las leyes requieran que una información o documento sea presentado y conservado en su forma original, se tendrá por satisfecho este requisito, respecto a un mensaje de datos, si existe garantía confiable de que se ha conservado la integridad de la información, a partir del momento en que se generó por primera vez en su forma definitiva, como mensaje de datos o en alguna otra forma, y de requerirse la presentación de la información, si la misma puede mostrarse a la persona a la que se deba presentar.

CAPÍTULO IV.- DE LAS CARACTERÍSTICAS DE LA FIRMA ELECTRÓNICA AVANZADA CERTIFICADA.

ARTÍCULO 26.- Las disposiciones del presente ordenamiento serán aplicables de modo que no excluyan, restrinjan o priven a cualquier método de creación de firmas electrónicas avanzadas siempre y cuando cumplan con los requisitos que establecen las leyes de la materia.

ARTÍCULO 27.- La firma electrónica avanzada se considerará como tal, si cumple al menos con los siguientes requisitos:

I.- Que indique que se expide como tal;

II.- Cuente con un certificado de firma electrónica avanzada vigente;

III.- Que contenga el código único de identificación del certificado;

IV.- Identifique a la autoridad certificadora que emite el certificado, incluyendo la firma electrónica avanzada de ésta;

V.- Que permita determinar la fecha electrónica del mensaje de datos;

VI.- Que los datos de creación de la firma, en el contexto en que son utilizados, corresponden exclusivamente al firmante;

VII.- Que los datos de creación de la firma estén en el momento de la firma bajo el control exclusivo del firmante, y

VIII.- Que sea posible detectar cualquier alteración de la firma electrónica avanzada realizada después del momento de la firma.

Lo dispuesto en el presente Artículo se entenderá́ sin perjuicio de la posibilidad de que cualquier persona demuestre de cualquier otra manera la fiabilidad de una firma electrónica avanzada; o presente pruebas de que la misma no es fiable.

ARTÍCULO 28.- La firma electrónica avanzada que permita vincular al firmante con el mensaje de datos y atribuir la autoría de éste, tendrá la misma validez jurídica y eficacia probatoria que las Leyes otorgan a la firma autógrafa, en los casos que prevé la presente ley.

ARTÍCULO 29.- La firma electrónica avanzada, además de tener las características mencionadas en el Artículo anterior, deberá garantizar cuando menos lo siguiente:

I.- Que los datos utilizados para su generación se puedan producir sólo una vez, de tal forma que se asegure razonablemente su confidencialidad;

II.- La seguridad suficiente y razonable de no ser alterada con la tecnología existente; y

III.- La integridad del mensaje de datos.

CAPÍTULO V.- DE LA OBTENCIÓN Y CANCELACIÓN DE CERTIFICADOS DE FIRMA ELECTRÓNICA AVANZADA

ARTÍCULO 30.- Para la obtención de un certificado de firma electrónica avanzada se deberá llevar a cabo el siguiente procedimiento:

I.- Los solicitantes tratándose de autoridades, deberán presentar ante la autoridad certificadora la solicitud para la obtención de certificado de firma electrónica avanzada, debidamente requisitada y autorizada por el titular de la dependencia, unidad administrativa u órgano en que se tramite, en el caso de los particulares estos deberán proporcionar los requisitos que establezca la autoridad certificadora;

II.- Recibida la solicitud, la autoridad certificadora deberá verificar la identidad del firmante con base en los documentos oficiales de identificación que ésta le requiera, así como el cumplimiento de los demás requisitos que se establezcan para tal efecto;

III.- Recibida la solicitud y los demás documentos, la autoridad certificadora expedirá el certificado de firma electrónica avanzada cuando se cumplan los requisitos necesarios y registrará el certificado en su base de datos de firma electrónica;

IV.- El solicitante una vez que obtenga el certificado de firma electrónica avanzada deberá resguardar la clave privada en un medio electrónico.

ARTÍCULO 31.- Los certificados de firma electrónica avanzada tendrán valor probatorio en los términos de esta Ley y surtirán efectos jurídicos cuando estén firmados electrónicamente por la autoridad certificadora.

ARTÍCULO 32.- Los efectos del certificado de firma electrónica avanzada son:

I.- Autenticar que la firma electrónica avanzada pertenece a determinada persona y;

II.- Verificar la vigencia de la misma.

ARTÍCULO 33.- Los certificados, para ser considerados válidos, deberán contener cuando menos:

I.- La indicación de que se expiden como tales;

II.- El código de identificación único del certificado;

III.. La identificación de la autoridad certificadora que expide el certificado, su firma electrónica avanzada, razón social, dirección de correo electrónico y página web;

IV.- Nombre del titular del certificado;

V.- Periodo de vigencia del certificado;

VI.- La fecha y hora de la emisión, suspensión, revocación, renovación del certificado;

VII.- En su caso, los límites de uso del certificado de firma electrónica avanzada; y

VIII.- La referencia de la tecnología empleada para la creación de la firma electrónica.

ARTÍCULO 34.- La vigencia del certificado digital será de dos años como máximo, la cual iniciará a partir del momento de su emisión y expirará el día y hora que señala el mismo.

Los certificados de firma electrónica avanzada tendrán valor probatorio pleno, salvo lo que dispongan al respecto otras leyes en la materia que ellas regulan y surtirán efectos jurídicos, cuando estén firmados electrónicamente por la autoridad certificadora.

ARTÍCULO 35.- Los certificados de firma electrónica avanzada se extinguirán por las siguientes causas:

I.- Expiración de su vigencia;

II.- Revocación por el firmante, o por mandato de autoridad competente;

III.- Pérdida, robo o inutilización por daños del soporte del certificado de firma electrónica avanzada;

IV.- Fallecimiento del firmante, incapacidad superveniente total, o extinción de la persona moral representada;

V.- Fallecimiento del firmante o su representante, incapacidad superveniente, total o parcial, de cualquiera de ellos, terminación de la representación o extinción de la persona moral representada;

VI.- Inexactitudes en los datos aportados por el firmante para la obtención del certificado de firma electrónica avanzada; y

VII.- Por haberse comprobado que el certificado de firma electrónica avanzada no cumple con los requisitos de esta Ley, situación que no afectará los derechos de terceros de buena fe.

ARTÍCULO 36.- Cuando un servidor público deje de prestar sus servicios y cuente con un certificado de firma electrónica avanzada en virtud de sus funciones, el superior jerárquico o la autoridad certificadora ordenará la cancelación inmediata del mismo.

ARTÍCULO 37.- La pérdida de eficacia de los certificados de firma electrónica avanzada, en el supuesto de expiración de vigencia, tendrá lugar desde que esta circunstancia se produzca. En los demás casos, la extinción de un certificado de firma electrónica avanzada surtirá efectos desde la fecha en que la autoridad certificadora, tenga conocimiento cierto de la causa que la origina y así lo haga constar en el registro de certificados.

ARTÍCULO 38.- La autoridad certificadora podrá suspender temporalmente la vigencia o revocar de los certificados de firma electrónica avanzada expedidos, cuando así lo solicite el firmante o sus representados o lo ordene una autoridad competente. Toda suspensión o revocación, deberá inscribirse sin demora en el registro respectivo.

ARTÍCULO 39.- Todo certificado de firma electrónica avanzada expedido fuera del Estado de Durango, producirá los mismos efectos jurídicos que un certificado de firma electrónica avanzada expedido dentro de su territorio, si presenta un grado de fiabilidad equivalente a los contemplados por esta Ley. Lo anterior sin perjuicio de la obligación de registrar el certificado que se homologa en términos de esta Ley, en el registro de certificados de firma electrónica avanzada, que al efecto lleve la autoridad certificadora.

CAPÍTULO VI.- DE LA AUTORIDAD CERTIFICADORA Y LOS SERVICIOS DE CERTIFICACIÓN

ARTÍCULO 40.- La autoridad certificadora, de conformidad con los reglamentos respectivos, establecerá los requisitos jurídicos, técnicos, materiales y financieros necesarios para la expedición y, en su caso, homologación de certificados de firma electrónica avanzada. En el caso de homologación de certificados de firma electrónica avanzada, podrá celebrar convenios que tengan como objeto observar los requisitos a que se refiere este Artículo.

ARTÍCULO 41.- La autoridad certificadora podrá prestar el servicio de consignación de fecha electrónica, respecto de los mensajes de datos.

ARTÍCULO 42.- El registro de certificados de firma electrónica avanzada estará a cargo de la autoridad certificadora, en el ámbito de su competencia. Dicho registro será público debiendo mantenerse permanentemente actualizado, y visible en la página web destinada para tal fin.

ARTÍCULO 43.- La autoridad certificadora está obligada a:

I.- Indicar la fecha y la hora en las que se expidió o se dejó sin efecto un certificado de firma electrónica avanzada;

II.- Llevar un registro de los certificados emitidos y revocados, así como proveer los servicios de consulta a los interesados;

III.- Comprobar por los medios idóneos autorizados por las leyes, la identidad y cualesquiera circunstancias personales de los solicitantes, relevantes para la emisión de los certificados de firma electrónica avanzada;

IV.- Guardar confidencialidad respecto de la información que haya recibido para la prestación del servicio de certificación;

V.- Antes de expedir un certificado de firma electrónica avanzada, informar en español a la persona que solicite sus servicios, en los casos que así se prevea, sobre el costo, características y las condiciones precisas de utilización del mismo;

VI.- Conservar registrada toda la información y documentación física o electrónica relativa a un certificado de firma electrónica avanzada, durante doce años;

VII. Adoptar las medidas necesarias para evitar la falsificación, alteración o uso indebido de certificados digitales, así como de los servicios relacionados con la firma electrónica avanzada; y

VIII. Cumplir con las demás obligaciones que deriven de ésta y otras leyes y demás disposiciones jurídicas aplicables.

ARTÍCULO 44.- La autoridad certificadora cuando expida certificados de firma electrónica avanzada, únicamente puede recabar datos personales directamente de los titulares de los mismos o con su consentimiento explícito. Los datos requeridos serán, exclusivamente, los necesarios para la expedición y el mantenimiento del certificado de firma electrónica avanzada.

ARTÍCULO 45.- La firma electrónica avanzada y los certificados de la misma expedidos de conformidad con esta Ley, sólo surtirán efectos respecto de los actos, convenios, comunicaciones, trámites y la prestación de los servicios públicos que correspondan a los entes y cualquier entidad o dependencia. Así como respecto de las promociones y solicitudes de los particulares que hayan optado por estos medios y la autoridad correspondiente los haya habilitado.

CAPÍTULO VII.- DE LAS ATRIBUCIONES DE LAS AUTORIDADES CERTIFICADORAS

ARTÍCULO 46.- Las dependencias y entidades y entes públicos, podrán establecer mediante convenio, qué autoridad certificadora tendrá a su cargo el servicio de certificación de firmas electrónicas, cuando no cuenten con aquella.

Para los efectos de la presente Ley, será autoridad certificadora en el Poder Ejecutivo la Secretaría de Contraloría.

(Reformado por Decreto nº 145, publicado en el Periódico Oficial nº 44 de 1 de junio de 2017).

ARTÍCULO 47.- La autoridad certificadora tendrá las siguientes atribuciones:

I.- Expedir certificados de firma electrónica avanzada y prestar servicios relacionados con la misma que se habiliten para tal efecto;

II.- Llevar el registro de certificados de firma electrónica avanzada;

III.- Colaborar en el desarrollo de sistemas informáticos internos y externos para la prestación de servicios en lo relacionado a la aplicación y observancia de la firma electrónica avanzada; y IV. Las demás que establezcan las disposiciones legales aplicables.

ARTÍCULO 48.- La autoridad certificadora que corresponda dentro del ámbito de su competencia, podrá autorizar a otra entidad o dependencia, a expedir certificados de firma electrónica avanzada y a prestar servicios relacionados con la certificación. La acreditación deberá publicarse en el Periódico Oficial del Gobierno del Estado, previamente al inicio de la prestación de los servicios. Adquiriendo las responsabilidades expresas detalladas en la presente Ley y las definidas en el convenio que se firme.

CAPÍTULO VIII.- DE LOS DERECHOS Y OBLIGACIONES DE LOS TITULARES DE CERTIFICADOS DE FIRMA ELECTRÓNICA AVANZADA.

ARTÍCULO 49.- Sin perjuicio de lo establecido por otras leyes, los titulares de certificados de firma electrónica avanzada tendrán, respecto de la autoridad certificadora, los siguientes derechos:

I.- Solicitar se les expida constancia de la existencia y registro del certificado;

II.- A ser informados sobre:

a) Las características generales del certificado de firma electrónica avanzada, y de las demás reglas que la autoridad certificadora se comprometa a seguir en la prestación de sus servicios; y

b) El costo de los servicios, en su caso, las características y condiciones precisas para la utilización del certificado y sus límites de uso.

III.- A que se guarde confidencialidad sobre la información proporcionada para la acreditación de la personalidad; y

IV.- A conocer el domicilio físico y la dirección electrónica de la autoridad certificadora para solicitar aclaraciones, presentar quejas o reportes.

ARTÍCULO 50.- Son obligaciones de los titulares de certificados de firma electrónica avanzada:

I.- Proporcionar datos veraces, completos y exactos;

II.- Mantener el control exclusivo de sus datos de creación de firma electrónica avanzada;

III.- Solicitar la revocación de su certificado de firma electrónica avanzada cuando se presente cualquier circunstancia que pueda comprometer la privacidad o seguridad de sus datos de creación de firma electrónica avanzada o la información en el contenida sea incorrecta o desactualizada;

IV.- El firmante será responsable de las consecuencias jurídicas que deriven por no cumplir oportunamente las obligaciones previstas en el presente Artículo;

V.- Responder por las obligaciones derivadas del uso no autorizado de su firma, cuando no hubiere obrado con la debida diligencia para impedir su utilización;

VI.- Actualizar los datos contenidos en el certificado de firma electrónica avanzada;

VII.- Las demás que establezcan las disposiciones legales aplicables;

CAPÍTULO IX.- PREVENCIONES GENERALES

ARTÍCULO 51.- Los entes podrán expedir reglamentos que establecerán cuando menos la forma, formalidades, modalidades y condiciones que deben observar los servidores públicos y particulares en la presentación de solicitudes, promociones, trámites, actos y convenios que se realicen utilizando la firma electrónica avanzada en términos de esta ley. De la misma manera, los reglamentos establecerán el diseño de los formatos que se utilicen empleando la firma electrónica avanzada.

ARTÍCULO 52.- Por virtud de la aplicación de la presente Ley, en contra de los actos o resoluciones de la administración pública estatal o municipal, procederá el recurso de inconformidad o el juicio de nulidad en la forma y términos señalados en Ley de Justicia Administrativa del Estado y demás disposiciones legales aplicables.

(Reformado por Decreto nº 145, publicado en el Periódico Oficial nº 44 de 1 de junio de 2017).

ARTÍCULO 53.- Los servidores públicos y particulares que le dieren un uso indebido, utilicen o se sirvan de un certificado de firma electrónica avanzada o de una firma electrónica avanzada como medio para cometer actos, hechos u omisiones que constituyan algún tipo de responsabilidad en términos de la Ley de Responsabilidades de los Servidores Públicos del Estado y de los Municipios, del Código Penal para el Estado de Durango o cualquier otro ordenamiento legal, les serán aplicables las sanciones y penalidades que se establezcan en las mismas.

TRANSITORIOS

PRIMERO.- El presente Decreto entrará en vigor, a partir del día siguiente de su publicación, en el Periódico Oficial del Gobierno Constitucional del Estado de Durango.

SEGUNDO.- Los Poderes Ejecutivo, Legislativo y Judicial, los órganos autónomos y los Ayuntamientos, en el ámbito de sus respectivas competencias, podrán expedir los reglamentos de esta Ley; en los casos que algún ente no cuente con la tecnología o suficiencia presupuestal para implementar la firma electrónica avanzada, podrá convenir con otro que sí tenga los medios para la creación de las firmas electrónicas avanzadas.

TERCERO.- Se derogan las disposiciones que se opongan al presente Decreto.

El Ciudadano Gobernador Constitucional del Estado, sancionará, promulgará y dispondrá se publique, circule y observe.

Dado en el Salón de Sesiones del Honorable Congreso del Estado, en Victoria de Durango, Dgo., a los (26) veintiseis días del mes de mayo del año (2010) dos mil diez.

DIP. JUAN MORENO ESPINOZA, PRESIDENTE.-

DIP. OMAR JOSÉ JIMÉNEZ HERRERA, SECRETARIO.-

DIP. JULIO ALBERTO CASTAÑEDA CASTAÑEDA, SECRETARIO.-

DECRETO 491, LXIV LEGISLATURA, PERIÓDICO OFICIAL nº 44, DE FECHA 3 DE JUNIO DE 2010.

DECRETO 145, LXVII LEGISLATURA, PERIODICO OFICIAL nº 44 DE FECHA 1 DE JUNIO DE 2017.

Artículo Primero.- Se reforman los Artículos 1, fracción I, 2, fracción IV, 5, fracción X, 46, 52 de la Ley de Firma Electrónica Avanzada para el Estado de Durango para quedar en los siguientes términos:

ARTÍCULOS TRANSITORIOS

PRIMERO.- El presente Decreto entrará en vigor al siguiente día de su publicación en el Periódico Oficial del Gobierno del Estado de Durango.

SEGUNDO.- En un término de sesenta días naturales, a partir de la publicación del presente Decreto, deberán quedar debidamente armonizadas, conforme al contenido de la reforma, todos y cada uno de los instrumentos reglamentarios y los correspondientes manuales de operación que conforman el Marco Normativo bajo el que se rige la función y organización de la Administración Pública del Estado de Durango.

TERCERO.- Se derogan todas las disposiciones que se opongan a lo contenido en el presente Decreto.

El Ciudadano Gobernador del Estado, sancionará, promulgará y dispondrá se publique, circule y observe.

Dado en el Salón de Sesiones del Honorable Congreso del Estado, en Victoria de Durango, Dgo. a los (03) tres días del mes de mayo de (2017) dos mil diecisiete.

DIP. GINA GERARDINA CAMPUZANO GONZÁLEZ, PRESIDENTE;

DIP. MARISOL PEÑA RODRÍGUEZ, SECRETARIA;

DIP. MAR GRECIA OLIVA GUERRERO, SECRETARIA.

DECRETO 412, LXVII LEGISLATURA, PERIODICO OFICIAL nº 57 DE FECHA 19 DE JULIO DE 2018.

ARTÍCULO PRIMERO.- Se reforma y adiciona la Ley de Firma Electrónica Avanzada para el Estado de Durango, para quedar como sigue:

TRANSITORIOS

PRIMERO.- El presente Decreto entrará en vigor al día siguiente de su publicación en el Periódico Oficial del Gobierno del Estado de Durango.

SEGUNDO.- La Comisión Estatal de Gobierno Digital de Durango, deberá integrarse a mas tardar 30 días después de la entrada en vigor del presente decreto.

TERCERO.- A falta de disposición expresa en esta ley o en las demás disposiciones que de ellas se deriven, se aplicaran supletoriamente la Ley de Justicia Administrativa del Estado de Durango y la Legislación Procesal Civil aplicable.

CUARTO.- Se derogan todas las disposiciones que se opongan a lo previsto en el presente decreto.

El Ciudadano Gobernador del Estado, sancionará, promulgará y dispondrá se publique, circule y observe.

Dado en el Salón de Sesiones del Honorable Congreso del Estado, en Victoria de Durango, Dgo. a los (30) treinta días del mes de Mayo de (2018) dos mil dieciocho.

DIP. JESÚS EVER MEJORADO REYES, PRESIDENTE;

DIP. OMAR MATA VALADEZ, SECRETARIO;

DIP. MARISOL PEÑA RODRÍGUEZ, SECRETARIA.

22Sep/18

Ley de 29 de septiembre de 2014, de firma electrónica avanzada y uso de medios electrónicos del Estado de Campeche

22 septiembre, 2018Ley, Méxicode firma electrónica avanzada y uso de medios electrónicos del Estado de Campeche. (Última reforma, Decreto nº 100, Derecho Informático de México, Derecho Informático del Estado de Campeche, el jueves 2 de octubre de 2014)., Legislación Informática de México, Legislación Informática del Estado de Campeche, Ley de 29 de septiembre de 2014, Periódico Oficial de 22 de diciembre de 2016). (Ley publicada en el Periódico Oficial del Estado de CampecheJosé Cuervo

Ley de 29 de septiembre de 2014, de firma electrónica avanzada y uso de medios electrónicos del Estado de Campeche. (Última reforma, Decreto nº 100, Periódico Oficial de 22 de diciembre de 2016). (Ley publicada en el Periódico Oficial del Estado de Campeche, el jueves 2 de octubre de 2014).

D E C R E T O

La LXI Legislatura del Congreso del Estado de Campeche decreta:

NÚMERO 170

ÚNICO.- Se expide la Ley de Firma Electrónica Avanzada y Uso de Medios Electrónicos del Estado de Campeche, para quedar como sigue:

LEY DE FIRMA ELECTRÓNICA AVANZADA Y USO DE MEDIOS ELECTRÓNICOS DEL ESTADO DE CAMPECHE

TÍTULO PRIMERO.- DISPOSICIONES GENERALES

CAPÍTULO ÚNICO.- DEL OBJETO Y APLICACIÓN DE LA LEY

Artículo 1.- La presente Ley es de orden público y observancia general en el territorio del Estado de Campeche y tiene por objeto regular la creación y aplicación de la firma electrónica avanzada, el uso de medios electrónicos y mensajes de datos relacionados con la firma electrónica avanzada y la prestación al público de servicios de certificación.

Artículo 2.- La firma electrónica avanzada tiene la finalidad de simplificar, facilitar y agilizar los actos y negocios jurídicos, comunicaciones y procedimientos administrativos y judiciales entre los sujetos obligados del sector público, los particulares y las relaciones que mantengan entre sí.

El uso de la firma electrónica avanzada tiene como objeto fomentar la incorporación de nuevas tecnologías de información y establecer mecanismos de seguridad en las mismas, además de agilizar y simplificar actos, trámites, servicios, comunicaciones y procedimientos administrativos y judiciales entre los sujetos que hagan uso de la firma electrónica avanzada.

Artículo 3.- Son sujetos obligados de esta Ley, los siguientes:

I. El Poder Ejecutivo;

II. El Poder Legislativo;

III. El Poder Judicial;

IV. Los Organismos Públicos Autónomos;

V. Los Municipios; y

VI. Los particulares que soliciten la firma electrónica avanzada, en los términos de la presente Ley.

Cada uno de los sujetos aquí nombrados, de conformidad con su propia normatividad, designará a los servidores públicos que ejercerán el uso de la firma electrónica avanzada.

Artículo 4.- Para los efectos de esta Ley, se entenderá por:

I. Autoridad Certificadora: Ente responsable de crear firmas electrónicas y de emitir y revocar los certificados digitales, utilizados para autenticar la firma electrónica de los usuarios; asimismo, legitima ante los terceros la relación entre la identidad de un titular de certificado digital y su llave pública;

II. Autenticación: El mecanismo de seguridad por el que un sistema electrónico comprueba la identidad de un usuario de firma electrónica avanzada;

III. Certificado Digital: El documento emitido electrónicamente por la autoridad certificadora, mediante el cual se confirma el vínculo existente entre el firmante y la firma electrónica avanzada e identifica la fecha electrónica y vigencia de la misma;

IV. Certificación Cruzada: El acto por el cual una autoridad certificadora reconoce la validez de un certificado electrónico emitido por otra autoridad certificadora, previo convenio firmado por ambas, y homologa tal certificado como si fuera de propia emisión, bajo su responsabilidad;

V. Destinatario: La persona designada por el emisor para recibir el mensaje de datos, con excepción de las personas que actúen a título de intermediario con respecto a dicho mensaje;

VI. Documento Electrónico: El instrumento que contiene datos o información enviada, recibida o archivada por medios electrónicos, ópticos o de cualquier otra tecnología, utilizado para el intercambio de información entre los sujetos de esta Ley, el cual puede requerir o no de una firma electrónica avanzada;

VII. Emisor: A toda persona física o moral que haya actuado a nombre propio o en cuyo nombre se haya enviado o generado un mensaje de datos;

VIII. Firma Electrónica: Conjunto de datos electrónicos integrados o asociados inequívocamente a un mensaje de datos que permite asegurar la identidad del usuario;

IX. Firma Electrónica Avanzada: La firma electrónica que ha sido certificada por autoridad certificadora en los términos que señale esta Ley, consistente en el conjunto de datos electrónicos integrados o asociados inequívocamente a un mensaje de datos que permite asegurar la integridad y autenticidad de ésta y la identidad del usuario;

X. Fecha Electrónica: El conjunto de datos en forma electrónica utilizados como medio para constatar la fecha y hora en que un mensaje de datos es enviado por el firmante o recibido por el destinatario;

XI. Llave Pública: La cadena de bits cifrada perteneciente a una persona, susceptible de ser conocida públicamente, que se usa para verificar la firma electrónica avanzada de la misma, la cual está matemáticamente asociada a su llave privada;

XII. Llave Privada: La cadena de bits cifrada perteneciente a una persona y conocida únicamente por ésta, que se usa en conjunto con un mensaje de datos para la creación de la firma electrónica avanzada, relacionada con ambos elementos;

XIII. Medios Electrónicos: Los dispositivos tecnológicos usados para transmitir o almacenar datos e información, a través de computadoras, líneas telefónicas, enlaces de datos, microondas, o de cualquier otra tecnología;

XIV. Mensaje de Datos: Toda información inteligible en formato electrónico o similar que pueda ser almacenada o intercambiada por medios electrónicos, ópticos o cualquier otra tecnología;

XV. Módulos Fijos o Itinerantes: Las unidades automatizadas o no, donde se expiden documentos oficiales al público usuario, previo el pago fiscal correspondiente, que se hace también a través del mismo módulo, en cuyas unidades automatizadas se emplea la firma electrónica avanzada;

XVI. Registro: El Registro de Certificados Digitales perteneciente a cada autoridad certificadora;

XVII. Reglamento: Al Reglamento de la Ley de Firma Electrónica Avanzada y Uso de Medios Electrónicos del Estado de Campeche;

XVIII. Sistema de Información: A los sistemas utilizados para generar, enviar, recibir, archivar o procesar de alguna otra forma mensajes de datos;

XIX. Sujetos Obligados: Los señalados en el artículo 3 de la presente Ley;

XX. Sistema Automatizado de Gestión: La herramienta informática que, mediante el uso de medios y firma electrónica, permite realizar comunicaciones, gestiones y trámites intergubernamentales entre los servidores públicos;

XXI. Trámite Electrónico: Cualquier solicitud o entrega de información que los particulares realicen por medios electrónicos ante las dependencias y entidades, ya sea para cumplir una obligación, obtener un beneficio o servicio, o en general, a fin de que se emita un acuerdo o resolución; y

XXII. Titular del Certificado: A la persona física o moral a cuyo favor sea expedido el certificado de la firma electrónica avanzada.

Artículo 5.- Quedan exceptuados de la aplicación de esta Ley:

I. Los actos o procedimientos que, por disposición legal, exijan la firma autógrafa; y

II. Los actos o procedimientos que, por disposición legal, exijan una formalidad que no sea susceptible de cumplirse mediante la firma electrónica avanzada.

TÍTULO SEGUNDO.- DE LA FIRMA ELECTRÓNICA AVANZADA

CAPÍTULO I.- DEL USO Y VALIDEZ DE LA FIRMA ELECTRÓNICA AVANZADA

Artículo 6.- La firma electrónica avanzada podrá ser utilizada en documentos electrónicos y mensajes de datos.

Los documentos electrónicos y mensajes de datos que cuenten con la firma electrónica avanzada, generados, enviados, recibidos o archivados por medios electrónicos, ópticos o cualquier otra tecnología, tendrán la misma validez y eficacia jurídica que la ley otorga a los documentos escritos en soporte de papel.

Artículo 7.- Para que los sujetos obligados puedan utilizar la firma electrónica avanzada en los actos a que se refiere esta Ley deberán contar con:

I. Un certificado digital vigente, emitido u homologado en términos de la presente Ley; y

II. Una llave privada, generada bajo su exclusivo control.

Artículo 8.- El uso de los medios electrónicos, en ningún caso, podrá implicar la existencia de restricciones o discriminaciones de cualquier naturaleza en el acceso de los particulares a la prestación de servicios públicos o a cualquier trámite, acto o actuación de cualquier autoridad estatal.

CAPÍTULO II.- DE LOS PRINCIPIOS RECTORES EN MATERIA DE FIRMA ELECTRÓNICA AVANZADA

Artículo 9.- La firma electrónica avanzada deberá cumplir con los principios rectores siguientes:

I. Equivalencia Funcional: La firma electrónica avanzada que se encuentre en un documento electrónico o, en su caso, en un mensaje de datos, deberá satisfacer el requisito de firma del mismo modo que la firma autógrafa en los documentos impresos;

II. Autenticidad: La firma electrónica avanzada en un documento electrónico o en un mensaje de datos deberá dar certeza de que el mismo ha sido emitido por el firmante, de manera tal que su contenido le sea atribuible al igual que las consecuencias jurídicas que de él deriven;

III. Integridad: La firma electrónica avanzada en un documento electrónico o en un mensaje de datos deberá dar certeza de que éste ha permanecido completo e inalterado desde su firma, con independencia de los cambios que hubiere podido sufrir el medio que lo contiene como resultado del proceso de comunicación, archivo o presentación;

IV. Neutralidad Tecnológica: La tecnología utilizada para la emisión de certificados digitales y para la prestación de los servicios relacionados con la firma electrónica avanzada será aplicada de modo tal que no excluya, restrinja o favorezca alguna tecnología en particular;

V. No Repudio: La firma electrónica avanzada contenida en documentos electrónicos garantiza la autoría e integridad del documento y que dicha firma corresponde exclusivamente al firmante; y

VI. Confidencialidad: La firma electrónica avanzada en un documento electrónico o en un mensaje de datos, debe garantizar que sólo pueda ser cifrado por el firmante y el receptor.

Artículo 10.- Para la creación de la firma electrónica avanzada así como para la celebración de los actos jurídicos en que se haga uso de la misma, se deberá observar, además de lo contenido en la presente Ley, la Ley de Procedimiento Administrativo para el Estado y los Municipios de Campeche, el C (sic) Estado de Campeche y el Código de Procedimientos Civiles del Estado de Campeche.

CAPÍTULO III.- DE LOS DOCUMENTOS ELECTRÓNICOS Y MENSAJES DE DATOS

Artículo 11.- Los actos, convenios, comunicaciones, procedimientos administrativos y judiciales, trámites, prestación de los servicios públicos, solicitudes y promociones, según sea el caso, que lleven a cabo los titulares del certificado digital, los podrán realizar a través de su firma electrónica avanzada contenida en un documento electrónico o mensaje de datos, mediante el uso de medios electrónicos.

Artículo 12. Los sujetos obligados deberán contar con una dirección de correo electrónico para recibir, cuando corresponda, mensajes de datos y documentos electrónicos en la realización de los actos jurídicos previstos en esta Ley.

Artículo 13.- Para que surta efectos un mensaje de datos se requerirá de un acuse de recibo electrónico, y se entenderá como tal, el generado por el sistema de información del destinatario.

Se considerará que el mensaje de datos ha sido enviado y recibido cuando se pruebe la existencia del acuse de recibo electrónico respectivo.

Artículo 14.- Los documentos electrónicos y el contenido de los mensajes de datos que incluyan la firma electrónica avanzada, relativos a los actos, convenios, comunicaciones, procedimientos administrativos y judiciales, trámites, prestación de los servicios públicos, las solicitudes y promociones que se realicen a través de medios electrónicos, deberán conservarse en archivos electrónicos y hacerse constar íntegramente en forma impresa, y se formará un expediente cuando así lo soliciten expresamente los interesados o lo determine la autoridad competente.

Artículo 15.- Todo documento electrónico o mensaje de datos se tendrá por expedido en el lugar donde el emisor tenga su domicilio legal y por recibido en el lugar donde el destinatario tenga el suyo, salvo prueba o acuerdo en contrario.

Artículo 16.- Los documentos electrónicos presentados por los titulares del certificado digital con su firma electrónica avanzada producirán, en términos de esta Ley, los mismos efectos que los documentos firmados de manera autógrafa.

Artículo 17.- Los mensajes de datos tendrán valor probatorio pleno, salvo lo que dispongan al respecto otras leyes en la materia, cuando se acredite lo siguiente:

I. Que contengan la firma electrónica avanzada;

II. La fiabilidad del método en que hayan sido generados, archivados o conservados; y

III. Que se ha conservado la integridad de la información a partir del momento en que se generaron por primera vez y en forma definitiva como tales o en alguna otra forma.

Artículo 18.- Se presumirá, salvo prueba en contrario, que un mensaje de datos proviene de una persona determinada, cuando contenga su firma electrónica avanzada.

Artículo 19.- El momento de recepción de un Mensaje de Datos se determinará de la forma siguiente:

I. Al ingresar en el sistema de información designado por el destinatario; y

II. De no haber un sistema de información designado, en el momento en que el destinatario se manifieste sabedor de dicha información.

Artículo 20.- Cuando las personas realicen cualquiera de los actos regulados por esta Ley con su firma electrónica avanzada, en relación con los sujetos públicos, a través de un mensaje de datos en hora o día inhábil, se tendrá por realizado en la primera hora y día hábil siguiente y se tendrán por no presentados cuando no contenga la firma electrónica avanzada.

Artículo 21.- El contenido de los mensajes de datos relativos a los actos que regula la presente Ley deberá conservarse en archivos electrónicos. El archivo electrónico deberá garantizar los criterios específicos en materia de clasificación y conservación de documentos así como de la organización de archivos, de acuerdo a las disposiciones aplicables en la materia.

TÍTULO TERCERO.- DE LA AUTORIDAD CERTIFICADORA

CAPÍTULO I.- DISPOSICIONES GENERALES

Artículo 22.- La autoridad certificadora será la encargada de mantener permanentemente actualizada la información correspondiente de los servicios de certificación e indicará la vigencia o extinción de los mismos, así como cualquier otro asunto derivado.

(REFORMADO, DECRETO 100 PERIÓDICO OFICIAL DEL 22 DE DICIEMBRE DE 2016)

La autoridad certificadora del Poder Ejecutivo será la Secretaría de Administración e Innovación Gubernamental. Los demás sujetos de la Ley designarán el área correspondiente encargada de los servicios de certificación, la cual se ajustará a lo establecido en esta Ley y demás legislación aplicable. Asimismo deberán crear sus instalaciones tecnológicas para efectuar los servicios de autoridad certificadora, en el ámbito de sus competencias, o en su caso, optar por utilizar la infraestructura del Poder Ejecutivo, previa solicitud y convenio que al efecto se suscriba. En materia fiscal, el Servicio de Administración Fiscal del Estado de Campeche tendrá carácter de autoridad certificadora para los actos de su competencia.

El Reglamento determinará:

I. Las facultades y atribuciones de la autoridad certificadora en relación con los servicios registrales;

II. Las condiciones de operación del Registro;

III. Los procedimientos de consulta, actualización y mantenimiento del Registro; y

IV. Los servicios que deberá prestar el Registro.

Artículo 23.- La autoridad certificadora, de conformidad con el Reglamento, establecerá los requisitos jurídicos, técnicos, materiales y financieros necesarios para la expedición y, en su caso, homologación de certificados digitales.

Todo certificado digital, expedido por una autoridad distinta a la establecida en esta Ley, se deberá homologar ante la autoridad certificadora, a fin de que produzca los mismos efectos y alcance legales. La autoridad certificadora podrá celebrar convenios para lograr la homologación de certificados digitales.

Artículo 24.- El uso de medios electrónicos y firma electrónica avanzada en los sistemas automatizados de gestión permitirán la generación y manejo de documentos electrónicos, que deberán cumplir con las especificaciones técnicas y de seguridad previstas por las autoridades certificadoras.

Artículo 25.- Los sujetos señalados en las fracciones I a V del artículo 3 de esta Ley, deberán proveer lo necesario a la autoridad certificadora, para que los documentos electrónicos y trámites electrónicos generados se conserven de manera ordenada y sistemática, para asegurar su validez, autenticidad, confidencialidad, integridad y disponibilidad, conforme a las disposiciones legales aplicables.

Asimismo, deberán facilitar a la autoridad certificadora competente toda la información y los medios necesarios para el ejercicio de sus funciones, así como permitir a sus agentes o al personal inspector, el acceso a sus instalaciones para la consulta de cualquier documentación que resulte relevante para la inspección de que se trate, referida siempre a datos que conciernan a la autoridad certificadora.

Artículo 26.- La autoridad certificadora, cuando expida certificados digitales, únicamente podrá obtener los datos personales directamente de sus titulares con el consentimiento explícito de estos. Los datos personales requeridos serán exclusivamente los necesarios para la expedición y mantenimiento del certificado digital, de conformidad con la ley en la materia.

CAPÍTULO II.- DE LAS ATRIBUCIONES Y OBLIGACIONES DE LA AUTORIDAD CERTIFICADORA

Artículo 27.- La autoridad certificadora tendrá las atribuciones y obligaciones siguientes:

I. Emitir, administrar y registrar certificados digitales y firmas electrónicas avanzadas, así como prestar servicios relacionados con las mismas;

II. Antes de expedir un certificado digital informará a los particulares que soliciten sus servicios, sobre el costo, características y las condiciones precisas de utilización del certificado;

III. Llevar un registro de los certificados digitales que emita y de los que revoque, así como proveer los servicios de consulta a los interesados;

IV. Adoptar las medidas necesarias para evitar la falsificación, alteración o uso indebido de certificados digitales, así como de los servicios relacionados con la firma electrónica avanzada;

V. Celebrar los convenios con otras autoridades certificadoras, a efecto de establecer los estándares tecnológicos y operativos para la expedición de certificados digitales y servicios electrónicos, aplicables en el ámbito de su competencia;

VI. Colaborar en el desarrollo de sistemas informáticos internos y externos para la prestación de servicios de certificación

VII. Garantizar la autenticidad, integridad, conservación, confidencialidad y confiabilidad de la firma electrónica avanzada, así como de los servicios relacionados con la misma;

VIII. Preservar la confidencialidad, integridad y seguridad de los datos personales de los titulares de los certificados digitales, de conformidad con el Reglamento y demás leyes en la materia; y

IX. Las que se deriven de esta Ley, su Reglamento y demás disposiciones aplicables.

Artículo 28.- Los Poderes Legislativo y Judicial, los Organismos Públicos Autónomos y los Municipios, podrán celebrar convenios de colaboración con el Poder Ejecutivo, a través de la Secretaría de Administración e Innovación Gubernamental, para el ejercicio de las atribuciones a que se refiere esta Ley.

TÍTULO CUARTO.- DEL CERTIFICADO DIGITAL

CAPÍTULO I.- DE LOS CERTIFICADOS DIGITALES

Artículo 29.- Los certificados digitales deberán contener lo siguiente:

I. La expresión de que tienen esa naturaleza;

II. El código único de identificación;

III. Los datos de autorización de la autoridad certificadora;

IV. La firma electrónica avanzada de la autoridad certificadora;

V. El nombre y datos de identificación del titular del certificado digital;

VI. En el supuesto de representación, la indicación del documento que acredite las facultades del representante para actuar como titular de la firma electrónica avanzada;

VII. El período de vigencia del certificado, que no podrá ser superior a dos años;

VIII. Llave pública;

IX. Algoritmo de firma;

X. En su caso, las limitantes del uso del certificado digital;

XI. La referencia de la tecnología empleada para la creación de la firma electrónica avanzada; y

XII. Todos aquellos datos que se señalen en el Reglamento para su creación y demás disposiciones aplicables.

Artículo 30.- Cuando se produzca la expiración de la vigencia de un certificado digital, sobrevendrá la pérdida de su eficacia. En los demás casos, la extinción o cancelación de un certificado digital surtirá efectos desde la fecha en que la autoridad certificadora tenga conocimiento cierto de la causa que la origina y así lo haga constar en el Registro de Certificados de Firma Electrónica Avanzada.

Artículo 31.- Los certificados digitales expedidos fuera del Estado de Campeche tendrán la misma validez y producirán los mismos efectos jurídicos reconocidos en la presente Ley, siempre que tales certificados sean reconocidos por las autoridades certificadoras que señala la presente Ley y se garanticen, en la misma forma que lo hacen con sus propios certificados, el cumplimiento de los requisitos, el procedimiento, así como la validez y vigencia del certificado digital, de conformidad con lo establecido por la Constitución Política de los Estados Unidos Mexicanos y las leyes en la materia.

CAPÍTULO II.- DE LOS DERECHOS Y OBLIGACIONES DE LOS TITULARES DE CERTIFICADOS DIGITALES

Artículo 32.- Sin perjuicio de lo establecido por otras leyes, los titulares de certificados digitales tendrán respecto de la autoridad certificadora, los siguientes derechos:

I. Solicitar se les expida constancia de la existencia y registro del certificado digital;

II. Solicitar la variación de los datos y elementos de la firma electrónica avanzada, cuando así convenga a su interés;

III. A ser informados sobre:

a) Las características generales de los procedimientos de certificación y creación de firma electrónica avanzada y, de las demás reglas que la autoridad certificadora se comprometa a seguir en la prestación de sus servicios; y

b) El costo de los servicios, las características y condiciones precisas para la utilización del certificado digital y de la firma electrónica avanzada y sus límites de uso;

IV. A que se guarde confidencialidad sobre la información proporcionada; y

V. A conocer el domicilio físico y la dirección electrónica de la autoridad certificadora para solicitar aclaraciones y presentar quejas o reportes.

Artículo 33.- Son obligaciones de los titulares de certificados digitales las siguientes:

I. Proporcionar datos veraces, completos y exactos;

II. Mantener el control exclusivo de sus datos de creación de firma electrónica avanzada y su certificado digital, no compartirlos e impedir su divulgación;

III. Solicitar la cancelación de su certificado digital cuando se presente cualquier circunstancia que pueda comprometer la privacidad de sus datos de creación; y

IV. Actualizar los datos contenidos en el certificado de firma electrónica avanzada.

CAPÍTULO III.- DE LA SUSPENSIÓN DEL CERTIFICADO DIGITAL

Artículo 34.- Son causas de suspensión del certificado:

I. La sospecha de utilización de la llave privada, contraseña o de la propia firma electrónica avanzada, por parte de un tercero no autorizado;

II. A solicitud del titular del certificado digital, cuando requiera la modificación de alguno de los datos contenidos en el mismo;

III. Cuando la autoridad certificadora lo estime justificado y/o fundado; y

IV. Aquellas que se encuentren señaladas en el Reglamento.

La suspensión se mantendrá mientras alguna de las condiciones descritas continúe presente.

Artículo 35.- El titular o representante legal del certificado digital deberá presentar el formato de solicitud de suspensión ante la autoridad certificadora y señalar el motivo de la misma.

Artículo 36.- La autoridad certificadora analizará la solicitud de suspensión y, en caso de que se advierta el uso no autorizado de la firma electrónica avanzada, procederá inmediatamente a extinguir el certificado digital y a expedir uno nuevo.

Artículo 37.- La autoridad certificadora podrá suspender temporalmente la eficacia de los certificados digitales cuando así lo solicite el titular del certificado digital o sus representados, o en caso de que lo ordene una autoridad competente.

Toda suspensión deberá inscribirse sin demora en el registro respectivo.

CAPÍTULO IV.- DE LA REVOCACIÓN DEL CERTIFICADO DIGITAL

Artículo 38.- Se podrá revocar el certificado digital por alguna de las siguientes causas:

I. Cuando se observen inexactitudes en los datos aportados para la obtención del certificado digital;

II. Por haberse comprobado que al momento de la expedición del certificado digital no cumplió con los requisitos que marca esta Ley;

III. Por el uso indebido o ilícito del certificado digital o de la firma electrónica avanzada; y

IV. Las demás que señale el Reglamento.

Artículo 39.- La autoridad certificadora iniciará de oficio el procedimiento de revocación, el cual deberá notificar al titular del certificado digital en forma personal, a efecto de que, en un término de tres días hábiles contados a partir del día siguiente al de la notificación, manifieste lo que a su interés convenga.

Artículo 40.- La autoridad certificadora emitirá su resolución dentro de los quince días hábiles posteriores al vencimiento del término del artículo anterior. Dicha resolución deberá ser notificada personalmente al titular del certificado digital y deberá entregarse el comprobante de revocación de la misma.

Artículo 41.- La autoridad certificadora deberá realizar la anotación de revocación en el Registro, para los efectos legales a que haya lugar.

Artículo 42.- Los titulares de los certificados digitales que incurran en alguna de las causas de revocación señaladas en el artículo 38 de esta Ley, no podrán solicitar certificado digital, sino transcurrido un año contado a partir de que haya quedado firme la resolución de revocación dictada por la autoridad certificadora.

CAPÍTULO V.- DE LA EXTINCIÓN DEL CERTIFICADO DIGITAL

Artículo 43.- Los certificados digitales se extinguirán por las siguientes causas:

I. Expiración de su vigencia;

II. Cancelación realizada por el titular del certificado digital, su representante o autoridad competente;

III. Robo, pérdida o inutilización por daños del soporte del certificado digital;

IV. Resolución judicial o administrativa;

V. Fallecimiento del titular del certificado digital o su representante;

VI. Incapacidad superviniente del titular del certificado digital, total o parcial, por terminación de la representación o extinción de la persona moral representada;

VII. Omisiones en los datos aportados por la persona física o moral para la obtención del certificado digital;

VIII. Por renuncia del servidor público a su cargo;

IX. Por haberse comprobado que al momento de su expedición, el certificado digital no cumplió con los requisitos establecidos en esta Ley o su Reglamento, situación que no afectará los derechos de terceros de buena fe; y

X. Aquellas establecidas en el Reglamento.

Artículo 44.- Cuando un servidor público deje de prestar sus servicios y cuente con un certificado digital en virtud de sus funciones, el superior jerárquico ordenará la cancelación inmediata del mismo.

TÍTULO QUINTO.- DE LAS RESPONSABILIDADES Y SANCIONES

CAPÍTULO ÚNICO.- DISPOSICIONES GENERALES

Artículo 45.- Las conductas de los servidores públicos que impliquen el incumplimiento a los preceptos establecidos en la presente Ley darán lugar al procedimiento y a las sanciones que correspondan en términos de la Ley Reglamentaria del Capítulo XVII de la Constitución Política del Estado de Campeche.

Cuando las infracciones a la presente Ley impliquen la posible comisión de una conducta sancionada en los términos de la legislación civil, penal o de cualquier otra naturaleza, los sujetos obligados lo harán del conocimiento de las autoridades competentes.

TRANSITORIOS

PRIMERO.- El presente decreto entrará en vigor el día 3 de diciembre del 2014, previa su publicación en el Periódico Oficial del Estado.

Los procedimientos penales se sujetarán a las disposiciones, etapas y plazos que establezca la Declaratoria de Incorporación del Estado de Campeche al Sistema Procesal Acusatorio e inicio de vigencia del Código Nacional de Procedimientos Penales.

SEGUNDO.- Se abroga el Acuerdo del Ejecutivo del Estado por el que se Autoriza el Uso de Medios Electrónicos y de la Firma Electrónica en las Dependencias y Entidades de la Administración Pública del Estado de Campeche, publicado el 18 de Septiembre de 2008 en el Periódico Oficial del Estado de Campeche número 4121, así como todas las disposiciones legales, reglamentarias y administrativas del marco jurídico estatal, en lo que se opongan al contenido del presente decreto.

TERCERO.- El Ejecutivo Estatal expedirá el Reglamento de esta Ley, dentro de los noventa días hábiles siguientes a la fecha de entrada en vigor del presente decreto.

CUARTO.- Los sujetos de esta Ley, a los que se hace referencia en las fracciones I a V del artículo 3, en el ámbito de sus respectivas competencias, deberán realizar las acciones que correspondan a efecto de que la firma electrónica avanzada y el uso de medios electrónicos inicien su operación a más tardar en un año contado a partir de la entrada en vigor del presente decreto.

Dichos sujetos, en el ámbito de sus respectivas competencias, promoverán una difusión masiva entre los usuarios de las disposiciones de este decreto.

QUINTO.- Transcurrido el plazo señalado en el transitorio cuarto que antecede, los sujetos que no cuenten con la infraestructura tecnológica propia para efectuar los servicios de autoridad certificadora en el ámbito de su competencia, podrán optar por utilizar la infraestructura de la Secretaría de Administración e Innovación Gubernamental de la Administración Pública Estatal, previo convenio que se realice entre las partes, para cumplir con los fines establecidos en la presente Ley.

Dado en el Salón de Sesiones del Palacio Legislativo, en la ciudad de San Francisco de Campeche, Campeche, a los veintinueve días del mes de septiembre del año dos mil catorce.

C. Edgar Román Hernández Hernández, Diputado Presidente.-

C. Jesús Antonio Quiñones Loeza, Diputado Secretario.-

C. Adda Luz Ferrer González, Diputada Secretaría.-

FERNANDO EUTIMIO ORTEGA BERNES, Gobernador Constitucional del Estado Libre y Soberano de Campeche, mediante el presente Decreto, se hace saber a los habitantes del Estado de Campeche:

Que la LXI Legislatura del H. Congreso Constitucional del Estado Libre y Soberano de Campeche me ha dirigido el Decreto número 170, por lo que, en cumplimiento de lo dispuesto por los artículos 48, 49 y 71, fracción XVIII de la Constitución Política del Estado de Campeche, lo sanciono, mando se imprima, publique y circule para su debida observancia.

Este Decreto es dado en el Palacio de Gobierno el Estado, en San Francisco de Campeche, municipio y Estado de Campeche, a los veintinueve días del mes de septiembre del año dos mil catorce.

EL GOBERNADOR CONSTITUCIONAL DEL ESTADO, LIC. FERNANDO EUTIMIO ORTEGA BERNES.- EL SECRETARIO DE GOBIERNO, LIC. WILLIAM ROBERTO SARMIENTO URBINA.-

———————————————————————————————————

REFORMA P.O. 22 DE DICIEMBRE DE 2016.

TRANSITORIOS DEL DECRETO NÚMERO 100 POR EL QUE “SE REFORMA EL SEGUNDO PÁRRAFO DEL ARTÍCULO 22 DE LA LEY DE FIRMA ELECTRÓNICA AVANZADA Y USO DE MEDIOS ELECTRÓNICOS DEL ESTADO DE CAMPECHE.

PRIMERO.- Las modificaciones a las disposiciones contenidas en la Ley Orgánica de la Administración Pública del Estado de Campeche entrarán en vigor al día siguiente de la publicación de este decreto en el Periódico Oficial del Estado de Campeche. El sistema de registros y control de las erogaciones personales deberá estar en operación a más tardar el 1 de enero de 2018.

SEGUNDO.- La Ley del Servicio de Administración Fiscal del Estado de Campeche, las modificaciones contenidas en la Ley de Hacienda del Estado de Campeche, el Código Fiscal del Estado de Campeche y la Ley de Firma Electrónica Avanzada y Uso de Medios Electrónicos del Estado de Campeche entrarán en vigor el día 1 de abril de 2017.

TERCERO.- Se derogan todas las disposiciones legales, reglamentarias y administrativas, de igual o menor jerarquía, del marco jurídico estatal que se opongan al presente decreto.

CUARTO.- El Ejecutivo del Estado expedirá el Reglamento Interior del Servicio de Administración Fiscal del Estado de Campeche, con la anticipación debida con la finalidad de que entre en vigor de manera simultánea con la Ley del Servicio de Administración Fiscal del Estado de Campeche el día 1 de abril de 2017.

QUINTO.- La Secretaría establecerá los mecanismos para la readscripción de los trabajadores de base que vienen prestando sus servicios a la misma, y que deban incorporarse al Servicio de Administración Fiscal del Estado de Campeche. Los derechos de estos trabajadores serán respetados y en ningún caso serán afectados por la reorganización que implica el presente ordenamiento.

SEXTO.- Las referencias que se hacen y atribuciones que se otorgan en otras leyes, reglamentos y demás disposiciones a la Secretaria de Finanzas o a cualquiera de sus unidades administrativas, se entenderán hechas al Servicio de Administración Fiscal del Estado de Campeche, cuando se trate de atribuciones vinculadas con la materia objeto de la Ley del Servicio de Administración Fiscal del Estado de Campeche, el Reglamento Interior del Servicio de Administración Fiscal del Estado de Campeche o cualquier otra disposición jurídica que emane de ellos.

SÉPTIMO.- Los asuntos que a la fecha de entrada en vigor de la presente Ley se encuentren en trámite ante alguna de las unidades administrativas de la Subsecretaría de Ingresos, de la Procuraduría Fiscal y de la Dirección General de Auditoría Fiscal de la Secretaría y que pasen a formar parte del Servicio de Administración Fiscal del Estado de Campeche, o los recursos administrativos interpuestos en contra de actos o resoluciones de tales unidades administrativas, se seguirán tramitando ante el Servicio de Administración Fiscal del Estado de Campeche y serán resueltos por el mismo, cuando se encuentren vinculados con la materia objeto de la Ley del Servicio de Administración Fiscal del Estado de Campeche, el Reglamento Interior del Servicio de Administración Fiscal del Estado de Campeche y cualquier otra disposición jurídica que emane de ellos.

OCTAVO.- Los juicios en los que sea parte la Secretaría de Finanzas por actos de las unidades administrativas adscritas a la Subsecretaría de Ingresos, de la Procuraduría Fiscal y de la Dirección General de Auditoría Fiscal que pasen a formar parte del Servicio de Administración Fiscal del Estado de Campeche, que a la entrada en vigor de la presente Ley se encuentren en trámite ante los Tribunales del fuero federal, o cualquier otra instancia jurisdiccional, los continuará tramitando el Servicio de Administración Fiscal del Estado de Campeche a través de sus unidades administrativas competentes hasta su total conclusión, para lo cual ejercitarán las acciones, excepciones y defensas que correspondan a las autoridades señaladas en los juicios, ante dichos tribunales.

NOVENO.- Los amparos contra actos de las unidades administrativas adscritas a la Subsecretaría de Ingresos, de la Procuraduría Fiscal y de la Dirección General de Auditoría Fiscal de la Secretaría de Finanzas que pasen a formar parte del Servicio de Administración Fiscal del Estado de Campeche, cuya interposición les sea notificado con el carácter de autoridades responsables o de terceros perjudicados con anterioridad a la entrada en vigor de la Ley del Servicio de Administración Fiscal del Estado de Campeche, continuarán siendo llevados en su tramitación hasta su total conclusión por el Servicio de Administración Fiscal del Estado de Campeche.

DÉCIMO.- La Secretaría de Finanzas dispondrá lo conducente a fin de que, a partir de la entrada en vigor de la Ley del Servicio de Administración Fiscal del Estado de Campeche, los bienes muebles e inmuebles, materiales y financieros, así como los archivos y expedientes con los que actualmente cuentan las unidades administrativas adscritas a la Subsecretaría de Ingresos de la Secretaría, de la Procuraduría Fiscal y de la Dirección General de Auditoría Fiscal pasen a formar parte del Servicio de Administración Fiscal del Estado de Campeche, para el ejercicio de las atribuciones vinculadas con la materia objeto de la mencionada Ley, su Reglamento y cualquier otra disposición jurídica que emane de ellos. Para tales efectos se deberán formalizar las actas de entrega- recepción correspondientes, en términos de las disposiciones jurídicas aplicables.

UNDÉCIMO.- Los ajustes en materia de programación, presupuesto, estructuras y contabilidad que genere la creación del Servicio de Administración Fiscal del Estado de Campeche, podrán hacerse paulatinamente durante el ejercicio fiscal 2017.

DÉCIMO SEGUNDO.- El Servicio de Administración Fiscal del Estado de Campeche podrá continuar utilizando el sistema informático actual o implementar un sistema informático propio. En el caso de la firma electrónica avanzada podrá implementarla a través de medios propios o a través de convenios con terceros.

DÉCIMO TERCERO.- Las referencias que se hacen y atribuciones que se otorgan en el Código Fiscal del Estado de Campeche y en otras leyes, reglamentos, acuerdos y demás disposiciones Jurídicas del marco jurídico del Estado, a la Secretaría de Finanzas de la Administración Pública del Estado de Campeche o a cualquiera de sus unidades administrativas, se entenderán hechas al Servicio de Administración Fiscal del Estado de Campeche cuando se trate de atribuciones vinculadas con la materia objeto de la Ley que crea y regula dicho órgano o cualquier otra disposición jurídica que emane de ellos.

DÉCIMO CUARTO.- Las facultades conferidas al Estado de Campeche en el o los convenios de Colaboración Administrativa en materia Fiscal Federal y sus anexos, celebrados entre el Gobierno Federal, por conducto de la Secretaría de Hacienda y Crédito Público, y el Gobierno del Estado de Campeche, así como todos los Convenios de Colaboración Administrativa en materia Hacendaria de Ingresos celebrados entre el Estado de Campeche y sus municipios, se entenderán también conferidas todas esas facultades al Órgano Administrativo Desconcentrado denominado “Servicio de Administración Fiscal del Estado de Campeche”.

DÉCIMO QUINTO.- Los asuntos pendientes de resolver por la Secretaría de Finanzas de la Administración Pública del Estado de Campeche a la entrada en vigor de este decreto, cuyas facultades se sustenten en el Código Fiscal del Estado, los resolverá el Servicio de Administración Fiscal del Estado de Campeche, salvo disposición específica en contrario.

DÉCIMO SEXTO.- El plazo para el cómputo de la prescripción a que se refiere el párrafo quinto del artículo 39 del Código Fiscal del Estado, será aplicable para los créditos fiscales que hayan sido exigidos a partir del 1 de enero de 2008.

Tratándose de los créditos fiscales exigibles con anterioridad al 1 de enero de 2008, el Servicio de Administración Fiscal del Estado de Campeche tendrá un plazo máximo de dos años para hacer efectivo el cobro de dichos créditos contados a partir de la entrada en vigor del presente decreto, siempre que se trate de créditos que no se encuentren controvertidos en dicho periodo; de controvertirse, el plazo máximo de dos años será suspendido. La aplicación de la presente disposición no configurará responsabilidad administrativa para servidores públicos encargados de la ejecución y cobro de créditos fiscales, siempre y cuando realicen las gestiones de cobro correspondientes.

DÉCIMO SÉPTIMO.- La conversión de las tarifas, cuotas, derechos, multas y demás valores expresados en salarios mínimos generales diarios vigentes a Unidades de Medida y Actualización, se realizan en cumplimiento del artículo tercero transitorio del decreto por el que se declaran reformadas y adicionadas diversas disposiciones de la Constitución Política de los Estados Unidos Mexicanos, en materia de desindexación del salario mínimo, publicado en el Diario Oficial de la Federación el veintisiete de enero de dos mil dieciséis.

DÉCIMO OCTAVO.- Las referencias al Registro Único de Obligaciones y Financiamientos se entenderán hechas al Registro de Empréstitos y Obligaciones.

20Sep/18

Circular nº 39/2017 de 26 de octubre de 2017

20 septiembre, 2018Circular, Mexico31 de octubre de 2017)., Circular nº 39/2017 de 26 de octubre de 2017. Acuerdo del Pleno del Consejo de la Judicatura del Estado de México, del veinticuatro de octubre de dos mil diecisiete, Derecho Informático de México, Derecho Informático del Estado de México, Legislación Informática de México, Legislación Informática del Estado de Mexico, por el que se autoriza la creación de la Firma Electrónica Avanzada del Poder Judicial del Estado de México. (Gaceta del GobiernoJosé Cuervo

Circular nº 39/2017 de 26 de octubre de 2017. Acuerdo del Pleno del Consejo de la Judicatura del Estado de México, del veinticuatro de octubre de dos mil diecisiete, por el que se autoriza la creación de la Firma Electrónica Avanzada del Poder Judicial del Estado de México. (Gaceta del Gobierno, 31 de octubre de 2017).

C I R C U L A R nº 39/2017

Toluca de Lerdo, México, a 26 de octubre de 2017.

C I U D A D A N O

Con fundamento en el artículo 42, fracción I de la Ley Orgánica del Poder Judicial del Estado de México, se comunican los siguientes:

I.- ACUERDO DEL PLENO DEL CONSEJO DE LA JUDICATURA DEL ESTADO DE MÉXICO, DEL VEINTICUATRO DE OCTUBRE DE DOS MIL DIECISIETE, POR EL QUE SE AUTORIZA LA CREACIÓN DE LA FIRMA ELECTRÓNICA AVANZADA DEL PODER JUDICIAL DEL ESTADO DE MÉXICO; AL TENOR DE LOS SIGUIENTES:

CONSIDERANDOS

I.- El Consejo de la Judicatura es el órgano constitucional encargado de la administración, vigilancia y disciplina del Poder Judicial, en términos de los artículos 106 de la Constitución Política del Estado Libre y Soberano de México; 52 y 63, fracciones XVI, XVIII y XXIII de la Ley Orgánica del Poder Judicial del Estado de México, con facultades para adoptar las medidas necesarias para un eficiente manejo administrativo, así como para expedir los acuerdos generales en materia administrativa y los necesarios para llevar a cabo sus atribuciones.

II.- De conformidad con los artículos 34, 88, inciso a) de la Constitución Política del Estado Libre y Soberano de México y 2 de la Ley Orgánica del Poder Judicial del Estado de México es uno de los Poderes Públicos del Estado de México, encargado de interpretar y aplicar las leyes en los asuntos del orden civil, familiar, penal, de justicia para adolescentes y de las demás materias del fuero común y del orden federal, en los casos en que expresamente los ordenamientos legales le confieran jurisdicción.

III. El Plan de Desarrollo Estratégico 2015-2020 establece en sus ideales I y VI, la Justicia Efectiva y de Excelencia y la Modernización Administrativa, el reto de la calidad en la impartición de justicia, eficientar procesos judiciales, innovar al Tribunal con tendencia a los sistemas electrónicos modernos e incorporar las tecnologías de la información; lo cual conlleva a buscar alternativas tecnológicas que permitan dar mayor prontitud, eficacia y calidad a las actividades que realiza la institución en beneficio de los ciudadanos.

IV.- De conformidad con lo establecido en el párrafo segundo del artículo 17 de la Constitución Política de los Estados Unidos Mexicanos, toda persona tiene derecho a que se le administre justicia por tribunales que estarán expeditos para impartirla en los plazos y términos que fijen las leyes, emitiendo sus resoluciones de manera pronta, completa e imparcial.

V.- Los artículos 1.96, 1.97, 1.119, 1.119 Bis y 1.125 del Código de Procedimientos Civiles del Estado de México establecen el uso de la Firma Electrónica Avanzada para diversos trámites judiciales, entre ellos, la presentación de demandas y promociones.

Por su parte, el Código Nacional de Procedimientos Penales en sus numerales 51 y 83 último párrafo, establecen que en el proceso penal se podrán utilizar los medios electrónicos en todas las actuaciones para facilitar su operación; así como el uso de la firma digital en las notificaciones.

El Código de Comercio, en su artículo 89, establece, entre otras cosas, que en los actos de comercio y en la formación de los mismos podrán emplearse los medios electrónicos, ópticos o cualquier otra tecnología.

En esta materia, la utilización de la firma electrónica avanzada contribuirá al apuntalamiento del Poder Judicial del Estado de México en el puesto uno, en materia de juicios mercantiles, en el estudio que realiza el Banco Mundial, a través del proyecto Doing Bussines en México.

VI.- Por su parte, el artículo 8 fracción IX de la Ley Orgánica del Poder Judicial del Estado de México, el Tribunal Superior de Justicia, los tribunales y juzgados, tienen, entre otras, la obligación de implementar a través del Consejo de la Judicatura el uso estratégico de tecnologías de la información que ayuden a que la impartición de justicia se realice de manera pronta y expedita.

En el mismo sentido, el artículo 63, fracción XXXVI de la citada ley orgánica, señala que es facultad del Consejo de la Judicatura establecer, a través de acuerdos generales, el uso estratégico de las tecnologías de la información en los procesos jurisdiccionales que se ventilan en los juzgados y salas que integran el Poder Judicial, así como en sus respectivas áreas administrativas.

VII.- En ese orden de ideas, el uso de la tecnología en la administración de justicia, en el caso particular, con la implementación de la firma electrónica avanzada en los procesos judiciales, constituye una acción eficiente para acelerar los procesos de simplificación administrativa que la ciudadanía demanda.

Es así que uno de los objetivos de la administración 2015-2020 consiste en avanzar hacia un verdadero gobierno digital que permita a los servidores judiciales, brindar mejor servicio, así como poner a disposición de los usuarios de la administración de justicia medios electrónicos accesibles, lo que se traduce en eficiencia en términos de tiempo, servicio y capacidad de respuesta, para mejorar el acceso a la transparencia.

VIII.- Por lo anterior, la creación, uso y regulación de la firma electrónica avanzada en nuestra institución, involucra un avance importante en la implementación de nuevas tecnologías en la administración de justicia, con los siguientes beneficios: producirá mayor seguridad e integridad de los documentos; el contenido del documento electrónico firmado no puede ser alterado, por lo que se garantiza la autenticación del mismo y la identidad del firmante; se garantiza la confidencialidad, el contenido del mensaje solo será conocido por quienes estén autorizados a ello; disminución del uso de papel; se evitan desplazamientos y traslados; disminución del tiempo en la ejecución de procesos; aumento de la productividad y competitividad de la institución. Lo que sin duda coadyuvará a eficientar las labores de los órganos jurisdiccionales, en beneficio de la sociedad.

IX.- En mérito de lo anterior, con fundamento en los artículos 106 de la Constitución Política del Estado Libre y Soberano de México; 52 y 63, fracciones XVI, XXIII y XXXVI de la Ley Orgánica del Poder Judicial del Estado, se emite el siguiente:

ACUERDO

PRIMERO. Se autoriza la creación de la firma electrónica avanzada del Poder Judicial del Estado de México, cuya denominación será FEJEM (Firma Electrónica Judicial del Estado de México).

SEGUNDO. Se crea el Comité Técnico para la implementación de la Firma Electrónica Judicial del Estado de México; la designación de sus integrantes queda a cargo del Consejo de la Judicatura del Estado de México.

TERCERO. El Reglamento para la Operatividad de la Firma Electrónica Judicial, será emitido por este cuerpo colegiado.

CUARTO. Se instruye al Director General de Innovación y Desarrollo Tecnológico del Poder Judicial del Estado de México, para que en el ámbito de sus atribuciones, implemente las medidas pertinentes para ajustar los sistemas informáticos y para el otorgamiento de la firma electrónica a los servidores adscritos a los órganos jurisdiccionales, administrativos y público autorizados, que se establezca en el correspondiente Reglamento.

QUINTO. Con el fin de que los usuarios de la administración de justicia y público en general conozcan la próxima implementación de la firma electrónica, se instruye a la Coordinación de Comunicación Social del Poder Judicial del Estado de México para que realice la correspondiente difusión.

SEXTO. Cualquier situación no prevista en el presente será resuelta por el Consejo de la Judicatura mexiquense.

TRANSITORIOS

PRIMERO. El presente acuerdo general entrará en vigor el uno de noviembre de dos mil diecisiete, en que iniciará el enrolamiento de la firma electrónica judicial del Estado de México.

SEGUNDO. Hágase del conocimiento el presente acuerdo de los órganos jurisdiccionales y administrativos del Poder Judicial del Estado de México, para que en el ámbito de sus atribuciones tomen las precauciones pertinentes.

TERCERO. Publíquese el presente acuerdo en la Gaceta del Gobierno del Estado de México, Boletín Judicial y en la página de internet oficial del Poder Judicial del Estado de México.

II.- REGLAMENTO DE LA FIRMA ELECTRÓNICA AVANZADA DEL PODER JUDICIAL DEL ESTADO DE MÉXICO (FEJEM)

TÍTULO PRIMERO.- DISPOSICIONES GENERALES

CAPÍTULO PRIMERO

Objeto

Artículo 1. El presente Reglamento tiene por objeto regular las bases para la emisión, uso y revocación de la Firma Electrónica Avanzada del Poder Judicial del Estado de México, cuya denominación será FEJEM (Firma Electrónica Judicial del Estado de México).

Definiciones

Artículo 2. Para efectos del presente Reglamento se entenderá por:

I.- Firma Electrónica Avanzada: Es el conjunto de datos y caracteres que permiten la identificación del firmante, que ha sido creada por medios electrónicos bajo su exclusivo control, de manera que está vinculada únicamente a él y a los datos a los que se refiere, lo que permite que sea detectable cualquier modificación ulterior de éstos, la cual produce los mismos efectos jurídicos que la firma autógrafa;

II.- Agente Certificador: El servidor público por conducto del cual actuará la Unidad de Certificación para tramitar la emisión, renovación, revocación y cancelación de Certificados Digitales de la FEJEM;

III.- Certificado Digital: El Certificado emitido por la Unidad de Certificación que asocia de manera segura y fiable la identidad del firmante con una Llave Pública, permitiendo con ello identificar quién es el autor o emisor de un documento electrónico remitido mediante la FEJEM;

IV.- Llave Pública: Los datos contenidos en un Certificado Digital de la FEJEM que permiten la verificación de la autenticidad de la Firma Electrónica Avanzada del Firmante;

V.- Consejo: El Consejo de la Judicatura del Estado de México;

VI.- CURP: Clave Única de Registro de Población;

VII.- Documento Electrónico: El generado, consultado, modificado o procesado por Medios Electrónicos;

VIII.- Llave Privada: Los datos que el firmante genera de manera secreta y bajo su estricto control al solicitar su FEJEM, vinculados de manera única y complementaria con su Llave Pública;

IX.- Poder Judicial: Poder Judicial del Estado de México.

Sujetos obligados

Artículo 3. Estarán sujetos a las disposiciones del presente Reglamento, todos los Servidores Públicos del Poder Judicial y aquellas personas que requieran tramitar y obtener la FEJEM.

Uso de la Firma

Artículo 4. La FEJEM podrá ser utilizada por los usuarios en los trámites jurisdiccionales que determine la normatividad adjetiva respectiva, así como en los que señale el Consejo, en al ámbito administrativo.

Los documentos electrónicos que cuenten con una firma electrónica producirán los mismos efectos que los presentados con firma autógrafa, teniendo el mismo valor probatorio que las disposiciones aplicables les otorgan a éstos.

Sistemas Electrónicos

Artículo 5. Los requisitos para el acceso y privilegios en los sistemas electrónicos del Poder Judicial que requieran del uso de la FEJEM se establecerán en la normativa que los rija, y se difundirán y describirán en el correspondiente manual de usuario.

Principios

Artículo 6. La FEJEM deberá garantizar los siguientes principios:

I.- Autenticidad: Dar certeza de que un documento electrónico ha sido emitido por el firmante, por lo que su contenido y consecuencias jurídicas le son atribuibles a éste;

II.- Seguridad: En un documento electrónico se garantiza que éste sólo puede ser cifrado por el firmante y el receptor;

III.- Integridad: Un documento electrónico dará certeza de que éste ha permanecido completo e inalterado desde su firma.

CAPÍTULO II.- DE LA SOLICITUD DE LA FEJEM

Solicitud de personas físicas

Artículo 7. La FEJEM únicamente podrá ser solicitada y emitida a personas físicas, con independencia de que éstas sean representantes de personas morales públicas o privadas, por lo que se realizará exclusivamente por el interesado, sin que dicho trámite pueda efectuarse mediante apoderado o representante legal.

Procedimiento de solicitud

Artículo 8. Para obtener la FEJEM el interesado deberá ingresar a la dirección web: http://fejem.pjedomex.gob.mx y seguir los pasos del manual de usuario que allí estará disponible.

CAPÍTULO III.- RENOVACIÓN DE LA FEJEM

Renovación

Artículo 9. La renovación deberá efectuarse dentro de los treinta días naturales anteriores a la conclusión de su vigencia, si en ese lapso de tiempo no se renueva la FEJEM caducará y el interesado deberá formular una nueva solicitud.

Artículo 10. Para la renovación de la FEJEM el interesado deberá ingresar a la dirección web: http://fejem.pjedomex.gob.mx y seguir los pasos del manual de usuario que allí estará disponible.

CAPÍTULO IV.- REVOCACIÓN DE LA FEJEM

Revocación por el usuario

Artículo 11. Para la revocación de la FEJEM el interesado deberá ingresar a la dirección web: http://fejem.pjedomex.gob.mx y seguir los pasos del manual de usuario que allí estará disponible.

Causas de Revocación

Artículo 12. La Unidad de Certificación podrá revocar la FEJEM por las siguientes causas:

I).- Muerte del titular;

II).- Resolución administrativa o judicial que lo ordene;

III).- Por error en la emisión de un certificado;

Lo anterior, se notificará al usuario en el correo electrónico que proporcionó al momento de obtener su certificado.

TÍTULO SEGUNDO.- DE LOS DERECHOS, OBLIGACIONES Y SANCIONES DE LOS TITULARES DE LA FEJEM

CAPÍTULO I.- DE LOS DERECHOS Y OBLIGACIONES

Derechos de los titulares de una FEJEM

Artículo 13. Los titulares de la FEJEM tendrán los siguientes derechos:

I.- A la protección de sus datos personales, de conformidad con las disposiciones aplicables;

II.- Solicitar a la Unidad de Certificación constancia de la existencia y vigencia de su FEJEM cuando a sus intereses convenga; y

III.- Recibir información sobre los procedimientos de solicitud, emisión, renovación y revocación de la FEJEM, así como de las instrucciones para su uso.

Obligaciones de los titulares de una FEJEM

Artículo 14. Los titulares de la FEJEM tendrán las siguientes obligaciones:

I.- Proporcionar datos y documentos verdaderos, completos y exactos al momento de tramitar la solicitud de la FEJEM;

II.- Resguardar la confidencialidad de su Llave Privada y de la clave de acceso a dicha llave, así como la de revocación del Certificado Digital de la FEJEM;

III.- Mantener un control físico, personal y exclusivo de su FEJEM;

IV.- Usar adecuadamente la FEJEM; y

V.- Revocar de inmediato su FEJEM cuando se ponga en riesgo la confidencialidad de la Llave Privada o de las claves referidas en la fracción II de este artículo.

CAPÍTULO II.- DE LAS SANCIONES

Sanciones

Artículo 15. Las conductas de los servidores públicos del Poder Judicial que impliquen el incumplimiento a los preceptos establecidos en el presente Reglamento dará lugar al procedimiento y a las sanciones que correspondan en términos de lo previsto en la Ley Orgánica del Poder Judicial del Estado de México, de la Ley de Responsabilidades Administrativas del Estado de México y Municipios, y demás disposiciones aplicables.

Vista a la autoridad competente

Artículo 16. Los servidores públicos de la Unidad de Certificación deberán hacer del conocimiento de las autoridades competentes las conductas de los usuarios, a quienes se les haya otorgado una FEJEM, que pudieran constituir delitos o responsabilidad administrativa.

TÍTULO TERCERO.- DE LA UNIDAD DE CERTIFICACIÓN

CAPÍTULO ÚNICO

Unidad de Certificación

Artículo 17. La Unidad de Certificación será la responsable de llevar a cabo los procedimientos para la emisión, renovación, revocación y consulta de la FEJEM, por sí o por conducto de los agentes certificadores que la auxilien.

Dependerá de la Dirección General de Innovación y Desarrollo Tecnológico, y tendrá la estructura orgánica que establezca el Consejo.

Obligaciones de la Unidad de Certificación

Artículo 18. Corresponde a la Unidad de Certificación:

I.- Administrar el sistema informático para la emisión de los certificados digitales de la FEJEM;

II.- Emitir certificados digitales de la FEJEM cuando así proceda;

III.- Cotejar la documentación que acompañe el solicitante de un certificado digital de FEJEM;

IV.- Brindar la atención a solicitudes de certificados digitales de la FEJEM;

V.- Rechazar las solicitudes de certificados que no cumplan con los requisitos solicitados;

VI.- Atender las solicitudes de revocación de certificados cuando el interesado se encuentre imposibilitado para realizar el proceso de revocación en línea;

VII.- Expedir los manuales generales de funcionamiento de los certificados digitales de la FEJEM;

VIII.- Llevar un control electrónico del número de certificados digitales de la FEJEM que se han emitido, rechazado o revocado;

IX.- Coordinar los programas de capacitación a los Usuarios Finales de los certificados digitales de la FEJEM;

X.- Plantear la implementación de mejores prácticas para el uso de la FEJEM;

X.- Apoyar a las diversas áreas administrativas del Consejo para implementar en sus procedimientos administrativos el uso de la FEJEM;

XII. Proponer al Consejo la celebración de convenios con otros entes públicos y privados que cuenten con firma electrónica avanzada;

XIII. Revocar la FEJEM; y

XIV. Las demás que establezca el Consejo.

Manuales de Usuario

Artículo 19. La Unidad de Certificación publicará en los medios de comunicación electrónica del Poder Judicial los manuales de usuario que se requieran, así como las políticas que estime necesarias.

Publicidad de la vigencia de los Certificados

Artículo 20. La Unidad de Certificación deberá hacer pública la vigencia de los certificados digitales de la FEJEM emitidos a los usuarios finales, así como todos los servicios relacionados con la misma, a través de la página web institucional del Poder Judicial.

TÍTULO CUARTO.- DEL RECONOCIMIENTO HOMOLOGADO DE CERTIFICADOS DIGITALES DE FIRMA ELECTRÓNICA AVANZADA Y DE LA CELEBRACIÓN DE CONVENIOS DE COORDINACIÓN

CAPÍTULO ÚNICO

Convenio de Coordinación

Artículo 21. El Poder Judicial podrá reconocer un certificado digital de firma electrónica que hubiere emitido otro Estado, entidad federal o ente, siempre y cuando se haya celebrado convenio de coordinación para el reconocimiento de certificados digitales homologados, en términos de lo previsto en la legislación aplicable. En la inteligencia de que para acceder al Sistema Electrónico será necesaria la verificación en línea de la vigencia de los certificados correspondientes.

Situaciones no previstas

Artículo 22. Cualquier situación no prevista en este Reglamento será resuelta por el Consejo de la Judicatura.

TRANSITORIOS

PRIMERO. El presente Reglamento entrará en vigor el uno de noviembre de dos mil diecisiete.

SEGUNDO. Publíquese el presente Reglamento en la Gaceta del Gobierno del Estado de México, Boletín Judicial y en la página de internet oficial del Poder Judicial del Estado de México.

Así por unanimidad de votos lo acordó el Pleno del Consejo de la Judicatura del Estado de México, y firman al calce el Presidente y la Secretaria General de Acuerdos, que da fe.

A T E N T A M E N T E

PRESIDENTE DEL TRIBUNAL SUPERIOR DE JUSTICIA Y DEL CONSEJO DE LA JUDICATURA DEL ESTADO DE MÉXICO, MGDO. DR. EN D. SERGIO JAVIER MEDINA PEÑALOZA

SECRETARIA GENERAL DE ACUERDOS, M. EN C. P. FABIOLA CATALINA APARICIO PERALES

20Sep/18

SENTENCIA 25/2018 DEL TRIBUNAL SUPERIOR DE JUSTICIA DE CASTILLA LA MANCHA DE 12 DE ENERO DE 2018.

20 septiembre, 2018España, SentenciaDerecho a la Intimidad, Derecho a la protección de datos, Sala de lo Social, SENTENCIA 25/2018 DEL TRIBUNAL SUPERIOR DE JUSTICIA DE CASTILLA LA MANCHA DE 12 DE ENERO DE 2018.José Cuervo

MAGISTRADO/A PONENTE: Ilma. Sra. Dª Mª DEL CARMEN PIQUERAS PIQUERAS

ILMOS/AS. SRES/AS. MAGISTRADOS/AS

PEDRO LIBRAN SAINZ DE BARANDA

JESUS RENTERO JOVER

ISIDRO MARIANO SAIZ DE MARCO

Mª DEL CARMEN PIQUERAS PIQUERAS

En Albacete, a doce de enero de dos mil dieciocho.

La Sala de lo Social del Tribunal Superior de Justicia de Castilla-La Mancha, compuesta por los Iltmos. Sres. Magistrados citados al margen, y

EN NOMBRE DEL REY

ha dictado la siguiente

S E N T E N C I A

En el Recurso de Suplicación número 1.416/17, interpuesto por la representación legal de D. Rubén , contra la Sentencia dictada por el Juzgado de lo Social número Dos de Ciudad Real, de fecha 11 de abril de 2017 , en los autos número 802/16, sobre DESPIDO, siendo recurrido TEPOL SEGURIDAD, SLU, con la intervención del FOGASA.

Es Ponente la Iltma. Sra. Magistrada Dª. Mª DEL CARMEN PIQUERAS PIQUERAS.

ANTECEDENTES DE HECHO

PRIMERO .

Que la Sentencia recurrida dice en su parte dispositiva: «FALLO:

Que debo desestimar y desestimo la demanda presentada por el actor, declarando la procedencia del despido disciplinario, absolviendo a la mercantil demandada «Tepol Seguridad S.L.U.» de las pretensiones deducidas de contrario.

SEGUNDO .

Que, en dicha Sentencia se declaran probados los siguientes Hechos:

PRIMERO: El actor ha prestado servicios para la mercantil demandada, la cual se subrogó en la relación laboral mantenida con las mercantiles «Controlcaza, vigilancia y Seguridad S.L.», primero y después, «GS3 División Seguridad S.L», con una antigüedad reconocida por la demandada del 22-2-12, que sin embargo debe situarse en el 19- 11-2010, siendo su categoría profesional, la de vigilante de seguridad, con un salario diario de 1.392,45 euros.

SEGUNDO: El día 6-9-16 la empresa entregó carta al trabajador imponiéndole una sanción de tres días sin empleo ni sueldo, por hechos cometidos el 3 y el 4 de septiembre de 2016, consistentes en fumar en el trabajo durante su turno, en las instalaciones de la fábrica y en la caseta de seguridad. En dicha carta se le decía que el día 23-6-16 ya se le había amonestado verbalmente por los mismos hechos, poniendo en su conocimiento que se había tenido que higienizar la caseta de seguridad y los aparatos en ella instalados. El contenido de dicha carta se da por reproducido al obrar unido como documento nº 7 del ramo de la actora.

TERCERO: La empresa despidió al trabajador mediante carta fechada el 10-10-16 y con efectos de ese mismo día, en la que se le imputaba un despido disciplinario por infracción del art. 54.2b) y 55.1, 55.13, 55.15 y 55.20 del Convenio. En la carta se alude a que, pese a haber sido amonestado verbalmente, continua fumando en las instalaciones de la fábrica «Faiges» sita en Daimiel, donde se efectúa la vigilancia, todo ello en virtud de un contrato de arrendamiento de servicios de seguridad celebrado el 1-7-16 entre la mercantil Faiges y la empresa aquí demandada. Así mismo, se le imputa una disminución voluntaria y continuada en el rendimiento en su puesto de trabajo, la comisión de actos inmorales en el puesto de trabajo, tales como, visionado de material pornográfico y masturbaciones en el trabajo, y distracciones graves por juegos o conversaciones telefónicas. El contenido de la carta se da por reproducido al constar unido a los autos junto con la demanda.

CUARTO: Acreditado que el trabajador ha fumado mientras ejercía su actividad laboral en el interior de la caseta donde lo desarrolla, así como ha visionado material pornográfico y se ha masturbado durante la jornada laboral los días imputados en la carta de despido. La empleadora tuvo conocimiento de ello tras la instalación de una cámara de grabación en el interior de la caseta, incorporación realizada con la finalidad de sorprender al trabajador por sospechas anteriores y sin aviso por tanto, al trabajador. En el recinto hay carteles informativos que prohíben fumar.

QUINTO: El Convenio Colectivo aplicable es el Estatal de Empresas de Seguridad.

SEXTO: El actor no ostenta ni ha ostentado cargo de representación sindical.

SEPTIMO: Se celebró acto de conciliación con el resultado de sin avenencia.

TERCERO .

Que, en tiempo y forma, por la parte demandante, se formuló Recurso de Suplicación contra la anterior Sentencia, en base a los motivos que en el mismo constan.

Dicho Recurso ha sido impugnado de contrario.

Elevadas las actuaciones a este Tribunal, se dispuso el pase al Ponente para su examen y resolución.

FUNDAMENTOS DE DERECHO

PRIMERO.- Frente a la sentencia de instancia que declaró procedente el despido del que había sido objeto el actor, se alza este en suplicación mediante el presente recurso que articula a través de cinco motivos. Los tres primeros, al amparo procesal del apartado b) del artículo 193 LRJS , para revisar hechos probados; y el cuarto y quinto, bajo cobijo procesal en el apartado c) del citado precepto, para examinar la infracción de normas sustantivas o de la jurisprudencia; pretendiendo -en síntesis- la declaración de nulidad del despido por vulneración de derechos fundamentales, concretamente, del derecho a la protección de la intimidad personal y familiar en el uso de la informática, reconocido en el artículo 18.4 CE ; y subsidiariamente la improcedencia y en su caso la aplicación de la jurisprudencia sobre la graduación y proporcionalidad de la sanción impuesta.

Antes de dar contestación a cada uno de los motivos, conviene reseñar los hechos más relevantes, según se desprende del relato factico de la sentencia recurrida, así como de lo todo lo actuado. El actor prestaba sus servicios para la empresa demandada desde 22 de diciembre de 2012, como vigilante de seguridad, desarrollando sus funciones, consistentes fundamentalmente en controlar los monitores que proyectaban las imágenes grabadas por las cámaras de seguridad instaladas por todo el recinto empresarial, en una caseta aneja a la propia instalación empresarial pero dentro del espacio físico de esta. El trabajador es despedido mediante carta de fecha 10 de octubre de 2016 en la que se le imputaba la infracción de los artículos 54.2 b ) y 55.13 , 55.15 y 55.20 del Convenio Colectivo de Empresas de Vigilancia y Seguridad , por fumar en la instalaciones donde efectúa el servicio de vigilancia, pese a haber sido amonestado con anterioridad verbalmente; por disminución voluntaria y continuada en el rendimiento en su puesto de trabajo; la comisión de actos inmorales en el puesto de trabajo, tales como visionado de material pornográfico y masturbaciones, y distracciones graves por juegos o conversaciones telefónicas. La empresa tuvo conocimiento de tales hechos tras la instalación, sin previo aviso al trabajador, de una cámara de grabación en el interior de la caseta, con la finalidad de comprobar la sospecha de que fumaba en dicho lugar. En el recinto empresarial hay carteles informativos que prohíben fumar. También existen avisos y advertencias de la existencia de cámaras de video vigilancia en el interior del recinto empresarial, pero no en el interior de la caseta.

La sentencia de instancia considera probado que «el trabajador ha fumado mientras ejercía su actividad laboral en el interior de la caseta donde lo desarrolla, así como, ha visionado material pornográfico y se ha masturbado durante la jornada laboral los días imputados en la carta de despido», extrayendo tal conclusión probatoria de la grabación obtenida, además de por la declaración de varios testigos respecto del hecho de fumar en el lugar de trabajo. No considera probado la disminución voluntaria y continuada en el rendimiento que también se imputaba al trabajador. Y califica los hechos probados como incumplimientos graves y culpables, así como proporcionada la sanción de despido.

SEGUNDO.- Dicho lo anterior, procede dar respuesta a los motivos del recurso, comenzando por los tres primeros, a través de los cuales la parte recurrente pretende la modificación del ordinal primero para incluir en su contenido la fecha concreta desde la que viene prestando servicios para la empresa demandada (1 de julio de 2016) que es a su vez, la fecha en la que dicha empresa sucedió en la contrata de vigilancia y seguridad a la anterior, al considerar «sintomático» que se produzca el despido cuando solo habían transcurrido tres meses desde dicha fecha, y sin embargo no hubiera tenido problema alguno con el resto de las empresas para las que prestó servicios con anterioridad. Sostiene tal modificación fáctica sobre los documentos consistentes en la carta de subrogación del trabajador, contrato de arrendamiento de servicios entre la empresa principal y la demandada, vida laboral del trabajador, y contratos de trabajo con las empresas anteriores (motivo primero).

También solicita la revisión del ordinal segundo, cuyo texto original es el siguiente: «El día 6-9-16 la empresa entregó una carta al trabajador imponiéndole una sanción de tres días sin empleo ni sueldo, por hechos cometidos el 3 y 4 de septiembre de 2016, consistentes en fumar en el trabajo durante su turno, en las instalaciones de la fábrica y en la caseta de seguridad. En dicha carta se le decía que el día 23-6-16 ya se le había amonestado verbalmente por los mismos hechos, poniendo en su conocimiento que se había tenido que higienizar la caseta de seguridad y los aparatos en ella instalados. El contenido de dicha carta se da por reproducido al obran unido como documento nº 7 del ramo de prueba de la actora», para que sea sustituida por el texto alternativo que propone del siguiente tenor literal «El día 4 de octubre de 2016 la empresa entregó al trabajador una carta fechada el 6 de septiembre de 2016, imponiéndole una sanción de tres días sin empleo ni sueldo, por los hechos cometidos el día 3 y 4 de septiembre de 2016, consistentes en fumar en el trabajo durante su turno. En la carta se decía, sin prueba alguna que lo acredite, que el trabajador ya había sido amonestado verbalmente por los mismos hechos, poniendo en su conocimiento que había tenido que higienizar la caseta de seguridad y los aparatos en ella instalados. Consta por el contrario los partes de trabajo emitidos por el trabajador y firmados tanto por TEPOL como por el propio cliente, de conformidad con el servicio prestado» (motivo segundo).

Por último, pretende que se sustituya el contenido del hecho probado cuarto que dice: «Acreditado que el trabajador ha fumado mientras ejercía su actividad laboral en el interior de la caseta donde lo desarrolla, así como que ha visionado material pornográfico y se ha masturbado durante la jornada laboral los días imputados en la carta de despido. La empleadora tuvo conocimiento de ello tras la instalación de una cámara de grabación en el interior de la caseta, incorporación realizada con la finalidad de sorprender al trabajador por sospechas anteriores y sin aviso por tanto, al trabajador. En el recinto hay carteles informativos que prohíben fumar», por el siguiente texto alternativo: «La empresa ha aportado grabación video gráfica en la que se aprecia al trabajador de espaldas con un cigarrillo en la boca, de una parte, y en la que aparece parte de una imagen de una persona en un acto de masturbación. La grabación se realiza en una cámara de la que no se ha realizado la advertencia previa a los trabajadores de su instalación en el interior de la caseta de trabajo. El trabajador se reconoce en la imagen de espaldas y lateral con un cigarro en la mano pero rechaza que sea él el de la otra imagen de la masturbación, en la que no se aprecia la persona concreta. Preguntado por el uniforme, se indica que todos

los trabajadores tienen el mismo uniforme de trabajo; no se aprecia la cara de la persona en la grabación que se facilita por la empresa. En la empresa hay otras cámaras exteriores en el recinto que se controlan desde el monitor de la caseta. En la fábrica hay carteles de prohibido fumar, no así en la caseta» (hecho probado tercero).

Para dar respuesta a tales pretensiones de revisión fáctica conviene recordar la doctrina constante del Tribunal Supremo (Sentencias 11 de junio de 1993 ; 15 y 26 de julio y 26 de septiembre de 1995 ; 2 y 11 de noviembre de 1998 ; 2 de febrero de 2000 ; 24 de octubre de 2002 y 12 de mayo de 2003), seguida por los Tribunales laborales, según la cual, el carácter extraordinario del recurso de suplicación impide a las partes no sólo alegar o probar hechos nuevos sino tan siquiera modificar los hechos declarados probados por el Juez a quo, lo que deriva del hecho de que hay una sola instancia y, por consiguiente, el único juez competente para valorar en su plenitud la prueba es el que celebró el juicio (Sentencia Tribunal Supremo de 18 de noviembre de 1999). El Tribunal Superior no puede hacer una valoración nueva y conjunta de la prueba, sino que tan sólo tiene atribuida la posibilidad de revisar la valoración hecha por el juez si de algún documento público -entendiendo por tales los expedidos por funcionario público con referencia a libros, archivos o legajos cuya custodia les esté encomendada por razón de su cargo-, o privado -si han sido expresamente reconocidos en juicio por la parte a quien pueda perjudicar-, o pericia, se deriva la equivocación del juzgador, sin que sea admisible su invocación genérica, ni tampoco las declaraciones de las partes o de testigos.

En todo caso, para apreciar el error del juzgador en la valoración de la prueba, también la jurisprudencia (Sentencias del Tribunal Supremo, entre otras muchas, de 2 de febrero de 2000 ; 24 de octubre de 2002 y 12 de mayo de 2003 ; 6 de julio de 2004 ; 20 de junio de 2006 ; o 9 de abril y 7 de julio de 2014 ; y las que en ellas se citan), reiterada constantemente por la doctrina de suplicación, viene declarando que para poder apreciarse el error de hecho en la valoración de la prueba y en consecuencia la pretensión revisora de los hechos declarados probados, han de concurrir los siguientes requisitos:

a) que se señale con precisión cual es el hecho afirmado, negado u omitido que se entiende equivocado, contrario a los acreditados o que conste con evidencia y no se haya incorporado al relato fáctico;

b) que se ofrezca un texto alternativo concreto para que se incluya en la narración del hecho probado, para que bien sustituya la totalidad o alguno de sus puntos o bien los complemente;

c) que se cite pormenorizadamente los documentos o pericias de los que se desprenda la equivocación del Juez, sin que sea admisible una invocación genérica de los mismos, así como tampoco la revisión de cuestiones fácticas no discutidas a lo largo del proceso;

d) que tales documentos o pericias pongan de manifiesto el error de manera clara, evidente, directa y patente, de forma contundente e incuestionable, sin necesidad de acudir a conjeturas, suposiciones o argumentaciones más o menos lógicas, naturales o razonables;

e) que la revisión pretendida sea trascendente a la parte dispositiva de la sentencia, con efectos modificadores de ésta, pues el principio de economía procesal impide incorporar hechos cuya inclusión no conduzca a nada práctico.

CUARTO .

Aplicando lo expuesto al presente supuesto no puede alcanzar éxito ninguna de las pretensiones de revisión fáctica objeto de los motivos primero, segundo y tercero, por las siguientes razones.

Se desestima el motivo primero, en el que se pretende la modificación del ordinal primero de la sentencia recurrida, porque la adición de la fecha de inicio de la prestación de servicios del actor para la empresa demandada (1 julio 2016) que es la misma en la que se produjo la sucesión en la contrata de vigilancia y seguridad que venía realizando la empresa anterior, resulta innecesaria, dado que del ordinal tercero se desprende claramente dicha fecha («contrato de arrendamiento de servicios de seguridad celebrado el 1-7-16 entre la mercantil Faiges y la empresa aquí demandada»); y por lo que respecta a que el trabajador no ha tenido problema alguno con las empresas para las que prestó servicios con anterioridad, se rechaza tal modificación fáctica, porque se trata de una mera afirmación sin prueba.

No puede prosperar la revisión del hecho probado segundo, objeto del motivo segundo, porque, en primer lugar, el pretendido error en la entrega de la carta de despido (no el día 6 de septiembre como se declara probado, sino el 4 de octubre como afirma la recurrente) sería relevante si se discutiera la caducidad de la acción por despido, pero no cuando lo que se discute es la prescripción de una sanción impuesta por otro hechos distintos a los que ahora se enjuician, y que además no fue impugnada en su momento por la actora a fin de hacer valer la prescripción de la falta que ahora alega, por lo que carece de trascendencia para resolver la calificación del despido que es, en definitiva, el objeto del presente recurso. Y por lo que respecta a la afirmación que se pretende incluir en el ordinal segundo, referida a la falta de prueba de la existencia de una amonestación verbal anterior por los mismos hechos, así como que se hubiera tenido que higienizar la caseta de seguridad en la que prestaba servicios el demandante, se ha de hacer ver que no es cierto que no exista prueba, como se comprueba con la simple lectura del fundamento de derecho tercero de la sentencia de instancia. Y por último, es cierto que constan partes de trabajo emitidos por el trabajador y firmados tanto por la empresa TEPOL como por la empresa demandada, manifestando aquella su conformidad con el servicio prestado, pero este hecho resulta también intrascendente para el resultado del fallo, por cuanto el núcleo fundamental de la cuestión radica en la prueba de los hechos imputados al trabajador, los cuales, en su caso, no quedarían desvirtuados por la ausencia de queja en la prestación del servicio de la empresa principal.

Tampoco puede alcanzar éxito el motivo tercero, mediante el que se solicita la sustitución del ordinal cuarto por el texto alternativo que se propone, porque lo que en él se expresa es una valoración personal e interesada del contenido de la prueba video gráfica en un sentido distinto al efectuado por la Magistrada de Instancia, olvidando así la parte recurrente que es al Juzgador a quo a quien corresponde la facultad privativa sobre la valoración de todas las pruebas aportadas al proceso, de acuerdo con el artículo 97.2 de Ley Reguladora de la Jurisdicción Social , ya que lo contrario sería tanto como subrogarse la parte en lo que constituye labor jurisdiccional, sin que pueda sustituirse la misma por la valoración de la parte voluntaria y subjetiva, confundiendo éste recurso excepcional y con motivos tasados en una nueva instancia (entre muchas otras, Ss. TS 18 de noviembre de 1999 ; 25 de mayo de 2000 ; 7 de marzo de 2003 ; 3 de mayo de 2001 ; o 10 de febrero de 2002 ), máxime cuando la Juzgadora de instancia explica en el fundamento de derecho cuarto la valoración de dicha prueba conjuntamente con la de las declaraciones del actor y las de los testigos, que -recuérdese- carecen de habilidad para mostrar el error en la valoración de la prueba, dado que solo la tiene la prueba pericial y la documental (arts. 193 b) y 196.3 LRJS).

Por todas las razones expuestas se desestiman los motivos primero, segundo y tercero del recurso destinados a la revisión de los hechos probados.

QUINTO .

En el motivo cuarto se denuncia la infracción de lo dispuesto en el artículo 18.4 CE , y de la jurisprudencia que invoca a lo largo del mismo, lo que debe motivar -alega- la declaración de nulidad del despido, o bien la improcedencia conforme a los artículos 55 y 56 ET , con apoyo en la Sentencia del Tribunal Constitucional de 3 de marzo de 2016 , al no haber sido informado el trabajador sobre la instalación de una cámara dentro de la caseta control de los vigilantes de seguridad donde presta sus servicios, y siendo esta medida desproporcionada.

La cuestión así planteada requiere analizar si vulnera el derecho a la intimidad personal del trabajador la instalación de un cámara de video vigilancia en el interior de la caseta en la que este prestaba sus servicios, sin haber sido informado previamente, con la finalidad de comprobar un presunto y sospechado incumplimiento laboral del operario. Y en su caso, la calificación del despido como nulo o improcedente, según se entienda aplicable las consecuencias previstas en el artículo 55.5 ET o bien las propias de la prueba obtenida con vulneración de derechos fundamentales.

Dicho esto y por lo que se refiere a el primer punto, no cabe duda que el control empresarial de la actividad laboral (art. 20.3 ET) a través de los medios que ofrecen las nuevas tecnologías, puede colisionar con los derechos fundamentales a la intimidad y a la propia imagen, al secreto de las comunicaciones y a la protección de datos de carácter personal de los trabajadores (art. 18 CE).

La jurisprudencia constitucional al interpretar el art. 18.4 CE en conexión con el derecho a la intimidad personal ex art. 18.1 CE , ha analizado el alcance de tales derechos fundamentales en supuestos de instalaciones de sistemas de grabación de imagen con carácter puntual o permanente mediante los que, en determinados momentos, se ha controlado la actividad laboral y en los que con soporte en aquéllos se ha procedido a sancionar a los trabajadores afectados. Ha reconocido la plena efectividad de los derechos fundamentales del trabajador en el marco de la relación laboral, ya que ésta no puede implicar la privación de tales derechos para quienes prestan servicio en organizaciones productivas que no son ajenas a los principios y derechos constitucionales que informan el sistema de relaciones de trabajo (Ss. TC 88/85, cuya doctrina reitera posteriormente en otras, como Ss. TC 6/88 ; 129/89 ; 126/90 ; 99/94 ; 106/96 ), no obstante ha admitido que el ejercicio de estos derechos admite limitaciones o modulaciones en la medida en que se desenvuelven en el seno de una organización que a su vez refleja otros derechos reconocidos constitucionalmente, como son el derecho a la propiedad y la libertad de empresa (arts. 33 y 38 CE), lo que exige la necesaria adaptabilidad entre todos ellos ( Ss. TC 99/94 ; 6/95 ; 106/96 ; o 98/2000 ).

Concretamente sobre los límites de la facultad empresarial de control de la conducta de los trabajadores a través de sistemas de video vigilancia no existe una respuesta consolidada, probablemente debido a la escasa regulación legal en esta materia, lo que ha dado lugar a una jurisprudencia y doctrina constitucional ciertamente vacilante, si no discordante a última hora. En las STC 98/2000 y 186/2000 se establecieron los principales criterios aplicativos en esa materia, si bien estas resoluciones analizaron la cuestión únicamente desde la perspectiva del derecho a la intimidad (art. 18.1 CE ), dejando al margen del debate el derecho a la autodeterminación informativa que se integra en el derecho a la protección de datos personales (art. 18.4 CE ), al que sí atendió la importante STC 29/2013, de 11 de febrero , que introdujo, a su vez, importantes correcciones a la anteriores.

En efecto, se dice que constituye un importante hito en la evolución de la doctrina constitucional la STC 29/2013, de 11 de febrero , al fijar la doctrina sobre el contenido esencial del derecho a la libertad informática que reconoce el artículo 18.4 CE en su proyección a la relación laboral. En esta resolución el Tribunal Constitucional declaró que es necesaria una » información previa y expresa, precisa, clara e inequívoca a los trabajadores de la finalidad de control de la actividad laboral a la que la captación podía ser dirigida (…) concretar las características y el alcance del tratamiento de datos que iba a realizarse, esto es, en qué casos las grabaciones podrían ser examinadas, durante cuánto tiempo y con qué propósitos, explicitando muy particularmente que podían utilizarse para la imposición de sanciones disciplinarias por incumplimientos del contrato de trabajo «. En síntesis la doctrina que estable esta Sentencia puede ser resumida del siguiente modo:

a) la habilitación legal para recabar los datos personales sin necesidad de consentimiento en el ámbito de las relaciones laborales no exime del derecho de información al trabajador;

b) el derecho de información no puede ser suplido o subsanado por la existencia de anuncios sobre la instalación de cámaras ni por la mera notificación de la creación del fichero a la Agencia Española de Protección de Datos;

c) lesiona el artículo 18.4 CE la utilización, para controlar el cumplimiento de las obligaciones laborales, de medios encubiertos que niegan al trabajador la información exigible;

d) la información debe ser previa y expresa, precisa, clara e inequívoca, expresando la finalidad de control de la actividad laboral a la que la captación podía ser dirigida; debe concretar las características y el alcance del tratamiento de datos que vaya a realizarse; debiéndose explicitar que podrán ser utilizadas para la imposición de sanciones disciplinarias por incumplimientos del contrato de trabajo.

En sentido semejante se ha pronunciado el TEDH en la recentísima Sentencia de 9 de enero de 2018 (Caso López Ribalta y otras c. España), a la que más adelante nos referiremos.

El Tribunal Supremo aplica la doctrina constitucional sentada en la STC 29/2013 en STS 13 de marzo de 2014 (RCUD 1685/13 ) -RJ 2014\3307- en un supuesto en que consideró vulnerado el derecho a la intimidad por la utilización de las cámaras de video-vigilancia instaladas como sistema disuasorio de hurtos de clientes, para sancionar a una trabajadora, existiendo falta de información sobre la utilidad de supervisión laboral asociada a las capturas de imágenes de los trabajadores, sin que esa conclusión pudiera verse contrarrestada por la existencia de dispositivos anunciando su instalación y la captación de imágenes, así como la notificación de la creación de ficheros a la Agencia Española de Protección de Datos.

Sin embargo, poco después, el Tribunal Constitucional en la sentencia 39/2016 de 3 de marzo de 2016 -de gran relevancia porque fue dictada por el Pleno, pero no por unanimidad pues tiene varios votos particulares-, establece otros criterios y condiciones en el uso, como prueba válida en el proceso social, de las cámaras de seguridad o de vigilancia de la actividad laboral, en el sentido de modificar y corregir sustancialmente y de forma restrictiva la doctrina que hasta entonces había mantenido dicho Tribunal. Así, afirma que la empresa no necesita el consentimiento expreso del trabajador para el tratamiento de las imágenes que han sido obtenidos a través de las cámaras instaladas en la empresa con el fin de seguridad o control laboral, ya que considera que se trata de una medida destinada a controlar el cumplimiento de la relación laboral y que resulta conforme con el artículo 20.3 del Estatuto de los Trabajadores , cuando establece que » el empresario podrá adoptar las medidas que estime más oportunas de vigilancia y control para verificar el cumplimiento por el trabajador de sus obligaciones y deberes laborales, guardando en su adopción y aplicación la consideración debida a la dignidad humana «. De este modo, el Tribunal Constitucional libera a las empresas de esta carga informativa explícita y precisa, al tiempo que convierte la sospecha de que un trabajador está cometiendo irregularidades, en una habilitación para instalar las cámaras en el lugar de trabajo, resolviendo así de forma contraria a la STC 29/2013 , sin explicación alguna sobre las razones del cambio de doctrina, sobre la que indudablemente va a influir la reciente Sentencia de 9 de enero de 2018 (Caso López Ribalta y otras c. España) en la que se reafirma el criterio sostenido en la anterior de 5 de septiembre de 2017 dictada por la Gran Sala TEDH (Caso Barbulescu c. Rumanía). Aquella resolución del TEDH condena a España por vulneración del artículo 8 CEDH (derecho a la vida privada), al entender -en síntesis- que la video vigilancia llevada a cabo por el empresario, que se desarrolló durante un periodo prolongado, no cumplió con las exigencias previstas en el art. 5 de la Ley Orgánica de Protección de Datos 15/1999 (LOPD), en particular, con la obligación de informar, previa, explicita y precisamente, sin ambigüedades, a los interesados sobre la exigencia y características particulares de un sistema de captación de datos personales. Considera el TEHD que los derechos del empresario podrían haberse satisfecho, al menos en cierto grado, por otros medios, concretamente informando previamente a las demandantes, incluso de forma general, de la instalación de un sistema de video vigilancia y proporcionándoles la información prevista en el artículo 5 de la LOPD .

La doctrina sentada por el Tribunal Europeo de Derechos Humanos en la antedicha resolución previsiblemente también influirá en la última jurisprudencia del Tribunal Supremo que ha aplicado la doctrina constitucional de la STC 39/2016 en las Sentencia de 31 de enero de 2017 (RCUD 3331/15) -RJ 2017\1429 – y 1 de febrero (RCUD 3262/15 ) -RJ 2017\1105-, dictadas en Pleno, en las que consideró válida la utilización de cámaras de video vigilancia, como medida de seguridad, estando indicada su existencia y siendo el trabajador conocedor de ello; y en la Sentencia de 2 de febrero de 2017 (RCUD 554/16 ) – RJ 2017\1628- en la que consideró igualmente válida la utilización de cámaras de video vigilancia, aunque el trabajador no hubiera sido informado expresamente sobre el uso y destino de las misma.

Con este panorama ciertamente incierto, en el estado actual de la cuestión en el ordenamiento español no puede dejar de afirmarse que los trabajadores han de considerarse suficientemente informados con los carteles estándares indicativos de «zona vídeo-vigilada», y válida la instalación de cámaras de video vigilancia cuando existan sospechas previas de incumplimientos laborales. Ahora bien, no debe olvidarse que tal medida de control de la actividad laboral es siempre una medida restrictiva de derechos fundamentales, y como tal se exige superar el triple juicio de proporcionalidad, necesidad e idoneidad, de conformidad con la propia doctrina que el Tribunal Constitucional que sigue intacta aun en la STC 39/2016 : » el empresario no queda apoderado para llevar a cabo, so pretexto de las facultades de vigilancia y control que le confiere el artículo 20.3 ET , intromisiones ilegítimas en la intimidad de sus empleados en los centros de trabajo » (STC 186/2000, de 10 de julio ) (…) el ejercicio de las facultades organizativas y disciplinarias del empleador no pueden servir en ningún caso a la producción de resultados inconstitucionales, lesivos de los derechos fundamentales del trabajador (entre otras, SSTC 94/1984 , 108/1989 , 171/1989 , 123/1992 , 134/1994 y 173/1994 ) ni a la sanción del ejercicio legítimo de tales derechos por parte de aquel (STC 11/1981 ). Por eso, de conformidad con dicha doctrina, » la constitucionalidad de cualquier medida restrictiva de derechos fundamentales viene determinada por la estricta observancia del principio de proporcionalidad «, recordando que para ello » es necesario constatar si cumple los tres requisitos o condiciones siguientes: si tal medida es susceptible de conseguir el objetivo propuesto (juicio de idoneidad); si, además, es necesaria, en el sentido de que no exista otra medida más moderada para la consecución de tal propósito con igual eficacia (juicio de necesidad); y finalmente, si la misma es ponderada o equilibrada, por derivarse de ella más beneficios o ventajas para el interés general que perjuicios sobre otros bienes o valores en conflicto (juicio de proporcionalidad en sentido estricto) (SSTC 66/1995, de 8 de marzo, FJ 5 ; 55/1996, de 28 de marzo, FFJJ 6, 7, 8 y 9; 207/1996, de 16 de diciembre , FJ 4 e , FJ 8).

SEXTO .

La doctrina constitucional antedicha constituye fuente de interpretación y aplicación de las normas, a la que debe estar la Sala – conforme a las previsiones del artículo 5.1 LOPJ – para resolver el presente supuesto, cuyos perfiles fácticos quedaron expuesto más atrás.

Según la STC 39/2016 de 3 de marzo de 2016 , el hecho de que el actor no fuera informado previamente de forma alguna por la empresa de su intención de instalar una cámara de video vigilancia en la caseta en la que prestaba sus servicios, ante la sospecha de que estaba cometiendo irregularidades laborales, existiendo avisos y advertencias de la presencia de cámaras de video vigilancia en el interior del recinto empresarial, pero no en el interior de la caseta, no vulneraría, en principio, el derecho del trabajador a la protección de la intimidad personal y familiar en el uso de la informática que recoge el artículo 18.4 CE .

No obstante, también de acuerdo con consolidada doctrina constitucional y jurisprudencial, que no se ha visto alterada sino que es acogida por la propia STC 39/2016 , el comportamiento empresarial descrito no cumple el triple juicio de proporcionalidad exigible a toda medida restrictiva de derechos fundamentales como es, indudablemente, la instalación de una cámara de video vigilancia en el puesto de trabajo. Y ello, porque aunque no parece existir duda sobre el carácter justificado de la medida, en cuanto existían razonables sospechas de que el trabajador fumaba en el puesto de trabajo, y por tanto era también idónea para la finalidad pretendida por la empresa (comprobar dicha sospecha), no puede afirmarse que fuera necesaria, en tanto en cuanto existían otros medios más moderados, menos agresivos del derecho a la intimidad personal del trabajador, como era el testimonio de los propios compañeros de trabajo y del gerente de la empresa FAIGES para la que la mercantil demandada prestaba el servicio de vigilancia y seguridad, que así depusieron en el acto de juicio, o la prueba de la contratación de una empresa de desinfección para higienizar la caseta acreditada mediante el correspondiente documento de pago del servicio, de lo que se desprende que la empresa disponía de otros medios de prueba idóneos y suficientes para acreditar el pretendido incumplimiento que motivó la instalación de la cámara referida; ni fue equilibrada, por derivarse de ella más beneficios o ventajas para el interés general que perjuicios sobre otros bienes o valores en conflicto que muestra, en definitiva, una clara desproporcionalidad de la medida, en tanto en cuanto se limita el derecho fundamental del trabajador a la garantía del derecho a la intimidad personal en el uso de la informática (art. 18.4 CE en relación con art. 18.1 CE) para satisfacer el derecho de la empresa a controlar el desarrollo de la relación laboral reconocido en el artículo 20.3 ET , que en este caso, no se olvide, era comprobar un comportamiento (fumar en el puesto de trabajo) que ni siquiera el convenio colectivo prevé expresamente como incumplimiento laboral, ni por las características de la empresa ni del puesto de trabajo de vigilancia desarrollado en una caseta aneja a la empresa pero independiente de las instalaciones de aquella, puede considerarse razonablemente como una actitud peligrosa para los bienes de la mercantil a la que se prestaba el servicio de vigilancia, o para la salud de otros empleados o clientes; por todo lo cual la Sala considera vulnerado aquel derecho constitucional cuya infracción denuncia la parte recurrente en este motivo, procediendo en consecuencia, la estimación del mismo.

SÉPTIMO .

Llegados a este punto, sobreviene la cuestión de la consecuencia jurídica que habrá de imponerse a la conclusión obtenida; si la nulidad del despido aplicando el art. 55.5 ET , o las consecuencias que se deriven de la proscripción de la obtención de prueba ilícita con arreglo a los artículos 11.1 LOPJ , 287 LEC y 90.1 LRJS , que serán la procedencia o improcedencia del despido, según hayan quedado o no probado el incumplimiento contractual alegado en la carta de despido, una vez eliminados los hechos obtenidos de tal modo. Cuestión respecto de la que no existe jurisprudencia unificadora ni opinión judicial ni doctrinal unánime, habiéndose inclinado esta Sala por desechar la calificación de nulidad del despido, «pues lo que no se ha admitido es el medio de prueba contaminado (…) pero no se ha concluido que la decisión extintiva, en sí mismo considerada, pretendiera la vulneración de un derecho fundamental o libertad pública del trabajador, que llevara aparejada la calificación de nulidad del mismo (art. 55.5 ET )» (STSJ Castilla-La Mancha (Sec.1ª) 10 junio 2014 -AS 2014/1619 -; en igual sentido STSJ Castilla-La Mancha (Sec. 2ª) 28 noviembre 2014 – AS 2015/484 -); sin embargo, otras sentencias dictadas en suplicación han mantenido otros argumentos jurídicos, también admisibles, como por ejemplo Sentencia TSJ del País Vasco de 10 mayo de 2011 -AS 2012\2277-en la que, con apoyo en la STC 196/2004 , considera que la ilicitud en la obtención de prueba utilizada por la demandada para acreditar los incumplimientos imputados al actor acarrea la nulidad el despido, porque la dicción del artículo 55.5 ET acoge «no solo los supuestos en los que el cese se produce como consecuencia del ejercicio legítimo de un derecho fundamental, sino también aquellos otros en que los hechos que lo sustentan han sido conocidos por el empresario mediante métodos que conculcan los derechos fundamentales del afectado»; o en la Sentencia del mismo Tribunal de 12 septiembre 2006 , en la que además trae a colación la doctrina de los frutos del árbol envenenado sobre la base de la expresión «se hubieran obtenido directa o indirectamente mediante procedimientos que supongan violación de derechos fundamentales o libertades públicas» del artículo 90 LPL (ahora 90 LRJS ), tan similar a la del artículo 11.1 LOPJ («No surtirán efecto las pruebas obtenidas, directa o indirectamente, violentando los derechos o libertades fundamentales»).

En el caso que nos ocupa, mantenemos el criterio aplicado por la Sala en anteriores supuestos, al entender que no existen razones de peso suficientes para alterar el ámbito de aplicación del artículo 55.5 ET , en tanto en cuanto pensamos que la sanción de nulidad del despido tiene su fundamento en el móvil del empresario cuando el despido en sí mismo responde a una causa vulneradora de un derecho fundamental, de ahí la prescripción del artículo 55.5 ET , pero no cuando la finalidad que mueve al empresario es comprobar un comportamiento del trabajador para obtener la prueba de la existencia de la causa alegada para justificar el despido, en cuyo caso, procede la nulidad de dicha prueba obtenida con vulneración de derechos fundamentales o libertades públicas, sin que tal nulidad pueda extenderse a la calificación del despido que podrá ser improcedente o incluso procedente, si una vez desechados los hechos acreditados mediante la prueba ilegal o ilegítima, aun resultan probados, mediante prueba hábil e idónea hechos que constituyen un incumplimiento grave y culpable del trabajador.

Así, una vez eliminados del enjuiciamiento todos los hechos acreditados mediante la grabación de la cámara de video vigilancia (fumar, masturbarse y visionar pornografía), el único que puede considerarse probado es que el trabajador fumaba en el puesto de trabajo, porque así se desprende del testimonio de los compañeros de trabajo y del gerente de la empresa principal para la que prestaba servicio de vigilancia la empleadora del trabajador. Pero este comportamiento no constituye causa de despido porque, además de no estar previsto expresamente como tal en el Convenio Colectivo aplicable, tampoco se ajusta a ninguna de las causas legales de despido del artículo 54 ET en que pudiera resultar encuadrable, pues como desobediencia a las órdenes del empresario del apartado b) del artículo 54.2 ET se advierte que no consta la existencia de prohibición expresa, y como disminución continuada y voluntaria en el rendimiento del trabajo normal o pactado del apartado e) del mismo precepto, la propia sentencia recurrida no lo considera acreditado por las razones que expresa en el fundamento de derecho cuarto; por todo lo cual debe concluirse que no ha quedado acreditada la causa de despido alguna, procediendo la estimación del cuarto motivo del recurso y con ello del recurso mismo, al haberse dado respuesta con lo antedicho al quinto y último motivo; y en consecuencia, la declaración del despido como improcedente, en aplicación de lo dispuesto en los artículos 55.4 ET y 108 LRJS , con las consecuencias legales inherentes a dicha calificación establecidas en los artículos 56 ET y 109 LRJS , esto es, la obligación de empresario de optar en el plazo de cinco días desde la notificación de la sentencia, entre la readmisión del trabajador o el abono de una indemnización equivalente a treinta y tres días de salario por año de servicio, prorrateándose por meses los periodos de tiempo inferiores a un año, hasta un máximo de veinticuatro mensualidades, debiendo advertir que dada la antigüedad del trabajador (22-2-1012) no es de aplicación lo establecido en la Disposición Transitoria 5ª de la Ley 3/2012 , debiendo realizarse en cálculo de la indemnización con arreglo a una antigüedad de 56 meses y a razón de 1.392,45 € mensuales (no pueden ser diarios como, erróneamente -entendemos-, se hace constar en el ordinal primero), o 45,65 € diarios, lo que hace un total de 7.030,73 € de indemnización.

Vistos los preceptos legales citados y demás de general y especial aplicación

FALLAMOS

Que estimando el recurso de suplicación formulado por la representación letrada de Rubén contra la sentencia de fecha 11 de abril de 2017, dictada por el Juzgado de lo Social nº 2 de Ciudad Real , en autos 802/16 sobre despido, siendo parte recurrida la empresa TEPOL SEGURIDAD SLU, debemos revocar y revocamos la citada resolución, para dictar otra por la que, estimando la demanda, debemos declarar y declaramos improcedente el despido, condenando a la empresa TEPOL SEGURIDAD SLU a optar en el plazo de cinco días desde la notificación de la sentencia, entre la readmisión del trabajador o el abono de una indemnización de 7.030,73 €. Sin costas.

Notifíquese la presente resolución a las partes y a la Fiscalía del Tribunal Superior de Justicia de Castilla-La Mancha en Albacete, haciéndoles saber que contra la misma únicamente cabe RECURSO DE CASACION PARA LA UNIFICACION DE DOCTRINA, que se preparará por escrito dirigido a esta Sala de lo Social del Tribunal Superior de Justicia de Castilla La Mancha en Albacete, dentro de los DIEZ DIAS siguientes a su notificación, durante dicho plazo, las partes, el Ministerio Fiscal o el letrado designado a tal fin, tendrán a su disposición en la oficina judicial los autos para su examen, de acuerdo con lo dispuesto en el artículo 220 de la Ley reguladora de la jurisdicción social . La consignación del importe de la condena, cuando proceda, deberá acreditarse por la parte recurrente, que no goce del beneficio de justicia gratuita, ante esta Sala al tiempo de preparar el Recurso, presentando resguardo acreditativo de haberla efectuado en la Cuenta Corriente número ES55 00493569 9200 0500 1274 que esta Sala de lo Social del Tribunal Superior de Justicia de Castilla-La Mancha, Albacete, tiene abierta en el BANCO SANTANDER, sita en Albacete, C/ Marqués de Molíns nº 13,indicando el nombre o razón social de la persona física o jurídica obligada a hacer el ingreso, y si es posible, el NIF/CIF, así como el beneficiario (Sala de lo Social) y el concepto (cuenta expediente) 0044 0000 66 1416 17, pudiéndose sustituir dicha consignación en metálico por el aseguramiento mediante aval bancario en el que se hará constar la responsabilidad solidaria del avalista. Debiendo igualmente la parte recurrente, que no ostente la condición de trabajador, causahabiente suyo, o beneficiario del régimen público de la Seguridad Social, o se trate del Ministerio Fiscal, el Estado, las Comunidades Autónomas, las Entidades Locales, los Organismos dependientes de todas ellas y quienes tuvieren reconocido el beneficio de justicia gratuita, consignar como depósito la cantidad de SEISCIENTOS EUROS (600,00 €), conforme al artículo 229 de citada Ley, que deberá ingresar en la Cuenta Corriente anteriormente indicada, debiendo hacer entrega del resguardo acreditativo de haberlo efectuado en la Secretaría de esta Sala al tiempo de preparar el Recurso.

Así por esta nuestra Sentencia, lo pronunciamos, mandamos y firmamos.

16Sep/18

Directiva (UE) 2016/1148 del Parlamento Europeo y del Consejo, de 6 de julio de 2016

16 septiembre, 2018Directiva, Unión Europeade 6 de julio de 2016, Directiva (UE) 2016/1148 del Parlamento Europeo y del Consejo, relativa a las medidas destinadas a garantizar un elevado nivel común de seguridad de las redes y sistemas de información en la Unión. (Diario Oficial de la Unión Europea L 194 de 19 de julio de 2016)José Cuervo

Directiva (UE) 2016/1148 del Parlamento Europeo y del Consejo, de 6 de julio de 2016, relativa a las medidas destinadas a garantizar un elevado nivel común de seguridad de las redes y sistemas de información en la Unión. (Diario Oficial de la Unión Europea L 194 de 19 de julio de 2016)

EL PARLAMENTO EUROPEO Y EL CONSEJO DE LA UNIÓN EUROPEA,

Visto el Tratado de Funcionamiento de la Unión Europea, y en particular su artículo 114,

Vista la propuesta de la Comisión Europea,

Previa transmisión del proyecto de acto legislativo a los Parlamentos nacionales,

Visto el dictamen del Comité Económico y Social Europeo (1),

De conformidad con el procedimiento legislativo ordinario (2),

Considerando lo siguiente:

(1) Las redes y sistemas de información desempeñan un papel crucial en la sociedad. Su fiabilidad y seguridad son esenciales para las actividades económicas y sociales, y en particular para el funcionamiento del mercado interior.

(2) La magnitud, la frecuencia y los efectos de los incidentes de seguridad se están incrementando y representan una grave amenaza para el funcionamiento de las redes y sistemas de información. Esos sistemas pueden convertirse además en objetivo de acciones nocivas deliberadas destinadas a perjudicar o interrumpir su funcionamiento. Este tipo de incidentes puede interrumpir las actividades económicas, generar considerables pérdidas financieras, menoscabar la confianza del usuario y causar grandes daños a la economía de la Unión.

(3) Las redes y sistemas de información, principalmente internet, contribuyen de forma decisiva a facilitar la circulación transfronteriza de productos, servicios y personas. Debido a ese carácter transnacional, una perturbación grave de esas redes y sistemas, ya sea o no deliberada, y con independencia del lugar en que se produzca, puede afectar a diferentes Estados miembros y a la Unión en su conjunto. Por consiguiente, la seguridad de las redes y sistemas de información es fundamental para el correcto funcionamiento del mercado interior.

(4) Partiendo de los significativos avances logrados en el marco del Foro Europeo de Estados miembros, que ha permitido promover discusiones e intercambios de información sobre buenas prácticas políticas, incluida la elaboración de principios de cooperación europea ante crisis cibernéticas, procede establecer un Grupo de cooperación compuesto por representantes de los Estados miembros, la Comisión y la Agencia de Seguridad de las Redes y de la Información de la Unión Europea (ENISA) a fin de respaldar y facilitar la cooperación estratégica entre los Estados miembros en lo relativo a la seguridad de las redes y sistemas de información. Para que dicho grupo sea eficaz e integrador, es esencial que todos los Estados miembros posean unas capacidades mínimas y una estrategia que garanticen un elevado nivel de seguridad de las redes y sistemas de información en su territorio. Por otra parte, los operadores de servicios esenciales y los proveedores de servicios digitales deben estar sujetos a requisitos en materia de seguridad y notificación de incidentes, con el fin de fomentar una cultura de gestión de riesgos y garantizar que se informe de los incidentes más graves.

(5) Las capacidades existentes no bastan para garantizar un elevado nivel de seguridad de las redes y sistemas de información en la Unión. Los niveles de preparación de los Estados miembros son muy distintos, lo que ha dado lugar a planteamientos fragmentados en la Unión. Esta situación genera niveles desiguales de protección de los consumidores y las empresas, comprometiendo el nivel general de seguridad de las redes y sistemas de información de la Unión. A su vez, la inexistencia de requisitos comunes aplicables a los operadores de servicios esenciales y los proveedores de servicios digitales imposibilita la creación de un mecanismo global y eficaz de cooperación en la Unión. Las universidades y los centros de investigación tienen un papel determinante que desempeñar a la hora de impulsar la investigación, el desarrollo y la innovación en esos ámbitos.

(6) Para dar una respuesta efectiva a los problemas de seguridad de las redes y sistemas de información es necesario un planteamiento global en la Unión que integre requisitos mínimos comunes en materia de desarrollo de capacidades y planificación, intercambio de información, cooperación y requisitos comunes de seguridad para los operadores de servicios esenciales y los proveedores de servicios digitales. No obstante, no está excluido que los operadores de servicios esenciales y los proveedores de servicios digitales apliquen medidas de seguridad más estrictas que las previstas en la presente Directiva.

(7) Para cubrir todos los incidentes y riesgos pertinentes, la presente Directiva debe aplicarse tanto a los operadores de servicios esenciales como a los proveedores de servicios digitales. Sin embargo, las obligaciones impuestas a los operadores de servicios esenciales y a los proveedores de servicios digitales no deben aplicarse a empresas que suministren redes públicas de comunicaciones o presten servicios de comunicaciones electrónicas disponibles para el público en el sentido de la Directiva 2002/21/CE del Parlamento Europeo y del Consejo (3), que están sujetas a los requisitos específicos de seguridad e integridad establecidos en dicha Directiva, como tampoco a los prestadores de servicios de confianza definidos en el Reglamento (UE) nº 910/2014 del Parlamento Europeo y del Consejo (4), que están sujetos a los requisitos de seguridad establecidos en dicho Reglamento.

(8) La presente Directiva debe entenderse sin perjuicio de que los Estados miembros puedan adoptar las medidas necesarias para garantizar la protección de los intereses esenciales de su seguridad, preservar el orden público y la seguridad pública, y permitir la investigación, detección y enjuiciamiento de infracciones penales. De conformidad con el artículo 346 del Tratado de Funcionamiento de la Unión Europea (TFUE), ningún Estado miembro está obligado a facilitar información cuya divulgación considere contraria a los intereses esenciales de su seguridad. En este contexto, son relevantes la Decisión 2013/488/UE del Consejo (5) y los acuerdos sobre confidencialidad o los acuerdos informales sobre confidencialidad como el Protocolo para el intercambio de información.

(9) Determinados sectores de la economía ya están ya regulados o pueden regularse en el futuro mediante actos jurídicos sectoriales de la Unión que incluyan normas relacionadas con la seguridad de las redes y sistemas de información. Siempre que esos actos jurídicos de la Unión contengan disposiciones por las que se impongan requisitos en materia de seguridad de las redes y sistemas de información o en materia de notificación de incidentes, dichas disposiciones deben aplicarse en lugar de las disposiciones correspondientes de la presente Directiva si contienen requisitos cuyos efectos sean, como mínimo, equivalentes a los de las obligaciones que establece la presente Directiva. En tales casos, los Estados miembros deben aplicar lo dispuesto en los mencionados actos jurídicos sectoriales de la Unión, incluidos los relativos a cuestiones de competencia judicial, y no deben llevar a cabo el proceso de identificación de los operadores de servicios esenciales, tal como se definen en la presente Directiva. En este contexto, los Estados miembros deben facilitar a la Comisión información sobre la aplicación de dichas disposiciones con carácter de lex specialis. A la hora de determinar si los requisitos en materia de seguridad de las redes y sistemas de información o en materia de notificación de incidentes establecidos en los actos jurídicos sectoriales de la Unión son o no equivalentes a los que se establecen en la presente Directiva, debe tenerse únicamente en cuenta lo dispuesto en los actos jurídicos de la Unión aplicables y su aplicación en los Estados miembros.

(10) En el sector del transporte marítimo y fluvial, los requisitos de seguridad que imponen los actos jurídicos de la Unión a las compañías, buques, instalaciones portuarias, puertos y servicios de gestión del tráfico de buques se aplican a la totalidad de las operaciones, incluidas las de los sistemas de radio y telecomunicaciones, los sistemas informáticos y las redes. Una parte de los procedimientos obligatorios que han de seguirse se refiere a la notificación de todos los incidentes de seguridad, y debe, por tanto, considerarse lex specialis en la medida en que dichos requisitos sean al menos equivalentes a las disposiciones correspondientes de la presente Directiva.

(11) Al identificar a los operadores del sector del transporte marítimo y fluvial, los Estados miembros deben tener en cuenta los códigos y directrices internacionales existentes o que se puedan elaborar en el futuro, en particular, por parte de la Organización Marítima Internacional, con el fin de proporcionar a los diferentes operadores marítimos un planteamiento coherente.

(12) La regulación y la supervisión del sector bancario y de las infraestructuras de los mercados financieros han sido objeto de una elevada armonización en la Unión mediante el recurso al Derecho primario y al Derecho derivado de la Unión y a normas elaboradas junto con las autoridades europeas de supervisión. Dentro de la Unión Bancaria, el Mecanismo Único de Supervisión garantiza la aplicación y supervisión de dichos requisitos. En los Estados miembros que no forman parte de la Unión Bancaria, son los reguladores bancarios competentes de cada Estado miembro los que garantizan dicha función. En otros ámbitos de regulación del sector financiero, el Sistema Europeo de Supervisión Financiera también garantiza un alto grado de uniformidad y convergencia de las prácticas de supervisión. La Autoridad Europea de Valores y Mercados también desempeña una función directa de supervisión para determinadas entidades, concretamente las agencias de calificación crediticia y los registros de operaciones.

(13) El riesgo operativo es un componente fundamental de la regulación y la supervisión prudenciales en los sectores de la banca y las infraestructuras del mercado financiero. Dicho riesgo se extiende a todas las operaciones, incluidas la seguridad, la integridad y la resistencia de las redes y sistemas de información. Los requisitos relativos a estos sistemas, que a menudo son más estrictos que los establecidos en la presente Directiva, se recogen en una serie de actos jurídicos de la Unión que incluyen normas sobre el acceso a la actividad de las entidades de crédito y a la supervisión prudencial de las entidades de crédito y las empresas de inversión, y normas sobre los requisitos prudenciales aplicables a las entidades de crédito y las empresas de inversión, que incluyen requisitos sobre el riesgo operativo; normas sobre los mercados de instrumentos financieros, que incluyen requisitos sobre evaluación de riesgos para las empresas de inversión y los mercados regulados; normas sobre los derivados extrabursátiles, las entidades de contrapartida central y los registros de operaciones, que incluyen requisitos sobre el riesgo operativo para dichas entidades y registros; y normas sobre la mejora de la liquidación de valores en la Unión y sobre los depositarios centrales de valores, que incluyen requisitos sobre el riesgo operativo. Por otra parte, los requisitos de notificación de incidentes forman parte de la práctica normal en materia de supervisión en el sector financiero y están incluidos a menudo en los manuales de supervisión. Los Estados miembros deben tener en cuenta dichas normas y requisitos a la hora de aplicar la lex specialis.

(14) Como ya observó el Banco Central Europeo en su dictamen de 25 de julio de 2014 (6), la presente Directiva no afecta al régimen de supervisión de los sistemas de pago y liquidación del Eurosistema en virtud del Derecho de la Unión. Conviene que las autoridades responsables de esa supervisión intercambien experiencias sobre cuestiones relacionadas con la seguridad de las redes y sistemas de información con las autoridades competentes en virtud de la presente Directiva. Esta consideración se aplica asimismo a los miembros del Sistema Europeo de Bancos Centrales que no sean miembros de la zona Euro y que ejerzan esa supervisión de los sistemas de pago y liquidación sobre la base de disposiciones legales y reglamentarias nacionales.

(15) Los mercados en línea permiten a consumidores y comerciantes celebrar contratos de compraventa o de prestación de servicios en línea con comerciantes, y son el destino final de celebración de tales contratos. Esos mercados no deben tener por objeto servicios en línea que constituyan únicamente un paso intermedio para acceder a servicios prestados por terceros a través de los que finalmente se pueda celebrar un contrato. Por consiguiente, no deben tener por objeto servicios en línea que comparen el precio de los productos o servicios de diferentes comerciantes para luego dirigir al usuario hacia el comerciante al que este prefiera comprar el producto. Los servicios informáticos prestados por el mercado en línea pueden incluir servicios de tramitación de transacciones, agregación de datos o elaboración de perfiles de los usuarios. Las tiendas de aplicaciones, que funcionan como tiendas en línea que posibilitan la distribución digital de aplicaciones o programas informáticos de terceros, deben ser consideradas un tipo de mercado en línea.

(16) Los motores de búsqueda en línea permiten al usuario realizar búsquedas, en principio, en todos los sitios web, a partir de una consulta sobre cualquier tema. También pueden restringirse a sitios web en una lengua determinada. La definición de «motor de búsqueda en línea» de la presente Directiva no debe incluir las funciones de búsqueda que se limiten al contenido de un sitio web en concreto, con independencia de que la función de búsqueda la proporcione un motor de búsqueda externo. Tampoco debe incluir, por consiguiente, servicios en línea que comparen el precio de los distintos productos o servicios de diferentes comerciantes para luego dirigir al usuario hacia el comerciante al que se prefiera comprar el producto.

(17) Los servicios de computación en nube abarcan toda una serie de actividades que pueden realizarse según diferentes modelos. A efectos de la presente Directiva, se entiende por «servicios de computación en nube» aquellos servicios que permiten acceder a un conjunto modulable y elástico de recursos informáticos que se pueden compartir. Esos «servicios de computación» incluyen recursos tales como las redes, servidores u otras infraestructuras, sistemas de almacenamiento, aplicaciones y servicios. El término «modulable» se refiere a los recursos de computación que el proveedor de servicios en nube puede asignar de manera flexible con independencia de la localización geográfica de los recursos para hacer frente a fluctuaciones de la demanda. El término «elástico» se usa para describir los recursos de los que se abastece y que se ponen a la venta según la demanda, de modo que se puedan aumentar o reducir con rapidez los recursos disponibles en función de la carga de trabajo. La expresión «que se pueden compartir» se usa para describir recursos informáticos que se proporcionan a múltiples usuarios que comparten un acceso común al servicio pero la tramitación se lleva a cabo por separado para cada usuario, aunque el servicio se preste desde el mismo equipo electrónico.

(18) La función de un punto de intercambio de internet (en lo sucesivo, «IXP», por sus siglas en inglés de «internet exchange point») es conectar redes entre sí. Un IXP no proporciona acceso a la red ni actúa como proveedor o transportista de servicios de tránsito. Tampoco presta otros servicios ajenos a la interconexión, aunque ello no impide que un IXP preste tales servicios. El IXP existe para conectar entre sí redes que están técnica y organizativamente diferenciadas. El término «sistema autónomo» se emplea para describir una red que es técnicamente independiente.

(19) Los Estados miembros deben ser responsables de determinar qué entidades cumplen los criterios de la definición de «operador de servicios esenciales». A efectos de garantizar un planteamiento coherente, la definición de operador de servicios esenciales debe ser aplicada de manera coherente por todos los Estados miembros. A tal fin, la presente Directiva prevé un examen de las entidades que desarrollan su actividad en sectores y subsectores específicos, el establecimiento de una lista de servicios esenciales, la consideración de una lista común de factores intersectoriales que permitan determinar si un incidente potencial tendría un efecto perturbador significativo, un proceso de consulta en el que participen los Estados miembros pertinentes en el caso de las entidades que prestan servicios en varios Estados miembros, y el apoyo del Grupo de cooperación en el proceso de identificación. Con el fin de garantizar que los cambios que puedan producirse en el mercado se tengan debidamente en cuenta, los Estados miembros deben revisar periódicamente la lista de operadores identificados y actualizarla cuando sea necesario. Por último, los Estados miembros deben presentar a la Comisión la información necesaria para valorar en qué medida este método común ha permitido que los Estados miembros apliquen la definición de modo coherente.

(20) En el proceso de identificación de los operadores de servicios esenciales, los Estados miembros deben valorar, como mínimo para cada uno de los subsectores que se indican en la presente Directiva, qué servicios han de considerarse esenciales para el mantenimiento de actividades sociales y económicas vitales y determinar si las entidades enumeradas en los sectores y subsectores que se indican en la presente Directiva y que prestan esos servicios cumplen los criterios de identificación de los operadores. Al valorar si una entidad presta un servicio que es esencial para el mantenimiento de actividades sociales o económicas cruciales, basta con examinar si la entidad presta un servicio que esté incluido en la lista de servicios esenciales. Por otra parte, debe demostrarse que la prestación del servicio esencial depende de redes y sistemas de información. Por último, al valorar si un incidente en las redes y sistemas de información relativo a la prestación del servicio tendría un efecto perturbador significativo en la prestación de este, los Estados miembros deben tener en cuenta una serie de factores intersectoriales, así como, en su caso, los factores sectoriales pertinentes.

(21) A efectos de la identificación de los operadores de servicios esenciales, el establecimiento en un Estado miembro implica el ejercicio real y efectivo de una actividad mediante una organización estable. La forma jurídica de dicha organización, ya sea a través de una sucursal o una filial con personalidad jurídica, no es el factor determinante a este respecto.

(22) Es posible que las entidades que operan en los sectores y subsectores que se indican en la presente Directiva presten tanto servicios esenciales como no esenciales. Por ejemplo, en el sector del transporte aéreo, los aeropuertos prestan servicios que un Estado miembro puede considerar esenciales, como la gestión de las pistas, pero también una serie de servicios que pueden considerarse no esenciales, como la oferta de zonas comerciales. Los operadores de servicios esenciales deben estar sujetos a los requisitos específicos de seguridad únicamente respecto de aquellos servicios que se consideren esenciales. Para la identificación de los operadores, los Estados miembros deben por lo tanto establecer una lista de los servicios que se consideren esenciales.

(23) La lista de servicios debe contener la totalidad de los servicios prestados en el territorio de un determinado Estado miembro que cumplan los requisitos establecidos en la presente Directiva. Los Estados miembros deben estar facultados para completar la lista existente incluyendo en ella nuevos servicios. La lista de servicios debe servir de referencia para que los Estados miembros puedan identificar a los operadores de servicios esenciales. Su finalidad es determinar los tipos de servicios esenciales en cada uno de los sectores que se indican en la presente Directiva, distinguiéndolos así de los servicios no esenciales de los que una entidad activa en un sector determinado pueda ser responsable. La lista de servicios establecida por cada Estado miembro sería otro elemento de utilidad para evaluar las prácticas normativas de cada Estado miembro con el fin de garantizar la coherencia global del proceso de identificación en todos los Estados miembros.

(24) Para los fines del proceso de identificación, cuando una entidad preste un servicio esencial en dos o más Estados miembros, estos deben entablar entre sí conversaciones bilaterales o multilaterales. Este proceso de consulta tiene por objeto ayudarles a valorar el carácter crítico del operador en términos de su impacto transfronterizo, permitiendo a cada Estado miembro participante exponer su punto de vista en lo que respecta a los riesgos asociados a los servicios prestados. Los Estados miembros interesados deben tener en cuenta los puntos de vista de los demás en este proceso, y deben poder solicitar la asistencia del Grupo de cooperación a este respecto.

(25) Como resultado del proceso de identificación, los Estados miembros deben adoptar medidas nacionales para determinar qué entidades están sujetas a obligaciones en materia de seguridad de las redes y sistemas de información. Este resultado podría alcanzarse mediante la elaboración de una lista en la que se enumere a todos los operadores de servicios esenciales, o bien mediante la adopción de medidas nacionales que incluyan criterios objetivos y cuantificables, como la producción del operador o el número de usuarios, que permitan determinar qué entidades han de quedar sujetas a las obligaciones en materia de seguridad de las redes y sistemas de información. Las medidas nacionales, con independencia de que ya existieran o de que se adopten en el contexto de la presente Directiva, deben incluir todas las medidas jurídicas y administrativas y las políticas que permitan identificar a los operadores de servicios esenciales a los efectos de la presente Directiva.

(26) Para dar una indicación de la importancia, en relación con el sector de que se trate, de los operadores identificados de servicios esenciales, los Estados miembros deben tener en cuenta el número y la magnitud de los operadores identificados, por ejemplo en términos de cuota de mercado o cantidad producida o transportada, sin necesidad de divulgar información que pueda revelar qué operadores han sido identificados.

(27) A fin de determinar si un incidente podría tener un efecto perturbador significativo, los Estados miembros deben tener en cuenta distintos factores, como el número de usuarios que confían en dicho servicio para fines tanto privados como profesionales. La utilización de ese servicio puede ser directa, indirecta o mediante intermediario. Al evaluar el impacto, en términos de magnitud y duración, que podría tener un incidente en las actividades económicas y sociales o en la seguridad pública, los Estados miembros deben considerar también el tiempo que probablemente tendría que transcurrir antes de que la discontinuidad empiece a tener repercusiones negativas.

(28) Además de los factores intersectoriales, deben también tenerse en cuenta factores específicamente sectoriales para determinar si un incidente tendría un efecto perturbador significativo en la prestación de un servicio esencial. En el caso de los proveedores de energía, esos factores podrían ser el volumen o la proporción de la energía nacional generada; en el caso de los proveedores de petróleo, el volumen diario; en el caso del transporte aéreo, incluidos aeropuertos y compañías aéreas, del transporte ferroviario y de los puertos marítimos, la proporción del volumen de tráfico nacional y el número de viajeros u operaciones de transporte de mercancías anuales; en el caso de la banca o las infraestructuras del mercado financiero, su importancia sistémica, valorada según los activos totales o la razón entre estos y el producto interior bruto; en el caso del sector sanitario, el número de pacientes atendidos cada año por el prestador de servicios sanitarios; en el caso de la producción, tratamiento y abastecimiento de agua, el volumen y el número y los tipos de usuarios abastecidos incluidos, por ejemplo, hospitales, organismos que presten servicios públicos o particulares, y la existencia de fuentes alternativas de suministro de agua para abastecer la misma zona geográfica.

(29) A fin de alcanzar y mantener un elevado nivel de seguridad de las redes y sistemas de información, cada Estado miembro debe disponer de una estrategia nacional de seguridad de las redes y sistemas de información que fijen los objetivos estratégicos y las medidas concretas que haya que aplicar.

(30) Habida cuenta de las diferencias existentes entre las estructuras nacionales de gobernanza y con el fin de salvaguardar las disposiciones sectoriales vigentes o los organismos de supervisión y regulación de la Unión ya existentes, y para evitar duplicidades, los Estados miembros deben poder designar a más de una autoridad nacional competente responsable de ejercer las funciones vinculadas a la seguridad de las redes y sistemas de información de los operadores de servicios esenciales y los proveedores de servicios digitales en virtud de la presente Directiva.

(31) Con el fin de facilitar la cooperación y la comunicación transfronterizas y de permitir una aplicación efectiva de la presente Directiva, es necesario que cada Estado miembro designe, sin perjuicio de las disposiciones normativas sectoriales, un punto de contacto único nacional que se encargue de coordinar las cuestiones relacionadas con la seguridad de las redes y sistemas de información y de la cooperación transfronteriza a escala de la Unión. Las autoridades competentes y los puntos de contacto único deben disponer de recursos técnicos, financieros y humanos adecuados para garantizar que puedan ejercer de manera efectiva y eficiente las funciones que se les atribuyen y alcanzar de este modo los objetivos de la presente Directiva. Dado que la finalidad de la presente Directiva es mejorar el funcionamiento del mercado interior mediante la creación de un clima de confianza y seguridad, los organismos de los Estados miembros deben poder cooperar eficazmente con los agentes económicos y han de estar estructurados en consecuencia.

(32) Las autoridades competentes o los equipos de respuesta a incidentes de seguridad informática (en lo sucesivo, «CSIRT», por sus siglas en inglés de «computer security incident response teams») deben recibir las notificaciones de los incidentes. Los puntos de contacto únicos no deben recibir directamente ninguna notificación de incidente, salvo en caso de que actúen también como autoridad competente o como CSIRT. No obstante, una autoridad competente o un CSIRT ha de poder encargar al punto de contacto único que transmita notificaciones de incidentes a los puntos de contacto únicos de los demás Estados miembros afectados.

(33) Para garantizar que la información se facilite efectivamente a los Estados miembros y a la Comisión, el punto de contacto único debe presentar un informe resumido al Grupo de cooperación, y este debe estar anonimizado para proteger la confidencialidad de las notificaciones y la identidad de los operadores de servicios esenciales y los proveedores de servicios digitales, dado que, para el intercambio de información sobre buenas prácticas dentro del Grupo de cooperación, no es necesaria información sobre la identidad de las entidades notificantes. El informe resumido debe contener información sobre el número de notificaciones recibidas y sobre las características de los incidentes notificados, como los tipos de vulneraciones de la seguridad, su gravedad o su duración.

(34) Los Estados miembros deben disponer de capacidades técnicas y de organización adecuadas para poder adoptar medidas de prevención, detección, respuesta y mitigación de los incidentes y riesgos que afecten a las redes y sistemas de información. Los Estados miembros deben asegurarse por tanto de que disponen de CSIRT que funcionen adecuadamente y cumplan los requisitos esenciales para así disponer de capacidades efectivas y compatibles que permitan hacer frente a incidentes y riesgos y garantizar una cooperación eficaz a escala de la Unión. Con el fin de que todos los tipos de operadores de servicios esenciales y proveedores de servicios digitales gocen de este tipo de capacidades y posibilidades de cooperación, los Estados miembros deben asegurarse de que todos ellos queden cubiertos por un CSIRT designado. Dada la importancia de la cooperación internacional en materia de ciberseguridad, los CSIRT deben tener la posibilidad de participar en redes internacionales de cooperación además de la red de CSIRT establecida en virtud de la presente Directiva.

(35) La cooperación entre los sectores público y privado es esencial dado que la mayor parte de las redes y sistemas de información es de gestión privada. Se debe alentar a los operadores de servicios esenciales y proveedores de servicios digitales a crear sus propios mecanismos de cooperación informal para garantizar la seguridad de las redes y sistemas de información. Cuando sea indicado, el Grupo de cooperación ha de poder invitar a los interesados a las discusiones. Para fomentar eficazmente el intercambio de información y buenas prácticas, es esencial garantizar que los operadores de servicios esenciales y los proveedores de servicios digitales que participan en dichos intercambios no queden en desventaja a causa de su cooperación.

(36) La ENISA debe prestar asistencia a los Estados miembros y a la Comisión ofreciéndoles su experiencia, conocimientos y asesoramiento y facilitando el intercambio de buenas prácticas. En particular, a la hora de aplicar la presente Directiva, la Comisión debe consultar a la ENISA, y los Estados miembros deben poder hacerlo. Para desarrollar las capacidades y los conocimientos en los Estados miembros, el Grupo de cooperación debe servir también de instrumento para intercambiar información sobre buenas prácticas, discutir sobre las capacidades y el grado de preparación de los Estados miembros y, a título voluntario, prestar ayuda a los miembros del grupo para evaluar las estrategias nacionales en materia de seguridad de las redes y sistemas de información, la creación de capacidades y los ejercicios de evaluación relativos a la seguridad de las redes y sistemas de información.

(37) En su caso, los Estados miembros deben poder utilizar o adaptar las estructuras organizativas o las estrategias existentes al aplicar la presente Directiva.

(38) Las funciones del Grupo de cooperación y las de la ENISA son interdependientes y complementarias. En general, la ENISA debe ayudar al Grupo de cooperación en la ejecución de sus funciones, en consonancia con el objetivo de aquella, establecido en el Reglamento (UE) nº 526/2013 del Parlamento Europeo y del Consejo (7), a saber, ayudar a las instituciones, órganos y organismos de la Unión y a los Estados miembros a aplicar las políticas necesarias para cumplir los requisitos legales y reglamentarios relativos a la seguridad de las redes y de la información que figuran en actos jurídicos actuales y futuros de la Unión. En particular, la ENISA debe prestar asistencia en aquellos ámbitos que corresponden a sus propias funciones, enumeradas en el Reglamento (UE) nº 526/2013, a saber, analizar las estrategias de la seguridad de las redes y los sistemas de información, apoyar la organización y realización de ejercicios relativos a la seguridad de las redes y sistemas de información a escala de la Unión e intercambiar información y buenas prácticas en materia de sensibilización y formación. La ENISA también debe participar en la elaboración de las directrices aplicables a los criterios sectoriales de determinación de la gravedad de las repercusiones de un incidente.

(39) A fin de promover un elevado nivel de seguridad de las redes y sistemas de información, el Grupo de cooperación debe, en su caso, cooperar con las instituciones, órganos y organismos de la Unión para intercambiar conocimientos prácticos y buenas prácticas, y para ofrecer asesoramiento sobre aspectos de seguridad de las redes y sistemas de información que puedan incidir en la labor de dichas instituciones, órganos y organismos, sin dejar de respetar las disposiciones vigentes en materia de intercambio de información restringida. Cuando coopere con las autoridades policiales en los aspectos relacionados con la seguridad de las redes y de la información que puedan incidir en la labor de dichas autoridades, el Grupo de cooperación debe respetar los canales de información existentes y las redes establecidas.

(40) La información sobre incidentes tiene cada vez mayor utilidad para la población en general y para las empresas, en particular las pequeñas y medianas empresas. En algunos casos, este tipo de información ya se proporciona a través de sitios web de ámbito nacional, en la lengua de un país concreto, dedicados principalmente a incidentes y sucesos con una dimensión nacional. Dado que las empresas operan cada vez más con carácter transfronterizo y que los particulares utilizan servicios en línea, la información sobre incidentes debe facilitarse de modo agregado a escala de la Unión. Es conveniente que la secretaría de la red de CSIRT mantenga un sitio web, o dedique una página dentro de un sitio web existente, en el que se ponga a disposición del público información general sobre los principales incidentes en materia de seguridad que afecten a las redes y sistemas de información acaecidos en toda la Unión, prestando una atención especial a los intereses y necesidades de las empresas. Conviene asimismo que los CSIRT que participen en dicha red faciliten con carácter voluntario la información que deba publicarse en ese sitio web, sin incluir información confidencial o delicada.

(41) Cuando la información se considere confidencial de conformidad con las normas nacionales y de la Unión en materia de confidencialidad empresarial, debe mantenerse ese carácter confidencial a la hora de desarrollar las actividades y cumplir los objetivos establecidos en la presente Directiva.

(42) Los ejercicios que simulan en tiempo real situaciones asociadas a un incidente son esenciales para comprobar el grado de preparación de los Estados miembros y su capacidad de cooperación por lo que respecta a la seguridad de las redes y sistemas de información. El ciclo de ejercicios denominado CyberEurope, coordinado por la ENISA con la participación de los Estados miembros, es una herramienta útil para hacer pruebas y elaborar recomendaciones sobre el modo de ir mejorando la gestión de incidentes a escala de la Unión. Considerando que, en la actualidad, los Estados miembros no están obligados a planificar ejercicios ni a participar en ellos, la creación de la red de CSIRT en virtud de la presente Directiva ha de permitirles participar en ejercicios basados en una planificación precisa y en decisiones estratégicas. El Grupo de cooperación establecido en virtud de la presente Directiva debe discutir sobre las decisiones estratégicas relativas a los ejercicios, en particular, aunque no exclusivamente, por lo que respecta a la regularidad de los mismos y a la concepción de las hipótesis. La ENISA, de conformidad con su mandato, debe apoyar la organización y realización de ejercicios a escala de la Unión, ofreciendo sus conocimientos especializados y su asesoramiento al Grupo de coordinación y a la red de CSIRT.

(43) El alcance mundial de los problemas que afectan a la seguridad de las redes y sistemas de información hace necesaria una mayor cooperación internacional para mejorar las normas de seguridad y el intercambio de información, y promover un planteamiento global común con respecto a las cuestiones de seguridad.

(44) La responsabilidad de velar por la seguridad de las redes y sistemas de información recae en gran medida en los operadores de servicios esenciales y los proveedores de servicios digitales. Debe fomentarse una cultura de gestión de riesgos que implique una evaluación del riesgo y la aplicación de medidas de seguridad adecuadas a los riesgos que hay que afrontar, y esta se debe desarrollar a través de requisitos normativos adecuados y prácticas sectoriales voluntarias. Asimismo, es indispensable sentar unas condiciones de igualdad dignas de confianza para garantizar el funcionamiento efectivo del Grupo de cooperación y la red de CSIRT y, por ende, la cooperación efectiva de todos los Estados miembros.

(45) La presente Directiva se aplica únicamente a las administraciones públicas que hayan sido identificadas como operadores de servicios esenciales. Por consiguiente, es responsabilidad de los Estados miembros garantizar la seguridad de las redes y sistemas de información de las administraciones públicas que no estén incluidas en el ámbito de aplicación de la presente Directiva.

(46) Entre las medidas de gestión del riesgo figuran aquellas cuya finalidad es determinar todo riesgo de incidentes, prevenir, detectar y gestionar incidentes y mitigar sus repercusiones. La seguridad de las redes y sistemas de información comprende la seguridad de los datos conservados, transmitidos y procesados.

(47) Las autoridades competentes deben seguir estando facultadas para adoptar directrices nacionales acerca de las circunstancias en las que los operadores de servicios esenciales deben notificar incidentes.

(48) Numerosas empresas de la Unión recurren para prestar sus propios servicios a proveedores de servicios digitales. Dado que algunos servicios digitales pueden representar un recurso importante para sus usuarios, incluidos los operadores de servicios esenciales, y dado que esos usuarios no siempre pueden recurrir a otras opciones, la presente Directiva debe aplicarse también a los proveedores de ese tipo de servicios. La seguridad, continuidad y fiabilidad del tipo de servicios digitales a que se refiere la presente Directiva tienen una importancia capital para el buen funcionamiento de numerosas empresas. La perturbación de un servicio digital puede impedir la prestación de otros servicios que dependen de él y afectar, por lo tanto, a actividades económicas y sociales fundamentales en la Unión. Por esa razón, ese tipo de servicios digitales puede tener una importancia capital para el correcto funcionamiento de las empresas que dependen de ellos, y también para la participación de estas en el mercado interior y en el comercio transfronterizo en toda la Unión. Esos proveedores de servicios digitales que están sujetos a la presente Directiva son aquellos que prestan servicios digitales de los que muchas empresas de la Unión dependen cada vez más.

(49) Los proveedores de servicios digitales deben garantizar un nivel de seguridad acorde con el grado de riesgo que se plantea para la seguridad de los servicios digitales que presten, dada la importancia de sus servicios para las operaciones de otras empresas de la Unión. En la práctica, el grado de riesgo para los operadores de servicios esenciales, que son a menudo esenciales para el mantenimiento de actividades sociales y económicas cruciales, es superior al que corresponde a los proveedores de servicios digitales. Por consiguiente, los proveedores de servicios digitales deben estar sujetos a requisitos de seguridad menos rigurosos. Los proveedores de servicios digitales deben seguir pudiendo tomar las medidas que consideren oportunas a fin de gestionar los riesgos que se planteen para la seguridad de sus redes y servicios de información. Debido a su carácter transfronterizo, los proveedores de servicios digitales deben estar sujetos a un planteamiento más armonizado a escala de la Unión. La especificación y aplicación de las medidas correspondientes debe verse facilitada mediante actos de ejecución.

(50) Aunque los fabricantes de equipos informáticos y quienes desarrollan programas informáticos no sean operadores de servicios esenciales ni proveedores de servicios digitales, sus productos facilitan la seguridad de las redes y sistemas de información. Desempeñan por ello un importante papel al permitir que los operadores de servicios esenciales y los proveedores de servicios digitales garanticen la seguridad de sus redes e infraestructuras de información. Estos equipos y programas informáticos están ya sujetos a las normas vigentes en materia de responsabilidad por los daños causados por productos defectuosos.

(51) Las medidas técnicas y de organización impuestas a los operadores de servicios esenciales y a los proveedores de servicios digitales no deben requerir que se diseñe, desarrolle o fabrique de una manera especial un determinado producto comercial de tecnología de la información y la comunicación.

(52) Los operadores de servicios esenciales y los proveedores de servicios digitales deben garantizar la seguridad de las redes y sistemas que utilicen. Se trata fundamentalmente de redes y sistemas privados gestionados por el personal informático interno o cuya seguridad se ha encomendado a empresas externas. Los requisitos en materia de seguridad y notificación han de aplicarse a los operadores de servicios esenciales y a los proveedores de servicios digitales pertinentes, independientemente de si se encargan ellos mismos del mantenimiento de sus redes y sistemas de información o lo subcontratan.

(53) Para no imponer una carga financiera y administrativa desproporcionada a los operadores de servicios esenciales y a los proveedores de servicios digitales, los requisitos han de ser proporcionados en relación con los riesgos que presenta la red y el sistema de información en cuestión, y tener en cuenta el estado de la técnica. En el caso de los proveedores de servicios digitales, esos requisitos no deben aplicarse ni a las microempresas ni a las pequeñas empresas.

(54) Las administraciones públicas de los Estados miembros que utilizan servicios ofrecidos por proveedores de servicios digitales, en particular servicios de computación en nube, pueden considerar conveniente exigir a los proveedores de tales servicios medidas de seguridad adicionales, más estrictas que las que dichos proveedores ofrecerían normalmente en cumplimiento de los requisitos de la presente Directiva. Han de poder hacerlo mediante obligaciones contractuales.

(55) Las definiciones de mercados digitales, motores de búsqueda en línea y servicios de computación en nube formuladas en la presente Directiva han de entenderse a los efectos específicos de esta, y sin perjuicio de cualquier otro instrumento.

(56) La presente Directiva no debe ser óbice para que los Estados miembros adopten medidas nacionales que obliguen a los organismos del sector público a garantizar unas condiciones de seguridad específicas cuando contraten servicios de computación en nube. Las medidas nacionales de ese tipo que se adopten deben aplicarse al organismo del sector público de que se trate, y no al proveedor de servicios de computación en nube.

(57) Dadas las diferencias fundamentales existentes entre los operadores de servicios esenciales, en particular por su vinculación directa con infraestructuras físicas, y los proveedores de servicios digitales, en particular por su carácter transfronterizo, debe adoptarse en la presente Directiva un planteamiento diferenciado con respecto al nivel de armonización aplicable a esos dos grupos de entidades. Para los operadores de servicios esenciales, los Estados miembros deben poder identificar a los operadores correspondientes e imponerles requisitos más estrictos que los previstos en la presente Directiva. Los Estados miembros no deben identificar a los proveedores de servicios digitales, ya que la presente Directiva debe aplicarse a todos los proveedores de servicios digitales incluidos en su ámbito de aplicación. Por otra parte, la presente Directiva y los actos de ejecución que se adopten en virtud de esta deben garantizar un elevado nivel de armonización para los proveedores de servicios digitales respecto de los requisitos de seguridad y notificación. Ello debe permitir que los proveedores de servicios digitales sean tratados de manera uniforme en toda la Unión, de una manera proporcionada en relación con su naturaleza y con el grado de riesgo al que puedan tener que hacer frente.

(58) La presente Directiva no debe impedir que los Estados miembros impongan requisitos de seguridad y notificación a entidades que no sean proveedores de servicios digitales comprendidos en el ámbito de aplicación de la presente Directiva, sin perjuicio de las obligaciones de los Estados miembros en virtud del Derecho de la Unión.

(59) Las autoridades competentes deben procurar que se mantengan los canales de intercambio de información informales y de confianza. Antes de dar publicidad a los incidentes notificados a las autoridades competentes, es preciso sopesar debidamente el interés de los ciudadanos en ser informados sobre amenazas que en términos comerciales y de reputación puedan sufrir los operadores de servicios esenciales y los proveedores de servicios digitales que notifican incidentes. A la hora de cumplir sus obligaciones de notificación, las autoridades competentes y los CSIRT han de tener muy en cuenta la necesidad de mantener estrictamente confidencial la información sobre los puntos vulnerables del producto antes de dar a conocer las soluciones de seguridad adecuadas.

(60) Los proveedores de servicios digitales deben estar sujetos a un tipo de supervisión ligera, reactiva y a posteriori, justificada por la naturaleza de sus servicios y operaciones. La autoridad competente de que se trate debe, por tanto, intervenir únicamente cuando obtenga pruebas, por ejemplo del propio proveedor de servicios digitales, de otra autoridad competente, incluida una autoridad competente de otro Estado miembro, o de un usuario del servicio, de que un proveedor de servicios digitales no cumple los requisitos de la presente Directiva, en particular después de que se haya producido un incidente. Por consiguiente, la autoridad competente no debe tener la obligación general de supervisar a los proveedores de servicios digitales.

(61) Las autoridades competentes deben disponer de los medios necesarios para ejercer sus funciones, incluidas sus competencias para obtener información suficiente para evaluar el nivel de seguridad de las redes y sistemas de información.

(62) Los incidentes pueden ser consecuencia de actividades delictivas, cuya prevención, investigación y enjuiciamiento se ven facilitados por la coordinación y la cooperación entre los operadores de servicios esenciales, los proveedores de servicios digitales, las autoridades competentes y las autoridades policiales. Cuando se sospeche que un incidente guarda relación con actividades delictivas graves en virtud del Derecho de la Unión o nacional, los Estados miembros deben alentar a los operadores de servicios esenciales y a los proveedores de servicios digitales a notificar personalmente a las autoridades policiales competentes los incidentes de naturaleza presuntamente delictiva y grave. Es deseable que el Centro Europeo de Ciberdelincuencia (EC3) y la ENISA faciliten, en su caso, la coordinación entre las autoridades competentes y las autoridades policiales de los diferentes Estados miembros.

(63) En numerosas ocasiones los datos de carácter personal se ven comprometidos a raíz de incidentes. En este contexto, las autoridades competentes y las autoridades responsables de la protección de datos han de cooperar e intercambiar la información sobre todos los asuntos pertinentes ante las violaciones de datos personales derivadas de incidentes.

(64) La competencia judicial respecto de los proveedores de servicios digitales debe atribuirse al Estado miembro en el que el operador tenga en la Unión su establecimiento principal, que corresponde en principio al lugar en el que el proveedor tiene su domicilio social en la Unión. Por establecimiento se entiende el ejercicio real y efectivo de una actividad mediante una organización estable. La forma jurídica de dicha organización, ya sea a través de una sucursal o una filial con personalidad jurídica, no es el factor determinante a este respecto. Este criterio no debe depender de que las redes y sistemas de información estén o no físicamente situados en un lugar determinado; la presencia y utilización de tales sistemas no pueden asimilarse por sí mismos a la existencia del mencionado establecimiento principal y no constituyen, por tanto, criterios para determinar el establecimiento principal.

(65) Cuando un proveedor de servicios digitales que no esté establecido en la Unión ofrezca servicios en ella, debe designar a un representante. Para determinar si dicho proveedor de servicios digitales ofrece servicios en la Unión, debe averiguarse si hay constancia de que el proveedor de servicios digitales tiene la intención de ofrecer servicios a personas de uno o varios Estados miembros. La simple accesibilidad en la Unión del sitio web del proveedor de servicios digitales o de un intermediario, o de una dirección de correo electrónico y otros datos de contacto, o el empleo de una lengua de uso común en el país tercero en que esté establecido el proveedor de servicios digitales, no basta para determinar dicha intención. No obstante, factores como el empleo de una lengua o una moneda, de uso común en uno o varios Estados miembros, con la posibilidad de encargar servicios en esa otra lengua, o la mención de clientes o usuarios que estén en la Unión, puede revelar que el proveedor de servicios digitales tiene la intención de ofrecer servicios en la Unión. El representante debe actuar por cuenta del proveedor de servicios digitales, y las autoridades competentes o los CSIRT han de poder ponerse en contacto con él. El representante debe haber sido designado expresamente mediante un mandato escrito del proveedor de servicios digitales que le autorice para actuar por cuenta de este en lo que respecta a las obligaciones del proveedor en virtud de la presente Directiva, también por lo que respecta a la obligación de notificación de incidentes.

(66) La normalización de los requisitos en materia de seguridad es un proceso impulsado por el mercado. Al objeto de garantizar una aplicación convergente de las normas de seguridad, los Estados miembros han de fomentar el cumplimiento de normas específicas o la conformidad con ellas para así lograr un elevado nivel de seguridad de las redes y sistemas de información en la Unión. La ENISA debe prestar asistencia a los Estados miembros ofreciéndoles asesoramiento y directrices. A tal fin, podría ser útil elaborar normas armonizadas, de conformidad con el Reglamento (UE) nº 1025/2012 del Parlamento Europeo y del Consejo (8).

(67) Puede ocurrir que entidades no incluidas en el ámbito de aplicación de la presente Directiva sufran incidentes que tengan efectos significativos en los servicios que prestan. Cuando tales entidades consideren de interés público notificar que se han producido esos incidentes, deben poder hacerlo a título voluntario. Tales notificaciones solo deben ser tramitadas por la autoridad competente o por el CSIRT cuando su tramitación no suponga una carga desproporcionada o injustificada para los Estados miembros afectados.

(68) A fin de garantizar condiciones uniformes de ejecución de la presente Directiva, deben conferirse a la Comisión competencias de ejecución para establecer, por una parte, las disposiciones de procedimiento necesarias para el funcionamiento del Grupo de cooperación y, por otra, los requisitos de seguridad y notificación aplicables a los proveedores de servicios digitales. Esas competencias deben ejercerse de conformidad con el Reglamento (UE) nº 182/2011 del Parlamento Europeo y del Consejo (9). Al adoptar actos de ejecución relacionados con las disposiciones de procedimiento necesarias para el funcionamiento del Grupo de cooperación, la Comisión debe tener plenamente en cuenta el dictamen de la ENISA.

(69) Al adoptar actos de ejecución relacionados con los requisitos de seguridad aplicables a los proveedores de servicios digitales, la Comisión debe tener plenamente en cuenta el dictamen de la ENISA y debe consultar a los interesados. Además, se alienta a la Comisión a que tenga en cuenta los siguientes ejemplos: por lo que respecta a la seguridad de los sistemas e instalaciones: la seguridad física y del entorno, la seguridad de abastecimiento, el control del acceso a las redes y sistemas de información y la integridad de las redes y sistemas de información; por lo que respecta a la gestión de incidentes: los procedimientos de gestión de incidentes, las capacidades de detección de incidentes, la información y comunicación sobre incidentes; por lo que respecta a la gestión de la continuidad de las actividades: la estrategia de continuidad de los servicios y los planes para contingencias y las capacidades de recuperación en caso de catástrofe; y, por lo que respecta a la supervisión, la auditoría y los ensayos: las políticas de supervisión y registro, la planificación de contingencias durante los ejercicios, los ensayos con las redes y sistemas de información, las evaluaciones de seguridad y el control del cumplimiento de la normativa.

(70) Al aplicar la presente Directiva, la Comisión debe mantener contactos, según corresponda, con los comités sectoriales y organismos pertinentes establecidos a escala de la Unión en los ámbitos a los que se aplica la presente Directiva.

(71) La Comisión debe revisar periódicamente lo dispuesto en la presente Directiva, en consulta con los interesados, en particular para determinar si se precisa alguna modificación a raíz de cambios en la situación social, política, de la tecnología o el mercado.

(72) El intercambio de información sobre riesgos e incidentes que ha de llevarse a cabo en el Grupo de cooperación y la red de los CSIRT, y el cumplimiento de la obligación de notificar los incidentes a las autoridades nacionales competentes o a los CSIRT, pueden hacer necesario el tratamiento de datos personales. Dicho tratamiento debe cumplir lo dispuesto en la Directiva 95/46/CE del Parlamento Europeo y del Consejo (10) y en el Reglamento (CE) nº 45/2001 del Parlamento Europeo y del Consejo (11). Al aplicar la presente Directiva, se debe aplicar, según corresponda, el Reglamento (CE) nº 1049/2001 del Parlamento Europeo y del Consejo (12).

(73) El Supervisor Europeo de Protección de Datos, consultado de conformidad con el artículo 28, apartado 2, del Reglamento (CE) nº 45/2001, emitió un dictamen el 14 de junio de 2013 (13).

(74) Dado que el objetivo de la presente Directiva, a saber, garantizar un elevado nivel común de seguridad de las redes y sistemas de información en la Unión, no puede ser alcanzado de manera suficiente por los Estados miembros, sino que, debido a los efectos de la acción, puede lograrse mejor a escala de la Unión, esta puede adoptar medidas, de acuerdo con el principio de subsidiariedad establecido en el artículo 5 del Tratado de la Unión Europea. De conformidad con el principio de proporcionalidad establecido en el mismo artículo, la presente Directiva no excede de lo necesario para alcanzar dicho objetivo.

(75) La presente Directiva observa los derechos fundamentales y los principios reconocidos por la Carta de los Derechos Fundamentales de la Unión Europea, en particular, el derecho al respeto de la vida privada y las comunicaciones, el derecho a la protección de los datos de carácter personal, la libertad de empresa, el derecho a la propiedad, el derecho a una tutela judicial efectiva y el derecho a ser oído. La presente Directiva debe aplicarse de conformidad con estos derechos y principios.

HAN ADOPTADO LA PRESENTE DIRECTIVA:

CAPÍTULO I.- DISPOSICIONES GENERALES

Artículo 1.- Objeto y ámbito de aplicación

La presente Directiva establece medidas con el objeto de lograr un elevado nivel común de seguridad de las redes y sistemas de información dentro de la Unión a fin de mejorar el funcionamiento del mercado interior.

A tal fin, la presente Directiva:

a) establece obligaciones para todos los Estados miembros de adoptar una estrategia nacional de seguridad de las redes y sistemas de información;

b) crea un Grupo de cooperación para apoyar y facilitar la cooperación estratégica y el intercambio de información entre los Estados miembros y desarrollar la confianza y seguridad entre ellos;

c) crea una red de equipos de respuesta a incidentes de seguridad informática (en lo sucesivo, «red de CSIRT», por sus siglas en inglés de «computer security incident response teams») con el fin de contribuir al desarrollo de la confianza y seguridad entre los Estados miembros y promover una cooperación operativa rápida y eficaz;

d) establece requisitos en materia de seguridad y notificación para los operadores de servicios esenciales y para los proveedores de servicios digitales;

e) establece obligaciones para que los Estados miembros designen autoridades nacionales competentes, puntos de contacto únicos y CSIRT con funciones relacionadas con la seguridad de las redes y sistemas de información.

Los requisitos de seguridad y notificación previstos en la presente Directiva no serán aplicables a las empresas que están sujetas a los requisitos de los artículos 13 bis y 13 ter de la Directiva 2002/21/CE ni a los proveedores de servicios de confianza sujetos a los requisitos del artículo 19 del Reglamento (UE) nº 910/2014.

La presente Directiva se entenderá sin perjuicio de la Directiva 2008/114/CE del Consejo (14) y las Directivas 2011/93/UE (15) y 2013/40/UE (16) del Parlamento Europeo y del Consejo.

Sin perjuicio de lo dispuesto en el artículo 346 del TFUE, la información que se considere confidencial de acuerdo con las normas de la Unión y nacionales, como las normas sobre confidencialidad empresarial, se intercambiará con la Comisión y otras autoridades competentes únicamente cuando tal intercambio sea necesario a efectos de la aplicación de la presente Directiva. La información que se intercambie se limitará a aquella que resulte pertinente y proporcionada para la finalidad del intercambio. Dicho intercambio de información preservará la confidencialidad de esta y protegerá los intereses de seguridad y comerciales de los operadores de servicios esenciales y de los proveedores de servicios digitales.

La presente Directiva se entenderá sin perjuicio de las acciones emprendidas por los Estados miembros para salvaguardar sus funciones estatales esenciales, en particular para salvaguardar la seguridad nacional, incluidas las acciones que protejan la información cuya revelación los Estados miembros consideren contraria a los intereses esenciales de su seguridad, y para mantener el orden público, en particular para permitir la investigación, la detección y el enjuiciamiento de infracciones penales.

Se aplicará lo dispuesto en un acto jurídico sectorial de la Unión, cuando este requiera que los operadores de servicios esenciales o los proveedores de servicios digitales garanticen la seguridad de sus redes y sistemas de información o notifiquen incidentes, siempre que dichos requisitos tengan al menos un efecto equivalente al de las obligaciones establecidas en la presente Directiva.

Artículo 2.- Tratamiento de datos personales

El tratamiento de datos personales conforme a la presente Directiva se llevará a cabo de conformidad con la Directiva 95/46/CE.

El tratamiento de datos personales por las instituciones y los órganos de la Unión conforme a la presente Directiva se llevará a cabo de conformidad con el Reglamento (CE) nº 45/2001.

Artículo 3.- Armonización mínima

Sin perjuicio de lo dispuesto en el artículo 16, apartado 10, y de sus obligaciones en virtud del Derecho de la Unión, los Estados miembros podrán adoptar o mantener disposiciones con el objeto de alcanzar un mayor nivel de seguridad de las redes y sistemas de información.

Artículo 4.- Definiciones

A los efectos de la presente Directiva, se entenderá por:

1) «redes y sistemas de información»:

a) una red de comunicaciones electrónicas en el sentido del artículo 2, letra a), de la Directiva 2002/21/CE;

b) todo dispositivo o grupo de dispositivos interconectados o relacionados entre sí en el que uno o varios de ellos realizan, mediante un programa, el tratamiento automático de datos digitales, o

c) los datos digitales almacenados, tratados, recuperados o transmitidos mediante elementos contemplados en las letras a) y b) para su funcionamiento, utilización, protección y mantenimiento;

2) «seguridad de las redes y sistemas de información»: la capacidad de las redes y sistemas de información de resistir, con un nivel determinado de fiabilidad, toda acción que comprometa la disponibilidad, autenticidad, integridad o confidencialidad de los datos almacenados, transmitidos o tratados, o los servicios correspondientes ofrecidos por tales redes y sistemas de información o accesibles a través de ellos;

3) «estrategia nacional de seguridad de las redes y sistemas de información»: un marco que proporciona prioridades y objetivos estratégicos de seguridad de las redes y sistemas de información a escala nacional;

4) «operador de servicios esenciales»: una entidad pública o privada de uno de los tipos que figuran en el anexo II, que reúna los criterios establecidos en el artículo 5, apartado 2;

5) «servicio digital»: un servicio en el sentido del artículo 1, apartado 1, letra b), de la Directiva (UE) 2015/1535 del Parlamento Europeo y del Consejo (17) que sea de uno de los tipos que figuran en el anexo III;

6) «proveedor de servicios digitales»: toda persona jurídica que preste un servicio digital;

7) «incidente»: todo hecho que tenga efectos adversos reales en la seguridad de las redes y sistemas de información;

8) «gestión de incidentes»: todos los procedimientos seguidos para detectar, analizar y limitar un incidente y responder ante este;

9) «riesgo»: toda circunstancia o hecho razonablemente identificable que tenga un posible efecto adverso en la seguridad de las redes y sistemas de información;

10) «representante»: toda persona física o jurídica establecida en la Unión que ha sido designada expresamente para actuar por cuenta de un proveedor de servicios digitales no establecido en la Unión, al que puede dirigirse una autoridad competente nacional o un CSIRT en sustitución del proveedor de servicios digitales, en lo que respecta a las obligaciones del proveedor de servicios digitales en virtud de la presente Directiva;

11) «norma»: una norma en el sentido del artículo 2, punto 1, del Reglamento (UE) nº 1025/2012;

12) «especificación»: una especificación técnica en el sentido del artículo 2, punto 4, del Reglamento (UE) nº 1025/2012;

13) «punto de intercambio de internet (»IXP«, por sus siglas en inglés de» internet exchange point«)»: una instalación de la red que permite interconectar más de dos sistemas autónomos independientes, principalmente para facilitar el intercambio de tráfico de internet; un IXP solo permite interconectar sistemas autónomos; un IXP no requiere que el tráfico de internet que pasa entre cualquier par de sistemas autónomos participantes pase por un tercer sistema autónomo, ni modifica ni interfiere de otra forma en dicho tráfico;

14) «servidor de sistema de nombres de dominio (»DNS«, por sus siglas en inglés de» domain name system«)»: un sistema de nombres de dominio distribuido jerárquicamente en una red que recibe consultas sobre nombres de dominio;

15) «proveedor de servicios de DNS»: una entidad que presta servicios de DNS en internet;

16) «registro de nombres de dominio de primer nivel»: una entidad que administra y dirige el registro de nombres de dominio de internet en un dominio específico de primer nivel;

17) «mercado en línea»: un servicio digital que permite a los consumidores o a los comerciantes, como se definen respectivamente en el artículo 4, apartado 1, letra a) y letra b), de la Directiva 2013/11/UE del Parlamento Europeo y del Consejo (18), celebrar contratos de compraventa o de servicios en línea con comerciantes, ya sea en el sitio web del mercado en línea o en un sitio web de un comerciante que utilice servicios informáticos proporcionados por el mercado en línea;

18) «motor de búsqueda en línea»: un servicio digital que permite a los usuarios hacer búsquedas de, en principio, todos los sitios web o de sitios web en una lengua en concreto mediante una consulta sobre un tema cualquiera en forma de palabra clave, frase u otro tipo de entrada, y que en respuesta muestra enlaces en los que puede encontrarse información relacionada con el contenido solicitado;

19) «servicio de computación en nube»: un servicio digital que hace posible el acceso a un conjunto modulable y elástico de recursos informáticos que se pueden compartir.

Artículo 5.- Identificación de operadores de servicios esenciales

A más tardar el 9 de noviembre de 2018, los Estados miembros identificarán a los operadores de servicios esenciales establecidos en su territorio para cada sector y subsector mencionados en el anexo II.

Los criterios para la identificación de operadores de servicios esenciales a que se refiere el artículo 4, punto 4, son los siguientes:

a) una entidad presta un servicio esencial para el mantenimiento de actividades sociales o económicas cruciales;

b) la prestación de dicho servicio depende de las redes y sistemas de información, y

c) un incidente tendría efectos perturbadores significativos en la prestación de dicho servicio.

A efectos del apartado 1, cada Estado miembro establecerá una lista de los servicios mencionados en el apartado 2, letra a).

A efectos del apartado 1, cuando una entidad preste un servicio tal como se contempla en el apartado 2, letra a), en dos o más Estados miembros, estos se consultarán entre ellos. Dicha consulta tendrá lugar antes de que se adopte una decisión sobre la identificación.

Los Estados miembros revisarán con regularidad, y al menos cada dos años a partir del 9 de mayo de 2018, la lista de operadores de servicios esenciales identificados y la actualizarán cuando proceda.

La misión del Grupo de cooperación será, de conformidad con las funciones contempladas en el artículo 11, apoyar a los Estados miembros para que adopten un planteamiento coherente en el proceso de identificación de los operadores de servicios esenciales.

A efectos de la revisión a que se refiere el artículo 23, a más tardar el 9 de noviembre de 2018, y cada dos años a partir de entonces, los Estados miembros remitirán a la Comisión la información necesaria para que pueda evaluar la aplicación de la presente Directiva, en particular la coherencia de los planteamientos de los Estados miembros respecto a la identificación de los operadores de servicios esenciales. Dicha información deberá contener, como mínimo:

a) las medidas nacionales que permitan identificar operadores de servicios esenciales;

b) la lista de servicios contemplada en el apartado 3;

c) el número de operadores de servicios esenciales identificados para cada uno de los sectores que figuran en el anexo II y una indicación de su importancia en relación con dicho sector;

d) los umbrales, cuando existan, para determinar el nivel de suministro pertinente en función del número de usuarios que confían en ese servicio a que hace referencia el artículo 6, apartado 1, letra a), o la importancia de ese operador concreto de servicios esenciales a que hace referencia el artículo 6, apartado 1, letra f).

A fin de contribuir a que se aporte información comparable, la Comisión, teniendo en cuenta en la mayor medida posible el dictamen de la Agencia de Seguridad de las Redes y de la Información de la Unión Europea (ENISA), podrá adoptar directrices técnicas adecuadas sobre parámetros para la información contemplada en el presente apartado.

Artículo 6.- Efecto perturbador significativo

A la hora de determinar la importancia de un efecto perturbador tal como se indica en el artículo 5, apartado 2, letra c), los Estados miembros tendrán en cuenta al menos los siguientes factores intersectoriales:

a) el número de usuarios que confían en los servicios prestados por la entidad de que se trate;

b) la dependencia de otros sectores que figuran en el anexo II sobre el servicio prestado por esa entidad;

c) la repercusión que podrían tener los incidentes, en términos de grado y duración, en las actividades económicas y sociales o en la seguridad pública;

d) la cuota de mercado de la entidad;

e) la extensión geográfica con respecto a la zona que podría verse afectada por un incidente;

f) la importancia de la entidad para mantener un nivel suficiente del servicio, teniendo en cuenta la disponibilidad de alternativas para la prestación de ese servicio.

A fin de determinar si un incidente podría tener efectos perturbadores significativos, los Estados miembros también tendrán en cuenta factores específicos del sector, cuando proceda.

CAPÍTULO II.- MARCOS NACIONALES DE SEGURIDAD DE LAS REDES Y SISTEMAS DE INFORMACIÓN

Artículo 7.- Estrategia nacional de seguridad de las redes y sistemas de información

Cada Estado miembro adoptará una estrategia nacional de seguridad de las redes y sistemas de información que establezca los objetivos estratégicos y las medidas políticas y normativas adecuadas con objeto de alcanzar y mantener un elevado nivel de seguridad de las redes y sistemas de información y que cubra al menos los sectores que figuran en el anexo II y los servicios que figuran en el anexo III. La estrategia nacional de seguridad de las redes y sistemas de información abordará, en particular, las cuestiones siguientes:

a) los objetivos y prioridades de la estrategia nacional de seguridad de las redes y sistemas de información;

b) un marco de gobernanza para lograr los objetivos y las prioridades de la estrategia nacional de seguridad de las redes y sistemas de información, incluidas las funciones y responsabilidades de las instituciones públicas y de los demás agentes pertinentes;

c) la identificación de medidas sobre preparación, respuesta y recuperación, incluida la cooperación entre los sectores público y privado;

d) una indicación de los programas de educación, concienciación y formación relacionados con la estrategia nacional de seguridad de las redes y sistemas de información;

e) una indicación de los programas de investigación y desarrollo relacionados con la estrategia nacional de seguridad de las redes y sistemas de información;

f) un plan de evaluación de riesgos para identificar riesgos;

g) una lista de los diversos agentes que participan en la ejecución de la estrategia de seguridad de las redes y sistemas de información.

Los Estados miembros podrán solicitar la asistencia de la ENISA a la hora de elaborar estrategias nacionales de seguridad de las redes y sistemas de información.

Los Estados miembros comunicarán sus estrategias nacionales de seguridad de las redes y sistemas de información a la Comisión en el plazo de tres meses a partir de su adopción. Al hacerlo, los Estados miembros podrán excluir elementos de la estrategia relacionados con la seguridad nacional.

Artículo 8.- Autoridades nacionales competentes y punto de contacto único

Cada Estado miembro designará una o más autoridades nacionales competentes en materia de seguridad de las redes y sistemas de información (en lo sucesivo, «autoridad competente») que cubra al menos los sectores que figuran en el anexo II y los servicios que figuran en el anexo III. Los Estados miembros podrán asignar esta función a una autoridad o autoridades existentes.

Las autoridades competentes supervisarán la aplicación de la presente Directiva a escala nacional.

Cada Estado miembro designará un punto de contacto único en materia de seguridad de las redes y sistemas de información (en lo sucesivo, «punto de contacto único»). Los Estados miembros podrán asignar esta función a una autoridad existente. Si un Estado miembro designa únicamente una autoridad competente, dicha autoridad también será el punto de contacto único.

El punto de contacto único ejercerá una función de enlace para garantizar la cooperación transfronteriza entre las autoridades de los Estados miembros y con las autoridades competentes en otros Estados miembros y con el Grupo de cooperación a que se refiere el artículo 11 y la red de CSIRT a que se refiere el artículo 12.

Los Estados miembros velarán por que las autoridades competentes y los puntos de contacto únicos dispongan de recursos adecuados para ejercer las funciones que les son asignadas de forma efectiva y eficiente y cumplir así los objetivos de la presente Directiva. Los Estados miembros garantizarán una cooperación efectiva, eficiente y segura de los representantes designados en el Grupo de cooperación

Las autoridades competentes y los puntos de contacto únicos, cuando proceda y de conformidad con el Derecho nacional, consultarán a las autoridades policiales nacionales competentes y a las autoridades nacionales responsables de la protección de datos y cooperarán con ellas.

Los Estados miembros notificarán sin dilación a la Comisión la autoridad competente y el punto de contacto único que hayan designado, sus funciones y cualquier cambio posterior que se introduzca. Los Estados miembros harán pública su designación de la autoridad competente y el punto de contacto único. La Comisión publicará la lista de puntos de contacto únicos designados.

Artículo 9.- Equipos de respuesta a incidentes de seguridad informática (CSIRT)

Cada Estado miembro designará uno o varios CSIRT que cumplan los requisitos establecidos en el anexo I, punto 1, que cubran al menos los sectores que figuran en el anexo II y los tipos de servicios digitales que figuran en el anexo III, responsables de la gestión de incidentes y riesgos de conformidad con un procedimiento claramente definido. Podrá crearse un CSIRT en el marco de una autoridad competente.

Los Estados miembros velarán por que los CSIRT designados dispongan de recursos adecuados para ejercer eficazmente sus funciones, tal como se establece en el anexo I, punto 2.

Los Estados miembros garantizarán una cooperación efectiva, eficiente y segura de sus CSIRT en la red de CSIRT a que hace referencia el artículo 12.

Los Estados miembros velarán por que sus CSIRT designados tengan acceso a una infraestructura de comunicación e información apropiada, segura y resiliente a escala nacional.

Los Estados miembros informarán a la Comisión del mandato y de los elementos principales del proceso de gestión de incidentes de sus CSIRT.

Los Estados miembros podrán solicitar la asistencia de la ENISA a la hora de crear CSIRT nacionales.

Artículo 10.- Cooperación a escala nacional

Cuando sean distintos, la autoridad competente, el punto de contacto único y los CSIRT del mismo Estado miembro cooperarán respecto al cumplimiento de las obligaciones establecidas en la presente Directiva.

Los Estados miembros velarán por que las autoridades competentes o los CSIRT reciban las notificaciones sobre incidentes presentadas en el marco de la presente Directiva. Cuando un Estado miembro decida que los CSIRT no recibirán notificaciones, se dará a estos últimos, en la medida necesaria para que cumplan sus funciones, el acceso a los datos sobre incidentes notificados por los operadores de servicios esenciales con arreglo al artículo 14, apartados 3 y 5, o por los proveedores de servicios digitales con arreglo al artículo 16, apartados 3 y 6.

Los Estados miembros velarán por que las autoridades competentes o los CSIRT informen a los puntos de contacto únicos sobre las notificaciones de incidentes presentadas en el marco de la presente Directiva.

A más tardar el 9 de agosto de 2018, y una vez al año a partir de entonces, el punto de contacto único presentará al Grupo de cooperación un informe resumido sobre las notificaciones recibidas, con mención del número de notificaciones y de la naturaleza de los incidentes notificados, así como de las acciones emprendidas de conformidad con el artículo 14, apartados 3 y 5, y el artículo 16, apartados 3 y 6.

CAPÍTULO III.- COOPERACIÓN

Artículo 11.- Grupo de cooperación

Se establece un Grupo de cooperación a fin de apoyar y facilitar la cooperación estratégica y el intercambio de información entre los Estados miembros y desarrollar confianza y seguridad, y a fin de alcanzar un elevado nivel común de seguridad de las redes y sistemas de información en la Unión.

El Grupo de cooperación ejercerá sus funciones con arreglo a los programas de trabajo bienales a que se refiere el apartado 3, párrafo segundo.

El Grupo de cooperación estará formado por representantes de los Estados miembros, la Comisión y la ENISA.

Cuando proceda, el Grupo de cooperación podrá invitar a representantes de los interesados pertinentes a que participen en su labor.

La Comisión se hará cargo de la secretaría.

El Grupo de cooperación ejercerá las siguientes funciones:

a) proporcionar orientación estratégica para las actividades de la red de CSIRT establecida en virtud del artículo 12;

b) intercambiar buenas prácticas cuando se intercambie información relativa a la notificación de incidentes tal como se contempla en el artículo 14, apartados 3 y 5, y en el artículo 16, apartados 3 y 6;

c) intercambiar buenas prácticas entre los Estados miembros y, en colaboración con la ENISA, asistir a los Estados miembros en el desarrollo de capacidades para garantizar la seguridad de las redes y sistemas de información;

d) discutir sobre las capacidades y la preparación de los Estados miembros, evaluar voluntariamente las estrategias nacionales de seguridad de las redes y sistemas de información y la eficacia de los CSIRT e identificar las buenas prácticas;

e) intercambiar información y buenas prácticas sobre concienciación y formación;

f) intercambiar información y buenas prácticas sobre investigación y desarrollo en materia seguridad de las redes y sistemas de información;

g) cuando proceda, intercambiar experiencias sobre asuntos relativos a seguridad de las redes y sistemas de información con las instituciones, órganos y organismos de la Unión competentes;

h) discutir sobre las normas y especificaciones a que hace referencia el artículo 19 con los representantes de los organismos europeos de normalización pertinentes;

i) recopilar información de buenas prácticas sobre los riesgos e incidentes que afecten a las redes y sistemas de información;

j) examinar anualmente los informes resumidos que menciona el artículo 10, apartado 3, párrafo segundo;

k) discutir sobre el trabajo emprendido con respecto a ejercicios relativos a la seguridad de las redes y sistemas de información, programas educativos y formación, incluido el trabajo realizado por la ENISA;

l) con la asistencia de la ENISA, intercambiar buenas prácticas con respecto a la identificación de operadores de servicios esenciales por parte de los Estados miembros, en particular en relación con las dependencias transfronterizas, en lo que atañe a riesgos e incidentes;

m) discutir sobre las modalidades para informar sobre notificaciones de incidentes tal como se contempla en los artículos 14 y 16;

A más tardar el 9 de febrero de 2018, y cada dos años a partir de entonces, el Grupo de cooperación establecerá un programa de trabajo sobre las acciones que deben emprenderse para realizar sus objetivos y funciones, que serán coherentes con los objetivos de la presente Directiva.

A efectos de la revisión a que se refiere el artículo 23, a más tardar el 9 de agosto de 2018, y cada año y medio a partir de entonces, el Grupo de cooperación elaborará un informe para valorar la experiencia adquirida con la cooperación estratégica contemplada en el presente artículo.

La Comisión adoptará actos de ejecución para establecer las disposiciones de procedimiento necesarias para el funcionamiento del Grupo de cooperación. Dichos actos de ejecución se adoptarán de conformidad con el procedimiento de examen a que se refiere el artículo 22, apartado 2.

A efectos del párrafo primero, la Comisión presentará al Comité el primer proyecto de acto de ejecución a que se refiere el artículo 22, apartado 1, a más tardar el 9 de febrero de 2017.

Artículo 12.- Red de CSIRT

A fin de contribuir a desarrollar la confianza y la seguridad entre los Estados miembros y promover una cooperación operativa rápida y eficaz, se establece una red de CSIRT nacionales.

La red de CSIRT estará formada por representantes de los CSIRT de los Estados miembros. La Comisión participará en la red de CSIRT en calidad de observador. La ENISA se hará cargo de la secretaría y apoyará activamente la cooperación entre los CSIRT.

La red de CSIRT desempeñará los siguientes cometidos:

a) intercambiar información sobre servicios, operaciones y capacidades de cooperación de los CSIRT;

b) a instancias de un representante de un CSIRT de un Estado miembro que pueda verse afectado por un incidente, intercambiar y discutir sobre información sensible de carácter no comercial relacionada con ese incidente y los riesgos asociados; no obstante, todo Estado miembro podrá negarse a contribuir a dicha discusión si existe riesgo de perjuicio para la investigación del incidente;

c) intercambiar y proporcionar voluntariamente información no confidencial sobre incidentes concretos;

d) a instancias de un representante de un CSIRT de un Estado miembro, discutir y, cuando sea posible, determinar una respuesta coordinada a un incidente que se haya identificado dentro del ámbito de competencias de ese Estado miembro;

e) prestar apoyo a los Estados miembros a la hora de abordar los incidentes transfronterizos sobre la base de su asistencia mutua voluntaria;

f) discutir, explorar e identificar más formas de cooperación operativa, incluidas las relacionadas con:

i) categorías de riesgos e incidentes,

ii) alertas tempranas,

iii) asistencia mutua,

iv) principios y modalidades de coordinación, cuando los Estados miembros respondan ante incidentes y riesgos transfronterizos de seguridad de las redes y sistemas de información;

g) informar al Grupo de cooperación sobre sus actividades y sobre las formas adicionales de cooperación operativa sobre las que se haya discutido conforme a la letra f), y solicitar directrices a este respecto;

h) discutir sobre la experiencia adquirida a partir de los ejercicios relativos a la seguridad de las redes y sistemas de información, entre ellas las organizadas por la ENISA;

i) a instancias de un CSIRT determinado, analizar las capacidades y la preparación de ese mismo CSIRT;

j) publicar directrices para facilitar la convergencia de prácticas operativas con respecto a la aplicación de lo dispuesto en el presente artículo en lo que atañe a la cooperación operativa.

A efectos de la revisión que contempla el artículo 23, a más tardar el 9 de agosto de 2018, y cada año y medio a partir de entonces, la red de CSIRT elaborará un informe en el que se examine la experiencia adquirida a través de la cooperación operativa, en particular las conclusiones y recomendaciones, practicada con arreglo al presente artículo. Dicho informe también se enviará al Grupo de cooperación.

La red de CSIRT establecerá su reglamento interno.

Artículo 13.- Cooperación internacional

La Unión podrá celebrar, de conformidad con el artículo 218 del TFUE, acuerdos internacionales con terceros países u organizaciones internacionales que hagan posible y organicen su participación en algunas actividades del Grupo de cooperación. En tales acuerdos se tendrá en cuenta la necesidad de garantizar una protección de datos adecuada.

CAPÍTULO IV.- SEGURIDAD DE LAS REDES Y SISTEMAS DE INFORMACIÓN DE LOS OPERADORES DE SERVICIOS ESENCIALES

Artículo 14.- Requisitos en materia de seguridad y notificación de incidentes

Los Estados miembros velarán por que los operadores de servicios esenciales tomen las medidas técnicas y de organización adecuadas y proporcionadas para gestionar los riesgos que se planteen para la seguridad de las redes y sistemas de información que utilizan en sus operaciones. Habida cuenta de la situación, dichas medidas garantizarán un nivel de seguridad de las redes y sistemas de información adecuado en relación con el riesgo planteado.

Los Estados miembros velarán por que los operadores de servicios esenciales tomen medidas adecuadas para prevenir y reducir al mínimo los efectos de los incidentes que afecten la seguridad de las redes y sistemas de información utilizados para la prestación de tales servicios esenciales con el objeto de garantizar su continuidad.

Los Estados miembros velarán por que los operadores de servicios esenciales notifiquen sin dilación indebida a la autoridad competente o al CSIRT los incidentes que tengan efectos significativos en la continuidad de los servicios esenciales que prestan. Las notificaciones incluirán información que permita a la autoridad competente o al CSIRT determinar cualquier efecto transfronterizo del incidente. La notificación no sujetará al notificante a una mayor responsabilidad.

A fin de determinar la importancia de los efectos de un incidente, se tendrán en cuenta, en particular, los siguientes parámetros:

a) el número de usuarios afectados por la perturbación del servicio esencial;

b) la duración del incidente;

c) la extensión geográfica con respecto a la zona afectada por el incidente.

Sobre la base de la información proporcionada en la notificación por el operador de servicios esenciales, la autoridad competente o el CSIRT informará al otro u otros Estados miembros afectados acerca de si el incidente tiene efectos significativos en la continuidad de los servicios esenciales en dicho Estado miembro. Al hacerlo, la autoridad competente o el CSIRT, de conformidad con el Derecho de la Unión o con la legislación nacional acorde con el Derecho de la Unión, mantendrán la seguridad y los intereses comerciales del operador de servicios esenciales así como la confidencialidad de la información proporcionada en su notificación.

Cuando las circunstancias lo permitan, la autoridad competente o el CSIRT proporcionarán al operador de servicios esenciales notificante la información pertinente con respecto al seguimiento de la notificación de un incidente, por ejemplo la información que podría facilitar la gestión eficaz del incidente.

A instancias de la autoridad competente o del CSIRT, el punto de contacto único remitirá las notificaciones contempladas en el párrafo primero a los puntos de contacto únicos de otros Estados miembros afectados.

Después de consultar al operador de servicios esenciales notificante, la autoridad competente o el CSIRT podrán informar al público sobre determinados incidentes, cuando la concienciación pública sea necesaria para evitar un incidente o gestionar uno que ya se haya producido.

Las autoridades competentes que actúen juntas dentro del Grupo de cooperación podrán elaborar y adoptar directrices relativas a las circunstancias en las que se exija a los operadores de servicios esenciales que notifiquen incidentes, en particular sobre los parámetros para determinar la importancia de los efectos de un incidente a que se refiere el apartado 4.

Artículo 15.- Aplicación y observancia

Los Estados miembros velarán por que las autoridades competentes dispongan de las competencias y los medios necesarios para evaluar el cumplimiento por los operadores de servicios esenciales de las obligaciones que les impone el artículo 14 y los efectos que tengan sobre la seguridad de las redes y sistemas de información.

Los Estados miembros velarán por que la autoridad competente disponga de las competencias y los medios para exigir a los operadores de servicios esenciales que proporcionen:

a) la información necesaria para evaluar la seguridad de sus redes y sistemas de información, incluida la documentación sobre las políticas de seguridad;

b) pruebas de la aplicación efectiva de las políticas de seguridad, como el resultado de las auditorías de seguridad realizadas por la autoridad competente o por un auditor cualificado y, en este último caso, que pongan a disposición de la autoridad competente el resultado de dicha auditoría y, en particular, las pruebas subyacentes.

Al exigir dicha información o pruebas, las autoridades competentes indicarán la finalidad de su petición y especificarán la información exigida.

Tras la evaluación de la información o del resultado de las auditorías de seguridad a que se refiere el apartado 2, la autoridad competente podrá impartir instrucciones vinculantes a los operadores de servicios esenciales para subsanar las deficiencias detectadas.

La autoridad competente cooperará estrechamente con las autoridades responsables de la protección de datos a la hora de hacer frente a incidentes que den lugar a violaciones de datos personales.

CAPÍTULO V.- SEGURIDAD DE LAS REDES Y SISTEMAS DE INFORMACIÓN DE LOS PROVEEDORES DE SERVICIOS DIGITALES

Artículo 16.- Requisitos en materia de seguridad y notificación de incidentes

Los Estados miembros velarán por que los proveedores de servicios digitales determinen y adopten medidas técnicas y organizativas adecuadas y proporcionadas para gestionar los riesgos existentes para la seguridad de las redes y sistemas de información que se utilizan en el marco de la oferta de servicios en la Unión a que se refiere el anexo III. Habida cuenta de los avances técnicos, dichas medidas garantizarán un nivel de seguridad de las redes y los sistemas de información adecuado en relación con el riesgo planteado, y tendrán en cuenta lo siguiente:

a) la seguridad de los sistemas e instalaciones;

b) la gestión de incidentes;

c) la gestión de la continuidad de las actividades;

d) la supervisión, auditorías y pruebas;

e) el cumplimiento de las normas internacionales.

Los Estados miembros velarán por que los proveedores de servicios digitales adopten medidas para prevenir y reducir al mínimo el impacto de los incidentes que afectan a la seguridad de sus redes y sistemas de información en los servicios a que se refiere el anexo III que se ofrecen en la Unión, a fin de garantizar la continuidad de dichos servicios.

Los Estados miembros velarán por que los proveedores de servicios digitales notifiquen sin dilación indebida a la autoridad competente o al CSIRT cualquier incidente que tenga un impacto significativo en la prestación de uno de los servicios a que se refiere el anexo III que ellos ofrezcan en la Unión. Las notificaciones incluirán la información necesaria para que la autoridad competente o el CSIRT puedan determinar la importancia de cualquier impacto transfronterizo. La notificación no sujetará al notificante a una mayor responsabilidad.

Para determinar si el impacto de un incidente es significativo se tendrán en cuenta, en particular, los siguientes parámetros:

a) el número de usuarios afectados por el incidente, en particular los usuarios que dependen del servicio para la prestación de sus propios servicios;

b) la duración del incidente;

c) la extensión geográfica con respecto a la zona afectada por el incidente;

d) el grado de perturbación del funcionamiento del servicio;

e) el alcance del impacto sobre las actividades económicas y sociales.

La obligación de la notificación del incidente únicamente se aplicará cuando el proveedor de servicios digitales tenga acceso a la información necesaria para valorar el impacto de un incidente en función de los parámetros que se indican en el párrafo primero.

Cuando un operador de servicios esenciales dependa de un proveedor tercero de servicios digitales para la prestación de un servicio que es esencial para el mantenimiento de actividades sociales y económicas fundamentales, dicho operador notificará cualquier efecto significativo en la continuidad de los servicios esenciales causado por un incidente que afecte al proveedor de servicios digitales.

Cuando proceda, y en particular si el incidente mencionado en el apartado 3 afecta a dos o varios Estados miembros, la autoridad o el CSIRT al que se haya notificado el incidente informará del mismo a los demás Estados miembros afectados. Al hacerlo, las autoridades competentes, el CSIRT y los puntos de contacto únicos preservarán, de conformidad con el Derecho de la Unión o de la legislación nacional acorde con el Derecho de la Unión, la seguridad y los intereses comerciales del proveedor de servicios digitales así como la confidencialidad de la información facilitada.

Tras consultar al proveedor de servicios digitales afectado, la autoridad competente o el CSIRT al que se le haya notificado el incidente y, en su caso, las autoridades o el CSIRT de los demás Estados miembros afectados, podrán informar al público de determinados incidentes o exigir al proveedor de servicios digitales que lo haga, cuando el conocimiento del público sea necesario para evitar un incidente o hacer frente a un incidente en curso, o cuando la divulgación de un incidente redunde en interés público.

La Comisión adoptará actos de ejecución en los que se especifiquen más los elementos a que se refiere el apartado 1 y los parámetros enumerados en el apartado 4 del presente artículo. Dichos actos de ejecución se adoptarán de conformidad con el procedimiento de examen a que se refiere el artículo 22, apartado 2, a más tardar el 9 de agosto de 2017.

La Comisión podrá adoptar actos de ejecución por los que se establezcan los formatos y procedimientos aplicables a los requisitos de notificación. Dichos actos de ejecución se adoptarán de conformidad con el procedimiento de examen a que se refiere el artículo 22, apartado 2.

Sin perjuicio de lo dispuesto en el artículo 1, apartado 6, los Estados miembros no impondrán nuevos requisitos de seguridad o de notificación a los proveedores de servicios digitales.

El presente capítulo no se aplicará a las microempresas y pequeñas empresas tal como se definen en la Recomendación 2003/361/CE de la Comisión (19).

Artículo 17.- Aplicación y observancia

Los Estados miembros velarán por que las autoridades competentes adopten medidas, si fuera necesario, mediante actividades de supervisión a posteriori, cuando tengan pruebas de que un proveedor de servicios digitales no cumple los requisitos establecidos en el artículo 16. Dichas pruebas podrán ser presentadas por la autoridad competente de otro Estado miembro en el que se presta el servicio.

A efectos del apartado 1, las autoridades competentes contarán con las atribuciones y medios necesarios para exigir a los proveedores de servicios digitales que:

a) proporcionen la información necesaria para evaluar la seguridad de sus redes y sistemas de información, incluida la documentación sobre las políticas de seguridad;

b) subsanen cualquier incumplimiento de los requisitos establecidos en el artículo 16.

Si un proveedor de servicios digitales tiene su establecimiento principal o un representante en un Estado miembro, pero sus redes y sistemas de información en otro u otros Estados miembros, la autoridad competente del Estado miembro en el que se encuentre su establecimiento principal o el representante y las autoridades competentes de esos otros Estados miembros cooperarán entre sí y se asistirán mutuamente cuando sea necesario. Dicha asistencia y cooperación podrá abarcar el intercambio de información entre las autoridades competentes de que se trate y las peticiones de que se adopten las medidas de supervisión contempladas en el apartado 2.

Artículo 18.- Jurisdicción y territorialidad

A efectos de la presente Directiva, un proveedor de servicios digitales se considerará sometido a la jurisdicción del Estado miembro en el que se encuentre su establecimiento principal. Se considerará que un proveedor de servicios digitales tiene su establecimiento principal en un Estado miembro cuando su domicilio social se encuentre en ese Estado miembro.

Un proveedor de servicios digitales que no está establecido en la Unión, pero que ofrece servicios que figuran en el anexo III en la Unión, designará un representante en ella. El representante se establecerá en uno de aquellos Estados miembros en los que se ofrecen los servicios. Un proveedor de servicios digitales se considerará sometido a la jurisdicción del Estado miembro en el que se encuentre establecido su representante.

La designación de un representante por el proveedor de servicios digitales se entenderá sin perjuicio de las acciones legales que pudieran emprenderse contra el propio proveedor de servicios digitales.

CAPÍTULO VI.- NORMALIZACIÓN Y NOTIFICACIÓN VOLUNTARIA

Artículo 19.- Normalización

A fin de promover una aplicación convergente de lo dispuesto en el artículo 14, apartados 1 y 2, y en el artículo 16, apartados 1 y 2, los Estados miembros fomentarán, sin imponer ni favorecer el uso de un tipo específico de tecnología, la utilización de normas y especificaciones aceptadas a nivel europeo o internacionalmente que sean pertinentes en materia de seguridad de las redes y sistemas de información.

La ENISA, en colaboración con los Estados miembros, elaborará directrices y orientaciones relativas a las áreas técnicas que deban examinarse en relación con el apartado 1, así como en relación con las normas ya existentes, en particular las normas nacionales de los Estados miembros que permitirían cubrir esas áreas.

Artículo 20.- Notificación voluntaria

Sin perjuicio de lo dispuesto en el artículo 3, las entidades que no hayan sido identificadas como operadores de servicios esenciales y no sean proveedores de servicios digitales podrán notificar voluntariamente los incidentes que tengan efectos significativos en la continuidad de los servicios que prestan.

Cuando tramiten las notificaciones, los Estados miembros actuarán de conformidad con el procedimiento establecido en el artículo 14. Los Estados miembros podrán dar prioridad a la tramitación de notificaciones obligatorias sobre las notificaciones voluntarias. Las notificaciones voluntarias se tramitarán únicamente cuando dicha tramitación no suponga una carga desproporcionada o indebida para los Estados miembros de que se trate.

La notificación voluntaria no dará lugar a la imposición a la entidad notificante de obligaciones a las que no estaría sujeta de no haberse producido dicha notificación.

CAPÍTULO VII.- DISPOSICIONES FINALES

Artículo 21.- Sanciones

Los Estados miembros establecerán el régimen de sanciones aplicables en caso de incumplimiento de las disposiciones nacionales aprobadas al amparo de la presente Directiva y adoptarán todas las medidas necesarias para garantizar su aplicación. Tales sanciones serán efectivas, proporcionadas y disuasorias. Los Estados miembros comunicarán ese régimen y esas medidas a la Comisión, a más tardar el 9 de mayo de 2018, y le notificarán sin demora toda modificación posterior de las mismas.

Artículo 22.- Procedimiento de comité

La Comisión estará asistida por el Comité de Seguridad de las Redes y Sistemas de Información. Dicho Comité será un comité en el sentido del Reglamento (UE) n.o 182/2011.

En los casos en que se haga referencia al presente apartado, será de aplicación el artículo 5 del Reglamento (UE) n.o 182/2011.

Artículo 23.- Revisión

A más tardar el 9 de mayo de 2019, la Comisión presentará un informe al Parlamento Europeo y al Consejo en el que se examine la coherencia de los planteamientos adoptados por los Estados miembros respecto a la identificación de los operadores de servicios esenciales.

La Comisión revisará periódicamente el funcionamiento de la presente Directiva e informará al Parlamento Europeo y al Consejo. A tal efecto y con vistas a incrementar la cooperación estratégica y operativa, la Comisión tendrá en cuenta los informes del Grupo de cooperación y de la red de CSIRT sobre la experiencia adquirida a nivel estratégico y operativo. En su revisión, la Comisión también examinará las listas que figuran en los anexos II y III, así como la coherencia en la identificación de los operadores de servicios esenciales y de los servicios en los sectores que figuran en el anexo II. El primer informe se presentará a más tardar el 9 de mayo de 2021.

Artículo 24.- Medidas transitorias

Sin perjuicio del artículo 25 y con el fin de ofrecer a los Estados miembros oportunidades adicionales de cooperación durante el plazo de transposición, el Grupo de cooperación y la red de CSIRT empezarán a ejercer las funciones que se establecen en los artículos 11 apartado 3, y 12, apartado 3, respectivamente, a más tardar el 9 de febrero de 2017.

En el período comprendido entre el 9 de febrero de 2017 y el 9 de noviembre de 2018, y a efectos de ayudar a los Estados miembros a adoptar un planteamiento coherente en el proceso de identificación de los operadores de servicios esenciales, el Grupo de cooperación examinará el proceso, el contenido y el tipo de medidas nacionales que permitan la identificación de los operadores de servicios esenciales en un sector específico, de acuerdo con los criterios que figuran en los artículos 5 y 6. A petición de un Estado miembro, el Grupo de cooperación también examinará proyectos específicos nacionales de medidas de dicho Estado miembro, que permitan la identificación de los operadores de servicios esenciales en un sector específico, de acuerdo con los criterios que figuran en los artículos 5 y 6.

A más tardar el 9 de febrero de 2017, y a efectos del presente artículo, los Estados miembros harán lo necesario para estar convenientemente representados en el Grupo de cooperación y en la red de CSIRT.

Artículo 25.- Transposición

Los Estados miembros adoptarán y publicarán, a más tardar el 9 de mayo de 2018, las disposiciones legales, reglamentarias y administrativas necesarias para dar cumplimiento a lo establecido en la presente Directiva. Informarán de ello inmediatamente a la Comisión.

Aplicarán esas medidas a partir del 10 de mayo de 2018.

Cuando los Estados miembros adopten dichas disposiciones, estas incluirán una referencia a la presente Directiva o irán acompañadas de dicha referencia en su publicación oficial. Los Estados miembros establecerán las modalidades de la mencionada referencia.

Los Estados miembros comunicarán a la Comisión el texto de las principales disposiciones de Derecho interno que adopten en el ámbito regulado por la presente Directiva.

Artículo 26.- Entrada en vigor

La presente Directiva entrará en vigor a los veinte días de su publicación en el Diario Oficial de la Unión Europea.

Artículo 27.- Destinatarios

Los destinatarios de la presente Directiva son los Estados miembros.

Hecho en Estrasburgo, el 6 de julio de 2016.

Por el Parlamento Europeo. El Presidente M. SCHULZ

Por el Consejo. El Presidente I. KORČOK

(1) DO C 271 de 19.9.2013, p. 133.

(2) Posición del Parlamento Europeo de 13 de marzo de 2014 (pendiente de publicación en el Diario Oficial) y Posición del Consejo en primera lectura de 17 de mayo de 2016 (pendiente de publicación en el Diario Oficial). Posición del Parlamento Europeo de 6 de julio de 2016 (pendiente de publicación en el Diario Oficial).

(3) Directiva 2002/21/CE del Parlamento Europeo y del Consejo, de 7 de marzo de 2002, relativa a un marco regulador común de las redes y los servicios de comunicaciones electrónicas (Directiva marco) (DO L 108 de 24.4.2002, p. 33).

(4) Reglamento (UE) nº 910/2014 del Parlamento Europeo y del Consejo, de 23 de julio de 2014, relativo a la identificación electrónica y los servicios de confianza para las transacciones electrónicas en el mercado interior y por el que se deroga la Directiva 1999/93/CE (DO L 257 de 28.8.2014, p. 73).

(5) Decisión 2013/488/UE del Consejo, de 23 de septiembre de 2013, sobre las normas de seguridad para la protección de la información clasificada de la UE (DO L 274 de 15.10.2013, p. 1).

(6) DO C 352 de 7.10.2014, p. 4.

(7) Reglamento (UE) nº 526/2013 del Parlamento Europeo y del Consejo, de 21 de mayo de 2013, relativo a la Agencia de Seguridad de las Redes de la Información de la Unión Europea (ENISA) y por el que se deroga el Reglamento (CE) nº 460/2004 (DO L 165 de 18.6.2013, p. 41).

(8) Reglamento (UE) nº 1025/2012 del Parlamento Europeo y del Consejo, de 25 de octubre de 2012, sobre la normalización europea, por el que se modifican las Directivas 89/686/CEE y 93/15/CEE del Consejo y las Directivas 94/9/CE, 94/25/CE, 95/16/CE, 97/23/CE, 98/34/CE, 2004/22/CE, 2007/23/CE, 2009/23/CE y 2009/105/CE del Parlamento Europeo y del Consejo y por el que se deroga la Decisión 87/95/CEE del Consejo y la Decisión nº 1673/2006/CE del Parlamento Europeo y del Consejo (DO L 316 de 14.11.2012, p. 12).

(9) Reglamento (UE) nº 182/2011 del Parlamento Europeo y del Consejo, de 16 de febrero de 2011, por el que se establecen las normas y los principios generales relativos a las modalidades de control por parte de los Estados miembros del ejercicio de las competencias de ejecución por la Comisión (DO L 55 de 28.2.2011, p. 13).

(10) Directiva 95/46/CE del Parlamento Europeo y del Consejo, de 24 de octubre de 1995, relativa a la protección de las personas físicas en lo que respecta al tratamiento de datos personales y a la libre circulación de estos datos (DO L 281 de 23.11.1995, p. 31).

(11) Reglamento (CE) nº 45/2001 del Parlamento Europeo y del Consejo, de 18 de diciembre de 2000, relativo a la protección de las personas físicas en lo que respecta al tratamiento de datos personales por las instituciones y los organismos comunitarios y a la libre circulación de estos datos (DO L 8 de 12.1.2001, p. 1).

(12) Reglamento (CE) nº 1049/2001 del Parlamento Europeo y del Consejo, de 30 de mayo de 2001, relativo al acceso del público a los documentos del Parlamento Europeo, del Consejo y de la Comisión (DO L 145 de 31.5.2001, p. 43).

(13) DO C 32 de 4.2.2014, p. 19.

(14) Directiva 2008/114/CE del Consejo, de 8 de diciembre de 2008, sobre la identificación y designación de infraestructuras críticas europeas y la evaluación de la necesidad de mejorar su protección (DO L 345 de 23.12.2008, p. 75).

(15) Directiva 2011/93/UE del Parlamento Europeo y del Consejo, de 13 de diciembre de 2011, relativa a la lucha contra los abusos sexuales y la explotación sexual de los menores y la pornografía infantil y por la que se sustituye la Decisión marco 2004/68/JAI del Consejo (DO L 335 de 17.12.2011, p. 1).

(16) Directiva 2013/40/UE del Parlamento Europeo y del Consejo, de 12 de agosto de 2013, relativa a los ataques contra los sistemas de información y por la que se sustituye la Decisión marco 2005/222/JAI del Consejo (DO L 218 de 14.8.2013, p. 8).

(17) Directiva (UE) 2015/1535 del Parlamento Europeo y del Consejo, de 9 de septiembre de 2015, por la que se establece un procedimiento de información en materia de reglamentaciones técnicas y de reglas relativas a los servicios de la sociedad de la información (DO L 241 de 17.9.2015, p. 1).

(18) Directiva 2013/11/UE del Parlamento Europeo y del Consejo, de 21 de mayo de 2013, relativa a la resolución alternativa de litigios en materia de consumo y por la que se modifica el Reglamento (CE) nº 2006/2004 y la Directiva 2009/22/CE (Directiva sobre resolución alternativa de litigios en materia de consumo) (DO L 165 de 18.6.2013, p. 63).

(19) Recomendación 2003/361/CE de la Comisión, de 6 de mayo de 2003, sobre la definición de microempresas, pequeñas y medianas empresas (DO L 124 de 20.5.2003, p. 36).

ANEXO I.- REQUISITOS Y FUNCIONES DE LOS EQUIPOS DE RESPUESTA A INCIDENTES DE SEGURIDAD INFORMÁTICA (CSIRT)

Los requisitos y funciones de los CSIRT se definirán adecuada y claramente y se basarán en la política o la normativa nacional. Incluirán lo siguiente:

Requisitos que deben cumplir los CSIRT

a) Los CSIRT garantizarán un elevado nivel de disponibilidad de sus servicios de comunicaciones evitando los fallos ocasionales y contarán con varios medios para que se les pueda contactar y puedan contactar a otros en todo momento. Además, los canales de comunicación estarán claramente especificados y serán bien conocidos de los grupos de usuarios y los socios colaboradores.

b) Las dependencias de los CSIRT y los sistemas de información de apoyo estarán situados en lugares seguros.

c) Continuidad de las actividades:

i) Los CSIRT estarán dotados de un sistema adecuado para gestionar y canalizar las solicitudes con el fin de facilitar los traspasos.

ii) Los CSIRT contarán con personal suficiente para garantizar su disponibilidad en todo momento.

iii) Los CSIRT dependerán de infraestructuras cuya continuidad esté asegurada. A tal fin, se dispondrá de sistemas redundantes y espacios de trabajo de reserva.

d) Los CSIRT podrán participar, cuando lo deseen, en redes de cooperación internacional.

2) Funciones de los CSIRT

a) Las funciones de los CSIRT incluirán como mínimo las siguientes:

i) supervisar incidentes a escala nacional,

ii) difundir alertas tempranas, alertas, avisos e información sobre riesgos e incidentes entre los interesados,

iii) responder a incidentes,

iv) efectuar un análisis dinámico de riesgos e incidentes y de conocimiento de la situación,

v) participar en la red de CSIRT.

b) Los CSIRT establecerán relaciones de cooperación con el sector privado.

c) A fin de facilitar la cooperación, los CSIRT fomentarán la adopción y utilización de prácticas comunes o normalizadas de:

i) procedimientos de gestión de incidentes y riesgos,

ii) sistemas de clasificación de incidentes, riesgos e información.

ANEXO II.- TIPOS DE ENTIDADES A EFECTOS DEL ARTÍCULO 4, PUNTO 4

………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………

(1) Directiva 2009/72/CE del Parlamento Europeo y del Consejo, de 13 de julio de 2009, sobre normas comunes para el mercado interior de la electricidad y por la que se deroga la Directiva 2003/54/CE (DO L 211 de 14.8.2009, p. 55).

(2) Directiva 2009/73/CE del Parlamento Europeo y del Consejo, de 13 de julio de 2009, sobre normas comunes para el mercado interior del gas natural y por la que se deroga la Directiva 2003/55/CE (DO L 211 de 14.8.2009, p. 94).

(3) Reglamento (CE) nº 300/2008 del Parlamento Europeo y del Consejo, de 11 de marzo de 2008, sobre normas comunes para la seguridad de la aviación civil y por el que se deroga el Reglamento (CE) n.o 2320/2002 (DO L 97 de 9.4.2008, p. 72).

(4) Directiva 2009/12/CE del Parlamento Europeo y del Consejo, de 11 de marzo de 2009, relativa a las tasas aeroportuarias (DO L 70 de 14.3.2009, p. 11).

(5) Reglamento (UE) nº 1315/2013 del Parlamento Europeo y del Consejo, de 11 de diciembre de 2013, sobre las orientaciones de la Unión para el desarrollo de la Red Transeuropea de Transporte, y por el que se deroga la Decisión nº 661/2010/UE (DO L 348 de 20.12.2013, p. 1).

(6) Reglamento (CE) nº 549/2004 del Parlamento Europeo y del Consejo, de 10 de marzo de 2004, por el que se fĳa el marco para la creación del cielo único europeo (Reglamento marco) (DO L 96 de 31.3.2004, p. 1).

(7) Directiva 2012/34/UE del Parlamento Europeo y del Consejo, de 21 de noviembre de 2012, por la que se establece un espacio ferroviario europeo único (DO L 343 de 14.12.2012, p. 32).

(8) Reglamento (CE) nº 725/2004 del Parlamento Europeo y del Consejo, de 31 de marzo de 2004, relativo a la mejora de la protección de los buques y las instalaciones portuarias (DO L 129 de 29.4.2004, p. 6).

(9) Directiva 2005/65/CE del Parlamento Europeo y del Consejo, de 26 de octubre de 2005, sobre mejora de la protección portuaria (DO L 310 de 25.11.2005, p. 28).

(10) Directiva 2002/59/CE del Parlamento Europeo y del Consejo, de 27 de junio de 2002, relativa al establecimiento de un sistema comunitario de seguimiento y de información sobre el tráfico marítimo y por la que se deroga la Directiva 93/75/CEE del Consejo (DO L 208 de 5.8.2002, p. 10).

(11) Reglamento Delegado (UE) 2015/962 de la Comisión, de 18 de diciembre de 2014, por el que se complementa la Directiva 2010/40/UE del Parlamento Europeo y del Consejo en lo que se refiere al suministro de servicios de información de tráfico en tiempo real en toda la Unión Europea (DO L 157 de 23.6.2015, p. 21).

(12) Directiva 2010/40/UE del Parlamento Europeo y del Consejo, de 7 de julio de 2010, por la que se establece el marco para la implantación de los sistemas de transporte inteligentes en el sector del transporte por carretera y para las interfaces con otros modos de transporte (DO L 207 de 6.8.2010, p. 1).

(13) Reglamento (UE) nº 575/2013 del Parlamento Europeo y del Consejo, de 26 de junio de 2013, sobre los requisitos prudenciales de las entidades de crédito y empresas de inversión, y por el que se modifica el Reglamento (UE) nº 648/2012 (DO L 176 de 27.6.2013 p. 1).

(14) Directiva 2014/65/UE del Parlamento Europeo y del Consejo, de 15 de mayo de 2014, relativa a los mercados de instrumentos financieros y por la que se modifican la Directiva 2002/92/CE y la Directiva 2011/61/UE (DO L 173 de 12.6.2014, p. 349).

(15) Reglamento (UE) nº 648/2012 del Parlamento Europeo y del Consejo, de 4 de julio de 2012, relativo a los derivados extrabursátiles, las entidades de contrapartida central y los registros de operaciones (DO L 201 de 27.7.2012, p. 1).

(16) Directiva 2011/24/UE del Parlamento Europeo y del Consejo, de 9 de marzo de 2011, relativa a la aplicación de los derechos de los pacientes en la asistencia sanitaria transfronteriza (DO L 88 de 4.4.2011, p. 45).

(17) Directiva 98/83/CE del Consejo, de 3 de noviembre de 1998, relativa a la calidad de las aguas destinadas al consumo humano (DO L 330 de 5.12.1998, p. 32).

ANEXO III.- TIPOS DE SERVICIOS DIGITALES A EFECTOS DEL ARTÍCULO 4, PUNTO 5

1. Mercado en línea

2. Motor de búsqueda en línea

3. Servicios de computación en nube

16Sep/18

Real Decreto-Ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de información

16 septiembre, 2018España, Real Decretode 7 de septiembre, de seguridad de las redes y sistemas de información, Derecho Informático de España, Legislación Informática de España, Real Decreto-Ley 12/2018José Cuervo

La evolución de las tecnologías de la información y de la comunicación, especialmente con el desarrollo de Internet, ha hecho que las redes y sistemas de información desempeñen actualmente un papel crucial en nuestra sociedad, siendo su fiabilidad y seguridad aspectos esenciales para el desarrollo normal de las actividades económicas y sociales.

Por ello, los incidentes que, al afectar a las redes y sistemas de información, alteran dichas actividades, representan una grave amenaza, pues tanto si son fortuitos como si provienen de acciones deliberadas pueden generar pérdidas financieras, menoscabar la confianza de la población y, en definitiva, causar graves daños a la economía y a la sociedad, con la posibilidad de afectar a la propia seguridad nacional en la peor de las hipótesis.

El carácter transversal e interconectado de las tecnologías de la información y de la comunicación, que también caracteriza a sus amenazas y riesgos, limita la eficacia de las medidas que se emplean para contrarrestarlos cuando se toman de modo aislado. Este carácter transversal también hace que se corra el riesgo de perder efectividad si los requisitos en materia de seguridad de la información se definen de forma independiente para cada uno de los ámbitos sectoriales afectados.

Por tanto, es oportuno establecer mecanismos que, con una perspectiva integral, permitan mejorar la protección frente a las amenazas que afectan a las redes y sistemas de información, facilitando la coordinación de las actuaciones realizadas en esta materia tanto a nivel nacional como con los países de nuestro entorno, en particular, dentro de la Unión Europea.

Con este propósito se dicta este real decreto-ley, que transpone al ordenamiento jurídico español la Directiva (UE) 2016/1148 del Parlamento Europeo y del Consejo, de 6 de julio de 2016, relativa a las medidas destinadas a garantizar un elevado nivel común de seguridad de las redes y sistemas de información en la Unión. El real decreto-ley se apoya igualmente en las normas, en los instrumentos de respuesta a incidentes y en los órganos de coordinación estatal existentes en esta materia, lo que, junto a las razones señaladas en el apartado I, justifica que su contenido trascienda el de la propia Directiva.

El real decreto-ley se aplicará a las entidades que presten servicios esenciales para la comunidad y dependan de las redes y sistemas de información para el desarrollo de su actividad. Su ámbito de aplicación se extiende a sectores que no están expresamente incluidos en la Directiva, para darle a este real decreto-ley un enfoque global, aunque se preserva su legislación específica. Adicionalmente, en el caso de las actividades de explotación de las redes y de prestación de servicios de comunicaciones electrónicas y los recursos asociados, así como de los servicios electrónicos de confianza, expresamente excluidos de dicha Directiva, el real decreto-ley se aplicará únicamente en lo que respecta a los operadores críticos.

El real decreto-ley se aplicará, así mismo, a los proveedores de determinados servicios digitales. La Directiva (UE) 2016/1148 del Parlamento Europeo y del Consejo, de 6 de julio de 2016, los somete a un régimen de armonización máxima, equivalente a un reglamento, pues se considera que su regulación a escala nacional no sería efectiva por tener un carácter intrínsecamente transnacional. La función de las autoridades nacionales se limita, por tanto, a supervisar su aplicación por los proveedores establecidos en su país, y coordinarse con las autoridades correspondientes de otros países de la Unión Europea.

Siguiendo la citada Directiva, el real decreto-ley identifica los sectores en los que es necesario garantizar la protección de las redes y sistemas de información, y establece procedimientos para identificar los servicios esenciales ofrecidos en dichos sectores, así como los principales operadores que prestan dichos servicios, que son, en definitiva, los destinatarios de este real decreto-ley.

Los operadores de servicios esenciales y los proveedores de servicios digitales deberán adoptar medidas adecuadas para gestionar los riesgos que se planteen para la seguridad de las redes y sistemas de información que utilicen, aunque su gestión esté externalizada. Las obligaciones de seguridad que asuman deberán ser proporcionadas al nivel de riesgo que afronten y estar basadas en una evaluación previa de los mismos. Las normas de desarrollo de este real decreto-ley podrán concretar las obligaciones de seguridad exigibles a los operadores de servicios esenciales, incluyendo en su caso las inspecciones a realizar o la participación en actividades y ejercicios de gestión de crisis.

El real decreto-ley requiere así mismo que los operadores de servicios esenciales y los proveedores de servicios digitales notifiquen los incidentes que sufran en las redes y servicios de información que emplean para la prestación de los servicios esenciales y digitales, y tengan efectos perturbadores significativos en los mismos, al tiempo que prevé la notificación de los sucesos o incidencias que puedan afectar a los servicios esenciales, pero que aún no hayan tenido un efecto adverso real sobre aquellos, y perfila los procedimientos de notificación.

La notificación de incidentes forma parte de la cultura de gestión de riesgos que la Directiva y el real decreto-ley fomentan. Por ello, el real decreto-ley protege a la entidad notificante y al personal que informe sobre incidentes ocurridos; se reserva la información confidencial de su divulgación al público o a otras autoridades distintas de la notificada y se permite la notificación de incidentes cuando no sea obligada su comunicación.

El real decreto-ley recalca la necesidad de tener en cuenta los estándares europeos e internacionales, así como las recomendaciones que emanen del grupo de cooperación y de la red de CSIRT (Computer Security Incident Response Team) establecidos en el ámbito comunitario por la Directiva, con vistas a aplicar las mejores prácticas aprendidas en estos foros y contribuir al impulso del mercado interior y a la participación de nuestras empresas en él.

Con el fin de aumentar su eficacia y, al tiempo, reducir las cargas administrativas y económicas que estas obligaciones suponen para las entidades afectadas, este real decreto-ley trata de garantizar su coherencia con las que se derivan de la aplicación de otras normativas en materia de seguridad de la información, tanto de carácter horizontal como sectorial, y la coordinación en su aplicación con las autoridades responsables en cada caso.

Respecto a las normas horizontales, destacan los vínculos establecidos con las Leyes 8/2011, de 28 de abril, por la que se establecen medidas para la protección de las infraestructuras críticas, y 36/2015, de 28 de septiembre, de Seguridad Nacional, y con el Real Decreto 3/2010, de 8 de enero, por el que se regula el Esquema Nacional de Seguridad en el ámbito de la Administración Electrónica, como normativa especial en materia de seguridad de los sistemas de información del sector público.

Así, se aproxima el ámbito de aplicación de este real decreto-ley al de la Ley 8/2011, de 28 de abril, añadiendo a los sectores previstos por la Directiva (UE) 2016/1148 del Parlamento Europeo y del Consejo, de 6 de julio de 2016, los sectores estratégicos adicionales contemplados en esa ley; se apoya en ella para definir el concepto de «servicio esencial», y se atribuye a sus órganos colegiados la determinación de los servicios esenciales y de los operadores de servicios esenciales sujetos al presente real decreto-ley. Teniendo en cuenta la Ley 36/2015, de 28 de septiembre, se atribuye al Consejo de Seguridad Nacional la función de actuar como punto de contacto con otros países de la Unión Europea y un papel coordinador de la política de ciberseguridad a través de la Estrategia de Ciberseguridad Nacional.

III

La Estrategia de Ciberseguridad Nacional con la que España cuenta desde el año 2013, sienta las prioridades, objetivos y medidas adecuadas para alcanzar y mantener un elevado nivel de seguridad de las redes y sistemas de información. Dicha Estrategia seguirá desarrollando el marco institucional de la ciberseguridad que este real decreto-ley esboza, compuesto por las autoridades públicas competentes y los CSIRT de referencia, por una parte, y la cooperación público-privada, por otra.

Las autoridades competentes ejercerán las funciones de vigilancia derivadas de este real decreto-ley y aplicarán el régimen sancionador cuando proceda. Así mismo, promoverán el desarrollo de las obligaciones que el real decreto-ley impone, en consulta con el sector y con las autoridades que ejerzan competencias por razón de la materia cuando se refieran a sectores específicos, para evitar la existencia de obligaciones duplicadas, innecesarias o excesivamente onerosas.

Los CSIRT son los equipos de respuesta a incidentes que analizan riesgos y supervisan incidentes a escala nacional, difunden alertas sobre ellos y aportan soluciones para mitigar sus efectos. El término CSIRT es el usado comúnmente en Europa en lugar del término protegido CERT (Computer Emergency Response Team), registrado en EE.UU.

El real decreto-ley delimita el ámbito funcional de actuación de los CSIRT de referencia previstos en ella. Dichos CSIRT son la puerta de entrada de las notificaciones de incidentes, lo que permitirá organizar rápidamente la respuesta a ellos, pero el destinatario de las notificaciones es la autoridad competente respectiva, que tendrá en cuenta esta información para la supervisión de los operadores. En todo caso, el operador es responsable de resolver los incidentes y reponer las redes y sistemas de información afectados a su funcionamiento ordinario.

Se prevé la utilización de una plataforma común para la notificación de incidentes, de tal manera que los operadores no deban efectuar varias notificaciones en función de la autoridad a la que deban dirigirse. Esta plataforma podrá ser empleada también para la notificación de vulneraciones de la seguridad de datos personales según el Reglamento (UE) 2016/679 del Parlamento Europeo y del Consejo, de 27 de abril de 2016, relativo a la protección de las personas físicas en lo que respecta al tratamiento de datos personales y a la libre circulación de estos datos y por el que se deroga la Directiva 95/46/CE.

Este real decreto-ley consta de siete títulos que contienen, en primer lugar, las definiciones de los términos que se usan a lo largo del texto, la salvaguarda de funciones estatales esenciales, como la seguridad nacional y otras disposiciones generales. A continuación, en el título II se determina la forma y criterios de identificación de los servicios esenciales y de los operadores que los presten a los que se aplicará el real decreto-ley. El orden en que se procederá a su identificación por primera vez se establece en la disposición adicional primera del real decreto-ley. El título III recoge el marco estratégico e institucional de la seguridad de las redes y sistemas de información que se ha descrito anteriormente. Se dedica un precepto específico a la cooperación entre autoridades públicas, como pilar de un ejercicio adecuado de las diferentes competencias concurrentes sobre la materia.

El título IV se ocupa de las obligaciones de seguridad de los operadores, y en él se prevé la aplicación preferente de normas sectoriales que impongan obligaciones equivalentes a las previstas en este real decreto-ley, sin perjuicio de la coordinación ejercida por el Consejo de Seguridad Nacional y del deber de cooperación con las autoridades competentes en virtud de este real decreto-ley.

En el título V, el más extenso, se regula la notificación de incidentes y se presta atención a los incidentes con impacto transfronterizo y a la información y coordinación con otros Estados de la Unión Europea para su gestión. En el título VI, se disponen las potestades de inspección y control de las autoridades competentes y la cooperación con las autoridades nacionales de otros Estados miembros, y en el título VII se tipifican las infracciones y sanciones de este real decreto-ley. En este aspecto, el real decreto-ley se decanta por impulsar la subsanación de la infracción antes que su castigo, el cual, si es necesario dispensarlo, será efectivo, proporcionado y disuasorio, en línea con lo ordenado por la Directiva (UE) 2016/1148 del Parlamento Europeo y del Consejo, de 6 de julio de 2016.

El real decreto-ley se cierra con una parte final que incluye las disposiciones adicionales y finales necesarias para completar la regulación.

Esta disposición ha sido sometida al procedimiento de información de normas reglamentarias técnicas y de reglamentos relativos a los servicios de la sociedad de la información, previsto en la Directiva (UE) 2015/1535 del Parlamento Europeo y del Consejo, de 9 de septiembre de 2015, por la que se establece un procedimiento de información en materia de reglamentaciones técnicas y de reglas relativas a los servicios de la sociedad de la información, así como el Real Decreto 1337/1999, de 31 de julio, por el que se regula la remisión de información en materia de normas y reglamentaciones técnicas y reglamentos relativos a los servicios de la sociedad de la información. Así mismo, se adecúa a los principios de buena regulación establecidos en el artículo 129 de la Ley 39/2015, de 1 de octubre, del Procedimiento Administrativo Común de las Administraciones Públicas, conforme a los cuales deben actuar las Administraciones Públicas en el ejercicio de la iniciativa legislativa, como son los principios de necesidad, eficacia, proporcionalidad, seguridad jurídica, transparencia y eficiencia.

Este real decreto-ley se dicta en virtud de las competencias exclusivas atribuidas al Estado en materia de régimen general de telecomunicaciones y seguridad pública por el artículo 149.1.21.ª y 29.ª de la Constitución.

El real decreto-ley constituye un instrumento constitucionalmente lícito, siempre que el fin que justifica la legislación de urgencia, sea, tal como reiteradamente ha exigido nuestro Tribunal Constitucional (Sentencias 6/1983, de 4 de febrero, F. 5; 11/2002, de 17 de enero, F. 4, 137/2003, de 3 de julio, F. 3 y 189/2005, de 7 julio, F.3), subvenir a un situación concreta, dentro de los objetivos gubernamentales, que por razones difíciles de prever requiere una acción normativa inmediata en un plazo más breve que el requerido por la vía normal o por el procedimiento de urgencia para la tramitación parlamentaria de las Leyes.

Por otro lado, la utilización del instrumento jurídico del real decreto-ley, en el presente caso, además queda justificada por la doctrina del Tribunal Constitucional, que, en su Sentencia 1/2012, de 13 de enero, ha avalado la concurrencia del presupuesto habilitante de la extraordinaria y urgente necesidad del artículo 86.1 de la Constitución, cuando concurra el retraso en la transposición de directivas.

En efecto, el plazo de transposición de la mencionada Directiva (UE) 2016/1148, del Parlamento Europeo y del Consejo, de 6 de julio de 2016, se encuentra ya vencido a 9 de mayo de 2018. La finalización del plazo de transposición de esta Directiva ha motivado la iniciación por parte de la Comisión Europea de un procedimiento formal de infracción n.º 2018/168.

En consecuencia, se entiende que en el conjunto y en cada una de las medidas que se adoptan mediante el real decreto-ley proyectado, concurren, por su naturaleza y finalidad, las circunstancias de extraordinaria y urgente necesidad que exige el artículo 86 de la Constitución como presupuestos habilitantes para la aprobación de un real decreto-ley.

En su virtud, haciendo uso de la autorización contenida en el artículo 86 de la Constitución Española, a propuesta de la Vicepresidenta del Gobierno y Ministra de la Presidencia, Relaciones con las Cortes e Igualdad, del Ministro del Interior y de la Ministra de Economía y Empresa y previa deliberación del Consejo de Ministros, en su reunión del día 7 de septiembre de 2018,

DISPONGO:

TÍTULO I. Disposiciones generales

Artículo 1. Objeto.

1. El presente real decreto-ley tiene por objeto regular la seguridad de las redes y sistemas de información utilizados para la provisión de los servicios esenciales y de los servicios digitales, y establecer un sistema de notificación de incidentes.

2. Así mismo, establece un marco institucional para la aplicación de este real decreto-ley y la coordinación entre autoridades competentes y con los órganos de cooperación relevantes en el ámbito comunitario.

Artículo 2. Ámbito de aplicación.

1. Este real decreto-ley se aplicará a la prestación de:

a) Los servicios esenciales dependientes de las redes y sistemas de información comprendidos en los sectores estratégicos definidos en el anexo de la Ley 8/2011, de 28 de abril, por la que se establecen medidas para la protección de las infraestructuras críticas.

b) Los servicios digitales, considerados conforme se determina en el artículo 3 e), que sean mercados en línea, motores de búsqueda en línea y servicios de computación en nube.

2. Estarán sometidos a este real decreto-ley:

a) Los operadores de servicios esenciales establecidos en España. Se entenderá que un operador de servicios esenciales está establecido en España cuando su residencia o domicilio social se encuentren en territorio español, siempre que éstos coincidan con el lugar en que esté efectivamente centralizada la gestión administrativa y la dirección de sus negocios o actividades.

Así mismo, este real decreto-ley será de aplicación a los servicios esenciales que los operadores residentes o domiciliados en otro Estado ofrezcan a través de un establecimiento permanente situado en España.

b) Los proveedores de servicios digitales que tengan su sede social en España y que constituya su establecimiento principal en la Unión Europea, así como los que, no estando establecidos en la Unión Europea, designen en España a su representante en la Unión para el cumplimiento de la Directiva (UE) 2016/1148 del Parlamento Europeo y del Consejo, de 6 de julio de 2016, relativa a las medidas destinadas a garantizar un elevado nivel común de seguridad de las redes y sistemas de información en la Unión.

3. Este real decreto-ley no se aplicará a:

a) Los operadores de redes y servicios de comunicaciones electrónicas y los prestadores de servicios electrónicos de confianza que no sean designados como operadores críticos en virtud de la Ley 8/2011, de 28 de abril.

b) Los proveedores de servicios digitales cuando se trate de microempresas o pequeñas empresas, de acuerdo con las definiciones recogidas en la Recomendación 2003/361/CE de la Comisión, de 6 de mayo de 2003, sobre la definición de microempresas, pequeñas y medianas empresas.

Artículo 3. Definiciones.

A los efectos de este real decreto-ley, se entenderá por:

a) Redes y sistemas de información, cualquiera de los elementos siguientes:

1.º Las redes de comunicaciones electrónicas, tal y como vienen definidas en el número 31 del anexo II de la Ley 9/2014, de 9 de mayo, General de Telecomunicaciones;

2.º Todo dispositivo o grupo de dispositivos interconectados o relacionados entre sí, en el que uno o varios de ellos realicen, mediante un programa, el tratamiento automático de datos digitales;

3.º Los datos digitales almacenados, tratados, recuperados o transmitidos mediante los elementos contemplados en los números 1.º y 2.º anteriores, incluidos los necesarios para el funcionamiento, utilización, protección y mantenimiento de dichos elementos.

b) Seguridad de las redes y sistemas de información: la capacidad de las redes y sistemas de información de resistir, con un nivel determinado de fiabilidad, toda acción que comprometa la disponibilidad, autenticidad, integridad o confidencialidad de los datos almacenados, transmitidos o tratados, o los servicios correspondientes ofrecidos por tales redes y sistemas de información o accesibles a través de ellos.

c) Servicio esencial: servicio necesario para el mantenimiento de las funciones sociales básicas, la salud, la seguridad, el bienestar social y económico de los ciudadanos, o el eficaz funcionamiento de las Instituciones del Estado y las Administraciones Públicas, que dependa para su provisión de redes y sistemas de información.

d) Operador de servicios esenciales: entidad pública o privada que se identifique considerando los factores establecidos en el artículo 6 de este real decreto-ley, que preste dichos servicios en alguno de los sectores estratégicos definidos en el anexo de la Ley 8/2011, de 28 de abril.

e) Servicio digital: servicio de la sociedad de la información entendido en el sentido recogido en la letra a) del anexo de la Ley 34/2002, de 11 de julio, de servicios de la sociedad de la información y de comercio electrónico.

f) Proveedor de servicios digitales: persona jurídica que presta un servicio digital.

g) Riesgo: toda circunstancia o hecho razonablemente identificable que tenga un posible efecto adverso en la seguridad de las redes y sistemas de información. Se puede cuantificar como la probabilidad de materialización de una amenaza que produzca un impacto en términos de operatividad, de integridad física de personas o material o de imagen.

h) Incidente: suceso inesperado o no deseado con consecuencias en detrimento de la seguridad de las redes y sistemas de información.

i) Gestión de incidentes: procedimientos seguidos para detectar, analizar y limitar un incidente y responder ante éste.

j) Representante: persona física o jurídica establecida en la Unión Europea que ha sido designada expresamente para actuar por cuenta de un proveedor de servicios digitales no establecido en la Unión Europea, a la que, en sustitución del proveedor de servicios digitales, pueda dirigirse una autoridad competente nacional o un CSIRT, en relación con las obligaciones que, en virtud de este real decreto-ley, tiene el proveedor de servicios digitales.

k) Norma técnica: una norma en el sentido del artículo 2.1 del Reglamento (UE) n.º 1025/2012 del Parlamento Europeo y del Consejo, de 25 de octubre de 2012, sobre la normalización europea.

l) Especificación: una especificación técnica en el sentido del artículo 2.4 del Reglamento (UE) n.º 1025/2012 del Parlamento Europeo y del Consejo, de 25 de octubre de 2012.

m) Punto de intercambio de Internet («IXP», por sus siglas en inglés de «Internet eXchange Point»): una instalación de red que permite interconectar más de dos sistemas autónomos independientes, principalmente para facilitar el intercambio de tráfico de Internet. Un IXP permite interconectar sistemas autónomos sin requerir que el tráfico de Internet que pasa entre cualquier par de sistemas autónomos participantes pase por un tercer sistema autónomo, y sin modificar ni interferir de otra forma en dicho tráfico.

n) Sistema de nombres de dominio («DNS», por sus siglas en inglés de «Domain Name System»): sistema distribuido jerárquicamente que responde a consultas proporcionando información asociada a nombres de dominio, en particular, la relativa a los identificadores utilizados para localizar y direccionar equipos en Internet.

o) Proveedor de servicios de DNS: entidad que presta servicios de DNS en Internet.

p) Registro de nombres de dominio de primer nivel: entidad que administra y dirige el registro de nombres de dominio de Internet en un dominio específico de primer nivel.

q) Mercado en línea: servicio digital que permite a los consumidores y a los empresarios, tal y como se definen respectivamente en los artículos 3 y 4 del texto refundido de la Ley General para la Defensa de los Consumidores y Usuarios y otras leyes complementarias, aprobado mediante el Real Decreto Legislativo 1/2007, de 16 de noviembre, celebrar entre sí contratos de compraventa o de prestación de servicios en línea con empresarios, ya sea en un sitio web específico del servicio de mercado en línea, o en un sitio web de un empresario que utilice servicios informáticos proporcionados al efecto por el proveedor del servicio de mercado en línea.

r) Motor de búsqueda en línea: servicio digital que permite a los usuarios hacer búsquedas de, en principio, todos los sitios web o de sitios web en una lengua en concreto, mediante una consulta sobre un tema en forma de palabra clave, frase u otro tipo de entrada, y que, en respuesta, muestra enlaces en los que puede encontrarse información relacionada con el contenido solicitado.

s) Servicio de computación en nube: servicio digital que hace posible el acceso a un conjunto modulable y elástico de recursos de computación que se pueden compartir.

Artículo 4. Directrices y orientaciones comunitarias.

En la aplicación de este real decreto-ley y en la elaboración de los reglamentos y guías previstos en él se tendrán en cuenta los actos de ejecución de la Directiva (UE) 2016/1148 del Parlamento Europeo y del Consejo, de 6 de julio de 2016, así como todas las recomendaciones y directrices emanadas del grupo de cooperación establecido por el artículo 11 de la citada Directiva, y la información sobre buenas prácticas recopiladas por dicho grupo y la red de CSIRT, regulado en el artículo 12 de aquélla.

Artículo 5. Salvaguarda de funciones estatales esenciales.

Lo dispuesto en este real decreto-ley se entenderá sin perjuicio de las acciones emprendidas para salvaguardar la seguridad nacional y las funciones estatales esenciales, incluyéndose las dirigidas a proteger la información clasificada o cuya revelación fuere contraria a los intereses esenciales del Estado, o las que tengan como propósito el mantenimiento del orden público, la detección, investigación y persecución de los delitos, y el enjuiciamiento de sus autores.

TÍTULO II. Servicios esenciales y servicios digitales

Artículo 6. Identificación de servicios esenciales y de operadores de servicios esenciales.

1. La identificación de los servicios esenciales y de los operadores que los presten se efectuará por los órganos y procedimientos previstos por la Ley 8/2011, de 28 de abril, y su normativa de desarrollo.

La relación de los servicios esenciales y de los operadores de dichos servicios se actualizará, para cada sector, con una frecuencia bienal, en conjunción con la revisión de los planes estratégicos sectoriales previstos en la Ley 8/2011, de 28 de abril.

Se identificará a un operador como operador de servicios esenciales si un incidente sufrido por el operador puede llegar a tener efectos perturbadores significativos en la prestación del servicio, para lo que se tendrán en cuenta, al menos, los siguientes factores:

a) En relación con la importancia del servicio prestado:

1.º La disponibilidad de alternativas para mantener un nivel suficiente de prestación del servicio esencial;

2.º La valoración del impacto de un incidente en la provisión del servicio, evaluando la extensión o zonas geográficas que podrían verse afectadas por el incidente; la dependencia de otros sectores estratégicos respecto del servicio esencial ofrecido por la entidad y la repercusión, en términos de grado y duración, del incidente en las actividades económicas y sociales o en la seguridad pública.

b) En relación con los clientes de la entidad evaluada:

1.º El número de usuarios que confían en los servicios prestados por ella;

2.º Su cuota de mercado.

Reglamentariamente podrán añadirse factores específicos del sector para determinar si un incidente podría tener efectos perturbadores significativos.

2. En el caso de tratarse de un operador crítico designado en cumplimiento de la Ley 8/2011, de 28 de abril, bastará con que se constate su dependencia de las redes y sistemas de información para la provisión del servicio esencial de que se trate.

3. En la identificación de los servicios esenciales y de los operadores de servicios esenciales se tendrán en consideración, en la mayor medida posible, las recomendaciones pertinentes que adopte el grupo de cooperación.

4. Cuando un operador de servicios esenciales ofrezca servicios en otros Estados miembros de la Unión Europea, se informará a los puntos de contacto único de dichos Estados sobre la intención de identificarlo como operador de servicios esenciales.

Artículo 7. Comunicación de actividad por los proveedores de servicios digitales.

Los proveedores de servicios digitales señalados en el artículo 2 deberán comunicar su actividad a la autoridad competente en el plazo de tres meses desde que la inicien, a los meros efectos de su conocimiento.

TÍTULO III. Marco estratégico e institucional

Artículo 8. Marco estratégico de seguridad de las redes y sistemas de información.

La Estrategia de Ciberseguridad Nacional, al amparo y alineada con la Estrategia de Seguridad Nacional, enmarca los objetivos y las medidas para alcanzar y mantener un elevado nivel de seguridad de las redes y sistemas de información.

La Estrategia de Ciberseguridad Nacional abordará, entre otras cuestiones, las establecidas en el artículo 7 de la Directiva (UE) 2016/1148 del Parlamento Europeo y del Consejo, de 6 de julio de 2016.

A tal efecto, el Consejo de Seguridad Nacional impulsará la revisión de la Estrategia de Ciberseguridad Nacional, de conformidad con lo dispuesto en el artículo 21.1 e) de la Ley 36/2015, de 28 de septiembre, de Seguridad Nacional.

Artículo 9. Autoridades competentes.

1. Son autoridades competentes en materia de seguridad de las redes y sistemas de información las siguientes:

a) Para los operadores de servicios esenciales:

1.º En el caso de que éstos sean, además, designados como operadores críticos conforme a la Ley 8/2011, de 28 de abril, y su normativa de desarrollo, con independencia del sector estratégico en que se realice tal designación: la Secretaría de Estado de Seguridad, del Ministerio del Interior, a través del Centro Nacional de Protección de Infraestructuras y Ciberseguridad (CNPIC).

2.º En el caso de que no sean operadores críticos: la autoridad sectorial correspondiente por razón de la materia, según se determine reglamentariamente.

b) Para los proveedores de servicios digitales: la Secretaría de Estado para el Avance Digital, del Ministerio de Economía y Empresa.

c) Para los operadores de servicios esenciales y proveedores de servicios digitales que no siendo operadores críticos se encuentren comprendidos en el ámbito de aplicación de la Ley 40/2015, de 1 de octubre, de Régimen Jurídico del Sector Público: el Ministerio de Defensa, a través del Centro Criptológico Nacional.

2. El Consejo de Seguridad Nacional, a través de su comité especializado en materia de ciberseguridad, establecerá los mecanismos necesarios para la coordinación de las actuaciones de las autoridades competentes.

Artículo 10. Funciones de las autoridades competentes.

Las autoridades competentes ejercerán las siguientes funciones:

a) Supervisar el cumplimiento por parte de los operadores de servicios esenciales y de los proveedores de servicios digitales de las obligaciones que se determinen, conforme a lo establecido en el título VI.

b) Establecer canales de comunicación oportunos con los operadores de servicios esenciales y con los proveedores de servicios digitales que, en su caso, serán desarrollados reglamentariamente.

c) Coordinarse con los CSIRT de referencia a través de los protocolos de actuación que, en su caso, se desarrollarán reglamentariamente.

d) Recibir las notificaciones sobre incidentes que sean presentadas en el marco de este real decreto-ley, a través de los CSIRT de referencia, conforme a lo establecido en el título V.

e) Informar al punto de contacto único sobre las notificaciones de incidentes presentadas en el marco de este real decreto-ley, conforme a lo establecido en el artículo 27.

f) Informar, en su caso, al público sobre determinados incidentes, cuando la difusión de dicha información sea necesaria para evitar un incidente o gestionar uno que ya se haya producido, conforme a lo establecido en el artículo 26.

g) Cooperar, en el ámbito de aplicación de este real decreto-ley, con las autoridades competentes en materia de protección de datos de carácter personal, seguridad pública, seguridad ciudadana y seguridad nacional, así como con las autoridades sectoriales correspondientes, conforme a lo establecido en los artículos 14 y 29.

h) Establecer obligaciones específicas para garantizar la seguridad de las redes y sistemas de información y sobre notificación de incidentes, y dictar instrucciones técnicas y guías orientativas para detallar el contenido de dichas obligaciones, conforme a lo establecido en los artículos 16 y 19.

i) Ejercer la potestad sancionadora en los casos previstos en el presente real decreto-ley, conforme a lo establecido en el título VII.

j) Promover el uso de normas y especificaciones técnicas, de acuerdo con lo establecido en el artículo 17.

k) Cooperar con las autoridades competentes de otros Estados miembros de la Unión Europea en la identificación de operadores de servicios esenciales entre entidades que ofrezcan dichos servicios en varios Estados miembros.

l) Informar al punto de contacto único sobre incidentes que puedan afectar a otros Estados miembros, en los términos previstos en el artículo 25.

Artículo 11. Equipos de respuesta a incidentes de seguridad informática de referencia.

1. Son equipos de respuesta a incidentes de seguridad informática (CSIRT) de referencia en materia de seguridad de las redes y sistemas de información, los siguientes:

a) En lo concerniente a las relaciones con los operadores de servicios esenciales:

1.º El CCN-CERT, del Centro Criptológico Nacional, al que corresponde la comunidad de referencia constituida por las entidades del ámbito subjetivo de aplicación de la Ley 40/2015, de 1 de octubre.

2.º El INCIBE-CERT, del Instituto Nacional de Ciberseguridad de España, al que corresponde la comunidad de referencia constituida por aquellas entidades no incluidas en el ámbito subjetivo de aplicación de la Ley 40/2015, de 1 de octubre.

El INCIBE-CERT será operado conjuntamente por el INCIBE y el CNPIC en todo lo que se refiera a la gestión de incidentes que afecten a los operadores críticos.

3.º El ESPDEF-CERT, del Ministerio de Defensa, que cooperará con el CCN-CERT y el INCIBE-CERT en aquellas situaciones que éstos requieran en apoyo de los operadores de servicios esenciales y, necesariamente, en aquellos operadores que tengan incidencia en la Defensa Nacional y que reglamentariamente se determinen.

b) En lo concerniente a las relaciones con los proveedores de servicios digitales que no estuvieren comprendidos en la comunidad de referencia del CCN-CERT: el INCIBE-CERT.

El INCIBE-CERT será, así mismo, equipo de respuesta a incidentes de referencia para los ciudadanos, entidades de derecho privado y otras entidades no incluidas anteriormente en este apartado 1.

2. Los CSIRT de referencia se coordinarán entre sí y con el resto de CSIRT nacionales e internacionales en la respuesta a los incidentes y gestión de riesgos de seguridad que les correspondan. En los supuestos de especial gravedad que reglamentariamente se determinen y que requieran un nivel de coordinación superior al necesario en situaciones ordinarias, el CCN-CERT ejercerá la coordinación nacional de la respuesta técnica de los CSIRT.

Cuando las actividades que desarrollen puedan afectar de alguna manera a un operador crítico, los CSIRT de referencia se coordinarán con el Ministerio del Interior, a través de la Oficina de Coordinación Cibernética del Centro Nacional de Protección de Infraestructuras y Ciberseguridad (CNPIC), de la forma que reglamentariamente se determine.

Artículo 12. Requisitos y funciones de los CSIRT de referencia.

1. Los CSIRT deberán reunir las siguientes condiciones:

a) Garantizarán un elevado nivel de disponibilidad de sus servicios de comunicaciones evitando los fallos ocasionales y contarán con varios medios para que se les pueda contactar y puedan contactar a otros en todo momento. Además, los canales de comunicación estarán claramente especificados y serán bien conocidos de los grupos de usuarios y los socios colaboradores.

b) Sus instalaciones y las de los sistemas de información de apoyo estarán situados en lugares seguros.

c) Garantizarán la continuidad de las actividades. Para ello:

1.º Estarán dotados de un sistema adecuado para gestionar y canalizar las solicitudes con el fin de facilitar los traspasos.

2.º Contarán con personal suficiente para garantizar su disponibilidad en todo momento.

3.º Tendrán acceso a infraestructuras de comunicación cuya continuidad esté asegurada. A tal fin, dispondrán de sistemas redundantes y espacios de trabajo de reserva.

d) Deberán tener la capacidad de participar, cuando lo deseen, en redes de cooperación internacional.

2. Los CSIRT desempeñarán como mínimo, las siguientes funciones:

a) Supervisar incidentes a escala nacional.

b) Difundir alertas tempranas, alertas, avisos e información sobre riesgos e incidentes entre los interesados.

c) Responder a incidentes.

d) Efectuar un análisis dinámico de riesgos e incidentes y de conocimiento de la situación.

e) Participar en la red de CSIRT.

3. Los CSIRT establecerán relaciones de cooperación con el sector privado. A fin de facilitar la cooperación, los CSIRT fomentarán la adopción y utilización de prácticas comunes o normalizadas de:

a) Procedimientos de gestión de incidentes y riesgos.

b) Sistemas de clasificación de incidentes, riesgos e información.

Artículo 13. Punto de contacto único.

El Consejo de Seguridad Nacional ejercerá, a través del Departamento de Seguridad Nacional, una función de enlace para garantizar la cooperación transfronteriza de las autoridades competentes designadas conforme al artículo 9, con las autoridades competentes de otros Estados miembros de la Unión Europea, así como con el grupo de cooperación y la red de CSIRT.

Artículo 14. Cooperación con otras autoridades con competencias en seguridad de la información y con las autoridades sectoriales.

1. Las autoridades competentes, los CSIRT de referencia y el punto de contacto único consultarán, cuando proceda, con los órganos con competencias en materia de seguridad nacional, seguridad pública, seguridad ciudadana y protección de datos de carácter personal y colaborarán con ellas en el ejercicio de sus respectivas funciones.

2. Consultarán así mismo, cuando proceda, con los órganos con competencias por razón de la materia en cada uno de los sectores incluidos en el ámbito de aplicación de este real decreto-ley, y colaborarán con ellos en el ejercicio de sus funciones.

3. Cuando los incidentes notificados presenten caracteres de delito, las autoridades competentes y los CSIRT de referencia darán cuenta de ello, a través de la Oficina de Coordinación Cibernética del Ministerio del Interior, al Ministerio Fiscal a los efectos oportunos, trasladándole al tiempo cuanta información posean en relación con ello.

Artículo 15. Confidencialidad de la información sensible.

Sin perjuicio de lo dispuesto en el artículo 5, las autoridades competentes, los CSIRT de referencia y el punto de contacto único preservarán, como corresponda en Derecho, la seguridad y los intereses comerciales de los operadores de servicios esenciales y proveedores de servicios digitales, así como la confidencialidad de la información que recaben de éstos en el ejercicio de las funciones que les encomienda el presente real decreto-ley.

Cuando ello sea necesario, el intercambio de información sensible se limitará a aquella que sea pertinente y proporcionada para la finalidad de dicho intercambio.

TÍTULO IV. Obligaciones de seguridad

Artículo 16. Obligaciones de seguridad de los operadores de servicios esenciales y de los proveedores de servicios digitales.

1. Los operadores de servicios esenciales y los proveedores de servicios digitales deberán adoptar medidas técnicas y de organización, adecuadas y proporcionadas, para gestionar los riesgos que se planteen para la seguridad de las redes y sistemas de información utilizados en la prestación de los servicios sujetos a este real decreto-ley.

Sin perjuicio de su deber de notificar incidentes conforme al título V, deberán tomar medidas adecuadas para prevenir y reducir al mínimo el impacto de los incidentes que les afecten.

2. El desarrollo reglamentario de este real decreto-ley preverá las medidas necesarias para el cumplimiento de lo preceptuado en el apartado anterior por parte de los operadores de servicios esenciales.

3. Los operadores de servicios esenciales designarán y comunicarán a la autoridad competente, en el plazo que reglamentariamente se establezca, la persona, unidad u órgano colegiado responsable de la seguridad de la información, como punto de contacto y de coordinación técnica con aquella.

Sus funciones específicas serán las previstas reglamentariamente.

4. Las autoridades competentes podrán establecer mediante Orden ministerial obligaciones específicas para garantizar la seguridad de las redes y sistemas de información empleados por los operadores de servicios esenciales. Así mismo, podrán dictar instrucciones técnicas y guías orientativas para detallar el contenido de dichas órdenes.

Al elaborar las disposiciones reglamentarias, instrucciones y guías, tendrán en cuenta las obligaciones sectoriales, las directrices relevantes que se adopten en el grupo de cooperación y los requisitos en materia de seguridad de la información, a las que estuviera sometido el operador en virtud de otras normas, como la Ley 8/2011, de 28 de abril, y el Esquema Nacional de Seguridad, aprobado por el Real Decreto 3/2010, de 8 de enero.

5. Las autoridades competentes deberán coordinarse entre sí y con los diferentes órganos sectoriales con competencias por razón de la materia, en lo relativo al contenido y a la aplicación de las órdenes, instrucciones técnicas y guías orientativas que dicten en sus respectivos ámbitos de competencia, con objeto de evitar duplicidades en las obligaciones exigibles y facilitar su cumplimiento a los operadores de servicios esenciales.

6. Los proveedores de servicios digitales determinarán las medidas de seguridad que aplicarán, teniendo en cuenta, como mínimo, los avances técnicos y los siguientes aspectos:

a) La seguridad de los sistemas e instalaciones;

b) La gestión de incidentes;

c) La gestión de la continuidad de las actividades;

d) La supervisión, auditorías y pruebas;

e) El cumplimiento de las normas internacionales.

Los proveedores de servicios digitales atenderán igualmente a los actos de ejecución por los que la Comisión europea detalle los aspectos citados.

Artículo 17. Normas técnicas.

Las autoridades competentes promoverán la utilización de regulaciones, normas o especificaciones técnicas en materia de seguridad de las redes y sistemas de información elaboradas en el marco del Reglamento (UE) 1025/2012 del Parlamento Europeo y del Consejo de 25 de octubre de 2012 sobre la normalización europea.

En ausencia de dichas normas o especificaciones, promoverán la aplicación de las normas o recomendaciones internacionales aprobadas por los organismos internacionales de normalización, y, en su caso, de las normas y especificaciones técnicas aceptadas a nivel europeo o internacional que sean pertinentes en esta materia.

Artículo 18. Sectores con normativa específica equivalente.

Cuando una normativa nacional o comunitaria establezca para un sector obligaciones de seguridad de las redes y sistemas de información o de notificación de incidentes que tengan efectos, al menos, equivalentes a los de las obligaciones previstas en este real decreto-ley, prevalecerán aquellos requisitos y los mecanismos de supervisión correspondientes.

Ello no afectará al deber de cooperación entre autoridades competentes, a la coordinación ejercida por el Consejo de Seguridad Nacional ni, en la medida en que no sea incompatible con la legislación sectorial, a la aplicación del título V sobre notificación de incidentes.

TÍTULO V. Notificación de incidentes

Artículo 19. Obligación de notificar.

1. Los operadores de servicios esenciales notificarán a la autoridad competente, a través del CSIRT de referencia, los incidentes que puedan tener efectos perturbadores significativos en dichos servicios.

Las notificaciones podrán referirse también, conforme se determine reglamentariamente, a los sucesos o incidencias que puedan afectar a las redes y sistemas de información empleados para la prestación de los servicios esenciales, pero que aún no hayan tenido un efecto adverso real sobre aquéllos.

2. Así mismo, los proveedores de servicios digitales notificarán a la autoridad competente, a través del CSIRT de referencia, los incidentes que tengan efectos perturbadores significativos en dichos servicios.

La obligación de la notificación del incidente únicamente se aplicará cuando el proveedor de servicios digitales tenga acceso a la información necesaria para valorar el impacto de un incidente.

3. Las notificaciones tanto de operadores de servicios esenciales como de proveedores de servicios digitales se referirán a los incidentes que afecten a las redes y sistemas de información empleados en la prestación de los servicios indicados, tanto si se trata de redes y servicios propios como si lo son de proveedores externos, incluso si éstos son proveedores de servicios digitales sometidos a este real decreto-ley.

4. Las autoridades competentes y los CSIRT de referencia utilizarán una plataforma común para facilitar y automatizar los procesos de notificación, comunicación e información sobre incidentes.

5. El desarrollo reglamentario de este real decreto-ley preverá las medidas necesarias para el cumplimiento de lo preceptuado en este artículo por parte de los operadores de servicios esenciales. Las autoridades competentes podrán establecer, mediante Orden ministerial, obligaciones específicas de notificación por los operadores de servicios esenciales. Así mismo, podrán dictar instrucciones técnicas y guías orientativas para detallar el contenido de dichas órdenes.

Al elaborar las disposiciones reglamentarias, instrucciones y guías, se tendrán en cuenta las obligaciones sectoriales, las directrices relevantes que se adopten en el grupo de cooperación y los requisitos en materia de notificación de incidentes a los que estuviera sometido el operador en virtud de otras normas, como la Ley 8/2011, de 28 de abril, y el Esquema Nacional de Seguridad, aprobado por el Real Decreto 3/2010, de 8 de enero.

6. La obligación de notificación de incidentes prevista en los apartados anteriores no obsta al cumplimiento de los deberes legales de denuncia de aquellos hechos que revistan caracteres de delito ante las autoridades competentes, de acuerdo con lo dispuesto en los artículos 259 y siguientes de la Ley de Enjuiciamiento Criminal y teniendo en cuenta lo previsto en el artículo 14.3 de este real decreto-ley.

Artículo 20. Protección del notificante.

1. Las notificaciones consideradas en este título no sujetarán a la entidad que las efectúe a una mayor responsabilidad.

2. Los empleados y el personal que, por cualquier tipo de relación laboral o mercantil, participen en la prestación de los servicios esenciales o digitales, que informen sobre incidentes no podrán sufrir consecuencias adversas en su puesto de trabajo o con la empresa, salvo en los supuestos en que se acredite mala fe en su actuación.

Se entenderán nulas y sin efecto legal las decisiones del empleador tomadas en perjuicio o detrimento de los derechos laborales de los trabajadores que hayan actuado conforme a este apartado.

Artículo 21. Factores para determinar la importancia de los efectos de un incidente.

1. A los efectos de las notificaciones a las que se refiere el artículo 19.1, primer párrafo, la importancia de un incidente se determinará teniendo en cuenta, como mínimo, los siguientes factores:

a) El número de usuarios afectados por la perturbación del servicio esencial.

b) La duración del incidente.

c) La extensión o áreas geográficas afectadas por el incidente.

d) El grado de perturbación del funcionamiento del servicio.

e) El alcance del impacto en actividades económicas y sociales cruciales.

f) La importancia de los sistemas afectados o de la información afectada por el incidente para la prestación del servicio esencial.

g) El daño a la reputación.

2. En las notificaciones a las que se refiere el artículo 19.2, la importancia de un incidente se determinará conforme a lo que establezcan los actos de ejecución previstos en los apartados 8 y 9 del artículo 16 de la Directiva (UE) 2016/1148 del Parlamento Europeo y del Consejo, de 6 de julio de 2016.

Artículo 22. Notificación inicial, notificaciones intermedias y notificación final.

1. Los operadores de servicios esenciales deberán realizar una primera notificación de los incidentes a los que se refiere el artículo 19.1 sin dilación indebida.

La notificación incluirá, entre otros datos, información que permita determinar cualquier efecto transfronterizo del incidente.

2. Los operadores de servicios esenciales efectuarán las notificaciones intermedias que sean precisas para actualizar la información incorporada a la notificación inicial e informar sobre la evolución del incidente, mientras éste no esté resuelto.

3. Los operadores de servicios esenciales enviarán una notificación final del incidente tras su resolución.

Un incidente se considerará resuelto cuando se hayan restablecido las redes y sistemas de información afectados y el servicio opere con normalidad.

Artículo 23. Flexibilidad en la observancia de los plazos para la notificación.

Los operadores de servicios esenciales y los proveedores de servicios digitales podrán omitir, en las comunicaciones que realicen sobre los incidentes que les afecten, la información de la que aún no dispongan relativa a su repercusión sobre servicios esenciales u otros servicios que dependan de ellos para su prestación, u otra información de la que no dispongan. Tan pronto como conozcan dicha información deberán remitirla a la autoridad competente.

Si, transcurrido un tiempo prudencial desde la notificación inicial del incidente, el operador de servicios esenciales o el proveedor de servicios digitales no hubiera podido reunir la información pertinente, enviará a la autoridad competente, sin demora, un informe justificativo de las actuaciones realizadas para reunir la información y de los motivos por los que no ha sido posible obtenerla.

Artículo 24. Incidentes que afecten a servicios digitales.

Los operadores de servicios esenciales y los proveedores de servicios digitales sometidos a este real decreto-ley, así como cualquier otra parte interesada, que tengan noticia de incidentes que afecten de modo significativo a servicios digitales ofrecidos en España por proveedores establecidos en otros Estados miembros de la Unión Europea, podrán notificarlo a la autoridad competente aportando la información pertinente, al objeto de facilitar la cooperación con el Estado miembro en el que estuviese establecido el citado proveedor.

Del mismo modo, si tienen noticia de que dichos proveedores han incumplido los requisitos de seguridad o de notificación de incidentes ocurridos en España que les son aplicables, podrán notificarlo a la autoridad competente aportando la información pertinente.

Artículo 25. Tramitación de incidentes con impacto transfronterizo.

1. Cuando las autoridades competentes o los CSIRT de referencia tengan noticia de incidentes que pueden afectar a otros Estados miembros de la Unión Europea, informarán a través del punto de contacto único a los Estados miembros afectados, precisando si el incidente puede tener efectos perturbadores significativos para los servicios esenciales prestados en dichos Estados.

2. Cuando a través de dicho punto de contacto se reciba información sobre incidentes notificados en otros países de la Unión Europea que puedan tener efectos perturbadores significativos para los servicios esenciales prestados en España, se remitirá la información relevante a la autoridad competente y al CSIRT de referencia, para que adopten las medidas pertinentes en el ejercicio de sus funciones respectivas.

3. Las actuaciones consideradas en los apartados anteriores se entienden sin perjuicio de los intercambios de información que las autoridades competentes o los CSIRT de referencia puedan realizar de modo directo con sus homólogos de otros Estados miembros de la Unión Europea en relación con aquellos incidentes que puedan resultar de interés mutuo.

Artículo 26. Información al público.

1. La autoridad competente podrá exigir a los operadores de servicios esenciales o a los proveedores de servicios digitales que informen al público o a terceros potencialmente interesados sobre los incidentes cuando su conocimiento sea necesario para evitar nuevos incidentes o gestionar uno que ya se haya producido, o cuando la divulgación de un incidente redunde en beneficio del interés público.

2. La autoridad competente también podrá decidir informar de modo directo al público o a terceros sobre el incidente.

En estos casos la autoridad competente consultará y se coordinará con el operador de servicios esenciales o el proveedor de servicios digitales antes de informar al público.

Artículo 27. Información anual al punto de contacto único y al grupo de cooperación.

1. Las autoridades competentes transmitirán al punto de contacto único un informe anual sobre el número y tipo de incidentes comunicados, sus efectos en los servicios prestados o en otros servicios y su carácter nacional o transfronterizo dentro de la Unión Europea.

Las autoridades competentes elaborarán el informe siguiendo las instrucciones que dicte el punto de contacto único teniendo en cuenta las indicaciones del grupo de cooperación respecto al formato y contenido de la información a transmitir.

2. El punto de contacto único remitirá al grupo de cooperación antes del 9 de agosto de cada año un informe anual resumido sobre las notificaciones recibidas, y lo remitirá ulteriormente a las autoridades competentes y a los CSIRT de referencia, para su conocimiento.

Artículo 28. Obligación de resolver los incidentes, de información y de colaboración mutua.

1. Los operadores de servicios esenciales y los proveedores de servicios digitales tienen la obligación de resolver los incidentes de seguridad que les afecten, y de solicitar ayuda especializada, incluida la del CSIRT de referencia, cuando no puedan resolver por sí mismos los incidentes.

En tales casos deberán atender a las indicaciones que reciban del CSIRT de referencia para resolver el incidente, mitigar sus efectos y reponer los sistemas afectados.

2. Los operadores de servicios esenciales y los proveedores de servicios digitales han de suministrar al CSIRT de referencia y a la autoridad competente toda la información que se les requiera para el desempeño de las funciones que les encomienda el presente real decreto-ley.

En particular, podrá requerirse información adicional a los operadores de servicios esenciales y a los proveedores de servicios digitales para analizar la naturaleza, causas y efectos de los incidentes notificados, y para elaborar estadísticas y reunir los datos necesarios para elaborar los informes anuales considerados en el artículo 27.

Cuando las circunstancias lo permitan, la autoridad competente o el CSIRT de referencia proporcionarán a los operadores de servicios esenciales o a los proveedores de servicios digitales afectados por incidentes la información derivada de su seguimiento que pueda serles relevante, en particular, para resolver el incidente.

Artículo 29. Cooperación en lo relativo a los incidentes que afecten a datos personales.

Las autoridades competentes y los CSIRT de referencia cooperarán estrechamente con la Agencia Española de Protección de Datos para hacer frente a los incidentes que den lugar a violaciones de datos personales.

Las autoridades competentes y los CSIRT de referencia comunicarán sin dilación a la Agencia Española de Protección de Datos los incidentes que puedan suponer una vulneración de datos personales y la mantendrán informada sobre la evolución de tales incidentes.

Artículo 30. Autorización para la cesión de datos personales.

Si la notificación de incidentes o su gestión, análisis o resolución requiriera comunicar datos personales, su tratamiento se restringirá a los que sean estrictamente adecuados, pertinentes y limitados a lo necesario en relación con la finalidad, de las indicadas, que se persiga en cada caso.

Su cesión para estos fines se entenderá autorizada en los siguientes casos:

a) De los operadores de servicios esenciales y los proveedores de servicios digitales a las autoridades competentes, a través de los CSIRT de referencia.

b) Entre los CSIRT de referencia y las autoridades competentes, y viceversa.

c) Entre los CSIRT de referencia, y entre éstos y los CSIRT designados en otros Estados miembros de la Unión Europea.

d) Entre los CSIRT de referencia y otros CSIRT nacionales o internacionales.

e) Entre el punto de contacto único y los puntos de contacto únicos de otros Estados miembros de la Unión Europea.

Artículo 31. Notificaciones voluntarias.

1. Los operadores de servicios esenciales y los proveedores de servicios digitales podrán notificar los incidentes para los que no se establezca una obligación de notificación.

Así mismo, las entidades que presten servicios esenciales y no hayan sido identificadas como operadores de servicios esenciales y que no sean proveedores de servicios digitales podrán notificar los incidentes que afecten a dichos servicios.

Estas notificaciones obligan a la entidad que las efectúe a resolver el incidente de acuerdo con lo establecido en el artículo 28.

2. Las notificaciones a las que se refiere el apartado anterior se regirán por lo dispuesto en este título, y se informará sobre ellas al punto de contacto único en el informe anual previsto en el artículo 27.1.

3. Las notificaciones obligatorias gozarán de prioridad sobre las voluntarias a los efectos de su gestión por los CSIRT y por las autoridades competentes.

TÍTULO VI. Supervisión

Artículo 32. Supervisión de los operadores de servicios esenciales.

1. Las autoridades competentes podrán requerir a los operadores de servicios esenciales para que les proporcionen toda la información necesaria para evaluar la seguridad de las redes y sistemas de información, incluida la documentación sobre políticas de seguridad.

Podrán requerirles información sobre la aplicación efectiva de su política de seguridad, así como auditar o exigir al operador que someta la seguridad de sus redes y sistemas de información a una auditoría por una entidad externa, solvente e independiente.

2. A la vista de la información recabada, la autoridad competente podrá requerir al operador que subsane las deficiencias detectadas e indicarle cómo debe hacerlo.

Artículo 33. Supervisión de los proveedores de servicios digitales.

1. La autoridad competente para la supervisión de los servicios digitales sólo inspeccionará el cumplimiento de las obligaciones derivadas de este real decreto-ley cuando tenga noticia de algún incumplimiento, incluyendo por petición razonada de otros órganos o denuncia.

En tal caso, la autoridad competente podrá requerir al proveedor de servicios digitales para que le proporcione toda la información necesaria para evaluar la seguridad de sus redes y sistemas de información, incluida la documentación sobre políticas de seguridad, y para que subsane las deficiencias detectadas.

2. Cuando la autoridad competente tenga noticia de incidentes que perturben de modo significativo a servicios digitales ofrecidos en otros Estados miembros por proveedores establecidos en España, adoptará las medidas de supervisión pertinentes.

A estos efectos, tendrá especialmente en cuenta la información facilitada por las autoridades competentes de otros Estados miembros.

Artículo 34. Cooperación transfronteriza.

1. La supervisión se llevará a cabo, cuando proceda, en cooperación con las autoridades competentes de los Estados miembros en los que se ubiquen las redes y sistemas de información empleados para la prestación del servicio, o en que esté establecido el operador de servicios esenciales, el proveedor de servicios digitales o su representante.

2. Las autoridades competentes colaborarán con las autoridades competentes de otros Estados miembros cuando éstas requieran su cooperación en la supervisión y adopción de medidas por operadores de servicios esenciales y proveedores de servicios digitales en relación con las redes y sistemas de información ubicados en España, así como respecto a los proveedores de servicios digitales establecidos en España o cuyo representante en la Unión Europea tenga su residencia o domicilio social en España.

TÍTULO VII. Régimen sancionador

Artículo 35. Responsables.

Serán responsables los operadores de servicios esenciales y los proveedores de servicios digitales comprendidos en el ámbito de aplicación de este real decreto-ley.

Artículo 36. Infracciones.

1. Las infracciones de los preceptos de este real decreto-ley se clasifican en muy graves, graves y leves.

2. Son infracciones muy graves:

a) La falta de adopción de medidas para subsanar las deficiencias detectadas, de acuerdo con lo dispuesto en los artículos 32.2 o 33.1, cuando éstas le hayan hecho vulnerable a un incidente con efectos perturbadores significativos en el servicio y el operador de servicios esenciales o el proveedor de servicios digitales no hubiera atendido los requerimientos dictados por la autoridad competente con anterioridad a la producción del incidente.

b) El incumplimiento reiterado de la obligación de notificar incidentes con efectos perturbadores significativos en el servicio. Se considerará que es reiterado a partir del segundo incumplimiento.

c) No tomar las medidas necesarias para resolver los incidentes con arreglo a lo dispuesto en el artículo 28.1 cuando éstos tengan un efecto perturbador significativo en la prestación servicios esenciales o de servicios digitales en España o en otros Estados miembros.

3. Son infracciones graves:

a) El incumplimiento de las disposiciones reglamentarias o de las instrucciones técnicas de seguridad dictadas por la autoridad competente referidas a las precauciones mínimas que los operadores de servicios esenciales han de adoptar para garantizar la seguridad de las redes y sistemas de información.

b) La falta de adopción de medidas para subsanar las deficiencias detectadas en respuesta a un requerimiento dictado de acuerdo con los artículos 32.2 o 33.1, cuando ese sea el tercer requerimiento desatendido que se dicta en los cinco últimos años.

c) El incumplimiento de la obligación de notificar incidentes con efectos perturbadores significativos en el servicio.

d) La demostración de una notoria falta de interés en la resolución de incidentes con efectos perturbadores significativos notificados cuando dé lugar a una mayor degradación del servicio.

e) Proporcionar información falsa o engañosa al público sobre los estándares que cumple o las certificaciones de seguridad que mantiene en vigor.

f) Poner obstáculos a la realización de auditorías por la autoridad competente.

4. Son infracciones leves:

a) El incumplimiento de las disposiciones reglamentarias o de las instrucciones técnicas de seguridad dictadas por la autoridad competente al amparo de este real decreto-ley, cuando no suponga una infracción grave.

b) La falta de adopción de medidas para corregir las deficiencias detectadas en respuesta a un requerimiento de subsanación dictado de acuerdo con los artículos 32.2 o 33.1.

c) No facilitar la información que sea requerida por las autoridades competentes sobre sus políticas de seguridad, o proporcionar información incompleta o tardía sin justificación.

d) No someterse a una auditoría de seguridad según lo ordenado por la autoridad competente.

e) No proporcionar al CSIRT de referencia o a la autoridad competente la información que soliciten en virtud del artículo 28.2.

f) La falta de notificación de los sucesos o incidencias para los que, aunque no hayan tenido un efecto adverso real sobre los servicios, exista obligación de notificación en virtud del párrafo segundo del artículo 19.2.

g) No completar la información que debe reunir la notificación de incidentes teniendo en cuenta lo dispuesto en el artículo 23, o no remitir el informe justificativo sobre la imposibilidad de reunir la información previsto en dicho artículo.

h) No seguir las indicaciones que reciba del CSIRT de referencia para resolver un incidente, de acuerdo con el artículo 28.

Artículo 37. Sanciones.

1. Por la comisión de las infracciones recogidas en el artículo anterior, se impondrán las siguientes sanciones:

a) Por la comisión de infracciones muy graves, multa de 500.001 hasta 1.000.000 euros.

b) Por la comisión de infracciones graves, multa de 100.001 hasta 500.000 euros.

c) Por la comisión de infracciones leves, amonestación o multa hasta 100.000 euros.

2. Las sanciones firmes en vía administrativa por infracciones muy graves y graves podrán ser publicadas, a costa del sancionado, en el «Boletín Oficial del Estado» y en el sitio de Internet de la autoridad competente, en atención a los hechos concurrentes y de conformidad con el artículo siguiente.

Artículo 38. Graduación de la cuantía de las sanciones.

El órgano sancionador establecerá la sanción teniendo en cuenta los siguientes criterios:

a) El grado de culpabilidad o la existencia de intencionalidad.

b) La continuidad o persistencia en la conducta infractora.

c) La naturaleza y cuantía de los perjuicios causados.

d) La reincidencia, por comisión en el último año de más de una infracción de la misma naturaleza, cuando así haya sido declarado por resolución firme en vía administrativa.

e) El número de usuarios afectados.

f) El volumen de facturación del responsable.

g) La utilización por el responsable de programas de recompensa por el descubrimiento de vulnerabilidades en sus redes y sistemas de información.

h) Las acciones realizadas por el responsable para paliar los efectos o consecuencias de la infracción.

Artículo 39. Proporcionalidad de sanciones.

1. El órgano sancionador podrá establecer la cuantía de la sanción aplicando la escala relativa a la clase de infracciones que preceda inmediatamente en gravedad a aquella en que se integra la considerada en el caso de que se trate, en los siguientes supuestos:

a) Cuando se aprecie una cualificada disminución de la culpabilidad del imputado como consecuencia de la concurrencia significativa de varios de los criterios enunciados en el artículo 38.

b) Cuando la entidad infractora haya regularizado la situación irregular de forma diligente.

c) Cuando el infractor haya reconocido espontáneamente su culpabilidad.

2. Los órganos con competencia sancionadora, atendida la naturaleza de los hechos y la concurrencia significativa de los criterios establecidos en el apartado anterior, podrán no acordar el inicio del procedimiento sancionador y, en su lugar, apercibir al sujeto responsable a fin de que, en el plazo que el órgano sancionador determine, acredite la adopción de las medidas correctoras que, en cada caso, resulten pertinentes, siempre que concurran los siguientes presupuestos:

a) Que los hechos fuesen constitutivos de infracción leve o grave conforme a lo dispuesto en este real decreto-ley.

b) Que el órgano competente no hubiese sancionado o apercibido al infractor en los dos años previos como consecuencia de la comisión de infracciones previstas en este real decreto-ley.

Si el apercibimiento no fuera atendido en el plazo que el órgano sancionador hubiera determinado, procederá la apertura del correspondiente procedimiento sancionador por dicho incumplimiento.

3. No podrán ser objeto de apercibimiento las infracciones leves descritas en el artículo 36.4 c), d) y e) y la infracción grave prevista en el artículo 36.3 e).

Artículo 40. Infracciones de las Administraciones públicas.

1. Cuando las infracciones a que se refiere el artículo 36 fuesen cometidas por órganos o entidades de las Administraciones Públicas, el órgano sancionador dictará una resolución estableciendo las medidas que procede adoptar para que cesen o se corrijan los efectos de la infracción. Esta resolución se notificará al órgano o entidad infractora y a los afectados, si los hubiera.

Además de lo anterior, el órgano sancionador podrá proponer también la iniciación de actuaciones disciplinarias, si procedieran.

2. Se deberán comunicar al órgano sancionador las resoluciones que recaigan en relación con las medidas y actuaciones a que se refiere el apartado anterior.

Artículo 41. Competencia sancionadora.

1. La imposición de sanciones corresponderá, en el caso de infracciones muy graves, al Ministro competente en virtud de lo dispuesto en el artículo 9, y en el caso de infracciones graves y leves al órgano de la autoridad competente que se determine mediante el reglamento de desarrollo de este real decreto-ley.

2. La potestad sancionadora se ejercerá con arreglo a los principios y al procedimiento previstos en las Leyes 39/2015, de 1 de octubre, del Procedimiento Administrativo Común de las Administraciones Públicas, y 40/2015, de 1 de octubre, de Régimen Jurídico del Sector Público.

3. El ejercicio de la potestad sancionadora se sujetará al procedimiento aplicable, con carácter general, a la actuación de las Administraciones públicas. No obstante, el plazo máximo de duración del procedimiento será de un año y el plazo de alegaciones no tendrá una duración inferior a un mes.

Artículo 42. Concurrencia de infracciones.

1. No procederá la imposición de sanciones según lo previsto en este real decreto-ley cuando los hechos constitutivos de infracción lo sean también de otra tipificada en la normativa sectorial a la que esté sujeto el prestador del servicio y exista identidad del bien jurídico protegido.

2. Cuando, como consecuencia de una actuación sancionadora, se tuviera conocimiento de hechos que pudieran ser constitutivos de infracciones tipificadas en otras leyes, se dará cuenta de los mismos a los órganos u organismos competentes para su supervisión y sanción.

Disposición adicional primera. Relación inicial de servicios esenciales y operadores de servicios esenciales.

La Comisión Nacional para la Protección de las Infraestructuras Críticas aprobará una primera lista de servicios esenciales dentro de los sectores incluidos en el ámbito de aplicación de este real decreto-ley e identificará a los operadores que los presten que deban sujetarse a este real decreto-ley en el siguiente orden:

a) Antes del 9 de noviembre de 2018: los servicios esenciales y los operadores correspondientes a los sectores estratégicos energía, transporte, salud, sistema financiero, agua, e infraestructuras digitales.

b) Antes del 9 de noviembre de 2019: los servicios esenciales y los operadores correspondientes al resto de los sectores estratégicos recogidos en el anexo de la Ley 8/2011, de 28 de abril.

Disposición adicional segunda. Comunicaciones electrónicas y servicios de confianza.

La aplicación de este real decreto-ley a los operadores de redes y servicios de comunicaciones electrónicas y de servicios electrónicos de confianza que sean designados como operadores críticos en virtud de la Ley 8/2011, de 28 de abril, no obstará a la aplicación de su normativa específica en materia de seguridad.

El Ministerio de Economía y Empresa, como órgano competente para la aplicación de dicha normativa, y el Ministerio del Interior actuarán de manera coordinada en el establecimiento de obligaciones que recaigan sobre los operadores críticos. Así mismo, mantendrán un intercambio fluido de información sobre incidentes que les afecten.

Disposición adicional tercera. Notificación de violaciones de seguridad de los datos personales a través de la plataforma común prevista en este real decreto-ley.

La plataforma común para la notificación de incidentes prevista en este real decreto-ley podrá ser empleada para la notificación de vulneraciones de la seguridad de datos personales según el Reglamento (UE) 2016/679 del Parlamento Europeo y del Consejo, de 27 de abril de 2016, relativo a la protección de las personas físicas en lo que respecta al tratamiento de datos personales y a la libre circulación de estos datos y por el que se deroga la Directiva 95/46/CE, en los términos que acuerden la Agencia Española de Protección de Datos y los órganos que gestionen dicha plataforma.

Disposición adicional cuarta. Proveedores de servicios digitales ya existentes.

Los proveedores de servicios digitales que ya vinieran prestando servicios deberán comunicar su actividad a la Secretaría de Estado para el Avance Digital del Ministerio de Economía y Empresa, en el plazo de tres meses desde la entrada en vigor de este real decreto-ley.

Disposición final primera. Título competencial.

Este real decreto-ley se dicta en virtud de las competencias exclusivas atribuidas al Estado en materia de régimen general de telecomunicaciones y seguridad pública, por el artículo 149.1.21.ª y 29.ª de la Constitución.

Disposición final segunda. Incorporación del Derecho de la Unión Europea.

Este real decreto-ley incorpora al ordenamiento jurídico interno la Directiva (UE) 2016/1148 del Parlamento Europeo y del Consejo, de 6 de julio de 2016, relativa a las medidas destinadas a garantizar un elevado nivel común de seguridad de las redes y sistemas de información en la Unión.

Disposición final tercera. Habilitación para el desarrollo reglamentario.

Se habilita al Gobierno para desarrollar reglamentariamente lo previsto en este real decreto-ley sin perjuicio de la competencia de los Ministros para fijar las obligaciones específicas mediante Orden Ministerial en los supuestos previstos en el articulado de esta norma.

Disposición final cuarta. Entrada en vigor.

El presente real decreto-ley entrará en vigor el día siguiente al de su publicación en el «Boletín Oficial del Estado».

Dado en Madrid, el 7 de septiembre de 2018.

FELIPE R.

El Presidente del Gobierno, PEDRO SÁNCHEZ PÉREZ-CASTEJÓN

13Sep/18

Electronic Code of Federal Regulations

13 septiembre, 2018Código, Estados UnidosJosé Cuervo

Electronic Code of Federal Regulations.

Title 17. Commodity and Securities Exchanges.

Chapter I. Commodity Futures Trading Commission.

Part. 1. General Regulations under the Commodity Exchange Act.

Section 1.4. Electronic signatures, acknowledgements and verifications.

For purposes of complying with any provision in the Commodity Exchange Act or the rules or regulations in this Chapter I that requires a swap transaction to be acknowledged by a swap dealer or major swap participant or a document to be signed or verified by a customer of a futures commission merchant or introducing broker, a retail forex customer of a retail foreign exchange dealer or futures commission merchant, a pool participant or a client of a commodity trading advisor, or a counterparty of a swap dealer or major swap participant, an electronic signature executed by the customer, retail forex customer, participant, client, counterparty, swap dealer, or major swap participant will be sufficient, if the futures commission merchant, retail foreign exchange dealer, introducing broker, commodity pool operator, commodity trading advisor, swap dealer, or major swap participant elects generally to accept electronic signatures, acknowledgments or verifications or another Commission rule permits the use of electronic signatures for the purposes listed above; Provided, however, That the electronic signature must comply with applicable Federal laws and other Commission rules; And, Provided further, That the futures commission merchant, retail foreign exchange dealer, introducing broker, commodity pool operator, commodity trading advisor, swap dealer, or major swap participant must adopt and use reasonable safeguards regarding the use of electronic signatures, including at a minimum safeguards employed to prevent alteration of the electronic record with which the electronic signature is associated, after such record has been electronically signed.

[77 FR 66320, Nov. 2, 2012]

Title 21. Food and Drugs

Chapter I. Food and Drug Administration, Department of Health and Human Services.

Part 11. Electronic Records; Electronic Signatures

Subpart A—GENERAL PROVISIONS

11.1 Scope.

(a) The regulations in this part set forth the criteria under which the agency considers electronic records, electronic signatures, and handwritten signatures executed to electronic records to be trustworthy, reliable, and generally equivalent to paper records and handwritten signatures executed on paper.

(b) This part applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted, under any records requirements set forth in agency regulations. This part also applies to electronic records submitted to the agency under requirements of the Federal Food, Drug, and Cosmetic Act and the Public Health Service Act, even if such records are not specifically identified in agency regulations. However, this part does not apply to paper records that are, or have been, transmitted by electronic means.

(c) Where electronic signatures and their associated electronic records meet the requirements of this part, the agency will consider the electronic signatures to be equivalent to full handwritten signatures, initials, and other general signings as required by agency regulations, unless specifically excepted by regulation(s) effective on or after August 20, 1997.

(d) Electronic records that meet the requirements of this part may be used in lieu of paper records, in accordance with §11.2, unless paper records are specifically required.

11.2 Implementation.

(a) For records required to be maintained but not submitted to the agency, persons may use electronic records in lieu of paper records or electronic signatures in lieu of traditional signatures, in whole or in part, provided that the requirements of this part are met.

(b) For records submitted to the agency, persons may use electronic records in lieu of paper records or electronic signatures in lieu of traditional signatures, in whole or in part, provided that:

(1) The requirements of this part are met; and

(2) The document or parts of a document to be submitted have been identified in public docket No. 92S-0251 as being the type of submission the agency accepts in electronic form. This docket will identify specifically what types of documents or parts of documents are acceptable for submission in electronic form without paper records and the agency receiving unit(s) (e.g., specific center, office, division, branch) to which such submissions may be made. Documents to agency receiving unit(s) not specified in the public docket will not be considered as official if they are submitted in electronic form; paper forms of such documents will be considered as official and must accompany any electronic records. Persons are expected to consult with the intended agency receiving unit for details on how (e.g., method of transmission, media, file formats, and technical protocols) and whether to proceed with the electronic submission.

11.3 Definitions.

(a) The definitions and interpretations of terms contained in section 201 of the act apply to those terms when used in this part.

(b) The following definitions of terms also apply to this part:

(1) Act means the Federal Food, Drug, and Cosmetic Act (secs. 201-903 (21 U.S.C. 321-393)).

(2) Agency means the Food and Drug Administration.

(3) Biometrics means a method of verifying an individual’s identity based on measurement of the individual’s physical feature(s) or repeatable action(s) where those features and/or actions are both unique to that individual and measurable.

(4) Closed system means an environment in which system access is controlled by persons who are responsible for the content of electronic records that are on the system.

(5) Digital signature means an electronic signature based upon cryptographic methods of originator authentication, computed by using a set of rules and a set of parameters such that the identity of the signer and the integrity of the data can be verified.

(6) Electronic record means any combination of text, graphics, data, audio, pictorial, or other information representation in digital form that is created, modified, maintained, archived, retrieved, or distributed by a computer system.

(7) Electronic signature means a computer data compilation of any symbol or series of symbols executed, adopted, or authorized by an individual to be the legally binding equivalent of the individual’s handwritten signature.

(8) Handwritten signature means the scripted name or legal mark of an individual handwritten by that individual and executed or adopted with the present intention to authenticate a writing in a permanent form. The act of signing with a writing or marking instrument such as a pen or stylus is preserved. The scripted name or legal mark, while conventionally applied to paper, may also be applied to other devices that capture the name or mark.

(9) Open system means an environment in which system access is not controlled by persons who are responsible for the content of electronic records that are on the system.

Subpart B—ELECTRONIC RECORDS

11.10 Controls for closed systems.

Persons who use closed systems to create, modify, maintain, or transmit electronic records shall employ procedures and controls designed to ensure the authenticity, integrity, and, when appropriate, the confidentiality of electronic records, and to ensure that the signer cannot readily repudiate the signed record as not genuine. Such procedures and controls shall include the following:

(a) Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records.

(b) The ability to generate accurate and complete copies of records in both human readable and electronic form suitable for inspection, review, and copying by the agency. Persons should contact the agency if there are any questions regarding the ability of the agency to perform such review and copying of the electronic records.

(d) Limiting system access to authorized individuals.

11.30 Controls for open systems.

Persons who use open systems to create, modify, maintain, or transmit electronic records shall employ procedures and controls designed to ensure the authenticity, integrity, and, as appropriate, the confidentiality of electronic records from the point of their creation to the point of their receipt. Such procedures and controls shall include those identified in §11.10, as appropriate, and additional measures such as document encryption and use of appropriate digital signature standards to ensure, as necessary under the circumstances, record authenticity, integrity, and confidentiality.

11.50 Signature manifestations.

(a) Signed electronic records shall contain information associated with the signing that clearly indicates all of the following:

(1) The printed name of the signer;

(2) The date and time when the signature was executed; and

(3) The meaning (such as review, approval, responsibility, or authorship) associated with the signature.

(b) The items identified in paragraphs (a)(1), (a)(2), and (a)(3) of this section shall be subject to the same controls as for electronic records and shall be included as part of any human readable form of the electronic record (such as electronic display or printout).

11.70 Signature/record linking.

Electronic signatures and handwritten signatures executed to electronic records shall be linked to their respective electronic records to ensure that the signatures cannot be excised, copied, or otherwise transferred to falsify an electronic record by ordinary means.

Subpart C—ELECTRONIC SIGNATURES

11.100 General requirements.

(a) Each electronic signature shall be unique to one individual and shall not be reused by, or reassigned to, anyone else.

(b) Before an organization establishes, assigns, certifies, or otherwise sanctions an individual’s electronic signature, or any element of such electronic signature, the organization shall verify the identity of the individual.

(c) Persons using electronic signatures shall, prior to or at the time of such use, certify to the agency that the electronic signatures in their system, used on or after August 20, 1997, are intended to be the legally binding equivalent of traditional handwritten signatures.

(1) The certification shall be submitted in paper form and signed with a traditional handwritten signature, to the Office of Regional Operations (HFC-100), 5600 Fishers Lane, Rockville, MD 20857.

(2) Persons using electronic signatures shall, upon agency request, provide additional certification or testimony that a specific electronic signature is the legally binding equivalent of the signer’s handwritten signature.

11.200 Electronic signature components and controls.

(a) Electronic signatures that are not based upon biometrics shall:

(1) Employ at least two distinct identification components such as an identification code and password.

(i) When an individual executes a series of signings during a single, continuous period of controlled system access, the first signing shall be executed using all electronic signature components; subsequent signings shall be executed using at least one electronic signature component that is only executable by, and designed to be used only by, the individual.

(ii) When an individual executes one or more signings not performed during a single, continuous period of controlled system access, each signing shall be executed using all of the electronic signature components.

(2) Be used only by their genuine owners; and

(3) Be administered and executed to ensure that attempted use of an individual’s electronic signature by anyone other than its genuine owner requires collaboration of two or more individuals.

(b) Electronic signatures based upon biometrics shall be designed to ensure that they cannot be used by anyone other than their genuine owners.

11.300 Controls for identification codes/passwords.

Persons who use electronic signatures based upon use of identification codes in combination with passwords shall employ controls to ensure their security and integrity. Such controls shall include:

(a) Maintaining the uniqueness of each combined identification code and password, such that no two individuals have the same combination of identification code and password.

(b) Ensuring that identification code and password issuances are periodically checked, recalled, or revised (e.g., to cover such events as password aging).

(c) Following loss management procedures to electronically deauthorize lost, stolen, missing, or otherwise potentially compromised tokens, cards, and other devices that bear or generate identification code or password information, and to issue temporary or permanent replacements using suitable, rigorous controls.

(d) Use of transaction safeguards to prevent unauthorized use of passwords and/or identification codes, and to detect and report in an immediate and urgent manner any attempts at their unauthorized use to the system security unit, and, as appropriate, to organizational management.

(e) Initial and periodic testing of devices, such as tokens or cards, that bear or generate identification code or password information to ensure that they function properly and have not been altered in an unauthorized manner.

13Sep/18

Government Paperwork Elimination Act.

13 septiembre, 2018Estados Unidos, LeyJosé Cuervo

United States Code. Government Paperwork Elimination Act. Title 44. Public Printing and Documents. Chapter 35. Coordination of Federal Information Policy. Subchapter I. Federal Information Policy. Sectión 3504. (Added Pub. L. 107–347, title III, § 305(c)(1), Dec. 17, 2002, 116 Stat. 2960)

Title 44. Public Printing and Documents.

Chapter 35. Coordination of Federal Information Policy.

Subchapter I. Federal Information Policy.

Sectión 3504. Authority and functions of Director

(a)

(1) The Director shall oversee the use of information resources to improve the efficiency and effectiveness of governmental operations to serve agency missions, including burden reduction and service delivery to the public. In performing such oversight, the Director shall:

(A) develop, coordinate and oversee the implementation of Federal information resources management policies, principles, standards, and guidelines; and

(B) provide direction and oversee:

(i) the review and approval of the collection of information and the reduction of the information collection burden;

(ii) agency dissemination of and public access to information;

(iii) statistical activities;

(iv) records management activities;

(v) privacy, confidentiality, security, disclosure, and sharing of information; and

(vi) the acquisition and use of information technology, including alternative information technologies that provide for electronic submission, maintenance, or disclosure of information as a substitute for paper and for the use and acceptance of electronic signatures.

(2) The authority of the Director under this subchapter shall be exercised consistent with applicable law.

(b) With respect to general information resources management policy, the Director shall:

(1) develop and oversee the implementation of uniform information resources management policies, principles, standards, and guidelines;

(2) foster greater sharing, dissemination, and access to public information, including through:

(A) the use of the Government Information Locator Service; and

(B) the development and utilization of common standards for information collection, storage, processing and communication, including standards for security, interconnectivity and interoperability;

(3) initiate and review proposals for changes in legislation, regulations, and agency procedures to improve information resources management practices;

(4) oversee the development and implementation of best practices in information resources management, including training; and

(5) oversee agency integration of program and management functions with information resources management functions.

(1) review and approve proposed agency collections of information;

(2) coordinate the review of the collection of information associated with Federal procurement and acquisition by the Office of Information and Regulatory Affairs with the Office of Federal Procurement Policy, with particular emphasis on applying information technology to improve the efficiency and effectiveness of Federal procurement, acquisition and payment, and to reduce information collection burdens on the public;

(3) minimize the Federal information collection burden, with particular emphasis on those individuals and entities most adversely affected;

(4) maximize the practical utility of and public benefit from information collected by or for the Federal Government;

(5) establish and oversee standards and guidelines by which agencies are to estimate the burden to comply with a proposed collection of information; [1]

(6) publish in the Federal Register and make available on the Internet (in consultation with the Small Business Administration) on an annual basis a list of the compliance assistance resources available to small businesses, with the first such publication occurring not later than 1 year after the date of enactment of the Small Business Paperwork Relief Act of 2002.

(d) With respect to information dissemination, the Director shall develop and oversee the implementation of policies, principles, standards, and guidelines to:

(1) apply to Federal agency dissemination of public information, regardless of the form or format in which such information is disseminated; and

(2) promote public access to public information and fulfill the purposes of this subchapter, including through the effective use of information technology.

(e) With respect to statistical policy and coordination, the Director shall:

(1) coordinate the activities of the Federal statistical system to ensure:

(A) the efficiency and effectiveness of the system; and

(B) the integrity, objectivity, impartiality, utility, and confidentiality of information collected for statistical purposes;

(2) ensure that budget proposals of agencies are consistent with system-wide priorities for maintaining and improving the quality of Federal statistics and prepare an annual report on statistical program funding;

(3) develop and oversee the implementation of Governmentwide policies, principles, standards, and guidelines concerning:

(A) statistical collection procedures and methods;

(B) statistical data classification;

(D) timely release of statistical data; and

(E) such statistical data sources as may be required for the administration of Federal programs;

(4) evaluate statistical program performance and agency compliance with Governmentwide policies, principles, standards and guidelines;

(5) promote the sharing of information collected for statistical purposes consistent with privacy rights and confidentiality pledges;

(6) coordinate the participation of the United States in international statistical activities, including the development of comparable statistics;

(7) appoint a chief statistician who is a trained and experienced professional statistician to carry out the functions described under this subsection;

(8) establish an Interagency Council on Statistical Policy to advise and assist the Director in carrying out the functions under this subsection that shall:

(A) be headed by the chief statistician; and

(B) consist of:

(i) the heads of the major statistical programs; and

(ii) representatives of other statistical agencies under rotating membership; and

(9) provide opportunities for training in statistical policy functions to employees of the Federal Government under which:

(A) each trainee shall be selected at the discretion of the Director based on agency requests and shall serve under the chief statistician for at least 6 months and not more than 1 year; and

(B) all costs of the training shall be paid by the agency requesting training.

(f) With respect to records management, the Director shall:

(1) provide advice and assistance to the Archivist of the United States and the Administrator of General Services to promote coordination in the administration of chapters 29, 31, and 33 of this title with the information resources management policies, principles, standards, and guidelines established under this subchapter;

(2) review compliance by agencies with:

(A) the requirements of chapters 29, 31, and 33 of this title; and

(B) regulations promulgated by the Archivist of the United States and the Administrator of General Services; and

(3) oversee the application of records management policies, principles, standards, and guidelines, including requirements for archiving information maintained in electronic format, in the planning and design of information systems.

(g) With respect to privacy and security, the Director shall:

(1) develop and oversee the implementation of policies, principles, standards, and guidelines on privacy, confidentiality, security, disclosure and sharing of information collected or maintained by or for agencies; and

(2) oversee and coordinate compliance with sections 552 and 552a of title 5, sections 20 and 21 of the National Institute of Standards and Technology Act (15 U.S.C. 278g–3 and 278g–4), section 11331 of title 40 and subchapter II of this chapter, and related information management laws.

(h) With respect to Federal information technology, the Director shall:

(1) in consultation with the Director of the National Institute of Standards and Technology and the Administrator of General Services:

(A) develop and oversee the implementation of policies, principles, standards, and guidelines for information technology functions and activities of the Federal Government, including periodic evaluations of major information systems; and

(B) oversee the development and implementation of standards under section 11331 of title 40;

(2) monitor the effectiveness of, and compliance with, directives issued under subtitle III of title 40 and directives issued under section 322 [2] of title 40;

(3) coordinate the development and review by the Office of Information and Regulatory Affairs of policy associated with Federal procurement and acquisition of information technology with the Office of Federal Procurement Policy;

(4) ensure, through the review of agency budget proposals, information resources management plans and other means:

(A) agency integration of information resources management plans, program plans and budgets for acquisition and use of information technology; and

(B) the efficiency and effectiveness of inter-agencyinformation technology initiatives to improve agency performance and the accomplishment of agency missions; and

(5) promote the use of information technology by the Federal Government to improve the productivity, efficiency, and effectiveness of Federal programs, including through dissemination of public information and the reduction of information collection burdens on the public.

(Added Pub. L. 104–13, § 2, May 22, 1995, 109 Stat. 167; amended Pub. L. 104–106, div. E, title LI, § 5131(e)(1), title LVI, § 5605(b), (c), Feb. 10, 1996, 110 Stat. 688, 700; Pub. L. 105–85, div. A, title X, § 1073(h)(5)(B), (C), Nov. 18, 1997, 111 Stat. 1907; Pub. L. 105–277, div. C, title XVII, § 1702, Oct. 21, 1998, 112 Stat. 2681–749; Pub. L. 106–398, § 1 [[div. A], title X, § 1064(b)], Oct. 30, 2000, 114 Stat. 1654, 1654A–275; Pub. L. 107–198, § 2(a), June 28, 2002, 116 Stat. 729; Pub. L. 107–217, § 3(l)(5), Aug. 21, 2002, 116 Stat. 1301; Pub. L. 107–296, title X, § 1005(c)(1), Nov. 25, 2002, 116 Stat. 2272; Pub. L. 107–347, title III, § 305(c)(1), Dec. 17, 2002, 116 Stat. 2960.)

[1]  So in original. Probably should be followed by “and”.

[2]  See References in Text note below.

13Sep/18

Electronic Signatures in Global and National Commerce Act.

13 septiembre, 2018Estados Unidos, LeyCurrent to May 2016, Derecho Informático Estados Unidos, Legislación Estados Unidos, United States Code. Electronic Signatures in Global and National Commerce Act. Title 15. Commerceand Trade. Chapter 96. Electronic Signatures in Global and National Commerce. Sections 7001-7031José Cuervo

United States Code. Electronic Signatures in Global and National Commerce Act. Title 15. Commerceand Trade. Chapter 96. Electronic Signatures in Global and National Commerce. Sections 7001-7031, Current to June 2000

Subchapter I. Electronic Records and Signatures in Commerce (§§ 7001-7006)

§ 7001 – General rule of validity

(a) In general Notwithstanding any statute, regulation, or other rule of law (other than this subchapter and subchapter II), with respect to any transaction in or affecting interstate or foreign commerce:

(1) a signature, contract, or other record relating to such transaction may not be denied legal effect, validity, or enforceability solely because it is in electronic form; and

(2) a contract relating to such transaction may not be denied legal effect, validity, or enforceability solely because an electronic signature or electronic record was used in its formation.

(b) Preservation of rights and obligationsThis subchapter does not:

(1) limit, alter, or otherwise affect any requirement imposed by a statute, regulation, or rule of law relating to the rights and obligations of persons under such statute, regulation, or rule of law other than a requirement that contracts or other records be written, signed, or in nonelectronic form; or

(2) require any person to agree to use or accept electronic records or electronic signatures, other than a governmental agency with respect to a record other than a contract to which it is a party.

(1) Consent to electronic recordsNotwithstanding subsection (a), if a statute, regulation, or other rule of law requires that information relating to a transaction or transactions in or affecting interstate or foreign commerce be provided or made available to a consumer in writing, the use of an electronic record to provide or make available (whichever is required) such information satisfies the requirement that such information be in writing if:

(A) the consumer has affirmatively consented to such use and has not withdrawn such consent;

(B) the consumer, prior to consenting, is provided with a clear and conspicuous statement:

(i) informing the consumer of (I) any right or option of the consumer to have the record provided or made available on paper or in nonelectronic form, and (II) the right of the consumer to withdraw the consent to have the record provided or made available in an electronic form and of any conditions, consequences (which may include termination of the parties’ relationship), or fees in the event of such withdrawal;

(ii) informing the consumer of whether the consent applies (I) only to the particular transaction which gave rise to the obligation to provide the record, or (II) to identified categories of records that may be provided or made available during the course of the parties’ relationship;

(iii) describing the procedures the consumer must use to withdraw consent as provided in clause (i) and to update information needed to contact the consumer electronically; and

(iv) informing the consumer (I) how, after the consent, the consumer may, upon request, obtain a paper copy of an electronic record, and (II) whether any fee will be charged for such copy;

(i) prior to consenting, is provided with a statement of the hardware and software requirements for access to and retention of the electronic records; and

(ii) consents electronically, or confirms his or her consent electronically, in a manner that reasonably demonstrates that the consumer can access information in the electronic form that will be used to provide the information that is the subject of the consent; and

(D) after the consent of a consumer in accordance with subparagraph (A), if a change in the hardware or software requirements needed to access or retain electronic records creates a material risk that the consumer will not be able to access or retain a subsequent electronic record that was the subject of the consent, the person providing the electronic record:

(i) provides the consumer with a statement of (I) the revised hardware and software requirements for access to and retention of the electronic records, and (II) the right to withdraw consent without the imposition of any fees for such withdrawal and without the imposition of any condition or consequence that was not disclosed under subparagraph (B)(i); and

(ii) again complies with subparagraph (C).

(2) Other rights

(A) Preservation of consumer protections

Nothing in this subchapter affects the content or timing of any disclosure or other record required to be provided or made available to any consumer under any statute, regulation, or other rule of law.

(B) Verification or acknowledgment

If a law that was enacted prior to this chapter expressly requires a record to be provided or made available by a specified method that requires verification or acknowledgment of receipt, the record may be provided or made available electronically only if the method used provides verification or acknowledgment of receipt (whichever is required).

(3) Effect of failure to obtain electronic consent or confirmation of consent

The legal effectiveness, validity, or enforceability of any contract executed by a consumer shall not be denied solely because of the failure to obtain electronic consent or confirmation of consent by that consumer in accordance with paragraph (1)(C)(ii).

(4) Prospective effect

Withdrawal of consent by a consumer shall not affect the legal effectiveness, validity, or enforceability of electronic records provided or made available to that consumer in accordance with paragraph (1) prior to implementation of the consumer’s withdrawal of consent. A consumer’s withdrawal of consent shall be effective within a reasonable period of time after receipt of the withdrawal by the provider of the record. Failure to comply with paragraph (1)(D) may, at the election of the consumer, be treated as a withdrawal of consent for purposes of this paragraph.

(5) Prior consent

This subsection does not apply to any records that are provided or made available to a consumer who has consented prior to the effective date of this subchapter to receive such records in electronic form as permitted by any statute, regulation, or other rule of law.

(6) Oral communications

An oral communication or a recording of an oral communication shall not qualify as an electronic record for purposes of this subsection except as otherwise provided under applicable law.

(d) Retention of contracts and records

(1) Accuracy and accessibilityIf a statute, regulation, or other rule of law requires that a contract or other record relating to a transaction in or affecting interstate or foreign commerce be retained, that requirement is met by retaining an electronic record of the information in the contract or other record that:

(A) accurately reflects the information set forth in the contract or other record; and

(B) remains accessible to all persons who are entitled to access by statute, regulation, or rule of law, for the period required by such statute, regulation, or rule of law, in a form that is capable of being accurately reproduced for later reference, whether by transmission, printing, or otherwise.

(2) Exception

A requirement to retain a contract or other record in accordance with paragraph (1) does not apply to any information whose sole purpose is to enable the contract or other record to be sent, communicated, or received.

(3) Originals

If a statute, regulation, or other rule of law requires a contract or other record relating to a transaction in or affecting interstate or foreign commerce to be provided, available, or retained in its original form, or provides consequences if the contract or other record is not provided, available, or retained in its original form, that statute, regulation, or rule of law is satisfied by an electronic record that complies with paragraph (1).

(4) Checks

If a statute, regulation, or other rule of law requires the retention of a check, that requirement is satisfied by retention of an electronic record of the information on the front and back of the check in accordance with paragraph (1).

(e) Accuracy and ability to retain contracts and other records

Notwithstanding subsection (a), if a statute, regulation, or other rule of law requires that a contract or other record relating to a transaction in or affecting interstate or foreign commerce be in writing, the legal effect, validity, or enforceability of an electronic record of such contract or other record may be denied if such electronic record is not in a form that is capable of being retained and accurately reproduced for later reference by all parties or persons who are entitled to retain the contract or other record.

(f) Proximity

Nothing in this subchapter affects the proximity required by any statute, regulation, or other rule of law with respect to any warning, notice, disclosure, or other record required to be posted, displayed, or publicly affixed.

(g) Notarization and acknowledgment

If a statute, regulation, or other rule of law requires a signature or record relating to a transaction in or affecting interstate or foreign commerce to be notarized, acknowledged, verified, or made under oath, that requirement is satisfied if the electronic signature of the person authorized to perform those acts, together with all other information required to be included by other applicable statute, regulation, or rule of law, is attached to or logically associated with the signature or record.

(h) Electronic agents

A contract or other record relating to a transaction in or affecting interstate or foreign commerce may not be denied legal effect, validity, or enforceability solely because its formation, creation, or delivery involved the action of one or more electronic agents so long as the action of any such electronic agent is legally attributable to the person to be bound.

(i) Insurance

It is the specific intent of the Congress that this subchapter and subchapter II apply to the business of insurance.

(j) Insurance agents and brokersAn insurance agent or broker acting under the direction of a party that enters into a contract by means of an electronic record or electronic signature may not be held liable for any deficiency in the electronic procedures agreed to by the parties under that contract if:

(1) the agent or broker has not engaged in negligent, reckless, or intentional tortious conduct;

(2) the agent or broker was not involved in the development or establishment of such electronic procedures; and

(3) the agent or broker did not deviate from such procedures.

(Pub. L. 106–229, title I, § 101, June 30, 2000, 114 Stat. 464.)

§ 7002 – Exemption to preemption

(a) In general A State statute, regulation, or other rule of law may modify, limit, or supersede the provisions of section 7001 of this title with respect to State law only if such statute, regulation, or rule of law:

(1) constitutes an enactment or adoption of the Uniform ElectronicTransactions Act as approved and recommended for enactment in all the States by the National Conference of Commissioners on Uniform State Laws in 1999, except that any exception to the scope of such Act enacted by a State under section 3(b)(4) of such Act shall be preempted to the extent such exception is inconsistent with this subchapter or subchapter II, or would not be permitted under paragraph (2)(A)(ii) of this subsection; or

(2)

(A) specifies the alternative procedures or requirements for the use or acceptance (or both) of electronic records or electronic signatures to establish the legal effect, validity, or enforceability of contracts or other records, if:

(i) such alternative procedures or requirements are consistent with this subchapter and subchapter II; and

(ii) such alternative procedures or requirements do not require, or accord greater legal status or effect to, the implementation or application of a specific technology or technical specification for performing the functions of creating, storing, generating, receiving, communicating, or authenticating electronic records or electronic signatures; and

(B) if enacted or adopted after June 30, 2000, makes specific reference to this chapter.

(b)Exceptions for actions by States as market participants

Subsection (a)(2)(A)(ii) shall not apply to the statutes, regulations, or other rules of law governing procurement by any State, or any agency or instrumentality thereof.

(c)Prevention of circumvention

Subsection (a) does not permit a State to circumvent this subchapter or subchapter II through the imposition of nonelectronic delivery methods under section 8(b)(2) of the Uniform ElectronicTransactions Act.

(Pub. L. 106–229, title I, § 102, June 30, 2000, 114 Stat. 467.)

§ 7003 – Specific exceptions

(a) Excepted requirementsThe provisions of section 7001 of this title shall not apply to a contract or other record to the extent it is governed by—

(1) a statute, regulation, or other rule of law governing the creation and execution of wills, codicils, or testamentary trusts;

(2) a State statute, regulation, or other rule of law governing adoption, divorce, or other matters of family law; or

(3) the Uniform Commercial Code, as in effect in any State, other than sections 1–107 and 1–206 and Articles 2 and 2A.

(b) Additional exceptionsThe provisions of section 7001 of this title shall not apply to:

(1) court orders or notices, or official court documents (including briefs, pleadings, and other writings) required to be executed in connection with court proceedings;

(2) any notice of:

(A) the cancellation or termination of utility services (including water, heat, and power);

(B) default, acceleration, repossession, foreclosure, or eviction, or the right to cure, under a credit agreement secured by, or a rental agreement for, a primary residence of an individual;

(D) recall of a product, or material failure of a product, that risks endangering health or safety; or

(3) any document required to accompany any transportation or handling of hazardous materials, pesticides, or other toxic or dangerous materials.

(1) Evaluation required

The Secretary of Commerce, acting through the Assistant Secretary for Communications and Information, shall review the operation of the exceptions in subsections (a) and (b) to evaluate, over a period of 3 years, whether such exceptions continue to be necessary for the protection of consumers. Within 3 years after June 30, 2000, the Assistant Secretary shall submit a report to the Congress on the results of such evaluation.

(2) Determinations

If a Federal regulatory agency, with respect to matter within its jurisdiction, determines after notice and an opportunity for public comment, and publishes a finding, that one or more such exceptions are no longer necessary for the protection of consumers and eliminating such exceptions will not increase the material risk of harm to consumers, such agency may extend the application of section 7001 of this title to the exceptions identified in such finding.

(Pub. L. 106–229, title I, § 103, June 30, 2000, 114 Stat. 468.)

§ 7004 – Applicability to Federal and State governments

(a) Filing and access requirements

Subject to subsection (c)(2), nothing in this subchapter limits or supersedes any requirement by a Federal regulatory agency, self-regulatory organization, or State regulatory agency that records be filed with such agency or organization in accordance with specified standards or formats.

(b) Preservation of existing rulemaking authority

(1) Use of authority to interpretSubject to paragraph (2) and subsection (c), a Federal regulatory agency or State regulatory agency that is responsible for rulemaking under any other statute may interpret section 7001 of this title with respect to such statute through:

(A) the issuance of regulations pursuant to a statute; or

(B) to the extent such agency is authorized by statute to issue orders or guidance, the issuance of orders or guidance of general applicability that are publicly available and published (in the Federal Register in the case of an order or guidance issued by a Federal regulatory agency).

This paragraph does not grant any Federal regulatory agency or State regulatory agency authority to issue regulations, orders, or guidance pursuant to any statute that does not authorize such issuance.

(2) Limitations on interpretation authorityNotwithstanding paragraph (1), a Federal regulatory agency shall not adopt any regulation, order, or guidance described in paragraph (1), and a State regulatory agency is preempted by section 7001 of this title from adopting any regulation, order, or guidance described in paragraph (1), unless:

(A) such regulation, order, or guidance is consistent with section 7001 of this title;

(B) such regulation, order, or guidance does not add to the requirements of such section; and

(i) there is a substantial justification for the regulation, order, or guidance;

(ii) the methods selected to carry out that purpose:

(I) are substantially equivalent to the requirements imposed on records that are not electronic records; and

(II) will not impose unreasonable costs on the acceptance and use of electronic records; and

(iii) the methods selected to carry out that purpose do not require, or accord greater legal status or effect to, the implementation or application of a specific technology or technical specification for performing the functions of creating, storing, generating, receiving, communicating, or authenticating electronic records or electronic signatures.

(3) Performance standards

(A) Accuracy, record integrity, accessibility

Notwithstanding paragraph (2)(C)(iii), a Federal regulatory agency or State regulatory agency may interpret section 7001(d) of this title to specify performance standards to assure accuracy, record integrity, and accessibility of records that are required to be retained. Such performance standards may be specified in a manner that imposes a requirement in violation of paragraph (2)(C)(iii) if the requirement (i) serves an important governmental objective; and (ii) is substantially related to the achievement of that objective. Nothing in this paragraph shall be construed to grant any Federal regulatory agency or State regulatory agency authority to require use of a particular type of software or hardware in order to comply with section 7001(d) of this title.

(B) Paper or printed formNotwithstanding subsection (c)(1), a Federal regulatory agency or State regulatory agency may interpret section 7001(d) of this title to require retention of a record in a tangible printed or paper form if:

(i) there is a compelling governmental interest relating to law enforcement or national security for imposing such requirement; and

(ii) imposing such requirement is essential to attaining such interest.

(4) Exceptions for actions by government as market participant

Paragraph (2)(C)(iii) shall not apply to the statutes, regulations, or other rules of law governing procurement by the Federal or any State government, or any agency or instrumentality thereof.

(1) Reimposing paper prohibited

Nothing in subsection (b) (other than paragraph (3)(B) thereof) shall be construed to grant any Federal regulatory agency or State regulatory agency authority to impose or reimpose any requirement that a record be in a tangible printed or paper form.

(2) Continuing obligation under Government Paperwork Elimination Act

Nothing in subsection (a) or (b) relieves any Federal regulatory agency of its obligations under the Government Paperwork Elimination Act (title XVII of Public Law 105–277).

(d) Authority to exempt from consent provision

(1) In general

A Federal regulatory agency may, with respect to matter within its jurisdiction, by regulation or order issued after notice and an opportunity for public comment, exempt without condition a specified category or type of record from the requirements relating to consent in section 7001(c) of this title if such exemption is necessary to eliminate a substantial burden on electronic commerce and will not increase the material risk of harm to consumers.

(2) Prospectuses

Within 30 days after June 30, 2000, the Securities and Exchange Commission shall issue a regulation or order pursuant to paragraph (1) exempting from section 7001(c) of this title any records that are required to be provided in order to allow advertising, sales literature, or other information concerning a security issued by an investment company that is registered under the Investment Company Act of 1940 [15 U.S.C. 80a–1 et seq.], or concerning the issuer thereof, to be excluded from the definition of a prospectus under section 77b(a)(10)(A) of this title.

(e) Electronic letters of agency

The Federal Communications Commission shall not hold any contract for telecommunications service or letter of agency for a preferred carrier change, that otherwise complies with the Commission’s rules, to be legally ineffective, invalid, or unenforceable solely because an electronic record or electronic signature was used in its formation or authorization.

(Pub. L. 106–229, title I, § 104, June 30, 2000, 114 Stat. 469.)

§ 7005 – Studies

(a) Delivery

Within 12 months after June 30, 2000, the Secretary of Commerce shall conduct an inquiry regarding the effectiveness of the delivery of electronic records to consumers using electronic mail as compared with delivery of written records via the United States Postal Service and private express mail services. The Secretary shall submit a report to the Congress regarding the results of such inquiry by the conclusion of such 12-month period.

(b) Study of electronic consent

Within 12 months after June 30, 2000, the Secretary of Commerce and the Federal Trade Commission shall submit a report to the Congress evaluating any benefits provided to consumers by the procedure required by section 7001(c)(1)(C)(ii) of this title; any burdens imposed on electronic commerce by that provision; whether the benefits outweigh the burdens; whether the absence of the procedure required by section 7001(c)(1)(C)(ii) of this title would increase the incidence of fraud directed against consumers; and suggesting any revisions to the provision deemed appropriate by the Secretary and the Commission. In conducting this evaluation, the Secretary and the Commission shall solicit comment from the general public, consumer representatives, and electronic commerce businesses.

(Pub. L. 106–229, title I, § 105, June 30, 2000, 114 Stat. 471.)

§ 7006 – Definitions

For purposes of this subchapter:

(1) Consumer

The term “consumer” means an individual who obtains, through a transaction, products or services which are used primarily for personal, family, or household purposes, and also means the legal representative of such an individual.

(2) Electronic

The term “electronic” means relating to technology having electrical, digital, magnetic, wireless, optical, electromagnetic, or similar capabilities.

(3) Electronic agent

The term “electronic agent” means a computer program or an electronic or other automated means used independently to initiate an action or respond to electronic records or performances in whole or in part without review or action by an individual at the time of the action or response.

(4) Electronic record

The term “electronic record” means a contract or other record created, generated, sent, communicated, received, or stored by electronic means.

(5) Electronic signature

The term “electronic signature” means an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record.

(6) Federal regulatory agency

The term “Federal regulatory agency” means an agency, as that term is defined in section 552(f) of title 5.

(7) Information

The term “information” means data, text, images, sounds, codes, computer programs, software, databases, or the like.

(8) Person

The term “person” means an individual, corporation, business trust, estate, trust, partnership, limited liability company, association, joint venture, governmental agency, public corporation, or any other legal or commercial entity.

(9) Record

The term “record” means information that is inscribed on a tangible medium or that is stored in an electronic or other medium and is retrievable in perceivable form.

(10) Requirement

The term “requirement” includes a prohibition.

(11) Self-regulatory organization

The term “self-regulatory organization” means an organization or entity that is not a Federal regulatory agency or a State, but that is under the supervision of a Federal regulatory agency and is authorized under Federal law to adopt and administer rules applicable to its members that are enforced by such organization or entity, by a Federal regulatory agency, or by another self-regulatory organization.

(12) State

The term “State” includes the District of Columbia and the territories and possessions of the United States.

(13) TransactionThe term “transaction” means an action or set of actions relating to the conduct of business, consumer, or commercial affairs between two or more persons, including any of the following types of conduct—

(A) the sale, lease, exchange, licensing, or other disposition of (i) personal property, including goods and intangibles, (ii) services, and (iii) any combination thereof; and

(B) the sale, lease, exchange, or other disposition of any interest in real property, or any combination thereof.

(Pub. L. 106–229, title I, § 106, June 30, 2000, 114 Stat. 472.)

Subchapter II. Transferable Records (§ 7021)

§ 7021.- Transferable records

Subchapter III. Promotion of International Electronic Commerce (§ 7031)

§ 7031.- Principles governing the use of electronic signatures in international transactions

12Sep/18

REGLAMENTO PARA EL USO DEL EXPEDIENTE ELECTRÓNICO Y LA FIRMA ELECTRÓNICA CERTIFICADA DEL PODER JUDICIAL DEL ESTADO DE BAJA CALIFORNIA

12 septiembre, 2018México, ReglamentoDerecho Informático Baja California, Derecho Informático México, Legislación de Baja California, Legislación de Mexico, REGLAMENTO PARA EL USO DEL EXPEDIENTE ELECTRÓNICO Y LA FIRMA ELECTRÓNICA CERTIFICADA DEL PODER JUDICIAL DEL ESTADO DE BAJA CALIFORNIAJosé Cuervo

REGLAMENTO PARA EL USO DEL EXPEDIENTE ELECTRÓNICO Y LA FIRMA ELECTRÓNICA CERTIFICADA DEL PODER JUDICIAL DEL ESTADO DE BAJA CALIFORNIA

Reglamento publicado en la Sección I del Periódico Oficial del Estado de Baja California, el viernes 18 de marzo de 2016.

MAGISTRADO JORGE ARMANDO VÁZQUEZ, PRESIDENTE DEL TRIBUNAL SUPERIOR DE JUSTICIA Y DEL CONSEJO DE LA JUDICATURA DEL ESTADO, MAGISTRADO CONSEJERO SALVADOR JUAN ORTIZ MORALES, MAGISTRADO CONSEJERO JORGE IGNACIO PÉREZ CASTAÑEDA, JUEZ CONSEJERO RAÚL LUIS MARTÍNEZ, CONSEJERO HÉCTOR ORLANDO DÍAZ CERVANTES, CONSEJERO GERARDO BRIZUELA GAYTÁN, MIEMBROS DEL CONSEJO DE LA JUDICATURA DEL PODER JUDICIAL DEL ESTADO, EN EJERCICIO DE LAS FACULTADES QUE NOS CONFIEREN LOS ARTÍCULOS 57 PÁRRAFOS SEGUNDO Y TERCERO, 59 PÁRRAFO SEGUNDO, 64 PRIMER PÁRRAFO, 65 PÁRRAFO SÉPTIMO y 97 PRIMER PÁRRAFO, DE LA CONSTITUCIÓN POLÍTICA DEL ESTADO LIBRE Y SOBERANO DE BAJA CALIFORNIA Y CON FUNDAMENTO EN LO DISPUESTO POR LOS ARTÍCULOS 3 FRACCIÓN III y 83 DEL CÓDIGO NACIONAL DE PROCEDIMIENTOS PENALES; 111 y 112 DEL CÓDIGO DE PROCEDIMIENTOS CIVILES PARA EL ESTADO DE BAJA CALIFORNIA; 22, 39 FRACCIÓN II, 155, 156, 158, 159 PÁRRAFO SEGUNDO, 161, 163, 164, 165, 166, 167 Y 168 FRACCIONES I, II, IV, XV, XVIII, XXVI, XXXIII, XXXV, y XLIII, DE LA LEY ORGÁNICA DEL PODER JUDICIAL DEL ESTADO DE BAJA CALIFORNIA, Y

C O N S I D E R A N D O

De ahí que resulte necesaria y obligatoria la expedición del presente reglamento, toda vez que mediante Sesión Ordinaria de fecha veintinueve de octubre del año dos mil quince, este Consejo de la Judicatura del Estado, aprobó dentro del punto 8.01, el ACUERDO GENERAL NÚMERO 02-2015, DEL PLENO DEL CONSEJO DE LA JUDICATURA DEL PODER JUDICIAL DEL ESTADO DE BAJA CALIFORNIA, POR EL QUE SE CREA LA UNIDAD ADMINISTRATIVA DE CERTIFICACIÓN, SE AUTORIZA LA IMPLEMENTACIÓN DEL EXPEDIENTE ELECTRÓNICO, SE RECONOCE LA VALIDEZ DE LAS NOTIFICACIONES ELECTRÓNICAS Y EL USO DE LA FIRMA ELECTRÓNICA EN LOS EXPEDIENTES, INCIDENTES, CUADERNILLOS Y DEMÁS ASUNTOS DEL CONOCIMIENTO DEL LOS TRIBUNALES, ÓRGANOS JURISDICCIONALES Y ÓRGANOS ADMINISTRATIVOS DEL PODER JUDICIAL DEL ESTADO DE BAJA CALIFORNIA y por ende, en ejecución del mismo, se hace necesaria la expedición del presente, en los siguientes términos:

ARTÍCULO ÚNICO.- Se expide el reglamento, para quedar como sigue:

REGLAMENTO PARA EL USO DEL EXPEDIENTE ELECTRÓNICO Y LA FIRMA ELECTRÓNICA CERTIFICADA DEL PODER JUDICIAL DEL ESTADO DE BAJA CALIFORNIA.

TÍTULO PRIMERO.- DISPOSICIONES GENERALES

CAPÍTULO ÚNICO

Artículo 1. El presente reglamento es de interés general y de orden público y tiene por objeto regular:

I. La operación de los sistemas que sustentan la Firma Electrónica Certificada y el Expediente Electrónico;

II. El uso de la Firma Electrónica Certificada y la creación del Expediente Electrónico, en los asuntos, expedientes, recursos, incidentes, cuadernillos y actos de la competencia del Poder Judicial del Estado de Baja California, por conducto del Tribunal Superior de Justicia en Pleno o en Salas, de los Juzgados de Primera Instancia, Juzgados de Paz, Tribunales, Jueces de Paz, de Primera Instancia, Mixtos, de Menores, de Garantía o Especializados, Jurados y en su caso por este Consejo de la Judicatura o sus órganos y unidades administrativas; previstos en las leyes y códigos de la materia aplicables al asunto de que se trate; II (SIC). La expedición de certificados digitales a personas físicas;

III. La emisión, uso adecuado y revocación de la Firma Electrónica Certificada, por parte de la Unidad Administrativa, los tribunales, juzgados y órganos jurisdiccionales y administrativos del Poder Judicial del Estado de Baja California; así como de personas físicas o morales públicas o privadas, nacionales o extranjeras, previo cumplimiento de los requisitos que se establecen en el presente Reglamento.

IV. Los servicios relacionados con la Firma Electrónica Certificada y el Expediente Electrónico;

V. Las facultades de las autoridades certificadoras;

VI. La homologación de la Firma Electrónica Certificada, con las firmas electrónicas reguladas por otros ordenamientos legales, en los términos establecidos en el presente Reglamento y de conformidad con las disposiciones de la Ley de Firma Electrónica para el Estado de Baja California, la Ley de Firma Electrónica Avanzada y el Reglamento de la Ley de Firma Electrónica Avanzada; y.

VII. Las facultades del Consejo de la Judicatura del Estado, para incorporar como válidos para los órganos y tribunales del Poder Judicial del Estado, los documentos, notificaciones y actos de otros poderes, entes, órganos o tribunales de esta o de otras entidades federativas; expedidos mediante firma electrónica en términos de sus diversas disposiciones aplicables.

Artículo 2. Se establece la Firma Electrónica Certificada del Poder Judicial del Estado de Baja California (FIREC), como el instrumento a través del cual se ingresa al Sistema Electrónico para presentar demandas, promociones, recursos, medios de impugnación, incidentes y enviar escritos y/o documentos, recibir comunicaciones, notificaciones y/o documentos oficiales, así como consultar acuerdos, resoluciones y sentencias interlocutorias o principales; relacionadas con los asuntos competencia del Tribunal, de las Salas y de los órganos jurisdiccionales y administrativos del Poder Judicial del Estado de Baja California; la cual producirá los mismos efectos que la firma autógrafa, tomando en cuenta lo previsto en el presente Reglamento y en las demás disposiciones generales aplicables a los asuntos de la competencia del Tribunal Superior de Justicia, los Juzgados de Primera Instancia, los Juzgados de Paz, Jueces de Paz, de Primera Instancia, Mixtos, de Menores, de Garantía o Especializados, Jurados y en su caso del Consejo de la Judicatura del Estado.

Artículo 3. Para los efectos de este reglamento, se entenderá por:

I. Actos: las comunicaciones, trámites, servicios, actos jurídicos y administrativos, así como actuaciones dentro de los procedimientos judiciales y administrativos en los cuales los particulares y los servidores públicos del Poder Judicial del Estado de Baja California, utilicen la Firma Electrónica Certificada;

II. Actuaciones Electrónicas: las determinaciones, acuerdos, resoluciones, notificaciones, citatorios, emplazamientos, requerimientos, solicitudes de informes o documentos y, en su caso, las resoluciones administrativas y judiciales, incidentales, definitivas, principales o de alzada, que se emitan en los Asuntos de la competencia del Poder Judicial del Estado de Baja California, regulados por este reglamento y que sean comunicados por medios electrónicos;

III. Acuse de Recibo Electrónico: el mensaje de datos que se emite o genera a través de medios de comunicación electrónica para acreditar de manera fehaciente la fecha y hora de recepción de documentos electrónicos relacionados con las actuaciones electrónicas establecidas por este Reglamento;

IV. Autoridad Certificadora: La Unidad Administrativa de Certificación del Consejo de la Judicatura del Poder Judicial del Estado de Baja California, creada para el Control de Certificación de Firmas y las Unidades de Control y Certificación, que conforme a las disposiciones jurídicas, tengan reconocida esta calidad y cuenten con la infraestructura tecnológica para la emisión, administración y registro de certificados digitales, así como para proporcionar servicios relacionados con los mismos;

V. Asunto: El expediente de los juicios, incidentes, cuadernillos, recursos, medios de impugnación, procedimientos administrativos inquisitivos o seguidos en forma de juicios y demás procedimientos o procesos de la competencia del Tribunal Superior de Justicia en Pleno o en Salas; de los Juzgados de Primera Instancia, Juzgados de Paz, Jueces de Paz, de Primera Instancia, Mixtos, de Menores, de Garantía o Especializados, Jurados y en su caso del Consejo de la Judicatura y sus Comisiones u órganos y unidades administrativas;

VI. Boletín Electrónico: Medio de comunicación oficial electrónico, a través del cual los órganos del Poder Judicial del Estado, dan a conocer las actuaciones o resoluciones en los asuntos que se tramitan ante los mismos;

VII. Certificado Digital: el mensaje de datos o registro que confirme el vínculo entre un firmante y la clave privada;

VIII. Certificado Intermedio: Certificado digital generado a partir del Certificado Raíz del Poder Judicial del Estado de Baja California, con el cual las Unidades de Control y Certificación emitirán los certificados de los usuarios finales;

IX. Certificado Raíz: El certificado digital único emitido por la Unidad Administrativa del Consejo de la Judicatura del Poder Judicial del Estado de Baja California, para el Control de Certificación de Firmas, que sirve de base a la infraestructura de firma electrónica de los órganos del Poder Judicial del Estado y da origen a los certificados intermedios, los que a su vez servirán para dar origen a los certificados digitales que emitan las Unidades de Certificación correspondientes;

X. Usuario del Sistema: Conjunto único de caracteres alfanuméricos asignados por el Sistema de Trámites Electrónicos, como medio de identificación de los servidores públicos o de las personas facultadas en el asunto de origen para utilizar el Sistema, y asignarles los privilegios para la recepción de notificaciones, consulta del expediente respectivo o envío vía electrónica de promociones relativas a las actuaciones procesales con el uso de la FIREC en un procedimiento o proceso en el que promuevan, ante los Órganos del Poder Judicial del Estado;

XI. Clave Privada: los datos que el firmante genera de manera secreta y utiliza para crear su Firma Electrónica Certificada, a fin de lograr el vínculo entre dicha Firma Electrónica Certificada y el firmante;

XII. Clave Pública: los datos contenidos en un certificado digital que permiten la verificación de la autenticidad de la Firma Electrónica Certificada del firmante;

XIII. Consejo: El Consejo de la Judicatura del Poder Judicial del Estado de Baja California;

XIV. Contraseña: Conjunto único de caracteres alfanuméricos, asignados de manera confidencial al Usuario del Sistema, la cual permite validar la identificación de la persona a la que se le asignó una Clave de Acceso;

XV. Datos y elementos de identificación: aquéllos que se encuentran considerados como tales en la Ley General de Población y en las disposiciones que deriven de la misma;

XVI. Documento Electrónico: aquél que es generado, consultado, modificado o procesado por medios electrónicos;

XVII. Dirección de Correo Electrónico: la dirección en Internet señalada por los servidores públicos y particulares para enviar y recibir mensajes de datos y documentos electrónicos relacionados con los actos a que se refiere el presente Reglamento y a través de los medios de comunicación electrónica;

XVIII. Expediente Electrónico: Conjunto de información contenida en archivos electrónicos o documentos digitales que conforman un Asunto, independientemente de que sea texto, imagen, audio o video, identificado por un número específico.

XIX. FIREC: La Firma Electrónica Certificada del Poder Judicial del Estado de Baja California;

XX. Firma Electrónica Certificada: el conjunto de datos y caracteres que permite la identificación del firmante, que ha sido creada por medios electrónicos bajo su exclusivo control, de manera que está vinculada únicamente al mismo y a los datos a los que se refiere, lo que permite que sea detectable cualquier modificación ulterior de éstos, la cual produce los mismos efectos jurídicos que la firma autógrafa;

XXI. Firmante: toda persona física que utiliza su Firma Electrónica Certificada para suscribir documentos electrónicos y, en su caso, mensajes de datos;

XXII. Medios de Comunicación Electrónica: los dispositivos tecnológicos que permiten efectuar la transmisión y recepción de mensajes de datos y documentos electrónicos;

XXIII. Medios Electrónicos: los dispositivos tecnológicos para el procesamiento, impresión, despliegue, conservación y, en su caso, modificación de información;

XXIV. Mensaje de Datos: la información generada, enviada, recibida, archivada o comunicada a través de medios de comunicación electrónica, que puede contener documentos electrónicos;

XXV. Órganos del Poder Judicial: El Tribunal Superior de Justicia del Estado de Baja California, las Salas Unitarias o Colegiadas del Tribunal Superior de Justicia del Estado de Baja California; los Tribunales de Juicio Oral y los Jueces de Garantía; los Juzgados de Primera Instancia, Juzgados Mixtos, Juzgados de Paz y Jurados; el Consejo de la Judicatura del Poder Judicial del Estado de Baja California, sus Comisiones y los demás órganos o unidades administrativas autorizadas posteriormente por el Consejo, que emitan actos al amparo del presente Reglamento;

XXVI. Página Web: el sitio en Internet que contiene información, aplicaciones y, en su caso, vínculos a otras páginas;

XXVII. Prestador de Servicios de Certificación: La Unidad Administrativa de Certificación del Consejo de la Judicatura del Estado, por sí o por conducto de sus Unidades de Control y Certificación; las instituciones públicas que conforme a las leyes que les son aplicables, así como los notarios y corredores públicos y las personas morales de carácter privado que de acuerdo a lo establecido en el Código de Comercio sean reconocidas con tal carácter para prestar servicios relacionados con la Firma Electrónica y, en su caso, expedir certificados digitales;

XXVIII. Servicios relacionados con la Firma Electrónica Certificada: los servicios de firmado de documentos electrónicos, de verificación de la vigencia de certificados digitales, de verificación y validación de la unicidad de la clave pública, así como de consulta de certificados digitales revocados, entre otros, que en términos de las disposiciones jurídicas aplicables pueden ser proporcionados por la autoridad certificadora;

XXIX. Tribunal Electrónico o Sistema: el sitio electrónico desarrollado por la Administración Judicial del Poder Judicial del Estado y la Oficialía Mayor del Consejo de la Judicatura del Estado, ligado a la página Web del Nuevo Sistema de Justicia Penal y al sitio electrónico del Poder Judicial del Estado de Baja California, para el envío y recepción de documentos, notificaciones y comunicaciones, así como para la consulta de información relacionada con los actos a que se refiere este Reglamento;

XXX. Sujetos Obligados: los servidores públicos y particulares que utilicen la Firma Electrónica Certificada del Poder Judicial del Estado de Baja California o el Expediente Electrónico, en términos de lo previsto en el artículo 3 de este Reglamento;

XXXI. Tablero Electrónico: el medio electrónico incorporado al Tribunal Electrónico o Sistema, a través del cual se ponen a disposición de los particulares que utilicen la Firma Electrónica Certificada en términos de esta (sic) reglamento, las actuaciones electrónicas que emitan los órganos del Poder Judicial del Estado de Baja California y que genera un acuse de recibo electrónico;

XXXII. Unidad Administrativa: La Unidad Administrativa de Certificación del Consejo de la Judicatura del Poder Judicial del Estado de Baja California; y XXXIII. Unidades de Control y Certificación: Las unidades administrativas del Tribunal, de las Salas o de los órganos jurisdiccionales y administrativos del Poder Judicial del Estado de Baja California a quienes el Consejo o la Unidad Administrativa de Certificación, autorice para el uso de certificados intermedios con los que pueda realizar la expedición de la FIREC, en los términos previstos en el presente Reglamento.

Artículo 4. Están sujetos a las disposiciones de la presente Ley:

I. Los órganos a que se refiere la fracción XXV, del artículo 2 de este Reglamento;

II. Los servidores públicos adscritos a los órganos del Poder Judicial del Estado a que se refiere la fracción anterior, que en la realización de los actos a que se refiere este Reglamento utilicen la Firma Electrónica Certificada, y

III. Los particulares, en los casos en que utilicen la Firma Electrónica Certificada en términos de esta (sic) Reglamento.

Artículo 5. La Unidad Administrativa de Certificación, por sí o por conducto de sus Unidades de Control y Certificación de Firmas y en su caso, por las demás áreas que mediante acuerdo determine el Consejo; realizará las funciones de autoridad registradora y certificadora encargada de recibir las solicitudes para la emisión de certificados digitales a los funcionarios del Poder Judicial del Estado y de emitir los certificados digitales correspondientes; con la colaboración de las áreas técnicas a que se refiere el artículo 8 del presente Reglamento y una vez validada la información necesaria.

Asimismo, será la encargada de recibir las solicitudes de usuarios externos, para la emisión de certificados digitales.

Las autoridades señaladas en el presente artículo, en su calidad de autoridades registradoras, recibirán las solicitudes de usuarios externos, revisará que cumplan con los requisitos que al efecto se establezcan y una vez validada la información proporcionada por el usuario externo, emitirán el certificado digital correspondiente.

Artículo 6. Las disposiciones de este Reglamento no serán aplicables a los actos en que no sea factible el uso de la Firma Electrónica Certificada por disposición expresa de la Ley o Código de la materia, de este Reglamento, o de aquéllos en donde no exista acuerdo de incorporación del Consejo o donde exista acuerdo expreso estableciendo su prohibición.

Tampoco serán aplicables para la presentación de quejas administrativas en términos de la Ley Orgánica del Poder Judicial del Estado o de la Ley de Responsabilidades de los Servidores Públicos del Estado de Baja California.

En los actos de comercio e inscripciones en el Registro Público de la Propiedad y del Comercio, el uso de la Firma Electrónica se regirá de conformidad con lo previsto en el Código de Comercio y demás ordenamientos aplicables en la materia, sin perjuicio de la aplicación de lo dispuesto en este Reglamento, en lo conducente.

Artículo 7. El Consejo, en el ámbito de su competencia, estará facultado para interpretar las disposiciones de este Reglamento y para efectos administrativos.

Para tal efecto, a propuesta de la Unidad Administrativa, dictará las disposiciones generales para el adecuado cumplimiento de este Reglamento, mismas que deberán publicarse en Boletín Judicial y en el Periódico Oficial del Estado.

Artículo 8. El Subjefe de la Unidad de Sistemas y Tecnología Informática del Tribunal de Garantía y Juicio Oral Penal y el Jefe de Informática del Poder Judicial del Estado de Baja California, como áreas especializadas en tecnologías de la información y comunicaciones, serán las encargadas de implantar y administrar la infraestructura tecnológica necesaria para la operación de la Firma Electrónica Certificada, así como para brindar la asesoría en materia tecnológica que requiera la Unidad Administrativa o el Consejo, para operar el Sistema del Expediente Electrónico, de Trámites Electrónicos, de Registro y Certificación.

También deberán de capacitar a los usuarios internos del Poder Judicial del Estado, sobre el funcionamiento de la Firma Electrónica Certificada y poner a disposición del público en general en los portales electrónicos, los manuales respectivos para los usuarios externos.

Artículo 9. A falta de disposición expresa en este Reglamento o en las demás disposiciones que del mismo deriven, se aplicarán supletoriamente la Ley de Firma Electrónica para el Estado de Baja California, la Ley de Firma Electrónica Avanzada, el Reglamento de la Ley de Firma Electrónica Avanzada, el Código Nacional de Procedimientos Penales, el Código de Comercio, el Código Federal de Procedimientos Civiles y el Código de Procedimientos Civiles para el Estado de Baja California, en lo conducente y atendiendo a la materia de que se trate.

Artículo 10. La interpretación del presente Reglamento, se realizará conforme a los criterios gramatical, sistemático y funcional, atendiendo a lo dispuesto en el último párrafo del artículo 14 de la Constitución Política de los Estados Unidos Mexicanos.

TÍTULO SEGUNDO.- DE LA FIRMA ELECTRÓNICA CERTIFICADA

CAPÍTULO I.- DEL USO Y VALIDEZ DE LA FIRMA ELECTRÓNICA CERTIFICADA

Artículo 11. La Firma Electrónica Certificada podrá ser utilizada en documentos electrónicos y, en su caso, en mensajes de datos. Los servidores públicos de los órganos jurisdiccionales y administrativos del Poder Judicial del Estado, podrán utilizar la Firma Electrónica Certificada en los trámites y servicios que brinden a la ciudadanía, en las comunicaciones internas de carácter oficial, así como en los documentos que en el ejercicio de sus funciones expidan.

Las personas físicas o morales por conducto de sus representantes legales, podrán hacer uso de la Firma Electrónica Certificada en la realización de trámites ante las autoridades del Poder Judicial del Estado de Baja California, siempre y cuando se les autorice mediante acuerdo expreso en el asunto de que se trate, para tal efecto. Los documentos que consten en papel y con firma autógrafa o rúbrica, podrán ser habilitados para tener un formato electrónico si cuenta con la firma electrónica de conformidad con el presente reglamento.

Los documentos electrónicos y los mensajes de datos que cuenten con Firma Electrónica Certificada producirán los mismos efectos que los presentados con firma autógrafa y, en consecuencia, tendrán el mismo valor probatorio que las disposiciones aplicables les otorgan a éstos, en su carácter de documentos públicos o privados, según su origen.

Artículo 12. Para efectos del artículo 10 de este Reglamento, la Firma Electrónica Certificada estará sujeta a los principios rectores siguientes:

I. Equivalencia Funcional: Consiste en que la Firma Electrónica Certificada en un documento electrónico o en su caso, en un mensaje de datos, satisface el requisito de firma del mismo modo que la firma autógrafa en los documentos impresos;

II. Autenticidad: Consiste en que la Firma Electrónica Certificada en un documento electrónico o, en su caso, en un mensaje de datos, permite dar certeza de que el mismo ha sido emitido por el firmante de manera tal que su contenido le es atribuible al igual que las consecuencias jurídicas que de él deriven;

III. Integridad: Consiste en que la Firma Electrónica Certificada en un documento electrónico o, en su caso, en un mensaje de datos, permite dar certeza de que éste ha permanecido completo e inalterado desde su firma, con independencia de los cambios que hubiere podido sufrir el medio que lo contiene como resultado del proceso de comunicación, archivo o presentación;

IV. Neutralidad Tecnológica: Consiste en que la tecnología utilizada para la emisión de certificados digitales y para la prestación de los servicios relacionados con la Firma Electrónica Certificada será aplicada de modo tal que no excluya, restrinja o favorezca alguna tecnología en particular;

V. No Repudio: Consiste en que la Firma Electrónica Certificada contenida en documentos electrónicos garantiza la autoría e integridad del documento y que dicha firma corresponde exclusivamente al firmante, y

VI. Confidencialidad: Consiste en que la Firma Electrónica Certificada en un documento electrónico o, en su caso, en un mensaje de datos, garantiza que sólo pueda ser cifrado por el firmante y el receptor.

Artículo 13. Para que los sujetos obligados puedan utilizar la Firma Electrónica Certificada en los actos a que se refiere este Reglamento, deberán contar con:

I. Un certificado digital vigente, emitido u homologado en términos del presente Reglamento, y

II. Una clave privada que deberá mantener bajo su exclusivo control y que será generada con los datos proporcionados por este previa validación de la Autoridad Certificadora.

Artículo 14. El actor, recurrente o promovente, podrá presentar su demanda, recurso o promoción mediante la vía tradicional y por escrito ante el Órgano del Poder Judicial del Estado competente, o en línea a través del Sistema de Trámites Electrónicos en Línea.

Para este último caso, se deberá manifestar expresamente su opción de someterse al uso de la FIREC y el Expediente Electrónico, al momento de la presentación.

Una vez que el sujeto obligado haya elegido su opción, deberá revocar su decisión para que a partir de esa fecha no se le notifique mas por medio electrónico.

Para el caso de que el sujeto obligado no manifieste su opción al momento de la presentación de su trámite respectivo, se entenderá que eligió tramitar el Asunto en la vía tradicional.

Artículo 15. En el Tribunal Electrónico o Sistema se integrará el Expediente Electrónico, mismo que incluirá el escrito inicial, todas las promociones, pruebas y otros anexos que presenten las partes, oficios, actuaciones, acuerdos y resoluciones tanto interlocutorias como definitivas, así como las demás diligencias que deriven de la substanciación del Asunto en línea, garantizando su seguridad, inalterabilidad, autenticidad, integridad y durabilidad, conforme a los lineamientos que expida el Consejo.

Para el caso en que proceda la acumulación y los Asuntos respectivos se estén sustanciando por la vía tradicional y en línea, el Órgano del Poder Judicial del Estado competente, requerirá a las partes vía notificación personal o electrónica según corresponda, para que en el plazo de tres días manifiesten si optan por substanciar el Asunto en línea, en caso de que no ejerza su opción se tramitara el Asunto en la vía tradicional.

Artículo 16. La Firma Electrónica Certificada, Clave de Acceso y Contraseña se proporcionarán, a través del Sistema de Trámites Electrónicos, previa obtención del registro y autorización correspondientes.

El uso de la Firma Electrónica Certificada, Clave de Acceso y Contraseña, implica el consentimiento expreso de que el Sistema registre la fecha y hora en la que se abran los Archivos Electrónicos, que contengan las notificaciones y constancias que integran el Expediente Electrónico, para los efectos legales establecidos en las disposiciones legales aplicables. Para hacer uso del Sistema, se deberán observarse los lineamientos que, para tal efecto, expida la Unidad Administrativa.

CAPÍTULO II.- DE LOS DOCUMENTOS ELECTRÓNICOS Y DE LOS MENSAJES DE DATOS

Artículo 17. Los órganos del Poder Judicial del Estado, las dependencias y entidades de gobierno, en las comunicaciones y en su caso, en los actos jurídicos que realicen entre las mismas dentro de los expedientes, incidentes, cuadernillos, medios de impugnación y demás asuntos de la competencia del Poder Judicial del Estado, harán uso de mensajes de datos y aceptarán la presentación de documentos electrónicos, los cuales deberán contar, cuando así se requiera, con la Firma Electrónica Certificada del servidor público facultado para ello.

Cualquier actuación en los asuntos en Línea se efectuará a través del Sistema, en términos del presente Reglamento. Dichas actuaciones serán validadas con las firmas electrónicas y firmas digitales de los Magistrados, Jueces de Paz, de Primera Instancia, Mixtos, de Menores, de Garantía o Especializados; Secretarios Generales, Secretarios de Estudio y Cuenta, Secretarios Proyectistas, Secretarios de Acuerdos, Secretarios Actuarios y demás servidores públicos de los Órganos del Poder Judicial del Estado, que actúen en ejercicio de sus atribuciones o que den fe, según corresponda.

Artículo 18. Las autoridades señaladas en el artículo anterior, en la realización de los actos del conocimiento de los órganos del Poder Judicial del Estado, deberán aceptar el uso de mensajes de datos y la presentación de documentos electrónicos, siempre que los particulares por sí o por conducto de sus representantes legales, mandatarios o procuradores, manifiesten expresamente su conformidad para que dichos actos se efectúen, desde su inicio hasta su conclusión, a través de medios de comunicación electrónica.

Artículo 19. Los documentos que las partes ofrezcan como prueba, deberán exhibirlos de forma legible a través del Sistema de Trámites Electrónicos en línea.

Tratándose de documentos digitales, se deberá manifestar la naturaleza de los mismos, especificando si la reproducción digital corresponde a una copia simple, una copia certificada o al original y tratándose de esta última, si tiene o no firma autógrafa. Los particulares deberán hacer esta manifestación bajo protesta de decir verdad.

La omisión de la manifestación presume en perjuicio sólo del promovente, que el documento digitalizado corresponde a una copia simple.

Las pruebas documentales que ofrezcan y exhiban las partes tendrán el mismo valor probatorio que su constancia física, siempre y cuando se observen las disposiciones del presente Reglamento y de los acuerdos que emita el Consejo para asegurar la autenticidad de la información, así como de su transmisión, recepción, validación y notificación; salvo que se ponga en tela de duda la autenticidad de un documento presentado vía digital, caso en el cual, el interesado podrá solicitar que se exhiba el original para su cotejo.

Artículo 20. Para el caso de pruebas diversas a las documentales, los instrumentos en los que se haga constar la existencia de dichas pruebas se integrarán al Expediente Electrónico.

El Secretario de Acuerdos o servidor público competente, a quien corresponda el conocimiento y tramite del asunto, deberá digitalizar las constancias relativas y procederá a la certificación de su cotejo con los originales físicos, así como a garantizar el resguardo de los originales y de los bienes materiales que en su caso hubieren sido objeto de prueba.

Este tipo de pruebas, deberán ofrecerse en términos de las disposiciones aplicables y ser presentadas al Órgano del Poder Judicial del Estado que esté conociendo del asunto, en la fecha en la que se señale en el acuerdo recaído al ofrecimiento, haciéndose constar su exhibición para efectos de su incorporación al Expediente Electrónico y ordenando en ese acto las medidas de seguridad para garantizar el resguardo de los originales y de los bienes materiales o implementos que en su caso hubieren sido objeto de la prueba.

Artículo 21. Los sujetos obligados deberán contar con una dirección de correo electrónico para recibir, cuando corresponda, mensajes de datos y documentos electrónicos en la realización de los actos previstos en esta Ley.

Artículo 22. Las personas interesadas en obtener la Firma Electrónica Certificada, deberán suscribir ante la Unidad Administrativa o Unidades Certificadoras, un documento en el que:

I. Expresarán que es su libre voluntad contar con un Certificado de Firma Electrónica Certificada;

II. Se obligan a proporcionar información veraz y exacta para la obtención de la Firma Electrónica;

III. Reconocerán como propios y auténticos los Mensajes de Datos que contengan su Firma Electrónica;

IV. Aceptarán que el uso de la Firma Electrónica por persona distinta, quedará bajo su exclusiva responsabilidad, y que de ocurrir ese supuesto se les atribuirá la autoría de los Mensajes de Datos;

V. Se obligarán a notificar de manera inmediata a la Unidad Administrativa, para efectos de su invalidación, la pérdida o cualquier otra situación que pudiera implicar la reproducción o el uso indebido del Certificado de Firma Electrónica; sin que ello invalide las notificaciones anteriores que se les hubiesen practicado o las actuaciones que los particulares hubiesen signado con su firma Electrónica Certificada, sino las subsecuentes actuaciones realizadas con posterioridad a tal comunicado formal.

VI. Autorizarán que las notificaciones, citaciones o requerimientos se les hagan a través de Medios Electrónicos o Sistemas de Información, mismas que se practicarán en los términos, plazos y condiciones previstas en las disposiciones legales aplicables a la materia de que se trate el asunto, expediente, incidente, cuadernillo o medio de impugnación correspondiente; y

VII. Las demás que determinen las leyes.

Artículo 23. La manifestación a que se refiere el artículo anterior deberá señalar adicionalmente:

I. Que aceptan consultar el tablero electrónico, al menos, los días viernes de cada semana o bien, el día hábil siguiente si alguno de éstos fuere inhábil; y en caso de no hacerlo, se tendrá por hecha la notificación y surtirá sus efectos, en el día hábil siguiente a aquél en que hubiere sido efectuada vía electrónica;

II. Que aceptan darse por notificados de las actuaciones electrónicas que emitan los Órganos del Poder Judicial del Estado, en el mismo día en que consulten el tablero electrónico, y

III. Que en el supuesto de que por causas imputables al Poder Judicial del Estado, se encuentren imposibilitados para consultar el tablero electrónico o abrir los documentos electrónicos que contengan la información depositada en el mismo, en los días señalados en la fracción I de este artículo, lo harán del conocimiento del órgano del Poder Judicial del Estado de que se trate, a más tardar el día hábil siguiente a aquél en que ocurra dicho impedimento, por medios de comunicación electrónica o cualquier otro previsto en la Ley o Código de la materia de que se trate, para que sean notificados por alguna otra forma de las establecidas en las normas que rijan el acto materia de notificación.

Artículo 24. La Unidad Administrativa de Certificación, con el auxilio de las áreas técnicas a que se refiere el artículo 8 de este Reglamento, crearán y administrarán un sistema de trámites electrónicos que establezca el control de accesos, los respaldos y la recuperación de información, con mecanismos confiables de seguridad, disponibilidad, integridad, autenticidad, confidencialidad y custodia.

El Consejo, a propuesta de la Unidad Administrativa de Certificación, emitirá los lineamientos conducentes a efecto de dar cumplimiento a lo dispuesto en este artículo.

Artículo 25. La información contenida en los mensajes de datos y en los documentos electrónicos será pública, salvo que la misma esté clasificada como reservada o confidencial en términos de la Ley General de Transparencia y Acceso a la Información Pública, la Ley de Transparencia y Acceso a la Información Pública para el Estado de Baja California y por ende, en su caso podrá ser entregada en términos en los Lineamientos para la Elaboración de Versiones Públicas de Documentos y Resoluciones que Tiene Bajo su Resguardo el Poder Judicial del Estado de Baja California vigentes al momento de su solicitud.

Los mensajes de datos y los documentos electrónicos que contengan datos personales e información confidencial, estarán sujetos a las disposiciones aplicables para el manejo, seguridad y protección de los mismos.

Artículo 26. Los sujetos obligados deberán conservar en medios electrónicos, los mensajes de datos y los documentos electrónicos con Firma Electrónica Certificada derivados de los actos a que se refiere este Reglamento, durante los plazos de conservación previstos en los ordenamientos legales o reglamentarios aplicables, según la naturaleza del asunto o la información de que se trate.

A falta de término previsto, la conservación de los mensajes de datos y de los documentos electrónicos con Firma Electrónica Certificada, se estará al término de diez años para su resguardo y conservación; salvo que se trate de información o documentación que hubiere sido catalogada como de valor histórico.

Artículo 27. Cuando se requiera que un documento impreso y con firma autógrafa, sea presentado o conservado en su forma original, tal requisito quedará satisfecho si la copia se genera en un documento electrónico, y se cumple con lo siguiente:

I. Que la migración a una forma digital haya sido realizada o supervisada por un servidor público que cuente con facultades de certificación de documentos en términos de las disposiciones aplicables o, en su caso, por el particular interesado, quien deberá manifestar, bajo protesta de decir verdad, que el documento electrónico es copia íntegra e inalterada del documento impreso;

II. Cuando exista duda sobre la autenticidad del documento electrónico remitido, la dependencia o entidad podrá solicitar que el documento impreso le sea presentado directamente o bien, que este último se le envíe por correo certificado con acuse de recibo. En el supuesto de que se opte por el envío del documento impreso a través de correo certificado, será necesario que adicionalmente se envíe dentro de los tres días hábiles siguientes, mediante un mensaje de datos, la guía que compruebe que el referido documento fue depositado en una oficina de correos;

III. Que la información contenida en el documento electrónico se mantenga íntegra e inalterada a partir del momento en que se generó por primera vez en su forma definitiva y sea accesible para su ulterior consulta;

IV. Que el documento electrónico permita conservar el formato del documento impreso y reproducirlo con exactitud, y

V. Que se observe lo previsto en las disposiciones generales en materia de conservación de mensajes de datos y de los documentos electrónicos con Firma Electrónica Certificada.

Lo establecido en este artículo se aplicará sin perjuicio de que las dependencias y entidades observen, conforme a la naturaleza de la información contenida en el documento impreso de que se trate, los plazos de conservación previstos en los ordenamientos legales o reglamentarios aplicables.

TÍTULO TERCERO.- DEL CERTIFICADO DIGITAL CAPÍTULO I DE LA ESTRUCTURA Y PROCEDIMIENTOS DEL CERTIFICADO DIGITAL

Artículo 28. El certificado digital deberá contener lo siguiente:

I. Número de serie;

II. Autoridad certificadora que lo emitió;

III. Algoritmo de firma;

IV. Vigencia;

V. Nombre del titular del certificado digital;

VI. Dirección de correo electrónico del titular del certificado digital;

VII. Clave Única del Registro de Población (CURP) del titular del certificado digital;

VIII. Clave pública, y

IX. Los demás requisitos que, en su caso, se establezcan en las disposiciones generales que se emitan en términos de este reglamento.

Artículo 29. Para obtener un certificado digital el solicitante accederá a la página Web de la autoridad certificadora y llenará el formato de solicitud con los siguientes datos:

I. Tratándose del personal del Poder Judicial del Estado, accederá al Sistema de Registro y Certificación mediante el cual llevará a cabo el procedimiento de certificación electrónica y requisitará el formato de solicitud que llenará como mínimo, con los datos siguientes:

a) Nombre completo del solicitante;

b) Dirección de correo electrónico Institucional para recibir mensajes de datos y documentos electrónicos;

c) Número de empleado;

d) Área de adscripción;

e) Cargo que desempeña, y;

f) Clave Única del Registro de Población (CURP) del titular del certificado digital;

Posteriormente, el solicitante deberá hacer llegar materialmente su solicitud con firma autógrafa de acuerdo con los procedimientos que para tal efecto defina el Consejo o la Unidad Administrativa de Certificación, adjuntando copia simple de su identificación o gafete de trabajo, copia de su nombramiento y copia simple de su Clave Única del Registro de Población (CURP).

II. Tratándose de usuarios externos, deberá seguir el procedimiento de preregistro que se dará a conocer el (sic) la Página Web en que se indicará también el vínculo al Tribunal Electrónico o Sistema y acudir a las oficinas de la Unidad Administrativa de Certificación o a las demás oficinas que el Consejo de la Judicatura del Estado habilite para tal efecto y requisitar la solicitud correspondiente:

a) Nombre de la autoridad certificadora a quien va dirigida la solicitud;

b) Nombre completo del solicitante;

c) Domicilio del solicitante;

d) Dirección de correo electrónico para recibir mensajes de datos y documentos electrónicos;

e) Clave Única del Registro de Población (CURP) del solicitante, salvo que se trate de extranjeros, quienes deberán presentar el documento que acredite su legal estadía en territorio nacional o aquellos documentos expedidos por sus gobiernos, debidamente traducidos y apostillados y

f) Carta compromiso para la obtención de la Firma Electrónica Certificada;

g) Documento que acredite la facultad de representación, para el caso de personas jurídicas colectivas públicas o privadas, nacionales o extranjeras o institutos políticos;

h) Solicitud con firma autógrafa, dirigida a la Unidad Administrativa o al Consejo, acompañada de comprobante de domicilio, copia del CURP e identificación oficial vigente, y tratándose de extranjeros, quienes deberán presentar el documento que acredite su legal estadía en territorio nacional o aquellos documentos expedidos por sus gobiernos, debidamente traducidos y apostillados. Documentos todos, estos, que deberán ser presentados en original y copia, y que, previo cotejo se devolverán los originales al interesado.

Posteriormente, el interesado deberá acudir ante la autoridad certificadora que corresponda y entregar su solicitud con firma autógrafa, acompañada de los siguientes documentos:

a) El documento que compruebe el domicilio a que se refiere la fracción II;

b) El documento de identificación oficial expedido por autoridad competente, y

c) El documento probatorio de nacionalidad mexicana, y tratándose de extranjeros, quienes deberán presentar el documento que acredite su legal estadía en territorio nacional o aquellos documentos expedidos por sus gobiernos, debidamente traducidos y apostillados.

d) La cédula para el ejercicio profesional estatal o federal, en caso de abogados procuradores que promuevan a nombre de un tercero o el número de registro electrónico otorgado por el Poder Judicial del Estado, al registrar electrónicamente sus cédulas.

El Consejo establecerá en términos de las disposiciones aplicables, los procedimientos para el registro de datos y verificación de elementos de identificación, emisión, renovación y revocación de certificados digitales, los cuales darán a conocer a través de sus respectivas páginas Web.

Artículo 30. El certificado digital quedará sin efectos o será revocado por la autoridad certificadora que lo emitió, cuando se actualice alguno de los supuestos siguientes:

I. Por expiración de su vigencia;

II. Cuando se compruebe que los documentos que presentó el titular del certificado digital para acreditar su identidad son falsos;

III. Por revocación decretada por el Consejo, cuando se dejen de reunir las condiciones que sirvieron de base para su otorgamiento, o bien el Titular o Firmante incumplan las obligaciones que les impone este Reglamento;

IV. Cuando así lo solicite el titular del certificado digital o el Firmante en los casos de representación, ante la autoridad certificadora que lo emitió;

V. Por fallecimiento del titular del certificado digital. En este caso, la revocación procederá a solicitud de un tercero legalmente autorizado, quien deberá acompañar el acta de defunción del titular del certificado digital;

V (SIC). Cuando se extravíe o inutilice por daños el medio electrónico que contenga los certificados digitales;

VI. Cuando se ponga en riesgo la confidencialidad, integridad o seguridad de los datos de creación de la Firma Electrónica Certificada, caso en el cual, el interesado deberá adjuntar a su solicitud de revocación, el acta levantada ante el Agente del Ministerio Público que haga constar los hechos en los cuales se haya puesto en riesgo la confidencialidad, integridad o seguridad de su firma electrónica o certificado digital;

VII. Por resolución de autoridad judicial o administrativa que así lo determine;

VIII. Cuando exista resolución firme en la que se haya acreditado que se alteró o falseo la autenticidad, calidad o contenido de los documentos que hayan exhibido ante las autoridades certificadoras; y,

IX. Cuando exista resolución firme en la que se haya acreditado que se alteró o falseo la autenticidad, calidad o contenido de algún documento que se haya exhibido en juicio, mediante el uso de la firma electrónica.

Artículo 31. La vigencia del certificado digital será de tres años como máximo, la cual iniciará a partir del momento de su emisión y expirará el día y en la hora señalada en el mismo.

CAPÍTULO II.- DERECHOS Y OBLIGACIONES DEL TITULAR DEL CERTIFICADO DIGITAL

Artículo 32. El titular de un certificado digital tendrá los derechos siguientes:

I. A ser informado por la autoridad certificadora que lo emita sobre:

a) Las características y condiciones precisas para la utilización del certificado digital, así como los límites de su uso;

b) Las características generales de los procedimientos para la generación y emisión del certificado digital y la creación de la clave privada, y

c) La revocación del certificado digital;

II. A que los datos personales e información confidencial que proporcione a la autoridad certificadora, sean tratados de manera confidencial, en términos de las disposiciones jurídicas aplicables, y

III. A solicitar la modificación de datos y elementos del certificado digital, o la revocación de éste, cuando así convenga a sus intereses.

Artículo 33. El titular de un certificado digital o firmante, estará obligado a lo siguiente:

I. Cumplir con los términos y condiciones a que se sujeta el uso de la Firma Electrónica Certificada;

II. Hacer declaraciones veraces y completas en relación con los datos y documentos que proporcione para su identificación personal, para el adecuado ejercicio de la profesión que se requiera y para la adecuada representación que ostente;

III. Custodiar adecuadamente sus datos de creación de firma y la clave privada vinculada con ellos, a fin de mantenerlos en secreto y sin injerencia de terceros;

IV. Actuar con diligencia y los cuidados necesarios para evitar la utilización no autorizada por parte de terceros, de su Firma Electrónica Certificada;

V. Asumir cualquier tipo de responsabilidad y cumplir con las obligaciones derivadas del mal uso que se haga de su Firma Electrónica Certificada; y

VI. Solicitar a la autoridad certificadora la revocación de su certificado digital en caso de que la integridad o confidencialidad de sus datos de creación de firma o su frase de seguridad hayan sido comprometidos y presuma que su clave privada pudiera ser utilizada indebidamente, y

VII. Dar aviso a la autoridad certificadora respectiva de cualquier modificación de los datos que haya proporcionado, a fin de que ésta incorpore las modificaciones en los registros correspondientes y emita un nuevo certificado digital; siempre y cuando ello no varíe la identidad y titularidad del certificado; y,

VIII. Las demás que determinen las leyes y ordenamientos.

Artículo 34. Los titulares de una Firma Electrónica Certificada, Clave de Acceso y Contraseña serán responsables de su uso, por lo que el acceso o recepción de las notificaciones, la consulta al Expediente Electrónico y el envío de información mediante la utilización de cualquiera de dichos instrumentos, les serán atribuibles y no admitirán prueba en contrario, salvo que se demuestren fallas del Sistema.

Una vez recibida por vía electrónica cualquier promoción de las partes, el Sistema emitirá el Acuse de Recibo Electrónico correspondiente, señalando la fecha y la hora de recibido.

CAPÍTULO III.- DE LAS AUTORIDADES CERTIFICADORAS

Artículo 35. La Unidad Administrativa y las Unidades Certificadoras habilitadas por el Consejo son consideradas autoridades certificadoras para emitir certificados digitales en términos de este Reglamento.

Artículo 36. Las autoridades certificadoras tendrán las atribuciones y obligaciones siguientes:

I. Emitir, administrar y registrar certificados digitales, así como prestar servicios relacionados con la Firma Electrónica Certificada y el Expediente Electrónico;

II. Llevar un registro de los certificados digitales que emitan y de los que revoquen, así como proveer los servicios de consulta a los interesados;

III. Adoptar las medidas necesarias para evitar la falsificación, alteración o uso indebido de certificados digitales, así como de los servicios relacionados con la Firma Electrónica Certificada;

IV. Solicitar al Consejo la revocación de los certificados de Firma Electrónica Certificada, cuando se actualice alguno de los supuestos previstos en el presente Reglamento y conforme al procedimiento previsto en el mismo;

V. Garantizar la autenticidad, integridad, conservación, confidencialidad y confiabilidad de la Firma Electrónica Certificada, así como de los servicios relacionados con la misma;

VI. Preservar la confidencialidad, integridad y seguridad de los datos personales de los titulares de los certificados digitales en términos de la Ley General del (sic) Transparencia y Acceso a la Información Pública y a la Ley de Transparencia y Acceso a la Información Pública para el Estado de Baja California y al Reglamento para la Transparencia y el Acceso a la Información Pública del Poder Judicial del Estado de Baja California;

VII. Las demás que les confiera la Ley Orgánica del Poder Judicial del Estado de Baja California, el Reglamento Interior del Consejo de la Judicatura del Estado de Baja California y las demás disposiciones jurídicas aplicables.

Artículo 37. Las autoridades certificadoras que mediante acuerdo designe el Consejo, podrán dejar de tener ese carácter cuando incumplan las obligaciones previstas en el presente Reglamento o así lo determine el Consejo.

Artículo 38. La Unidad Administrativa, la Oficialía Mayor del Consejo de la Judicatura del Estado y la Administración Judicial, podrán coordinarse para acordar y definir los estándares, características y requerimientos tecnológicos a que se deberán sujetar las autoridades certificadoras del Poder Judicial del Estado, para garantizar la autenticidad, integridad, conservación, confidencialidad y confiabilidad de la Firma Electrónica Certificada.

CAPÍTULO IV.- DEL RECONOCIMIENTO DE CERTIFICADOS DIGITALES Y DE LA CELEBRACIÓN DE CONVENIOS DE COLABORACIÓN O COORDINACIÓN

Artículo 39. El Consejo o la Unidad Administrativa con autorización previa de aquél, podrán celebrar bases o convenios de colaboración con otras instituciones de gobierno, para la prestación de servicios relacionados con la Firma Electrónica Certificada.

En estos casos, el Consejo de la Judicatura del Estado publicará una declaratoria de incorporación de la firma electrónica de algún otro poder, ente, órgano o autoridad del estado o de alguna otra entidad federativa, a efecto de que se tomen como válidos para los órganos y tribunales del Poder Judicial del Estado, todos los documentos, notificaciones y actos de otros poderes, entes, órganos o tribunales de esta o de otras entidades federativas, que se hayan expedidos mediante firma electrónica en términos de sus diversas disposiciones aplicables.

Artículo 40. Los certificados digitales expedidos por otros poderes, entes, órganos o instituciones de gobierno, tendrán la misma validez y producirán los mismos efectos jurídicos reconocidos en el presente Reglamento, siempre y cuando tales certificados sean reconocidos por la (sic) el Consejo o la Unidad Administrativa mediante convenio, y garanticen en la misma forma que lo hacen los certificados propios, el cumplimiento de los requisitos, el procedimiento, así como la validez y vigencia del certificado.

TÍTULO CUARTO.- DE LAS RESPONSABILIDADES Y SANCIONES CAPÍTULO ÚNICO

Artículo 41. Las conductas de los servidores públicos que impliquen el incumplimiento a los preceptos establecidos en el presente reglamento, dará lugar al procedimiento y a las sanciones que correspondan en términos de la Ley Orgánica del Poder Judicial del Estado de Baja California y la Ley de Responsabilidades de los Servidores Públicos del Estado de Baja California.

Artículo 42. Las conductas de los particulares que impliquen el incumplimiento a los preceptos establecidos en el presente reglamento, dará lugar al inicio del procedimiento de garantía de audiencia previa para la revocación del certificado digital y de la firma electrónica del presunto infractor.

En tal caso, la Secretaría General del Consejo de la Judicatura del Estado, dictará el acuerdo de inicio, realizará las notificaciones correspondientes en el último domicilio que se hubiere señalado ante la Unidad Administrativa o las Unidades Certificadoras; desahogará el procedimiento con las formalidades esenciales en las que se permita al presunto infractor ofrecer pruebas y rendir alegatos, hasta ponerlo en estado de citación para resolución; caso en el cual, dará cuenta al Pleno del Consejo con el proyecto corresponde (sic) para su aprobación.

La resolución que emita el Consejo, se notificará a los interesados en términos del artículo 116 del Código de Procedimientos Civiles del Estado.

Artículo 43. En todos los casos, cuando las infracciones al presente reglamento impliquen la posible comisión de una conducta sancionada en los términos de la legislación civil, penal o de cualquier otra naturaleza, los órganos del Poder Judicial del Estado, lo harán del conocimiento de las autoridades competentes.

ARTÍCULOS TRANSITORIOS

PRIMERO.-

El presente reglamento entrará en vigor al día siguiente de su publicación en el Periódico Oficial del Estado.

SEGUNDO.-

Solicítese la publicación del presente, en el Boletín Judicial y en Periódico Oficial del Estado de Baja California en términos de los artículos 159 párrafo segundo y 187 de la Ley Orgánica del Poder Judicial del Estado de Baja California; 2, 3 fracción VIII y 4, de la Ley del Periódico Oficial del Estado.

TERCERO.- Los certificados digitales expedidos con anterioridad a la entrada en vigor de este Reglamento, mediante el programa piloto de implementación del ACUERDO GENERAL NÚMERO 02-2015, DEL PLENO DEL CONSEJO DE LA JUDICATURA DEL PODER JUDICIAL DEL ESTADO DE BAJA CALIFORNIA, POR EL QUE SE CREA LA UNIDAD ADMINISTRATIVA DE CERTIFICACIÓN, SE AUTORIZA LA IMPLEMENTACIÓN DEL EXPEDIENTE ELECTRÓNICO, SE RECONOCE LA VALIDEZ DE LAS NOTIFICACIONES ELECTRÓNICAS Y EL USO DE LA FIRMA ELECTRÓNICA EN LOS EXPEDIENTES, INCIDENTES, CUADERNILLOS Y DEMÁS ASUNTOS DEL CONOCIMIENTO DEL (SIC) LOS TRIBUNALES, ÓRGANOS JURISDICCIONALES Y ÓRGANOS ADMINISTRATIVOS DEL PODER JUDICIAL DEL ESTADO DE BAJA CALIFORNIA, conservarán su vigencia y alcances, al haber sido emitidos al amparo del citado acuerdo general.

CUARTO.-

Las disposiciones generales a que se refiere el segundo párrafo del artículo 6 del presente Reglamento, se emitirán en un plazo máximo de noventa días hábiles, contados a partir de la entrada en vigor de este ordenamiento.

QUINTO.-

Los órganos administrativos y jurisdiccionales del Poder Judicial del Estado, que el Consejo determine como viables para el uso de firma electrónica, deberán remitir a la Unidad Administrativa, dentro de los quince días hábiles posteriores a la entrada en vigor de este Reglamento, su programa de instrumentación para el uso de la Firma Electrónica Certificada, en el que se contemplen los distintos actos en los que sea o no factible el uso de la Firma Electrónica Certificada, con objeto de que la Unidad Administrativa emita, cuando corresponda, el dictamen que determine la gradualidad requerida para que el órgano respectivo esté en posibilidad de instrumentar el uso de la Firma Electrónica Certificada en los actos que le competen.

Aprobado por unanimidad de votos de los miembros del Consejo de la Judicatura del Estado de Baja California, en sesión de fecha nueve de marzo de dos mil dieciséis y de conformidad con lo dispuesto por los artículos los artículos (sic) 57 párrafos segundo y tercero, 59 párrafo segundo, 64 primer párrafo, 65 párrafo séptimo y 97 primer párrafo, de la Constitución Política del Estado Libre y Soberano de Baja California y con fundamento en lo dispuesto por los artículos 22, 39 fracción II, 155, 156, 158, 159, 161, 163, 164, 165, 166, 167 y 168 fracciones I, II, IV, XV, XVIII, XXIII, XXVI, XXXI, XXXIII, XXXV, y XLII, de la Ley Orgánica del Poder Judicial del Estado de Baja California; imprímase y publíquese el presente para su debida observancia y cumplimiento.

Dado en el Edificio de Tribunales del Poder Judicial del Estado, en la Ciudad de Mexicali, Baja California, a los nueve días del mes de marzo de dos mil dieciséis.

MAGISTRADO JORGE ARMANDO VÁSQUEZ PRESIDENTE DEL TRIBUNAL SUPERIOR DE JUSTICIA Y DEL CONSEJO DE LA JUDICATURA DEL ESTADO DE BAJA CALIFORNIA

LIC. JORGE IGNACIO PÉREZ CASTAÑEDA MAGISTRADO CONSEJERO

LIC. SALVADOR JUAN ORTIZ MORALES MAGISTRADO CONSEJERO

LIC. RAÚL LUIS MARTÍNEZ JUEZ CONSEJERO

LIC. GERARDO BRIZUELA GAYTÁN CONSEJERO

LIC. HÉCTOR ORLANDO DÍAZ CERVANTES CONSEJERO

LIC. ENRIQUE MAGAÑA MOSQUEDA SECRETARIO GENERAL DEL CONSEJO DE LA JUDICATURA DEL ESTADO

12Sep/18

Reglamento sobre el uso de medios electrónicos y Firma Electrónica para el Municipio de Celaya, Guanajuato

12 septiembre, 2018México, ReglamentoJosé Cuervo

Reglamento sobre el uso de medios electrónicos y Firma Electrónica para el Municipio de Celaya, Guanajuato.
Artículo 1.- El presente ordenamiento es de orden e interés público, así como de observancia general y obligatoria para todos los servidores públicos del gobierno municipal y se expide como el medio para implementar el uso de medios electrónicos y firma electrónica certificada en el desarrollo de trámites y servicios en el Municipio de Celaya Guanajuato.
Artículo 2.- El presente reglamento se expide con fundamento en lo dispuesto en los artículos: 115 fracción II inciso a) de la Constitución Política de los Estados Unidos Mexicanos.
Artículo 3.- En lo no previsto por el presente reglamento será supletoria la Ley Sobre el Uso de Medios Electrónicos y Firma Electrónica para el Estado de Guanajuato y sus Municipios, su Reglamento, el Código Civil del Estado de Guanajuato, Ley Orgánica Municipal para el Estado de Guanajuato, las Políticas y los Lineamientos aplicables.
Artículo 4.- El presente ordenamiento tiene por objeto:
I. Agilizar, simplificar y hacer más accesibles los actos, comunicaciones, procedimientos administrativos, trámites y la prestación de servicios públicos que corresponden a la administración pública municipal, promoviendo y fomentando el uso de medios electrónicos en las relaciones entre sus dependencias, entidades y los particulares;
II. El uso de la firma electrónica certificada, su eficacia jurídica y la prestación de trámites y servicios relacionados con la Administración Pública Municipal;
III. Proporcionar certeza y confianza en el desarrollo de trámites a través de
medios electrónicos, que incentiven su utilización; y,
IV. Estandarizar y contribuir al desarrollo de las tecnologías de la información y
las comunicaciones dentro de las dependencias y entidades de la Administración Pública Municipal.
Artículo 5.- Para los efectos de este reglamento, se entiende por:
I. Acceder remotamente: Se refiere a poder acceder desde una computadora a un recurso ubicado físicamente en otra computadora que se encuentra geográficamente en otro lugar, a través de una red local o externa.
II. Actuación Electrónica: Los actos, notificaciones, requerimientos, solicitudes de informes o documentos, comunicaciones o resoluciones administrativas que las dependencias, entidades y demás unidades administrativas de la Administración Pública Municipal efectúen entre sí o hacia los particulares, a través de medios electrónicos o mediante
firma electrónica.
III. Almacenamiento en nube: Espacio de almacenamiento
proporcionado por un proveedor externo al cual se le puede accesar a
través de internet.
IV. Autoridad Certificadora: Es la autoridad Estatal facultada de emitir la
certificación de la firma electrónica.
V. Aval técnico: Es la aprobación que emite la Dirección de Sistemas
respecto de todo lo concerniente al área.
VI. certificado de firma electrónica: El documento firmado electrónicamente por la autoridad certificadora, mediante el cual se confirma el vínculo existente entre el firmante y la firma electrónica.
VII. Cliente-servidor: Es un modelo en el que las tareas se reparten entre los proveedores de recursos o servicios, llamados servidores, y los demandantes, llamados clientes. Un cliente realiza peticiones a otro programa, el servidor, es quien le da respuesta.
VIII. Coordinación de redes: Es un área de la dirección de sistemas la cual brinda servicios de redes, telefonía soporte técnico para dar servicio a las dependencias del municipio
IX. Dependencias: Son las Direcciones que conforman la estructura orgánica de la Administración Pública Municipal Centralizada.
X. Discos duros: Medios de almacenamiento de información digital.
XI. Dirección de Sistemas: Dependencia encargada de la gestión del
hardware y software del municipio de Celaya, Guanajuato.
XII. Entidades: Organismo de la Administración Pública Paramunicipal.
XIII. Equipos de cómputo personales: Es una máquina electrónica que
recibe y procesa datos, para convertirlos en información conveniente y
útil, utilizada por personal del municipio.
XIV. Firma electrónica certificada: Es el conjunto de datos electrónicos
integrados o asociados al mensaje de datos o documento electrónico, expedida por la Autoridad Certificadora, que permite asegurar la integridad y autenticidad de ésta y la identidad del titular.
XV. Hardware: Conjunto de elementos físicos que constituyen un sistema informático.
XVI. Infraestructura tecnológica: Conjunto de hardware y software sobre el que se asientan los diferentes servicios que el municipio necesita tener en funcionamiento.
XVII. Medios electrónicos: Cualquier tipo de dispositivo que almacena y permite la distribución o el uso de información electrónica.
XVIII. Municipio: El Municipio de Celaya, Guanajuato.
XIX. Niveles de seguridad de acceso: Contraseñas, o sistemas de
seguridad requeridos para ingresar a los programas de cómputo.
XX. Políticas en Informática: Es el conjunto de reglas obligatorias, que deben observar la Dirección de Sistemas responsables del hardware y
software existente en el Municipio: Municipio de Celaya, Guanajuato.
XXI. Procesamiento de información: Se refiere a la recolección de datos que son evaluados y ordenados en un sistema de cómputo, para
obtener información específica, que posteriormente será analizada por
el área correspondiente.
XXII. Red de voz y datos: Es el soporte físico de un sistema de
comunicaciones que posee unas características determinadas.
XXIII. Redes: Una red informática son dos o más sistemas de cómputo conectados entre sí y que comparten recursos, ya sea hardware software, permite que varios usuarios puedan intercambiar información, pasar archivos, compartir periféricos como las impresoras e incluso ejecutar programas en otros ordenadores conectados a la red.
XXIV. Respaldos históricos: Es una copia que se realiza periódicamente, de los datos originales fuera de la infraestructura con el fin de disponer de un medio para recuperarlos en caso de su pérdida.
XXV. Reglamento: Reglamento Sobre el Uso de Medios Electrónicos y Firma Electrónica Certificada para el Municipio de Celaya, Guanajuato.
XXVI. Servicios informáticos: Se refiere a los servicios proporcionados por la Dirección de Sistemas, tales como internet, correo electrónico institucional, telefonía, etcétera.
XXVII. Seguridad jurídica: Es la certeza del derecho, tanto en el ámbito de su publicidad como en su aplicación, se tiene la seguridad de que se conoce, o puede conocerse, lo previsto como prohibido, ordenado o permitido por el poder público.
XXVIII. Sistemas informáticos: Es un sistema que permite almacenar y procesar información.
XXIX. Software: Conjunto de programas y rutinas que permiten a la computadora realizar determinadas tareas.
XXX. Software de red: Software utilizado para ejecutarse en una red.
XXXI. Tecnologías de la información: Se refiere al uso de equipos de telecomunicaciones y computadoras para la transmisión, el
procesamiento y el almacenamiento de datos.
XXXII. Tesorería: La Tesorería Municipal de Celaya Guanajuato.
XXXIII. Virus: Es un software que tiene por objetivo el alterar el funcionamiento normal de cualquier tipo de dispositivo informático, sin el permiso o el
conocimiento del usuario
Artículo 6.- Las disposiciones contempladas en el presente reglamento aplican a todos los usuarios de las dependencias y entidades que utilizan los recursos y servicios informáticos que sean propiedad del municipio de Celaya, ya sea en forma compartida o controlada individualmente, que estén aislados o interconectados a redes.
Artículo 7.- Las dependencias del municipio de Celaya deberán contar con un enlace, en el que recaiga la administración de los bienes y servicios, que vigilará la correcta aplicación de los ordenamientos establecidos y demás disposiciones aplicables.
CAPÍTULO SEGUNDO AUTORIDADES COMPETENTES
Artículo 8.- Son autoridades responsables de vigilar la observancia y aplicación del presente ordenamiento, en el ámbito de sus respectivas competencias:
I. El Ayuntamiento de Celaya;
II. El Presidente Municipal de Celaya;
III. La Tesorería Municipal;
IV. La Dirección de Sistemas; y,
V. Las Dependencias y Entidades de la Administración Pública Municipal.
Artículo 9.- Al Ayuntamiento le compete ser el órgano normativo en materia de aplicación y promoción del uso de medios electrónicos para todas las entidades y dependencias del gobierno de la administración pública municipal.
Artículo 10.- Es facultad del Presidente Municipal y la Dirección de Sistemas promover el uso de medios electrónicos, buscando agilizar, simplificar, hacer eficiente y dotar de mayor seguridad jurídica los procedimientos administrativos que lleven a cabo las dependencias y entidades del gobierno municipal.
Artículo 11.- La Tesorería a través de la Dirección de Sistemas, tendrá la facultad de integrar y desarrollar sistemas informáticos que proporcionen soluciones factibles, cuidando la integridad de sus procedimientos e información así como la interacción entre ellos.
Artículo 12.- La Dirección de Sistemas es la unidad administrativa encargada de la supervisión de los sistemas de informática de la administración pública municipal centralizada, así como del cumplimiento de este reglamento, por lo cual tendrá las siguientes atribuciones y facultades:
I. Vigilar el funcionamiento de la tecnología informática que se utilice en las diferentes dependencias y entidades;
II. Elaborar y dar seguimiento a la planeación de objetivos del área.
III. Mantener la infraestructura tecnológica;
IV. Controlar la calidad del servicio brindado;
V. Mantener un control del resguardo de las bases de datos del municipio;
VI. Cuidar el cumplimiento de las políticas y procedimientos establecidos en el presente reglamento;
VII. Emitirelavaltécnicoenacuerdoconeldirectordeladependenciasolicitante para el mantenimiento y/o adquisición de bienes y servicios informáticos; y,
VIII. En el caso de las dependencias que cuenten en su estructura orgánica con áreas de sistematización o informática, es responsabilidad del titular de la misma el cumplimiento de la normatividad vigente.
Artículo 13.- Toda adquisición, mantenimiento y contratación de servicios informáticos deberán sujetarse a los procedimientos establecidos en la normatividad aplicable.
Artículo 14.- Para la operación del software de red se debe tener en consideración lo siguiente:
I. Toda la información institucional debe invariablemente ser operada a través de un mismo tipo de sistema manejador de base de datos para beneficiarse de los mecanismos de integridad, seguridad y recuperación de información en caso de falla del sistema de cómputo;
II. El acceso a los sistemas de información, debe contar con los privilegios o niveles de seguridad de acceso suficientes para garantizar la seguridad total de la información institucional;
III. Los niveles de seguridad de acceso deberán controlarse por un administrador único y poder ser manipulado por la coordinación de redes;
IV. Se deben delimitar las responsabilidades en cuanto a quién está autorizado a consultar y/o modificar en cada caso la información, tomando las medidas de seguridad pertinentes para cada caso en concreto;
V. El Director de cada dependencia es responsable del sistema de información que debe autorizar para su área, y de solicitar la asignación de claves de acceso al titular de la Dirección de Sistemas;
VI. Los datos de los sistemas de información, deben ser respaldados de acuerdo a la frecuencia de actualización dependiendo de la importancia de los mismos, rotando los dispositivos de respaldo y guardando respaldos históricos periódicamente;
VII. Es indispensable llevar una bitácora oficial de los respaldos realizados, asimismo, los medios de respaldo o almacenamiento deberán guardarse en un lugar de acceso restringido con condiciones ambientales suficientes para garantizar su conservación;
VIII. Encuantoalainformacióndelosequiposdecómputopersonales,losusuarios deben realizar sus propios respaldos en la red o en medios de almacenamiento alternos;
IX. Todos los sistemas de información que se tengan en operación, deben contar con sus respectivos manuales actualizados, uno técnico que describa la estructura interna del sistema, así como los programas, catálogos y archivos que lo conforman, y otro que describa a los usuarios del sistema los procedimientos para su utilización;
X. Los sistemas de información elaborados por la Dirección de Sistemas, deben contemplar el registro de las transacciones sobre datos relevantes, así como la clave del usuario y fecha en que se realizó; y,
XI. Se deben implantar rutinas periódicas de auditoría a la integridad de los datos y de los programas de cómputo, para garantizar su confiabilidad al menos cada 6 meses.
Artículo 15.- Todas las dependencias de la Administración Pública Municipal que requieran la elaboración o contratación de un sistema electrónico que esté relacionado con el logro de sus objetivos; deberá obtener el aval técnico y atender las recomendaciones de la Dirección de Sistemas.
CAPITULO CUARTO
DE LA INSTALACION, SEGURIDAD Y SOPORTE DEL HARDWARE Y SOFTWARE
Artículo 16.- La instalación del equipo de cómputo, quedará sujeta a lo siguiente:
I. Los equipos para uso interno y de atención directa al público se instalarán en lugares validados por la Dirección de Sistemas;
II. La Dirección de Sistemas, así como las dependencias deberán contar con un diagrama actualizado de las instalaciones de la red de voz y datos;
III. Las instalaciones de red de voz y datos estarán de preferencia fijas o en su defecto resguardadas del paso de personas o máquinas, y libres de cualquier interferencia eléctrica o magnética;
IV. Las instalaciones se apegarán estrictamente a los requerimientos de los equipos, cuidando las especificaciones del cableado y de los circuitos de protección necesarios;
V. En ningún caso se permitirán instalaciones improvisadas o sobrecargadas; y,
VI. Cuando en la instalación se alimenten elevadores, motores y maquinaria pesada, se deberá tener un circuito independiente, exclusivo para el equipo
y/o red de cómputo.
Artículo 17.- La Seguridad de información del equipo de cómputo, quedará sujeta a lo siguiente:
I. El usuario responsable del equipo de cómputo deberá mantener bajo su resguardo los medios de acceso para su instalación y en su caso manuales de operación;
II. Esobligacióndelusuarioresponsabledecadaequipoverificarqueelsoftware antivirus institucional se encuentre en ejecución y vigente en forma permanente;
III. Todo usuario es responsable de mantener respaldos de su información de acuerdo a sus necesidades, en caso de las aplicaciones cliente-servidor , el responsable de los respaldos de las bases de datos es el administrador de red;
IV. Queda prohibido que los usuarios remuevan o agreguen componentes tanto de software como de hardware a los equipos de cómputo. En caso de requerir algún cambio deberá solicitarse a la Dirección de Sistemas;
V. Para dar de baja equipo de cómputo, el enlace de la dependencia deberá solicitar el visto bueno de la Dirección de Sistemas, quien a su vez evaluará y emitirá el dictamen correspondiente para dar continuidad al procedimiento de baja o reasignación;
VI. Los servicios de red institucionales debidamente autorizados, que se habiliten para su acceso desde internet, deberán ponerse en operación sólo después de que el personal de la Dirección de Sistemas aplique medidas de seguridad básicas, debiendo ser solicitadas vía oficio por el Director de la dependencia correspondiente a la Dirección de Sistemas;
VII. Cuando se requiera acceder remotamente a los equipos del municipio se deberán utilizar únicamente conexiones seguras creadas por personal de la Dirección de Sistemas;
VIII. La configuración de los equipos realizada por la Dirección de Sistemas no deberá ser modificada por los usuarios;
IX. La Dirección de Sistemas es la única facultada para configurar equipos para el acceso a la red e internet;
X. Por razones de seguridad y riesgos asociados, se prohíbe el uso de software de mensajería instantánea, chat, almacenamiento en nube diferente al institucional y similares a menos que se justifique el uso del mismo, debiendo ser autorizado vía oficio por la dependencia correspondiente;
XI. Estáprohibidoconectarseainternetutilizandoequiposdiferentesalosquese encuentran oficialmente en servicio;
XII. El uso de internet es únicamente para actividades relacionadas con las funciones institucionales;
XIII. La Dirección de Sistemas asignará una contraseña al momento de crear una cuenta de correo electrónico misma que se entregará al usuario. Los usuarios de equipo informático, son responsables del uso que se le dé a la cuenta de correo electrónico y del acceso a internet en su caso;
XIV. Toda solicitud de procesamiento de información deberá presentarse vía oficio a la Dirección de Sistemas, siendo el usuario responsable de la validación y de mantener un respaldo de la misma; y,
XV. El usuario es responsable de seguir las políticas de seguridad y procedimientos para el uso de los servicios y recursos informáticos, evitando cualquier práctica o uso inapropiado que los pudiera poner en peligro y a la información del municipio.
CAPITULO QUINTO
DE LAS OBLIGACIONES Y PROHIBICIONES DEL USO DE LOS MEDIOS INFORMÁTICOS
Artículo 18.- Para el uso adecuado del correo electrónico institucional el usuario deberá sujetarse a lo siguiente:
I. Las cuentas de correo electrónico que se asignan a los usuarios son exclusivamente para uso oficial;
II. La contraseña del correo electrónico deberá ser cambiada por la Dirección de Sistemas periódicamente;
III. Está prohibido abrir archivos adjuntos de correo electrónico recibidos de remitentes desconocidos, ya que pueden contener virus u otros códigos dañinos;
IV. Los usuarios no deben enviar mensajes no solicitados de correo electrónico, ni cadenas de mensajes, correo basura o materiales publicitarios;
V. Está prohibido que los usuarios compartan las contraseñas de sus cuentas de correo;
VI. Toda sesión de trabajo deberá ser cerrada por el usuario que se encuentre disponiendo del equipo al concluir su jornada laboral;
VII. Se debe revisar el correo periódicamente y depurarlo; y,
VIII. La Dirección de Sistemas deberá capacitar a los usuarios acerca de los riesgos asociados al correo electrónico.
Artículo 19.- Queda prohibido a todo funcionario público que tenga acceso al uso de software y hardware que sea propiedad del municipio, lo siguiente:
I. Utilizar los recursos para llevar a cabo actividades fuera de la ley;
II. Utilizar los recursos para fines particulares;
III. Utilizar los recursos sin respetar las leyes de derechos de autor, aplicables a textos, elementos multimedios tales como gráficos, fotografías, videos, música, etcétera, datos y software;
IV. Utilizar recursos sin tener autorización o autoridad para hacerlo;
V. Permitirofacilitarqueusuariosnoautorizadoshaganusodelosrecursosdel
municipio;
VI. Distribuir datos o información confidencial del municipio sin autorización;
VII. Alterar configuraciones de software o hardware del sistema sin autorización;
VIII. Leer la correspondencia electrónica ajena, o prestar las contraseñas
personales;
IX. Suplantar a otras personas, haciendo uso de una falsa identidad, utilizando
cuentas de acceso ajenas a los servicios;
X. Utilizarinternetparaconsultadepáginasconcontenidospornográficos,sitios
recreativos, deporte, juegos, chistes, etcétera;
XI. Utilizar internet para accesar a sitios que sintonizan estaciones de radio y
televisión;
XII. Utilizar los discos duros de las computadoras del municipio para almacenar
archivos de pornografía, música en cualquier formato, juegos o similares, y
fotografías personales;
XIII. Intentar evitar los mecanismos de seguridad de la red, perjudicar la
funcionalidad de la red, o saltarse las restricciones establecidas por los
administradores de la red;
XIV. Interceptar o alterar la información que se transmite; y,
XV. Utilizarlosrecursosdetalformaquesevioleéstereglamento,otraspolíticas institucionales y la normatividad aplicable.
CAPITULO QUINTO
DE LA FIRMA ELECTRONICA CERTIFICADA
Artículo 20.- El uso de la firma electrónica certificada tiene como finalidad fomentar la incorporación de nuevas tecnologías de seguridad, para agilizar y simplificar actos, trámites, servicios, comunicaciones y procedimientos administrativos entre los sujetos que hagan uso de la firma.
Artículo 21.- Para el uso y aplicación de la firma electrónica certificada se deberán observar los siguientes principios:
I. Equivalencia funcional: Es la equiparación de la firma electrónica certificada con la firma autógrafa y de un mensaje de datos con los documentos escritos.
II. Autenticidad: La certeza de que un mensaje de datos ha sido emitido o proviene del firmante y por tanto le es atribuible su contenido y las
consecuencias jurídicas que del mismo deriven.
III. Confidencialidad: Toda información generada, enviada y recibida se deberá
proteger y resguardar de la distribución no autorizada.
IV. Integridad: Asegura que la información no ha sido manipulada, es decir, que
ha permanecido en un estado inalterado desde su creación.
V. Recepción: Para que surtan efectos jurídicos de un mensaje de datos, deberá contar siempre y sin excepción con un acuse de recibo electrónico del mismo,
generado por el sistema de información del destinatario.
VI. Conservación: Se deberán establecer los procedimientos y medidas
destinados a asegurar la preservación y la prevención de alteraciones en la
información de los documentos electrónicos para su posterior consulta.
VII. Neutralidad tecnológica: Ningún método de firma electrónica podrá ser objeto de rechazo, en virtud, de que se otorga a todas las tecnologías la misma oportunidad de satisfacer los requisitos establecidos en el presente
ordenamiento.
Artículo 22.- Quedan exceptuados de la aplicación de este ordenamiento:
I. Los actos o procedimientos, que por disposición legal expresa exijan la firma autógrafa; y,
II. Losactosoprocedimientos,quepordisposiciónlegalexijaunaformalidadque no sea susceptible de cumplirse mediante la firma electrónica certificada.
Artículo 23.- Para que un mensaje de datos se considere enviado y recibido, se requiere de un acuse de recibo electrónico, generado por el sistema de información del destinatario, lo anterior atendiendo al principio de recepción.
Artículo 24.- Cuando se realicen cualquiera de los actos regulados por este reglamento a través de un mensaje de datos en hora o día inhábil, se tendrá por realizado en el siguiente día hábil.
Artículo 25.- Los mensajes de datos se tendrán por emitidos en el lugar en donde el firmante tenga registrado su domicilio dentro del certificado de la firma electrónica y por recibidos en el lugar donde el destinatario tenga señalado para recibir notificaciones.
Artículo 26.- Para la obtención de la firma electrónica certificada, el solicitante realizará el trámite correspondiente ante la Autoridad Certificadora cumpliendo los requisitos y procedimientos establecidos en la normativa aplicable.
Artículo 27.- Para que la firma electrónica certificada se considere como tal, debe cumplir con los requisitos y el procedimiento señalado en la Ley aplicable.
Artículo 28.- Las obligaciones del titular del certificado de firma electrónica serán:
I. Proporcionar datos que sean completos, exactos y veraces;
II. Mantener la confidencialidad de los datos de creación de la firma electrónica
certificada;
III. Resguardar su firma electrónica certificada en un medio electrónico; y,
IV. Notificar a la Autoridad Certificadora, la pérdida de la firma electrónica certificada o cualquier otro movimiento que altere el estado o seguridad de la misma.
Artículo 29.- En caso de ser necesario, la autoridad municipal tendrá la facultad de solicitar a la Autoridad Certificadora la revocación, suspensión o cancelación del certificado de firma electrónica.
Artículo 30.- La revocación de un certificado de firma electrónica procederá por las siguientes causas:
I. Incumplimiento de las obligaciones previstas en la Ley o en la normativa aplicable;
II. Modificación o alteración de la firma electrónica certificada expedida de conformidad con la Ley y en la normativa aplicable;
III. Uso indebido o ilícito de la firma electrónica certificada;
IV. Cuando se observen inexactitudes en los datos aportados por el firmante
para la obtención de la firma electrónica certificada; y,
V. Por haberse comprobado que al momento de la expedición de la firma
electrónica certificada no se cumplió con los requisitos que marca la normativa aplicable.
Artículo 31.- La cancelación de un certificado de firma electrónica, procederá por las siguientes causas:
I. Cuando el servidor público deje de prestar sus servicios;
II. Por pérdida, robo o inutilización de la firma electrónica certificada;
III. Por fallecimiento del firmante; y,
IV. Por solicitud del titular de la firma electrónica certificada.
Artículo 32.- La suspensión de un certificado de firma electrónica, procederá por las siguientes causas:
I. Como medida precautoria frente a un riesgo de confidencialidad de la clave privada;
II. Por solicitud del titular de la firma electrónica certificada o por mandato de la autoridad competente; y
III. Por incapacidad superveniente total o parcial del titular, declarada por la autoridad competente.
Artículo 33.- La suspensión se mantendrá mientras alguna de las condiciones descritas en el artículo anterior continúen presentes.
Artículo 34.- El titular del certificado de la firma electrónica, deberá presentar el formato de solicitud de suspensión ante la Autoridad Certificadora, señalando el motivo de la misma.
Artículo 35.- La Autoridad Certificadora analizará la solicitud de suspensión y en caso de que se advierta el uso no autorizado de la firma, procederá inmediatamente a extinguir el certificado y a expedir uno nuevo.
CAPITULO SEPTIMO DE LAS SANCIONES
Artículo 36.- Los servidores que incurran en desacato/conducta o uso indebido a lo establecido en el presente reglamento serán sancionados conforme a lo establecido en la Ley de Responsabilidades Administrativas de los Servidores Públicos del Estado de Guanajuato y sus Municipios, y la normativa aplicable.
ARTICULOS TRANSITORIOS
PRIMERO.- El presente Reglamento entrará en vigor a partir del día siguiente de su publicación en el Periódico Oficial del Estado.

12Sep/18

LEY SOBRE EL USO DE MEDIOS ELECTRÓNICOS Y FIRMAS ELECTRÓNICAS PARA EL ESTADO DE COLIMA.

12 septiembre, 2018Ley, MéxicoDECRETO nº 556 SE APRUEBA LA LEY SOBRE EL USO DE MEDIOS ELECTRÓNICOS Y FIRMAS ELECTRÓNICAS PARA EL ESTADO DE COLIMA., Derecho Informático de Estado de Colima, Derecho Informático Mexicano, legislación informática estado de Colima, legislación informática MexicoJosé Cuervo

DECRETO nº 556

SE APRUEBA LA LEY SOBRE EL USO DE MEDIOS ELECTRÓNICOS Y FIRMAS ELECTRÓNICAS PARA EL ESTADO DE COLIMA.

LIC. JESÚS SILVERIO CAVAZOS CEBALLOS, Gobernador Constitucional del Estado Libre y Soberano de Colima, a sus habitantes sabed:

Que el H. Congreso del Estado me ha dirigido para su publicación el siguiente

D E C R E T O

EL HONORABLE CONGRESO CONSTITUCIONAL DEL ESTADO LIBRE Y SOBERANO DE COLIMA, EN EJERCICIO DE LAS FACULTADES QUE LE CONFIERE LOS ARTÍCULOS 33 FRACCION II, Y 39 DE LA CONSTITUCIÓN POLÍTICA LOCAL, EN NOMBRE DEL PUEBLO, Y

C O N S I D E R A N D O

PRIMERO.-

Que mediante oficio número 824/07 de fecha 11 de septiembre de 2008, los Diputados Secretarios del H. Congreso del Estado, turnaron a las Comisiones de Estudios Legislativos y Puntos Constitucionales y de Ciencia, Tecnología e Innovación Gubernamental, la Iniciativa de Ley con Proyecto de Decreto presentada por el Licenciado Jesús Silverio Cavazos Ceballos, Gobernador Constitucional del Estado Libre y Soberano de Colima, relativa a la Ley sobre el Uso de Medios Electrónicos y Firmas Electrónicas para el Estado de Colima, la cual dentro de su exposición de motivos señala que:

Dentro del propio Plan de Desarrollo 2004-2009, se fijaron estrategias y líneas de acción para el cumplimiento del objetivo antes descrito, el fortalecimiento de la innovación gubernamental mediante el desarrollo telemático; así como las de consolidar el gobierno electrónico de Colima y los servicios electrónicos de gobierno; avanzar hacia una sociedad de la información ampliando la cobertura social en el acceso a las tecnologías de información en el Estado.

Por otra parte en el Programa Sectorial de la Administración Pública 2004-2009, dentro del subprograma de innovación gubernamental se establece como meta de la administración pública estatal, la implementación de la firma electrónica en los trámites y procedimientos internos de las dependencias que auxilian al Titular del Ejecutivo, eficientando el ejercicio de la función pública.

Ante la experiencia alcanzada en la instrumentación del gobierno electrónico y la actualización de la infraestructura tecnológica de información y de las telecomunicaciones, en las dependencias de Gobierno del Estado, facilitando con ello la comunicación interinstitucional, mediante el intercambio y acceso a la información vía internet; se hace necesario e inminente, la regulación de las modalidades de intercambio de información por medios electrónicos, y su plena validez mediante la utilización de la firma electrónica certificada, a partir de las cuales han de desarrollarse las nuevas modalidades de transmisión y recepción de información, a fin de garantizar un marco jurídico mínimo indispensable que permita a los diversos agentes involucrados, desarrollarse y contribuir con el avance de las nuevas tecnologías.

El presente ordenamiento tiene como objeto constituir una codificación legal que regule el uso de documentos electrónicos, medios electrónicos y la utilización en ellos de firma electrónica certificada por los órganos de estado y de los gobernados con los que se relaciona, con el objeto de garantizar su validez y el cumplimiento de las obligaciones y compromisos asumidos mediante dichos mecanismos y constituirse en un aporte necesario e indispensable que permita constituirse que permita constituir la base jurídica para el desarrollo de éstas tecnologías, estableciéndose como elementos principales la identificación de las partes y la integridad del documento electrónico y el mensaje de datos.

SEGUNDO.-

Que mediante oficio número 2345/08 de fecha 8 de abril de 2008, los Diputados Secretarios del H. Congreso del Estado, turnaron a la Comisión de Estudios Legislativos y Puntos Constitucionales, la Iniciativa de Ley con Proyecto de Decreto presentada por el Diputado Humberto Cabrera Dueñas y demás Integrantes del Grupo Parlamentario del Partido Acción Nacional, relativa a Ley de Firma Electrónica para el Estado de Colima, la que en su punto expositivo establece que:

La sociedad moderna, ha experimentado en gran escala los desarrollos tecnológicos por los cuales atraviesan los sistemas electrónicos y de información, que cada vez ofrecen mayores aportaciones a la humanidad, facilitando las tareas diarias que desempeñan las personas con motivo de su trabajo, escuela o diversión.

Uno de los desarrollos tecnológicos que ha impactado a nivel mundial es la implementación de los medios electrónicos y el uso de la firma electrónica.

La firma electrónica se basa en el reconocimiento de las funciones que cumple una firma manuscrita en papel, por lo general, la firma manuscrita identifica a una persona, proporciona certidumbre en cuanto a su participación personal en el acto de la firma, y lo vincula al contenido del documento. Para que la firma electrónica pueda tener validez jurídica, ésta debe llenar ciertos requisitos que den seguridad y confianza tanto al usuario como a la parte con quien se lleva a cabo el negocio o trámite.

El Estado de Colima, ha tenido a la fecha grandes avances a lo que refiere en Gobierno electrónico, y ha sido ejemplo de otros Gobiernos Estatales para implementar las medidas tecnológicas que se han venido utilizando en los últimos años, no obstante lo anterior, aún falta seguir legislando para la implementación de la firma electrónica en nuestro Estado.

El uso de la firma electrónica genera rapidez en la información enviada o recibida, ahorro de espacio mediante los documentos electrónicos que actualmente ocupa el papel, economía en el uso de copias, toner, hojas, tinta, carpetas, costo de envío, gasolina, recurso humano, entre otros muchos beneficios.

La iniciativa de Ley de Firma Electrónica para el Estado de Colima, que se presenta, prevé que la firma electrónica reconocida se equipare a la firma manuscrita, debido a que ésta se basa en un certificado electrónico reconocido y haya sido creada por un dispositivo seguro de creación.

TERCERO.-

Que esta Comisión una vez llevado a cabo el análisis y estudio de la propuesta, considera que la aprobación de la ley de Firma Electrónica viene a actualizar el desarrollo de las modalidades de transmisión y recepción de información, lo cual quiere decir que con el uso de la tecnología por internet se están creando nuevas formar para eficientar el trabajo diario, lo que ha hecho que evolucione a pasos gigantescos el quehacer diario de los individuos en la tecnología, por lo que la actualización de los procedimientos y métodos para satisfacer el reclamo de la sociedad para la obtención de un mejor servicio gubernamental no es más que un paso a lo que en la actualidad se esta viviendo, provocando el fenómeno de modernización del Estado en materia de tecnología, con la implementación de la firma electrónica en los trámites y procedimientos internos de las dependencias que auxilian al Titular del Ejecutivo, eficientando el ejercicio de la función pública.

Por eso, con el fin de garantizar un marco jurídico mínimo indispensable que permita a los diversos agentes involucrados, desarrollarse y contribuir con el avance de las nuevas tecnologías, pues como el iniciador afirma, que ante la experiencia alcanzada en la instrumentación del gobierno electrónico y la actualización de la infraestructura tecnológica de información y de las telecomunicaciones, las dependencias de Gobierno del Estado se constituyen en facilitadores respecto de la comunicación interinstitucional, mediante el intercambio y acceso a la información vía internet; por ello se hace necesario e inminente la regulación de las modalidades de intercambio de información por medios electrónicos, y su plena validez mediante la utilización de la firma electrónica certificada, a partir de las cuales han de desarrollarse las nuevas modalidades de transmisión y recepción de información.

Efectivamente coincidimos con el iniciador en el sentido de que este nuevo ordenamiento tiene como objetivo constituir una codificación legal que regule el uso de documentos electrónicos, medios electrónicos y la utilización en ellos de firma electrónica certificada por los órganos de estado y de los gobernados con los que se relaciona, con el objeto de garantizar su validez y el cumplimiento de las obligaciones y compromisos asumidos mediante dichos mecanismos y constituirse en un aporte necesario e indispensable que permita constituir la base jurídica para el desarrollo de éstas tecnologías, estableciéndose como elementos principales la identificación de las partes y la integridad del documento electrónico y el mensaje de datos.

Por último, cabe destacar la plena disposición de los iniciadores de este nuevo proyecto de Ley de Firma Electrónica para el Estado de Colima, donde se unificaron los criterios, teniendo como resultado el proyecto que se presenta ante el Pleno de esta Soberanía, con la oportunidad de que en un plazo no mayor de ciento ochenta días, se lleven a cabo las reformas a las normas secundaria donde impactará la ley que se propone.

Por lo anteriormente expuesto se expide el siguiente

D E C R E T O nº 556

ARTÍCULO ÚNICO.-

Se aprueba la Ley sobre el Uso de Medios Electrónicos y Firmas Electrónicas para el Estado de Colima, para quedar en los siguientes términos:

LEY SOBRE EL USO DE MEDIOS ELECTRÓNICOS Y FIRMA ELECTRÓNICA PARA EL ESTADO DE COLIMA

TÍTULO PRIMERO.- DISPOSICIONES GENERALES

CAPÍTULO UNICO

ARTÍCULO 1°

La presente Ley es de orden público e interés general y tiene por objeto regular en el Estado de Colima el uso de documentos electrónicos y sus efectos legales, los medios electrónicos, la utilización de la firma electrónica certificada en los documentos escritos o electrónicos expedidos por órganos del Gobierno del Estado; así como la utilización en ellos de firma electrónica certificada, su eficacia jurídica y la prestación de servicios de certificación, por los órganos de estado, las entidades dependientes o vinculadas al mismo, las relaciones que mantengan aquéllas y éstos entre sí o con los particulares.

Las actividades reguladas por esta ley se someterán a los principios de libertad de prestación de servicios, libre competencia, neutralidad tecnológica, compatibilidad internacional y equivalencia del soporte electrónico al soporte de papel.

Toda interpretación de los preceptos de esta ley deberá guardar armonía con los principios señalados.

ARTÍCULO 2°

Son sujetos de esta Ley:

I.- El Poder Ejecutivo, Legislativo y Judicial del Estado de Colima;

II.- Los Organismos Autónomos, dependencias y entidades de la Administración Pública Estatal;

III.- Los Ayuntamientos del Estado de Colima; y

IV.- Los particulares que decidan utilizar la firma electrónica certificada, por medios electrónicos, ante los órganos del Estado de Colima, en los términos de la presente Ley.

ARTÍCULO 3º

Para los efectos de esta ley se entenderá por:

I.- Autoridad certificadora.

Organismo público facultado para otorgar un certificado de firma electrónica certificada, o en su caso, autorizar la prestación de servicios de certificación, así como la prestación de otros servicios relacionados con la firma electrónica certificada.

II.- Certificación de un prestador de servicios de Certificación:

Es el procedimiento por el que la Autoridad Certificadora, emite una declaración facultando a una dependencia del sector público, para la prestación de servicios de certificación de firma electrónica certificada, que implica un reconocimiento del cumplimiento de requisitos específicos en la prestación de los servicios que se ofrecen al público.

III.- Certificado electrónico

Es un documento firmado electrónicamente por un prestador de servicios de certificación mediante el cual se vincula los datos de verificación de firma a un firmante y permite confirmar la identidad del mismo.

IV.- Datos de creación de firma electrónica certificada:

Son los datos únicos, como códigos o claves criptográficas privadas, que el firmante utiliza para crear la firma electrónica certificada.

V.- Datos de verificación de firma electrónica certificada:

Son los datos, como códigos o claves criptográficas públicas, que se utilizan para verificar la firma electrónica certificada.

VI.- Dispositivo de creación de firma electrónica certificada:

Es un programa o sistema informático que sirve para aplicar los datos de creación de firma electrónica certificada.

VII.- Dispositivo de verificación de firma electrónica certificada

Es un programa o sistema informático que sirve para aplicar los datos de verificación de firma electrónica certificada.

VIII.- Documento electrónico

El redactado en soporte electrónico que incorpore datos que esténfirmados electrónicamente.

IX.- Documento escrito

Documentos en papel expedidos por los órganos de estado, sus organismos autónomos, los Ayuntamientos, y las dependencias o entidades de la administración pública estatal o municipal.

X.- Fecha electrónica

El conjunto de datos en forma electrónica utilizados como medio para constatar el momento en que se ha efectuado una actuación sobre otros datos electrónicos a los que están asociados.

XI.- Firma electrónica certificada

Aquélla que ha sido certificada por la autoridad certificadora o el prestador de servicios de certificación facultado para ello, en los términos que señale esta Ley, consistente en el conjunto de datos electrónicos integrados o asociados inequívocamente a un mensaje de datos que permite asegurar la integridad y autenticidad de ésta y la identidad del firmante.

XII.- Firmante

Es la persona que posee un dispositivo de creación de firma y que actúa en nombre propio o en nombre de una persona física o jurídica a la que representa.

XIII.- Mensaje de Datos:

La información generada, enviada, recibida o archivada por medios electrónicos, ópticos o cualquier otra tecnología.

XIV.- Prestador de Servicios de Certificación

El organismo público que expide certificados electrónicos o presta otros servicios en relación con la firma electrónica.

XV.- Secretaría de Administración

La Secretaría de Administración del Poder Ejecutivo Estatal.

ARTÍCULO 4°

La firma electrónica certificada utilizada en documentos electrónicos o documentos escritos tendrá respecto de los datos consignados en forma electrónica el mismo valor que la firma manuscrita en relación con los consignados en papel; y no altera las normas relativas a la celebración, formalización, validez y eficacia de los contratos y cualesquiera otros actos jurídicos, ni las relativas a los documentos en que unos y otros consten.

Cuando la ley requiera o las partes acuerden la existencia de una firma electrónica certificada en relación con un mensaje de datos, se entenderá satisfecho dicho requerimiento si se utiliza una firma electrónica que resulte apropiada para los fines para los cuales se generó o comunicó ese Mensaje de Datos.

ARTÍCULO 5°

Cuando la ley exija la forma escrita para los actos, convenios o contratos, este supuesto se tendrá por cumplido tratándose de documentos electrónicos y mensajes de datos, siempre que la información en él contenida se mantenga íntegra y sea accesible para su ulterior consulta, sin importar el formato en el que se encuentre o represente.

Cuando adicionalmente la ley exija la firma autógrafa de las partes, dicho requisito se tendrá por cumplido tratándose de mensaje de datos y documentos electrónicos, siempre que en éste se utilice la firma electrónica certificada y sea atribuible a dichas partes.

ARTÍCULO 6°

El documento electrónico será soporte de:

I.- Documentos públicos, por estar firmados electrónicamente por funcionarios que tengan legalmente atribuida la facultad de dar fe pública, judicial, notarial o administrativa, siempre que actúen en el ámbito de sus competencias con los requisitos exigidos por la ley en cada caso;

II.- Documentos expedidos y firmados electrónicamente por funcionarios o empleados públicos en el ejercicio de sus funciones públicas, conforme a su legislación específica; y

III.- Documentos privados.

Los documentos electrónicos, tendrán el valor que corresponda a su respectiva naturaleza, de conformidad con la legislación que les resulte aplicable

ARTÍCULO 7°

Los actos y contratos otorgados o celebrados por personas naturales o jurídicas, públicas o privadas, suscritos por medio de firma electrónica, serán válidos de la misma manera y producirán los mismos efectos que los celebrados por escrito y en soporte de papel. Dichos actos y contratos se reputarán como escritos, en los casos en que la ley exija que los mismos consten por escrito, y en todos aquellos casos en que la ley prevea consecuencias jurídicas cuando constan por escrito cuando los mismos sean suscritos mediante firma electrónica certificada.

Lo dispuesto en el inciso anterior no será aplicable a los actos y contratos otorgados o celebrados en los casos siguientes:

a) Aquellos en que la ley exige una solemnidad que no sea susceptible de cumplirse mediante documento electrónico; y

b) Aquellos en que la ley requiera la concurrencia personal de alguna de las partes.

ARTÍCULO 8°

Si se impugnare la autenticidad de la firma electrónica certificada, con la que se hayan firmado los datos incorporados al documento electrónico, se procederá a comprobar por los prestadores de servicio de certificación que expide los certificados electrónicos, cumplen todos los requisitos establecidos en la ley en cuanto a la garantía de los servicios que presta en la comprobación de la eficacia de la firma electrónica certificada, y en especial, las obligaciones de garantizar la confidencialidad del proceso así como la autenticidad, conservación e integridad de la información generada y la identidad de los firmantes. Si se impugna la autenticidad de la firma electrónica certificada, con la que se hayan firmado los datos incorporados al documento electrónico, se estará a lo establecido en el Artículo 341 del Código de Procedimientos Civiles vigente para el Estado.

TÍTULO SEGUNDO.- USO DE FIRMAS ELECTRÓNICAS Y MEDIOS ELECTRÓNICOS POR LOS ORGANOS DEL ESTADO

CAPÍTULO UNICO

ARTÍCULO 9°

Las dependencias o entidades de los Poderes Ejecutivo, Legislativo y Judicial, organismos autónomos y ayuntamientos, podrán para hacer más accesibles, ágiles y sencillos los actos, convenios, comunicaciones, procedimientos administrativos, trámites, prestación de los servicios, contratos y expedición de cualquier documento, dentro de su ámbito de competencia, suscribirlos por medio de firma electrónica certificada.

Se exceptúan aquellas actuaciones para las cuales la Constitución Política de los Estados Unidos Mexicanos, la Constitución Política para el Estado de Colima o la ley, exijan una solemnidad que no sea susceptible de cumplirse mediante documento electrónico, o requiera la concurrencia personal de la autoridad o funcionario que deba intervenir en ellas.

ARTÍCULO 10

Las dependencias o entidades señaladas en el Artículo anterior, con el objeto de salvaguardar las garantías de cada procedimiento, podrán establecer condiciones adicionales a la utilización de la firma electrónica certificada en los procedimientos que ante ellos se desahoguen.

Dichas condiciones podrán incluir, entre otras, la imposición de fechas electrónicas sobre los documentos electrónicos integrados en un expediente administrativo y la conservación de la información generada en los procedimientos tratándose de medios y documentos electrónicos por los periodos de tiempo que para tal efecto establezcan los reglamentos respectivos.

Los órganos del Estado deberán evitar, al hacer uso de firmas electrónicas certificadas, restringir injustificadamente el acceso a las prestaciones que brinden y a la publicidad y transparencia que rijan sus actuaciones y, en general, que se cause discriminaciones arbitrarias.

ARTÍCULO 11

La certificación de las firmas electrónicas de los órganos de Estado, las entidades dependientes o vinculadas al mismo, y los particulares se realizará mediante la autoridad certificadora competente de acuerdo a lo establecido en el capítulo tercero de la ley y los reglamentos internos respectivos.

Dicha certificación deberá contener, además de las menciones que corresponda, la fecha y hora de la emisión del documento.

ARTÍCULO 12

Los órganos del Estado podrán contratar los servicios de certificación de firmas electrónicas con entidades certificadoras acreditadas, si ello resultare más conveniente, técnica o económicamente, en las condiciones que señale el respectivo reglamento.

ARTÍCULO 13

Los reglamentos aplicables a los correspondientes órganos del Estado regularán la forma cómo se garantizará la publicidad, seguridad, integridad y eficacia en el uso de las firmas electrónicas, y las demás necesarias para la aplicación de las normas de este Título.

Los órganos de Estado, deberán verificar la firma electrónica certificada, la vigencia del certificado de firma electrónica y, en su caso, la fecha electrónica, en los actos, convenios, comunicaciones, procedimientos administrativos, trámites y la prestación de los servicios públicos que correspondan a éstos; así como en las solicitudes y promociones que en relación con los mismos realicen los particulares.

ARTÍCULO 14

El uso de medios electrónicos a que se refiere esta Ley será optativo para los particulares.

Quienes opten por el uso de medios electrónicos en los actos, convenios, comunicaciones, procedimientos administrativos, trámites y la prestación de los servicios públicos que corresponden al Poder Ejecutivo, al Poder Legislativo, al Poder Judicial, a los Organismos Autónomos, a los Ayuntamientos y cualquier entidad o dependencia de la administración pública estatal o municipal, quedarán sujetos a las disposiciones de este ordenamiento.

ARTÍCULO 15

Para que surta efectos un mensaje de datos, se requiere de un acuse de recibo electrónico, entendiéndose como tal el generado por el sistema de información del destinatario.

Se considera que el mensaje de datos ha sido enviado y recibido, cuando se pruebe la existencia del acuse de recibo electrónico respectivo.

ARTÍCULO 16

El contenido de los mensajes de datos que contengan firma electrónica certificada, relativos a los actos, convenios, comunicaciones, procedimientos administrativos, trámites, prestación de los servicios públicos y las solicitudes y promociones que se realicen utilizando medios electrónicos, deberán conservarse en archivos electrónicos y hacerse constar íntegramente en forma impresa, integrando expediente, cuando así lo soliciten expresamente los interesados o lo determine la autoridad competente.

ARTÍCULO 17

Todo mensaje de datos se tendrá por expedido en el lugar donde el emisor tenga su domicilio legal y por recibido en el lugar donde el destinatario tenga el suyo, salvo prueba o acuerdo en contrario.

ARTÍCULO 18

Los documentos presentados por los particulares por medios electrónicos que contengan la firma electrónica certificada, producirán en términos de esta Ley, los mismos efectos que los documentos firmados de manera autógrafa.

Las autoridades podrán expedir documentos por medios electrónicos que contengan la firma electrónica certificada cuando reúnan los requisitos señalados en esta Ley.

ARTÍCULO 19

Se presumirá salvo prueba en contrario, que un mensaje de datos proviene de una persona determinada, cuando contenga su firma electrónica certificada.

ARTÍCULO 20

El momento de recepción de un mensaje de datos se determinará de la forma siguiente:

I.- Al ingresar en el sistema de información designado por el destinatario; y

II.- De no haber un sistema de información designado, en el momento en que el destinatario se manifieste sabedor de dicha información.

ARTÍCULO 21

Cuando los particulares realicen comunicaciones o soliciten la prestación de servicios públicos o promuevan cualquier trámite por medios electrónicos en hora o día inhábil, se tendrán por presentados en la primera hora hábil del siguiente día hábil.

Los documentos a que se refiere el párrafo anterior se tendrán por no presentados, cuando no contengan la firma electrónica certificada.

ARTÍCULO 22

Cuando las leyes requieran que una información o documento sea presentado y conservado en su forma original, se tendrá por satisfecho este requisito, respecto a un mensaje de datos, si existe garantía confiable de que se ha conservado la integridad de la información, a partir del momento en que se generó por primera vez en su forma definitiva, como mensaje de datos o en alguna otra forma, y de requerirse la presentación de la información, si la misma puede mostrarse a la persona a la que se deba presentar. Lo anterior sin perjuicio de lo dispuesto por el Artículo 9 párrafo segundo de esta Ley.

TITULO TERCERO.- DE LAS AUTORIDADES CERTIFICADORAS

CAPITULO UNICO

ARTÍCULO 23

Para los efectos de la presente Ley, serán autoridades certificadoras en su respectivo ámbito de competencia:

I.- El Poder Ejecutivo por conducto de la Secretaría de Administración;

II.- El Poder Legislativo;

III.- El Poder Judicial;

IV.- Los Organismos Autónomos; y

V.- Los Ayuntamientos.

ARTÍCULO 24

Las autoridades certificadoras tendrán las siguientes atribuciones:

I.- Otorgar a las personas físicas o morales, organismos públicos o privados certificados de firma electrónica y prestar servicios relacionados con la certificación;

II.- Facultar a los organismos públicos, para que expidan certificados de firma electrónica y a prestar servicios relacionados con la certificación;

III.- Llevar el registro de certificados de firma electrónica, así como los organismos públicos, autorizados para expedir certificados de firma electrónica;

IV.- Celebrar los convenios de colaboración entre sí, para la prestación de servicios de certificación, así como establecer los estándares tecnológicos y operativos de la infraestructura de la firma electrónica certificada y servicios electrónicos, aplicables en el ámbito de su competencia;

V.- Colaborar en el desarrollo de sistemas informáticos internos y externos para la prestación de servicios; y

VI.- Las demás que les otorgue esta Ley y su reglamento.

ARTÍCULO 25

Son prestadores de servicios de certificación los organismos públicos establecidos por la autoridad certificadora, para que otorguen certificados de firma electrónica, sin perjuicio de los demás servicios que puedan realizar.

La autorización para prestar servicios de certificación podrá ser solicitada por organismos públicos y será otorgada, por las autoridades certificadoras establecidas en el Artículo 23 de la presente ley.

La autorización deberá publicarse en el Periódico Oficial del Gobierno del Estado, previamente al inicio de la prestación de los servicios.

ARTÍCULO 26

El prestador de servicios de certificación, deberá informar al solicitante antes de la expedición del certificado de firma electrónica la siguiente información mínima, que deberá transmitirse de forma gratuita, por escrito o por vía electrónica:

I.- Las obligaciones del firmante, la forma en que han de custodiarse los datos de creación de firma electrónica certificada, el procedimiento que haya de seguirse para comunicar la pérdida o posible utilización indebida de dichos datos y determinados dispositivos de creación y de verificación de firma electrónica que sean compatibles con los datos de firma y con el certificado expedido;

II.- Los mecanismos para garantizar la fiabilidad de la firma electrónica de un documento a lo largo del tiempo;

III.- El método utilizado por el prestador de servicios de certificación para comprobar la identidad del firmante u otros datos que figuren en el certificado; y

IV.- Las condiciones precisas de utilización del certificado, sus posibles límites de uso y la forma en que el prestador garantiza su responsabilidad patrimonial.

El prestador de servicios de certificación deberá mantener un directorio actualizado de certificados en el que se indicarán los certificados expedidos y si están vigentes o si su vigencia ha sido suspendida o extinguida. La integridad del directorio se protegerá mediante la utilización de los mecanismos de seguridad adecuados.

Asimismo, deberá garantizar la disponibilidad de un servicio de consulta sobre la vigencia de los certificados rápido y seguro.

ARTÍCULO 27

Requisitos para la autorización de prestación de servicios de certificación con la expedición de certificados reconocidos.

Los prestadores de servicios de certificación que expidan certificados de firma electrónica deberán cumplir las siguientes obligaciones:

I.- Demostrar la fiabilidad necesaria para prestar servicios de certificación;

II.- Garantizar que pueda determinarse con precisión la fecha y la hora en las que se expidió un certificado o se extinguió o suspendió su vigencia;

III.- Emplear personal con la cualificación, conocimientos y experiencia necesarios para la prestación de los servicios de certificación ofrecidos y los procedimientos de seguridad y de gestión adecuados en el ámbito de la firma electrónica;

IV.- Utilizar sistemas y productos fiables que estén protegidos contra toda alteración y que garanticen la seguridad técnica y, en su caso, criptográfica de los procesos de certificación a los que sirven de soporte;

V.- Tomar medidas contra la falsificación de certificados y, en el caso de que el prestador de servicios de certificación genere datos de creación de firma, garantizar su confidencialidad durante el proceso de generación y su entrega por un procedimiento seguro al firmante;

VI.- Conservar registrada por cualquier medio seguro toda la información y documentación relativa a un certificado de firma electrónica y las declaraciones de prácticas de certificación vigentes en cada momento, al menos durante 5 años contados desde el momento de su expedición, de manera que puedan verificarse las firmas efectuadas con el mismo; y

VII.- Utilizar sistemas fiables para almacenar certificados reconocidos que permitan comprobar su autenticidad e impedir que personas no autorizadas alteren los datos, restrinjan su accesibilidad en los supuestos o a las personas que el firmante haya indicado y permitan detectar cualquier cambio que afecte a estas condiciones de seguridad.

Los prestadores de servicios de certificación que expidan certificados de firma electrónica deberán constituir un seguro de responsabilidad civil para afrontar el riesgo de la responsabilidad por los daños y perjuicios que pueda ocasionar el uso de los certificados que expidan.

ARTÍCULO 28

El prestador de servicios de certificación que vaya a cesar en su actividad deberá comunicarlo a los firmantes que utilicen los certificados electrónicos que haya expedido así como a los solicitantes de certificados expedidos a favor de personas jurídicas; y podrá transferir, con su consentimiento expreso, la gestión de los que sigan siendo válidos en la fecha en que el cese se produzca a otro prestador de servicios de certificación que los asuma o, en caso contrario, extinguir su vigencia. La citada comunicación se llevará a cabo con una antelación mínima de dos meses al cese efectivo de la actividad e informará, en su caso, sobre las características.

ARTÍCULO 29

Los prestadores de servicios de certificación serán responsables de los daños y perjuicios que en el ejercicio de su actividad ocasionen por la certificación u homologación de certificados de firmas electrónicas. En todo caso, corresponderá al prestador de servicios demostrar que actuó con la debida diligencia.

Sin perjuicio de lo dispuesto en el inciso anterior, los prestadores no serán responsables de los daños que tengan su origen en el uso indebido o fraudulento de un certificado de firma electrónica.

ARTÍCULO 30

El certificado de firma electrónica provisto por una entidad certificadora podrá establecer límites en cuanto a sus posibles usos, siempre y cuando los límites sean reconocibles por tercero. El proveedor de servicios de certificación quedará eximido de responsabilidad por los daños y perjuicios causados por el uso que exceda de los límites indicados en el certificado.

ARTÍCULO 31

El prestador de servicios de certificación no será responsable de los Daños y perjuicios ocasionados al firmante o terceros de buena fe, si el firmante incurre en alguno de los siguientes supuestos:

I.- No haber proporcionado al prestador de servicios de certificación información veraz, completa y exacta sobre los datos que deban constar en el certificado electrónico o que sean necesarios para su expedición o para la extinción o suspensión de su vigencia, cuando su inexactitud no haya podido ser detectada por el prestador de servicios de certificación;

II.- La falta de comunicación sin demora al prestador de servicios de certificación de cualquier modificación de las circunstancias reflejadas en el certificado electrónico;

III.- Negligencia en la conservación de sus datos de creación de firma, en el aseguramiento de su confidencialidad y en la protección de todo acceso o revelación;

IV.- No solicitar la suspensión o revocación del certificado electrónico en caso de duda en cuanto al mantenimiento de la confidencialidad de sus datos de creación de firma;

V.- Utilizar los datos de creación de firma cuando haya expirado el período de validez del certificado electrónico o el prestador de servicios de certificación le notifique la extinción o suspensión de su vigencia; y

VI.- Superar los límites que figuren en el certificado electrónico en cuanto a sus posibles usos y al importe individualizado de las transacciones que puedan realizarse con él o no utilizarlo conforme a las condiciones establecidas y comunicadas al firmante por el prestador de servicios de certificación.

En el caso de los certificados electrónicos que recojan un poder de representación del firmante, tanto éste como la persona o entidad representada, cuando ésta tenga conocimiento de la existencia del certificado, están obligados a solicitar la revocación o suspensión de la vigencia del certificado en los términos previstos en esta ley.

ARTÍCULO 32

El prestador de servicios de certificación tampoco será responsable por los daños y perjuicios ocasionados al firmante o a terceros de buena fe si el destinatario de los documentos firmados electrónicamente actúa de forma negligente. Se entenderá, en particular, que el destinatario actúa de forma negligente en los siguientes casos:

a) Cuando no compruebe y tenga en cuenta las restricciones que figuren en el certificado electrónico en cuanto a sus posibles usos y al importe individualizado de las transacciones que puedan realizarse con él; y

b) Cuando no tenga en cuenta la suspensión o pérdida de vigencia del certificado electrónico publicada en el servicio de consulta sobre la vigencia de los certificados o cuando no verifique la firma electrónica.

El prestador de servicios de certificación no será responsable de los daños y perjuicios ocasionados al firmante o terceros de buena fe por la inexactitud de los datos que consten en el certificado electrónico, si éstos le han sido acreditados mediante documento público. En caso de que dichos datos deban figurar inscritos en un registro público, el prestador de servicios de certificación deberá comprobarlos en el citado registro en el momento inmediato anterior a la expedición del certificado, pudiendo emplear, en su caso, medios telemáticos.

TITULO CUARTO.- DE LA ACREDITACION DE LOS PRESTADORES DE SERVICIOS DE CERTIFICACION DE FIRMA ELECTRONICA CERTIFICADA

CAPITULO UNICO

ARTÍCULO 3

La acreditación es el procedimiento en virtud del cual la autoridad certificadora autoriza a un organismo público como prestador de servicios de certificación verificando para ello que cuenta con las instalaciones, sistemas, programas informáticos y los recursos humanos necesarios para otorgar los certificados en los términos que se establecen en esta ley y los reglamentos respectivos, permitiendo su inscripción en el registro que se señala en el Artículo 27 de esta Ley.

Para ser acreditado, el prestador de servicios de certificación deberá cumplir, al menos, con las siguientes condiciones:

I.- Demostrar la fiabilidad necesaria de sus servicios, dispositivos de creación y certificación de firma electrónica;

II.- Garantizar la existencia de un servicio seguro de consulta del registro de certificados emitidos;

III.- Emplear personal calificado para la prestación de los servicios ofrecidos, en el ámbito de la firma electrónica y los procedimientos de seguridad y de gestión adecuados;

IV.- Utilizar sistemas y productos confiables que garanticen la seguridad de sus procesos de certificación;

V.- Haber contratado un seguro apropiado que respalde la responsabilidad en que pueda incurrir el prestador de servicios de certificación en los términos del Artículo 30 de la Ley; y

VI.- Contar con la capacidad tecnológica necesaria para el desarrollo de la actividad de certificación.

TITULO QUINTO.- DISPOSITIVOS DE CREACION Y VERIFICACIÓN DE FIRMA ELECTRÓNICA CERTIFICADA

CAPITULO UNICO

ARTÍCULO 34

Los dispositivos de creación de firma deben ofrecer, al menos, las siguientes garantías:

I.- Que los datos utilizados para la generación de firma puedan producirse sólo una vez y asegura razonablemente su secreto;

II.- Que exista una seguridad razonable de que los datos utilizados para la generación de firma no pueden ser derivados de los de verificación de firma o de la propia firma y de que la firma esté protegida contra la falsificación con la tecnología existente en cada momento;

III.- Que los datos de creación de firma puedan ser protegidos de forma fiable por el firmante contra su utilización por terceros; y

IV.- Que el dispositivo utilizado no altere los datos o el documento que deba firmarse ni impide que éste se muestre al firmante antes del proceso de firma.

ARTÍCULO 35

Los dispositivos de verificación de firma electrónica garantizarán, siempre que sea técnicamente posible, que el proceso de verificación de una firma electrónica satisfaga, al menos, los siguientes requisitos:

I.- Que los datos utilizados para verificar la firma correspondan a los datos mostrados a la persona que verifica la firma;

II.- Que la firma se verifique de forma fiable y el resultado de esa verificación se presente correctamente;

III.- Que la persona que verifica la firma electrónica pueda, en caso necesario, establecer de forma fiable el contenido de los datos firmados y detectar si han sido modificados;

IV.- Que se muestren correctamente tanto la identidad del firmante o, en su caso, conste claramente la utilización de un seudónimo, como el resultado de la verificación;

V.- Que se verifiquen de forma fiable la autenticidad y la validez del certificado electrónico correspondiente; y

VI.- Que pueda detectarse cualquier cambio relativo a su seguridad.

Asimismo, los datos referentes a la verificación de la firma, tales como el momento en que ésta se produce o una constatación de la validez del certificado electrónico en ese momento, podrán ser almacenados por la persona que verifica la firma electrónica o por terceros de confianza.

TITULO SEXTO.- DE LOS CERTIFICADOS DE FIRMA ELECTRÓNICA

CAPITULO UNICO

ARTÍCULO 36

Los certificados de firma electrónica tendrán valor probatorio pleno, salvo lo que dispongan al respecto otras leyes en la materia que ellas regulan y surtirán efectos jurídicos, cuando estén firmados electrónicamente por la autoridad certificadora.

ARTÍCULO 37

Los efectos del certificado de firma electrónica son los siguientes:

I.- Autentificar que la firma electrónica pertenece a determinada persona; y

II.- Verificar la vigencia de la firma electrónica.

ARTÍCULO 38

Los certificados de firma electrónica, deberán contener, al menos, las siguientes menciones:

I.- La expresión de que tienen esa naturaleza;

II.- El código único de identificación;

III.- Los datos de autorización de la autoridad certificadora que lo expide;

IV.- La firma electrónica certificada de la autoridad certificadora que lo expide;

V.- El nombre y apellidos del firmante. Se podrá consignar en el certificado de firma electrónica cualquier otra circunstancia personal del titular, en caso de que sea significativa en función del fin propio del certificado y siempre que aquél otorgue su consentimiento;

VI.- En los supuestos de representación, la indicación del documento que acredite las facultades del firmante para actuar en nombre de la persona a la que represente;

VII.- Los datos de verificación de firma electrónica certificada que correspondan a los datos de creación de firma que se encuentren bajo el control del firmante;

VIII.- El período de validez del certificado de firma electrónica;

IX.- En su caso, los límites de uso del certificado de firma electrónica; y

X.- La referencia de la tecnología empleada para la creación de la firma electrónica.

ARTÍCULO 39

Los certificados de firma electrónica quedarán sin efecto, en los siguientes casos:

I.- Expiración de su vigencia, que nunca será superior a dos años;

II.- Revocación por el firmante, su representante o autoridad competente;

III.- Pérdida, robo o inutilización por daños del soporte del certificado de firma electrónica;

IV.- Resolución judicial o administrativa;

VI.- Inexactitudes en los datos aportados por el firmante para la obtención del certificado de firma electrónica;

VII.- Por haberse comprobado que al momento de su expedición, el certificado de firma electrónica no cumplió con los requisitos establecidos en esta Ley, situación que no afectará los derechos de terceros de buena fe; y

VIII.- Cancelación o suspensión del certificado a solicitud del interesado.

ARTÍCULO 40

Cuando un servidor público deje de prestar sus servicios y cuente con un certificado de firma electrónica en virtud de sus funciones, el superior jerárquico ordenará la cancelación inmediata del mismo.

ARTÍCULO 41

La pérdida de eficacia de los certificados de firma electrónica, en el supuesto de expiración de vigencia, tendrá lugar desde que esta circunstancia se produzca. En los demás casos, la extinción de un certificado de firma electrónica surtirá efectos desde la fecha en que la autoridad certificadora competente, tenga conocimiento cierto de la causa que la origina y así lo haga constar en el registro de certificados.

ARTÍCULO 42

Las autoridades certificadoras podrán suspender temporalmente la eficacia de los certificados de firma electrónica expedidos, cuando así lo solicite el firmante o sus representados o lo ordene una autoridad competente.

Toda suspensión deberá inscribirse sin demora en el registro respectivo.

ARTÍCULO 43

Todo certificado de firma electrónica expedido fuera del Estado de Colima, producirá los mismos efectos jurídicos que un certificado de firma electrónica expedido dentro de su territorio, si presenta un grado de fiabilidad equivalente a los contemplados por esta Ley. Lo anterior sin perjuicio de la obligación de registrar el certificado que se homologa en términos de esta Ley, en el registro de certificados de firma electrónica, que al efecto lleve la autoridad certificadora correspondiente.

TITULO SEPTIMO.- DE LOS DERECHOS Y OBLIGACIONES DE LOS TITULARES DE CERTIFICADOS DE FIRMA ELECTRÓNICA

CAPITULO UNICO

ARTÍCULO 44

Sin perjuicio de lo establecido por otras leyes, los titulares de certificados de firma electrónica tendrán, respecto de las autoridades certificadoras, los siguientes derechos:

I.- Solicitar se les expida constancia de la existencia y registro del certificado;

II.- Solicitar la variación de los datos y elementos de la firma cuando así convenga a su interés;

III.- A ser informados sobre:

a) Las características generales de los procedimientos de certificación y creación de firma electrónica, y de las demás reglas que la autoridad certificadora se comprometa a seguir en la prestación de sus servicios; y

b) El costo de los servicios, las características y condiciones precisas para la utilización del certificado y sus límites de uso;

IV.- A que se guarde confidencialidad sobre la información proporcionada;

V.- A conocer el domicilio físico y la dirección electrónica de la autoridad certificadora para solicitar aclaraciones, presentar quejas o reportes; y

VI.- A cancelar o suspender su registro cuando así lo consideren conveniente.

ARTÍCULO 45

Son obligaciones de los titulares de certificados de firma electrónica:

I.- Proporcionar datos veraces, completos y exactos;

II.- Mantener el control exclusivo de sus datos de creación de firma electrónica, no compartirlos e impedir su divulgación;

III.- Solicitar la revocación de su certificado de firma electrónica cuando se presente cualquier circunstancia que pueda comprometer la privacidad de sus datos de creación de firma electrónica; y

IV.- Actualizar los datos contenidos en el certificado de firma electrónica.

TITULO OCTAVO.- PROTECCIÓN DE LOS DATOS PERSONALES

CAPITULO UNICO

ARTÍCULO 46

El tratamiento de los datos personales que precisen los prestadores de servicios de certificación para el desarrollo de su actividad y los órganos administrativos para el ejercicio de las funciones atribuidas por esta ley se sujetará a lo dispuesto en la Ley de Protección de Datos Personales del Estado de Colima.

Para la expedición de certificados electrónicos al público, los prestadores de servicios de certificación únicamente podrán recabar datos personales directamente de los firmantes o previo consentimiento expreso de éstos.

Los datos requeridos serán exclusivamente los necesarios para la expedición y el mantenimiento del certificado electrónico y la prestación de otros servicios en relación con la firma electrónica, no pudiendo tratarse con fines distintos sin el consentimiento expreso del firmante.

Los prestadores de servicios de certificación que consignen un seudónimo en el certificado electrónico a solicitud del firmante deberán constatar su verdadera identidad y conservar la documentación que la acredite.

Dichos prestadores de servicios de certificación estarán obligados a revelar la identidad de los firmantes cuando se encuentren en los supuestos previstos en el Artículo 6 de la Ley de Protección de Datos Personales del Estado de Colima.

TRANSITORIOS

PRIMERO

La presente Ley entrará en vigor a partir del día siguiente de su publicación en el Periódico Oficial “El Estado de Colima”.

SEGUNDO

La Legislatura local, actualizará las leyes relacionadas con la presente reforma en un plazo de 180 días a partir del día siguiente al de su entrada en vigor.

El Gobernador del Estado dispondrá se publique, circule y observe.

Dado en el Recinto Oficial del Poder Legislativo, a los veintisiete días del mes de mayo del año dos mil nueve.

MIRIAM YADIRA LARA ARTEAGA, DIPUTADA PRESIDENTA.

MARTÍN ALCARAZ PARRA, DIPUTADO SECRETARIO.

FERNANDO RAMÍREZ GONZÁLEZ, DIPUTADO SECRETARIO.

Por lo tanto mando se imprima, publique, circule y observe.

Dado en Palacio de Gobierno, al día 28 del mes de mayo del año dos mil nueve.

EL GOBERNADOR CONSTITUCIONAL DEL ESTADO, LIC. JESÚS SILVERIO CAVAZOS CEBALLOS.

LA SECRETARIA GENERAL DE GOBIERNO, LICDA. YOLANDA VERDUZCO GUZMÁN.

EL SECRETARIO DE ADMINISTRACIÓN, C.P. LUIS MARIO LEÓN LÓPEZ.

29Ago/18

Desafios da Liberdade de Expressão na Internet em Períodos Eleitorais

29 agosto, 2018seminariosDesafios da Liberdade de Expressão na Internet em Períodos EleitoraisJosé Cuervo

No próximo dia 31 de agosto, será realizado na sede do Tribunal Regional Eleitoral de Pernambuco o Seminário “Desafios da Liberdade de Expressão na Internet em Períodos Eleitorais”.

O evento contará com a presença de vários desembargadores e com a entrega do material Cartilha INTERNET, DEMOCRACIA E ELEIÇÕES – Guia prático para gestores públicos e usuários, produzida pelo Comitê Gestor da Internet do Brasil – CGI.br.

Confira a programação:

Seminário «Desafios da Liberdade de Expressão na Internet em Períodos Eleitorais”

Dia 31.08.18 (sexta-feira)

HORÁRIO

TEMA

PALESTRANTE

8:00

Entrega do material

Cartilha INTERNET, DEMOCRACIA E ELEIÇÕES – Guia prático para gestores públicos e usuários, produzida pelo Comitê Gestor da Internet do Brasil – CGI.br

8:30

Abertura:

Mesa de Abertura:

Des. Luiz Carlos de Barros Figueiredo,

Presidente do Tribunal Regional

Eleitoral de PE

Des. Manoel Erhardt, Presidente do TRF-5ª. Região

Des. Adalberto de Oliveira Melo, Presidente do TJPE

Des. Márcio Vidal, Presidente do TRE-MT e do COPTREL – Colégio dos Presidentes dos Tribunais Regionais do Brasil

Dr. Ronnie Preuss Duarte, Presidente da OAB/PE

Dr. Francisco Machado Teixeira, Procurador Regional Eleitoral

Delmiro Dantas Campos Neto, Diretor da Escola Eleitoral

Prof. Hartmut Glaser, Secretário Executivo do Comitê Gestor da Internet no Brasil – CGI.br

Des. Demócrito Reinaldo Filho, Pres. do IMN-Instituto dos Magistrados do Nordeste

8:45

(30 min. p/ palestra e 15 p/ perg.)

Palestra: Conceitos técnicos sobre o funcionamento da Internet: modelo de camadas, TCP/IP, sistema de nomes de domínio e a Web.

Presidente: Des. Agenor Ferreira Lima Filho

Palestrante: Antonio Moreiras, Engenheiro Senior do NIC.br

9:30

(30 min. p/ palestra e 15 p/ perg.)

Palestra: Desafios da liberdade de expressão em períodos eleitorais e as redes sociais: filtros bolha, algoritmos, bots e impulsionamento de conteúdos na esfera de debates da Internet

Presidente: Des. Itamar Pereira da Silva Júnior

Palestrante: Sérgio Amadeu, Prof da Univ. Federal do ABC e Conselheiro do CGI.br

10:15

Coffee Break

10:35

(35 min. p/ cada palestra e 15 p/ perg.)

Mesa redonda: Internet, Democracia e Eleições

Presidente: Gabriel de Oliveira Cavalcanti Filho, Desembargador Eleitoral

Integrantes:

Luiz Fernando Martins Castro, advogado em SP e Conselheiro do CGI.br

Diego Canabarro, Doutor em Ciências Políticas

Flávia Lefèvre Guimarães, Conselheira do CGI.br

12:30

Almoço

14:30

(30 min. p/ palestra e 10 p/ perg.)

Palestra: Propaganda eleitoral na Internet: aspectos legais e jurisprudenciais

Presidente: Érika de Barros Lima Ferraz, Desembargadora Eleitoral

Palestrante: Orson Lemos, Assessor da Corregedoria do TRE-PE

15:10

(30 min. p/ palestra e 10 p/ perg.)

Palestra: Segurança do voto eletrônico

Presidente: Des. Eleitoral Vladimir Souza Carvalho

Palestrante: George Maciel, Secretário de Tecnologia da Informação e Comunicação do TRE

15:50

Coffee Break

16:10

(20 min. p/ cada palestra e 15 p/ perg.)

Mesa redonda: Controle judicial das Fake News.

Presidente: Clicério Bezerra e Silva, Des. Eleitoral

Integrantes:

Júlio Alcino de Oliveira Neto, Desembargador Eleitoral

Alexandre Freire Pimentel, Juiz de Direito e Corregedor Regional Eleitoral

Karina Albuquerque Aragão de Amorim, Desembargadora Eleitoral Substituto

Paulo Roberto de Oliveira Lima,

Desembargador Eleitoral Substituto

Wellington Cabral Saraiva, Procurador Regional Eleitoral Substituto

18:00

Encerramento do 1º. dia

17Ago/18

Projeto de Lei da Câmara n° 53, de 2018

17 agosto, 2018Brasil, Proyecto de Leyde 2018 Dispõe sobre a proteção de dados pessoais e altera a Lei nº 12.965, de 23 de abril de 2014., Projeto de Lei da Câmara n° 53José Cuervo

Projeto de Lei da Câmara n° 53, de 2018 Dispõe sobre a proteção de dados pessoais e altera a Lei nº 12.965, de 23 de abril de 2014.

O CONGRESSO NACIONAL decreta:

CAPÍTULO I.- DISPOSIÇÕES PRELIMINARES

Artigo 1º.- Esta Lei dispõe sobre o tratamento de dados pessoais, inclusive nos meios digitais, por pessoa natural ou por pessoa jurídica de direito público ou privado, com o objetivo de proteger os direitos fundamentais de liberdade e de privacidade e o livre desenvolvimento da personalidade da pessoa natural.

Artigo 2º.- A disciplina da proteção de dados pessoais tem como fundamentos:

I.- o respeito à privacidade;

II.- a autodeterminação informativa;

III.- a liberdade de expressão, de informação, de comunicação e de opinião;

IV.- a inviolabilidade da intimidade, da honra e da imagem;

V.- o desenvolvimento econômico e tecnológico e a inovação;

VI.- a livre iniciativa, a livre concorrência e a defesa do consumidor; e

VII.- os direitos humanos e o livre desenvolvimento da personalidade, dignidade e exercício da cidadania pelas pessoas naturais.

Artigo 3º.- Esta Lei aplica-se a qualquer operação de tratamento realizada por pessoa natural ou por pessoa jurídica de direito público ou privado, independentemente do meio, do país de sua sede ou do país onde estejam localizados os dados, desde que:

I.- a operação de tratamento seja realizada no território nacional, salvo o tratamento previsto no inciso IV do caput do Artigo 4º desta Lei;

II.- a atividade de tratamento tenha por objetivo a oferta ou o fornecimento de bens ou serviços ou o tratamento de dados de indivíduos localizados no território nacional; ou

III.- os dados pessoais objeto do tratamento tenham sido coletados no território nacional.
Parágrafo único.- Consideram-se coletados no território nacional os dados pessoais cujo titular nele se encontre no momento da coleta.

Artigo 4º Esta Lei não se aplica ao tratamento de dados pessoais:

I.- realizado por pessoa natural para fins exclusivamente pessoais;

II.- realizado para fins exclusivamente:

a) jornalísticos e artísticos; ou

b) acadêmicos, aplicando-se a esta hipótese os arts. 7º e 11 desta Lei;

III.- realizado para fins exclusivos de segurança pública, de defesa nacional, de segurança do Estado ou de atividades de investigação e repressão de infrações penais; ou

IV.- provenientes de fora do território nacional e que não sejam objeto de comunicação, uso compartilhado de dados com agentes de tratamento brasileiros ou objeto de transferência internacional de dados com outro país que não o de proveniência, desde que o país de proveniência proporcione grau de proteção de dados pessoais adequado ao previsto nesta Lei.

§ 1º O tratamento de dados pessoais previsto no inciso III será regido por legislação específica, que deverá prever medidas proporcionais e estritamente necessárias ao atendimento do interesse público, observados o devido processo legal, os princípios gerais de proteção e os direitos do titular previstos nesta Lei.

§ 2º É vedado o tratamento dos dados a que se refere o inciso III do caput deste artigo por pessoa de direito privado, exceto em procedimentos sob tutela de pessoa jurídica de direito público, que serão objeto de informe específico ao órgão competente e que deverão observar a limitação imposta no § 4º deste artigo.

§ 3º Órgão competente emitirá opiniões técnicas ou recomendações referentes às exceções previstas no inciso III do caput deste artigo e deverá solicitar aos responsáveis relatórios de impacto à proteção de dados pessoais.

§ 4º Em nenhum caso a totalidade dos dados pessoais de banco de dados de que trata o inciso III do caput deste artigo poderá ser tratada por pessoa de direito privado.

Artigo 5º.- Para os fins desta Lei, considera-se:

I.- dado pessoal: informação relacionada à pessoa natural identificada ou identificável;

II.- dados sensíveis: dados pessoais sobre a origem racial ou étnica, as convicções religiosas, as opiniões políticas, a filiação a sindicatos ou a organizações de caráter religioso, filosófico ou político, dados referentes à saúde ou à vida sexual, dados genéticos ou biométricos, quando vinculados a uma pessoa natural;

III.- dados anonimizados: dados pessoais relativos a um titular que não possa ser identificado, considerando a utilização de meios técnicos razoáveis e disponíveis na ocasião de seu tratamento;

IV.- banco de dados: conjunto estruturado de dados pessoais, localizado em um ou em vários locais, em suporte eletrônico ou físico;

V.- titular: a pessoa natural a quem se referem os dados pessoais que são objeto de tratamento;

VI.- responsável: a pessoa natural ou jurídica, de direito público ou privado, a quem competem as decisões referentes ao tratamento de dados pessoais;

VII.- operador: a pessoa natural ou jurídica, de direito público ou privado, que realiza o tratamento de dados pessoais em nome do responsável;

VIII.- encarregado: pessoa natural, indicada pelo responsável, que atua como canal de comunicação entre o responsável e os titulares e o órgão competente;

IX.- agentes do tratamento: o responsável e o operador;

X.- tratamento: toda operação realizada com dados pessoais, como as que se referem a coleta, produção, recepção, classificação, utilização, acesso, reprodução, transmissão, distribuição, processamento, arquivamento, armazenamento, eliminação, avaliação ou controle da informação, modificação, comunicação, transferência, difusão ou extração;

XI.- anonimização: utilização de meios técnicos razoáveis e disponíveis no momento do tratamento, por meio dos quais um dado perde a possibilidade de associação, direta ou indireta, a um indivíduo;

XII.- consentimento: manifestação livre, informada e inequívoca pela qual o titular concorda com o tratamento de seus dados pessoais para uma finalidade determinada;

XIII.- bloqueio: guarda do dado pessoal ou do banco de dados com a suspensão temporária de qualquer operação de tratamento;

XIV.- eliminação: exclusão de dado ou de conjunto de dados armazenados em banco de dados, independentemente do procedimento empregado;

XV.- transferência internacional de dados: transferência de dados pessoais para um país estrangeiro ou organização internacional da qual o país seja membro;

XVI.- uso compartilhado de dados: a comunicação, a difusão, a transferência internacional, a interconexão de dados pessoais ou o tratamento compartilhado de bancos de dados pessoais por órgãos e entidades públicos, no cumprimento de suas competências legais, ou entre estes e entes privados, reciprocamente, com autorização específica, para uma ou mais modalidades de tratamento permitidas por esses entes públicos, ou entre entes privados;

XVII.- relatório de impacto à proteção de dados pessoais: documentação do responsável que contém a descrição dos processos de tratamento de dados pessoais que podem gerar riscos às liberdades civis e aos direitos fundamentais, bem como medidas, salvaguardas e mecanismos de mitigação de risco;

XVIII.- órgão de pesquisa: órgão ou entidade da administração pública direta ou indireta ou pessoa jurídica de direito privado sem fins lucrativos legalmente constituída sob as leis brasileiras, com sede e foro no País, que inclua em sua missão institucional ou em seu objetivo social ou estatutário a pesquisa básica ou aplicada de caráter histórico, científico, tecnológico ou estatístico;

XIX.- órgão competente: órgão da administração pública indireta responsável por zelar, implementar e fiscalizar o cumprimento desta Lei.

Artigo 6º.- As atividades de tratamento de dados pessoais deverão observar a boa-fé e os seguintes princípios:

I.- finalidade: realização do tratamento para propósitos legítimos, específicos, explícitos e informados ao titular, sem possibilidade de tratamento posterior de forma incompatível com essas finalidades;

II.- adequação: compatibilidade do tratamento com as finalidades informadas ao titular, de acordo com o contexto do tratamento;

III.- necessidade: limitação do tratamento ao mínimo necessário para a realização das suas finalidades, com abrangência dos dados pertinentes, proporcionais e não excessivos em relação às finalidades do tratamento de dados;

IV.- livre acesso: garantia aos titulares de consulta facilitada e gratuita sobre a forma e a duração do tratamento, bem como sobre a integralidade dos seus dados pessoais;

V.- qualidade dos dados: garantia aos titulares de exatidão, clareza, relevância e atualização dos dados, de acordo com a necessidade e para o cumprimento da finalidade de seu tratamento;

VI.- transparência: garantia aos titulares de informações claras, precisas e facilmente acessíveis sobre a realização do tratamento e os respectivos agentes de tratamento, observados os segredos comercial e industrial;

VII.- segurança: utilização de medidas técnicas e administrativas aptas a proteger os dados pessoais de acessos não autorizados e de situações acidentais ou ilícitas de destruição, perda, alteração, comunicação ou difusão;

VIII.- prevenção: adoção de medidas para prevenir a ocorrência de danos em virtude do tratamento de dados pessoais;

IX.- não discriminação: impossibilidade de realização do tratamento para fins discriminatórios ilícitos ou abusivos; e

X.- responsabilização e prestação de contas: demonstração pelo agente da adoção de medidas eficazes e capazes de comprovar a observância e o cumprimento das normas de proteção de dados pessoais, inclusive da eficácia das medidas.

CAPÍTULO II.- DOS REQUISITOS PARA O TRATAMENTO DE DADOS PESSOAIS

SEÇÃO I.- DOS REQUISITOS PARA O TRATAMENTO

Artigo 7º.- O tratamento de dados pessoais somente poderá ser realizado nas seguintes hipóteses:

I.- mediante o fornecimento de consentimento pelo titular;

II.- para o cumprimento de obrigação legal ou regulatória pelo responsável;

III.- pela administração pública, para o tratamento e uso compartilhado de dados necessários à execução de políticas públicas previstas em leis, regulamentos ou respaldadas em contratos, convênios ou instrumentos congêneres, observadas as disposições do Capítulo IV desta Lei;

IV.- para a realização de estudos por órgão de pesquisa, garantida, sempre que possível, a anonimização dos dados pessoais;

V.- quando necessário para a execução de contrato ou de procedimentos preliminares relacionados a contrato do qual é parte o titular, a pedido do titular dos dados;

VI.- para o exercício regular de direitos em processo judicial, administrativo ou arbitral, nos termos da Lei nº 9.307, de 23 de setembro de 1996;

VII.- para a proteção da vida ou da incolumidade física do titular ou de terceiro;

VIII.- para a tutela da saúde, com procedimento realizado por profissionais da área da saúde ou por entidades sanitárias;

IX.- quando necessário para atender aos interesses legítimos do responsável ou de terceiro, exceto no caso de prevalecerem direitos e liberdades fundamentais do titular que exijam a proteção dos dados pessoais; ou

X.- para a proteção do crédito de acordo com o Artigo 43 da Lei no 8.078, de 11 de setembro de 1990 (Código de Defesa do Consumidor).

§ 1º Nos casos de aplicação do disposto nos incisos II e III do caput deste artigo e excetuadas as hipóteses previstas no Artigo 4º desta Lei, o titular será informado das hipóteses em que será admitido o tratamento de seus dados.

§ 2º A forma de disponibilização das informações previstas no § 1º e no inciso I do caput do Artigo 23 desta Lei poderá ser especificada pelo órgão competente.

§ 3º O tratamento de dados pessoais cujo acesso é público deve considerar a finalidade, a boa-fé e o interesse público que justificaram a sua disponibilização.

§ 4º Fica dispensada a exigência do consentimento previsto no caput deste artigo para os dados tornados manifestamente públicos pelo titular, resguardados os direitos do titular e os princípios previstos nesta Lei.

§ 5º O responsável que obteve o consentimento referido no inciso I do caput deste artigo que necessitar comunicar ou compartilhar dados pessoais com outros responsáveis deverá obter consentimento específico do titular para esse fim, ressalvadas as hipóteses de dispensa do consentimento previstas nesta Lei.

§ 6º A eventual dispensa da exigência do consentimento não desobriga os agentes do tratamento das demais obrigações previstas nesta Lei, especialmente da observância dos princípios gerais e da garantia dos direitos do titular.

Artigo 8º.- O consentimento previsto no inciso I do Artigo 7º desta Lei, deverá ser fornecido por escrito ou por outro meio que demonstre a manifestação de vontade do titular.

§ 1º Caso o consentimento seja fornecido por escrito, este deverá constar de cláusula destacada das demais cláusulas contratuais.

§ 2º Cabe ao responsável o ônus da prova de que o consentimento foi obtido em conformidade com o disposto nesta Lei. §

3º É vedado o tratamento de dados pessoais mediante vício de consentimento.

§ 4º O consentimento deverá referir-se a finalidades determinadas e serão nulas as autorizações genéricas para o tratamento de dados pessoais.

§ 5º O consentimento pode ser revogado a qualquer momento, mediante manifestação expressa do titular, por procedimento gratuito e facilitado, ratificados os tratamentos realizados sob o amparo do consentimento anteriormente manifestado enquanto não houver requerimento de eliminação, nos termos do inciso VI do caput do Artigo 18 desta Lei. § 6º Em caso de alteração de informação referida nos incisos I, II, III ou V do Artigo 9º desta Lei, o responsável deverá informar ao titular, com destaque de forma específica do teor das alterações, podendo o titular, nos casos em que o seu consentimento é exigido, revogá-lo caso discorde da alteração.

Artigo 9º.- O titular tem direito ao acesso facilitado às informações sobre o tratamento de seus dados, que deverão ser disponibilizadas de forma clara, adequada e ostensiva, acerca de, entre outras características previstas em regulamentação para o atendimento do princípio do livre acesso:

I.- finalidade específica do tratamento;

II.- forma e duração do tratamento, observados os segredos comercial e industrial;

III.- identificação do responsável;

IV.- informações de contato do responsável;

V.- informações acerca do uso compartilhado de dados pelo responsável e a finalidade;

VI.- responsabilidades dos agentes que realizarão o tratamento; e

VII.- direitos do titular, com menção explícita aos direitos contidos no Artigo 18 desta Lei.

§ 1º Na hipótese em que o consentimento é requerido, este será considerado nulo caso as informações fornecidas ao titular tenham conteúdo enganoso ou abusivo ou não tenham sido apresentadas previamente com transparência, de forma clara e inequívoca.

§ 2º Na hipótese em que o consentimento é requerido, se houver mudanças da finalidade para o tratamento de dados pessoais não compatível com o consentimento original, o responsável deverá informar previamente o titular sobre as mudanças de finalidade, podendo o titular revogar o consentimento, caso discorde das alterações.

§ 3º Quando o tratamento de dados pessoais for condição para o fornecimento de produto ou de serviço ou para o exercício de direito, o titular será informado com destaque sobre esse fato e sobre os meios pelos quais poderá exercer os direitos do titular elencados no Artigo 18 desta Lei.

Artigo 10.- O legítimo interesse do responsável somente poderá fundamentar tratamento de dados pessoais para finalidades legítimas, consideradas a partir de situações concretas, que incluem:

I.- o apoio e a promoção de atividades do responsável; e

II.- em relação ao titular, a proteção do exercício regular de seus direitos ou a prestação de serviços que o beneficiem, respeitadas as legítimas expectativas dele e os direitos e liberdades fundamentais, nos termos desta Lei.

§ 1º Quando o tratamento for baseado no legítimo interesse do responsável, somente os dados pessoais estritamente necessários para a finalidade pretendida poderão ser tratados.

§ 2º O responsável deverá adotar medidas para garantir a transparência do tratamento de dados baseado no seu legítimo interesse.

§ 3º O órgão competente poderá solicitar ao responsável relatório de impacto à proteção de dados pessoais, quando o tratamento tiver como fundamento o seu interesse legítimo, observados os segredos comercial e industrial.

Seção II.- Dos Dados Sensíveis

Artigo 11.- É vedado o tratamento de dados pessoais sensíveis, exceto:

I.- com fornecimento de consentimento específico e em destaque, pelo titular, para finalidades específicas;

II.- sem fornecimento de consentimento do titular, nas hipóteses em que for indispensável para:

a) cumprimento de obrigação legal pelo responsável;

b) tratamento e uso compartilhado de dados necessários à execução, pela administração pública, de políticas públicas previstas em leis ou regulamentos;

c) realização de estudos por órgão de pesquisa, garantida, sempre que possível, a anonimização dos dados pessoais sensíveis;

d) exercício regular de direitos, inclusive em contrato, processo judicial, administrativo ou arbitral, nos termos da Lei nº 9.307, de 23 de setembro de 1996;

e) proteção da vida ou da incolumidade física do titular ou de terceiro;

f) tutela da saúde, com procedimento realizado por profissionais da área da saúde ou por entidades sanitárias; ou

g) garantia da prevenção à fraude e à segurança do titular, nos processos de identificação e autenticação de cadastro em sistemas eletrônicos, resguardados os direitos mencionados no Artigo 9º desta Lei e exceto no caso de prevalecerem direitos e liberdades fundamentais do titular que exijam a proteção dos dados pessoais.

§ 1º Aplica-se o disposto neste artigo a qualquer tratamento de dados pessoais que revele dados pessoais sensíveis e que possa causar dano ao titular, ressalvado o disposto em legislação específica.

§ 2º Nos casos de aplicação do disposto nas alíneas a e b do inciso II do caput deste artigo pelos órgãos e pelas entidades públicas, será dada publicidade à referida dispensa de consentimento, nos termos do inciso I do caput do Artigo 23 desta Lei.

§ 3º A comunicação ou o uso compartilhado de dados sensíveis entre responsáveis com o objetivo de obter vantagem econômica poderá ser objeto de vedação ou de regulamentação por parte do órgão competente, ouvidos os órgãos setoriais do poder público, no âmbito de suas competências.

§ 4º É vedada a comunicação ou o uso compartilhado entre responsáveis de dados sensíveis referentes à saúde com o objetivo de obter vantagem econômica, exceto nos casos de portabilidade de dados quando consentido pelo titular.

Artigo 12.- Os dados anonimizados serão considerados dados pessoais, para os fins desta Lei, quando o processo de anonimização ao qual foram submetidos for revertido, utilizando exclusivamente meios próprios, ou quando, com esforços razoáveis, puder ser revertido.

§ 1º A determinação do que seja razoável deve levar em consideração fatores objetivos, tais como custo e tempo necessário para reverter o processo de anonimização, de acordo com as tecnologias disponíveis, e a utilização exclusiva de meios próprios.

§ 2º Poderão ser igualmente considerados como dados pessoais, para os fins desta Lei, aqueles utilizados para a formação do perfil comportamental de uma determinada pessoa natural, se identificada.

§ 3º O órgão competente poderá dispor sobre padrões e técnicas utilizadas em processos de anonimização e realizar verificações acerca de sua segurança, ouvido o Conselho Nacional de Proteção de Dados Pessoais.

Artigo 13.- Na realização de estudos em saúde pública, os órgãos de pesquisa poderão ter acesso a bases de dados pessoais, que serão tratados exclusivamente dentro do órgão e estritamente para a finalidade de realização de estudos e pesquisas e mantidos em ambiente controlado e seguro, conforme práticas de segurança previstas em regulamento específico e que incluam, sempre que possível, a anonimização ou pseudomização dos dados, bem como considerem os devidos padrões éticos relacionados a estudos e pesquisas.

§ 1º A divulgação dos resultados ou de qualquer excerto do estudo ou pesquisa de que trata o caput deste artigo em nenhuma hipótese poderá revelar dados pessoais.

§ 2º O órgão de pesquisa será o responsável pela segurança da informação prevista no caput deste artigo, não permitida, em qualquer circunstância, a transferência dos dados a terceiros.

§ 3º O acesso aos dados de que trata este artigo será objeto de regulamentação por parte do órgão competente e das autoridades da área de saúde e sanitárias, no âmbito de suas competências.

§ 4º Para os efeitos deste artigo, a pseudonimização é o tratamento por meio do qual um dado perde a possibilidade de associação, direta ou indireta, a um indivíduo, senão pelo uso de informação adicional mantida separadamente pelo responsável em ambiente controlado e seguro.

Seção III.- Das Crianças e dos Adolescentes

Artigo 14.- O tratamento de dados pessoais de crianças e de adolescentes deverá ser realizado no seu melhor interesse, nos termos deste artigo e da legislação pertinente.

§ 1º O tratamento de dados pessoais de crianças deverá ser realizado com o consentimento específico e em destaque dado por pelo menos um dos pais ou responsável legal.

§ 2º Os responsáveis pelo tratamento de dados de que trata o § 1º deste artigo deverão manter pública informação sobre os tipos de dados coletados, a forma de sua utilização e os procedimentos para o exercício dos direitos a que se refere o Artigo 18 desta Lei.

§ 3º Poderão ser coletados dados pessoais de crianças sem o consentimento a que se refere o § 1º deste artigo quando a coleta for necessária para contatar os pais ou responsável legal, utilizados uma única vez e sem armazenamento, ou para sua proteção, e em nenhum caso poderão ser repassados a terceiros sem o consentimento de que trata o § 1º deste artigo.

§ 4º Os responsáveis por tratamento de dados não devem condicionar a participação dos titulares de que trata o § 1º deste artigo a jogos, aplicações de internet ou outras atividades para o fornecimento de informações pessoais além das estritamente necessárias à atividade.

§ 5º O responsável deve realizar todos os esforços razoáveis para verificar que o consentimento a que se refere o § 1º deste artigo foi dado pelo responsável pela criança, consideradas as tecnologias disponíveis.

§ 6º As informações sobre o tratamento de dados referidas no § 3º deste artigo deverão ser fornecidas de maneira simples, clara e acessível, consideradas as características físico-motoras, perceptivas, sensoriais, intelectuais e mentais do usuário, com uso de recursos audiovisuais quando adequado, de forma a proporcionar a informação necessária aos pais ou responsável legal e adequada ao entendimento da criança.

Seção IV.- Do Término do Tratamento

Artigo 15.- O término do tratamento de dados pessoais ocorrerá nas seguintes hipóteses:

I.- verificação de que a finalidade foi alcançada ou de que os dados deixaram de ser necessários ou pertinentes ao alcance da finalidade específica almejada;

II.- fim do período de tratamento;

III.- comunicação do titular, inclusive no exercício do seu direito de revogação do consentimento conforme disposto no § 5º do Artigo 8º desta Lei, resguardado o interesse público; ou

IV.- determinação do órgão competente, quando houver violação da legislação em vigor.

Artigo 16.- Os dados pessoais serão eliminados após o término de seu tratamento, no âmbito e nos limites técnicos das atividades, autorizada a conservação para as seguintes finalidades:

I.- cumprimento de obrigação legal do responsável;

II.- estudos por órgão de pesquisa, garantida, sempre que possível, a anonimização dos dados pessoais;

III.- transferência a terceiros, desde que respeitados os requisitos de tratamento de dados dispostos nesta Lei; ou

IV.- uso exclusivo do responsável, vedado o seu acesso por terceiros, e desde que anonimizados os dados.

CAPÍTULO III.- DOS DIREITOS DO TITULAR

Artigo 17.- Toda pessoa natural tem assegurada a titularidade de seus dados pessoais, garantidos os direitos fundamentais de liberdade, de intimidade e de privacidade, nos termos desta Lei.

Artigo 18.- O titular dos dados pessoais tem direito a obter do responsável, em relação aos dados do titular por ele tratados, a qualquer momento e mediante requisição:

I.- confirmação da existência de tratamento;

II.- acesso aos dados;

III.- correção de dados incompletos, inexatos ou desatualizados;

IV.- anonimização, bloqueio ou eliminação de dados desnecessários, excessivos ou tratados em desconformidade com o disposto nesta Lei;

V.- portabilidade dos dados pessoais a outro fornecedor de serviço ou produto, mediante requisição expressa e observados os segredos comercial e industrial, de acordo com a regulamentação do órgão responsável;

VI.- eliminação dos dados pessoais tratados com o consentimento do titular, exceto nas hipóteses previstas no Artigo 16 desta Lei;

VII.- informação das entidades públicas e privadas com as quais o responsável realizou uso compartilhado de dados;

VIII.- informação sobre a possibilidade de não fornecer o consentimento e sobre as consequências da negativa;

IX.- revogação do consentimento nos termos do § 5º do Artigo 8º desta Lei.

§ 1º O titular dos dados pessoais tem o direito de peticionar em relação aos seus dados contra o responsável perante o órgão competente e os organismos de defesa do consumidor.

§ 2º O titular pode opor-se a tratamento realizado com fundamento em uma das hipóteses de dispensa de consentimento, em caso de descumprimento ao disposto nesta Lei.

§ 3º Os direitos previstos neste artigo serão exercidos mediante requerimento expresso do titular ou representantes legalmente constituídos, a um dos agentes de tratamento.

§ 4º Em caso de impossibilidade de adoção imediata da providência de que trata o § 3º deste artigo, o responsável enviará ao titular resposta em que poderá:

I.- comunicar que não é agente de tratamento dos dados e indicar, sempre que possível, o agente; ou

II.- indicar as razões de fato ou de direito que impedem a adoção imediata da providência.

§ 5º O requerimento de que trata o § 3º deste artigo será atendido sem custos para o titular nos prazos e termos previstos na regulamentação.

§ 6º O responsável deverá informar de maneira imediata aos agentes de tratamento com os quais tenha realizado uso compartilhado de dados a correção, a eliminação, a anonimização ou o bloqueio dos dados, para que repitam idêntico procedimento.

§ 7º A portabilidade dos dados pessoais a que se refere o inciso V do caput deste artigo não inclui dados que já tenham sido anonimizados pelo responsável.

Artigo 19.- A confirmação de existência ou o acesso a dados pessoais serão providenciados, mediante requisição do titular:

I.- em formato simplificado, imediatamente; ou

II.- por meio de declaração clara e completa, que indique a origem dos dados, a inexistência de registro, os critérios utilizados e a finalidade do tratamento, observados os segredos comercial e industrial, fornecida no prazo de até 15 (quinze) dias, contado da data do requerimento do titular.

§ 1º Os dados pessoais serão armazenados em formato que favoreça o exercício do direito de acesso.

§ 2º As informações e os dados poderão ser fornecidos, a critério do titular:

I.- por meio eletrônico, seguro e idôneo para esse fim; ou

II.- sob forma impressa.

§ 3º Quando o tratamento tiver origem no consentimento do titular ou em contrato, o titular poderá solicitar cópia eletrônica integral dos seus dados pessoais, observado os segredos comercial e industrial, nos termos da regulamentação do órgão competente, em formato que permita a sua utilização subsequente, inclusive em outras operações de tratamento.

§ 4º O órgão competente poderá dispor de forma diferenciada acerca dos prazos previstos nos incisos I e II do caput deste artigo para os setores específicos.

Artigo 20.- O titular dos dados tem direito a solicitar revisão, por pessoa natural, de decisões tomadas unicamente com base em tratamento automatizado de dados pessoais que afetem seus interesses, inclusive as decisões destinadas a definir o seu perfil pessoal, profissional, de consumo, de crédito ou os aspectos de sua personalidade.

§ 1º O responsável deverá fornecer, sempre que solicitadas, informações claras e adequadas a respeito dos critérios e dos procedimentos utilizados para a decisão automatizada, observados os segredos comercial e industrial.

§ 2º Em caso de não oferecimento de informações de que trata o § 1º deste artigo baseado na observância de segredo comercial e industrial, o órgão competente poderá realizar auditoria para verificação de aspectos discriminatórios em tratamento automatizados de dados pessoais.

Artigo 21.- Os dados pessoais referentes ao exercício regular de direitos pelo titular não podem ser utilizados em seu prejuízo.

Artigo 22.- A defesa dos interesses e dos direitos dos titulares de dados poderá ser exercida em juízo, individual ou coletivamente, na forma do disposto na Lei nº 9.507, de 12 de novembro de 1997, nos arts. 81 e 82 da Lei nº 8.078, de 11 de setembro de 1990 (Código de Defesa do Consumidor), na Lei nº 7.347, de 24 de julho de 1985, e nos demais instrumentos de tutela individual e coletiva.

CAPITULO IV.- DO TRATAMENTO DE DADOS PESSOAIS PELO PODER PÚBLICO

Seção I.- Das Regras de Tratamento de Dados pelo Poder Público

Artigo 23.- O tratamento de dados pessoais pelas pessoas jurídicas de direito público referidas no parágrafo único do Artigo 1º da Lei nº 12.527, de 18 de novembro de 2011, deverá ser realizado para o atendimento de sua finalidade pública, na persecução de um interesse público, com o objetivo de executar as competências legais ou cumprir as atribuições legais do serviço público, desde que:

I.- sejam informadas as hipóteses em que, no exercício de suas competências, realizam o tratamento de dados pessoais, fornecendo informações claras e atualizadas sobre a previsão legal, a finalidade, os procedimentos e as práticas utilizadas para a execução dessas atividades em veículos de fácil acesso, preferencialmente em seus sítios eletrônicos;

II.- sejam protegidos e preservados dados pessoais de requerentes de acesso à informação, no âmbito da Lei nº 12.527, de 18 de novembro de 2011, vedado seu compartilhamento no âmbito do poder público e com pessoas jurídicas de direito privado; e

III.- seja indicado um encarregado quando realizarem operações de tratamento de dados pessoais, nos termos do Artigo 39 desta Lei.

§ 1º O órgão competente poderá dispor sobre as formas de publicidade das operações de tratamento.

§ 2º O disposto nesta Lei não dispensa as pessoas jurídicas mencionadas no caput deste artigo de instituir as autoridades de que trata a Lei nº 12.527, de 18 de novembro de 2011.

§ 3º Os prazos e procedimentos para exercício dos direitos do titular perante o poder público observarão o disposto em legislação específica, em especial as disposições constantes da Lei nº 9.507, de 12 de novembro de 1997, da Lei nº 9.784, de 29 de janeiro de 1999, e da Lei nº 12.527, de 18 de novembro de 2011.

§ 4º Os serviços notariais de registro exercidos em caráter privado, por delegação do poder público, terão o mesmo tratamento dispensado às pessoas jurídicas de que trata o caput deste artigo, nos termos desta Lei.

§ 5º Os serviços notariais de registro devem fornecer acesso aos dados por meio eletrônico para a administração pública, tendo em vista as finalidades de que trata o caput deste artigo.

Artigo 24.- As empresas públicas e as sociedades de economia mista que atuem em regime de concorrência, sujeitas ao disposto no Artigo 173 da Constituição Federal, terão o mesmo tratamento dispensado às pessoas jurídicas de direito privado particulares, nos termos desta Lei.

Parágrafo único. As empresas públicas e as sociedades de economia mista, quando estiverem operacionalizando políticas públicas e no âmbito da execução delas, terão o mesmo tratamento dispensado aos órgãos e às entidades do poder público, nos termos deste Capítulo.

Artigo 25.- Os dados deverão ser mantidos em formato interoperável e estruturado para o uso compartilhado com vistas à execução de políticas públicas, à prestação de serviços públicos, à descentralização da atividade pública, à disseminação e ao acesso das informações pelo público em geral.

Artigo 26.- O uso compartilhado de dados pessoais pelo poder público deve atender a finalidades específicas de execução de políticas públicas e atribuição legal pelos órgãos e pelas entidades públicas, respeitados os princípios de proteção de dados pessoais elencados no Artigo 6º desta Lei.

§ 1º É vedado ao poder público transferir a entidades privadas dados pessoais constantes de bases de dados a que tenha acesso, exceto:

I.- em casos de execução descentralizada de atividade pública que exija a transferência, exclusivamente para esse fim específico e determinado, observado o disposto na Lei nº 12.527, de 18 de novembro de 2011;

II.- quando houver previsão legal e a transferência for respaldada em contratos, convênios ou instrumentos congêneres;

III.- nos casos em que os dados forem acessíveis publicamente, observadas as disposições desta Lei.

§ 2º Os contratos e convênios de que trata o § 1º deste artigo deverão ser comunicados ao órgão competente.

Artigo 27.- A comunicação ou o uso compartilhado de dados pessoais de pessoa jurídica de direito público a pessoa de direito privado será informado ao órgão competente e dependerá de consentimento do titular, exceto:

I.- nas hipóteses de dispensa do consentimento previstas nesta Lei;

II.- nos casos de uso compartilhado de dados, em que será dada publicidade nos termos do inciso I do caput do Artigo 23 desta Lei; ou

III.- nas exceções constantes do § 1º do Artigo 26 desta Lei.

Artigo 28.- A comunicação ou o uso compartilhado de dados pessoais entre órgãos e entidades de direito público será objeto de publicidade, nos termos do inciso I do caput do Artigo 23 desta Lei.

Artigo 29.- O órgão competente poderá solicitar, a qualquer momento, às entidades do poder público a realização de operações de tratamento de dados pessoais, informe específico sobre o âmbito, natureza dos dados e demais detalhes do tratamento realizado, e poderá emitir parecer técnico complementar para garantir o cumprimento desta Lei.

Artigo 30.- O órgão competente poderá estabelecer normas complementares para as atividades de comunicação ou o uso compartilhado de dados pessoais.

Seção II.- Da Responsabilidade

Artigo 31.- Quando houver infração a esta Lei em decorrência do tratamento de dados pessoais por órgãos públicos, o órgão competente poderá enviar informe com medidas cabíveis para fazer cessar a violação.

Artigo 32.- O órgão competente poderá solicitar a agentes do poder público a publicação de relatórios de impacto à proteção de dados pessoais e poderá sugerir a adoção de padrões e boas práticas aos tratamentos de dados pessoais pelo poder público.

CAPÍTULO V.- DA TRANSFERÊNCIA INTERNACIONAL DE DADOS

Artigo 33.- A transferência internacional de dados pessoais somente é permitida nos seguintes casos:

I.- para países ou organizações internacionais que proporcionem grau de proteção de dados pessoais adequado ao previsto nesta Lei;

II.- quando o responsável oferecer e comprovar garantias de cumprimento dos princípios, dos direitos do titular e do regime de proteção de dados previstos nesta lei, na forma de:

a) cláusulas contratuais específicas para uma determinada transferência;

b) cláusulas-padrão contratuais;

c) normas corporativas globais;

d) selos, certificados e códigos de conduta regularmente emitidos;

III.- quando a transferência for necessária para a cooperação jurídica internacional entre órgãos públicos de inteligência, de investigação e de persecução, de acordo com os instrumentos de direito internacional;

IV.- quando a transferência for necessária para a proteção da vida ou da incolumidade física do titular ou de terceiro;

V.- quando o órgão competente autorizar a transferência;

VI.- quando a transferência resultar em compromisso assumido em acordo de cooperação internacional;

VII.- quando a transferência for necessária para execução de política pública ou atribuição legal do serviço público, sendo dada publicidade nos termos do inciso I do caput do Artigo 23 desta Lei;

VIII.- quando o titular tiver fornecido o seu consentimento específico e em destaque para a transferência, com informação prévia sobre o caráter internacional da operação, distinguindo claramente esta de outras finalidades; ou

IX.- quando necessário para atender as hipóteses previstas nos incisos II, V e VI do Artigo 7º desta Lei.

Parágrafo único.- Para os fins do inciso I do Artigo 33 desta Lei, as pessoas jurídicas de direito público referidas no parágrafo único do Artigo 1º da Lei 12.527, de 18 de novembro de 2011, no âmbito de suas competências legais, e responsáveis, no âmbito de suas atividades, poderão requerer ao órgão competente a avaliação do nível de proteção a dados pessoais conferido por país ou organização internacional.

Artigo 34.- O nível de proteção de dados do país estrangeiro ou da organização internacional mencionado no inciso I do caput do Artigo 33 desta Lei será avaliado pelo órgão competente, que levará em consideração:

I.- as normas gerais e setoriais da legislação em vigor no país de destino ou na organização internacional;

II.- a natureza dos dados;

III.- a observância dos princípios gerais de proteção de dados pessoais e direitos dos titulares previstos nesta Lei;

IV.- a adoção de medidas de segurança previstas em regulamento;

V.- a existência de garantias judiciais e institucionais para o respeito aos direitos de proteção de dados pessoais; e

VI.- as outras circunstâncias específicas relativas à transferência.

Artigo 35.- A definição do conteúdo de cláusulas-padrão contratuais, bem como a verificação de cláusulas contratuais específicas para uma determinada transferência, normas corporativas globais ou selos, certificados e códigos de conduta, a que se refere o inciso II do caput do Artigo 33 desta Lei, será realizada pelo órgão competente.

§ 1º Para a verificação do disposto no caput deste artigo, deverão ser considerados os requisitos, as condições e as garantias mínimas para a transferência que observem os direitos, as garantias e os princípios desta Lei.

§ 2º Na análise de cláusulas contratuais, de documentos ou de normas corporativas globais submetidas à aprovação do órgão competente, poderão ser requeridas informações suplementares ou realizadas diligências de verificação quanto às operações de tratamento, quando necessário.

§ 3º O órgão competente poderá designar organismos de certificação para a realização do previsto no caput deste artigo, que permanecerão sob sua fiscalização nos termos definidos em regulamento.

§ 4º Os atos realizados por organismo de certificação poderão ser revistos pelo órgão competente e, caso em desconformidade com esta Lei, submetidos à revisão ou anulados.

§ 5º As garantias suficientes de observância dos princípios gerais de proteção e dos direitos do titular referidas no caput deste artigo serão também analisadas de acordo com as medidas técnicas e organizacionais adotadas pelo operador, de acordo com o previsto nos §§ 1º e 2º do Artigo 46 desta Lei.

Artigo 36.- As alterações nas garantias apresentadas como suficientes de observância dos princípios gerais de proteção e dos direitos do titular referidas no inciso II do Artigo 33 desta Lei deverão ser comunicadas ao órgão competente.

CAPÍTULO VI.- DOS AGENTES DO TRATAMENTO DE DADOS PESSOAIS

Seção I.- Do Responsável e do Operador

Artigo 37.- O responsável e o operador devem manter registro das operações de tratamento de dados pessoais que realizarem, especialmente quando baseado no legítimo interesse.

Artigo 38.- O órgão competente poderá determinar ao responsável que elabore relatório de impacto à proteção de dados pessoais, inclusive de dados sensíveis, referente às suas operações de tratamento de dados, nos termos do regulamento, observados os segredos comercial e industrial.

Parágrafo único.- Observado o disposto no caput deste artigo, o relatório deverá conter, no mínimo, a descrição dos tipos de dados coletados, a metodologia utilizada para sua coleta e para a garantia da segurança das informações, bem como a análise do responsável com relação às medidas, salvaguardas e mecanismos de mitigação de risco adotados.

Artigo 39.- O operador deverá realizar o tratamento segundo as instruções fornecidas pelo responsável, que verificará a observância das próprias instruções e das normas sobre a matéria.

Artigo 40.- O órgão competente poderá dispor sobre padrões de interoperabilidade para fins de portabilidade, livre acesso aos dados e segurança, assim como sobre o tempo de guarda dos registros, tendo em vista especialmente a necessidade e a transparência.

Seção II.- Do Encarregado pelo Tratamento de Dados Pessoais

Artigo 41.- O responsável deverá indicar um encarregado pelo tratamento de dados pessoais.

§ 1º A identidade e as informações de contato do encarregado deverão ser divulgadas publicamente, de forma clara e objetiva, preferencialmente no sítio eletrônico do responsável.

§ 2º As atividades do encarregado consistem em:

I.- aceitar reclamações e comunicações dos titulares, prestar esclarecimentos e adotar providências;

II.- receber comunicações do órgão competente e adotar providências;

III.- orientar os funcionários e os contratados da entidade a respeito das práticas a serem tomadas em relação à proteção de dados pessoais; e

IV.- executar as demais atribuições determinadas pelo responsável ou estabelecidas em normas complementares.

§ 3º O órgão competente poderá estabelecer normas complementares sobre a definição e as atribuições do encarregado, inclusive hipóteses de dispensa da necessidade de sua indicação, conforme a natureza e o porte da entidade ou o volume de operações de tratamento de dados.

Seção III.- Da Responsabilidade e do Ressarcimento de Danos

Artigo 42.- O responsável ou o operador que, em razão do exercício de atividade de tratamento de dados pessoais, causar a outrem dano patrimonial, moral, individual ou coletivo, em violação à legislação de proteção de dados pessoais, é obrigado a repará-lo.

§ 1º A fim de assegurar a efetiva indenização ao titular dos dados:

I.- o operador responde solidariamente pelos danos causados pelo tratamento quando descumprir as obrigações da legislação de proteção de dados ou quando não tiver seguido as instruções lícitas do responsável, hipótese em que o operador equipara-se a responsável, salvo nos casos de exclusão previstos no Artigo 43 desta Lei;

II.- os responsáveis que estiverem diretamente envolvidos no tratamento do qual decorreram danos ao titular dos dados respondem solidariamente, salvo nos casos de exclusão previstos no Artigo 43 desta Lei.

§ 2º O juiz, no processo civil, poderá inverter o ônus da prova a favor do titular dos dados quando, a seu juízo, for verossímil a alegação, houver hipossuficiência para fins de produção de prova ou quando a produção de prova pelo titular resultar-lhe excessivamente onerosa.

§ 3º As ações de reparação por danos coletivos que tenham por objeto a responsabilização nos termos do caput deste artigo podem ser exercidas coletivamente em juízo, observado o disposto no Título III da Lei nº 8.078, de 11 de setembro de 1990 (Código de Defesa do Consumidor).

§ 4º Aquele que reparar o dano ao titular tem direito de regresso contra os demais responsáveis, na medida de sua participação no evento danoso.

Artigo 43.- Os agentes de tratamento só não serão responsabilizados quando provarem:

I.- que não realizaram o tratamento de dados pessoais que lhes é atribuído;

II.- que, embora tenham realizado o tratamento de dados pessoais que lhes é atribuído, não houve violação à legislação de proteção de dados;

III.- que o dano é decorrente de culpa exclusiva do titular dos dados ou de terceiro.

Artigo 44.- O tratamento de dados pessoais será irregular quando deixar de observar a legislação ou quando não fornecer a segurança que o titular dele pode esperar, consideradas as circunstâncias relevantes, entre as quais:

I.- o modo pelo qual é realizado;

II.- o resultado e os riscos que razoavelmente dele se esperam;

III.- as técnicas de tratamento de dados pessoais disponíveis à época em que foi realizado. Parágrafo único. Responde pelos danos decorrentes da violação da segurança dos dados o responsável ou o operador que, ao deixar de adotar as medidas de segurança previstas no Artigo 46 desta Lei, der causa ao dano.

Artigo 45.- As hipóteses de violação ao direito do titular no âmbito das relações de consumo permanecem sujeitas às regras de responsabilidade previstas na Lei nº 8.078, de 11 de setembro de 1990 (Código de Defesa do Consumidor), observado o inciso III do Artigo 4º da referida Lei.

CAPÍTULO VII.- DA SEGURANÇA E DAS BOAS PRÁTICAS

Seção I.- Da Segurança e do Sigilo de Dados

Artigo 46.- Os agentes de tratamento devem adotar medidas de segurança, técnicas e administrativas aptas a proteger os dados pessoais de acessos não autorizados e de situações acidentais ou ilícitas de destruição, perda, alteração, comunicação ou qualquer forma de tratamento inadequado ou ilícito.

§ 1º O órgão competente poderá dispor sobre padrões técnicos mínimos para tornar aplicável o disposto no caput deste artigo, considerados a natureza das informações tratadas, as características específicas do tratamento e o estado atual da tecnologia, especialmente no caso de dados sensíveis, assim como os princípios previstos no caput do Artigo 6º desta Lei.

§ 2º As medidas de que trata o caput deste artigo deverão ser observadas desde a fase de concepção do produto ou do serviço até a sua execução.

Artigo 47.- Os agentes de tratamento ou qualquer outra pessoa que intervenha em uma das fases do tratamento obriga-se a garantir a segurança da informação prevista nesta Lei em relação aos dados pessoais, mesmo após o seu término.

Artigo 48.- O responsável deverá comunicar ao órgão competente e ao titular a ocorrência de incidente de segurança que possa acarretar risco ou dano relevante aos titulares.

§ 1º A comunicação será feita em prazo razoável, conforme definido pelo órgão competente, e deverá mencionar, no mínimo:

I.- a descrição da natureza dos dados pessoais afetados;

II.- as informações sobre os titulares envolvidos;

III.- a indicação das medidas técnicas e de segurança utilizadas para a proteção dos dados, observados os segredos comercial e industrial;

IV.- os riscos relacionados ao incidente;

V.- os motivos da demora, no caso de a comunicação não ter sido imediata; e

VI.- as medidas que foram ou que serão adotadas para reverter ou mitigar os efeitos do prejuízo.

§ 2º O órgão competente verificará a gravidade do incidente e poderá, caso necessário para a salvaguarda dos direitos dos titulares, determinar ao responsável a adoção de providências, tais como: I – ampla divulgação do fato em meios de comunicação; e II – medidas para reverter ou mitigar os efeitos do incidente. § 3º No juízo de gravidade do incidente, será avaliada eventual comprovação de que foram adotadas medidas técnicas adequadas que tornem os dados pessoais afetados ininteligíveis, no âmbito e nos limites técnicos de seus serviços, para terceiros não autorizados a acessá-los. Artigo 49. Os sistemas utilizados para o tratamento de dados pessoais devem ser estruturados de forma a atender aos requisitos de segurança, aos padrões de boas práticas e de governança, aos princípios gerais previstos nesta Lei e às demais normas regulamentares.

Seção II.- Das Boas Práticas e da Governança

Artigo 50.- Os responsáveis e operadores, no âmbito de suas competências, pelo tratamento de dados pessoais, individualmente ou por meio de associações, poderão formular regras de boas práticas e de governança que estabeleçam as condições de organização, o regime de funcionamento, os procedimentos, incluindo reclamações e petições de titulares, as normas de segurança, os padrões técnicos, as obrigações específicas para os diversos envolvidos no tratamento, as ações educativas, os mecanismos internos de supervisão e de mitigação de riscos e outros aspectos relacionados ao tratamento de dados pessoais.

§ 1º Ao estabelecer regras de boas práticas, o responsável pelo tratamento e o operador levarão em consideração, em relação ao tratamento e aos dados, a natureza, o escopo, a finalidade e a probabilidade e a gravidade dos riscos e dos benefícios decorrentes de tratamento de dados de titular.

§ 2º Na aplicação dos princípios indicados nos incisos VII e VIII do caput do Artigo 6º desta Lei, o responsável observados a estrutura, a escala e o volume de suas operações, bem como a sensibilidade dos dados tratados, a probabilidade e a gravidade dos danos para os titulares dos dados, poderá:

I.- implementar programa de governança em privacidade que, no mínimo:

a) demonstre o comprometimento do responsável em adotar processos e políticas internas que assegurem o cumprimento, de forma abrangente, de normas e boas práticas relativas à proteção de dados pessoais;

b) seja aplicável a todo o conjunto de dados pessoais que estejam sob seu controle, independentemente do modo em que se realizou sua coleta;

c) seja adaptado à estrutura, à escala e ao volume de suas operações, bem como à sensibilidade dos dados tratados;

d) estabeleça políticas e salvaguardas adequadas com base em processo de avaliação sistemática de impactos e riscos à privacidade;

e) tenha o objetivo de estabelecer relação de confiança com o titular, por meio de atuação transparente e que assegure mecanismos de participação do titular;

f) esteja integrado à sua estrutura geral de governança e estabeleça e aplique mecanismos de supervisão internos e externos;

g) conte com planos de resposta a incidentes e remediação; e

h) seja atualizado constantemente com base em informações obtidas a partir de monitoramento contínuo e avaliações periódicas;

II.- demonstrar a efetividade de seu programa de governança em privacidade quando apropriado, e, em especial, a pedido do órgão competente ou de outra entidade responsável por promover o cumprimento de boas práticas ou códigos de conduta, os quais, de forma independente, promovam o cumprimento desta Lei. § 3º As regras de boas práticas e de governança deverão ser publicadas e atualizadas periodicamente e poderão ser reconhecidas e divulgadas pelo órgão competente.

Artigo 51.- O órgão competente estimulará a adoção de padrões técnicos que facilitem o controle pelos titulares dosseus dados pessoais.

CAPÍTULO VIII.- DA FISCALIZAÇÃO

Seção I.- Das Sanções Administrativas

Artigo 52.- Os agentes de tratamento de dados, em razão das infrações cometidas às normas previstas nesta Lei, ficam sujeitos às seguintes sanções administrativas aplicáveis pelo órgão competente:

I.- advertência, com indicação de prazo para adoção de medidas corretivas;

II.- multa simples ou diária, de até 2% (dois por cento) do faturamento da pessoa jurídica de direito privado, grupo ou conglomerado no Brasil no seu último exercício, excluídos os tributos, limitada, no total, a R$ 50.000.000,00 (cinquenta milhões de reais) por infração;

III.- publicização da infração após devidamente apurada e confirmada a sua ocorrência;

IV.- bloqueio de dados pessoais a que se refere a infração até a sua regularização;

V.- eliminação dos dados pessoais a que se refere a infração;

VI.- suspensão parcial ou total de funcionamento de banco de dados a que se refere a infração pelo período máximo de 6 (seis) meses, prorrogável por igual período até a regularização da atividade de tratamento pelo responsável;

VII.- suspensão do exercício de atividade de tratamento de dados pessoais a que se refere a infração pelo período máximo de 6 (seis) meses, prorrogáveis por igual período; e

VIII.- proibição parcial ou total do exercício de atividades relacionadas a tratamento de dados.

§ 1º As sanções serão aplicadas após procedimento administrativo que possibilite a oportunidade da ampla defesa, de forma gradativa, isolada ou cumulativa, de acordo com as peculiaridades do caso concreto e considerados os seguintes parâmetros e critérios:

I.- a gravidade e a natureza das infrações e dos direitos pessoais afetados;

II.- a boa-fé do infrator;

III.- a vantagem auferida ou pretendida pelo infrator;

IV.- a condição econômica do infrator;

V.- a reincidência;

VI.- o grau do dano;

VII.- a cooperação do infrator;

VIII.- a adoção reiterada e demonstrada de mecanismos e procedimentos internos capazes de minimizar o dano, voltados ao tratamento seguro e adequado de dados, em consonância com o disposto no inciso II do § 2º do Artigo 48 desta Lei.

IX.- a adoção de política de boas práticas e governança;

X.- a pronta adoção de medidas corretivas; e

XI.- a proporcionalidade entre a gravidade da falta e a intensidade da sanção.

§ 2º O disposto neste artigo não substitui a aplicação de sanções administrativas, civis ou penais definidas em legislação específica.

§ 3º O disposto nos incisos I, III, IV, V, VI, VII e VIII do caput deste artigo poderá ser aplicado às entidades e aos órgãos públicos, sem prejuízo do disposto nas Leis nºs 8.112, de 11 de dezembro de 1990, 8.429, de 2 de junho de 1992, e 12.527, de 18 de novembro de 2011.

§ 4º No cálculo do valor da multa de que trata o inciso II do caput deste artigo, o órgão competente poderá considerar o faturamento total da empresa ou grupo de empresas, quando não dispuser do valor do faturamento no ramo de atividade empresarial em que ocorreu a infração, definido pelo órgão competente, ou quando o valor for apresentado de forma incompleta ou não for demonstrado de forma inequívoca e idônea.

Artigo 53.- O órgão competente definirá, por meio de regulamento próprio sobre sanções administrativas a infrações a esta Lei que deverá ser objeto de consulta pública, as metodologias que orientarão o cálculo do valor-base das sanções de multa.

§ 1º As metodologias a que se refere o caput deste artigo devem ser previamente publicadas, para ciência dos agentes de tratamento, e devem apresentar objetivamente as formas e dosimetrias para o cálculo do valor-base das sanções de multa, que deverão conter fundamentação detalhada de todos os seus elementos, demonstrando a observância dos critérios previstos nesta Lei.

§ 2º O regulamento de sanções e metodologias correspondentes deve estabelecer as circunstâncias e as condições para a adoção de multa simples ou diária.

Artigo 54.- O valor da sanção de multa diária aplicável às infrações a esta Lei deve observar a gravidade da falta e a extensão do dano ou prejuízo causado e ser fundamentado pelo órgão competente. Parágrafo único. A intimação da sanção de multa diária deverá conter, no mínimo, a descrição da obrigação imposta, o prazo razoável e estipulado pelo órgão para o seu cumprimento e o valor da multa diária a ser aplicada pelo seu descumprimento.

CAPÍTULO IX.- DA AUTORIDADE NACIONAL DE PROTEÇÃO DE DADOS E DO CONSELHO NACIONAL DE PROTEÇÃO DE DADOS PESSOAIS E DA PRIVACIDADE

Seção I.- Da Autoridade Nacional de Proteção de Dados

Artigo 55.- Fica criado o órgão competente, Autoridade Nacional de Proteção de Dados, integrante da administração pública federal indireta, submetido a regime autárquico especial e vinculado ao Ministério da Justiça.

§ 1º A Autoridade deverá ser regida nos termos previstos na Lei nº 9.986, de 18 de julho de 2000.

§ 2º A Autoridade será composta pelo Conselho Diretor, como órgão máximo, e pelo Conselho Nacional de Proteção de Dados Pessoais e da Privacidade, além das unidades especializadas para a aplicação desta Lei.

§ 3º A natureza de autarquia especial conferida à Autoridade é caracterizada por independência administrativa, ausência de subordinação hierárquica, mandato fixo e estabilidade de seus dirigentes e autonomia financeira.

§ 4º O regulamento e a estrutura organizacional da Autoridade serão aprovados por decreto do Presidente da República.

§ 5º O Conselho Diretor será composto por 3 (três) conselheiros e decidirá por maioria.

§ 6º O mandato dos membros do Conselho Diretor será de 4 (quatro) anos.

§ 7º Os mandatos dos primeiros membros do Conselho Diretor serão de 3 (três), 4 (quatro), 5 (cinco) anos, a serem estabelecidos no decreto de nomeação.

§ 8º É vedado ao ex-conselheiro utilizar informações privilegiadas obtidas em decorrência do cargo exercido, sob pena de incorrer em improbidade administrativa.

Artigo 56.- A Autoridade Nacional de Proteção de Dados terá as seguintes atribuições:

I.- zelar pela proteção dos dados pessoais, nos termos da legislação;

II.- zelar pela observância dos segredos comercial e industrial em ponderação com a proteção de dados pessoais e do sigilo das informações quando protegido por lei ou quando a quebra do sigilo violar os fundamentos do Artigo 2º desta Lei;

III.- elaborar diretrizes para Política Nacional de Proteção de Dados Pessoais e da Privacidade;

IV.- fiscalizar e aplicar sanções em caso de tratamento de dados realizado em descumprimento à legislação, mediante processo administrativo que assegure o contraditório, a ampla defesa e o direito de recurso;

V.- atender petições de titular contra responsável;

VI.- promover na população o conhecimento das normas e das políticas públicas sobre proteção de dados pessoais e das medidas de segurança;

VII.- promover estudos sobre as práticas nacionais e internacionais de proteção de dados pessoais e privacidade;

VIII.- estimular a adoção de padrões para serviços e produtos que facilitem o exercício de controle dos titulares sobre seus dados pessoais, que deverão levar em consideração especificidades das atividades e o porte dos responsáveis;

IX.- promover ações de cooperação com autoridades de proteção de dados pessoais de outros países, de natureza internacional ou transnacional;

X.- dispor sobre as formas de publicidade das operações de tratamento de dados pessoais, observado o respeito aos segredos comercial e industrial;

XI.- solicitar, a qualquer momento, às entidades do poder público que realizem operações de tratamento de dados pessoais, informe específico sobre o âmbito, a natureza dos dados e os demais detalhes do tratamento realizado, podendo emitir parecer técnico complementar para garantir o cumprimento desta Lei;

XII.- elaborar relatórios de gestão anuais acerca de suas atividades;

XIII.- editar regulamentos e procedimentos sobre proteção de dados pessoais e privacidade, assim como sobre relatórios de impacto à proteção de dados pessoais para os casos em que o tratamento representar alto risco para a garantia dos princípios gerais de proteção de dados pessoais previstos nesta Lei;

XIV.- ouvir os agentes de tratamento e a sociedade em matérias de interesse relevante, assim como prestar contas sobre suas atividades e planejamento;

XV.- arrecadar e aplicar suas receitas e publicar no relatório de gestão a que se refere o inciso XII do caput deste artigo o detalhamento de suas receitas e despesas; e

XVI – realizar ou determinar a realização de auditorias, no âmbito da atividade de fiscalização, sobre o tratamento de dados pessoais efetuado pelos agentes de tratamento, incluindo o poder público.

§ 1º Ao impor condicionamentos administrativos ao tratamento de dados pessoais por agente de tratamento privado, sejam eles limites, encargos ou sujeições, a Autoridade deve observar a exigência de mínima intervenção, assegurados os fundamentos, os princípios e os direitos dos titulares previstos no Artigo 170 da Constituição Federal e nesta Lei.

§ 2º Os regulamentos e normas editados pela Autoridade devem necessariamente ser precedidos de consulta e audiência públicas, bem como de análises de impacto regulatório.

Artigo 57.- Constituem receitas da Autoridade Nacional de Proteção de Dados:

I.- o produto da execução da sua dívida ativa;

II.- as dotações consignadas no orçamento geral da União, os créditos especiais, os créditos adicionais, as transferências e os repasses que lhe forem conferidos;

III.- as doações, legados, subvenções e outros recursos que lhe forem destinados;

IV.- os valores apurados na venda ou aluguel de bens móveis e imóveis de sua propriedade;

V.- os valores apurados em aplicações no mercado financeiro das receitas previstas neste artigo;

VI .- o produto da cobrança de emolumentos por serviços prestados;

VII.- os recursos provenientes de acordos, convênios ou contratos celebrados com entidades, organismos ou empresas, públicos ou privados, nacionais e internacionais;

VIII.- o produto da venda de publicações, material técnico, dados e informações, inclusive para fins de licitação pública.

Seção II.- Do Conselho Nacional de Proteção de Dados Pessoais e da Privacidade

Artigo 58.- O Conselho Nacional de Proteção de Dados Pessoais e da Privacidade será composto por 23 (vinte e três) representantes titulares, e seus suplentes, dos seguintes órgãos:

I.- 6 (seis) representantes do Poder Executivo federal;

II.- 1 (um) representante indicado pelo Senado Federal;

III.- 1 (um) representante indicado pela Câmara dos Deputados;

IV.- 1 (um) representante indicado pelo Conselho Nacional de Justiça;

V.- 1 (um) representante indicado pelo Conselho Nacional do Ministério Público;

VI.- 1 (um) representante indicado pelo Comitê Gestor da Internet no Brasil;

VII .- 4 (quatro) representantes da sociedade civil com atuação comprovada em proteção de dados pessoais;

VIII.- 4 (quatro) representantes de instituição científica, tecnológica e de inovação; e

IX.- 4 (quatro) representantes de entidade representativa do setor empresarial afeto à área de tratamento de dados pessoais.

§ 1º Os representantes serão designados por ato do Presidente da República, permitida a delegação, e terão mandato de 2 (dois) anos, permitida 1 (uma) recondução.

§ 2º A participação no Conselho Nacional de Proteção de Dados Pessoais e da Privacidade será considerada atividade de relevante interesse público, não remunerada.

§ 3º Os representantes referidos nos incisos I, II, III e VI do caput deste artigo e seus suplentes serão indicados pelos titulares dos respectivos órgãos e entidades.

§ 4º Os representantes referidos nos incisos VII, VIII e IX do caput deste artigo e seus suplentes serão indicados na forma do regulamento e não poderão ser membros da entidade mencionada no inciso VI do caput deste artigo.

Artigo 59.- Compete ao Conselho Nacional de Proteção de Dados Pessoais e da Privacidade:

I.- propor diretrizes estratégicas e fornecer subsídios para a elaboração da Política Nacional de Proteção de Dados Pessoais e da Privacidade e de atuação da Autoridade Nacional de Proteção de Dados;

II.- elaborar relatórios anuais de avaliação da execução das ações da Política Nacional de Proteção de Dados Pessoais e da Privacidade;

III.- sugerir ações a serem realizadas pela Autoridade;

IV.- realizar estudos e debates sobre a proteção de dados pessoais e da privacidade; e

V.- disseminar o conhecimento sobre proteção de dados pessoais e da privacidade à população em geral.

CAPÍTULO X.- DISPOSIÇÕES FINAIS E TRANSITÓRIAS

Artigo 60.- Lei nº 12.965, de 23 de abril de 2014, passa a vigorar com as seguintes alterações:

“Artigo 7º ………………………….

X – exclusão definitiva dos dados pessoais que tiver fornecido a determinada aplicação de internet, a seu requerimento, ao término da relação entre as partes, ressalvadas as hipóteses de guarda obrigatória de registros previstas nesta Lei e na que trata da proteção de dados pessoais; ……………………………………….”(NR)

“Artigo 16. …………………………
II – de dados pessoais que sejam excessivos em relação à finalidade para a qual foi dado consentimento pelo seu titular, exceto nas hipóteses previstas na Lei que trata da proteção de dados pessoais.”(NR) Artigo 61. A empresa estrangeira será notificada e intimada de todos os atos processuais previstos nesta Lei, independentemente de procuração ou de disposição contratual ou estatutária, na pessoa do agente ou representante ou pessoa responsável por sua filial, agência, sucursal, estabelecimento ou escritório instalado no Brasil.

Artigo 62.- O órgão competente e o Instituto Nacional de Estudos e Pesquisas Educacionais Anísio Teixeira (Inep), no âmbito de suas competências, editarão regulamentos específicos para o acesso a dados tratados pela União para o cumprimento do disposto no § 2º do Artigo 9º da Lei nº 9.394, de 20 de dezembro de 1996 (Lei de Diretrizes e Bases da Educação Nacional), e aos referentes ao Sistema Nacional de Avaliação da Educação Superior (Sinaes), de que trata a Lei nº 10.861, de 14 de abril de 2004.

Artigo 63.- O órgão competente estabelecerá normas sobre a adequação progressiva de bancos de dados constituídos até a data de entrada em vigor desta Lei, consideradas a complexidade das operações de tratamento e a natureza dos dados.

Artigo 64.- Os direitos e princípios expressos nesta Lei não excluem outros previstos no ordenamento jurídico pátrio relacionados à matéria ou nos tratados internacionais em que a República Federativa do Brasil seja parte.

Artigo 65.- Esta Lei entra em vigor após decorridos 18 (dezoito) meses de sua publicação oficial.

CÂMARA DOS DEPUTADOS, de maio de 2018.

RODRIGO MAIA Presidente

15Ago/18

Lei 13709/18, de 14 de agosto de 2018

15 agosto, 2018Brasil, Leyde 14 de agosto de 2018 dispõe sobre a proteção de dados pessoais e altera a Lei nº 12.965, de 23 de abril de 2014. (DOU de 15.8.2018), Lei 13709/18José Cuervo

Lei 13709/18, de 14 de agosto de 2018 dispõe sobre a proteção de dados pessoais e altera a Lei nº 12.965, de 23 de abril de 2014. (DOU de 15.8.2018)

O PRESIDENTE DA REPÚBLICA Faço saber que o Congresso Nacional decreta e eu sanciono a seguinte Lei:

CAPÍTULO I.- DISPOSIÇÕES PRELIMINARES

Artigo 2º.- A disciplina da proteção de dados pessoais tem como fundamentos:

I.- o respeito à privacidade;

II.- a autodeterminação informativa;

III.- a liberdade de expressão, de informação, de comunicação e de opinião;

IV.- a inviolabilidade da intimidade, da honra e da imagem;

V.- o desenvolvimento econômico e tecnológico e a inovação;

VI.- a livre iniciativa, a livre concorrência e a defesa do consumidor; e

VII.- os direitos humanos, o livre desenvolvimento da personalidade, a dignidade e o exercício da cidadania pelas pessoas naturais.

I.- a operação de tratamento seja realizada no território nacional;

II.- a atividade de tratamento tenha por objetivo a oferta ou o fornecimento de bens ou serviços ou o tratamento de dados de indivíduos localizados no território nacional;

III.- os dados pessoais objeto do tratamento tenham sido coletados no território nacional.

§ 1º Consideram-se coletados no território nacional os dados pessoais cujo titular nele se encontre no momento da coleta.

§ 2º Excetua-se do disposto no inciso I deste artigo o tratamento de dados previsto no inciso IV do caput do Artigo 4º desta Lei.

Artigo 4º.- Esta Lei não se aplica ao tratamento de dados pessoais:

I.- realizado por pessoa natural para fins exclusivamente particulares e não econômicos;

II . realizado para fins exclusivamente:

a) jornalístico e artísticos; ou

b) acadêmicos, aplicando-se a esta hipótese os arts. 7º e 11 desta Lei;

III.- realizado para fins exclusivos de:

a) segurança pública;

b) defesa nacional;

c) segurança do Estado; ou

d) atividades de investigação e repressão de infrações penais; ou

§ 2º É vedado o tratamento dos dados a que se refere o inciso III do caput deste artigo por pessoa de direito privado, exceto em procedimentos sob tutela de pessoa jurídica de direito público, que serão objeto de informe específico à autoridade nacional e que deverão observar a limitação imposta no § 4º deste artigo.

§ 3º A autoridade nacional emitirá opiniões técnicas ou recomendações referentes às exceções previstas no inciso III do caput deste artigo e deverá solicitar aos responsáveis relatórios de impacto à proteção de dados pessoais.

§ 4º Em nenhum caso a totalidade dos dados pessoais de banco de dados de que trata o inciso III do caput deste artigo poderá ser tratada por pessoa de direito privado.

Artigo 5º.- Para os fins desta Lei, considera-se:

I.- dado pessoal: informação relacionada a pessoa natural identificada ou identificável;

II.- dado pessoal sensível: dado pessoal sobre origem racial ou étnica, convicção religiosa, opinião política, filiação a sindicato ou a organização de caráter religioso, filosófico ou político, dado referente à saúde ou à vida sexual, dado genético ou biométrico, quando vinculado a uma pessoa natural;

III.- dado anonimizado: dado relativo a titular que não possa ser identificado, considerando a utilização de meios técnicos razoáveis e disponíveis na ocasião de seu tratamento;

IV.- banco de dados: conjunto estruturado de dados pessoais, estabelecido em um ou em vários locais, em suporte eletrônico ou físico;

V.- titular: pessoa natural a quem se referem os dados pessoais que são objeto de tratamento;

VI.- controlador: pessoa natural ou jurídica, de direito público ou privado, a quem competem as decisões referentes ao tratamento de dados pessoais;

VII.- operador: pessoa natural ou jurídica, de direito público ou privado, que realiza o tratamento de dados pessoais em nome do controlador;

VIII.- encarregado: pessoa natural, indicada pelo controlador, que atua como canal de comunicação entre o controlador e os titulares e a autoridade nacional;

IX.- agentes de tratamento: o controlador e o operador;

XII.- consentimento: manifestação livre, informada e inequívoca pela qual o titular concorda com o tratamento de seus dados pessoais para uma finalidade determinada;

XIII.- bloqueio: suspensão temporária de qualquer operação de tratamento, mediante guarda do dado pessoal ou do banco de dados;

XIV.- eliminação: exclusão de dado ou de conjunto de dados armazenados em banco de dados, independentemente do procedimento empregado;

XV.- transferência internacional de dados: transferência de dados pessoais para país estrangeiro ou organismo internacional do qual o país seja membro;

XVI.- uso compartilhado de dados: comunicação, difusão, transferência internacional, interconexão de dados pessoais ou tratamento compartilhado de bancos de dados pessoais por órgãos e entidades públicos no cumprimento de suas competências legais, ou entre esses e entes privados, reciprocamente, com autorização específica, para uma ou mais modalidades de tratamento permitidas por esses entes públicos, ou entre entes privados;

XVII.- relatório de impacto à proteção de dados pessoais: documentação do controlador que contém a descrição dos processos de tratamento de dados pessoais que podem gerar riscos às liberdades civis e aos direitos fundamentais, bem como medidas, salvaguardas e mecanismos de mitigação de risco;

XIX.- autoridade nacional: órgão da administração pública indireta responsável por zelar, implementar e fiscalizar o cumprimento desta Lei.

Artigo 6º.- As atividades de tratamento de dados pessoais deverão observar a boa-fé e os seguintes princípios:

II.- adequação: compatibilidade do tratamento com as finalidades informadas ao titular, de acordo com o contexto do tratamento;

III.- necessidade: limitação do tratamento ao mínimo necessário para a realização de suas finalidades, com abrangência dos dados pertinentes, proporcionais e não excessivos em relação às finalidades do tratamento de dados;

IV.- livre acesso: garantia, aos titulares, de consulta facilitada e gratuita sobre a forma e a duração do tratamento, bem como sobre a integralidade de seus dados pessoais;

V.- qualidade dos dados: garantia, aos titulares, de exatidão, clareza, relevância e atualização dos dados, de acordo com a necessidade e para o cumprimento da finalidade de seu tratamento;

VI.- transparência: garantia, aos titulares, de informações claras, precisas e facilmente acessíveis sobre a realização do tratamento e os respectivos agentes de tratamento, observados os segredos comercial e industrial;

VIII.- prevenção: adoção de medidas para prevenir a ocorrência de danos em virtude do tratamento de dados pessoais;

IX.- não discriminação: impossibilidade de realização do tratamento para fins discriminatórios ilícitos ou abusivos;

X.- responsabilização e prestação de contas: demonstração, pelo agente, da adoção de medidas eficazes e capazes de comprovar a observância e o cumprimento das normas de proteção de dados pessoais e, inclusive, da eficácia dessas medidas.

CAPÍTULO II.- DO TRATAMENTO DE DADOS PESSOAIS

Seção I.- Dos Requisitos para o Tratamento de Dados Pessoais

Artigo 7º.- O tratamento de dados pessoais somente poderá ser realizado nas seguintes hipóteses:

I.- mediante o fornecimento de consentimento pelo titular;

II.- para o cumprimento de obrigação legal ou regulatória pelo controlador;

III.- pela administração pública, para o tratamento e uso compartilhado de dados necessários à execução de políticas públicas previstas em leis e regulamentos ou respaldadas em contratos, convênios ou instrumentos congêneres, observadas as disposições do Capítulo IV desta Lei;

IV.- para a realização de estudos por órgão de pesquisa, garantida, sempre que possível, a anonimização dos dados pessoais;

V.- quando necessário para a execução de contrato ou de procedimentos preliminares relacionados a contrato do qual seja parte o titular, a pedido do titular dos dados;

VI.- para o exercício regular de direitos em processo judicial, administrativo ou arbitral, esse último nos termos da Lei nº 9.307, de 23 de setembro de 1996 (Lei de Arbitragem);

VII.- para a proteção da vida ou da incolumidade física do titular ou de terceiro;

VIII.- para a tutela da saúde, em procedimento realizado por profissionais da área da saúde ou por entidades sanitárias;

IX.- quando necessário para atender aos interesses legítimos do controlador ou de terceiro, exceto no caso de prevalecerem direitos e liberdades fundamentais do titular que exijam a proteção dos dados pessoais; ou

X.- para a proteção do crédito, inclusive quanto ao disposto na legislação pertinente.

§ 2º A forma de disponibilização das informações previstas no § 1º e no inciso I do caput do Artigo 23 desta Lei poderá ser especificada pela autoridade nacional.

§ 3º O tratamento de dados pessoais cujo acesso é público deve considerar a finalidade, a boa-fé e o interesse público que justificaram sua disponibilização.

§ 4º É dispensada a exigência do consentimento previsto no caput deste artigo para os dados tornados manifestamente públicos pelo titular, resguardados os direitos do titular e os princípios previstos nesta Lei.

§ 5º O controlador que obteve o consentimento referido no inciso I do caput deste artigo que necessitar comunicar ou compartilhar dados pessoais com outros controladores deverá obter consentimento específico do titular para esse fim, ressalvadas as hipóteses de dispensa do consentimento previstas nesta Lei.

§ 6º A eventual dispensa da exigência do consentimento não desobriga os agentes de tratamento das demais obrigações previstas nesta Lei, especialmente da observância dos princípios gerais e da garantia dos direitos do titular.

Artigo 8º.- O consentimento previsto no inciso I do Artigo 7º desta Lei deverá ser fornecido por escrito ou por outro meio que demonstre a manifestação de vontade do titular.

§ 1º Caso o consentimento seja fornecido por escrito, esse deverá constar de cláusula destacada das demais cláusulas contratuais.

§ 2º Cabe ao controlador o ônus da prova de que o consentimento foi obtido em conformidade com o disposto nesta Lei.

§ 3º É vedado o tratamento de dados pessoais mediante vício de consentimento.

§ 4º O consentimento deverá referir-se a finalidades determinadas, e as autorizações genéricas para o tratamento de dados pessoais serão nulas.

§ 5º O consentimento pode ser revogado a qualquer momento mediante manifestação expressa do titular, por procedimento gratuito e facilitado, ratificados os tratamentos realizados sob amparo do consentimento anteriormente manifestado enquanto não houver requerimento de eliminação, nos termos do inciso VI do caput do Artigo 18 desta Lei.

§ 6º Em caso de alteração de informação referida nos incisos I, II, III ou V do Artigo 9º desta Lei, o controlador deverá informar ao titular, com destaque de forma específica do teor das alterações, podendo o titular, nos casos em que o seu consentimento é exigido, revogá-lo caso discorde da alteração.

Artigo 9º.- O titular tem direito ao acesso facilitado às informações sobre o tratamento de seus dados, que deverão ser disponibilizadas de forma clara, adequada e ostensiva acerca de, entre outras características previstas em regulamentação para o atendimento do princípio do livre acesso:

I.- finalidade específica do tratamento;

II.- forma e duração do tratamento, observados os segredos comercial e industrial;

III.- identificação do controlador;

IV.- informações de contato do controlador;

V.- informações acerca do uso compartilhado de dados pelo controlador e a finalidade;

VI.- responsabilidades dos agentes que realizarão o tratamento; e

VII.- direitos do titular, com menção explícita aos direitos contidos no Artigo 18 desta Lei.

§ 1º Na hipótese em que o consentimento é requerido, esse será considerado nulo caso as informações fornecidas ao titular tenham conteúdo enganoso ou abusivo ou não tenham sido apresentadas previamente com transparência, de forma clara e inequívoca.

§ 2º Na hipótese em que o consentimento é requerido, se houver mudanças da finalidade para o tratamento de dados pessoais não compatíveis com o consentimento original, o controlador deverá informar previamente o titular sobre as mudanças de finalidade, podendo o titular revogar o consentimento, caso discorde das alterações.

Artigo 10.- O legítimo interesse do controlador somente poderá fundamentar tratamento de dados pessoais para finalidades legítimas, consideradas a partir de situações concretas, que incluem, mas não se limitam a:

I.- apoio e promoção de atividades do controlador; e

II.- proteção, em relação ao titular, do exercício regular de seus direitos ou prestação de serviços que o beneficiem, respeitadas as legítimas expectativas dele e os direitos e liberdades fundamentais, nos termos desta Lei.

§ 1º Quando o tratamento for baseado no legítimo interesse do controlador, somente os dados pessoais estritamente necessários para a finalidade pretendida poderão ser tratados.

§ 2º O controlador deverá adotar medidas para garantir a transparência do tratamento de dados baseado em seu legítimo interesse.

§ 3º A autoridade nacional poderá solicitar ao controlador relatório de impacto à proteção de dados pessoais, quando o tratamento tiver como fundamento seu interesse legítimo, observados os segredos comercial e industrial.

Seção II.- Do Tratamento de Dados Pessoais Sensíveis

Artigo 11.- O tratamento de dados pessoais sensíveis somente poderá ocorrer nas seguintes hipóteses:

I.- quando o titular ou seu responsável legal consentir, de forma específica e destacada, para finalidades específicas;

II.- sem fornecimento de consentimento do titular, nas hipóteses em que for indispensável para:

a) cumprimento de obrigação legal ou regulatória pelo controlador;

b) tratamento compartilhado de dados necessários à execução, pela administração pública, de políticas públicas previstas em leis ou regulamentos;

c) realização de estudos por órgão de pesquisa, garantida, sempre que possível, a anonimização dos dados pessoais sensíveis;

d) exercício regular de direitos, inclusive em contrato e em processo judicial, administrativo e arbitral, este último nos termos da Lei nº 9.307, de 23 de setembro de 1996 (Lei de Arbitragem);

e) proteção da vida ou da incolumidade física do titular ou de terceiro;

f) tutela da saúde, em procedimento realizado por profissionais da área da saúde ou por entidades sanitárias; ou

§ 3º A comunicação ou o uso compartilhado de dados pessoais sensíveis entre controladores com objetivo de obter vantagem econômica poderá ser objeto de vedação ou de regulamentação por parte da autoridade nacional, ouvidos os órgãos setoriais do Poder Público, no âmbito de suas competências.

§ 4º É vedada a comunicação ou o uso compartilhado entre controladores de dados pessoais sensíveis referentes à saúde com objetivo de obter vantagem econômica, exceto nos casos de portabilidade de dados quando consentido pelo titular.

Artigo 12.- Os dados anonimizados não serão considerados dados pessoais para os fins desta Lei, salvo quando o processo de anonimização ao qual foram submetidos for revertido, utilizando exclusivamente meios próprios, ou quando, com esforços razoáveis, puder ser revertido.

§ 1º A determinação do que seja razoável deve levar em consideração fatores objetivos, tais como custo e tempo necessários para reverter o processo de anonimização, de acordo com as tecnologias disponíveis, e a utilização exclusiva de meios próprios.

§ 2º Poderão ser igualmente considerados como dados pessoais, para os fins desta Lei, aqueles utilizados para formação do perfil comportamental de determinada pessoa natural, se identificada.

§ 3º A autoridade nacional poderá dispor sobre padrões e técnicas utilizados em processos de anonimização e realizar verificações acerca de sua segurança, ouvido o Conselho Nacional de Proteção de Dados Pessoais.

Artigo 13.- Na realização de estudos em saúde pública, os órgãos de pesquisa poderão ter acesso a bases de dados pessoais, que serão tratados exclusivamente dentro do órgão e estritamente para a finalidade de realização de estudos e pesquisas e mantidos em ambiente controlado e seguro, conforme práticas de segurança previstas em regulamento específico e que incluam, sempre que possível, a anonimização ou pseudonimização dos dados, bem como considerem os devidos padrões éticos relacionados a estudos e pesquisas.

§ 1º A divulgação dos resultados ou de qualquer excerto do estudo ou da pesquisa de que trata o caput deste artigo em nenhuma hipótese poderá revelar dados pessoais.

§ 2º O órgão de pesquisa será o responsável pela segurança da informação prevista no caput deste artigo, não permitida, em circunstância alguma, a transferência dos dados a terceiro.

§ 3º O acesso aos dados de que trata este artigo será objeto de regulamentação por parte da autoridade nacional e das autoridades da área de saúde e sanitárias, no âmbito de suas competências.

Seção III.- Do Tratamento de Dados Pessoais de Crianças e de Adolescentes

Artigo 14.- O tratamento de dados pessoais de crianças e de adolescentes deverá ser realizado em seu melhor interesse, nos termos deste artigo e da legislação pertinente.

§ 1º O tratamento de dados pessoais de crianças deverá ser realizado com o consentimento específico e em destaque dado por pelo menos um dos pais ou pelo responsável legal.

§ 2º No tratamento de dados de que trata o § 1º deste artigo, os controladores deverão manter pública a informação sobre os tipos de dados coletados, a forma de sua utilização e os procedimentos para o exercício dos direitos a que se refere o Artigo 18 desta Lei.

§ 3º Poderão ser coletados dados pessoais de crianças sem o consentimento a que se refere o § 1º deste artigo quando a coleta for necessária para contatar os pais ou o responsável legal, utilizados uma única vez e sem armazenamento, ou para sua proteção, e em nenhum caso poderão ser repassados a terceiro sem o consentimento de que trata o § 1º deste artigo.

§ 4º Os controladores não deverão condicionar a participação dos titulares de que trata o § 1º deste artigo em jogos, aplicações de internet ou outras atividades ao fornecimento de informações pessoais além das estritamente necessárias à atividade.

§ 5º O controlador deve realizar todos os esforços razoáveis para verificar que o consentimento a que se refere o § 1º deste artigo foi dado pelo responsável pela criança, consideradas as tecnologias disponíveis.

§ 6º As informações sobre o tratamento de dados referidas neste artigo deverão ser fornecidas de maneira simples, clara e acessível, consideradas as características físico-motoras, perceptivas, sensoriais, intelectuais e mentais do usuário, com uso de recursos audiovisuais quando adequado, de forma a proporcionar a informação necessária aos pais ou ao responsável legal e adequada ao entendimento da criança.

Seção IV.- Do Término do Tratamento de Dados

Artigo 15.- O término do tratamento de dados pessoais ocorrerá nas seguintes hipóteses:

I.- verificação de que a finalidade foi alcançada ou de que os dados deixaram de ser necessários ou pertinentes ao alcance da finalidade específica almejada;

II.- fim do período de tratamento;

III.- comunicação do titular, inclusive no exercício de seu direito de revogação do consentimento conforme disposto no § 5º do Artigo 8º desta Lei, resguardado o interesse público; ou

IV.- determinação da autoridade nacional, quando houver violação ao disposto nesta Lei.

Artigo 16.- Os dados pessoais serão eliminados após o término de seu tratamento, no âmbito e nos limites técnicos das atividades, autorizada a conservação para as seguintes finalidades:

I.- cumprimento de obrigação legal ou regulatória pelo controlador;

II.- estudo por órgão de pesquisa, garantida, sempre que possível, a anonimização dos dados pessoais;

III.- transferência a terceiro, desde que respeitados os requisitos de tratamento de dados dispostos nesta Lei; ou

IV.- uso exclusivo do controlador, vedado seu acesso por terceiro, e desde que anonimizados os dados.

CAPÍTULO III.- DOS DIREITOS DO TITULAR

Artigo 17.- Toda pessoa natural tem assegurada a titularidade de seus dados pessoais e garantidos os direitos fundamentais de liberdade, de intimidade e de privacidade, nos termos desta Lei.

Artigo 18.- O titular dos dados pessoais tem direito a obter do controlador, em relação aos dados do titular por ele tratados, a qualquer momento e mediante requisição:

I.- confirmação da existência de tratamento;

II.- acesso aos dados;

III.- correção de dados incompletos, inexatos ou desatualizados;

IV – anonimização, bloqueio ou eliminação de dados desnecessários, excessivos ou tratados em desconformidade com o disposto nesta Lei;

V.- portabilidade dos dados a outro fornecedor de serviço ou produto, mediante requisição expressa e observados os segredos comercial e industrial, de acordo com a regulamentação do órgão controlador;

VI.- eliminação dos dados pessoais tratados com o consentimento do titular, exceto nas hipóteses previstas no Artigo 16 desta Lei;

VII.- informação das entidades públicas e privadas com as quais o controlador realizou uso compartilhado de dados;

VIII.- informação sobre a possibilidade de não fornecer consentimento e sobre as consequências da negativa;

IX.- revogação do consentimento, nos termos do § 5º do Artigo 8º desta Lei.

§ 1º O titular dos dados pessoais tem o direito de peticionar em relação aos seus dados contra o controlador perante a autoridade nacional.

§ 2º O titular pode opor-se a tratamento realizado com fundamento em uma das hipóteses de dispensa de consentimento, em caso de descumprimento ao disposto nesta Lei.

§ 3º Os direitos previstos neste artigo serão exercidos mediante requerimento expresso do titular ou de representante legalmente constituído, a agente de tratamento.

§ 4º Em caso de impossibilidade de adoção imediata da providência de que trata o § 3º deste artigo, o controlador enviará ao titular resposta em que poderá:

I.- comunicar que não é agente de tratamento dos dados e indicar, sempre que possível, o agente; ou

II.- indicar as razões de fato ou de direito que impedem a adoção imediata da providência.

§ 5º O requerimento referido no § 3º deste artigo será atendido sem custos para o titular, nos prazos e nos termos previstos em regulamento.

§ 7º A portabilidade dos dados pessoais a que se refere o inciso V do caput deste artigo não inclui dados que já tenham sido anonimizados pelo controlador.

§ 8º O direito a que se refere o § 1º deste artigo também poderá ser exercido perante os organismos de defesa do consumidor.

Artigo 19.- A confirmação de existência ou o acesso a dados pessoais serão providenciados, mediante requisição do titular:

I.- em formato simplificado, imediatamente; ou

§ 1º Os dados pessoais serão armazenados em formato que favoreça o exercício do direito de acesso.

§ 2º As informações e os dados poderão ser fornecidos, a critério do titular:

I.- por meio eletrônico, seguro e idôneo para esse fim; ou

II.- sob forma impressa.

§ 3º Quando o tratamento tiver origem no consentimento do titular ou em contrato, o titular poderá solicitar cópia eletrônica integral de seus dados pessoais, observados os segredos comercial e industrial, nos termos de regulamentação da autoridade nacional, em formato que permita a sua utilização subsequente, inclusive em outras operações de tratamento.

§ 4º A autoridade nacional poderá dispor de forma diferenciada acerca dos prazos previstos nos incisos I e II do caput deste artigo para os setores específicos.

Artigo 20.- O titular dos dados tem direito a solicitar revisão, por pessoa natural, de decisões tomadas unicamente com base em tratamento automatizado de dados pessoais que afetem seus interesses, inclusive de decisões destinadas a definir o seu perfil pessoal, profissional, de consumo e de crédito ou os aspectos de sua personalidade.

§ 1º O controlador deverá fornecer, sempre que solicitadas, informações claras e adequadas a respeito dos critérios e dos procedimentos utilizados para a decisão automatizada, observados os segredos comercial e industrial.

§ 2º Em caso de não oferecimento de informações de que trata o § 1º deste artigo baseado na observância de segredo comercial e industrial, a autoridade nacional poderá realizar auditoria para verificação de aspectos discriminatórios em tratamento automatizado de dados pessoais.

Artigo 21.- Os dados pessoais referentes ao exercício regular de direitos pelo titular não podem ser utilizados em seu prejuízo.

Artigo 22.- A defesa dos interesses e dos direitos dos titulares de dados poderá ser exercida em juízo, individual ou coletivamente, na forma do disposto na legislação pertinente, acerca dos instrumentos de tutela individual e coletiva.

CAPÍTULO IV.- DO TRATAMENTO DE DADOS PESSOAIS PELO PODER PÚBLICO

Seção I.- Das Regras

Artigo 23.- O tratamento de dados pessoais pelas pessoas jurídicas de direito público referidas no parágrafo único do Artigo 1º da Lei nº 12.527, de 18 de novembro de 2011 (Lei de Acesso a Informacao), deverá ser realizado para o atendimento de sua finalidade pública, na persecução do interesse público, com o objetivo de executar as competências legais ou cumprir as atribuições legais do serviço público, desde que:

I.- sejam informadas as hipóteses em que, no exercício de suas competências, realizam o tratamento de dados pessoais, fornecendo informações claras e atualizadas sobre a previsão legal, a finalidade, os procedimentos e as práticas utilizadas para a execução dessas atividades, em veículos de fácil acesso, preferencialmente em seus sítios eletrônicos;

II.- (VETADO); e

III.- seja indicado um encarregado quando realizarem operações de tratamento de dados pessoais, nos termos do Artigo 39 desta Lei.

§ 1º A autoridade nacional poderá dispor sobre as formas de publicidade das operações de tratamento.

§ 2º O disposto nesta Lei não dispensa as pessoas jurídicas mencionadas no caput deste artigo de instituir as autoridades de que trata a Lei nº 12.527, de 18 de novembro de 2011 (Lei de Acesso a Informacao).

§ 3º Os prazos e procedimentos para exercício dos direitos do titular perante o Poder Público observarão o disposto em legislação específica, em especial as disposições constantes da Lei nº 9.507, de 12 de novembro de 1997 (Lei do Habeas Data), da Lei nº 9.784, de 29 de janeiro de 1999 (Lei Geral do Processo Administrativo), e da Lei nº 12.527, de 18 de novembro de 2011 (Lei de Acesso a Informacao).

§ 4º Os serviços notariais e de registro exercidos em caráter privado, por delegação do Poder Público, terão o mesmo tratamento dispensado às pessoas jurídicas referidas no caput deste artigo, nos termos desta Lei.

§ 5º Os órgãos notariais e de registro devem fornecer acesso aos dados por meio eletrônico para a administração pública, tendo em vista as finalidades de que trata o caput deste artigo.

Artigo 24.- As empresas públicas e as sociedades de economia mista que atuam em regime de concorrência, sujeitas ao disposto no Artigo 173 da Constituição Federal, terão o mesmo tratamento dispensado às pessoas jurídicas de direito privado particulares, nos termos desta Lei.

Parágrafo único.- As empresas públicas e as sociedades de economia mista, quando estiverem operacionalizando políticas públicas e no âmbito da execução delas, terão o mesmo tratamento dispensado aos órgãos e às entidades do Poder Público, nos termos deste Capítulo.

Artigo 25.- Os dados deverão ser mantidos em formato interoperável e estruturado para o uso compartilhado, com vistas à execução de políticas públicas, à prestação de serviços públicos, à descentralização da atividade pública e à disseminação e ao acesso das informações pelo público em geral.

Artigo 26.- O uso compartilhado de dados pessoais pelo Poder Público deve atender a finalidades específicas de execução de políticas públicas e atribuição legal pelos órgãos e pelas entidades públicas, respeitados os princípios de proteção de dados pessoais elencados no Artigo 6º desta Lei.

§ 1º É vedado ao Poder Público transferir a entidades privadas dados pessoais constantes de bases de dados a que tenha acesso, exceto:

II.- (VETADO);

III – nos casos em que os dados forem acessíveis publicamente, observadas as disposições desta Lei.

§ 2º Os contratos e convênios de que trata o § 1º deste artigo deverão ser comunicados à autoridade nacional.

Artigo 27.- A comunicação ou o uso compartilhado de dados pessoais de pessoa jurídica de direito público a pessoa de direito privado será informado à autoridade nacional e dependerá de consentimento do titular, exceto:

I.- nas hipóteses de dispensa de consentimento previstas nesta Lei;

II.- nos casos de uso compartilhado de dados, em que será dada publicidade nos termos do inciso I do caput do Artigo 23 desta Lei; ou

III.- nas exceções constantes do § 1º do Artigo 26 desta Lei.

Artigo 28.- (VETADO).

Artigo 29.- A autoridade nacional poderá solicitar, a qualquer momento, às entidades do Poder Público, a realização de operações de tratamento de dados pessoais, informe específico sobre o âmbito e a natureza dos dados e demais detalhes do tratamento realizado e poderá emitir parecer técnico complementar para garantir o cumprimento desta Lei.

Artigo 30.- A autoridade nacional poderá estabelecer normas complementares para as atividades de comunicação e de uso compartilhado de dados pessoais.

Seção II.- Da Responsabilidade

Artigo 31.- Quando houver infração a esta Lei em decorrência do tratamento de dados pessoais por órgãos públicos, a autoridade nacional poderá enviar informe com medidas cabíveis para fazer cessar a violação.

Artigo 32.- A autoridade nacional poderá solicitar a agentes do Poder Público a publicação de relatórios de impacto à proteção de dados pessoais e sugerir a adoção de padrões e de boas práticas para os tratamentos de dados pessoais pelo Poder Público.

CAPÍTULO V.- DA TRANSFERÊNCIA INTERNACIONAL DE DADOS

Artigo 33.- A transferência internacional de dados pessoais somente é permitida nos seguintes casos:

I.- para países ou organismos internacionais que proporcionem grau de proteção de dados pessoais adequado ao previsto nesta Lei;

II.- quando o controlador oferecer e comprovar garantias de cumprimento dos princípios, dos direitos do titular e do regime de proteção de dados previstos nesta Lei, na forma de:

a) cláusulas contratuais específicas para determinada transferência;

b) cláusulas-padrão contratuais;

c) normas corporativas globais;

d) selos, certificados e códigos de conduta regularmente emitidos;

IV.- quando a transferência for necessária para a proteção da vida ou da incolumidade física do titular ou de terceiro;

V.- quando a autoridade nacional autorizar a transferência;

VI.- quando a transferência resultar em compromisso assumido em acordo de cooperação internacional;

VII.- quando a transferência for necessária para a execução de política pública ou atribuição legal do serviço público, sendo dada publicidade nos termos do inciso I do caput do Artigo 23 desta Lei;

IX.- quando necessário para atender as hipóteses previstas nos incisos II, V e VI do Artigo 7º desta Lei.

Parágrafo único.- Para os fins do inciso I deste artigo, as pessoas jurídicas de direito público referidas no parágrafo único do Artigo 1º da Lei nº 12.527, de 18 de novembro de 2011 (Lei de Acesso a Informacao), no âmbito de suas competências legais, e responsáveis, no âmbito de suas atividades, poderão requerer à autoridade nacional a avaliação do nível de proteção a dados pessoais conferido por país ou organismo internacional.

Artigo 34.- O nível de proteção de dados do país estrangeiro ou do organismo internacional mencionado no inciso I do caput do Artigo 33 desta Lei será avaliado pela autoridade nacional, que levará em consideração:

I.- as normas gerais e setoriais da legislação em vigor no país de destino ou no organismo internacional;

II.- a natureza dos dados;

III.- a observância dos princípios gerais de proteção de dados pessoais e direitos dos titulares previstos nesta Lei;

IV.- a adoção de medidas de segurança previstas em regulamento;

V.- a existência de garantias judiciais e institucionais para o respeito aos direitos de proteção de dados pessoais; e

VI.- outras circunstâncias específicas relativas à transferência.

§ 2º Na análise de cláusulas contratuais, de documentos ou de normas corporativas globais submetidas à aprovação da autoridade nacional, poderão ser requeridas informações suplementares ou realizadas diligências de verificação quanto às operações de tratamento, quando necessário.

§ 3º A autoridade nacional poderá designar organismos de certificação para a realização do previsto no caput deste artigo, que permanecerão sob sua fiscalização nos termos definidos em regulamento.

§ 4º Os atos realizados por organismo de certificação poderão ser revistos pela autoridade nacional e, caso em desconformidade com esta Lei, submetidos a revisão ou anulados.

CAPÍTULO VI.- DOS AGENTES DE TRATAMENTO DE DADOS PESSOAIS

Seção I.- Do Controlador e do Operador

Artigo 37.- O controlador e o operador devem manter registro das operações de tratamento de dados pessoais que realizarem, especialmente quando baseado no legítimo interesse.

Artigo 38.- A autoridade nacional poderá determinar ao controlador que elabore relatório de impacto à proteção de dados pessoais, inclusive de dados sensíveis, referente a suas operações de tratamento de dados, nos termos de regulamento, observados os segredos comercial e industrial.

Parágrafo único.- Observado o disposto no caput deste artigo, o relatório deverá conter, no mínimo, a descrição dos tipos de dados coletados, a metodologia utilizada para a coleta e para a garantia da segurança das informações e a análise do controlador com relação a medidas, salvaguardas e mecanismos de mitigação de risco adotados.

Artigo 39. O operador deverá realizar o tratamento segundo as instruções fornecidas pelo controlador, que verificará a observância das próprias instruções e das normas sobre a matéria.

Artigo 40.- A autoridade nacional poderá dispor sobre padrões de interoperabilidade para fins de portabilidade, livre acesso aos dados e segurança, assim como sobre o tempo de guarda dos registros, tendo em vista especialmente a necessidade e a transparência.

Seção II.- Do Encarregado pelo Tratamento de Dados Pessoais

Artigo 41.- O controlador deverá indicar encarregado pelo tratamento de dados pessoais.

§ 1º A identidade e as informações de contato do encarregado deverão ser divulgadas publicamente, de forma clara e objetiva, preferencialmente no sítio eletrônico do controlador.

§ 2º As atividades do encarregado consistem em:

I.- aceitar reclamações e comunicações dos titulares, prestar esclarecimentos e adotar providências;

II.- receber comunicações da autoridade nacional e adotar providências;

III.- orientar os funcionários e os contratados da entidade a respeito das práticas a serem tomadas em relação à proteção de dados pessoais; e

IV.- executar as demais atribuições determinadas pelo controlador ou estabelecidas em normas complementares.

§ 3º A autoridade nacional poderá estabelecer normas complementares sobre a definição e as atribuições do encarregado, inclusive hipóteses de dispensa da necessidade de sua indicação, conforme a natureza e o porte da entidade ou o volume de operações de tratamento de dados.

Seção III.- Da Responsabilidade e do Ressarcimento de Danos

Artigo 42.- O controlador ou o operador que, em razão do exercício de atividade de tratamento de dados pessoais, causar a outrem dano patrimonial, moral, individual ou coletivo, em violação à legislação de proteção de dados pessoais, é obrigado a repará-lo.

§ 1º A fim de assegurar a efetiva indenização ao titular dos dados:

I.- o operador responde solidariamente pelos danos causados pelo tratamento quando descumprir as obrigações da legislação de proteção de dados ou quando não tiver seguido as instruções lícitas do controlador, hipótese em que o operador equipara-se ao controlador, salvo nos casos de exclusão previstos no Artigo 43 desta Lei;

II.- os controladores que estiverem diretamente envolvidos no tratamento do qual decorreram danos ao titular dos dados respondem solidariamente, salvo nos casos de exclusão previstos no Artigo 43 desta Lei.

§ 4º Aquele que reparar o dano ao titular tem direito de regresso contra os demais responsáveis, na medida de sua participação no evento danoso.

Artigo 43.- Os agentes de tratamento só não serão responsabilizados quando provarem:

I.- que não realizaram o tratamento de dados pessoais que lhes é atribuído;

II.- que, embora tenham realizado o tratamento de dados pessoais que lhes é atribuído, não houve violação à legislação de proteção de dados; ou

III.- que o dano é decorrente de culpa exclusiva do titular dos dados ou de terceiro.

I.- o modo pelo qual é realizado;

II.- o resultado e os riscos que razoavelmente dele se esperam;

III.- as técnicas de tratamento de dados pessoais disponíveis à época em que foi realizado.

Parágrafo único.- Responde pelos danos decorrentes da violação da segurança dos dados o controlador ou o operador que, ao deixar de adotar as medidas de segurança previstas no Artigo 46 desta Lei, der causa ao dano.

Artigo 45.- As hipóteses de violação do direito do titular no âmbito das relações de consumo permanecem sujeitas às regras de responsabilidade previstas na legislação pertinente.

CAPÍTULO VII.- DA SEGURANÇA E DAS BOAS PRÁTICAS

Seção I.- Da Segurança e do Sigilo de Dados

§ 1º A autoridade nacional poderá dispor sobre padrões técnicos mínimos para tornar aplicável o disposto no caput deste artigo, considerados a natureza das informações tratadas, as características específicas do tratamento e o estado atual da tecnologia, especialmente no caso de dados pessoais sensíveis, assim como os princípios previstos no caput do Artigo 6º desta Lei.

§ 2º As medidas de que trata o caput deste artigo deverão ser observadas desde a fase de concepção do produto ou do serviço até a sua execução.

Artigo 48.- O controlador deverá comunicar à autoridade nacional e ao titular a ocorrência de incidente de segurança que possa acarretar risco ou dano relevante aos titulares.

§ 1º A comunicação será feita em prazo razoável, conforme definido pela autoridade nacional, e deverá mencionar, no mínimo:

I.- a descrição da natureza dos dados pessoais afetados;

II.- as informações sobre os titulares envolvidos;

III.- a indicação das medidas técnicas e de segurança utilizadas para a proteção dos dados, observados os segredos comercial e industrial;

IV.- os riscos relacionados ao incidente;

V.- os motivos da demora, no caso de a comunicação não ter sido imediata; e

VI.- as medidas que foram ou que serão adotadas para reverter ou mitigar os efeitos do prejuízo.

§ 2º A autoridade nacional verificará a gravidade do incidente e poderá, caso necessário para a salvaguarda dos direitos dos titulares, determinar ao controlador a adoção de providências, tais como:

I.- ampla divulgação do fato em meios de comunicação; e

II.- medidas para reverter ou mitigar os efeitos do incidente.

§ 3º No juízo de gravidade do incidente, será avaliada eventual comprovação de que foram adotadas medidas técnicas adequadas que tornem os dados pessoais afetados ininteligíveis, no âmbito e nos limites técnicos de seus serviços, para terceiros não autorizados a acessá-los.

Artigo 49.- Os sistemas utilizados para o tratamento de dados pessoais devem ser estruturados de forma a atender aos requisitos de segurança, aos padrões de boas práticas e de governança e aos princípios gerais previstos nesta Lei e às demais normas regulamentares.

Seção II.- Das Boas Práticas e da Governança

Artigo 50.- Os controladores e operadores, no âmbito de suas competências, pelo tratamento de dados pessoais, individualmente ou por meio de associações, poderão formular regras de boas práticas e de governança que estabeleçam as condições de organização, o regime de funcionamento, os procedimentos, incluindo reclamações e petições de titulares, as normas de segurança, os padrões técnicos, as obrigações específicas para os diversos envolvidos no tratamento, as ações educativas, os mecanismos internos de supervisão e de mitigação de riscos e outros aspectos relacionados ao tratamento de dados pessoais.

§ 1º Ao estabelecer regras de boas práticas, o controlador e o operador levarão em consideração, em relação ao tratamento e aos dados, a natureza, o escopo, a finalidade e a probabilidade e a gravidade dos riscos e dos benefícios decorrentes de tratamento de dados do titular.

§ 2º Na aplicação dos princípios indicados nos incisos VII e VIII do caput do Artigo 6º desta Lei, o controlador, observados a estrutura, a escala e o volume de suas operações, bem como a sensibilidade dos dados tratados e a probabilidade e a gravidade dos danos para os titulares dos dados, poderá:

I.- implementar programa de governança em privacidade que, no mínimo:

a) demonstre o comprometimento do controlador em adotar processos e políticas internas que assegurem o cumprimento, de forma abrangente, de normas e boas práticas relativas à proteção de dados pessoais;

b) seja aplicável a todo o conjunto de dados pessoais que estejam sob seu controle, independentemente do modo como se realizou sua coleta;

c) seja adaptado à estrutura, à escala e ao volume de suas operações, bem como à sensibilidade dos dados tratados;

d) estabeleça políticas e salvaguardas adequadas com base em processo de avaliação sistemática de impactos e riscos à privacidade;

e) tenha o objetivo de estabelecer relação de confiança com o titular, por meio de atuação transparente e que assegure mecanismos de participação do titular;

f) esteja integrado a sua estrutura geral de governança e estabeleça e aplique mecanismos de supervisão internos e externos;

g) conte com planos de resposta a incidentes e remediação; e

h) seja atualizado constantemente com base em informações obtidas a partir de monitoramento contínuo e avaliações periódicas;

II.- demonstrar a efetividade de seu programa de governança em privacidade quando apropriado e, em especial, a pedido da autoridade nacional ou de outra entidade responsável por promover o cumprimento de boas práticas ou códigos de conduta, os quais, de forma independente, promovam o cumprimento desta Lei.

§ 3º As regras de boas práticas e de governança deverão ser publicadas e atualizadas periodicamente e poderão ser reconhecidas e divulgadas pela autoridade nacional.

Artigo 51.- A autoridade nacional estimulará a adoção de padrões técnicos que facilitem o controle pelos titulares dos seus dados pessoais.

CAPÍTULO VIII.- DA FISCALIZAÇÃO

Seção I.- Das Sanções Administrativas

I.- advertência, com indicação de prazo para adoção de medidas corretivas;

II.- multa simples, de até 2% (dois por cento) do faturamento da pessoa jurídica de direito privado, grupo ou conglomerado no Brasil no seu último exercício, excluídos os tributos, limitada, no total, a R$ 50.000.000,00 (cinquenta milhões de reais) por infração;

III.- multa diária, observado o limite total a que se refere o inciso II;

IV.- publicização da infração após devidamente apurada e confirmada a sua ocorrência;

V.- bloqueio dos dados pessoais a que se refere a infração até a sua regularização;

VI.- eliminação dos dados pessoais a que se refere a infração;

VII.- suspensão parcial ou total do funcionamento do banco de dados a que se refere a infração pelo período máximo de 6 (seis) meses, prorrogável por igual período até a regularização da atividade de tratamento pelo controlador;

VIII.- suspensão do exercício da atividade de tratamento dos dados pessoais a que se refere a infração pelo período máximo de 6 (seis) meses, prorrogável por igual período;

IX.- proibição parcial ou total do exercício de atividades relacionadas a tratamento de dados.

I.- a gravidade e a natureza das infrações e dos direitos pessoais afetados;

II.- a boa-fé do infrator;

III.- a vantagem auferida ou pretendida pelo infrator;

IV.- a condição econômica do infrator;

V.- a reincidência;

VI.- o grau do dano;

VII.- (VETADO);

VIII.- (VETADO);

IX – (VETADO);

X.- a pronta adoção de medidas corretivas; e

XI.- a proporcionalidade entre a gravidade da falta e a intensidade da sanção.

§ 2º O disposto neste artigo não substitui a aplicação de sanções administrativas, civis ou penais definidas em legislação específica.

§ 3º O disposto nos incisos I, IV, V, VI, VII, VIII e IX do caput deste artigo poderá ser aplicado às entidades e aos órgãos públicos, sem prejuízo do disposto na Lei nº 8.112, de 11 de dezembro de 1990 (Estatuto do Servidor Público Federal), na Lei nº 8.429, de 2 de junho de 1992 (Lei de Improbidade Administrativa), e na Lei nº 12.527, de 18 de novembro de 2011 (Lei de Acesso a Informacao).

§ 4º No cálculo do valor da multa de que trata o inciso II do caput deste artigo, a autoridade nacional poderá considerar o faturamento total da empresa ou grupo de empresas, quando não dispuser do valor do faturamento no ramo de atividade empresarial em que ocorreu a infração, definido pela autoridade nacional, ou quando o valor for apresentado de forma incompleta ou não for demonstrado de forma inequívoca e idônea.

Artigo 53.- A autoridade nacional definirá, por meio de regulamento próprio sobre sanções administrativas a infrações a esta Lei, que deverá ser objeto de consulta pública, as metodologias que orientarão o cálculo do valor-base das sanções de multa.

§ 2º O regulamento de sanções e metodologias correspondentes deve estabelecer as circunstâncias e as condições para a adoção de multa simples ou diária.

Artigo 54.- O valor da sanção de multa diária aplicável às infrações a esta Lei deve observar a gravidade da falta e a extensão do dano ou prejuízo causado e ser fundamentado pela autoridade nacional.

Parágrafo único.- A intimação da sanção de multa diária deverá conter, no mínimo, a descrição da obrigação imposta, o prazo razoável e estipulado pelo órgão para o seu cumprimento e o valor da multa diária a ser aplicada pelo seu descumprimento.

CAPÍTULO IX.- DA AUTORIDADE NACIONAL DE PROTEÇÃO DE DADOS (ANPD) E DO CONSELHO NACIONAL DE PROTEÇÃO DE DADOS PESSOAIS E
DA PRIVACIDADE

Seção I.- Da Autoridade Nacional de Proteção de Dados (ANPD)

Artigo 55.- (VETADO).

Artigo 56.- (VETADO).

Artigo 57.- (VETADO).

Seção II.- Do Conselho Nacional de Proteção de Dados Pessoais e da Privacidade

Artigo 58.- (VETADO).

Artigo 59.- (VETADO).

CAPÍTULO X.- DISPOSIÇÕES FINAIS E TRANSITÓRIAS

Artigo 60.- A Lei nº 12.965, de 23 de abril de 2014 (Marco Civil da Internet), passa a vigorar com as seguintes alterações:

“Artigo 7º …………………………………………………………

……………………………………………………………………………

X.- exclusão definitiva dos dados pessoais que tiver fornecido a determinada aplicação de internet, a seu requerimento, ao término da relação entre as partes, ressalvadas as hipóteses de guarda obrigatória de registros previstas nesta Lei e na que dispõe sobre a proteção de dados pessoais;

……………………………………………………………………”

“Artigo 16. ………………………………………………………..

……………………………………………………………………………

II.- de dados pessoais que sejam excessivos em relação à finalidade para a qual foi dado consentimento pelo seu titular, exceto nas hipóteses previstas na Lei que dispõe sobre a proteção de dados pessoais.”

Artigo 61.- A empresa estrangeira será notificada e intimada de todos os atos processuais previstos nesta Lei, independentemente de procuração ou de disposição contratual ou estatutária, na pessoa do agente ou representante ou pessoa responsável por sua filial, agência, sucursal, estabelecimento ou escritório instalado no Brasil.

Artigo 62.- A autoridade nacional e o Instituto Nacional de Estudos e Pesquisas Educacionais Anísio Teixeira (Inep), no âmbito de suas competências, editarão regulamentos específicos para o acesso a dados tratados pela União para o cumprimento do disposto no § 2º do Artigo 9º da Lei nº 9.394, de 20 de dezembro de 1996 (Lei de Diretrizes e Bases da Educacao Nacional), e aos referentes ao Sistema Nacional de Avaliação da Educação Superior (Sinaes), de que trata a Lei nº 10.861, de 14 de abril de 2004.

Artigo 63.- A autoridade nacional estabelecerá normas sobre a adequação progressiva de bancos de dados constituídos até a data de entrada em vigor desta Lei, consideradas a complexidade das operações de tratamento e a natureza dos dados.

Artigo 65.- Esta Lei entra em vigor após decorridos 18 (dezoito) meses de sua publicação oficial.

Brasília, 14 de agosto de 2018; 197º da Independência e 130º da República.

MICHEL TEMER

Torquato Jardim

Aloysio Nunes Ferreira Filho

Eduardo Refinetti Guardia

Esteves Pedro Colnago Junior

Gilberto Magalhães Occhi

Gilberto Kassab

Wagner de Campos Rosário

Gustavo do Vale Rocha

Ilan Goldfajn

Raul Jungmann

Eliseu Padilha

15Ago/18

Legislación Informática de Brasil 2018

15 agosto, 20182018, Brasil, LegislaciónJosé Cuervo

Lei 13709/18, de 14 de agosto de 2018 dispõe sobre a proteção de dados pessoais e altera a Lei nº 12.965, de 23 de abril de 2014. (DOU de 15.8.2018)

15Ago/18

Acuerdo nº 002-2018-TEL-MICITT, de 11 de enero de 2018

15 agosto, 2018Acuerdo, Costa RicaAcuerdo nº 002-2018-TEL-MICITT, de 11 de enero de 2018, del Ministerio de Ciencia, Tecnología y TelecomunicacionesJosé Cuervo

Acuerdo nº 002-2018-TEL-MICITT, de 11 de enero de 2018, del Ministerio de Ciencia, Tecnología y Telecomunicaciones

EL PRESIDENTE DE LA REPÚBLICA Y EL MINISTRO DE CIENCIA, TECNOLOGÍA
Y TELECOMUNICACIONES

Con fundamento en las atribuciones que les confieren los artículos 11, 129, 140 inciso 20), 146 de la Constitución Política de la República de Costa Rica; y en razón de lo dispuesto en los artículos 10, 11, 16.1, 25 inciso 1), 27 inciso 1), 28 inciso 2) subincisos a) y b), 140, 154, 264 y 346.1 de la Ley nº 6227, “Ley General de la
Administración Pública” (LGAP), emitida el 02 de mayo de 1978 y publicada en el Diario Oficial La Gaceta n° 102, Alcance n° 90, del 30 de mayo de 1978; en los artículos 3, 4, 7, 8, 9, 10, 22, 25 y 26 de la Ley n° 8642, “Ley General de Telecomunicaciones” (LGT), emitida el 04 de junio de 2008 y publicada en el Diario Oficial La Gaceta n° 125 del 30 de junio del 2008; en los artículos 39 y 40 de la Ley n° 8660, “Ley de Fortalecimiento y Modernización de la Entidades Públicas del Sector Telecomunicaciones”, emitida en fecha 08 de agosto de 2008 y publicada el Diario Oficial La Gaceta n° 156, Alcance n° 31, del 13 de agosto del 2008 y sus reformas; en la Ley n° 7593, “Ley de la Autoridad Reguladora de los Servicios Públicos” ARESEP), emitida publicada en el Diario Oficial La Gaceta n° 169 del 05 de setiembre de 1996 y sus reformas; en el artículo 6 de la Ley n° 9024, “Ley de Impuesto a las personas jurídicas” emitida el día 23 de diciembre del 2011 y publicada en el Alcance n° 111-A al Diario Oficial La Gaceta n° 249 de fecha 27 de diciembre del 2011; en lo dispuesto en el Decreto Ejecutivo n° 35257-MINAET, “Plan
Nacional de Atribución de Frecuencias” (PNAF), emitido en fecha 16 de abril del 2009 y publicado en el Diario Oficial La Gaceta n° 103, Alcance n° 19, del 29 de mayo del 2009 y sus reformas; en el Decreto Ejecutivo N° 34765-MINAET, “Reglamento a la Ley General de Telecomunicaciones” (RLGT), emitido el 22 de setiembre del 2008 y publicado en el Diario Oficial La Gaceta n° 186 del 26 de setiembre de 2008 y sus reformas; en la recomendación técnica emitida por la Superintendencia de Telecomunicaciones (SUTEL), mediante oficio n° 5386-SUTEL-DGC-2013 de fecha 23 de octubre del 2013, aprobada por Acuerdo n° 019-057-2013 de su Consejo, adoptado en la sesión ordinaria n° 057-2013, celebrada en fecha 25 de octubre del 2013; en el informe técnico n° MICITT-GAER-INF-033-2014,
de fecha 14 de febrero de 2014 de la Gerencia de Administración del Espectro Radioeléctrico; en el Informe Técnico-Jurídico n° MICITTDNPT-IT-184-2017 de fecha 13 de junio del 2017 del Departamento de Normas y Procedimientos en Telecomunicaciones (DNPT) ambas dependencias del Viceministerio de Telecomunicaciones del Ministerio de Ciencia, Tecnología y Telecomunicaciones (MICITT) y en los elementos que constan en el expediente administrativo n°
DNCR-TV-2014-01 de la Unidad de Control Nacional de Radio del Viceministerio de Telecomunicaciones.

Considerando:

I..- Que el Poder Ejecutivo mediante Acuerdo Ejecutivo n° 31-1994 del 28 de febrero de 1994, le otorgó a la empresa DONA NENA S. A., con cédula de persona jurídica n° 3-101-110968, la concesión del rango de frecuencias de 482 MHz a 488 MHz
(correspondiente al Canal 16), en Ultra Alta Frecuencia (UHF), para el servicio de radiodifusión televisiva abierta (emisiones de televisión de acceso libre), entre sus estudios ubicados en San José y su transmisor en Sabanillas de Alajuela. (Folio 32 del expediente administrativo n° DCNR-TV-2014-01).

II.- Que el Poder Ejecutivo mediante Acuerdo Ejecutivo n° 67-1994 del 26 de abril de 1994, le otorgó a la empresa DONA NENA S.A., con cédula de persona jurídica n° 3-101-110968, la concesión del rango de frecuencias de 482 MHz a 488 MHz (correspondiente al Canal 16), en Ultra Alta Frecuencia (UHF), para el servicio de radiodifusión televisiva abierta (emisiones de televisión de acceso libre), con transmisor ubicado en Cerro Cañas Dulces de Liberia, Guanacaste. (Folio 31 del expediente administrativo n° DCNR-TV-2014-01)

III.- Que mediante oficio n° 5469-SUTEL-SCS-2013 de fecha 29 de octubre de 2013, recibido en el Viceministerio de Telecomunicaciones en esa misma fecha, la Superintendencia de Telecomunicaciones remitió el dictamen técnico emitido
mediante el oficio n° 5386-SUTEL-DGC-2013 de fecha 23 de octubre del 2013, el cual fue aprobado por su Consejo mediante el Acuerdo n° 019-057-2013, adoptado en la sesión ordinaria n° 057-2013, celebrada en fecha 25 de octubre de 2013, referente a la recomendación sobre la adecuación de los títulos habilitantes de
la empresa DONA NENA S. A., con cédula de persona jurídica n° 3-101-110968, concesionaria de las frecuencias 482 MHz a 488 MHz (Canal 16) para radiodifusión televisiva abierta. En dicho informe, la SUTEL realizó el análisis respectivo, así como el estudio registral y concluyó que aparentemente la concesionaria no está utilizando el recurso asignado, así como determinó el eventual incumplimiento de las obligaciones legales y contractuales, por lo que se estaría en presencia de las causales de revocación y extinción del título habilitante, según lo contemplado por el artículo 22 de la Ley General de Telecomunicaciones. Por lo que, recomendó al Poder Ejecutivo que “en vista de la no utilización del recurso asignado (100% de no cobertura en el país durante los años 2010 y 2012) de conformidad con lo indicado mediante los oficios 1619-SUTEL-2010 y 5173-SUTEL-DGC-2012, con el fin de que
se proceda con la valoración de la extinción del título habilitante Acuerdo Ejecutivo n° 67-1994 y con la eventual recuperación del recurso escaso (canal 16 de televisión) por parte del Estado. (Folios 01 al 06 del expediente administrativo n° DCNR-TV-2014-01).

IV.- Que por medio del memorando n° MICITT-DERRTMEMO-015-2014, de fecha 14 de marzo del 2014, recibido en la Unidad de Control Nacional de Radio en esa misma fecha, la Dirección de Espectro Radioeléctrico y Redes de Telecomunicaciones remitió el informe técnico n° MICITT-GAERINF-033-2014, de fecha 14 de febrero del 2014 de la Gerencia de Administración del Espectro Radioeléctrico, acerca de la ocupación del espectro radioeléctrico concesionado a la empresa DONA NENA S. A., y la recomendación técnica de la Superintendencia de
Telecomunicaciones. Dicha Dirección indicó que “en el marco del ordenamiento del espectro radioeléctrico, y en vista de los principios rectores definidos en la Ley General de Telecomunicaciones (LGT), (…) se acoge el informe nº 5173-SUTEL-DGC-2012, en lo relativo al espectro radioeléctrico concesionado a Dona Nena S.A. (Canal 16, desde 482 MHz a 488 MHz). En la información analizada se observa: que aparentemente dicha concesionaria no cumple con la cobertura requerida, la no suscripción del respectivo contrato de concesión según lo dispuesto por el transitorio II del ya derogado Reglamento de Radiocomunicaciones, Decreto Ejecutivo nº 31608-G y sus reformas; y la no presentación de la información solicitada mediante oficio 1041-SUTEL-DGC-2012, por lo que no se pudo corroborar la ubicación de los puntos de transmisión”. (Folios 07 a 20 del expediente administrativo n° DCNR-TV-2014-01).

V.- Que mediante el Alcance nº 291 al Diario Oficial La Gaceta nº 235 de fecha 07 de diciembre del 2016, la Junta Administrativa del Registro Nacional del Ministerio de Justicia y Paz, comunica que de conformidad a lo dispuesto en el artículo 6 de la Ley nº 9024, Ley del Impuesto a las Personas Jurídicas, el Registro de Personas Jurídicas da a conocer que la sociedad DONA NENA S. A., con cédula de persona jurídica n° 3-101-110968 presenta morosidad con el pago del impuesto a las personas jurídicas por tres o más periodos consecutivos, motivo por el cual se
encuentra disuelta de pleno derecho. (Folios 22 a 26 del expediente administrativo n° DCNR-TV-2014-01).

VI.-Que mediante consulta realizada al Sistema de Certificaciones e Informes Digitales en línea del Registro Nacional en fecha 02 de junio del 2017, se constató que la empresa DONA NENA, S.A., con cédula de persona jurídica n° 3-101-110968, se encuentra disuelta conforme al artículo 6 de la Ley n° 9024, Ley del Impuesto a las Personas Jurídicas. (Folios 27 del expediente administrativo n° DCNR-TV-2014-01).

VII.- Que mediante certificación n° 40-SUTEL-2017 de las 09:00 horas del 12 de junio de 2017, suscrita por el Registro Nacional de Telecomunicaciones de la Superintendencia de Telecomunicaciones, se certificó que la empresa DONA NENA
S.A. cuenta con dos títulos habilitantes: los Acuerdos Ejecutivos n° 31-1994 de fecha 28 de febrero de 1994 y n° 67-1994 de fecha 26 de abril de 1994, citados en los considerandos primero y segundo del presente Acuerdo Ejecutivo. (Folios 28 a 32 del expediente administrativo n° DCNR-TV-2014-01)

VIII.- Que mediante certificación n° 071-2017 de las 14:00 horas del 09 de junio del 2017, suscrita por la funcionaria Alba Nidia Rodríguez Varela de la Unidad de Gestión Documental de la Dirección General de Operaciones de la Superintendencia de Telecomunicaciones, se certificó el expediente de la antigua Oficina de Control de Radio del Ministerio de Gobernación, cuyo original custodia la SUTEL, el cual se refiere al trámite de “Otorgamiento de frecuencia Canal 16”, mismo que tiene asignado el indicativo con el código TI-DN, y que se incorpora de manera integral al
expediente administrativo que lleva el Departamento de Normas y Procedimientos en Telecomunicaciones. (Folios 33 a 78 del expediente administrativo n° DCNR-TV-2014-01)

IX.- Que en fecha 13 de junio del 2017, el Departamento de Normas y Procedimientos en Telecomunicaciones emitió el informe técnico jurídico n° MICITT-DNPT-INF-184-2017 referente a la disolución de la empresa DONA NENA, S.A., mediante la aplicación del artículo 6 de la Ley n° 9024, Ley del Impuesto a las Personas Jurídicas, cuya condición configura una causal de mera constatación que permite extinguir una concesión (Acuerdos Ejecutivos n° 31-1994 del 28 de febrero de 1994 y ,° 67-1994 del 26 de abril de 1994) con fundamento en el artículo 22 inciso 2) subinciso e) de la Ley nº 8642, Ley General de Telecomunicaciones. Por lo tanto, dicho Departamento recomendó al Poder Ejecutivo acoger la recomendación para la extinción de los títulos habilitantes de marras, según el análisis realizado. (Folios 79 a 86 del expediente administrativo n° DCNR-TV-2014-01).

X.- Que con fundamento en lo dispuesto en los artículos 121 inciso 14) de la Constitución Política y 39 inciso d) de la Ley de Fortalecimiento y Modernización de las Entidades Públicas del Sector Telecomunicaciones, no existiendo razones de interés público ni de conveniencia institucional para separarse de las recomendaciones emitidas, el Poder Ejecutivo acoge integralmente, en el presente acto, su contenido y recomendaciones. Las recomendaciones técnicas que lo sustentan, referenciadas en los considerandos anteriores, consta en el expediente administrativo n° DCNR-TV-2014-01, de la Unidad de Control Nacional de Radio del Viceministerio de Telecomunicaciones (MICITT) para mayor abundamiento. Por tanto,

ACUERDAN:

Artículo 1º.- Declarar la extinción de las concesiones de uso del rango de frecuencias de 482 MHz a 488 MHz (Canal 16), otorgadas mediante Acuerdos Ejecutivos n° 31-1994 del 28 de febrero de 1994 y n° 67-1994 del 26 de abril de 1994 (para operar una estación radiodifusora de televisión entre sus estudios ubicados en San José y sus transmisores en Sabanilla de Alajuela y en el Cerro Cañas Dulces en Liberia, Guanacaste), a la extinta sociedad DONA NENA SOCIEDAD ANÓNIMA, la cual otrora ostentara la cédula de persona jurídica n° 3-101-110968, de conformidad con lo dispuesto en el artículo 22 inciso 2 subinciso e) de la Ley nº 8642, Ley General de Telecomunicaciones, y el principio de uso eficiente del espectro radioeléctrico.

Artículo 2º.- Solicitar a la Superintendencia de Telecomunicaciones que actualice las bases de datos sobre los registros de asignación del espectro radioeléctrico para que se considere como disponible el rango de frecuencias de 482 MHz a 488 MHz (Canal 16).

Artículo 3º.- Informar a la otrora empresa DONA NENA SOCIEDAD ANÓNIMA, o a cualquier interesado de la misma, sobre su derecho a recurrir el presente Acuerdo Ejecutivo, mediante el recurso de reposición el cual deberá ser presentado ante el Poder Ejecutivo en el plazo de tres (3) días hábiles a partir de la notificación del acuerdo, debiendo presentar su escrito en el Despacho del Ministro de Ciencia, Tecnología y Telecomunicaciones, sito en San José, de la esquina sureste de la Plaza de la Democracia, 150 metros al este; Avenida Segunda, Calles 17 y 19. Lo anterior de conformidad con el artículo 346 inciso 1) de la Ley General de
Administración Pública.

Artículo 4º.- Notificar el presente Acuerdo Ejecutivo a la otrora empresa DONA NENA SOCIEDAD ANÓNIMA, o a cualquier interesado de la misma, por el medio que conste dentro del expediente administrativo de la concesión que se está extinguiendo en este acto y que este mismo sea notificado a la Superintendencia
de Telecomunicaciones con el fin de ser inscrito en el Registro Nacional de Telecomunicaciones.

Artículo 5º.- Rige a partir de su notificación.

Dado en la Presidencia de la República, el día 11 de enero del año dos mil dieciocho.

LUIS GUILLERMO SOLÍS RIVERA.

Edwin Estrada Hernández, Ministro de Ciencia, Tecnología y Telecomunicaciones

14Ago/18

Decreto n° 41190-MP- MIDEPLAN-MICIT-MC, de 26 de junio de 2018

14 agosto, 2018Costa Rica, Decreto39372-MP-MC del 7 de diciembre de 2015 y 40199-MP del 27 de abril del DEL 2017. (Diario Oficial La Gaceta, año CXL, Costa Rica, de 26 de junio de 2018, Decreto n° 41190-MP- MIDEPLAN-MICIT-MC, La Uruca, miércoles 11 de julio del 2018)., nº 125, reforma a los Decretos Ejecutivos nº 38994-MP-PLAN-MICITT del 23 de abril del 2015, San JoséJosé Cuervo

Decreto n° 41190-MP- MIDEPLAN-MICIT-MC, de 26 de junio de 2018, reforma a los Decretos Ejecutivos nº 38994-MP-PLAN-MICITT del 23 de abril del 2015, 39372-MP-MC del 7 de diciembre de 2015 y 40199-MP del 27 de abril del DEL 2017. (Diario Oficial La Gaceta, año CXL, nº 125, La Uruca, San José, Costa Rica, miércoles 11 de julio del 2018).

EL PRESIDENTE DE LA REPÚBLICA, EL MINISTRO DE LA PRESIDENCIA,
LA MINISTRA DE PLANIFICACIÓN NACIONAL Y POLÍTICA ECONÓMICA
EL MINISTRO DE CIENCIA, TECNOLOGÍA Y TELECOMUNICACIONES Y EL
MINISTRO DE COMUNICACIÓN

Con fundamento en los artículos 27, 30, 140 inciso 18) y 146 de la Constitución Política, los artículos 25.1) y 27.1) de la Ley General de la Administración Pública, Ley nº 6227 de 2 de mayo de 1978; el artículo 19 de la Ley de Planificación Nacional, Ley nº 5525 de 2 de mayo de 1974;

Considerando:

I.- Que mediante Decreto Ejecutivo n° 38994-MP-PLANMICITT del 29 de abril de 2015, denominado Fomento del Gobierno Abierto en la Administración Pública y Creación de la Comisión Nacional para un Gobierno Abierto, se crea la Comisión Nacional por un Gobierno Abierto con el objetivo de coordinar y facilitar la
implementación del Gobierno Abierto en la Administración Pública, acompañando la formulación y evaluación de los planes nacionales de acción que sobre la materia se determinen necesarios.

II.- Que por medio del Decreto Ejecutivo n° 40199-MP del 27 de abril de 2017, denominado Apertura de Datos Públicos, se crea la Comisión Nacional de Datos Abiertos cuyo objetivo es la aplicación e implementación de la Política Nacional de Apertura de Datos de Carácter Público en el país, así como promover la transparencia gubernamental, la lucha contra la corrupción, la colaboración con la ciudadanía, la innovación y el crecimiento económico en la era digital.

III.- Que la temática de Gobierno Abierto, es un paradigma de organización multidireccional, colaborativo y transparente, entre la administración, la ciudadanía y los distintos actores de la sociedad civil, el cual constituye una nueva cultura de la comunicación gubernamental, donde la utilización de nuevas tecnologías, resulta
en un elemento primario para facilitar el acceso a la información, la lucha contra la corrupción, la participación ciudadana, y la generación procesos de co-creativos.

IV.- Que al ser la comunicación, el sustento de todos los procesos multidimensionales que un modelo de Gobierno Abierto requiere, se convierte en un eje transversal necesario para alcanzar, fomentar, y promocionar la Estrategia Nacional de Gobierno Abierto, los compromisos asumidos por Costa Rica en la Alianza para el Gobierno Abierto (Open Government Partnership) y la Política Nacional de Apertura de Datos de Carácter Público.

V.- Que en aras de facilitar la generación de procesos comunicación, la transparencia, el acceso a datos públicos abiertos, el uso de nuevas tecnologías y la rendición de cuentas, entre los distintos actores de la sociedad civil y los órganos y entes estatales de la administración pública, es necesaria la participación y liderazgo
del Ministerio de Comunicación. Por lo tanto,

Decretan:

REFORMA A LOS DECRETOS EJECUTIVOS NÚMERO 38994-MP-PLAN-MICITT DEL 23 DE ABRIL DEL 2015, 39372-MP-MC DEL 7 DE DICIEMBRE DE 2015 Y 40199-MP DEL 27 DE ABRIL DEL 2017

Artículo 1º.- Modifíquense los artículos 5 inciso 1) y 10 del Decreto Ejecutivo número 38994-MP-PLAN-MICITT del 23 de Abril del 2015, denominado Fomento del Gobierno Abierto en la Administración Pública y Creación de la Comisión Nacional para un Gobierno Abierto para que en adelante se lean:

“[…] Artículo 5º—Integración de la Comisión. La CNGA estará integrada por un representante propietario y un único suplente de cada una de las siguientes entidades y organizaciones:
1. El (la) Ministro(a) de Comunicación, destinado(a) al efecto, quien presidirá la Comisión. (…)
Artículo 10.—Jerarquía: La CNGA estará adscrita al Ministerio de la Comunicación, y este facilitará los recursos humanos y materiales para la adecuada gestión de la Comisión y sus Subcomisiones. […]”

Artículo 2º.- Modifíquense el artículo 8 y el párrafo primero del numeral 9 del Decreto Ejecutivo número 40199-MP del 27 de Abril del 2017, denominado Apertura de Datos Públicos, para que en adelante se lean:
“[…] Artículo 8.- Comisión Nacional de Datos Abiertos.(…)
La Comisión será presidida por el Ministerio de Comunicación en su función de rector de Gobierno Abierto y tendrá una conformación multisectorial.
La representación tendrá un propietario y un único suplente, ambos capacitados y con conocimiento acreditado en materia de datos abiertos, de cada una de las siguientes entidades y organizaciones:
1. Ministerio de Comunicación. (…)”
Artículo 9- La Secretaría Técnica de la Política Nacional de Apertura de Datos Públicos.
La Secretaría Técnica de la Política Nacional de Apertura de Datos Públicos se crea en el Ministerio de Comunicación con las siguientes funciones […]”

Artículo 3º.- Modifíquese el artículo 2 del Decreto Ejecutivo número 39372-MP-MC del 7 de diciembre de 2015, que Declara de Interés Público la Estrategia Nacional para un Gobierno Abierto 2015-2018, para que en adelante se lea:
“Artículo 2º—El documento que contiene la Estrategia Nacional para un Gobierno Abierto 2015-2018, se encuentra disponible en la dirección electrónica gobiernoabierto.go.cr. Una versión física se custodiará en el Ministerio de Comunicación.”

Artículo 4º.- Rige a partir de su publicación en el Diario Oficial.

Dado en la Presidencia de la República.

San José a los veintiséis días del mes de junio de dos mil dieciocho.

CARLOS ALVARADO QUESADA.

El Ministro de Presidencia, Rodolfo Piza Rocafort.

La Ministra de Planificación Nacional y Política Económica, María del Pilar Garrido Gonzalo.

El Ministro de Ciencia y Tecnología y Telecomunicaciones, Luis Adrián Salazar.

El Ministro de Comunicación, Juan Carlos Mendoza García.

14Ago/18

Decreto nº DIP-004-2018-MICITT del 11 de julio de 2018

14 agosto, 2018Costa Rica, Decretoaño CXL, Costa Rica, Decreto nº DIP-004-2018-MICITT del 11 de julio de 2018 del Ministerio de Ciencia, La Uruca, lunes 13 de agosto del 2018)., nº 145, San José, Tecnología y Telecomunicaciones. (Diario Oficial La GacetaJosé Cuervo

Decreto nº DIP-004-2018-MICITT del 11 de julio de 2018 del Ministerio de Ciencia, Tecnología y Telecomunicaciones. (Diario Oficial La Gaceta, año CXL, nº 145, La Uruca, San José, Costa Rica, lunes 13 de agosto del 2018).

EL PRESIDENTE DE LA REPÚBLICA Y EL MINISTRO DE CIENCIA, TECNOLOGÍA
Y TELECOMUNICACIONES

En uso de las facultades conferidas en los incisos 3) y 18) del artículo 140 y el artículo 146 de la Constitución Política de la República de Costa Rica; el inciso 1) del artículo 25 y el inciso 2.b) del artículo 28 de la Ley nº 6227, “Ley General de la Administración Pública”, publicada en el Diario Ofcial La Gaceta ,n° 102, Alcance
n° 90 del 30 de mayo de 1978; el artículo 8° de la Ley nº 7169, “Promoción Desarrollo Científco y Tecnológico y Creación del MICITT”, publicada en el Alcance n° 23 del Diario Ofcial La Gaceta n° 144 del 01 de agosto de 1990; y el artículo 1° inciso i) del Decreto Ejecutivo n° 20604-MICITT, “Reglamento Ley Promoción
Desarrollo Científco y Tecnológico n° 7169”, publicado en el Diario Ofcial La Gaceta n° 163 del 29 de agosto de 1991.

Considerando que:

1º.- La Asociación Estrategia Siglo XXI para el Desarrollo del Conocimiento y la Innovación, organiza el “Foro sobre El Hidrógeno en la Des-carbonización del Transporte en Costa Rica” (Foro de Hidrógeno CR), que se llevará a cabo en el Hotel Intercontinental en San José Costa Rica, los días 13 y 14 de agosto
del 2018.

2º.- La referida actividad resulta trascendental en la medida que abrirá un amplio espacio de discusión sobre la implementación de una de las tecnologías que contribuirá a sustituir los combustibles fósiles tradicionales por un combustible limpio, renovable y de producción doméstica que asimismo presenta oportunidades de innovación tecnológica autóctona para nuestro país y la región. El Foro de Hidrógeno CR promueve el uso de la ciencia y la tecnología como motor de competitividad y crecimiento del sector productivo nacional.

3º.- El fn primordial del “Foro de Hidrógeno CR”, es la educación en el uso del hidrógeno como un vector energético limpio y renovable. La proyección del evento es informar, disminuir el desconocimiento o incertidumbre, aclarar dudas y discutir o dialogar sobre el papel del hidrógeno en la gama de tecnologías alternativas
a los hidrocarburos en el área de transportes; así como profundizar sobre su potencial implementación a futuro en Costa Rica.

4º.- Según Dr-Ing. Paola Vega Castillo, Viceministra de Ciencia y Tecnología, “tras analizar la descripción del evento “Foro sobre El Hidrógeno en la Des-carbonización del Transporte en Costa Rica” (Foro de Hidrógeno CR), propuesto por la Asociación
Estrategia Siglo XXI, se determinó que efectivamente se trata de un evento tecnológico sin fnes de lucro, el cual resulta de gran importancia para lograr insumos para el análisis del posible uso de hidrógeno como parte de la estrategia de carbono neutralidad del país, al ser la matriz energética del sector transportes una fuente
importante de emisiones de dióxido de carbono. Por esta razón, se recomienda otorgar la Declaratoria de Interés Público para este evento”.

5°.- De conformidad con el artículo 8° de la Ley nº 7169, “Promoción Desarrollo Científco y Tecnológico y Creación del MICITT”, todas las actividades científcas y tecnológicas sin fnes de lucro, realizadas por las entidades que forman parte del Sistema Nacional de Ciencia y Tecnología, son de interés público. Por tanto,

ACUERDAN:

DECLARAR DE INTERÉS PÚBLICO EL “FORO SOBRE EL HIDRÓGENO EN LA DES-CARBONIZACIÓN DEL TRANSPORTE EN COSTA RICA (FORO DE HIDRÓGENO CR)

Artículo 1º.- Con fundamento en el artículo 8° de la Ley nº 7169, “Promoción Desarrollo Científco y Tecnológico y Creación del MICITT”, se declara de interés público el “Foro sobre El Hidrógeno en la Des-carbonización del Transporte en Costa
Rica” (Foro de Hidrógeno CR), el cual se realizará en el Hotel Intercontinental en San José Costa Rica, los días 13 y 14 de agosto del 2018.

Artículo 2º.- Se insta a las entidades públicas y privadas, para que en la medida de sus posibilidades y dentro de la normativa jurídica vigente, contribuyan con el aporte de recursos económicos, logísticos y técnicos para la exitosa realización de la actividad mencionada.

Artículo 3º.- Rige los días 13 y 14 de agosto del 2018.

Dado en la Presidencia de la República, San José, a los once días de julio del dos mil dieciocho.

CARLOS ANDRÉS ALVARADO QUESADA.

El Ministro de Ciencia, Tecnología y Telecomunicaciones, Luis Adrián Salazar Solís.

01Ago/18

Lei de Proteção de Dados Pessoais aproxima o Brasil dos Países Civilizados

1 agosto, 2018Protección de Datos, TrabajosLei de Proteção de Dados Pessoais aproxima o Brasil dos Países CivilizadosJosé Cuervo

LEI DE PROTEÇÃO DE DADOS PESSOAIS APROXIMA O BRASIL DOS PAÍSES CIVILIZADOS

Demócrito Reinaldo Filho

Desembargador do TJPE

Na última terça-feira (10/07), foi aprovada por unanimidade no Senado a Lei Geral de Proteção de Dados (LGPD), originada do PLC 53/18 [1], da Câmara dos Deputados, que agora segue para sanção presidencial. O projeto tramitou por cerca de oito anos no legislativo, após passar por diversas comissões e sofrer diversos ajustes na versão original.

A Lei disciplina o uso, a proteção e transferência de dados pessoais, garantindo aos cidadãos maior controle sobre suas informações. A lei brasileira sofreu influência da regulação europeia sobre dados pessoais, conhecida como Regulamento Geral de Proteção de Dados (RGPD)[2], que entrou em vigor no dia 25 de maio deste ano.

Dentre outras inovações, o texto aprovado no Senado com 65 artigos distribuídos em 10 capítulos exige o consentimento explícito do titular para a coleta e uso dos seus dados por terceiros, conferindo-lhe a possibilidade de exigir a correção e exclusão dos dados. A Lei ainda prevê a criação de um órgão responsável pela sua aplicação: a Autoridade Nacional de Proteção de Dados (ANPD), que terá a forma de uma autarquia especial vinculada ao Ministério da Justiça. Ainda prevê punições para o caso de infrações ou descumprimento de seus dispositivos, que variam de uma simples advertência até multa no limite de 50 milhões de reais, podendo haver também proibição parcial ou total do exercício de atividade da empresa que comete o ato infracional, dependendo da gravidade da infração. A lei será aplicável mesmo para empresas que tenham sede no exterior, desde que a operação de tratamento de dados seja realizada envolvendo pessoas que tenham residência no Brasil.

O projeto da lei geral de proteção de dados pessoais tramitava há muito tempo e ganhou impulso não somente depois do momento de entrada em vigor de sua congênere europeia, mas sobretudo depois que eclodiu o escândalo de vazamento de dados dos usuários do Facebook, transmitidos e utilizados para fins políticos sem o consentimento deles por uma empresa parceira dessa rede social, a Cambridge Analytica[3]. A divulgação desse caso teve repercussão em todo mundo, trazendo a questão da proteção de dados pessoais para o centro dos debates políticos, inclusive forçando o CEO do Facebook, Mark Zuckerberg, a prestar esclarecimentos perante uma comissão do Congresso dos EUA [4]. No Brasil, o efeito imediato foi a agilização do projeto da lei geral de proteção de dados pessoais, que foi votada em regime de urgência pelo plenário do Senado.

A expectativa é que o Presidente Temer sancione a Lei sem vetos significativos, mas só entrará em vigor dentro de 18 meses, prazo suficiente para que as empresas e o setor público se adequem às suas exigências.

O Brasil vinha perdendo oportunidades de investimento financeiro internacional em razão do “isolamento jurídico” por não dispor de uma lei geral de proteção de dados pessoais. A União Europeia, por exemplo, veda a transferência de dados de cidadãos europeus para empresas de outros países que não têm um “nível adequado” de proteção de dados pessoais, e o Brasil até então era enquadrado na categoria das nações que não protege de maneira satisfatória a privacidade e intimidade das pessoas. Como se costuma dizer, os dados hoje são “o petróleo” da nova economia da informação e o nosso país estava em desvantagem em relação a outros países que já tinham adotado legislação semelhante.

O Brasil chega excessivamente tarde na regulamentação do assunto da proteção de dados pessoais. O chamado Regulamento Geral de Proteção de Dados (RGPD), que serviu como modelo para a legislação brasileira, foi na verdade uma reforma das regras de proteção de dados na União Europeia, que já contava com uma Diretiva sobre o assunto desde 1995 (a Diretiva 95/46/CE)[5]. Leis específicas de proteção de dados pessoais começaram a surgir a partir da década de 70, com o advento das tecnologias da informação. Em 1970, o Estado alemão de Hesse editou a primeira lei sobre essa matéria. A Suécia contava com o Datalegen, Lei 289 de 11 de maio de 1973. Desde 1977, a Alemanha tinha uma lei federal de proteção de uso ilícito de dados pessoais. A Dinamarca regulamentava a questão da proteção de dados pelas Leis 243 e 244, ambas de 08 de julho de 1978, que estenderam a proteção também para as pessoas jurídicas. A França tinha a Lei 78-77, de 06 de janeiro de 1978. Até mesmo na América do Sul muitos países já contavam com leis que protegem a intimidade e a privacidade das pessoas contra coleta e processamento indevidos de dados individuais. A Argentina tem leis de proteção de dados pessoais em vigor desde 1994. A lei chilena é de 1999 e o Peru criou sua legislação de proteção de dados em 2011. No Uruguai o direito à proteção de dados está previsto em lei editada em 2008. A Colômbia aprovou sua lei de proteção de dados em 2010.

De qualquer maneira, embora tardiamente o Brasil editou sua lei geral de proteção de dados pessoais. Essa é uma Lei que traz ao mundo do direito a importância que os dados pessoais já possuem para a economia digital, onde são considerados “o novo petróleo”, como se disse. É analisando e interpretando grandes quantidades de dados e de grande variedade que as empresas hoje funcionam. Dependem e extraem soluções do Big Data, termo que descreve o grande volume de dados – estruturados e não estruturados – que impactam a vida das empresas diariamente. As organizações coletam dados de fontes variadas, incluindo transações financeiras, redes sociais e informações de sensores ou dados transmitidos de máquina para máquina. No passado, armazená-los teria sido um problema, mas novas tecnologias facilitaram essa atividade.

A utilização dos dados, contudo, não pode ser feita de maneira indiscriminada ou sem limite por corporações empresariais ou por órgãos do governo. O processamento de informações envolve diversos problemas como o uso indevido dos dados, sobretudo quando se combina Big Data com machine learning[6] para construção de modelos analíticos e tomada de decisões. A grande questão e que gera preocupações é a do controle dos indivíduos pelas grandes empresas de tecnologia e pelos governos. Quem controla os dados, controla a vida das pessoas. Por isso o Direito se preocupa com o que as organizações fazem com eles.

A nova lei cria mecanismos para que os indivíduos tenham o controle sobre seus dados, para que possam decidir sobre suas próprias vidas.

Recife, 11 de julho de 2018.

[1] https://www25.senado.leg.br/web/atividade/materias/-/materia/133486

[2] https://eur-lex.europa.eu/legal-content/PT/TXT/HTML/?uri=CELEX:32016R0679&from=EN

[3] Ver notícia publicada pelo jornal El País, pulicada em 20.03.18, acessível em: https://brasil.elpais.com/brasil/2018/03/19/internacional/1521500023_469300.html

[4] Ver notícia publicada em 11.04.18, acessível em: https://www.tecmundo.com.br/redes-sociais/129169-mark-zuckerberg-depoe-congresso-eua-confira-destaques.htm

[5] Para quem se interessar em conhecer as linhas gerais da revogada Diretiva 95/46/CE, sugiro a leitura do meu artigo intitulado “A Diretiva Europeia sobre Proteção de Dados Pessoais – uma Análise de seus Aspectos Gerais”, publicado na Revista Lex Magister, acessível em: http://www.lex.com.br/doutrina_24316822_A_DIRETIVA_EUROPEIA_SOBRE_PROTECAO_DE_DADOS_PESSOAIS__UMA_ANALISE_DE_SEUS_ASPECTOS_GERAIS.aspx

[6] Aprendizado de máquina (em inglês, machine learning) é um método de análise de dados que automatiza a construção de modelos analíticos. É uma vertente da inteligência artificial que se baseia na ideia de que sistemas podem aprender com dados, identificar padrões e tomar decisões com o mínimo de intervenção humana.

10Jul/18

Lei nº 133/V/2001, de 22 de Janeiro, estabelece o regime jurídico de tratamento de dados pessoais a pessoas singulares

10 julio, 2018Cabo Verde, Leyde 22 de Janeiro, Derecho Informático, estabelece o regime jurídico de tratamento de dados pessoais a pessoas singulares, Legislacion de Cabo Verde, Lei nº 133/V/2001José Cuervo

Lei nº 133/V/2001, de 22 de Janeiro, estabelece o regime jurídico de tratamento de dados pessoais a pessoas singulares

O Programa do Governo para o sector da justiça confere especial importância à reforma e modernização legislativas.

Com efeito, estabelece aquele Programa que o Governo promoverá a aprovação de «legislação que assegure … a tutela jurídica a um grande número de direito e a punição de inúmeras violações de lei, hoje praticamente sem garantia ou resposta…»

O domínio da protecção dos direitos, liberdades e garantias fundamentais dos cidadãos, designadamente o da protecção de dados pessoais, é, seguramente, um dos que carece de uma profunda regulamentação.

Trata-se de um domínio de capital importância e que mereceu consagração expressa no texto constitucional.

Efectivamente, a Constituição de República regula (artigo 44º), de forma relativamente pormenorizada ,a matéria de utilizaçao de meios informáticos e protecção de dados pessoais, estabelecendo (artigo 44º, nº 1), que todos «os cidadãos têm direitos de acesso aos dados informatizados que lhes digam respeito, podendo exigir a sua rectificação e actualização, bem como o direito de conhecer a finalidade a que se destinam, nos termos da lei». Estabelece, ainda, a Constituição da República ( artigo 44º, nº 3) que a «lei regula a protecção de dados pessoais constantes dos registos informáticos, as condições de acesso aos bancos de dados de constituição e de utilização por autoridades públicas e entidades privadas de tais bancos ou de suportes informáticos dos mesmos».

É, pois, neste contexto político-constitucional que se insere a aprovação da presente lei, a qual regulamenta o texto constitucional e surge com o regime quadro em mat´eria de protecção de dados pessoais.

A lei estabelece com clareza o regime dos direito dos titulares dos dados («direito de informação», «direito de acesso», «direito de opção» e «direito de não sujeição a decisão individuaais automatizadas»), regime esse de capital importância para a salvaguardar dos direitos, liberdades e garantias. Fundamentais dos cidadãos consagrados na Constituição da República.

A matéria de segurança e confidencialidade dos dados foi, também, objecto de um cuidadoso regime, salvaguardadopelo sigilo profissional, enquanto elemento de garantía do seu cumprimento rigoroso.

Estabeleceram-se importantes princípios relativos à transferências de dados pessoas, atribuindo a comissões parlamentar de fiscalização um papel de capital importância, bem como os casos de derrogação.

A fiscalização do cumprimento de toda a legislação em matéria protecção de dados pessoais foi atribuída à Assembleia Nacional, através de uma comissão parlamentar, a ser criado por lei específica, com natureza de autoridade administrativa independente e com amplos poderes de autoridade, quer de fiscalização prévia, quer à posteriori. A fiscalização pelo parlamento não dispensa, contudo, a fiscalização jurisdicional, através dos tribunais.

Para garantir o respeito pelos direitos, liberdades e garantias fundamentais dos cidadãos, o diploma estabelece um leque importante de infracções e sanções, distinguindo os casos de contra-ordenação dos de crimes.

Assim,

Tornando-se pois, necessário proceder à regulamentação do texto constitucional;

Por mandato do Povo, a Assembleia Nacional decreta, nos termos da alínea b) do artigo 147º e m) do artigo 175º da Constituição, o seguinte:

CAPÍTULO I.- Disposições gerais

Artigo 1º.- (Objecto)

A presente lei estabelece o regime jurídico geral de protecção de protecção de dados pessoais das pessoas singulares.

Artigo 2º (Âmbito de aplicação)

1. A presente lei aplica-se ao tratamento de dados pessoais por meios total ou parcialmente automatizados, bem como ao tratamento por meio não automatizados de dados pessoais contidos em ficheiros manuais ou a estes destinados.

2. A presente lei aplica-se ao tratamento de dados pessoais efectuados:

a) No âmbito das actividades de estabelecimento do responsável do tratamento situado em território nacional;

b) Fora do território nacional, em local onde a legislação cabo-verdiana seja aplicável por força do direito internacional;

c) Por responsável que, não estando estabelecido no território nacional, recorra, para tratamento de dados pessoais, a meios, automatizados ou não, situados no território nacional, salvo se esses meios só forem utilizados para trânsito.

3. A presente lei aplicá-se à video-vigilância e outras formas de captação, tratamentos e difusão de sons e imagens que permitam identificar pessoas sempre que o responsável pelo tratamento esteja domicialiado ou sediado em território nacional ou recorra a um fornecedor de acesso a redes informáticas e telemáticas aí estabelecido.

4. No caso referido na alínea c) do n.º 2, o responsável pelo tratamento deve designar, mediante comunicação à Comissão Parlamentar de Fiscalização, um representante estabelecido em território nacional, que se lhe substitua em todos os seus direitos e obrigações, sem prejuízo da sua própria responsabilidade.

5. O disposto no número anterior aplica-se no caso de o responsável pelo tratamento estar abrangido por estatuto de extraterritorialidade, de imunidade ou por qualquer outro que impeça o procedimento criminal.

6. A presente lei aplica-se ao tratamento de dados pessoais que tenham por objectivo a segurança pública, a defesa nacional e a segurança do Estado, sem prejuíso do disposto em normas especiais constantes de instrumentos de direito internacinal a que Cabo Verde se vincule e de legislação específica atinente aos respectivos sectores.

Artigo 3º.- (Exclusão do âmbito de aplicação)

A presente lei não se aplica ao tratamento de dados pessoais efectuados por pessoas singulares no exercício de actividades exclusivamente pessoais ou doméstica.

Artigo 4º.- (Princípios geral)

O tratamento de dados pessoais deve processar-se de forma transparente e no estrito respeito pela reserva da intimidade da vida privada e familiar, bem como pelos direitos, liberdades e garantias fundamentais do cidadão.

Artigo 5º.- (Definições)

1. Para efeitos da presente lei, entende-se por:

a) «Dados pessoais»: qualquer informação, de qualquer natureza é independentemente do respectivo suporte, incluindo som e imagem relativa a uma pessoa singular identificada ou identificável, «títular dos dados»;

b) «Tratamento de dados pessoais» ou «Tratamento»: qualquer operação ou conjunto de operações sobre dados pessoais efectuadas, total ou parcialmente, com ou sem meios autorizados, tais como a recolha, o registo, a organização, a conversação , a adaptação ou alteração, a recuperação, a consulta, a utilização, a comunicação por transmissão, por difusão ou por qualquer outra forma de colocação à disposição, com comparação ou interconexão, bem como o bloqueio, o apagamento ou a destruição;

c) «Ficheiro de dados pessoais» ou «Ficheiro»: qualquer conjunto estruturados de dados pessoais, acessível segundo critérios determinados, quer seja centralizados, descentralizados ou repartido de modo funcional ou geográfica;

d) «Responsável pelo tratamento»: a pessoa singular ou colectiva, a autoridade pública o serviço ou qualquer outro organismo que, individualmente ou em conjunto com outrem, determine as finalidades e os meios de tratamentos dos dados pessoais;

e) «Subcontratante»: a pessoa singular ou colectiva, a autoridade pública o serviço, ou qualquer outro organismo que trate os dados pessoais por conta do responsável pelo tratamento;

f) «Terceiro»: a pessoa singular ou colectiva, a autoridade pública, o serviço ou qualquer outro organismo que, não sendo o titular dos dados, o responsável pelo tratamento, o subcontratante ou outra pessoa sob autoridade directa do responsável pelo tratamento ou do subcontratante, esteja habilitado a tratar os daos;

g) «Destintário»: a pessoa singuar ou colectiva, a autoridade pública, o serviço ou qualquer outro organismo a quem sejam comunicados dados pessoais, independentemente de se tratar ou não de um terceiro, sem prejuízo de não serem consideradas destinatários as autoridaes a quem sejam comunicados dados no âmbito de uma disposição legal;

h) «Consentimento do titular dos dados»: qualquer manifestação de vontade, livre, específica e informada, nos termos da qual o titular que os seus dados pessoais sejam objectos de tratamento;

i) « Interconexão de dados»: forma de tratamento que consiste na possibilidade de relacionamento dos dados de um ficheiro com os dados de um ficheiro ou ficheiros mantidos por outro ou outros responsáveis, ou mantidos pelo mesmo responsável com outra finalidade.

2. Para efeito do disposto na alínea a) do número anterior, é considerada identificável a pessoa que possa ser identificada, directa ou indirectamente, designadamente por referencia a um número de identificaçaõ ou a um ou mais elementos específicos da sua identidade física, fisiologica, psíquica, económica, cultural ou social.

3. Para efeito do disposto na alínea d) do número anterior, sempre que as finalidades e os meios de tratamento sejam determinados por disposições legislativas ou regulamentares, o responsável pelo tratamento deve ser indicado na lei de organização e funcionamento ou no estatuto da entidade legal ou estatutariamente competente para tratar dos dados pessoais em causa.

CAPÍTULO II.- Tratamento de dados pessoais

SECÇÃO I.- Qualidades de dados e legitimidade do seu tratamento

Artigo 6º.- (Qualidade dos dados)

1. Os dados pessoais devem ser:

a) Tratados de forma legal, lícita e com respeito pelo princípio da boa fé;

b) Recolhidos para finalidades determinadas, explicitas e legítimas, não podendo ser posteriormente tratados de formas incompatível com essas finalidades;

c) Adequados, pertinentes e não excessivos relativamentes às finalidades para que não são recolhidos e posteriormente tratados;

d) Exactos e, se necessários, actualizados, devendo ser tomadas as medidas adequadas para assegurar que sejam apagados ou rectificados inexactos ou incompleto, tendo em conta as finalidades para que não foram recolhidos ou para que são tratados posteriormente;

e) Conservar de forma a permitir a identificação dos seus titulares apenas durante o período necessário para a prossecução das finalidades da recolha ou do tratamento posterior.

2. Tratamento posterior dos dados para fins históricos, estatísticos ou científicos bem como a sua conservação para os mesmos fins por período superior ao referido na alínea e) do número anterior, podem ser autorizados pela Comissão Parlamentar de Fiscalização em caso de interesse legítimo do responsável pelo tratamento, desde que não prevaleçam os direitos, liberdades e garantias do titular de dados .

3. Cabe ao responsável pelo tratamento assegurar a observância do disposto nos números anteriores .

Artigo 7º.- (Condições de legitimidade do tratamento de dados)

O tratamento de dados pessoais só pode ser efectuado se o seu titular tiver dado de forma inequívoca o seu consentimento ou se o tratamento for necessário para:

a) Execução de contrato em que o titular dos dados seja parte ou de diligências prévias efectuadas a seu pedido;

b) Cumprimento de obrigação legal a que o responsável pelo tratamento esteja sujeito;

c) Protecção de interesses vitais do titular dos dados, se este estiver física ou legalmente incapaz de dar o seu consentimento;

d) Execução de uma missão de interesse público ou no exercício de autoridade pública em que esteja investido o responsável pelo tratamento ou um terceiro a quem os dados sejam comunicados;

e) Prossecução de interesses legítimos do responsável pelo tratamento ou de terceiro a quem os dados sejam comunicados, desde que não prevalecem os interesses ou os direitos, liberdades e garantias do titular dos dados.

Artigo 8º.- (Tratamento de dados sensíveis)

1. É proibido o tratamento de dados pessoais relativos às convicções ou punições políticas, filosóficas ou ideológicas, à fé religiosa, à filiação partidária ou sindical, à origen racial ou étnica, à vida privada, à saúde e à vida sexual, incluindo os dados genéticos, salvo:

a) Mediante consentimento expresso do titular, com garantias de não discriminação e com as medidas de segurança adequadas;

b) Mediante autorização prevista na lei, com garantias de não discriminação e com as medidas de segurança adequadas;

c) Quando se destinem a processamento de dados estatísticos não individualmente identífiacáveis, com as medidas de segurança adequadas.

2. Na concessão de autorização prevista na alínea b) do número anterior a lei deve ater-se, designadamente, à indispensabilidade do tratamento dos dados pessoais referidos no n.º 1 para o exercício das atribuições legais ou estatutárias do seu responsável, por motivos de interesse público importante.

3. O tratamento dos dados referidos no n.º 1 é ainda permitido quando se verificar uma das seguintes condições:

a) Ser necessário para proteger interesses vitais do titular dos dados ou de uma outra pessoa e o titular dos dados estiver física ou legalmente incapaz de dar o seu consentimento;

b) Ser efectuado, com o consentimento do titular, por fundação, associação ou organismo sem fins lucrativos de caráter político, filosófico, religioso ou sindical, no âmbito das suas actividades legítimas, sob condição de o tratamento respeitar apenas aos membros dessa fundação, associação ou desse organismo ou às pessoas com quem ele mantenha contactos períodicos ligados às suas finalidades legítimas, e de os dados não serem comunicados a terceiros sem consentimento dos seus titulares;

c) Dizer respeito a dados manifestamente tornados públicos pelo seu titular, desde que se possa legitimamente deduzir das suas declarações oconsentimento para o tratamento dos mesmos;

d) Ser necessário à declaração, exercício ou defesa de um direito em proceso judicial e for efectuado exclusivamente com essa finalidade.

4. O tratamento dos dados pessoais referentes à saúde e à vida sexual, incluindo os dados genéticos, é permitido quando for necessário para efeitos de medicina preventiva, de diagnóstico médico, de prestação de cuidados ou tratamentos médicos ou de gestão de serviços de saúde, desde que o trtamento desses dados seja efectuado por um profissional de saúde obrigado ao segredo profissional ou por outra pessoa igualmente sujeita a uma obrigação de segredo equivalente, tenha sido notificada a Comissão Parlamentar de Fiscalização nos termos do artigo 23º, e sejam garantidas medidas adequadas de segurança da informação.

5. O tratamento dos dados referidos no número 1 pode ainda ser efectuado, com medidas adequadas de segurança da informação, quando se mostrar indispensável à protecção da segurança do Estado, da defessa da segurança públic e da prevebção, investigação ou repressão de infracções penais.

Artigo 9º.- (Registos de actividades ilícitas, condenações penais, medidas de segurança, infracções e contra-ordenações)

A criação e a manutenção de registos centrais relativos a pessoas suspeitas de actividades ilícitas, condenações penais, decisões que apliquem medidas de segurança, coimas e sanções acessórias e infracções e contra-ordenações só podem ser mantidas por serviços públicos com essa competência legal, observando normas procedimentais e de protecção de dados previstas em diploma legal.
O tratamento de dados pessoais relativos a suspeitas de actividades ilícitas, condenações penais, decisões que impliquem medidas de segurança, coimas e sanções acessórias e infracções e contra-ordenações pode ser autorizado, observadas as normas de protecção de dados e de segurança da informação, quando tal tratamento for necessário à execução de finalidades legítimas do seu responsável, desde que não prevaleçam os direitos, liberdades e garantias do titular dos dados.
O tratamento de dados pessoais para fins de investigação policial deve limitar-se ao necessário para a prevenção de um perigo concreto ou repressão de uma infracção determinada, para o exercício de competência previstas no respectivo estatuto orgânico ou noutra disposição legal e ainda nos termos de acordo, tratamento ou convenção internacional internacional de que Cabo Verde seja parte.

Artigo 10º.- (Interconexão de dados pessoais)

Sem prejuízo de proibição expressa na lei, a interconexão de dados pessoais que não esteja estabelecida em disposição legal está sujeita a autorização da Comissão Palamentar de Fiscalização solicitada pelo responsável ou em conjunto pelos correspondentes responsáveis dos tratamentos, nos termos do artigo 23º.
A interconexão de dados pessoais deve ser necessária e adequada à prossecução das finalidades legais ou estatutárias e de interesses legítimos dos responsáves dos tratamentos, não implicar discriminação ou diminuição dos direitos, liberdades e garantias fundamentais dos titulares dos dados, ter em conta o tipo de dados objecto de interconexão e ser rodeada de adequadas medidas de segurança.

SECÇÃO II.- Direitos do titular dos dados

Artigo 11º.- (Direito de informação)

1. Quando recolher dados pessoais directamente do seu titular, o responsável pelo tratamento ou o seu representante deve prestar-lhe, salvo se já forem dele conhecidas, as seguintes informações:

a) Identidade do responsável pelo tratamento e, se for caso disso, do seu representante;

b) Finalidades do tratamento;

c) Os destinatários ou categorias de destinatários dos dados;

d) O carácter obrigatório ou facultativo da resposta, bem como as possíveis consequências se não dados;

e) A existência e as condições do direito de acesso e de rectificação, desde que sejam necessárias, tendo em conta as circunstâncias específicas da recolha dos dados, para garantir ao seu titular um tratamento leal dos mesmos;

f) A decisão de comunicação dos seus dados pessoais pela primeira vez a terceiros para os fins previstos na alínea b) do artigo 13º, previamente e com a indicação expressa de que tem direito de se opor a essa comunicação;

g) A decisão de os seus dados pessoais serem utilizados por conta de terceiros, previamente e com a indicação expressa de que tem o direito de se opor a essa utilização.

2. Os documentos que sirvam de base à recolha de dados pessoais devem conter as informações constantes do número anterior.

3. Se os dados não forem recolhidos junto do seu titular e salvo se dele já forem conhecidas, o responsável pelo tratamento, ou o seu representante, deve prestar-lhe as informações previstas no número 1 no momento do registo dos dados ou, se estiver prevista a comunicação a terceiros, o mais tardar aquando da primeira comunicação desses dados.

4. No caso de recolha de dados em redes abertas, o titular dos dados deve ser informado, salvo se disso já tiver conhecimento, de que os seus dados pessoais podem circular na rede sem condições de segurança, correndo o resco de serem vistos e utilizados por terceiros não autorizados.

5. A obrigação de informação é dispensada por motivos de segurança do Estado, prevenção e investigação criminal, e bem assim, quando, nomeadamente no caso do tratamento de dados com finalidades estatísticas, históricas ou de investigação científica, a informação do titular dos dados se revelar impossível ou implicar esforços desproporcionados ou ainda quando a lei determinar expressamente o registo dos dados ou a sua divulgação.

6. A obrigação de informação não se aplica ao tratamento de dados efectuado para fins exclusivamente jornalísticos ou de expressão artística ou literária, salvo quando estiverem em causa direitos, liberdades e garantias dos titulares dos dados.

Artigo 12º.- (Direito de acesso)

1. O titular dos dados tem o direito de obter do responsável pelo tratamento, libremente e sem restrições, com periodicidade razoável e sem demoras ou custos excessivos:

a) A confirmação de serem ou não tratados dados que lhe digam respeito, bem como informação sobre as finalidades desse tratamento, as categorias de dados sobre que incide e os destinatários ou as categorias de destinatários a quem são comunicados os dados;

b) A comunicação, sob forma inteligível, dos seus dados sujeitos a tratamento e de quaisquer informações disponíveis sobre a origem desses dados;

c) O conhecimento da lógica subjacente ao tratamento automatizado dos dados que lhe digam respeito, no que se refere às decisões automatizadas referidas no número 1 do artigo 14º;

d) A rectificação, o pagamento ou o bloqueio dos dados cujo tratamento não respeitar o disposto na presente lei, nomeadamente devido ao carácter incompleto ou inexacto desses dados;

e) A notificação aos terceiros a quem os dados tenham sido comunicados de qualquer rectificação, apagamento ou bloqueio efectuado nos termos da alínea d), salvo se isso for comprovadamente impossível ou implicar um esforço desproporcionado.

2. Nos casos previstos nos n.ºs 4 e 5 do artigo 8º, o direito de acesso é exercido através da Comissão Parlamentar de Fiscalização.

3. No caso previsto no n.º 6 do artigo anterior, o direito de acesso é exercido através da Comissão Parlamentar de Fiscalização, com a salvaguarda das normas constitucionais aplicáveis, designadamente as que garantem a liberdade de expressão e informação, a liberdade de imprensa e a independência e sigilo profissional dos jornalistas.

4. Nos casos previstos nos n.ºs 2 e 3 deste artigo, se a cumunicação dos dados ao seu titular puder prejudicar a segurança do Estado, a prevenção ou a investigação criminal ou ainda a liberdade de expressão e informação ou a liberdade de imprensa, a Comissão Parlamentar de Fiscalização limita-se a informar o titular dos dados das diligências efectuadas.

5. O direito de acesso à informação relativa a dados da saúde, incluindo os dados genéticos, é exercido por intermédio de médico escolhido pelo titular dos dados.

6. No caso de os dados não serem utilizados para tomar medidas ou decisões em relação a pessoas determinadas, a lei pode restringir o direito de acesso nos casos em que manifestamente não exista qualquer perigo de violação dos direitos, liberdades e garantías do titular dos dados, designadamente do direito à sua intimidade da vida privada, e os referidos dados forem exclusivamente utilizados para fins de investigação científica ou conservado sob forma de dados pessoais durante um período que não exceda o necessário à finalidade exclusiva de elaborar estatísticas.

Artigo 13º.- (Direito de oposição)

O titular dos dados tem o direito de:

a) Salvo disposição legal em contrário, e pelo menos nos casos referidos nas alíneas d) e e) do artigo 7º, se opor em qualquer altura, por razões ponderosas e legítimas relacionadas com a sua situação particular, a que os dados que lhe digam respeito sejam objecto de tratamento, devendo, em caso de oposição justificada, o tratamento efectuado pelo responsável deixar de poder incidir sobre esses dados;

b) Se opor, a seu pedido e gratuitamente, ao tratamento dos dados pessoais que lhe digam respeito previsto pelo responsável pelo tratamento para efeitos de «marketing» directo ou qualquer outra forma de prospecção;

c) Se opor, sem despesas, a que os seus dados pessoais sejam comunicados pela primeira vez a terceiros para os fins previstos na alínea anterior ou utilizados por conta de terceiros.

Artigo 14º.- (Não sujeição a decisões individuais automatizadas)

Qualquer pessoa tem o direito de não ficar sujeita a uma decisão que produza efeitos na sua esfera jurídica ou que a afecte de modo significativo, tomada exclusivamente com base num tratamento automatizado de dados destinado a avaliar determinados aspectos da sua personalidade, designadamente a sua capacidade profissional, o seu crédito, a confiança de que é merecedora ou o seu comportamento.
Sem prejuízo do cumprimento das restantes disposições da presente lei, uma pessoa pode consentir em ser sujeita a uma decisão tomada nos termos do número 1, desde que tal ocorra no âmbito da celebração ou da execução de um contrato, e sob condição de o seu pedido de celebração ou execução do contrato ter sido satisfeito, ou de existirem medidas adequadas que garantam a defesa dos seus interesses legítimos e de expor o seu ponto de vista, designadamente o seu direito de representação e expressão.
Pode ainda ser permitida a tomada de uma decisão nos termos do número 1, quando autorizadas pela Comissão Parlamentar de Fiscalização e desde que sejam tomadas medidas de garantia da defesa dos interesses legímos do titular dos dados.

SECÇÃO III.- Segurança e confidencialidade do tratamento

Artigo 15º.- (Segurança do tratamento)

O responsável pelo tratamento deve pôr em prática as medidas técnicas e organizativas adequadas para proteger os dados pessoais contra a destruição, acidental ou ilícita, a perda aidental, a alteração, a difusão ou o acesso não autorizados, nomeadamente quando o tratamento implicar a sua transmissão por rede, e contra qualquer outra forma de tratamento ilícito.
As medidas previstas no número anterior devem assegurar, atendendo aos conhecimentos técnicos disponíveis e aos custos resultantes da sua aplicação, um nível de segurança adequado em relação aos riscos que o tratamento apresenta e à natureza dos dados a proteger.
O responsável pelo tratamento, em caso de tratamento por sua conta, deverá escolher um subcontratante que ofereça garantias suficientes em relação às medidas de segurança técnica e de organização do tratamento a efectuar, e deverá zelar pelo cumprimento dessas medidas.
A realização de operações de tratamento em subcontatação deve ser regida por um contrato ou acto jurídico que vincule o subcontratante ao responsável pelo tratamento e que estipule, designadamente, que o subcontratante apenas actua mediante instruções do responsável pelo tratamento e que lhe incumbe igualmente i cumprimento das obrigações referidas nos n.ºs 1 e 2.
Para efeitos de conservação de provas, os elementos da declaração negocial, do contrato ou do acto jurídico relativos à protecção dos dados, bem como as exigencias relativas às medidads referidas nos nºs 1 e 2 são consignados por escrito ou em suporte equivalente, de preferência, com valor probatório legalmente reconhecido.

Artigo 16º.- (Medidas especiais de segurança)

1. Os responsáveis pelo tratamento dos dados referidos nas alíneas do número 1, nos números 2 e 5 do artigo 8º e no número 1 do artigo 9º devem tomar as medidas adequadas e acrescidas de segurança da informação, designadamente para:

a) Impedir o acesso de pessoa não autorizada às instalações utilizadas para o tratamento desses dados (controlo da entrada nas instalações);

b) Impedir que suportes de dados possam ser lidos, copiados, alterados por pessoa não autorizada (controlo dos suportes de dados);

c) Impedir a introdução não autorizada, bem como a tomada de conhecimento, a alteração ou a eliminação não autorizadas de dados pessoais inseridos (controlo da inserção);

d) Impedir que sistemas de tratamento automatizados de dados possam ser utilizados por pessoas não autorizadas através de instalações de transmissão de dados (controlo da utilização);

e) Garantir que as pessoas autorizadas só possam ter acesso aos dados abragidos pela autorização (controlo de acesso);

f) Garantir a verificação das entidades a quem possam ser transmitidos os dados pessoais através das instalações de transmissão de dados (controlo da tranmissão);

g) Garantir que possa verificar-se, a posteriori, em prazo adequado à natureza do tratamento, a fixar na regulamentação aplicável a cada sector, quais os dados pessoais introduzidos, quando e por quem (controlo da introdução);

h) Impedir que, na transmissão de dados pessoais, bem como no transporte do seu suporte, os dados possam ser lidos, copiados, alterados ou eliminados de forma não autorizada (controlo do transporte).

2. Tendo em conta a natureza das entidades responsáveis pelo tratamento e o tipo das instalações em que é efectuado, a Comissão Parlamentar de Fiscalização pode dispensar a existência de certas medidas de segurança, garantido que se mostre o respeito pelos direitos, liberdades e garantias dos titulares dos dados.

3. Os sistemas devem garantir a separação lógica entre os dados referentes à saúde e à vida sexual, incluindo os genéticos, dos restantes dados pessoais.

4. A Comissão Parlamentar de Fiscalização pode determinar que a transmissão seja cifrada, nos casos em que a circulação em rede de dados pessoais referidos nos artigos 8º e 9º possa pôr em risco direitos, liberdades e garantias dos respectivos titulares.

Artigo 17º.- (Confidencialidade do tratamento)

Qualquer pessoa que, agindo sob a autoridade do responsável pelo tratamento ou do subcontratante, bem como o próprio subcontratante, tenha acesso a dados pessoais, não pode proceder ao seu tratamento sem instruções doresponsável pelo tratamento, salvo por força de obrigações legais.

Artigo 18º.- (Sigilo profissional)

Os responsáveis do tratamento de dados pessoais, bem como as pessoas que, no exercício das suas funções, tenham conhecimento dos dados passoais tratados, ficam obrigados a sigilo profissional, mesmo após o termo das suas funções.
Igual obrigação recai sobre os membros da Comissão Parlamentar de Fiscalização, mesmo o termo do mandato.
O disposto nos números anteriores não exclui o dever do fornecimento das informações obrigatórias, nos termos legais, excepto quando constem de ficheiros organizados para fins estatísticos.
O pessoal que exerça funções de assessoria à Comissão Parlamentar de Fiscalização ou aos membros está sujeito à mesma obrigação de sigilo profissional.

CAPÍTULO III.- Transferência de dados pessoais

Artigo 19º.- (Princípios)

Sem prejuízo no disposto no artigo seguinte, a transferência de dados pessoais que sejam objecto de tratamento ou que se destinam a sê-lo, só pode realizar-se com respeito das disposições da presente lei e demais legislação aplicável em matéria de protecção de dados pessoais e, tratando-se de transferência para o estrangeiro, para o país que asegurar um nível de protecção adequado.

A adequação do nível de protecção é apreciada em função de todas as circunstancias que rodeiem a transferência ou o conjunto de transferências de dados, em especial, a natureza dos dados, a finalidade e a duração do tratamento ou tratamentos projectados, os países de origem e de destino final, as regras de direito, gerais ou sectoriais, em vigor no país em causa, bem como as regras profissionais e as medidas de segurança que são respeitadas nesse país.
Cabe à Comissão Parlamentar de Fiscalização decidir se um Estado estrangeiro assegure um nível de protecção adequado.
A Comissão Parlamentar de Fiscalização comunica ao Primeiro Ministro os casos em que tenha considerado que um Estado estrangeiro não assegura um nível de protecção adequado.

Artigo 20º.- (Derrogações)

1. A transferência de dados pessoais para um país que não assegure um nível de protecção adequado na acepção do n.º 2 do artigo anterior pode ser permitida pela Comissão Parlamentar de Fiscalização se o titular dos dados tiver dado de forma inequívoca o seu consentimento à transferência ou se essa transferência:

a) For necessária para a execução de um contrato entre o titular dos dados e o responsável pelo tratamento ou de diligências prévias à formação do contrato decididas a pedido do titular dos dados;

b) For necessária para a execução ou celebração de um contrato outorgado ou a outorgar, no interesse do titular dos dados, entre o responsável pelo tratamento e um terceiro;

c) For necessária ou legalmente exigida para a protecção de um interesse público importante, ou para a declaração, o exercício ou a defesa de um direito num processo judicial;

d) For necessária para proteger os interesses vitais do titular dos dados;

e) For realizada a partir de um registo público que, nos termos de disposições legislativas ou regulamentares, se destine à informação do público e se encontre aberto à consulta do público em geral ou de qualquer pessoa que possa provar um interesse legítimo, desde que as condições estabelecidas na lei para a consulta sejam cumpridas no caso concreto.

2. Sem prejuízo do disposto no número 1, pode ser autorizada pela Comissão Parlamentar de Fiscalização uma transferência ou um conjunto de transferências de dados pessoais para um país que não assegure um nível de protecção adequado na acepção do número 2 do artigo anterior, desde que o responsável pelo tratamento apresente garantias suficientes de protecção da vida privada e dos direito e liberdades fundamentais das pessoas, assim como do seu exercício, designadamente, mediante cláusula contratuais adequadas.

3. A Comissão Parlamentar de Fiscalização comunica ao Primeiro Ministro das autorizações que conceder nos termos do número anterior.

4. A transferência de dados pessoais que constitua medida necessária à protecção da segurança do Estado, da defesa, da segurança pública e da prevenção, investigação e repressão das infracções penais é regida por disposições legais específicas ou pelas convenções, tratados e acordos internacionais em que Cabo Verde é parte.

CAPÍTULO IV.- Autoridade nacional para a fiscalização de protecção de dados pessoais

Secção I.- Disposições gerais

Artigo 21º.- (Objectivos da fiscalização)

A fiscalização da protecção de dados pessoais visa acompanhar, avaliar e controlar a actividade dos órgãos ou serviços legalmente competentes para o seu tratamento, velando pelo cumprimento da Constituição e da lei, particularmente do regime de direitos, liberdades e garantias fundamentais dos cidadãos.

Artigo 22º.- (Natureza da fiscalização)

A fiscalização da protecção de dados pessoais é assegurada pela Assembleia Nacional, através de um Comissão Parlamentar de Fiscalização.
A Comissão Parlamentar de Fiscalização é assegurada por lei própria.

SECÇÃO II.- Notificação

Artigo 23º.- (Obrigação de notificação)

O responsável pelo tratamento ou, se for caso disso, o seu representante deve notificar a Comissão Parlamentar de Fiscalização antes da realização de um tratamento ou conjunto de tratamentos, total ou parcialmente automatizados, destinados à prossecução de uma ou mais finalidades interligadas.
A Comissão Parlamentar de Fiscalização pode autorizar a simplificação ou a isenção da notificação para determinadas categorias de tratamentos que, atendendo aos dados a tratar, não sejam susceptíveis de pôr em causa os direitos e liberdades dos titulares dos dados e tenham em conta critérios de celeridade, economia e eficiência.
A autorização deve especificar as finalidades do tratamento, os dados ou categorías de dados a tratar, a categoria ou categorias de destinatários a quem podem ser comunicados os dados e o período de conservação dos dados.
Estão isentos de notificação os tratamentos cuja única finalidade seja a manutenção de registos que, nos termos de disposições legislativas ou regulamentares, se destinem a informação do público e possam ser consultados pelo público em geral ou por qualquer pessoa que provar um interesse legítimo.
Os tratamentos não autorizados dos dados pessoais previstos no número 1 do artigo 8º estão sujeitos a notificação quando tratados ao abrigo da alínea a) do número 3 do mesmo artigo.

Artigo 24º.- (Controlo prévio)

1. Salvo se autorizados por diploma legal, carecem a autorização da Comunidade Parlamentar de fiscalização;

a) O tratamento dos dados pessoais a que se referem as alíneas a) e c) do n.º 1 do artigo 8º e o n.º 2 do artigo 9º;

b) O tratamento dos dados pessoais relativos ao crédito e à solvabilidade dos seus titulares;

c) A interconexão de dados pessoais, nos ternos previstos no artigo 10º;

d) A utilização de dados pessoais para fins não determinantes da recolha.

2. O diploma legal que autorizar os tratamentos a que se refere o número anterior carece de prévio parecer da Comissão Parlamentar de Fiscalização.

Artigo 25º.- (Conteúdo dos pedidos de parecer ou de autorização e da notificação)

Os pedidos de parecer ou de autorização, bem como as notificações, remetidos à Comissão Parlamentar de Fiscalização devem conter as seguintes informações:

a) O nome e o endereço do responsável pelo tratamento e, se for caso, do seu representante;

b) A ou as finalidades do tratamento;

c) A descrição da ou das categorias de titulares dos dados e dos dados ou das categorias de dados pessoais que lhes respeitem;

d) Os destinatários ou as categorias de destinatários a quem os dados podem ser comunicados e em que condições;

e) A entidade encarregada do processamento da informação, se não for o próprio responsável do tratamento;

f) As eventuais interconexões de tratamentos de dados pessoais;

g) O tempo de conservação dos dados pessoais;

h) A forma e as condições como os titulares dos dados podem ter conhecimento ou fazer corrigir os dados pessoais que lhes respeitem;

i) As transferências de dados previstas para países terceiros;

j) A descrição geral que permita avaliar de forma preliminar a adequação das medidas tomadas para garantir a segurança do tratamento em aplicação dos artigos 15º e 16º.

Artigo 26º.- (Indicações obrigatórias)

1. Os diplomas legais referidos na alínea b) do n.º 1 do artigo 8º e no n.º 1 do artigo 9º bem como as autorizações da Comissão Parlamentar de Fiscalização e os registos de tratamentos de dados pessoais, devem, pelo menos, indicar:

a) O responsável do ficheiro e, se for caso disso, o seu representante;

b) As categorias de dados pessoais tratados;

c) A ou as finalidades a que se destinam os dados e as categorias de entidades a quem podem ser transmitidos;

d) A forma de exercício do direito de acesso e de rectificação;

e) As eventuais interconexões de tratamentos de dados pessoais;

f) As transferências de dados previstas para outros países.

2. Qualquer alteração das indicações constantes do número 1 está sujeita aos procedimentos previstos nos artigos 23º e 24º.

Artigo 27º.- (Publicidade dos tratamentos)

O tratamento dos dados pessoais, quando não for objecto de diploma legal e deber ser autorizado ou notificado, consta de registo na Comissão Parlamentar de Fiscalização, aberto à consulta por qualquer pessoa.
O registo contém as informações enumeradas nas alíneas a) a d) e i) do artigo 25º.
O responsável por tratamento de dados não sujeito a notificação está obrigado a prestar, de forma adequada, a qualquer pessoa que lho solicite, pelo menos, as informações referidas no número 1 do artigo 26º.
O disposto no presente artigo não se aplica a tratamentos cuja única finalidade seja a manutenção de registos que, nos termos de disposições legislativas ou regulamentares, se destinem à informação do público e se encontrem abertos à consulta do publico em geral ou de qualquer pessoa que possa provar um interesse legítimo.
A Comissão Parlamentar de Fiscalização deve indicar no seu relatório anual todos os pareceres e autorizações elaborados ou concedidas ao abrigo da presente lei, designadamente as autorizações previstas nas alíneas do número 1 do artigo 8º e no número 2 do artigo 10º.

CAPÍTULO V.- Códigos de conduta

Artigo 28º.- (Finalidades)

Os códigos de conduta destinam-se a contribuir, em função das características dos diferentes sectores, para a boa execução das disposições da presente lei.

Artigo 29º.- (Intervenção da Comissão Parlamentar de Fiscalização)

A Comunicação Parlamentar de Fiscalização apoia a elaboração de código de conduta.
As associações profissionais e outras organizações representativas de categorías de responsáveis pelo tratamento de dados que tenham elaborado projectos de códigos de conduta podem submetê-la à apreciação da Comissão Parlamentar de Fiscalização.
A Comissão Parlamentar de Fiscalização pode declarar a conformidade dos projectos com as disposições legais e regulamentares vigentes em matéria de protecção de dados pessoais.

CAPÍTULO VI.- Recursos judiciais, responsabilidade civil, infracções e sanções

SECÇÃO I.- Recursos judiciais e responsabilidade civil

Artigo 30º.- (Recursos judiciais)

Sem prejuízo do direito de apresentação de queixa ou reclamação à Comissão Parlamentar de Fiscalização, qualquer pessoa pode, nos termos da lei, recorrer judicialmente da violação dos direitos garantidos pela presente.

Artigo 31º.- (Responsabilidade civil)

Qualquer pessoa que tiver sofrido um prejuízo devido ao tratamento ilícito de dados ou a qualquer outro acto que viole disposições legislativas ou regulamentares em materia de protecção de dados pessoais tem o direito de obter do responsável e reparação pelo prejuízo sofrido.
O responsável pelo tratamento pode ser parcial ou totalmente exonerado desta responsabilidade se provar que o facto que causou o dano lhe não é imputável.

SECÇÃO II.- Infracções e sanções

SUBSECÇÃO.- Contra-ordenações

Artigo 32º.- (Legislação subsidiária)

Às infracções previstas na presente subsecção é subsidiariamente aplicável o regime das contra-ordenações, com as adaptações constantes dos artigos seguintes.

Artigo 33º.- (Omissão ou defeituoso cumprimento de obrigações)

As entidades que, por negligência, não cumpram a obrigação de notificação à Comissão Parlamentar de Fiscalização do tratamento de dados pessoais a que se referem os números 1 e 5 do artigo 23º, prestem falsas informações ou cumpram a obrigação de notificação com inobservância dos termos previstos no artigo 25º, ou ainda quando, depois de notificadas pela referida Comissão, mantiverem o acesso às redes abertas de transmissão de dados a responsáveis por tratamento de dados a responsáveis por tratamento de dados pessoais que não cumpram as disposições da presente lei, praticam contra-ordenação punível com as seguintes coimas:
a) Tratando-se de pessoa singular, no mínimo de 50.000$00 e no máximo de 500.000$00;
b) Tratando-se de pessoa colectiva ou de entidade sem personalidade jurídica, no mínimo de 300.000$00 e no máximo de 3.000.000$00.
A coima é agravada para o dobro dos seus limites quando se trate de dados sujeitos a controlo prévio, nos termos do artigo 24º.

Artigo 34º.- (Outras infracções)

1. Praticam contra-ordenação punível com a coima mínima de 100.000$00 e máxima de 1.000.000$00, as entidades que não cumprem alguma das seguintes disposições da presente lei:

a) Designar representante nos termos previstos no número 4 do artigo 2º;

b) Observar as obrigações estabelecidas nos artigos 6º, 11º, 12º, 13º, 14º, 16º, 17º e 27º, nº 3.

2. A coima é agravada para o dobro dos seus limites quando não forem cumpridas as obrigações constantes dos artigos 7º, 8º, 9º, 10º, 19º e 20º.

Artigo 35º.- (Concurso de infracções)

Se o mesmo facto constituir, simultaneamente, crime e contra-ordenação, o agente é punido sempre a título de crime.
As sanções aplicadas às contra-ordenações em concurso são sempre cumuladas materialmente.

Artigo 36º.- (Punição de negligência e da tentativa)

A negligência é sempre punida nas contra-ordenações previstas no artigo 34º.
A tentativa é sempre punível nas contra-ordenações previstas nos artigos 33º e 34º.

Artigo 37º.- (Aplicação das coimas)

A aplicação das coimas previstas na presente lei compete ao presidente da Comissão Parlamentar de Fiscalização, sob prévia deliberação desta.
A deliberação da Comissão Parlamentar de Fiscalização, depois de homologada pelo presidente, constitui título executivo, no caso de não ser impugnada no prazo legal.

Artigo 38º.- (Cumprimento do dever omitido)

Sempre que a contra-ordenação resulte de omissão de um dever, a aplicação da sanção e o pagamento da coima não dispensam o infractor do seu cumprimento, se este ainda for possível.

Artigo 39º.- (Destino das receitas cobradas)

O montante das importâncias cobradas, em resultado da aplicação das coimas, reverte para o Estado, salvo disposição legal que disponha de modo diferente.

SUBSECÇÃO II.- Crimes

Artigo 40º.- (Não cumprimento de obrigações relativas a protecção de dados)

1. É punido com prisão até um ano ou multa até 120 dias quem intencionalmente:

a) Omitir a notificação ou pedido de autorização a que se referem os artigos 23º e 24º.

b) Fornecer falsas informações na notificação ou nos pedidos de autorização para o tratamento de dados pessoais ou neste proceder a modificações não consentidas pelo instrumento de legalização;

c) Desviar ou utilizar dados pessoais, de forma incompatível com a finalidade determinante da recolha ou com o instrumento de legalização;

d) Promover ou efectuar uma interconexão ilegal de dados pessoais;

e) Depois de ultrapassado o prazo que lhes tiver sido fixado pela Comissão Parlamentar de Fiscalização para cumprimento das obrigações previstas na presente lei ou em outra legislação de protecção de dados, as não cumprir;

f) Depois de notificado pela Comissão Parlamentar de Fiscalização para o não fazer, mantiver o acesso a redes abertas de transmissão de dados a responsáveis pelo tratamento de dados pessoais que não cumpram as disposições da presente lei.

2. A pena é agravada para o dobro dos seus limites quando se tratar de dados pessoais a que se referem os artigos 8º e 9º.

Artigo 41º.- (Acesso indevido)

1. Quem, sem a devida autorização, por qualquer modo, aceder a dados pessoais cujo acesso lhe está vedado é punido com prisão até um ano ou multa até 120 dias.

2. A pena é agravada para o dobro dos seus limites quando o acesso:

a) For conseguido através de violação de regras técnicas de segurança;

b) Tiver possibilitado ao agente ou a terceiros o conhecimento de dados pessoais;

c) Tiver proporcionado ao agente ou a terceiros benefício ou vantagens patrimoniais;

3. No caso previsto no número 1 o procedimento criminal depende de queixa.

Artigo 42º

(Viciação ou destruição de dados pessoais)

Quem, sem a devida autorização, apagar, destruir, danificar, suprimir ou modificar dados pessoais, tornando-os inutilizáveis ou afectando a sua capacidade de uso, é punido com prisão até dois anos ou multa até 240 dias.
A pena é agravada para o dobro nos seus limites se o dano produzido for particularmente grave.
Se o agente actuar com negligência, a pena é, em ambos os casos, de prisão até um ano ou multa até 120 dias.

Artigo 43º.- (Desobediência qualificada)

1. Quem, depois de notificado para o efeito, não interromper cessar ou bloquear o tratamento de dados pessoais é punido com a pena de prisão correspondente ao crime de desobediência qualificada.

2. Na mesma pena incorre quem, depois de notificado:

a) Recusar, sem justa causa, a colaboração que concretamente lhe for exigida pela Comissão parlamentar de Fiscalização, nos termos da lei;

b) Não proceder ao pagamento, destruição total ou parcial de dados pessoais;

c) Não proceder à destruição de dados pessoais, findo o prazo de conservação previsto no artigo 6º.

Artigo 44º.- (Violação do dever de sigilo)

1. Que, obrigado a sigilo profissional, nos termos da lei, sem justa causa e sem o debido consentimento, revelar ou divulgar no todo ou em parte dados pessoais é punido com pena de prisão de seis meses até três anos ou multa de oitenta a duzentos dias, se a pena mais grave não lhe for aplicável, independentemente da medida disciplinar correspondente à gravidade da sua falta, a qual poderá ir até à cessação do vínculo que o liga ao cargo ou função.

2. A pena é agravada de metade dos seus limites se o agente:

a) For pessoal da função pública ou equiparado, nos termos da lei penal;

b) For determinado pela intenção de obter qualquer vantagem patrimonial ou outro benefício ilegítimo;

c) Puser em perigo a reputação, a honra e consideração ou a intimidade da vida privada de outrem.

3. A negligência é punível com prisão até seis meses ou multa até 120 dias.

4. Fora dos casos previstos no número 2, o procedimento criminal depende de queixa.

Artigo 45º.- (Punição da tentativa)

Nos crimes previstos nas disposições anteriores, a tentativa é sempre punível.

Artigo 46º.- (Sanções acessórias)

1. Conjuntamente com as coimas ou penas aplicadas pode, acessoriamente, ser ordenada:

a) A proibição temporária ou definitiva do tratamento, o bloqueio, o apagamento ou a destruição total ou parcial dos dados;

b) A publicidade da sentença condenatória;

c) A advertência ou censura públicas do responsável pelo tratamento;

2. A publicidade da decisão condenatória faz-se a expensas do condenado, em publicação periódica de maior expansão editada na área da comarca da prática da infracção, ou na sua falta, em publicação periódica de maior expansão da comarca mais próxima, bem como através da afixação de edital em suporte adequado, por período não inferior a 30 dias.

3. A publicação é feita por extracto de que constem os elementos da infracção e as sanções aplicadas, bem com a identificação do agente.

CAPÍTULO VII.- Disposições transitórias e finais

Artigo 47º.- (Ficheiros manuais existentes)

Os tratamentos de dados existentes em ficheiros manuais à data da entrada em vigor da presente lei devem cumprir o disposto nos artigos 8º, 9º, 11º e 12º no prazo de cinco anos.
Em qualquer caso, o titular dos dados pode obter, a seu pedido e, nomeadamente, aquando do exercício do direito de acesso, a rectificação, o apagamento ou o bloqueio dos dados incompletos, inexactos ou conservados de modo incompatível com os fins legítimos prosseguidos pelo responsável pelo tratamento.
A Comissão Parlamentar de Fiscalização pode autorizar que os dados existentes em ficheiros manuais e conservados unicamente com finalidades de investigação histórica não tenham que cumprir o disposto nos artigos 8º, 9º e 10º, desde que não sejam, em nenhum caso, reutilizados para finalidade diferente.

Artigo 48º.- (Ficheiros automatizados existentes)

Os titulares de ficheiros automatizados existentes á data da entrada em vigor da presente lei devem cumprir rigorosamente o que nela se contém, designadamente adaptar tais ficheiros no prazo de um ano.

Artigo 49º.- (Entrada em vigor)

A presente lei entra em vigor trinta dias após a sua publicação.

Aprovada em 20 de Dezembro de 2000.

O Presidente da Assembleia Nacional, António do Espírito Santo Fonseca.

Promulgada em 10 de Janeiro de 2001.

Publique-se.

O Presidente da República, ANTÓNIO MANUEL MASCARENHAS GOMES MONTEIRO.

Assinada em 13 de Janeiro de 2001.

O Presidente da Assembleia Nacional, António do Espírito Santo Fonseca.

10Jul/18

Lei nº 42/VIII/2013 de 17 Setembro, regula a composição, a competência, a organização e o funcionamento da CNPD

10 julio, 2018Cabo Verde, Ley17 setembro de 2013, a competência, a organização e o funcionamento da Comissão Nacional de Protecção de Dados (CNPD), bem como o estatuto dos seus membros. (B. O. da República de Cabo Verde, Derecho Informático, I Série nº 48)., Legislacion de Cabo Verde, Lei nº 42/VIII/2013 de 17 Setembro, regula a composiçãoJosé Cuervo

Lei nº 42/VIII/2013 de 17 Setembro, regula a composição, a competência, a organização e o funcionamento da Comissão Nacional de Protecção de Dados (CNPD), bem como o estatuto dos seus membros. (B. O. da República de Cabo Verde, 17 setembro de 2013, I Série nº 48)

Por mandato do Povo, a Assembleia Nacional decreta, nos termos da alínea b) do artigo 175º da Constituição,

o seguinte:

CAPÍTULO I.- Disposições gerais

Artigo 1º.- Objecto

A presente lei regula a composição, a competência, a organização e o funcionamento da Comissão Nacional de Protecção de Dados (CNPD), bem como o estatuto dos seus membros.

Artigo 2º.- Natureza

A CNPD é uma entidade administrativa independente, que funciona junto da Assembleia Nacional, cujas atribuições e competências, relativas à protecção de dados pessoais, são defi nidas na presente lei.

Artigo 3º.- Regime jurídico

A CNPD rege-se pelo disposto no presente Estatuto, pelas disposições legais que lhe sejam específicamente aplicáveis e, subsidiariamente, pelo regime aplicável às autoridades reguladoras independentes do sector económico e financeiro.

Artigo 4º.- Âmbito territorial

A CNPD exerce as suas competências em todo o território nacional.
A CNPD pode ser solicitada a exercer os seus poderes por uma autoridade de controlo de protecção de dados de outro Estado, nos termos dos acordos e convenções internacionais de que Cabo Verde seja parte.
A CNPD coopera com as autoridades de controlo de protecção de dados pessoais de outros Estados na difusão do direito nessa matéria, bem como na defesa e no exercício dos direitos de pessoas residentes no estrangeiro.

Artigo 5º.- Sede

A CNPD tem sede na cidade da Praia, podendo criar delegações em outros pontos do país.

Artigo 6º.- Colaboração de outras entidades

1. As entidades públicas e privadas devem prestar a sua colaboração à CNPD, facultando todas as informações por esta solicitadas, no exercício das suas competências.

2. O dever de colaboração é assegurado, designadamente, quando a CNPD tiver necessidade, para o cabal exercício das suas funções, de examinar o sistema informático e os ficheiros de dados pessoais, bem como toda a documentação relativa ao tratamento e transmissão de dados pessoais.

3. Os tribunais devem comunicar à CNPD certidão ou cópia das sentenças ou acórdãos proferidos em materia de direito de protecção de dados pessoais, nomeadamente sobre crimes ou recursos de decisões da CNPD.

Artigo 7º.- Acesso aos sistemas informáticos de suporte ao tratamento de dados

A CNPD ou os seus membros, bem como os técnicos por ela mandatados, têm direito de acesso aos sistemas informáticos que sirvam de suporte ao tratamento dos dados pessoais, bem como à documentação referida no artigo anterior, no âmbito das suas atribuições e competências.

CAPÍTULO II.- Atribuições e competências

Artigo 8º.- Atribuições

1. A CNPD é a autoridade nacional à qual incumbe controlar e fi scalizar o cumprimento das disposições legais e regulamentares em matéria de protecção de dados pessoais, em rigoroso respeito pelos direitos humanos e pelas liberdades e garantias consagradas na Constituição e na lei.

2. A CNPD dispõe de:

a) Poderes de investigação e de inquérito, podendo aceder aos dados objecto de tratamento e recolher todas as informações necessárias ao desempenho das suas funções de controlo;

b) Poderes de autoridade, designadamente o de ordenar o bloqueio, apagamento ou destruição dos dados, bem como o de proibir, temporária ou defi nitivamente, o tratamento de dados pessoais, ainda que incluídos em redes abertas de transmissão de dados a partir de servidores situados em territorio cabo-verdiano;

c) Poder de emitir pareceres prévios ao tratamento de dados pessoais, assegurando a sua publicitação.

3. Em caso de reiterado incumprimento das disposições legais em matéria de dados pessoais, a CNPD pode advertir ou censurar publicamente o responsável pelo tratamento, bem como suscitar a questão, de acordo com as respectivas competências, à Assembleia Nacional, ao Governo ou a outros órgãos ou autoridades.

Artigo 9º.- Intervenção em processos judiciais

A CNPD tem legitimidade para intervir em procesos judiciais no caso de violação das disposições da presente lei e deve denunciar ao Ministério Público as infracções penais de que tiver conhecimento no exercício das suas funções e por causa delas, bem como praticar os actos cautelares necessários e urgentes para assegurar os meios de prova.
A CNPD é representada em juízo pelo Ministério Público e está isenta de custas nos processos em que intervenha.

Artigo 10º.- Competências

1. Compete em especial à CNPD:

a) Autorizar ou registar, consoante os casos, os tratamentos de dados pessoais;

b) Autorizar excepcionalmente a utilização de dados pessoais para finalidades não determinantes da recolha, com respeito pelos principios definidos na lei;

c) Autorizar, nos casos previstos na lei, a interconexão de tratamentos automatizados de dados pessoais;

d) Autorizar a transferência de dados pessoais nos casos previstos na lei;

e) Fixar o tempo da conservação dos dados pessoais em função da finalidade, podendo emitir directivas para determinados sectores de actividade;

f) Fazer assegurar o direito de acesso à informação, bem como do exercício do direito de rectifi cação e actualização;

g) Autorizar a fi xação de custos ou de periodicidade para o exercício do direito de acesso, bem como fi xar os prazos máximos de cumprimento, em cada sector de actividade, das obrigações que, nos termos da lei, incumbem aos responsáveis pelo tratamento de dados pessoais;

h) Dar seguimento ao pedido efectuado por qualquer pessoa, ou por associação que a represente, para protecção dos seus direitos e liberdades no que diz respeito ao tratamento de dados pessoais e informá-la do resultado;

i) Efectuar, a pedido de qualquer pessoa, a verifi cação de licitude de um tratamento de dados, sempre que esse tratamento esteja sujeito a restrições de acesso ou de informação, e informá-la da realização da verifi cação;

j) Apreciar as reclamações, queixas ou petições dos particulares;

k) Dispensar a execução de medidas de segurança, nos termos previstos na lei, podendo emitir directivas para determinados sectores de actividade;

l) Assegurar a representação de Cabo Verde junto de instâncias internacionais no âmbito das suas competências;

m) Aplicar coimas;

n) Promover e apreciar códigos de conduta;

o) Promover a divulgação e esclarecimento dos direitos relativos à protecção de dados e dar publicidade periódica à sua actividade, nomeadamente através da publicação de um relatório anual;

p) Autorizar a contratação do pessoal, transferências, requisições e destacamentos;

q) Exercer outras competências previstas na lei.

2. No exercício das suas competências de emissão de directivas ou de apreciação de códigos de conduta, a CNPD deve promover a audição das associações de defesa dos interesses em causa.

3. No exercício das suas funções, a CNPD profere decisões com força obrigatória, passíveis de reclamação e de recurso para o tribunal competente.

4. A CNPD pode sugerir à Assembleia Nacional as providências que entender úteis à prossecução das suas atribuições e ao exercício das suas competências.

Artigo 11º.- Sanção pecuniária compulsória

1. Os destinatários de deliberação individualizada da CNPD fi cam sujeitos ao pagamento de uma quantia pecuniária a pagar por cada dia de atraso no cumprimento, contado da data da sua publicação ou notifi cação.

2. O valor diário da sanção prevista no número anterior é fi xado em:

a) Cinco mil escudos quando a infracção for cometida por pessoa singular;

b) Dez mil escudos quando cometida por pessoa colectiva.

Artigo 12º.- Competência consultiva

A CNPD deve ser consultada sobre quaisquer disposições legais relativas ao tratamento de dados pessoais.
A CNPD é ainda consultada para emitir parecer sobre disposições legais ou iniciativas legislativas relativas ao tratamento de dados pessoais.

CAPÍTULO II.- Organização e estatuto dos membros

Secção I.- Composição, mandato e posse

Artigo 13º.- Composição e eleição

A CNPD é composta por três personalidades de reconhecida competência e integridade moral, eleitos pela Assembleia Nacional, por maioria de dois terços dos deputados presentes, desde que superior à maioria absoluta dos Deputados em efectividade de funções.
A presidência da CNPD é assegurada por cada um dos seus membros rotativamente por ordem alfabética pelo período de dois anos.

Artigo 14º.- Mandato

O mandato dos membros da CNPD é de seis anos e cessa com a posse dos novos membros, não podendo ser renovado por mais de uma vez.

Artigo 15º.- Posse

Os membros da CNPD tomam posse perante o Presidente da Assembleia Nacional, no prazo de quinze dias após a publicação da resolução que aprova a respectiva eleição.

Secção II.- Estatuto dos membros

Artigo 16º.- Capacidade

Só podem ser membros da CNPD os cidadãos que se encontrem no pleno gozo dos seus direitos civis e políticos.

Artigo 17º.- Inamovibilidade

1. Os membros da CNPD são inamovíveis, não podendo as suas funções cessar antes do termo do mandato, salvo nos seguintes casos:

a) Morte ou incapacidade física permanente ou com uma duração que se preveja ultrapasar a data do termo do mandato;

b) Renúncia ao mandato;

c) Perda do mandato.

2. No caso de vacatura por um dos motivos previstos no número anterior, a vaga deve ser preenchida no prazo de sessenta dias após a sua verifi cação, através da designação de novo membro pela entidade competente.

3. O membro designado nos termos do número anterior completa o mandato do membro que substitui.

Artigo 18º.- Garantias

Os membros da CNPD benefi ciam das seguintes garantias:

a) Não podem ser prejudicados na estabilidade do seu emprego, na sua carreira profissional e no regime de segurança social de que benefi ciem;

b) O período correspondente ao exercício do mandato considera-se, para todos os efeitos legais, como prestado no lugar de origem.

Artigo 19º.- Renúncia

Os membros da CNPD podem renunciar ao mandato através de declaração escrita apresentada à Comissão.
A renúncia torna-se efectiva com o seu anúncio e é publicada na I Série do Boletim Oficial.

Artigo 20º.- Perda do mandato

1. Perdem o mandato os membros da CNPD que:

a) Sejam abrangidos por qualquer das incapacidades ou incompatibilidades previstas na lei;

b) Faltem, no mesmo ano civil, a três reuniões consecutivas ou a seis interpoladas, salvo motivo justificado;

c) Cometam violação do disposto na alínea c) do artigo 22º, desde que judicialmente declarada.

2. A perda do mandato é objecto, conforme o caso, de deliberação ou declaração a publicar na I Série do Boletim Oficial.

Artigo 21º.- Estatuto remuneratório

O estatuto remuneratório dos membros da CNPD é fixado por resolução da Assembleia Nacional.

Artigo 22º.- Deveres

Constituem deveres dos membros da CNPD:

a) Exercer o respectivo cargo com isenção, rigor e independência;

b) Participar activa e assiduamente nos trabalhos do órgão que integram;

c) Guardar sigilo sobre as questões ou procesos que estejam a ser objecto de apreciação, sem prejuízo das obrigações previstas na lei.

Artigo 23º.- Incompatibilidades

Os membros da CNPD são sujeitos ao regime de incompatibilidades estabelecido para os titulares de altos cargos públicos.

Artigo 24º.- Impedimentos e suspeições

Aos impedimentos e suspeições são aplicáveis, com as devidas adaptações, as disposições que regulam o estatuto dos magistrados.
Os impedimentos e suspeições são apreciados pela CNPD.

Artigo 25º.- Cartão de identifi cação

Os membros da CNPD possuem cartão de identificação, cujo modelo e condições de emissão constam da Resolução da Assembleia Nacional, dele constando o cargo as regalias e os direitos inerentes à sua função.
O cartão de identifi cação é simultaneamente de livre-trânsito e de acesso a todos os locais em que sejam tratados dados pessoais sujeitos ao controlo da CNPD.

CAPÍTULO III.- Funcionamento

Artigo 26º.- Reuniões

1. A CNPD funciona com carácter permanente.

2. A CNPD tem reuniões ordinárias e extraordinárias.

3. As reuniões extraordinárias têm lugar:

a) Por iniciativa do presidente;

b) A pedido de dois dos seus membros.

4. As reuniões da CNPD não são públicas e realizam-se nas suas instalações ou, por sua deliberação, em qualquer outro local do território nacional, sendo a periodicidade estabelecida nos termos adequados ao desempenho das suas funções.

5. O presidente, quando o entender conveniente, pode, com o acordo da Comissão, convidar a participar nas reuniões, salvo na fase decisória, qualquer pessoa cuja presença seja considerada útil.

6. Das reuniões é lavrada acta, que, depois de aprobada pela CNPD, é assinada pelo presidente e pelo secretário.

Artigo 27º.- Ordem de trabalhos

A ordem de trabalhos para cada reunião ordinária é fi xada pelo presidente, devendo ser comunicada aos vogais com a antecedência mínima de dois dias úteis relativamente à data prevista para a sua realização.
A ordem de trabalhos deve incluir os assuntos que para esse fi m lhe forem indicados por qualquer vogal, desde que sejam da competência do órgão e o pedido seja apresentado por escrito com uma antecedência mínima de cinco dias sobre a data da reunião.

Artigo 28º.- Deliberações

A CNPD só pode reunir e deliberar com a presença de pelo menos dois membros.
As deliberações da CNPD são tomadas por maioria dos membros presentes, tendo o presidente voto de qualidade.

Artigo 29º.- Publicidade das deliberações

São publicadas na II Série do Boletim Oficial:

a) As autorizações previstas na alínea g) do número 1 do artigo 10º;

b) As autorizações previstas no número 2 do artigo 23º da Lei nº 133/V/2001, de 22 de Janeiro;

c) As autorizações referidas na alínea h) do número 1 do artigo 10º da presente lei;

d) As deliberações que aprovem as directivas a que se referem as alíneas f) e l) do número 1 do artigo 10º da presente lei;

e) As deliberações que fi xem taxas nos termos do número 2 do artigo 31º da presente lei.

Artigo 30º.- Reclamações, queixas e petições

As reclamações, queixas e petições são dirigidas por escrito à CNPD, com indicação do nome e endereço dos seus autores, podendo ser exigida a confi rmação da identidade destes.
O direito de petição pode ser exercido por correio tradicional ou electrónico, ou através de telefax e otros meios de comunicação.
Quando a questão suscitada não for da competencia da CNPD, deve a mesma ser encaminhada para a entidade competente, com informação ao exponente.
As reclamações, queixas e petições manifestamente infundadas podem ser arquivadas pelo membro da Comissão a quem o respectivo processo tenha sido distribuído.

Artigo 31º.- Formalidades

Os documentos dirigidos à CNPD e o procesado subsequente não estão sujeitos a formalidades especiais.
A CNPD pode aprovar modelos ou formulários, em suporte papel ou electrónico, com vista a permitir melhor instrução dos pedidos de parecer ou de autorização, bem como das notificações de tratamentos de dados pessoais.
Os pedidos de autorização e as notifi cações apresentados à CNPD, nos termos da lei, devem ser assinados pelo responsável do tratamento de dados pessoais ou pelo seu legal representante.

Artigo 32º.- Competências e substituição do presidente

1. Compete ao presidente:

a) Representar a Comissão;

b) Superintender nos serviços de apoio;

c) Autorizar a realização de despesas dentro dos limites legalmente compreendidos na competência dos ministros;

d) Fixar as regras de distribuição dos processos, ouvida a Comissão;

e) Submeter à aprovação da Comissão o plano de actividades;

f) Em geral, assegurar o cumprimento das leis e a regularidade das deliberações.

2. O presidente é substituído, nas suas faltas e impedimentos, pelo membro mais idoso ou pelo vogal que a Comissão designar.

Artigo 33º.- Vinculação da CNPD

A CNPD obriga-se pela assinatura:

a) Do presidente ou de outros dois membros, se outra forma não for deliberada pelo plenário da CNPD;

b) De quem estiver habilitado para o efeito, nos termos e âmbito do respectivo mandato.

CAPÍTULO IV.- Regime financeiro e patrimonial

Artigo 34º.- Princípio geral

A gestão financeira e patrimonial da CNPD, incluindo a prática de actos de gestão privada, está sujeita ao regime da contabilidade pública e rege-se segundo princípios de transparência e economicidade.

Artigo 35º.- Regime de receitas e despesas

1. As receitas e despesas da CNPD constam de orçamento anual.

2. Além das dotações que lhe forem atribuídas no orçamento da Assembleia Nacional, constituem receitas da CNPD:

a) O produto das taxas cobradas;

b) O produto da venda de formulários e publicações;

c) O produto dos encargos da passagem de certidões e acesso a documentos;

d) O produto das coimas, nos termos previstos na lei;

e) O saldo de gerência do ano anterior;

f) Os subsídios, subvenções, comparticipações, doações e legados, concedidos por entidades, públicas e privadas, nacionais, estrangeiras ou internacionais;

g) O produto das sanções pecuniárias compulsórias por si aplicadas pelo incumprimento de decisões individualizadas;

h) Quaisquer outras receitas que lhe sejam atribuídas por lei ou contrato.

3. Constituem despesas da CNPD as que resultem dos encargos e responsabilidades decorrentes do seu funcionamento, bem como quaisquer outras relativas à prossecução das suas atribuições.

4. O orçamento anual, as respectivas alterações bem como as respectivas contas são aprovados pela CNPD.

5. As contas da CNPD fi cam sujeitas, nos termos gerais, ao controlo do Tribunal de Contas.

Artigo 36º.- Património

O património da CNPD é constituído pela universalidade dos bens, direitos e garantias que lhe sejam atribuídos por lei, bem como pelos adquiridos após a sua criação, para prosseguimento no desempenho das suas atribuições.

Artigo 37º.- Taxas

1. A CNPD pode cobrar taxas:

a) Pelo registo das notifi cações;

b) Pelas autorizações concedidas ao abrigo do disposto na Lei nº 133/V/2001, de 22 de Janeiro, ou outras autorizações legalmente previstas.

2. O montante das taxas, que deve ser proporcional à complexidade do pedido e ao serviço prestado, é fixado pela CNPD.

3. Em caso de comprovada insufi ciência económica, o pagamento poderá ser feito em prestações, mediante deliberação da CNPD.

CAPÍTULO V.- Dos serviços de apoio e assessoria especializada

Artigo 38º.- Serviços de apoio

A CNPD dispõe de serviços de apoio administrativo e técnico, criados pela CNPD em função do respectivo plano de actividades e na medida do seu cabimento orçamental.
Os serviços de apoio administrativo e técnico são dirigidos por um secretário, habilitado com licenciatura e de reconhecida competência para o desempenho do cargo.
O secretário é nomeado por despacho do presidente, obtido parecer favorável da Comissão, com observancia dos requisitos legais adequados ao desempenho das respectivas funções.
A nomeação do secretário é feita em regime de comissão de serviço, por períodos de três anos, renováveis.

Artigo 39º.- Competências do secretário

Compete ao secretário:

a) Secretariar a Comissão;

b) Dar execução às decisões da Comissão, de acordó com as orientações do presidente;

c) Assegurar a boa organização e funcionamento dos serviços de apoio, nomeadamente no tocante à gestão fi nanceira, do pessoal e das instalações e equipamento, de acordo com as orientações do presidente;

d) Elaborar o projecto de orçamento, bem como as respectivas alterações, e assegurar a sua execução;

e) Elaborar o projecto de relatório anual.

1. Nas suas faltas e impedimentos, o secretário é substituído por um trabalhador qualificado da CNPD designado pelo presidente, obtido o parecer favorável da Comissão.

Artigo 40º.- Regime do pessoal

O pessoal da CNPD está sujeito ao regime jurídico do contrato individual de trabalho e está abrangido pelo regime geral da segurança social.
A CNPD dispõe de um quadro de pessoal próprio estabelecido por resolução da Assembleia Nacional, através do qual se defi ne o respectivo conteúdo funcional.
O estatuto remuneratório do quadro de pessoal é estabelecido por regulamento interno, nos limites fixados pela Assembleia Nacional.
A CNPD pode ser parte em instrumentos de regulamentação colectiva de trabalho.
O recrutamento de pessoal é precedido de anúncio público, obrigatoriamente publicado em dois jornais de grande circulação nacional, mediante concurso público.
As condições de prestação e de disciplina do trabalho são definidas em regulamento aprovado pela CNPD, com observância das disposições legais imperativas do regime do contrato individual de trabalho.

Artigo 41º.- Funções de fi scalização

1. Os trabalhadores, mandatários e representantes da CNPD, bem como as pessoas ou entidades qualifi cadas devidamente credenciadas que desempenhem funções de fiscalização, quando se encontrem no exercício das suas funções e apresentem título comprativo dessa qualidade, são equiparados a agentes de autoridade e gozam, nomeadamente, das seguintes prorrogativas:

a) Aceder às instalações, equipamentos e serviços das entidades sujeitas à supervisão da CNPD;

b) Requisitar documentos para análise e requerer informações escritas;

c) Identifi car todos os indivíduos que infrinjam a legislação, cuja observância devem respeitar, para posterior abertura de procedimento;

d) Solicitar a colaboração das autoridades competentes quando o julguem necessário ao desempenho das suas funções.

2. Aos trabalhadores da CNPD, aos respectivos mandatários, bem como às pessoas ou às entidades qualificadas devidamente credenciadas que desempenhem as funções a que se refere o número anterior são atribuídos cartões de identificação, cujo modelo e condições de emissão constam de resolução da Assembleia Nacional.

Artigo 42º.- Incompatibilidades

O pessoal da CNPD não pode prestar trabalho ou otros serviços, remunerados ou não, a entidades sujeitas à fi scalização da CNPD ou outras cuja actividade colida com as atribuições e competências da CNPD.

Artigo 43º.- Mobilidade

Os funcionários da administração directa ou indirecta do Estado e das Autarquias Locais, bem como os trabalhadores ou administradores de empresas privadas, podem ser providos em comissão ordinária de serviço, por afectação específica, por cedência ou por requisição, para desempenhar funções na CNPD, com garantia do seu lugar de origem e dos direitos nele adquiridos, considerando-se o período de desempenho de funções como tempo de serviço prestado no lugar de origem, suportando a CNPD as despesas inerentes.
Sem prejuízo do disposto no artigo anterior, os trabalhadores da CNPD podem desempenhar funções noutras entidades, em regime de destacamento, requisição ou outros, nos termos da lei, com garantia do seu lugar de origem e dos direitos nele adquiridos, considerando-se tal período como tempo de serviço efectivamente prestado na CNPD.

Artigo 44º.- Assessoria especializada

Desde que assegurado o respectivo cabimento orçamental, a CNPD pode encarregar pessoas individuais ou colectivas da realização de estudos ou de pareceres técnicos relativos a matérias abrangidas pelas atribuições previstas no presente diploma, em regime de mera prestação de serviços.
Os estudos e pareceres técnicos elaborados pelas pessoas identificadas no número anterior não vinculam a CNPD, salvo ratificação expressa dos mesmos pela CNPD.

CAPITULO VI.- Relatório parlamentar e controlo judicial

Artigo 45º.- Relatório parlamentar

A CNPD deve manter a Assembleia Nacional informada sobre as suas deliberações e actividade, enviandolhe uma colectânea mensal das mesmas.
A CNPD envia à Assembleia Nacional, para discussão, na comissão parlamentar responsável pelo sector dos Direitos Fundamentais, precedida de audição dos membros da CNPD, um relatório anual sobre as suas actividades, no qual aborde designadamente, questões legislativas, administrativas e financeiras avaliadas no exercício das suas funções.
O debate em comissão realizar-se-á nos sessenta días posteriores ao recebimento do relatório de actividades e contas.
Os membros da CNPD comparecerão perante a comissão competente da Assembleia Nacional, para prestar informações ou esclarecimentos sobre as suas actividades, sempre que tal lhes for solicitado.

Artigo 46º.- Controlo judicial

A actividade dos órgãos, mandatários e representantes da CNPD fi ca sujeita à jurisdição administrativa, nos termos e limites expressamente previstos na lei.
As sanções por prática de ilícitos de mera ordenação social são impugnáveis junto dos tribunais judiciais competentes.
Das suas decisões e deliberações cabe recurso para os tribunais judiciais ou arbitrais, nos termos previstos na lei.

CAPÍTULO VII.- Disposições transitórias e fi nais

Artigo 47º.- Regime de instalação

A CNDP funciona em regime de instalação pelo período de sessenta dias a partir da tomada de posse dos respectivos membros, para efeitos de designação de secretário, fixação de suas instalações, elaboração e aprovação do seu orçamento, elaboração de regulamento interno, definição de serviços de apoio, entre outras questões indispensáveis ao seu funcionamento.

Artigo 48º.- Sítio de internet

A CNPD deve dispor de um sítio de Internet, com todos os dados relevantes, nomeadamente o diploma de criação, os regulamentos, as deliberações e orientações, bem como a composição dos seus órgãos, os planos, os orçamentos, os relatórios e contas referentes aos dois últimos anos da sua actividade e ainda todas as decisões que não se refiram à sua gestão corrente.
O sítio de Internet serve ainda de suporte para a divulgação de modelos e formulários para a apresentação de requerimentos por via electrónica, visando a satisfação dos respectivos pedidos e obtenção de informações em linha, nos termos legalmente admitidos.
O teor das sentenças ou acórdãos comunicados à CNPD, nos termos do número 3 do artigo 6º, são obrigatoriamente publicados no sítio de Internet da CNPD.

Artigo 49º.- Logótipo

A CNPD pode utilizar, para identifi cação de documentos e tudo o mais que se relacionar com os respectivos serviços, um logotipo, cujo modelo será aprovado pelo plenário da Comissão.

Artigo 50º.- Base de dados actualmente existentes

As entidades públicas e privadas possuidoras de base de dados pessoais dispõem de 180 dias para submeter à fi scalização da CNPD, nos termos da lei, as informações nelas contidas.

Artigo 51º.- Entrada em vigor

O presente diploma entra em vigor no seguinte ao da sua publicação, salvo as disposições com implicações orçamentais cuja vigência fi ca diferida para o dia 1 de Janeiro de 2014.

Aprovada em 24 de Julho de 2013.

O Presidente da Assembleia Nacional, Basílio Mosso Ramos

Promulgada em 9 de Setembro de 2013.

Publique-se.

O Presidente da República, JORGE CARLOS DE ALMEIDA FONSECA

Assinada em 10 de Setembro de 2013.

O Presidente da Assembleia Nacional, Basílio Mosso Ramos

10Jul/18

Lei nº 41/VIII/2013 Regime Jurídico Geral da Protecção de Dados Pessoais das Pessoas Singulares

10 julio, 2018Cabo Verde, Leyalterada pela Lei nº 41/VIII/2013, aprovado pela Lei nº 133/V/2001, de 17 de Setembro., Derecho Informático, Legislacion de Cabo Verde, Lei nº 41/VIII/2013 Regime Jurídico Geral da Protecção de Dados Pessoais das Pessoas Singulares. Regime jurídico geral de protecção de dados pessoais a pessoas singularesJosé Cuervo

Lei nº 41/VIII/2013 Regime Jurídico Geral da Protecção de Dados Pessoais das Pessoas Singulares. Regime jurídico geral de protecção de dados pessoais a pessoas singulares, aprovado pela Lei nº 133/V/2001, alterada pela Lei nº 41/VIII/2013, de 17 de Setembro.

CAPÍTULO I.- DISPOSIÇÕES GERAIS

Artigo 1°.- (Objecto)

A presente lei estabelece o regime jurídico geral de protecção de dados pessoais das pessoas singulares.

Artigo 2° (Âmbito de aplicação)

1. A presente lei aplica-se ao tratamento de dados pessoais por meios total ou parcialmente automatizados, bem como ao tratamento por meios não automatizados de dados pessoais contidos em ficheiros manuais ou a estes destinados.

2. A presente lei aplica-se ao tratamento de dados pessoais efectuados:

a) No âmbito das actividades de estabelecimento do responsável do tratamento situado em território nacional;

b) Fora do território nacional, em local onde a legislação cabo-verdiana seja aplicável por força do direito internacional;

c) Por responsável que, não estando estabelecido no território nacional, recorra, para tratamento de dados pessoais, a meios, automatizados ou não, situados no territorio nacional, salvo se esses meios só forem utilizados para trânsito.

3. A presente lei aplica-se a vídeo-vigilância e outras formas de captação, tratamento e difusão de sons e imagens que permitam identificar pessoas sempre que o responsável pelo tratamento esteja domiciliado ou sediado em território nacional ou recorra a um fornecedor de acesso a redes informáticas e telemáticas aí estabelecido.

4. No caso referido na alínea c) do número 2, o responsável pelo tratamento deve designar, mediante comunicação à Comissão Nacional de Protecção de Dados, adiante designada CPND, um representante estabelecido em território nacional, que se lhe substitua em todos os seus direitos e obrigações, sem prejuízo da sua própria responsabilidade.

6. A presente lei aplica-se ao tratamento de dados pessoais que tenham por objectivo a segurança pública, a defesa nacional e a segurança do Estado, sem prejuízo do disposto em normas especiais constantes de instrumentos de direito internacional a que Cabo Verde se vincule e de legislação específica atinente aos respectivos sectores.

Artigo 3° (Exclusão do âmbito de aplicação)

A presente lei não se aplica ao tratamento de dados pessoais efectuado por pessoa singular no exercício de actividades exclusivamente pessoais ou domésticas.

Artigo 4° (Princípio geral)

Artigo 5° (Definições)

1. Para efeitos da presente lei, entende-se por:

a) «Dados pessoais»: qualquer informação, de qualquer natureza e independentemente do respectivo suporte, incluindo som e imagem, relativa a uma pessoa singular identificada ou identificável, «títular dos dados»;

b) «Tratamento de dados pessoais» ou «Tratamento»: qualquer operação ou conjunto de operações sobre dados pessoais, efectuadas, total ou parcialmente, com ou sem meios automatizados, tais como a recolha, o registo, a organização, a conservação, a adaptação ou alteração, a recuperação, a consulta, a utilização, a comunicação por transmissão, por difusão ou por qualquer outra forma de colocação a disposição, com comparação ou interconexão, bem como o bloqueio, o apagamento ou a destruição;

c) «Ficheiro de dados pessoais» ou «Ficheiro»: qualquer conjunto estruturado de dados pessoais, acessível segundo critérios determinados, quer seja centralizado, descentralizado ou repartido de modo funcional ou geográfico;

d) «Responsável pelo tratamento»: a pessoa singular ou colectiva, a autoridade pública, o serviço ou qualquer outro organismo que, individualmente ou em conjunto com outrem, determine as finalidades e os meios de tratamento dos dados pessoais;

e) «Subcontratante»: a pessoa singular ou colectiva, a autoridade pública, o serviço ou qualquer outro organismo que trate os dados pessoais por conta do responsável pelo tratamento;

g) «Destinatário»: a pessoa singular ou colectiva, a autoridade pública, o serviço ou qualquer outro organismo a quem sejam comunicados dados pessoais, independentemente de se tratar ou não de um terceiro, sem prejuízo de não serem consideradas destinatários as autoridades a quem sejam comunicados dados no ámbito de uma disposição legal;

h) «Consentimento do titular dos dados»: qualquer manifestação de vontade, livre, específica e informada, nos termos da qual o titular aceita que os seus dados pessoais sejam objecto de tratamento;

i) «Interconexão de dados»: forma de tratamento que consiste na possibilidade de relacionamento dos dados de um ficheiro com os dados de um ficheiro ou ficheiros mantidos por outro ou outros responsáveis, ou mantidos

2. Para efeitos do disposto na alínea a) do número anterior, é considerada identificável a pessoa que possa ser identificada, directa ou indirectamente, designadamente por referência a um número de identificação ou a um ou mais elementos específicos da sua identidade física, fisiológica, psíquica, económica, cultural ou social.

3. Para efeitos do disposto na alínea d) do número anterior, sempre que as finalidades e os meios do tratamento sejam determinados por disposições legislativas ou regulamentares, o responsável pelo tratamento deve ser indicado na lei de organização e funcionamento ou no estatuto da entidade legal ou estatutariamente competente para tratar os dados pessoais em causa.

CAPÍTULO II.- TRATAMENTO DE DADOS PESSOAIS

Secção I.- Qualidade dos dados e legitimidade do seu tratamento

Artigo 6° (Qualidade dos dados)

1. Os dados pessoais devem ser:

a) Tratados de forma legal, lícita e com respeito pelo princípio da boa fé;

b) Recolhidos para finalidades determinadas, explícitas e legítimas, não podendo ser posteriormente tratados de forma incompatível com essas finalidades;

c) Adequados, pertinentes e não excessivos relativamente às finalidades para que são recolhidos e posteriormente tratados;

d) Exactos e, se necessário, actualizados, devendo ser tomadas as medidas adequadas para assegurar que sejam apagados ou rectificados os dados inexactos ou incompletos, tendo em conta as finalidades para que foram recolhidos ou para que são tratados posteriormente;

e) Conservados de forma a permitir a identificação dos seus titulares apenas durante o período necessário para a prossecução das finalidades da recolha ou do tratamento posterior.

2. O tratamento posterior dos dados para fins históricos, estatísticos ou científicos, bem como a sua conservação para os mesmos fins por período superior ao referido na alínea e) do número anterior, podem ser autorizados pela CNPD em caso de interesse legítimo do responsável pelo tratamento, desde que não prevaleçam os direitos, liberdades e garantias do titular de dados.

3. Cabe ao responsável pelo tratamento assegurar a observância do disposto nos números anteriores.

Artigo 7° (Condições de legitimidade do tratamento de dados)

O tratamento de dados pessoais só pode ser efectuado se o seu titular tiver dado de forma inequívoca o seu consentimento ou se o tratamento for necessário para:

a) Execução de contrato em que o titular dos dados seja parte ou de diligências prévias efectuadas a seu pedido;

b) Cumprimento de obrigação legal a que o responsável pelo tratamento esteja sujeita;

c) Protecção de interesses vitais do titular dos dados, se este estiver física ou legalmente incapaz de dar o seu consentimento;

d) Execução de uma missão de interesse público ou no exercício de autoridade pública em que esteja investido o responsável pelo tratamento ou um terceiro a quem os dados sejam comunicados;

Artigo 8° (Tratamento de dados sensíveis)

1. É proibido o tratamento de dados pessoais relativos às convicções ou opiniões políticas, filosóficas ou ideológicas, à fé religiosa, à filiação partidária ou sindical, à origem racial ou étnica, à vida privada, à saúde e à vida sexual, incluindo os dados genéricos, salvo:

a) Mediante consentimento expresso do titular, com garantias de não discriminação e com as medidas de segurança adequadas;

b) Mediante autorização prevista na lei, com garantias de não discriminação e com as medidas de segurança adequadas;

c) Quando se destinem a processamento de dados estatísticos não individualmente identificáveis, com as medidas de segurança adequadas.

2. Na concessão de autorização prevista na alínea b) do número anterior a lei deve ater-se, designadamente, à indispensabilidade do tratamento dos dados pessoais referidos no número 1 para o exercício das atribuições legais ou estatutárias do seu responsável, por motivos de interesse público importante.

3. O tratamento dos dados referidos no número 1 é ainda permitido quando se verificar uma das seguintes condições:

a) Ser necessário para proteger interesses vitais do titular dos dados ou de uma outra pessoa e o titular dos dados estiver física ou legalmente incapaz de dar o seu consentimento;

b) Ser efectuado, com o consentimento do titular, por fundação, associação ou organismo sem fins lucrativos de carácter político, filosófico, religioso ou sindical, no âmbito das suas actividades legítimas, sob condição de o tratamento respeitar apenas aos membros dessa fundação, associação ou desse organismo ou às pessoas com quem ele mantenha contactos periódicos ligados às suas finalidades legítimas, e de os dados não serem comunicados a terceiros sem consentimento dos seus titulares;

c) Dizer respeito a dados manifestamente tornados públicos pelo seu titular, desde que se possa legitimamente deduzir das suas declarações o consentimento para o tratamento dos mesmos;

d) Ser necessário à declaração, exercício ou defesa de um direito em processo judicial e for efectuado exclusivamente com essa finalidade.

4. O tratamento dos dados pessoais referentes à saúde e à vida sexual, incluindo os dados genéticos, é permitido quando for necessário para efeitos de medicina preventiva, de diagnóstico médico, de prestação de cuidados ou tratamentos médicos ou de gestão de serviços de saúde, desde que o tratamento desses dados seja efectuado por um profissional de saúde obrigado ao segredo profissional ou por outra pessoa igualmente sujeita a uma obrigação de segredo equivalente, tenha sido notificada a CNPD nos termos do artigo 23°, e sejam garantidas medidas adequadas de segurança da informação.

5. O tratamento dos dados referidos no número 1 pode ainda ser efectuado, com medidas adequadas de segurança da informação, quando se mostrar indispensável à protecção da segurança do Estado, da defesa da segurança pública e da prevenção, investigação ou repressão de infracções penais.

Artigo 9° (Registos de actividades ilícitas, condenações penais, medidas de segurança, infracções e contra-ordenações)

A criação e a manutenção de registos centrais relativos a pessoas suspeitas de actividades ilícitas, condenações penais, decisões que apliquem medidas de segurança, coimas e sanções acessórias e infracções e contra-ordenações só podem ser mantidas por serviços públicos com essa competência legal, observando normas procedimentais e de protecção de dados previstas em diploma legal.
O tratamento de dados pessoais relativos a suspeitas de actividades ilícitas, condenações penais, decisões que apliquem medidas de segurança, coimas e sanções acessórias e infracções e contra-ordenações pode ser autorizado, observadas as normas de protecção de dados e de segurança da informação, quando tal tratamento for necessário à execução de finalidades legítimas do seu responsável, desde que não prevaleçam os direitos, liberdades e garantias do titular dos dados.
O tratamento de dados pessoais para fins de investigação policial deve limitar-se ao necessário para a prevenção de um perigo concreto ou repressão de uma infracção determinada, para o exercício de competências previstas no respectivo estatuto orgânico ou noutra disposição legal e ainda nos termos de acordo, tratado ou convenção internacional de que Cabo Verde seja parte.

Artigo 10° (Interconexão de dados pessoais)

Sem prejuízo de proibição expressa prevista na lei, a interconexão de dados pessoais que não esteja estabelecida em disposição legal está sujeita a autorização da Comissão Parlamentar de Fiscalização solicitada pelo responsável ou em conjunto pelos correspondentes responsáveis dos tratamentos, nos termos do artigo 23°.
A interconexão de dados pessoais deve ser necessária e adequada à prossecução das finalidades legais ou estatutárias e de interesses legítimos dos responsáveis dos tratamentos, não implicar discriminação ou diminuição dos direitos, liberdades e garantias fundamentais dos titulares dos dados, ter em conta o tipo de dados objecto de interconexão e ser rodeada de adequadas medidas de segurança.

Secção II.- Direitos do titular dos dados

Artigo 11° (Direito de informação)

1. Quando recolher dados pessoais directamente do seu titular, o responsável pelo tratamento ou o seu representante deve prestar-lhe, salvo se já forem dele conhecidas, as seguintes informações:

a) Identidade do responsável pelo tratamento e, se for caso disso, do seu representante;

b) Finalidades do tratamento;

c) Os destinatários ou categorias de destinatários dos dados;

d) O carácter obrigatório ou facultativo da resposta, bem como as possíveis consequências se não responder;

f) A decisão de comunicação dos seus dados pessoais pela primeira vez a terceiros para os fins previstos na alínea b) do artigo 13°, previamente e com a indicação expressa de que tem direito de se opor a essa comunicação;

g) A decisão de os seus dados pessoais serem utilizados por conta de terceiros, previamente e com a indicação expressa de que tem o direito de se opor a essa utilização.

2. Os documentos que sirvam de base à recolha de dados pessoais devem conter as informações constantes do número anterior.

4. No caso de recolha de dados em redes abertas, o titular dos dados deve ser informado, salvo se disso já tiver conhecimento, de que os seus dados pessoais podem circular na rede sem condições de segurança, correndo o risco de serem vistos e utilizados por terceiros não autorizados.

5. A obrigação de informação e dispensada por motivos de segurança do Estado, prevenção e investigação criminal, e bem assim, quando, nomeadamente no caso do tratamento de dados com finalidades estatísticas, históricas ou de investigação científica, a informação do titular dos dados se revelar impossível ou implicar esforços desproporcionados ou ainda quando a lei determinar expressamente o registo dos dados ou a sua divulgação.

Artigo 12° (Direito de acesso)

1. O titular dos dados tem o direito de obter do responsável pelo tratamento, livremente e sem restrições, com periodicidade razoável e sem demoras ou custos excessivos:

b) A comunicação, sob forma inteligível, dos seus dados sujeitos a tratamento e de quaisquer informações disponíveis sobre a origem desses dados;

c) O conhecimento da lógica subjacente ao tratamento automatizado dos dados que lhe digam respeito, no que se refere às decisões automatizadas referidas no número 1 do artigo 14°;

d) A rectificação, o apagamento ou o bloqueio dos dados cujo tratamento não respeitar o disposto na presente lei, nomeadamente devido ao carácter incompleto ou inexacto desses dados;

2. Nos casos previstos nos números 4 e 5 do artigo 8°, o direito de acesso e exercido através da CNPD.

3. No caso previsto no número 6 do artigo anterior, o direito de acesso é exercido através da CNPD, com a salvaguarda das normas constitucionais aplicáveis, designadamente as que garantem a liberdade de expressão e informação, a liberdade de imprensa e a independencia e sigilo profissionais dos jornalistas.

4. Nos casos previstos nos números 2 e 3 deste artigo, se a comunicação dos dados ao seu titular puder prejudicar a segurança do Estado, a prevenção ou a investigação criminal ou ainda a liberdade de expressão e informação ou a liberdade de imprensa, a CNPD limita-se a informar o titular dos dados das diligências efectuadas.

5. O direito de acesso a informação relativa a dados da saúde, incluindo os dados genéticos, e exercido por intermédio de médico escolhido pelo titular dos dados.

6. No caso de os dados não serem utilizados para tomar medidas ou decisões em relação a pessoas determinadas, a lei pode restringir o direito de acesso nos casos em que manifestamente não exista qualquer perigo de violação dos direitos, liberdades e garantías do titular dos dados, designadamente do direito à sua intimidade da vida privada, e os referidos dados forem exclusivamente utilizados para fins de investigação científica ou conservados sob forma de dados pessoais durante um período que não exceda o necessário à finalidade exclusiva de elaborar estatísticas.

Artigo 13° (Direito de oposição)

O titular dos dados tem o direito de:

a) Salvo disposição legal em contrário, e pelo menos nos casos referidos nas alíneas d) e e) do artigo 7°, se opor em qualquer altura, por razões ponderosas e legítimas relacionadas com a sua situação particular, a que os dados que lhe digam respeito sejam objecto de tratamento, devendo, em caso de oposição justificada, o tratamento efectuado pelo responsável deixar de poder incidir sobre esses dados;

c) Se opor, sem despesas, a que os seus dados pessoais sejam comunicados pela primeira vez a terceiros para os fins previstos na alínea anterior ou utilizados por conta de terceiros.

Artigo 14° (Não sujeição a decisões individuais automatizadas)

Qualquer pessoa tem o direito de não ficar sujeita a uma decisão que produza efeitos na sua esfera jurídica ou que a afecte de modo significativo, tomada exclusivamente com base num tratamento automatizado de dados destinado a avaliar determinados aspectos da sua personalidade, designadamente a sua capacidade profissional, o seu crédito, a confiança de que é merecedora ou o seu comportamento.
Sem prejuízo do cumprimento das restantes disposições da presente lei, uma pessoa pode consentir em ser sujeita a uma decisão tomada nos termos do número 1, desde que tal ocorra no âmbito da celebração ou da execução de um contrato, e sob condição de o seu pedido de celebração ou execução do contrato ter sido satisfeito, ou de existirem medidas adequadas que garantam a defesa dos seus interesses legítimos e de expor o seu ponto de vista, designadamente o seu direito de representação e expressão.
Pode ainda ser permitida a tomada de uma decisão nos termos do número 1, quando autorizadas pela CNPD e desde que sejam tomadas medidas de garantia da defesa dos interesses legítimos do titular dos dados.

Secção III.- Segurança e confidencialidade do tratamento

Artigo 15° (Segurança do tratamento)

O responsável pelo tratamento deve pôr em prática as medidas técnicas e organizativas adequadas para proteger os dados pessoais contra a destruição, acidental ou ilícita, a perda acidental, a alteração, a difusão ou o acesso não autorizados, nomeadamente quando o tratamento implicar a sua transmissão por rede, e contra qualquer outra forma de tratamento ilícito.
As medidas previstas no número anterior devem assegurar, atendendo aos conhecimentos técnicos disponíveis e aos custos resultantes da sua aplicação, um nível de segurança adequado em relação aos riscos que o tratamento apresenta e a natureza dos dados a proteger.
O responsável pelo tratamento, em caso de tratamento por sua conta, deverá escolher um subcontratante que ofereça garantias suficientes em relação as medidas de segurança técnica e de organização do tratamento a efectuar, e deverá zelar pelo cumprimento dessas medidas.
A realização de operações de tratamento em subcontratação deve ser regida por um contrato ou acto jurídico que vincule o subcontratante ao responsável pelo tratamento e que estipule, designadamente, que o subcontratante apenas actua mediante instruções do responsável pelo tratamento e que lhe incumbe igualmente o cumprimento das obrigações referidas nos números 1 e 2.
Para efeitos de conservação de provas, os elementos da declaração negocial, do contrato ou do acto jurídico relativos à protecção dos dados, bem como as exigências relativas às medidas referidas nos números 1 e 2, são consignados por escrito ou em suporte equivalente, de preferência, com valor probatório legalmente reconhecido.

Artigo 16° (Medidas especiais de segurança)

1. Os responsáveis pelo tratamento dos dados referidos nas alíneas do número 1, nos números 2 e 5 do artigo 8° e no número 1 do artigo 9° devem tomar as medidas adequadas e acrescidas de segurança da informação, designadamente para:

a) Impedir o acesso de pessoa não autorizada às instalações utilizadas para o tratamento desses dados (controlo da entrada nas instalações);

b) Impedir que suportes de dados possam ser lidos, copiados, alterados ou retirados por pessoa não autorizada (controlo dos suportes de dados);

c) Impedir a introdução não autorizada, bem como a tomada de conhecimento, a alteração ou a eliminação não autorizadas de dados pessoais inseridos (controlo da inserção);

d) Impedir que sistemas de tratamento automatizados de dados possam ser utilizados por pessoas não autorizadas através de instalações de transmissão de dados (controlo da utilização);

e) Garantir que as pessoas autorizadas só possam ter acesso aos dados abrangidos pela autorização (controlo de acesso);

f) Garantir a verificação das entidades a quem possam ser transmitidos os dados pessoais através das instalações de transmissão de dados (controlo da transmissão);

g) Garantir que possa verificar-se, a posteriori, em prazo adequado a natureza do tratamento, a fixar na regulamentação aplicável a cada sector, quais os dados pessoais introduzidos, quando e por quem (controlo da introdução);

2. Tendo em conta a natureza das entidades responsáveis pelo tratamento e o tipo das instalações em que é efectuado, a CNPD pode dispensar a existência de certas medidas de segurança, garantido que se mostre o respeito pelos direitos, liberdades e garantias dos titulares dos dados.

3. Os sistemas devem garantir a separação lógica entre os dados referentes à saúde e à vida sexual, incluindo os genéticos, dos restantes dados pessoais.

4. A CNPD pode determinar que a transmissão seja cifrada, nos casos em que a circulação em rede de dados pessoais referidos nos artigos 8° e 9° possa pôr em risco direitos, liberdades e garantias dos respectivos titulares.

Artigo 17° (Confidencialidade do tratamento)

Qualquer pessoa que, agindo sob a autoridade do responsável pelo tratamento ou do subcontratante, bem como o próprio subcontratante, tenha acesso a dados pessoais, não pode proceder ao seu tratamento sem instruções do responsável pelo tratamento, salvo por força de obrigações legais.

Artigo 18° (Sigilo profissional)

Os responsáveis do tratamento de dados pessoais, bem como as pessoas que, no exercício das suas funções, tenham conhecimento dos dados pessoais tratados, ficam obrigados a sigilo profissional, mesmo após o termo das suas funções.
Igual obrigação recai sobre os membros da CNPD, mesmo no termo do mandato.
O disposto nos números anteriores não exclui o dever do fornecimento das informações obrigatórias, nos termos legais, excepto quando constem de ficheiros organizados para fins estatísticos.
O pessoal que exerça funções de assessoria à CNPD ou aos seus membros está sujeito à mesma obrigação de sigilo profissional.

CAPÍTULO III.- TRANSFERÊNCIA DE DADOS PESSOAIS

Artigo 19° (Princípios)

Sem prejuízo do disposto no artigo seguinte, a transferência de dados pessoais que sejam objecto de tratamento ou que se destinam a sê-lo, só pode realizar-se com respeito das disposições da presente lei e demais legislação aplicável em matéria de protecção de dados pessoais e, tratando-se de transferência para o estrangeiro, para o país que assegurar um nível de protecção adequado.
A adequação do nível de protecção é apreciada em função de todas as circunstâncias que rodeiem a transferência ou o conjunto de transferências de dados, em especial, a natureza dos dados, a finalidade e a duração do tratamento ou tratamentos projectados, os países de origem e de destino final, as regras de direito, gerais ou sectoriais, em vigor no país em causa, bem como as regras profissionais e as medidas de segurança que são respeitadas nesse país.
Cabe a CNPD decidir se um Estado estrangeiro assegura um nível de protecção adequado.

Artigo 20° (Derrogações)

1. A transferência de dados pessoais para um país que não assegure um nível de protecção adequado na acepção do número 2 do artigo anterior pode ser permitida pela CNPD se o titular dos dados tiver dado de forma inequívoca o seu consentimento à transferência ou se essa transferência:

b) For necessária para a execução ou celebração de um contrato outorgado ou a outorgar, no interesse do titular dos dados, entre o responsável pelo tratamento e um terceiro;

c) For necessária ou legalmente exigida para a protecção de um interesse público importante, ou para a declaração, o exercício ou a defesa de um direito num proceso judicial;

d) For necessária para proteger os interesses vitais do titular dos dados;

2. Sem prejuízo do disposto no número 1, pode ser autorizada pela CNPD uma transferencia ou um conjunto de transferências de dados pessoais para um país que não assegure um nível de protecção adequado na acepção do número 2 do artigo anterior, desde que o responsável pelo tratamento apresente garantias suficientes de protecção da vida privada e dos direitos e liberdades fundamentais das pessoas, assim como do seu exercício, designadamente, mediante cláusulas contratuais adequadas.

3. A transferência de dados pessoais que constitua medida necessária a protecção da segurança do Estado, da defesa, da segurança pública e da prevenção, investigação e repressão das infracções penais e regida por disposições legais específicas ou pelas convenções, tratados e acordos internacionais em que Cabo Verde é parte.

CAPÍTULO IV.- AUTORIDADE NACIONAL PARA A FISCALIZAÇÃO DE PROTECÇÃO DE DADOS PESSOAIS

Secção I.- Disposições gerais

Artigo 21° (Objectivos da fiscalização)

Artigo 22° (Natureza da fiscalização)

A fiscalização da protecção de dados pessoais é assegurada por uma autoridade administrativa independente, a CNPD, que funciona junto à Assembleia Nacional.
A CNPD é regulada por lei própria.

Secção II.- Notificação

Artigo 23° (Obrigação de notificação)

O responsável pelo tratamento ou, se for caso disso, o seu representante deve notificar a CNPD antes da realização de um tratamento ou conjunto de tratamentos, total ou parcialmente automatizados, destinados à prossecução de uma ou mais finalidades interligadas.
A CNPD pode autorizar a simplificação ou a isenção da notificação para determinadas categorias de tratamentos que, atendendo aos dados a tratar, não sejam susceptíveis de pôr em causa os direitos e liberdades dos titulares dos dados e tenham em conta critérios de celeridade, economia e eficiência.
A autorização deve especificar as finalidades do tratamento, os dados ou categorias de dados ou categoria de dados a tratar, a categoria ou categorias de destinatários a quem podem ser comunicados os dados e o período de conservação dos dados.
Estão isentos de notificação os tratamentos cuja única finalidade seja a manutenção de registos que, nos termos de disposições legislativas ou regulamentares, se destinem a informação do público e possam ser consultados pelo público em geral ou por qualquer pessoa que provar um interesse legítimo.
Os tratamentos não autorizados dos dados pessoais previstos no número 1 do artigo 8° estão sujeitos a notificação quando tratados ao abrigo da alínea a) do número 3 do mesmo artigo.

Artigo 24° (Controlo prévio)

1. Salvo se autorizados por diploma legal, carecem de autorização da CNPD:

a) O tratamento dos dados pessoais a que se referem as alíneas a) e c) do número 1 do artigo 8° e o número 2 do artigo 9°;

b) O tratamento dos dados pessoais relativos ao crédito e à solvabilidade dos seus titulares;

c) A interconexão de dados pessoais, nos termos previstos no artigo 10°;

d) A utilização de dados pessoais para fins não determinantes da recolha.

2. O diploma legal que autorizar os tratamentos a que se refere o número anterior carece de prévio parecer da CNPD.

Artigo 25° (Conteúdo dos pedidos de parecer ou de autorização e da notificação)

Os pedidos de parecer ou de autorização, bem como as notificações, remetidos à CNPD devem conter as seguintes informações:

a) O nome e o endereço do responsável pelo tratamento e, se for o caso, do seu representante;

b) A ou as finalidades do tratamento;

c) A descrição da ou das categorias de titulares dos dados ou das categorias de dados pessoais que lhes respeitem;

d) Os destinatários ou as categorias de destinatários a quem os dados podem ser comunicados e em que condições;

e) A entidade encarregada do processamento da informação, se não for o próprio responsável do tratamento;

f) As eventuais interconexões de tratamentos de dados pessoais;

g) O tempo de conservação dos dados pessoais;

h) A forma e as condições como os titulares dos dados podem ter conhecimento ou fazer corrigir os dados pessoais que lhes respeitem;

i) As transferências de dados previstas para países terceiros;

j) A descrição geral que permita avaliar de forma preliminar a adequação das medidas tomadas para garantir a segurança do tratamento em aplicação dos artigos 15° e 16°.

Artigo 26°.- (Indicações obrigatórias)

1. Os diplomas legais referidos na alínea b) do número 1 do artigo 8° e no número 1 do artigo 9° bem como as autorizações da CNPD e os registos de tratamentos de dados pessoais, devem, pelo menos, indicar:

a) O responsável do ficheiro e, se for caso disso, o seu representante;

b) As categorias de dados pessoais tratados;

c) A ou as finalidades a que se destinam os dados e as categorias de entidades a quem podem ser transmitidos;

d) A forma de exercício do direito de acesso e de rectificação;

e) As eventuais interconexões de tratamentos de dados pessoais;

f) As transferências de dados previstas para outros países.

2. Qualquer alteração das indicações constantes do número 1 está sujeita aos procedimentos previstos nos artigos 23° e 24°.

Artigo 27° (Publicidade dos tratamentos)

O tratamento dos dados pessoais, quando não for objecto de diploma legal e dever ser autorizado ou notificado, consta de registo na CNPD, aberto à consulta por qualquer pessoa.
O registo contém as informações enumeradas nas alíneas a) a d) e i) do artigo 25°.
O responsável por tratamento de dados não sujeito a notificação está obrigado a prestar, de forma adequada, a qualquer pessoa que lho solicite, pelo menos, as informações referidas no número 1 do artigo 26°.
O disposto no presente artigo não se aplica a tratamentos cuja única finalidade seja a manutenção de registos que, nos termos de disposições legislativas ou regulamentares, se destinem à informação do público e se encontrem abertos à consulta do público em geral ou de qualquer pessoa que possa provar um interesse legítimo.
A CNPD deve indicar no seu relatório anual todos os pareceres e autorizações elaborados ou concedidas ao abrigo da presente lei, designadamente as autorizações previstas nas alíneas do número 1 do artigo 8° e no número 2 do artigo 10°.

CAPÍTULO V.- CÓDIGOS DE CONDUTA

Artigo 28° (Finalidades)

Os códigos de conduta destinam-se a contribuir, em função das características dos diferentes sectores, para a boa execução das disposições da presente lei.

Artigo 29° (Intervenção da CNPD)

A CNPD apoia a elaboração de código de conduta.
As associações profissionais e outras organizações representativas de categorias de responsáveis pelo tratamento de dados que tenham elaborado projectos de códigos de conduta podem submetê-los à apreciação da CNPD.
A CNPD pode declarar a conformidade dos projectos com as disposições legais e regulamentares vigentes em matéria de protecção de dados pessoais.

CAPÍTULO VI.- RECURSOS JUDICIAIS, RESPONSABILIDADE CIVIL, INFRACÇÕES E SANÇÕES

Secção I.- Recursos judiciais e responsabilidade civil

Artigo 30° (Recursos judiciais)

Sem prejuízo do direito de apresentação de queixa ou reclamação à CNPD, qualquer pessoa pode, nos termos da lei, recorrer judicialmente da violação dos direitos garantidos pela presente lei.

Artigo 31° (Responsabilidade civil)

Qualquer pessoa que tiver sofrido um prejuízo devido ao tratamento ilícito de dados ou a qualquer outro acto que viole disposições legislativas ou regulamentares em matéria de protecção de dados pessoais tem o direito de obter do responsável a reparação pelo prejuízo sofrido.
O responsável pelo tratamento pode ser parcial ou totalmente exonerado desta responsabilidade se provar que o facto que causou o dano lhe não é imputável.

Secção II.- Infracções e sanções

Sub-secção I.- Contra-ordenações

Artigo 32° (Legislação subsidiaria)

Às infracções previstas na presente subsecção é subsidiariamente aplicável o regime geral das contra-ordenações, com as adaptações constantes dos artigos seguintes.

Artigo 33°

(Omissão ou defeituoso cumprime to de obrigações)

1. As entidades que, por negligência, não cumpram a obrigação de notificação à CNPD do tratamento de dados pessoais a que se referem os números 1 e 5 do artigo 23°, prestem falsas informações ou cumpram a obrigação de notificação com inobservância dos termos previstos no artigo 25°, ou ainda quando, depois de notificadas pela referida Comissão, mantiverem o acesso às redes abertas de transmissão de dados a responsáveis por tratamento de dados pessoais que não cumpram as disposições da presente lei, praticam contra-ordenação punível com as seguintes coimas:

a) Tratando-se de pessoa singular, no mínimo de 50.000$00 e no máximo de 500.000$00;

b) Tratando-se de pessoa colectiva ou de entidade sem personalidade jurídica, no mínimo de 300.000$00 e no máximo de 3.000.000$00.

2. A coima é agravada para o dobro dos seus limites quando se trate de dados sujeitos a controlo prévio, nos termos do artigo 24°.

Artigo 34° (Outras infracções)

1. Praticam contra-ordenação punível com a coima mínima de 100.000$00 e máxima de 1.000.000$00, as entidades que não cumprem alguma das seguintes disposições da presente lei:

a) Designar representante nos termos previstos no número 4 do artigo 2°;

b) Observar as obrigações estabelecidas nos artigos 6°, 11°, 12°, 13°, 14°, 16°, 17° e 27°, número 3.

2. A coima é agravada para o dobro dos seus limites quando não forem cumpridas as obrigações constantes dos artigos 7°, 8°, 9°, 10°, 19° e 20°.

Artigo 35° (Concurso de infracções)

Se o mesmo facto constituir, simultaneamente, crime e contra-ordenação, o agente é punido sempre a título de crime.
As sanções aplicadas as contra-ordenações em concurso são sempre cumuladas materialmente.

Artigo 36° (Punição de negligência e da tentativa)

A negligência é sempre punida nas contra-ordenações previstas no artigo 34°.
A tentativa é sempre punível nas contra-ordenações previstas nos artigos 33° e 34°.

Artigo 37° (Aplicação das coimas)

A aplicação das coimas previstas na presente lei compete ao presidente da CNPD, sob prévia deliberação desta.
A deliberação da CNPD, constitui título executivo, no caso de não ser impugnada no prazo legal.

Artigo 38° (Cumprimento do dever omitido)

Sempre que a contra-ordenação resulte de omissão de um dever, a aplicação da sanção e o pagamento da coima não dispensam o infractor do seu cumprimento, se este ainda for possível.

Artigo 39° (Destino das receitas cobradas)

O montante das importâncias cobradas, em resultado da aplicação das coimas, reverte para a CNPD.

Sub-secção II.- Crimes

Artigo 40° (Não cumprimento de obrigações relativas a protecção de dados)

1. É punido com prisão até um ano ou multa até 120 dias quem intencionalmente:

a) Omitir a notificação ou o pedido de autorização a que se referem os artigos 23° e 24°;

c) Desviar ou utilizar dados pessoais, de forma incompatível com a finalidade determinante da recolha ou com o instrumento de legalização;

d) Promover ou efectuar uma interconexão ilegal de dados pessoais;

e) Depois de ultrapassado o prazo que lhes tiver sido fixado pela CNPD para cumprimento das obrigações previstas na presente lei ou em outra legislação de protecção de dados, as não cumprir;

f) Depois de notificado pela CNPD para o não fazer, mantiver o acesso a redes abertas de transmissão de dados a responsáveis pelo tratamento de dados pessoais que não cumpram as disposições da presente lei.

2. A pena é agravada para o dobro dos seus limites quando se tratar de dados pessoais a que se referem os artigos 8° e 9°.

Artigo 41° (Acesso indevido)

1. Quem, sem a devida autorização, por qualquer modo, aceder a dados pessoais cujo acesso lhe está vedado é punido com prisão até um ano ou multa até 120 dias.

2. A pena é agravada para o dobro dos seus limites quando o acesso:

a) For conseguido através de violação de regras técnicas de segurança;

b) Tiver possibilitado ao agente ou a terceiros o conhecimento de dados pessoais;

c) Tiver proporcionado ao agente ou a terceiros benefício ou vantagens patrimoniais.

3. No caso previsto no número 1 o procedimento criminal depende de queixa.

Artigo 42° (Viciação ou destruição de dados pessoais)

Quem, sem a devida autorização, apagar, destruir, danificar, suprimir ou modificar dados pessoais, tornando-os inutilizáveis ou afectando a sua capacidade de uso, é punido com prisão até dois anos ou multa até 240 dias.
A pena é agravada para o dobro nos seus limites se o dano produzido for particularmente grave.
Se o agente actuar com negligência, a pena é, em ambos os casos, de prisão até um ano ou multa até 120 dias.

Artigo 43° (Desobediência qualificada)

Quem, depois de notificado para o efeito, não interromper, cessar ou bloquear o tratamento de dados pessoais é punido com a pena de prisão correspondente ao crime de desobediencia qualificada.
Na mesma pena incorre quem, depois de notificado:
a) Recusar, sem justa causa, a colaboração que concretamente lhe for exigida pela CNPD, nos termos da lei;
b) Não proceder ao apagamento, destruição total ou parcial de dados pessoais;
c) Não proceder à destruição de dados pessoais, findo o prazo de conservação previsto no artigo 6°.

Artigo 44° (Violação do dever de sigilo)

1. Quem, obrigado a sigilo profissional, nos termos da lei, sem justa causa e sem o debido consentimento, revelar ou divulgar no todo ou em parte dados pessoais é punido com pena de prisão de seis meses até três anos ou multa de oitenta a duzentos dias, se pena mais grave não lhe for aplicável, independentemente da medida disciplinar correspondente à gravidade da sua falta, a qual poderá ir até à cessação do vínculo que o liga ao cargo ou função.

2. A pena é agravada de metade dos seus limites se o agente:

a) For pessoal da função pública ou equiparado, nos termos da lei penal;

b) For determinado pela intenção de obter qualquer vantagem patrimonial ou outro benefício ilegítimo;

c) Puser em perigo a reputação, a honra e consideração ou a intimidade da vida privada de outrem.

3. A negligência é punível com prisão até seis meses ou multa até 120 dias.

4. Fora dos casos previstos no número 2, o procedimento criminal depende de queixa.

Artigo 45° (Punição da tentativa)

Nos crimes previstos nas disposições anteriores, a tentativa é sempre punível.

Artigo 46° (Sanções acessórias)

1. Conjuntamente com as coimas ou penas aplicadas pode, acessoriamente, ser ordenada:

a) A proibição temporária ou definitiva do tratamento, o bloqueio, o apagamento ou a destruição total ou parcial dos dados;

b) A publicidade da sentença condenatória;

c) A advertência ou censura públicas do responsável pelo tratamento.

3. A publicação e feita por extracto de que constem os elementos da infracção e as sanções aplicadas, bem como a identificação do agente.

CAPÍTULO VII.- DISPOSIÇÕES TRANSITÓRIAS E FINAIS

Artigo 47° (Ficheiros manuais existentes)

Os tratamentos de dados existentes em ficheiros manuais à data da entrada em vigor da presente lei devem cumprir o disposto nos artigos 8°, 9°, 11° e 12° no prazo de seis meses.
Em qualquer caso, o titular dos dados pode obter, a seu pedido e, nomeadamente, aquando do exercício do direito de acesso, a rectificação, o apagamento ou o bloqueio dos dados incompletos, inexactos ou conservados de modo incompatível com os fins legítimos prosseguidos pelo responsável pelo tratamento.
A CNPD pode autorizar que os dados existentes em ficheiros manuais e conservados unicamente com finalidades de investigação histórica não tenham que cumprir o disposto nos artigos 8°, 9° e 10°, desde que não sejam, em nenhum caso, reutilizados para finalidade diferente.

Artigo 48° (Ficheiros automatizados existentes)

Os titulares de ficheiros automatizados existentes à data da entrada em vigor da presente lei devem cumprir rigorosamente o que nela se contém, designadamente adaptar tais ficheiros no prazo de seis meses.

Artigo 49° (Entrada em vigor)

A presente lei entra em vigor trinta dias após a sua publicação.

Aprovada em 20 de Dezembro de 2000.

O Presidente da Assembleia Nacional, António do Esprito Santo Fonseca.

Promulgado em 10 de Janeiro de 2001.

Publique-se

O Presidente da Republica, ANTÓNIO MANUEL MASCARENHAS GOMES MONTEIRO.

Assinada em 13 de Janeiro de 2001.

O Presidente da Assembleia Nacional, António do Espirito Santo Fonseca.

10Jul/18

Constituição de 1992, aprovada pela Lei Constitucional nº 1/IV/92, de 25 de Setembro

10 julio, 2018Cabo Verde, Constituciónalterada pelas Leis Constitucionais nos 1/IV/95, aprovada pela Lei Constitucional nº 1/IV/92, Constituição de 1992, de 13 de Novembro e 1/V/99, de 23 de Novembro e Lei Constitucional nº 1/VII/2010 de 3 de Maio, de 25 de SetembroJosé Cuervo

Constituição de 1992, aprovada pela Lei Constitucional nº 1/IV/92, de 25 de Setembro, alterada pelas Leis Constitucionais nos 1/IV/95, de 13 de Novembro
e 1/V/99, de 23 de Novembro e Lei Constitucional nº 1/VII/2010 de 3 de Maio

PARTE I.- PRINCÍPIOS FUNDAMENTAIS

TÍTULO I.- DA REPÚBLICA

TÍTULO II.- RELAÇÕES INTERNACIONAIS E DIREITO INTERNACIONAL

PARTE II.- DIREITOS E DEVERES FUNDAMENTAIS

TÍTULO I.- PRINCÍPIOS GERAIS

Artigo 15º (Reconhecimento da inviolabilidade dos direitos, liberdades e garantias)

1. O Estado reconhece como invioláveis os direitos e liberdades consignados na Constituição e garante a sua protecção.

2. Todas as autoridades públicas têm o dever de respeitar e de garantir o livre exercício dos direitos e das liberdades e o cumprimento dos deveres constitucionais
ou legais.

TÍTULO II.- DIREITOS, LIBERDADES E GARANTIAS

CAPÍTULO I.- Dos direitos, liberdades e garantias individuais

Artigo 29º.- Direito à liberdade

É inviolável o direito à liberdade.
São garantidas as liberdades pessoal, de pensamento, de expressão e de informação, de associação, de religião, de culto, de criação intelectual, artística e cultural, de manifestação e as demais consagradas na Constituição, no direito internacional geral ou convencional, recebido na ordem jurídica interna, e nas leis.
Ninguém pode ser obrigado a declarar a sua ideologia, religião ou culto, fi liação política ou sindical.

Artigo 41º.- Direito à identidade, à personalidade, ao bom nome, à imagem e à intimidade

A todos são garantidos os direitos à identidade pessoal, ao desenvolvimento da personalidade e à capacidade civil, a qual só pode ser limitada por decisão judicial e nos casos e termos estabelecidos na lei.
Todo o cidadão tem direito ao bom nome, à honra e reputação, à imagem e à reserva da intimidade da sua vida pessoal e familiar.

Artigo 44º.- Inviolabilidade de correspondência e de telecomunicações

É garantido o segredo da correspondência e das telecomunicações, salvo nos casos em que por decisão judicial proferida nos termos da lei do processo criminal for permitida a ingerência das autoridades públicas na correspondência ou nas telecomunicações.

Artigo 45º.- Utilização de meios informáticos e protecção de dados pessoais

1. Todos os cidadãos têm o direito de acesso aos dados informatizados que lhes digam respeito, podendo exigir a sua rectificação e actualização, bem como o direito de conhecer a finalidade a que se destinam, nos termos da lei.

2. É proibida a utilização dos meios informáticos para registo e tratamento de dados individualmente identificáveis relativos às convicções políticas, filosóficas ou ideológicas, à fé religiosa, à filiação partidária ou sindical ou à vida privada salvo:

a) Mediante consentimento expresso do titular;

b) Mediante autorização prevista por lei, com garantias de não discriminação;

c) Quando se destinem a processamento de dados estatísticos não individualmente identificáveis.

3. A lei regula a protecção de dados pessoais constantes dos registos informáticos, as condições de acesso aos bancos de dados, de constituição e de utilização por autoridades públicas e entidades privadas de tais bancos ou de suportes informáticos dos mesmos.

4. Não é permitido o acesso a arquivos, ficheiros, registos informá- ticos ou bases de dados para conhecimento de dados pessoais relativos a terceiros, nem a transferência de dados pessoais de um para outro ficheiro informático pertencente a distintos serviços ou instituições, salvo nos casos estabelecidos na lei ou por decisão judicial.

5. Em nenhum caso pode ser atribuído um número nacional único aos cidadãos.

6. A todos é garantido acesso às redes informáticas de uso público, definindo a lei o regime aplicável aos fluxos de dados transfronteiras e as formas de protecção de dados pessoais e de outros cuja salvaguarda se justifique por razões de interesse nacional, bem como o regime de limitação do acesso, para defesa dos valores jurídicos tutelados pelo disposto no número 4 do artigo 48º.

7. Os dados pessoais constantes de ficheiros manuais gozam de protecção idéntica à prevista nos números anteriores, nos termos da lei.

Artigo 46º.- Habeas data

A todo o cidadão é concedido habeas data para asegurar o conhecimento de informações constantes de fi cheiros, arquivos ou registo informático que lhe digam respeito, bem como para ser informado do fi m a que se destinam e para exigir a rectifi cação ou actualização dos dados.
A lei regula o processo de habeas data.

Artigo 48º.- Liberdades de expressão e de informação

1. Todos têm a liberdade de exprimir e de divulgar as suas ideias pela palavra, pela imagem ou por qualquer outro meio, ninguém podendo ser inquietado pelas suas opiniões políticas, filosófi cas, religiosas ou outras.

3. Todos têm a liberdade de informar e de serem informados, procurando, recebendo e divulgando informações e ideias, sob qualquer forma, sem limitações, discriminações ou impedimentos.

3. É proibida a limitação do exercício dessas liberdades por qualquer tipo ou forma de censura.

4. As liberdades de expressão e de informação têm como limites o direito à honra e consideração das pessoas, o direito ao bom-nome, à imagem e à intimidade da vida pessoal e familiar.

5. As liberdades de expressão e de informação são ainda limitadas:

a) Pelo dever da protecção da infância e da juventude;

b) Pela proibição da apologia da violência, da pedofi lia, do racismo, da xenofobia e de qualquer forma de discriminação, nomeadamente da mulher;

c) Pela interdição da difusão de apelos à prática dos actos referidos na alínea anterior.

6. As infracções cometidas no exercício da liberdade de expressão e informação farão o infractor incorrer em responsabilidade civil, disciplinar e criminal, nos termos da lei.

7. É assegurado a todas as pessoas singulares ou colectivas, em condições de igualdade e efi cácia, o direito de resposta e de rectifi cação, bem como o direito de indemnização pelos danos sofridos em virtude de infracções cometidas no exercício da liberdade de expressão e informação.

Artigo 54º.- Liberdade de criação intelectual, artística e cultural

É livre a criação intelectual, cultural e científica, bem como a divulgação de obras literárias, artísticas e científicas.
A lei garante a protecção dos direitos de autor.

10Jul/18

Lei nº 134/V/2001, de 20 Dezembro 2000, estabelece o regime, jurídico de tratamento de dados pessoais no sector das telecomunicações

10 julio, 2018Cabo Verde, Leyde 20 Dezembro 2000, Derecho Informático, estabelece o regime, jurídico de tratamento de dados pessoais no sector das telecomunicações, Legislación Cabo Verde, Legislation Cape Verde, Lei nº 134/V/2001José Cuervo

Lei nº 134/V/2001, de 20 Dezembro 2000, estabelece o regime, jurídico de tratamento de dados pessoais no sector das telecomunicações (B. O. da República de Cabo Verde de 22 de janeiro de 2001, I SÉRIE nº 2)

Actualmente ainda persiste no ordenamento jurídico cabo-verdiano um grande número de direitos praticamente sem garantia ou resposta.

O domínio da protecção dos direitos, liberdades e garantias fundamentais dos cidadãos, designadamente o da protecção de dados pessoais, muito em especial no sector das telecomunicações é, seguramente, um dos que carece de profunda regulamentação.

Trata-se de um domínio de capital importância e que mereceu consagração no texto constitucional (artigo 44º). Efectivamente, a Constituição da República estabelece no seu artigo 44º, n.º3 que a «lei regula a protecção de dados pessoais constantes dos registos informáticos, as condições de acesso aos bancos de dados, de constituição e de utilização por autoridades públicas e entidades privadas de tais bancos ou de suportes informáticos dos mesmos».

Estabelece, ainda, a Constituição da República que a «todos é garantido acesso às redes informáticas de uso público, definido na lei, e o regime aplicável aos fluxos de dados transfronteiras e as formas de protecção de dados pessoais e de outros cuja salvaguarda se justifique por razões de interesse nacional, bem como o regime de limitação do acesso, para a defesa dos valores jurídicos tutelados pelo disposto no n.º 4 do artigo 47º»

É, pois, neste contexto político-constitucional que se insere a aprovação da presente lei.

Com efeito, a matéria de protecção de dados pessoais no sector das telecomunicações carece de regulamentação, por forma a se estabelecer um quadro normativo claro e moderno, que tenha em conta a salvaguarda dos direitos, liberdades e garantías fundamentais dos cidadãos e a liberdade de acesso à informação, de comunicação e circulação de dados, numa perspectiva de harmonia e equilíbrio.

Tratando-se de matéria de reconhecida sensibilidade, expressamente reconhecida, aliás, pela Constituição da República, importa definir com clareza a forma como esses dados devem ser tratados no sector das telecomunicações, de acordo com as exigências do regime jurídico geral da protecção de dados pessoais das pessoas singulares.

A presente lei estabelece um quadro claro de definições fundamentais («assinante», «utilizador», «rede pública de telecomunicações») e serviço de telecomunicações»), que se revelam de grande importância para a interpretação e aplicação do presente diploma.

O regime que ora se consagra abrange o tratamento de dados pessoais em ligação com a oferta de serviços de telecomunicações acessíveis ao público nas redes públicas de telecomunicações, nomeadamente através da rede digital com integração de serviços (RDIS) e das redes públicas móveis digitais.

Alguns dos aspectos do regime jurídico estabelecido, nomeadamente no que se refere à apresentação e restrição da identificação da linha chamadora e da linha conectada e ao reencaminhamento automático de chamadas, são aplicáveis às linhas de assinante ligadas centrais digitais e, sempre que tal seja tecnicamente possível e não exija esforço económico desproporcionado, às linhas de assinante ligadas a centrais analógicas.

Foram estabelecidas regras claras e rígidas, quer do ponto de vista organizacional, quer do ponto de vista técnico, em matéria de segurança dos serviços de telecomunicações acessíveis ao público prestados e, quando necessário, no que respeita à segurança da rede, bem como em matéria de confidencialidade das comunicações.

De igual modo, a presente lei prevê de forma tipificada o regime de tratamento dos dados de tráfego para efeitos de facturação, bem como um regime sancionatório para os casos de cometimento de infracções.

Prevê-se, ainda, o diploma a designação pelo Conselho de Ministros de uma autoridade independente que intervém com entidade reguladora e fiscalizadora, com poderes de autoridade, designadamente em materia de aplicação de coimas em certos casos.

Uma vez que se está no domínio da protecção de dados pessoais, o diploma prevê a intervenção da Comissão Parlamentar de Fiscalização, organismo a ser criado por diploma especial e a quem compete o controlo e a fiscalização, em geral, de tratamento de dados pessoais por parte de entidades públicas ou privadas.

Assim;

Por mandato do Povo, a Assembleia Nacional decreta, nos termos da alínea m) do artigo 175º da Constituição, o seguinte:

Artigo 1º (Objecto)

A presente lei estabelece o regime, jurídico de tratamento de dados pessoais no sector das telecomunicações.

Artigo 2º (Âmbito)

A presente lei aplica-se ao tratamento de dados pessoais no sector das telecomunicações.
As disposições da presente lei asseguram a protecção dos direitos e interesses legítimos dos assinantes que sejam pessoas colectivas compatíveis com a natureza destas.
As excepções à aplicação da presente lei que se mostrem estritamente necessárias para protecção da segurança do Estado, da defesa, da segurança pública e da prevenção, investigação ou repressão de infracções penais são definidas em legislação especial.

Artigo 3º (Definições)

Para efeitos da presente lei e sem prejuízo das definições constantes do regime jurídico geral da protecção de dados pessoais das pessoas singulares, entende-se por:

a) «Assinante»: qualquer pessoa singular ou colectiva que seja parte num contrato com o prestador de serviços de telecomunicações acessíveis ao público para a prestação de tais serviços;

b) «Utilizador»: qualquer pessoa singular que utilize um serviço de telecomunicações acessíveis ao público para fins privados ou comerciais, sem ser necesariamente assinante desse serviço;

c) « Rede pública de telecomunicações »: o conjunto de meiosfísicos, denominados infra-estruturas», ou electromagnéticos que suportam a transmissão, recepção ou emissão de sinais e utilizado, total ou parcialmente, para o fornecimento de serviços de telecomunicações acessíveis ao público;

d) «Serviço de telecomunicações»: a forma e o modo de exploração do encaminhamento ou distribuição de informação através de redes de telecomunicações, com excepção da radiodifusão sonora e da televisão.

Artigo 4º (Serviços abrangidos)

A presente lei é aplicável ao tratamento de dados pessoais, em ligação com a oferta de serviços de telecomunicações acessíveis ao público nas redes públicas de telecomunicações, nomeadamente através da rede digital com integração de serviços (RDIS) e das redes públicas móveis digitais.
Os artigos 9º a 11º são aplicáveis às linhas de assinante ligadas a centrais digitais e, sempre que tal seja tecnicamente possível e não exija esforço económico desproporcionado, às linhas de assinante ligadas a centrais analógicas.
Compete a uma autoridade independente designada por Resolução do Conselho de Ministros confirmar os casos em que seja tecnicamente impossível ou que exijam um investimento desproporcionado para preencher os requisitos dos artigos 9º a 11º e comunicar esse facto à Comissão Parlamentar de Fiscalização.

Artigo 5º (Segurança)

O prestador de um serviço deve adoptar todas as medidas técnicas e organizacionais necessárias para garantir a segurança dos serviços de telecomunicações acessíveis ao público que presta e, se necessário, no que respeita à segurança da rede, deve fazê-lo conjuntamente com o operador da rede pública que suporta o serviço.
As medidas referidas no número anterior devem ser adequadas à prevenção dos riscos existentes, tendo em conta a proporcionalidade dos custos da sua aplicação e o estado de evolução tecnológica.
Em caso de risco especial de violação da segurança da rede, o prestador de um serviço de telecomunicações acessível ao público deve informar os assinantes da existência desse risco, como das soluções possíveis para a evitar e respectivos custos.

Artigo 6º (Confidencialidade das comunicações)

Os prestadores de serviços e os operadores de rede devem garantir a confidencialidade e o sigilo das comunicações através dos serviços de telecomunicações acessíveis ao público e das redes públicas de telecomunicações.
É proibida a escuta, a colocação de dispositivos de escuta, o armazenamento ou outros meios de intercepção ou vigilância de comunicações por terceiros sem o consentimento expresso dos utilizadores com excepção dos casos especificamente previstos na lei.
O disposto na presente lei não obsta à gravação de comunicações, no âmbito de práticas comerciais lícitas, para o efeito de prova de uma transacção comercial ou de qualquer outra comunicação de negócios, desde que o titular dos dados tenha sido disso informado e dado o seu consentimento expresso.

Artigo 7º (Dados de tráfego e de facturação)

1. Os dados do tráfego relativos aos utilizadores e assinantes tratados para estabelecer chamadas e armazenados pelo operador de uma rede pública de telecomunicações ou pelo prestador de um serviço de telecomunicações acessível ao público devem ser apagados ou tornados anónimos após a conclusão da chamada.

2. Para finalidade de facturação dos assinantes e dos pagamentos das interligações, podem ser tratados os seguintes dados:

a) Número ou identificação, endereço e tipo de posto do assinante;

b) Número total de unidades a cobrar para o período de contagem, bem como o tipo, hora de início e duração das chamadas efectuadas ou o volume de dados transmitidos;

c) Data da chamada ou serviço e número chamado;

d) Outras informações relativas a pagamentos, tais como pagamentos adiantados, pagamentos a prestações, cortes de ligação e avisos.

3. O tratamento referido no número anterior apenas é lícito até final do período durante o qual a factura pode ser legalmente contestada ou o pagamento reclamado.

4. Para efeitos de comercialização dos seus próprios serviços de telecomunicações, o prestador de um serviço de telecomunicações acessível ao público pode tratar os dados referidos no número 2 se o assinante tiver dado o seu consentimento.

5. O tratamento dos dados referente ao tráfego e à facturação deve ser limitado ao pessoal das operações das redes públicas de telecomunicações 3 ou dos prestadores de serviços de telecomunicações acessíveis ao público encarregados da facturação ou da gestão do tráfego, da informação e assistência a clientes, da detecção de fraudes e da comercialização dos próprios serviçosde telecominicações do prestador e deve ser limitado ao que for estritamento necessário para efeitos das referidas actividades.

6- O disposto nos números anteriores não prejudica o direito das autoridades competentes serem informadas dos dados relativos à facturação ou ao tráfego nos termos da legislação aplicável, para efeitos da resolução de litígios, em especial os litígios relativos às interligações ou à facturação.

Artigo 8º (Facturação detalhada)

O assinante tem o direito de receber facturas detalhadas ou não detalhadas.
No caso de ter optado pela facturação detalhada, o assinante tem o direito de exigir do operador a supressão dos últimos quatro dígitos.
As chamadas facultadas a título gratuito, Incluindo chamadas para serviços de emergência e de assistência, não devem constar da facturação detalhada.

Artigo 9º (Apresentação e restrição da identificação da linha chamadora e da linha conectada)

Quando for oferecida a apresentação da identificação da linha chamadora, o utilizador chamador deve ter a possibilidade de, através de um meio simples gratuito, e por chamada eliminar a apresentação da identificação da linha chamadora.
O assinante chamador deve ter, linha a linha a possibilidade referida no número anterior.
Quando for oferecida a apresentação da Identificação da linha chamadora, o assinante chamado deve ter a possibilidade de, através de um meio simples e gratuito, dentro dos limites da utilização razoável desta função impedir a apresentação da identificação da linha chamadora das chamadas de entrada.
Quando a apresentação da identificação da linha chamadora for oferecida e a identificação dessa linha for apresentada antes do estabelecimento da chamada, o assinante chamado deve ter a possibilidade de, através de um meio simples, rejeitar chamadas de entrada sempre que a apresentação da identificação da linha chamadora tiver sido eliminada pelo utilizador ou pelo assinante autor da chamada.
Quando for oferecida a apresentação da identificação da linha conectada, o assinante chamado deve ter a possibilidade de, através de um meio simples e gratuito, eliminar a apresentação da identificação da linha conectada ao utilizador autor da chamada.
Se for oferecida a apresentação da identificação da linha chamadora ou da linha conectada, os prestadores de serviços de telecomunicações acessíveis ao público devem informar o público do facto e das possibilidades referidas nos números 1 a 5, designadamente nos contratos de adesão.

Artigo 10 (Excepções)

1. Os operadores de uma rede pública de telecomunicações e os prestadores de um serviço de telecomunicações acessível ao público podem anular a eliminação da apresentação da identificação da linha chamadora, quando compatível com os princípios da necessidade, da adequação e da proporcionalidade:

a) Por um período de tempo não superior a 30 dias, a pedido, feito por escrito, de um assinante que pretenda determinar a origem de chamadas mal intencionadas ou incomodativas, caso em que os números de telefone dos assinantes chamadores que tenham eliminado a identificação da linha chamadora são registados e comunicados ao assinante chamado pelo operador da rede pública de telecomunicações ou pelo prestador do serviço de telecomunicações acessível ao público,

b) Numa base linha a linha, para as organizações com competência legal para receber chamadas de emergência, designadamente as forças policiais, os serviços de ambulância e os bombeiros.

2. A existência do registo e da comunicação a que se ,refere a alínea a) do numero anterior deve ser objecto de informação ao público e a sua utilização deve ser restringida ao fim para que foi concedida.

Artigo 11º (Reencaminhamento automático de chamadas)

Os operadores de uma rede pública de telecomunicações e os prestadores de um serviço de telecomunicações acessível ao público devem asegurar aos assinantes, gratuitamente e através de um meio simples, a possibilidade de interromper o reencaminhamento automático de chamadas efectuado por terceiros para o seu equipamento terminal.

Artigo 12º (Listas de assinantes)

1. Os dados pessoais inseridos em listas impressas ou electrónicas de assinantes acessíveis ao público ou que se possam obter através de serviços de informações telefónicas devem limitar-se ao estritamente necessário para identificar um determinado assinante, a menos que este tenha consentido inequivocamente na publicação de dados pessoais suplementares.

2. O assinante, tem o direito de, a seu pedido e gratuitamente:

a) Não figurar em determinada lista, impressa ou electrónica;

b) Opor-se a que os seus dados pessoais sejam utilizados para fins de marketing directo;

c) Solicitar que o seu endereço seja omitido total ou parcialmente;

d) Não constar nenhuma referência reveladora do seu sexo.

3. Os direitos a que se refere o número 2 são conferidos aos assinantes que sejam pessoas singulares ou pessoas colectivas sem fim lucrativo.

Artigo 13º (Chamadas não solicitadas)

As acções de marketing directo com utilização de aparelhos de chamadas automáticos ou de aparelhos de fax carecem do consentimento prévio do assinante chamado.
O assinante tem o direito de se opor, gratuitamente a receber chamadas não solicitadas para fim de marketing directo realizadas por meios diferentes dos referidos no número anterior.
Os direitos a que se referem os números anteriores são conferidos aos assinantes quer sejam pessoas singulares quer colectivas.
As obrigações decorrentes do presente artigo recaem sobre as entidades que promovam as acções de marketing directo.

Artigo 14º (Características técnicas e normalização)

O cumprimento da presente lei não pode determinar a imposição de requisitos técnicos específicos dos equipamentos terminais ou de outros equipamentos de telecomunicações que impeçam a colocação no mercado e a livre circulação desses equipamentos.

Artigo 15º (Preterição de regras de segurança e violação do dever de confidencialidade)

1. Constituem contra – ordenação, punível com a coima nos termos do respectivo regime geral:

a) A preterição de regras de segurança previstas no artigo 5º;

b) A violação do dever de confidencialidade previsto no artigo 6º.

2. São sempre puníveis a tentativa e a negligência.

Artigo 16º (Outras contra – ordenações)

1. Praticam contra-ordenação, punível com coima de 100.000$00 a 1,000.000$00, as entidades que:

a) Não assegurarem o direito de Informação ou de obtenção do consentimento, nos termos previstos no artigo 6º, n.º 3;

b) Não observarem as obrigações estabelecidas nos artigos 7º a 13º.

2. A coima é agravada para o dobro dos seus limites mínimo e máximo se a contra-ordenação for praticada por pessoa colectiva.

Artigo 17º (Processamento, aplicação e destino de coimas)

Compete à Comissão Parlamentar de Fiscalização o processamento das contra – ordenações e a aplicação das coimas por violação dos artigos 6º, n.º 3, 7º, 12º e 13º do presente diploma.
O Processamento das restantes contra-ordenações compete à autoridade independente referida, no número 3 do artigo 4º.
As receitas Proveniente das coimas aplicadas pela Comissão Parlamentar de Fiscalização revertem-se a favor do Estado.
As receitas provenientes das coimas aplicadas pela autoridade independente referida no número anterior revertem-se em 60% para essa autoridade e em 40% para o Estado.

Artigo 18º (Disposições transitórias)

É dispensado o consentimento previsto no número 4 do artigo 7º relativamente ao tratamento de dados pessoais já em curso à data da entrada em vigor da presente lei, desde que os assinantes sejam informados deste tratamento e não manifestem o seu desacordo no prazo de 60 dias.
O artigo 12º não é aplicável às edições de listas publicadas antes da entrada em vigor da presente lei ou que o sejam no prazo de um ano, sem prejuízo do cumprimento das obrigações previstas pela legislação anterior.

Artigo 19º (Legislação subsidiária)

Em tudo o que não esteja previsto na presente lei, designadamente em matéria de tutela administrativa e jurisdicional, contra-ordenações e sanções e responsabilidade civil, são aplicáveis, consoante o caso, as disposições do regime jurídico geral da protecção de dados pessoais das pessoas singulares, as normas sancionatórias previstas na legislação sobre as telecomunicações, o regime jurídico geral das contra-ordenações e de responsabilidade civil.

Artigo 20º (Entrada em vigor)

A presente lei entra em vigor trinta dias após a sua publicação.

Aprovada em 20 de Dezembro de 2000.

O Presidente da Assembleia Nacional, António do Espírito Santo Fonseca.

Promulgado em 10 de Janeiro de 2001.

Publique-se.

O Presidente da República, ANTÓNIO MANUEL MASCARENHAS GOMES MONTEIRO.

Assinada em 13 de Janeiro de 2001.

O Presidente da Assembleia Nacional, António do Espírito Santo Fonseca.

07Jul/18

Constitution française du 4 octobre 1958

7 julio, 2018Constitución, FranciaConstitution française du 4 octobre 1958, Derecho Informático, Legislación francesa, Legislation françaiseJosé Cuervo

PRÉAMBULE

Le peuple français proclame solennellement son attachement aux Droits de l’homme et aux principes de la souveraineté nationale tels qu’ils ont été définis par la Déclaration de 1789, confirmée et complétée par le préambule de la Constitution de 1946, ainsi qu’aux droits et devoirs définis dans la Charte de l’environnement de 2004.

En vertu de ces principes et de celui de la libre détermination des peuples, la République offre aux territoires d’outre-mer qui manifestent la volonté d’y adhérer des institutions nouvelles fondées sur l’idéal commun de liberté, d’égalité et de fraternité et conçues en vue de leur évolution démocratique.

ARTICLE PREMIER.

La France est une République indivisible, laïque, démocratique et sociale. Elle assure l’égalité devant la loi de tous les citoyens sans distinction d’origine, de race ou de religion. Elle respecte toutes les croyances. Son organisation est décentralisée.

La loi favorise l’égal accès des femmes et des hommes aux mandats électoraux et fonctions électives, ainsi qu’aux responsabilités professionnelles et sociales.

Titre premier – DE LA SOUVERAINETÉ

ARTICLE 2.

La langue de la République est le français.

L’emblème national est le drapeau tricolore, bleu, blanc, rouge.

L’hymne national est «La Marseillaise».

La devise de la République est «Liberté, Égalité, Fraternité».

Son principe est: gouvernement du peuple, par le peuple et pour le peuple.

ARTICLE 3.

La souveraineté nationale appartient au peuple qui l’exerce par ses représentants et par la voie du référendum.

Aucune section du peuple ni aucun individu ne peut s’en attribuer l’exercice.

Le suffrage peut être direct ou indirect dans les conditions prévues par la Constitution. Il est toujours universel, égal et secret.

Sont électeurs, dans les conditions déterminées par la loi, tous les nationaux français majeurs des deux sexes, jouissant de leurs droits civils et politiques.

ARTICLE 4.

Les partis et groupements politiques concourent à l’expression du suffrage. Ils se forment et exercent leur activité librement. Ils doivent respecter les principes de la souveraineté nationale et de la démocratie.

Ils contribuent à la mise en œuvre du principe énoncé au second alinéa de l’article 1er dans les conditions déterminées par la loi.

La loi garantit les expressions pluralistes des opinions et la participation équitable des partis et groupements politiques à la vie démocratique de la Nation.

Titre II – LE PRÉSIDENT DE LA RÉPUBLIQUE

ARTICLE 5.

Le Président de la République veille au respect de la Constitution. Il assure, par son arbitrage, le fonctionnement régulier des pouvoirs publics ainsi que la continuité de l’État.

Il est le garant de l’indépendance nationale, de l’intégrité du territoire et du respect des traités.

ARTICLE 6.

Le Président de la République est élu pour cinq ans au suffrage universel direct.

Nul ne peut exercer plus de deux mandats consécutifs.

Les modalités d’application du présent article sont fixées par une loi organique

ARTICLE 7.

Le Président de la République est élu à la majorité absolue des suffrages exprimés. Si celle-ci n’est pas obtenue au premier tour de scrutin, il est procédé, le quatorzième jour suivant, à un second tour. Seuls peuvent s’y présenter les deux candidats qui, le cas échéant après retrait de candidats plus favorisés, se trouvent avoir recueilli le plus grand nombre de suffrages au premier tour.

Le scrutin est ouvert sur convocation du Gouvernement.

L’élection du nouveau Président a lieu vingt jours au moins et trente-cinq jours au plus avant l’expiration des pouvoirs du président en exercice.

En cas de vacance de la Présidence de la République pour quelque cause que ce soit, ou d’empêchement constaté par le Conseil constitutionnel saisi par le Gouvernement et statuant à la majorité absolue de ses membres, les fonctions du Président de la République, à l’exception de celles prévues aux articles 11 et 12 ci-dessous, sont provisoirement exercées par le président du Sénat et, si celui-ci est à son tour empêché d’exercer ces fonctions, par le Gouvernement.

En cas de vacance ou lorsque l’empêchement est déclaré définitif par le Conseil constitutionnel, le scrutin pour l’élection du nouveau Président a lieu, sauf cas de force majeure constaté par le Conseil constitutionnel, vingt jours au moins et trente-cinq jours au plus après l’ouverture de la vacance ou la déclaration du caractère définitif de l’empêchement.

Si, dans les sept jours précédant la date limite du dépôt des présentations de candidatures, une des personnes ayant, moins de trente jours avant cette date, annoncé publiquement sa décision d’être candidate décède ou se trouve empêchée, le Conseil constitutionnel peut décider de reporter l’élection.

Si, avant le premier tour, un des candidats décède ou se trouve empêché, le Conseil constitutionnel prononce le report de l’élection.

En cas de décès ou d’empêchement de l’un des deux candidats les plus favorisés au premier tour avant les retraits éventuels, le Conseil constitutionnel déclare qu’il doit être procédé de nouveau à l’ensemble des opérations électorales; il en est de même en cas de décès ou d’empêchement de l’un des deux candidats restés en présence en vue du second tour.

Dans tous les cas, le Conseil constitutionnel est saisi dans les conditions fixées au deuxième alinéa de l’article 61 ci-dessous ou dans celles déterminées pour la présentation d’un candidat par la loi organique prévue à l’article 6 ci-dessus.

Le Conseil constitutionnel peut proroger les délais prévus aux troisième et cinquième alinéas sans que le scrutin puisse avoir lieu plus de trente-cinq jours après la date de la décision du Conseil constitutionnel. Si l’application des dispositions du présent alinéa a eu pour effet de reporter l’élection à une date postérieure à l’expiration des pouvoirs du Président en exercice, celui-ci demeure en fonction jusqu’à la proclamation de son successeur.

Il ne peut être fait application ni des articles 49 et 50 ni de l’article 89 de la Constitution durant la vacance de la Présidence de la République ou durant la période qui s’écoule entre la déclaration du caractère définitif de l’empêchement du Président de la République et l’élection de son successeur.

ARTICLE 8.

Le Président de la République nomme le Premier ministre. Il met fin à ses fonctions sur la présentation par celui-ci de la démission du Gouvernement.

Sur la proposition du Premier ministre, il nomme les autres membres du Gouvernement et met fin à leurs fonctions.

ARTICLE 9.

Le Président de la République préside le conseil des ministres.

ARTICLE 10.

Le Président de la République promulgue les lois dans les quinze jours qui suivent la transmission au Gouvernement de la loi définitivement adoptée.

Il peut, avant l’expiration de ce délai, demander au Parlement une nouvelle délibération de la loi ou de certains de ses articles. Cette nouvelle délibération ne peut être refusée.

ARTICLE 11.

Le Président de la République, sur proposition du Gouvernement pendant la durée des sessions ou sur proposition conjointe des deux Assemblées, publiées au Journal Officiel, peut soumettre au référendum tout projet de loi portant sur l’organisation des pouvoirs publics, sur des réformes relatives à la politique économique, sociale ou environnementale de la nation et aux services publics qui y concourent, ou tendant à autoriser la ratification d’un traité qui, sans être contraire à la Constitution, aurait des incidences sur le fonctionnement des institutions.

Lorsque le référendum est organisé sur proposition du Gouvernement, celui-ci fait, devant chaque assemblée, une déclaration qui est suivie d’un débat.

Un référendum portant sur un objet mentionné au premier alinéa peut être organisé à l’initiative d’un cinquième des membres du Parlement, soutenue par un dixième des électeurs inscrits sur les listes électorales. Cette initiative prend la forme d’une proposition de loi et ne peut avoir pour objet l’abrogation d’une disposition législative promulguée depuis moins d’un an.

Les conditions de sa présentation et celles dans lesquelles le Conseil constitutionnel contrôle le respect des dispositions de l’alinéa précédent sont déterminées par une loi organique.

Si la proposition de loi n’a pas été examinée par les deux assemblées dans un délai fixé par la loi organique, le Président de la République la soumet au référendum.

Lorsque la proposition de loi n’est pas adoptée par le peuple français, aucune nouvelle proposition de référendum portant sur le même sujet ne peut être présentée avant l’expiration d’un délai de deux ans suivant la date du scrutin.

Lorsque le référendum a conclu à l’adoption du projet ou de la proposition de loi, le Président de la République promulgue la loi dans les quinze jours qui suivent la proclamation des résultats de la consultation.

ARTICLE 12.

Le Président de la République peut, après consultation du Premier ministre et des présidents des assemblées, prononcer la dissolution de l’Assemblée nationale.

Les élections générales ont lieu vingt jours au moins et quarante jours au plus après la dissolution.

L’Assemblée nationale se réunit de plein droit le deuxième jeudi qui suit son élection. Si cette réunion a lieu en dehors de la période prévue pour la session ordinaire, une session est ouverte de droit pour une durée de quinze jours.

Il ne peut être procédé à une nouvelle dissolution dans l’année qui suit ces élections.

ARTICLE 13.

Le Président de la République signe les ordonnances et les décrets délibérés en conseil des ministres.

Il nomme aux emplois civils et militaires de l’État.

Les conseillers d’État, le grand chancelier de la Légion d’honneur, les ambassadeurs et envoyés extraordinaires, les conseillers maîtres à la Cour des comptes, les préfets, les représentants de l’État dans les collectivités d’outre-mer régies par l’article 74 et en Nouvelle-Calédonie, les officiers généraux, les recteurs des académies, les directeurs des administrations centrales sont nommés en conseil des ministres.

Une loi organique détermine les autres emplois auxquels il est pourvu en conseil des ministres ainsi que les conditions dans lesquelles le pouvoir de nomination du Président de la République peut être par lui délégué pour être exercé en son nom.

Une loi organique détermine les emplois ou fonctions, autres que ceux mentionnés au troisième alinéa, pour lesquels, en raison de leur importance pour la garantie des droits et libertés ou la vie économique et sociale de la Nation, le pouvoir de nomination du Président de la République s’exerce après avis public de la commission permanente compétente de chaque assemblée. Le Président de la République ne peut procéder à une nomination lorsque l’addition des votes négatifs dans chaque commission représente au moins trois cinquièmes des suffrages exprimés au sein des deux commissions. La loi détermine les commissions permanentes compétentes selon les emplois ou fonctions concernés.

ARTICLE 14.

Le Président de la République accrédite les ambassadeurs et les envoyés extraordinaires auprès des puissances étrangères ; les ambassadeurs et les envoyés extraordinaires étrangers sont accrédités auprès de lui.

ARTICLE 15.

Le Président de la République est le chef des armées. Il préside les conseils et les comités supérieurs de la défense nationale.

ARTICLE 16.

Lorsque les institutions de la République, l’indépendance de la nation, l’intégrité de son territoire ou l’exécution de ses engagements internationaux sont menacées d’une manière grave et immédiate et que le fonctionnement régulier des pouvoirs publics constitutionnels est interrompu, le Président de la République prend les mesures exigées par ces circonstances, après consultation officielle du Premier ministre, des présidents des assemblées ainsi que du Conseil constitutionnel.

Il en informe la nation par un message.

Ces mesures doivent être inspirées par la volonté d’assurer aux pouvoirs publics constitutionnels, dans les moindres délais, les moyens d’accomplir leur mission. Le Conseil constitutionnel est consulté à leur sujet.

Le Parlement se réunit de plein droit.

L’Assemblée nationale ne peut être dissoute pendant l’exercice des pouvoirs exceptionnels.

Après trente jours d’exercice des pouvoirs exceptionnels, le Conseil constitutionnel peut être saisi par le Président de l’Assemblée nationale, le Président du Sénat, soixante députés ou soixante sénateurs, aux fins d’examiner si les conditions énoncées au premier alinéa demeurent réunies. Il se prononce dans les délais les plus brefs par un avis public. Il procède de plein droit à cet examen et se prononce dans les mêmes conditions au terme de soixante jours d’exercice des pouvoirs exceptionnels et à tout moment au-delà de cette durée.

ARTICLE 17.

Le Président de la République a le droit de faire grâce à titre individuel.

ARTICLE 18.

Le Président de la République communique avec les deux assemblées du Parlement par des messages qu’il fait lire et qui ne donnent lieu à aucun débat.

Il peut prendre la parole devant le Parlement réuni à cet effet en Congrès. Sa déclaration peut donner lieu, hors sa présence, à un débat qui ne fait l’objet d’aucun vote.

Hors session, les assemblées parlementaires sont réunies spécialement à cet effet.

ARTICLE 19.

Les actes du Président de la République autres que ceux prévus aux articles 8 (1er alinéa), 11, 12, 16, 18, 54, 56 et 61 sont contresignés par le Premier ministre et, le cas échéant, par les ministres responsables.

Titre III – LE GOUVERNEMENT

ARTICLE 20.

Le Gouvernement détermine et conduit la politique de la nation.

Il dispose de l’administration et de la force armée.

Il est responsable devant le Parlement dans les conditions et suivant les procédures prévues aux articles 49 et 50.

ARTICLE 21.

Le Premier ministre dirige l’action du Gouvernement. Il est responsable de la défense nationale. Il assure l’exécution des lois. Sous réserve des dispositions de l’article 13, il exerce le pouvoir réglementaire et nomme aux emplois civils et militaires.

Il peut déléguer certains de ses pouvoirs aux ministres.

Il supplée, le cas échéant, le Président de la République dans la présidence des conseils et comités prévus à l’article 15.

Il peut, à titre exceptionnel, le suppléer pour la présidence d’un conseil des ministres en vertu d’une délégation expresse et pour un ordre du jour déterminé.

ARTICLE 22.

Les actes du Premier ministre sont contresignés, le cas échéant, par les ministres chargés de leur exécution.

ARTICLE 23.

Les fonctions de membre du Gouvernement sont incompatibles avec l’exercice de tout mandat parlementaire, de toute fonction de représentation professionnelle à caractère national et de tout emploi public ou de toute activité professionnelle.

Une loi organique fixe les conditions dans lesquelles il est pourvu au remplacement des titulaires de tels mandats, fonctions ou emplois.

Le remplacement des membres du Parlement a lieu conformément aux dispositions de l’article 25.

Titre IV – LE PARLEMENT

ARTICLE 24.

Le Parlement vote la loi. Il contrôle l’action du Gouvernement. Il évalue les politiques publiques.

Il comprend l’Assemblée nationale et le Sénat.

Les députés à l’Assemblée nationale, dont le nombre ne peut excéder cinq cent soixante-dix-sept, sont élus au suffrage direct.

Le Sénat, dont le nombre de membres ne peut excéder trois cent quarante-huit, est élu au suffrage indirect. Il assure la représentation des collectivités territoriales de la République.

Les Français établis hors de France sont représentés à l’Assemblée nationale et au Sénat.

ARTICLE 25.

Une loi organique fixe la durée des pouvoirs de chaque assemblée, le nombre de ses membres, leur indemnité, les conditions d’éligibilité, le régime des inéligibilités et des incompatibilités.

Elle fixe également les conditions dans lesquelles sont élues les personnes appelées à assurer, en cas de vacance du siège, le remplacement des députés ou des sénateurs jusqu’au renouvellement général ou partiel de l’assemblée à laquelle ils appartenaient ou leur remplacement temporaire en cas d’acceptation par eux de fonctions gouvernementales.

Une commission indépendante, dont la loi fixe la composition et les règles d’organisation et de fonctionnement, se prononce par un avis public sur les projets de texte et propositions de loi délimitant les circonscriptions pour l’élection des députés ou modifiant la répartition des sièges de députés ou de sénateurs.

ARTICLE 26.

Aucun membre du Parlement ne peut être poursuivi, recherché, arrêté, détenu ou jugé à l’occasion des opinions ou votes émis par lui dans l’exercice de ses fonctions.

Aucun membre du Parlement ne peut faire l’objet, en matière criminelle ou correctionnelle, d’une arrestation ou de toute autre mesure privative ou restrictive de liberté qu’avec l’autorisation du bureau de l’assemblée dont il fait partie. Cette autorisation n’est pas requise en cas de crime ou délit flagrant ou de condamnation définitive.

La détention, les mesures privatives ou restrictives de liberté ou la poursuite d’un membre du Parlement sont suspendues pour la durée de la session si l’assemblée dont il fait partie le requiert.

L’assemblée intéressée est réunie de plein droit pour des séances supplémentaires pour permettre, le cas échéant, l’application de l’alinéa ci-dessus.

ARTICLE 27.

Tout mandat impératif est nul.

Le droit de vote des membres du Parlement est personnel.

La loi organique peut autoriser exceptionnellement la délégation de vote. Dans ce cas, nul ne peut recevoir délégation de plus d’un mandat.

ARTICLE 28.

Le Parlement se réunit de plein droit en une session ordinaire qui commence le premier jour ouvrable d’octobre et prend fin le dernier jour ouvrable de juin.

Le nombre de jours de séance que chaque assemblée peut tenir au cours de la session ordinaire ne peut excéder cent vingt. Les semaines de séance sont fixées par chaque assemblée.

Le Premier ministre, après consultation du président de l’assemblée concernée, ou la majorité des membres de chaque assemblée peut décider la tenue de jours supplémentaires de séance.

Les jours et les horaires des séances sont déterminés par le règlement de chaque assemblée.

ARTICLE 29.

Le Parlement est réuni en session extraordinaire à la demande du Premier ministre ou de la majorité des membres composant l’Assemblée nationale, sur un ordre du jour déterminé.

Lorsque la session extraordinaire est tenue à la demande des membres de l’Assemblée nationale, le décret de clôture intervient dès que le Parlement a épuisé l’ordre du jour pour lequel il a été convoqué et au plus tard douze jours à compter de sa réunion.

Le Premier ministre peut seul demander une nouvelle session avant l’expiration du mois qui suit le décret de clôture.

ARTICLE 30.

Hors les cas dans lesquels le Parlement se réunit de plein droit, les sessions extraordinaires sont ouvertes et closes par décret du Président de la République.

ARTICLE 31.

Les membres du Gouvernement ont accès aux deux assemblées. Ils sont entendus quand ils le demandent.

Ils peuvent se faire assister par des commissaires du Gouvernement.

ARTICLE 32.

Le président de l’Assemblée nationale est élu pour la durée de la législature. Le Président du Sénat est élu après chaque renouvellement partiel.

ARTICLE 33.

Les séances des deux assemblées sont publiques. Le compte rendu intégral des débats est publié au Journal officiel.

Chaque assemblée peut siéger en comité secret à la demande du Premier ministre ou d’un dixième de ses membres.

Titre V – DES RAPPORTS ENTRE LE PARLEMENT ET LE GOUVERNEMENT

ARTICLE 34.

La loi fixe les règles concernant:

– les droits civiques et les garanties fondamentales accordées aux citoyens pour l’exercice des libertés publiques; la liberté, le pluralisme et l’indépendance des médias; les sujétions imposées par la défense nationale aux citoyens en leur personne et en leurs biens;

– la nationalité, l’état et la capacité des personnes, les régimes matrimoniaux, les successions et libéralités;

– la détermination des crimes et délits ainsi que les peines qui leur sont applicables; la procédure pénale; l’amnistie; la création de nouveaux ordres de juridiction et le statut des magistrats;

– l’assiette, le taux et les modalités de recouvrement des impositions de toutes natures; le régime d’émission de la monnaie.

La loi fixe également les règles concernant:

– le régime électoral des assemblées parlementaires, des assemblées locales et des instances représentatives des Français établis hors de France ainsi que les conditions d’exercice des mandats électoraux et des fonctions électives des membres des assemblées délibérantes des collectivités territoriales;

– la création de catégories d’établissements publics;

– les garanties fondamentales accordées aux fonctionnaires civils et militaires de l’État;

– les nationalisations d’entreprises et les transferts de propriété d’entreprises du secteur public au secteur privé.

La loi détermine les principes fondamentaux:

– de l’organisation générale de la défense nationale;

– de la libre administration des collectivités territoriales, de leurs compétences et de leurs ressources;

– de l’enseignement;

– de la préservation de l’environnement;

– du régime de la propriété, des droits réels et des obligations civiles et commerciales;

– du droit du travail, du droit syndical et de la sécurité sociale.

Les lois de finances déterminent les ressources et les charges de l’État dans les conditions et sous les réserves prévues par une loi organique.

Les lois de financement de la sécurité sociale déterminent les conditions générales de son équilibre financier et, compte tenu de leurs prévisions de recettes, fixent ses objectifs de dépenses, dans les conditions et sous les réserves prévues par une loi organique.

Des lois de programmation déterminent les objectifs de l’action de l’État.

Les orientations pluriannuelles des finances publiques sont définies par des lois de programmation. Elles s’inscrivent dans l’objectif d’équilibre des comptes des administrations publiques.

Les dispositions du présent article pourront être précisées et complétées par une loi organique.

ARTICLE 34-1.

Les assemblées peuvent voter des résolutions dans les conditions fixées par la loi organique.

Sont irrecevables et ne peuvent être inscrites à l’ordre du jour les propositions de résolution dont le Gouvernement estime que leur adoption ou leur rejet serait de nature à mettre en cause sa responsabilité ou qu’elles contiennent des injonctions à son égard.

ARTICLE 35.

La déclaration de guerre est autorisée par le Parlement.

Le Gouvernement informe le Parlement de sa décision de faire intervenir les forces armées à l’étranger, au plus tard trois jours après le début de l’intervention. Il précise les objectifs poursuivis. Cette information peut donner lieu à un débat qui n’est suivi d’aucun vote.

Lorsque la durée de l’intervention excède quatre mois, le Gouvernement soumet sa prolongation à l’autorisation du Parlement. Il peut demander à l’Assemblée nationale de décider en dernier ressort.

Si le Parlement n’est pas en session à l’expiration du délai de quatre mois, il se prononce à l’ouverture de la session suivante.

ARTICLE 36.

L’état de siège est décrété en Conseil des ministres.

Sa prorogation au-delà de douze jours ne peut être autorisée que par le Parlement.

ARTICLE 37.

Les matières autres que celles qui sont du domaine de la loi ont un caractère réglementaire.

Les textes de forme législative intervenus en ces matières peuvent être modifiés par décrets pris après avis du Conseil d’État. Ceux de ces textes qui interviendraient après l’entrée en vigueur de la présente Constitution ne pourront être modifiés par décret que si le Conseil constitutionnel a déclaré qu’ils ont un caractère réglementaire en vertu de l’alinéa précédent.

ARTICLE 37-1.

La loi et le règlement peuvent comporter, pour un objet et une durée limités, des dispositions à caractère expérimental.

ARTICLE 38.

Le Gouvernement peut, pour l’exécution de son programme, demander au Parlement l’autorisation de prendre par ordonnances, pendant un délai limité, des mesures qui sont normalement du domaine de la loi.

Les ordonnances sont prises en conseil des ministres après avis du Conseil d’État. Elles entrent en vigueur dès leur publication mais deviennent caduques si le projet de loi de ratification n’est pas déposé devant le Parlement avant la date fixée par la loi d’habilitation. Elles ne peuvent être ratifiées que de manière expresse.

A l’expiration du délai mentionné au premier alinéa du présent article, les ordonnances ne peuvent plus être modifiées que par la loi dans les matières qui sont du domaine législatif.

ARTICLE 39.

L’initiative des lois appartient concurremment au Premier ministre et aux membres du Parlement.

Les projets de loi sont délibérés en conseil des ministres après avis du Conseil d’État et déposés sur le bureau de l’une des deux assemblées. Les projets de loi de finances et de loi de financement de la sécurité sociale sont soumis en premier lieu à l’Assemblée nationale. Sans préjudice du premier alinéa de l’article 44, les projets de loi ayant pour principal objet l’organisation des collectivités territoriales sont soumis en premier lieu au Sénat.

La présentation des projets de loi déposés devant l’Assemblée nationale ou le Sénat répond aux conditions fixées par une loi organique.

Les projets de loi ne peuvent être inscrits à l’ordre du jour si la Conférence des présidents de la première assemblée saisie constate que les règles fixées par la loi organique sont méconnues. En cas de désaccord entre la Conférence des présidents et le Gouvernement, le président de l’assemblée intéressée ou le Premier ministre peut saisir le Conseil constitutionnel qui statue dans un délai de huit jours.

Dans les conditions prévues par la loi, le président d’une assemblée peut soumettre pour avis au Conseil d’État, avant son examen en commission, une proposition de loi déposée par l’un des membres de cette assemblée, sauf si ce dernier s’y oppose.

ARTICLE 40.

Les propositions et amendements formulés par les membres du Parlement ne sont pas recevables lorsque leur adoption aurait pour conséquence soit une diminution des ressources publiques, soit la création ou l’aggravation d’une charge publique.

ARTICLE 41.

S’il apparaît au cours de la procédure législative qu’une proposition ou un amendement n’est pas du domaine de la loi ou est contraire à une délégation accordée en vertu de l’article 38, le Gouvernement ou le président de l’assemblée saisie peut opposer l’irrecevabilité.

En cas de désaccord entre le Gouvernement et le président de l’assemblée intéressée, le Conseil constitutionnel, à la demande de l’un ou de l’autre, statue dans un délai de huit jours.

ARTICLE 42.

La discussion des projets et des propositions de loi porte, en séance, sur le texte adopté par la commission saisie en application de l’article 43 ou, à défaut, sur le texte dont l’assemblée a été saisie.

Toutefois, la discussion en séance des projets de révision constitutionnelle, des projets de loi de finances et des projets de loi de financement de la sécurité sociale porte, en première lecture devant la première assemblée saisie, sur le texte présenté par le Gouvernement et, pour les autres lectures, sur le texte transmis par l’autre assemblée.

La discussion en séance, en première lecture, d’un projet ou d’une proposition de loi ne peut intervenir, devant la première assemblée saisie, qu’à l’expiration d’un délai de six semaines après son dépôt. Elle ne peut intervenir, devant la seconde assemblée saisie, qu’à l’expiration d’un délai de quatre semaines à compter de sa transmission.

L’alinéa précédent ne s’applique pas si la procédure accélérée a été engagée dans les conditions prévues à l’article 45. Il ne s’applique pas non plus aux projets de loi de finances, aux projets de loi de financement de la sécurité sociale et aux projets relatifs aux états de crise.

ARTICLE 43.

Les projets et propositions de loi sont envoyés pour examen à l’une des commissions permanentes dont le nombre est limité à huit dans chaque assemblée.

A la demande du Gouvernement ou de l’assemblée qui en est saisie, les projets ou propositions de loi sont envoyés pour examen à une commission spécialement désignée à cet effet.

ARTICLE 44.

Les membres du Parlement et le Gouvernement ont le droit d’amendement. Ce droit s’exerce en séance ou en commission selon les conditions fixées par les règlements des assemblées, dans le cadre déterminé par une loi organique.

Après l’ouverture du débat, le Gouvernement peut s’opposer à l’examen de tout amendement qui n’a pas été antérieurement soumis à la commission.

Si le Gouvernement le demande, l’assemblée saisie se prononce par un seul vote sur tout ou partie du texte en discussion en ne retenant que les amendements proposés ou acceptés par le Gouvernement.

ARTICLE 45.

Tout projet ou proposition de loi est examiné successivement dans les deux assemblées du Parlement en vue de l’adoption d’un texte identique. Sans préjudice de l’application des articles 40 et 41, tout amendement est recevable en première lecture dès lors qu’il présente un lien, même indirect, avec le texte déposé ou transmis.

Lorsque, par suite d’un désaccord entre les deux assemblées, un projet ou une proposition de loi n’a pu être adopté après deux lectures par chaque assemblée ou, si le Gouvernement a décidé d’engager la procédure accélérée sans que les Conférences des présidents s’y soient conjointement opposées, après une seule lecture par chacune d’entre elles, le Premier ministre ou, pour une proposition de loi, les présidents des deux assemblées agissant conjointement, ont la faculté de provoquer la réunion d’une commission mixte paritaire chargée de proposer un texte sur les dispositions restant en discussion.

Le texte élaboré par la commission mixte peut être soumis par le Gouvernement pour approbation aux deux assemblées. Aucun amendement n’est recevable sauf accord du Gouvernement.

Si la commission mixte ne parvient pas à l’adoption d’un texte commun ou si ce texte n’est pas adopté dans les conditions prévues à l’alinéa précédent, le Gouvernement peut, après une nouvelle lecture par l’Assemblée nationale et par le Sénat, demander à l’Assemblée nationale de statuer définitivement. En ce cas, l’Assemblée nationale peut reprendre soit le texte élaboré par la commission mixte, soit le dernier texte voté par elle, modifié le cas échéant par un ou plusieurs des amendements adoptés par le Sénat.

ARTICLE 46.

Les lois auxquelles la Constitution confère le caractère de lois organiques sont votées et modifiées dans les conditions suivantes.

Le projet ou la proposition ne peut, en première lecture, être soumis à la délibération et au vote des assemblées qu’à l’expiration des délais fixés au troisième alinéa de l’article 42. Toutefois, si la procédure accélérée a été engagée dans les conditions prévues à l’article 45, le projet ou la proposition ne peut être soumis à la délibération de la première assemblée saisie avant l’expiration d’un délai de quinze jours après son dépôt.

La procédure de l’article 45 est applicable. Toutefois, faute d’accord entre les deux assemblées, le texte ne peut être adopté par l’Assemblée nationale en dernière lecture qu’à la majorité absolue de ses membres.

Les lois organiques relatives au Sénat doivent être votées dans les mêmes termes par les deux assemblées.

Les lois organiques ne peuvent être promulguées qu’après la déclaration par le Conseil constitutionnel de leur conformité à la Constitution.

ARTICLE 47.

Le Parlement vote les projets de loi de finances dans les conditions prévues par une loi organique.

Si l’Assemblée nationale ne s’est pas prononcée en première lecture dans le délai de quarante jours après le dépôt d’un projet, le Gouvernement saisit le Sénat qui doit statuer dans un délai de quinze jours. Il est ensuite procédé dans les conditions prévues à l’article 45.

Si le Parlement ne s’est pas prononcé dans un délai de soixante-dix jours, les dispositions du projet peuvent être mises en vigueur par ordonnance.

Si la loi de finances fixant les ressources et les charges d’un exercice n’a pas été déposée en temps utile pour être promulguée avant le début de cet exercice, le Gouvernement demande d’urgence au Parlement l’autorisation de percevoir les impôts et ouvre par décret les crédits se rapportant aux services votés.

Les délais prévus au présent article sont suspendus lorsque le Parlement n’est pas en session.

ARTICLE 47-1.

Le Parlement vote les projets de loi de financement de la sécurité sociale dans les conditions prévues par une loi organique.

Si l’Assemblée nationale ne s’est pas prononcée en première lecture dans le délai de vingt jours après le dépôt d’un projet, le Gouvernement saisit le Sénat qui doit statuer dans un délai de quinze jours. Il est ensuite procédé dans les conditions prévues à l’article 45.

Si le Parlement ne s’est pas prononcé dans un délai de cinquante jours, les dispositions du projet peuvent être mises en oeuvre par ordonnance.

Les délais prévus au présent article sont suspendus lorsque le Parlement n’est pas en session et, pour chaque assemblée, au cours des semaines où elle a décidé de ne pas tenir séance, conformément au deuxième alinéa de l’article 28.

ARTICLE 47-2.

La Cour des comptes assiste le Parlement dans le contrôle de l’action du Gouvernement. Elle assiste le Parlement et le Gouvernement dans le contrôle de l’exécution des lois de finances et de l’application des lois de financement de la sécurité sociale ainsi que dans l’évaluation des politiques publiques. Par ses rapports publics, elle contribue à l’information des citoyens.

Les comptes des administrations publiques sont réguliers et sincères. Ils donnent une image fidèle du résultat de leur gestion, de leur patrimoine et de leur situation financière.

ARTICLE 48.

Sans préjudice de l’application des trois derniers alinéas de l’article 28, l’ordre du jour est fixé par chaque assemblée.

Deux semaines de séance sur quatre sont réservées par priorité, et dans l’ordre que le Gouvernement a fixé, à l’examen des textes et aux débats dont il demande l’inscription à l’ordre du jour.

En outre, l’examen des projets de loi de finances, des projets de loi de financement de la sécurité sociale et, sous réserve des dispositions de l’alinéa suivant, des textes transmis par l’autre assemblée depuis six semaines au moins, des projets relatifs aux états de crise et des demandes d’autorisation visées à l’article 35 est, à la demande du Gouvernement, inscrit à l’ordre du jour par priorité.

Une semaine de séance sur quatre est réservée par priorité et dans l’ordre fixé par chaque assemblée au contrôle de l’action du Gouvernement et à l’évaluation des politiques publiques.

Un jour de séance par mois est réservé à un ordre du jour arrêté par chaque assemblée à l’initiative des groupes d’opposition de l’assemblée intéressée ainsi qu’à celle des groupes minoritaires.

Une séance par semaine au moins, y compris pendant les sessions extraordinaires prévues à l’article 29, est réservée par priorité aux questions des membres du Parlement et aux réponses du Gouvernement.

ARTICLE 49.

Le Premier ministre, après délibération du conseil des ministres, engage devant l’Assemblée nationale la responsabilité du Gouvernement sur son programme ou éventuellement sur une déclaration de politique générale.

L’Assemblée nationale met en cause la responsabilité du Gouvernement par le vote d’une motion de censure. Une telle motion n’est recevable que si elle est signée par un dixième au moins des membres de l’Assemblée nationale. Le vote ne peut avoir lieu que quarante-huit heures après son dépôt. Seuls sont recensés les votes favorables à la motion de censure qui ne peut être adoptée qu’à la majorité des membres composant l’Assemblée. Sauf dans le cas prévu à l’alinéa ci-dessous, un député ne peut être signataire de plus de trois motions de censure au cours d’une même session ordinaire et de plus d’une au cours d’une même session extraordinaire.

Le Premier ministre peut, après délibération du conseil des ministres, engager la responsabilité du Gouvernement devant l’Assemblée nationale sur le vote d’un projet de loi de finances ou de financement de la sécurité sociale. Dans ce cas, ce projet est considéré comme adopté, sauf si une motion de censure, déposée dans les vingt-quatre heures qui suivent, est votée dans les conditions prévues à l’alinéa précédent. Le Premier ministre peut, en outre, recourir à cette procédure pour un autre projet ou une proposition de loi par session.

Le Premier ministre a la faculté de demander au Sénat l’approbation d’une déclaration de politique générale.

ARTICLE 50.

Lorsque l’Assemblée nationale adopte une motion de censure ou lorsqu’elle désapprouve le programme ou une déclaration de politique générale du Gouvernement, le Premier ministre doit remettre au Président de la République la démission du Gouvernement.

ARTICLE 50-1.

Devant l’une ou l’autre des assemblées, le Gouvernement peut, de sa propre initiative ou à la demande d’un groupe parlementaire au sens de l’article 51-1, faire, sur un sujet déterminé, une déclaration qui donne lieu à débat et peut, s’il le décide, faire l’objet d’un vote sans engager sa responsabilité.

ARTICLE 51.

La clôture de la session ordinaire ou des sessions extraordinaires est de droit retardée pour permettre, le cas échéant, l’application de l’article 49. A cette même fin, des séances supplémentaires sont de droit.

ARTICLE 51-1.

Le règlement de chaque assemblée détermine les droits des groupes parlementaires constitués en son sein. Il reconnaît des droits spécifiques aux groupes d’opposition de l’assemblée intéressée ainsi qu’aux groupes minoritaires.

ARTICLE 51-2.

Pour l’exercice des missions de contrôle et d’évaluation définies au premier alinéa de l’article 24, des commissions d’enquête peuvent être créées au sein de chaque assemblée pour recueillir, dans les conditions prévues par la loi, des éléments d’information.

La loi détermine leurs règles d’organisation et de fonctionnement. Leurs conditions de création sont fixées par le règlement de chaque assemblée.

Titre VI – DES TRAITÉS ET ACCORDS INTERNATIONAUX

ARTICLE 52.

Le Président de la République négocie et ratifie les traités.

Il est informé de toute négociation tendant à la conclusion d’un accord international non soumis à ratification.

ARTICLE 53.

Les traités de paix, les traités de commerce, les traités ou accords relatifs à l’organisation internationale, ceux qui engagent les finances de l’État, ceux qui modifient des dispositions de nature législative, ceux qui sont relatifs à l’état des personnes, ceux qui comportent cession, échange ou adjonction de territoire, ne peuvent être ratifiés ou approuvés qu’en vertu d’une loi.

Ils ne prennent effet qu’après avoir été ratifiés ou approuvés.

Nulle cession, nul échange, nulle adjonction de territoire n’est valable sans le consentement des populations intéressées.

ARTICLE 53-1.

La République peut conclure avec les États européens qui sont liés par des engagements identiques aux siens en matière d’asile et de protection des Droits de l’homme et des libertés fondamentales, des accords déterminant leurs compétences respectives pour l’examen des demandes d’asile qui leur sont présentées.

Toutefois, même si la demande n’entre pas dans leur compétence en vertu de ces accords, les autorités de la République ont toujours le droit de donner asile à tout étranger persécuté en raison de son action en faveur de la liberté ou qui sollicite la protection de la France pour un autre motif.

ARTICLE 53-2.

La République peut reconnaître la juridiction de la Cour pénale internationale dans les conditions prévues par le traité signé le 18 juillet 1998.

ARTICLE 54.

Si le Conseil constitutionnel, saisi par le Président de la République, par le Premier ministre, par le président de l’une ou l’autre assemblée ou par soixante députés ou soixante sénateurs, a déclaré qu’un engagement international comporte une clause contraire à la Constitution, l’autorisation de ratifier ou d’approuver l’engagement international en cause ne peut intervenir qu’après révision de la Constitution.

ARTICLE 55.

Les traités ou accords régulièrement ratifiés ou approuvés ont, dès leur publication, une autorité supérieure à celle des lois, sous réserve, pour chaque accord ou traité, de son application par l’autre partie.

Titre VII – LE CONSEIL CONSTITUTIONNEL

ARTICLE 56.

Le Conseil constitutionnel comprend neuf membres, dont le mandat dure neuf ans et n’est pas renouvelable. Le Conseil constitutionnel se renouvelle par tiers tous les trois ans. Trois des membres sont nommés par le Président de la République, trois par le président de l’Assemblée nationale, trois par le président du Sénat. La procédure prévue au dernier alinéa de l’article 13 est applicable à ces nominations. Les nominations effectuées par le président de chaque assemblée sont soumises au seul avis de la commission permanente compétente de l’assemblée concernée.

En sus des neuf membres prévus ci-dessus, font de droit partie à vie du Conseil constitutionnel les anciens Présidents de la République.

Le président est nommé par le Président de la République. Il a voix prépondérante en cas de partage.

ARTICLE 57.

Les fonctions de membre du Conseil constitutionnel sont incompatibles avec celles de ministre ou de membre du Parlement. Les autres incompatibilités sont fixées par une loi organique.

ARTICLE 58.

Le Conseil constitutionnel veille à la régularité de l’élection du Président de la République.

Il examine les réclamations et proclame les résultats du scrutin.

ARTICLE 59.

Le Conseil constitutionnel statue, en cas de contestation, sur la régularité de l’élection des députés et des sénateurs.

ARTICLE 60.

Le Conseil constitutionnel veille à la régularité des opérations de référendum prévues aux articles 11 et 89 et au titre XV. Il en proclame les résultats.

ARTICLE 61.

Les lois organiques, avant leur promulgation, les propositions de loi mentionnées à l’article 11 avant qu’elles ne soient soumises au référendum, et les règlements des assemblées parlementaires, avant leur mise en application, doivent être soumis au Conseil constitutionnel qui se prononce sur leur conformité à la Constitution.

Aux mêmes fins, les lois peuvent être déférées au Conseil constitutionnel, avant leur promulgation, par le Président de la République, le Premier ministre, le président de l’Assemblée nationale, le président du Sénat ou soixante députés ou soixante sénateurs.

Dans les cas prévus aux deux alinéas précédents, le Conseil constitutionnel doit statuer dans le délai d’un mois. Toutefois, à la demande du Gouvernement, s’il y a urgence, ce délai est ramené à huit jours.

Dans ces mêmes cas, la saisine du Conseil constitutionnel suspend le délai de promulgation.

ARTICLE 61-1.

Lorsque, à l’occasion d’une instance en cours devant une juridiction, il est soutenu qu’une disposition législative porte atteinte aux droits et libertés que la Constitution garantit, le Conseil constitutionnel peut être saisi de cette question sur renvoi du Conseil d’État ou de la Cour de cassation qui se prononce dans un délai déterminé.

Une loi organique détermine les conditions d’application du présent article.

ARTICLE 62.

Une disposition déclarée inconstitutionnelle sur le fondement de l’article 61 ne peut être promulguée ni mise en application.

Une disposition déclarée inconstitutionnelle sur le fondement de l’article 61-1 est abrogée à compter de la publication de la décision du Conseil constitutionnel ou d’une date ultérieure fixée par cette décision. Le Conseil constitutionnel détermine les conditions et limites dans lesquelles les effets que la disposition a produits sont susceptibles d’être remis en cause.

Les décisions du Conseil constitutionnel ne sont susceptibles d’aucun recours. Elles s’imposent aux pouvoirs publics et à toutes les autorités administratives et juridictionnelles.

ARTICLE 63.

Une loi organique détermine les règles d’organisation et de fonctionnement du Conseil constitutionnel, la procédure qui est suivie devant lui et notamment les délais ouverts pour le saisir de contestations.

Titre VIII – DE L’AUTORITÉ JUDICIAIRE

ARTICLE 64.

Le Président de la République est garant de l’indépendance de l’autorité judiciaire.

Il est assisté par le Conseil supérieur de la magistrature.

Une loi organique porte statut des magistrats.

Les magistrats du siège sont inamovibles.

ARTICLE 65.

Le Conseil supérieur de la magistrature comprend une formation compétente à l’égard des magistrats du siège et une formation compétente à l’égard des magistrats du parquet.

La formation compétente à l’égard des magistrats du siège est présidée par le premier président de la Cour de cassation. Elle comprend, en outre, cinq magistrats du siège et un magistrat du parquet, un conseiller d’État désigné par le Conseil d’État, un avocat ainsi que six personnalités qualifiées qui n’appartiennent ni au Parlement, ni à l’ordre judiciaire, ni à l’ordre administratif. Le Président de la République, le Président de l’Assemblée nationale et le Président du Sénat désignent chacun deux personnalités qualifiées. La procédure prévue au dernier alinéa de l’article 13 est applicable aux nominations des personnalités qualifiées. Les nominations effectuées par le président de chaque assemblée du Parlement sont soumises au seul avis de la commission permanente compétente de l’assemblée intéressée.

La formation compétente à l’égard des magistrats du parquet est présidée par le procureur général près la Cour de cassation. Elle comprend, en outre, cinq magistrats du parquet et un magistrat du siège, ainsi que le conseiller d’État, l’avocat et les six personnalités qualifiées mentionnés au deuxième alinéa.

La formation du Conseil supérieur de la magistrature compétente à l’égard des magistrats du siège fait des propositions pour les nominations des magistrats du siège à la Cour de cassation, pour celles de premier président de cour d’appel et pour celles de président de tribunal de grande instance. Les autres magistrats du siège sont nommés sur son avis conforme.

La formation du Conseil supérieur de la magistrature compétente à l’égard des magistrats du parquet donne son avis sur les nominations qui concernent les magistrats du parquet.

La formation du Conseil supérieur de la magistrature compétente à l’égard des magistrats du siège statue comme conseil de discipline des magistrats du siège. Elle comprend alors, outre les membres visés au deuxième alinéa, le magistrat du siège appartenant à la formation compétente à l’égard des magistrats du parquet.

La formation du Conseil supérieur de la magistrature compétente à l’égard des magistrats du parquet donne son avis sur les sanctions disciplinaires qui les concernent. Elle comprend alors, outre les membres visés au troisième alinéa, le magistrat du parquet appartenant à la formation compétente à l’égard des magistrats du siège.

Le Conseil supérieur de la magistrature se réunit en formation plénière pour répondre aux demandes d’avis formulées par le Président de la République au titre de l’article 64. Il se prononce, dans la même formation, sur les questions relatives à la déontologie des magistrats ainsi que sur toute question relative au fonctionnement de la justice dont le saisit le ministre de la justice. La formation plénière comprend trois des cinq magistrats du siège mentionnés au deuxième alinéa, trois des cinq magistrats du parquet mentionnés au troisième alinéa, ainsi que le conseiller d’État, l’avocat et les six personnalités qualifiées mentionnés au deuxième alinéa. Elle est présidée par le premier président de la Cour de cassation, que peut suppléer le procureur général près cette cour.

Sauf en matière disciplinaire, le ministre de la justice peut participer aux séances des formations du Conseil supérieur de la magistrature.

Le Conseil supérieur de la magistrature peut être saisi par un justiciable dans les conditions fixées par une loi organique.

La loi organique détermine les conditions d’application du présent article.

ARTICLE 66.

Nul ne peut être arbitrairement détenu.

L’autorité judiciaire, gardienne de la liberté individuelle, assure le respect de ce principe dans les conditions prévues par la loi.

ARTICLE 66-1.

Nul ne peut être condamné à la peine de mort.

Titre IX – LA HAUTE COUR

ARTICLE 67.

Le Président de la République n’est pas responsable des actes accomplis en cette qualité, sous réserve des dispositions des articles 53-2 et 68.

Il ne peut, durant son mandat et devant aucune juridiction ou autorité administrative française, être requis de témoigner non plus que faire l’objet d’une action, d’un acte d’information, d’instruction ou de poursuite. Tout délai de prescription ou de forclusion est suspendu.

Les instances et procédures auxquelles il est ainsi fait obstacle peuvent être reprises ou engagées contre lui à l’expiration d’un délai d’un mois suivant la cessation des fonctions.

ARTICLE 68.

Le Président de la République ne peut être destitué qu’en cas de manquement à ses devoirs manifestement incompatible avec l’exercice de son mandat. La destitution est prononcée par le Parlement constitué en Haute Cour.

La proposition de réunion de la Haute Cour adoptée par une des assemblées du Parlement est aussitôt transmise à l’autre qui se prononce dans les quinze jours.

La Haute Cour est présidée par le président de l’Assemblée nationale. Elle statue dans un délai d’un mois, à bulletins secrets, sur la destitution. Sa décision est d’effet immédiat.

Les décisions prises en application du présent article le sont à la majorité des deux tiers des membres composant l’assemblée concernée ou la Haute Cour. Toute délégation de vote est interdite. Seuls sont recensés les votes favorables à la proposition de réunion de la Haute Cour ou à la destitution.

Une loi organique fixe les conditions d’application du présent article.

Titre X – DE LA RESPONSABILITÉ PÉNALE DES MEMBRES DU GOUVERNEMENT

ARTICLE 68-1.

Les membres du Gouvernement sont pénalement responsables des actes accomplis dans l’exercice de leurs fonctions et qualifiés crimes ou délits au moment où ils ont été commis.

Ils sont jugés par la Cour de justice de la République.

La Cour de justice de la République est liée par la définition des crimes et délits ainsi que par la détermination des peines telles qu’elles résultent de la loi.

ARTICLE 68-2.

La Cour de justice de la République comprend quinze juges: douze parlementaires élus, en leur sein et en nombre égal, par l’Assemblée nationale et par le Sénat après chaque renouvellement général ou partiel de ces assemblées et trois magistrats du siège à la Cour de cassation, dont l’un préside la Cour de justice de la République.

Toute personne qui se prétend lésée par un crime ou un délit commis par un membre du Gouvernement dans l’exercice de ses fonctions peut porter plainte auprès d’une commission des requêtes.

Cette commission ordonne soit le classement de la procédure, soit sa transmission au procureur général près la Cour de cassation aux fins de saisine de la Cour de justice de la République.

Le procureur général près la Cour de cassation peut aussi saisir d’office la Cour de justice de la République sur avis conforme de la commission des requêtes.

Une loi organique détermine les conditions d’application du présent article.

ARTICLE 68-3.

Les dispositions du présent titre sont applicables aux faits commis avant son entrée en vigueur.

Titre XI – LE CONSEIL ÉCONOMIQUE, SOCIAL ET ENVIRONNEMENTAL

ARTICLE 69.

Le Conseil économique, social et environnemental, saisi par le Gouvernement, donne son avis sur les projets de loi, d’ordonnance ou de décret ainsi que sur les propositions de lois qui lui sont soumis.

Un membre du Conseil économique, social et environnemental peut être désigné par celui-ci pour exposer devant les assemblées parlementaires l’avis du Conseil sur les projets ou propositions qui lui ont été soumis.

Le Conseil économique, social et environnemental peut être saisi par voie de pétition dans les conditions fixées par une loi organique. Après examen de la pétition, il fait connaître au Gouvernement et au Parlement les suites qu’il propose d’y donner.

ARTICLE 70.

Le Conseil économique, social et environnemental peut être consulté par le Gouvernement et le Parlement sur tout problème de caractère économique, social ou environnemental. Le Gouvernement peut également le consulter sur les projets de loi de programmation définissant les orientations pluriannuelles des finances publiques. Tout plan ou tout projet de loi de programmation à caractère économique, social ou environnemental lui est soumis pour avis.

ARTICLE 71.

La composition du Conseil économique, social et environnemental, dont le nombre de membres ne peut excéder deux cent trente-trois, et ses règles de fonctionnement sont fixées par une loi organique.

Titre XI BIS – LE DÉFENSEUR DES DROITS

ARTICLE 71-1.

Le Défenseur des droits veille au respect des droits et libertés par les administrations de l’État, les collectivités territoriales, les établissements publics, ainsi que par tout organisme investi d’une mission de service public, ou à l’égard duquel la loi organique lui attribue des compétences.

Il peut être saisi, dans les conditions prévues par la loi organique, par toute personne s’estimant lésée par le fonctionnement d’un service public ou d’un organisme visé au premier alinéa. Il peut se saisir d’office.

La loi organique définit les attributions et les modalités d’intervention du Défenseur des droits. Elle détermine les conditions dans lesquelles il peut être assisté par un collège pour l’exercice de certaines de ses attributions.

Le Défenseur des droits est nommé par le Président de la République pour un mandat de six ans non renouvelable, après application de la procédure prévue au dernier alinéa de l’article 13. Ses fonctions sont incompatibles avec celles de membre du Gouvernement et de membre du Parlement. Les autres incompatibilités sont fixées par la loi organique.

Le Défenseur des droits rend compte de son activité au Président de la République et au Parlement.

Titre XII – DES COLLECTIVITÉS TERRITORIALES

ARTICLE 72.

Les collectivités territoriales de la République sont les communes, les départements, les régions, les collectivités à statut particulier et les collectivités d’outre-mer régies par l’article 74. Toute autre collectivité territoriale est créée par la loi, le cas échéant en lieu et place d’une ou de plusieurs collectivités mentionnées au présent alinéa.

Les collectivités territoriales ont vocation à prendre les décisions pour l’ensemble des compétences qui peuvent le mieux être mises en oeuvre à leur échelon.

Dans les conditions prévues par la loi, ces collectivités s’administrent librement par des conseils élus et disposent d’un pouvoir réglementaire pour l’exercice de leurs compétences.

Dans les conditions prévues par la loi organique, et sauf lorsque sont en cause les conditions essentielles d’exercice d’une liberté publique ou d’un droit constitutionnellement garanti, les collectivités territoriales ou leurs groupements peuvent, lorsque, selon le cas, la loi ou le règlement l’a prévu, déroger, à titre expérimental et pour un objet et une durée limités, aux dispositions législatives ou réglementaires qui régissent l’exercice de leurs compétences.

Aucune collectivité territoriale ne peut exercer une tutelle sur une autre. Cependant, lorsque l’exercice d’une compétence nécessite le concours de plusieurs collectivités territoriales, la loi peut autoriser l’une d’entre elles ou un de leurs groupements à organiser les modalités de leur action commune.

Dans les collectivités territoriales de la République, le représentant de l’État, représentant de chacun des membres du Gouvernement, a la charge des intérêts nationaux, du contrôle administratif et du respect des lois.

ARTICLE 72-1.

La loi fixe les conditions dans lesquelles les électeurs de chaque collectivité territoriale peuvent, par l’exercice du droit de pétition, demander l’inscription à l’ordre du jour de l’assemblée délibérante de cette collectivité d’une question relevant de sa compétence.

Dans les conditions prévues par la loi organique, les projets de délibération ou d’acte relevant de la compétence d’une collectivité territoriale peuvent, à son initiative, être soumis, par la voie du référendum, à la décision des électeurs de cette collectivité.

Lorsqu’il est envisagé de créer une collectivité territoriale dotée d’un statut particulier ou de modifier son organisation, il peut être décidé par la loi de consulter les électeurs inscrits dans les collectivités intéressées. La modification des limites des collectivités territoriales peut également donner lieu à la consultation des électeurs dans les conditions prévues par la loi.

ARTICLE 72-2.

Les collectivités territoriales bénéficient de ressources dont elles peuvent disposer librement dans les conditions fixées par la loi.

Elles peuvent recevoir tout ou partie du produit des impositions de toutes natures. La loi peut les autoriser à en fixer l’assiette et le taux dans les limites qu’elle détermine.

Les recettes fiscales et les autres ressources propres des collectivités territoriales représentent, pour chaque catégorie de collectivités, une part déterminante de l’ensemble de leurs ressources. La loi organique fixe les conditions dans lesquelles cette règle est mise en oeuvre.

Tout transfert de compétences entre l’État et les collectivités territoriales s’accompagne de l’attribution de ressources équivalentes à celles qui étaient consacrées à leur exercice. Toute création ou extension de compétences ayant pour conséquence d’augmenter les dépenses des collectivités territoriales est accompagnée de ressources déterminées par la loi.

La loi prévoit des dispositifs de péréquation destinés à favoriser l’égalité entre les collectivités territoriales.

ARTICLE 72-3.

La République reconnaît, au sein du peuple français, les populations d’outre-mer, dans un idéal commun de liberté, d’égalité et de fraternité.

La Guadeloupe, la Guyane, la Martinique, La Réunion, Mayotte, Saint Barthélemy, Saint-Martin, Saint-Pierre-et-Miquelon, les îles Wallis et Futuna et la Polynésie française sont régis par l’article 73 pour les départements et les régions d’outre-mer, et pour les collectivités territoriales créées en application du dernier alinéa de l’article 73, et par l’article 74 pour les autres collectivités.

Le statut de la Nouvelle-Calédonie est régi par le titre XIII.

La loi détermine le régime législatif et l’organisation particulière des Terres australes et antarctiques françaises et de Clipperton.

ARTICLE 72-4.

Aucun changement, pour tout ou partie de l’une des collectivités mentionnées au deuxième alinéa de l’article 72-3, de l’un vers l’autre des régimes prévus par les articles 73 et 74, ne peut intervenir sans que le consentement des électeurs de la collectivité ou de la partie de collectivité intéressée ait été préalablement recueilli dans les conditions prévues à l’alinéa suivant. Ce changement de régime est décidé par une loi organique.

Le Président de la République, sur proposition du Gouvernement pendant la durée des sessions ou sur proposition conjointe des deux assemblées, publiées au Journal officiel, peut décider de consulter les électeurs d’une collectivité territoriale située outre-mer sur une question relative à son organisation, à ses compétences ou à son régime législatif. Lorsque la consultation porte sur un changement prévu à l’alinéa précédent et est organisée sur proposition du Gouvernement, celui-ci fait, devant chaque assemblée, une déclaration qui est suivie d’un débat.

ARTICLE 73.

Dans les départements et les régions d’outre-mer, les lois et règlements sont applicables de plein droit. Ils peuvent faire l’objet d’adaptations tenant aux caractéristiques et contraintes particulières de ces collectivités.

Ces adaptations peuvent être décidées par ces collectivités dans les matières où s’exercent leurs compétences et si elles y ont été habilitées, selon le cas, par la loi ou par le règlement.

Par dérogation au premier alinéa et pour tenir compte de leurs spécificités, les collectivités régies par le présent article peuvent être habilitées, selon le cas, par la loi ou par le règlement, à fixer elles-mêmes les règles applicables sur leur territoire, dans un nombre limité de matières pouvant relever du domaine de la loi ou du règlement.

Ces règles ne peuvent porter sur la nationalité, les droits civiques, les garanties des libertés publiques, l’état et la capacité des personnes, l’organisation de la justice, le droit pénal, la procédure pénale, la politique étrangère, la défense, la sécurité et l’ordre publics, la monnaie, le crédit et les changes, ainsi que le droit électoral. Cette énumération pourra être précisée et complétée par une loi organique.

La disposition prévue aux deux précédents alinéas n’est pas applicable au département et à la région de La Réunion.

Les habilitations prévues aux deuxième et troisième alinéas sont décidées, à la demande de la collectivité concernée, dans les conditions et sous les réserves prévues par une loi organique. Elles ne peuvent intervenir lorsque sont en cause les conditions essentielles d’exercice d’une liberté publique ou d’un droit constitutionnellement garanti.

La création par la loi d’une collectivité se substituant à un département et une région d’outre-mer ou l’institution d’une assemblée délibérante unique pour ces deux collectivités ne peut intervenir sans qu’ait été recueilli, selon les formes prévues au second alinéa de l’article 72-4, le consentement des électeurs inscrits dans le ressort de ces collectivités.

ARTICLE 74.

Les collectivités d’outre-mer régies par le présent article ont un statut qui tient compte des intérêts propres de chacune d’elles au sein de la République.

Ce statut est défini par une loi organique, adoptée après avis de l’assemblée délibérante, qui fixe:

– les conditions dans lesquelles les lois et règlements y sont applicables;

– les compétences de cette collectivité; sous réserve de celles déjà exercées par elle, le transfert de compétences de l’État ne peut porter sur les matières énumérées au quatrième alinéa de l’article 73, précisées et complétées, le cas échéant, par la loi organique;

– les règles d’organisation et de fonctionnement des institutions de la collectivité et le régime électoral de son assemblée délibérante;

– les conditions dans lesquelles ses institutions sont consultées sur les projets et propositions de loi et les projets d’ordonnance ou de décret comportant des dispositions particulières à la collectivité, ainsi que sur la ratification ou l’approbation d’engagements internationaux conclus dans les matières relevant de sa compétence.

La loi organique peut également déterminer, pour celles de ces collectivités qui sont dotées de l’autonomie, les conditions dans lesquelles:

– le Conseil d’État exerce un contrôle juridictionnel spécifique sur certaines catégories d’actes de l’assemblée délibérante intervenant au titre des compétences qu’elle exerce dans le domaine de la loi;

– l’assemblée délibérante peut modifier une loi promulguée postérieurement à l’entrée en vigueur du statut de la collectivité, lorsque le Conseil constitutionnel, saisi notamment par les autorités de la collectivité, a constaté que la loi était intervenue dans le domaine de compétence de cette collectivité;

– des mesures justifiées par les nécessités locales peuvent être prises par la collectivité en faveur de sa population, en matière d’accès à l’emploi, de droit d’établissement pour l’exercice d’une activité professionnelle ou de protection du patrimoine foncier;

– la collectivité peut participer, sous le contrôle de l’État, à l’exercice des compétences qu’il conserve, dans le respect des garanties accordées sur l’ensemble du territoire national pour l’exercice des libertés publiques.

Les autres modalités de l’organisation particulière des collectivités relevant du présent article sont définies et modifiées par la loi après consultation de leur assemblée délibérante.

ARTICLE 74-1.

Dans les collectivités d’outre-mer visées à l’article 74 et en Nouvelle-Calédonie, le Gouvernement peut, par ordonnances, dans les matières qui demeurent de la compétence de l’État, étendre, avec les adaptations nécessaires, les dispositions de nature législative en vigueur en métropole ou adapter les dispositions de nature législative en vigueur à l’organisation particulière de la collectivité concernée, sous réserve que la loi n’ait pas expressément exclu, pour les dispositions en cause, le recours à cette procédure.

Les ordonnances sont prises en conseil des ministres après avis des assemblées délibérantes intéressées et du Conseil d’État. Elles entrent en vigueur dès leur publication. Elles deviennent caduques en l’absence de ratification par le Parlement dans le délai de dix-huit mois suivant cette publication.

ARTICLE 75.

Les citoyens de la République qui n’ont pas le statut civil de droit commun, seul visé à l’article 34, conservent leur statut personnel tant qu’ils n’y ont pas renoncé.

ARTICLE 75-1.

Les langues régionales appartiennent au patrimoine de la France.

Titre XIII – DISPOSITIONS TRANSITOIRES RELATIVES A LA NOUVELLE-CALÉDONIE

ARTICLE 76.

Les populations de la Nouvelle-Calédonie sont appelées à se prononcer avant le 31 décembre 1998 sur les dispositions de l’accord signé à Nouméa le 5 mai 1998 et publié le 27 mai 1998 au Journal officiel de la République française.

Sont admises à participer au scrutin les personnes remplissant les conditions fixées à l’article 2 de la loi n° 88-1028 du 9 novembre 1988.

Les mesures nécessaires à l’organisation du scrutin sont prises par décret en Conseil d’État délibéré en conseil des ministres.

ARTICLE 77.

Après approbation de l’accord lors de la consultation prévue à l’article 76, la loi organique, prise après avis de l’assemblée délibérante de la Nouvelle-Calédonie, détermine, pour assurer l’évolution de la Nouvelle-Calédonie dans le respect des orientations définies par cet accord et selon les modalités nécessaires à sa mise en œuvre:

– les compétences de l’État qui seront transférées, de façon définitive, aux institutions de la Nouvelle-Calédonie, l’échelonnement et les modalités de ces transferts, ainsi que la répartition des charges résultant de ceux-ci;

– les règles d’organisation et de fonctionnement des institutions de la Nouvelle-Calédonie et notamment les conditions dans lesquelles certaines catégories d’actes de l’assemblée délibérante de la Nouvelle-Calédonie pourront être soumises avant publication au contrôle du Conseil constitutionnel;

– les règles relatives à la citoyenneté, au régime électoral, à l’emploi et au statut civil coutumier;

– les conditions et les délais dans lesquels les populations intéressées de la Nouvelle-Calédonie seront amenées à se prononcer sur l’accession à la pleine souveraineté.

Les autres mesures nécessaires à la mise en oeuvre de l’accord mentionné à l’article 76 sont définies par la loi.

Pour la définition du corps électoral appelé à élire les membres des assemblées délibérantes de la Nouvelle-Calédonie et des provinces, le tableau auquel se réfèrent l’accord mentionné à l’article 76 et les articles 188 et 189 de la loi organique n° 99-209 du 19 mars 1999 relative à la Nouvelle-Calédonie est le tableau dressé à l’occasion du scrutin prévu audit article 76 et comprenant les personnes non admises à y participer.

ARTICLES 78 à 86
(Abrogés)

Titre XIV – DE LA FRANCOPHONIE ET DES ACCORDS D’ASSOCIATION

ARTICLE 87.

La République participe au développement de la solidarité et de la coopération entre les États et les peuples ayant le français en partage.

ARTICLE 88.

La République peut conclure des accords avec des États qui désirent s’associer à elle pour développer leurs civilisations.

Titre XV – DE L’UNION EUROPÉENNE

ARTICLE 88-1.

La République participe à l’Union européenne constituée d’États qui ont choisi librement d’exercer en commun certaines de leurs compétences en vertu du traité sur l’Union européenne et du traité sur le fonctionnement de l’Union européenne, tels qu’ils résultent du traité signé à Lisbonne le 13 décembre 2007.

ARTICLE 88-2.

La loi fixe les règles relatives au mandat d’arrêt européen en application des actes pris par les institutions de l’Union européenne.

ARTICLE 88-3.

Sous réserve de réciprocité et selon les modalités prévues par le Traité sur l’Union européenne signé le 7 février 1992, le droit de vote et d’éligibilité aux élections municipales peut être accordé aux seuls citoyens de l’Union résidant en France. Ces citoyens ne peuvent exercer les fonctions de maire ou d’adjoint ni participer à la désignation des électeurs sénatoriaux et à l’élection des sénateurs. Une loi organique votée dans les mêmes termes par les deux assemblées détermine les conditions d’application du présent article.

ARTICLE 88-4.

Le Gouvernement soumet à l’Assemblée nationale et au Sénat, dès leur transmission au Conseil de l’Union européenne, les projets d’actes législatifs européens et les autres projets ou propositions d’actes de l’Union européenne.

Selon des modalités fixées par le règlement de chaque assemblée, des résolutions européennes peuvent être adoptées, le cas échéant en dehors des sessions, sur les projets ou propositions mentionnés au premier alinéa, ainsi que sur tout document émanant d’une institution de l’Union européenne.

Au sein de chaque assemblée parlementaire est instituée une commission chargée des affaires européennes.

ARTICLE 88-5.

Tout projet de loi autorisant la ratification d’un traité relatif à l’adhésion d’un État à l’Union européenne est soumis au référendum par le Président de la République.

Toutefois, par le vote d’une motion adoptée en termes identiques par chaque assemblée à la majorité des trois cinquièmes, le Parlement peut autoriser l’adoption du projet de loi selon la procédure prévue au troisième alinéa de l’article 89.

(cet article n’est pas applicable aux adhésions faisant suite à une conférence intergouvernementale dont la convocation a été décidée par le Conseil européen avant le 1er juillet 2004, en vertu de l´article 47 de la Loi Constitutionnelle nº 2008-724 du 23 juillet 2008)

ARTICLE 88-6.

L’Assemblée nationale ou le Sénat peuvent émettre un avis motivé sur la conformité d’un projet d’acte législatif européen au principe de subsidiarité. L’avis est adressé par le président de l’assemblée concernée aux présidents du Parlement européen, du Conseil et de la Commission européenne. Le Gouvernement en est informé.

Chaque assemblée peut former un recours devant la Cour de justice de l’Union européenne contre un acte législatif européen pour violation du principe de subsidiarité. Ce recours est transmis à la Cour de justice de l’Union européenne par le Gouvernement.

À cette fin, des résolutions peuvent être adoptées, le cas échéant en dehors des sessions, selon des modalités d’initiative et de discussion fixées par le règlement de chaque assemblée. À la demande de soixante députés ou de soixante sénateurs, le recours est de droit.

ARTICLE 88-7.

Par le vote d’une motion adoptée en termes identiques par l’Assemblée nationale et le Sénat, le Parlement peut s’opposer à une modification des règles d’adoption d’actes de l’Union européenne dans les cas prévus, au titre de la révision simplifiée des traités ou de la coopération judiciaire civile, par le traité sur l’Union européenne et le traité sur le fonctionnement de l’Union européenne, tels qu’ils résultent du traité signé à Lisbonne le 13 décembre 2007.

Titre XVI – DE LA RÉVISION

ARTICLE 89.

L’initiative de la révision de la Constitution appartient concurremment au Président de la République sur proposition du Premier ministre et aux membres du Parlement.

Le projet ou la proposition de révision doit être examiné dans les conditions de délai fixées au troisième alinéa de l’article 42 et voté par les deux assemblées en termes identiques. La révision est définitive après avoir été approuvée par référendum.

Toutefois, le projet de révision n’est pas présenté au référendum lorsque le Président de la République décide de le soumettre au Parlement convoqué en Congrès ; dans ce cas, le projet de révision n’est approuvé que s’il réunit la majorité des trois cinquièmes des suffrages exprimés. Le bureau du Congrès est celui de l’Assemblée nationale.

Aucune procédure de révision ne peut être engagée ou poursuivie lorsqu’il est porté atteinte à l’intégrité du territoire.

La forme républicaine du Gouvernement ne peut faire l’objet d’une révision.

TITRE XVII
(Abrogé)

07Jul/18

Décision n° 2018-765 DC du 12 juin 2018

7 julio, 2018Decisión, FranciaDécision n° 2018-765 DC du 12 juin 2018, Derecho Informático, Legislación francesaJosé Cuervo

Décision n° 2018-765 DC du 12 juin 2018 (JORF n°0141 du 21 juin 2018 texte n° 2)

LE CONSEIL CONSTITUTIONNEL A ÉTÉ SAISI, dans les conditions prévues au deuxième alinéa de l’article 61 de la Constitution, de la loi relative à la protection des données personnelles, sous le n° 2018-765 DC, le 16 mai 2018, par MM. Bruno RETAILLEAU, Pascal ALLIZARD, Serge BABARY, Jean-Pierre BANSARD, Philippe BAS, Jérôme BASCHER, Arnaud BAZIN, Mmes Martine BERTHET, Anne-Marie BERTRAND, Christine BONFANTI-DOSSAT, M. François BONHOMME, Mme Pascale BORIES, M. Gilbert BOUCHET, Mme Céline BOULAY-ESPÉRONNIER, MM. Yves BOULOUX, Jean-Marc BOYER, Max BRISSON, Mme Marie-Thérèse BRUGUIÈRE, MM. François-Noël BUFFET, François CALVET, Christian CAMBON, Mme Agnès CANAYER, MM. Jean-Noël CARDOUX, Patrick CHAIZE, Pierre CHARON, Alain CHATILLON, Mme Marie-Christine CHAUVIN, M. Guillaume CHEVROLLIER, Gérard CORNU, Pierre CUYPERS, Mme Laure DARCOS, MM. Mathieu DARNAUD, Marc-Philippe DAUBRESSE, Mmes Annie DELMONT-KOROPOULIS, Catherine DEROCHE, Jacky DEROMEDI, Chantal DESEYNE, Catherine DI FOLCO, MM. Philippe DOMINATI, Alain DUFAUT, Mme Catherine DUMAS, M. Laurent DUPLOMB, Mmes Nicole DURANTON, Dominique ESTROSI SASSONE, Jacqueline EUSTACHE-BRINIO, MM. Michel FORISSIER, Bernard FOURNIER, Christophe-André FRASSA, Pierre FROGIER, Mme Joëlle GARRIAUD-MAYLAM, M. Jacques GENEST, Mme Frédérique GERBAUD, MM. Jordi GINESTA, Jean-Pierre GRAND, Daniel GREMILLET, François GROSDIDIER, Jacques GROSPERRIN, Charles GUENÉ, Jean-Raymond HUGONET, Benoît HURÉ, Jean-François HUSSON, Mmes Corinne IMBERT, Muriel JOURDA, MM. Alain JOYANDET, Roger KAROUTCHI, Marc LAMÉNIE, Mmes Élisabeth LAMURE, Christine LANFRANCHI-DORGAL, Florence LASSARADE, MM. Antoine LEFÈVRE, Dominique de LEGGE, Ronan LE GLEUT, Jean-Pierre LELEUX, Henri LEROY, Mme Brigitte LHERBIER, M. Gérard LONGUET, Mmes Vivette LOPEZ, Viviane MALET, Marie MERCIER, Brigitte MICOULEAU, MM. Alain MILON, Albéric de MONTGOLFIER, Mme Patricia MORHET-RICHAUD, MM. Jean-Marie MORISSET, Philippe MOUILLER, Philippe NACHBAR, Olivier PACCAUD, Philippe PAUL, Philippe PEMEZEC, Stéphane PIEDNOIR, Jackie PIERRE, François PILLET, Rémy POINTEREAU, Ladislas PONIATOWSKI, Mme Sophie PRIMAS, M. Christophe PRIOU, Mmes Catherine PROCACCIA, Frédérique PUISSAT, Isabelle RAIMOND-PAVERO, MM. Michel RAISON, Jean-François RAPIN, Mme Evelyne RENAUD-GARABEDIAN, MM. Charles REVET, Hugues SAURY, René-Paul SAVARY, Michel SAVIN, Alain SCHMITZ, Bruno SIDO, Jean SOL, Mme Catherine TROENDLÉ, MM. Michel VASPART et Jean-Pierre VIAL, sénateurs.

Au vu des textes suivants :

– la Constitution;

– l’ordonnance n° 58-1067 du 7 novembre 1958 portant loi organique sur le Conseil constitutionnel;

– la loi organique n° 2017-54 du 20 janvier 2017 relative aux autorités administratives indépendantes et autorités publiques indépendantes;

– le traité sur le fonctionnement de l’Union européenne;

– le règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 relatif à la protection des personnes physiques à l’égard du traitement des données à caractère personnel et à la libre circulation de ces données, et abrogeant la directive 95/46/CE (règlement général sur la protection des données);

– la directive (UE) 2016/680 du Parlement européen et du Conseil du 27 avril 2016 relative à la protection des personnes physiques à l’égard du traitement des données à caractère personnel par les autorités compétentes à des fins de prévention et de détection des infractions pénales, d’enquêtes et de poursuites en la matière ou d’exécution de sanctions pénales, et à la libre circulation de ces données et abrogeant la décision-cadre 2008/977/JAI du Conseil;

– le code de procédure pénale;

– le code des relations entre le public et l’administration;

– la loi n° 78-17 du 6 janvier 1978 relative à l’informatique, aux fichiers et aux libertés;

– les observations du Gouvernement, enregistrées le 31 mai 2018;

Et après avoir entendu le rapporteur ;

LE CONSEIL CONSTITUTIONNEL S’EST FONDÉ SUR CE QUI SUIT :

Les sénateurs requérants défèrent au Conseil constitutionnel la loi relative à la protection des données personnelles. Ils dénoncent son inintelligibilité et contestent la constitutionnalité de certaines dispositions de ses articles 1er, 4, 5, 7, 13, 16, 20, 21, 30 et 36.

– Sur le contrôle exercé par le Conseil constitutionnel :

Aux termes de l’article 88-1 de la Constitution : « La République participe à l’Union européenne constituée d’États qui ont choisi librement d’exercer en commun certaines de leurs compétences en vertu du traité sur l’Union européenne et du traité sur le fonctionnement de l’Union européenne, tels qu’ils résultent du traité signé à Lisbonne le 13 décembre 2007 ». Ainsi tant la transposition en droit interne d’une directive de l’Union européenne que le respect d’un règlement de l’Union européenne, lorsqu’une loi a pour objet d’y adapter le droit interne, résultent d’une exigence constitutionnelle.
Il appartient au Conseil constitutionnel, saisi dans les conditions prévues par l’article 61 de la Constitution d’une loi ayant pour objet de transposer en droit interne une directive de l’Union européenne, de veiller au respect de cette exigence. Il en va de même pour une loi ayant pour objet d’adapter le droit interne à un règlement de l’Union européenne. Toutefois, le contrôle qu’il exerce à cet effet est soumis à une double limite. En premier lieu, la transposition d’une directive ou l’adaptation du droit interne à un règlement ne sauraient aller à l’encontre d’une règle ou d’un principe inhérent à l’identité constitutionnelle de la France, sauf à ce que le constituant y ait consenti. En l’absence de mise en cause d’une telle règle ou d’un tel principe, le Conseil constitutionnel n’est pas compétent pour contrôler la conformité à la Constitution de dispositions législatives qui se bornent à tirer les conséquences nécessaires de dispositions inconditionnelles et précises d’une directive ou des dispositions d’un règlement de l’Union européenne. En second lieu, devant statuer avant la promulgation de la loi dans le délai prévu par l’article 61 de la Constitution, le Conseil constitutionnel ne peut saisir la Cour de justice de l’Union européenne sur le fondement de l’article 267 du traité sur le fonctionnement de l’Union européenne. En conséquence, il ne saurait déclarer non conforme à l’article 88-1 de la Constitution qu’une disposition législative manifestement incompatible avec la directive qu’elle a pour objet de transposer ou le règlement auquel elle adapte le droit interne. En tout état de cause, il appartient aux juridictions administratives et judiciaires d’exercer le contrôle de compatibilité de la loi au regard des engagements européens de la France et, le cas échéant, de saisir la Cour de justice de l’Union européenne à titre préjudiciel.
Il ressort de la Constitution que ces exigences constitutionnelles n’ont pas pour effet de porter atteinte à la répartition des matières entre le domaine de la loi et celui du règlement telle qu’elle est déterminée par la Constitution.

– Sur le grief tiré de la méconnaissance de l’objectif de valeur constitutionnelle d’accessibilité et d’intelligibilité de la loi :

Les sénateurs requérants soutiennent que le texte déféré méconnaît l’objectif de valeur constitutionnelle d’accessibilité et d’intelligibilité de la loi compte tenu des divergences résultant de l’articulation entre les dispositions de la loi du 6 janvier 1978, telle que modifiée, et du règlement du 27 avril 2016 mentionnés ci-dessus. Selon eux, cette absence de lisibilité serait de nature à « induire gravement en erreur » les citoyens quant à la portée de leurs droits et obligations en matière de protection des données personnelles. La loi déférée serait également contraire à ce même objectif au motif qu’elle ne réglerait pas clairement les modalités de son application dans les collectivités constituant des pays et territoires d’outre-mer dans lesquels le droit de l’Union européenne n’est pas applicable. En effet, selon les requérants, la loi du 6 janvier 1978 ne serait désormais compréhensible que combinée avec les dispositions du règlement du 27 avril 2016, lequel n’est pas applicable dans ces territoires.
L’objectif de valeur constitutionnelle d’accessibilité et d’intelligibilité de la loi, qui découle des articles 4, 5, 6 et 16 de la Déclaration des droits de l’homme et du citoyen de 1789, impose au législateur d’adopter des dispositions suffisamment précises et des formules non équivoques. Il doit en effet prémunir les sujets de droit contre une interprétation contraire à la Constitution ou contre le risque d’arbitraire, sans reporter sur des autorités administratives ou juridictionnelles le soin de fixer des règles dont la détermination n’a été confiée par la Constitution qu’à la loi.
En premier lieu, la loi déférée a pour principal objet de modifier la législation nationale en matière de protection des données personnelles afin d’adapter la législation nationale au règlement du 27 avril 2016 et de transposer la directive du même jour mentionnée ci-dessus. Si, à cette fin, le législateur a fait le choix de modifier les dispositions de la loi du 6 janvier 1978 en y introduisant des dispositions dont certaines sont formellement différentes de celles du règlement, il n’en résulte pas une inintelligibilité de la loi. Au surplus, l’article 32 de la loi déférée habilite le Gouvernement à prendre par voie d’ordonnance les mesures relevant du domaine de la loi nécessaires à la réécriture de l’ensemble de la loi du 6 janvier 1978 « afin d’apporter les corrections formelles et les adaptations nécessaires à la simplification et à la cohérence ainsi qu’à la simplicité de la mise en œuvre par les personnes concernées des dispositions qui mettent le droit national en conformité » avec le droit de l’Union européenne ainsi que les mesures pour « mettre en cohérence avec ces changements l’ensemble de la législation applicable à la protection des données à caractère personnel, apporter les modifications qui seraient rendues nécessaires pour assurer le respect de la hiérarchie des normes et la cohérence rédactionnelle des textes, harmoniser l’état du droit, remédier aux éventuelles erreurs et omissions résultant de la présente loi et abroger les dispositions devenues sans objet ».
En second lieu, le texte déféré ne prévoit pas de dispositions déterminant ses modalités d’application dans les collectivités d’outre-mer. En revanche, le 3° du paragraphe I de son article 32 habilite le Gouvernement à prendre par voie d’ordonnance les mesures relevant du domaine de la loi nécessaires à « l’adaptation et à l’extension à l’outre-mer des dispositions prévues aux 1° et 2° ainsi qu’à l’application à Saint-Barthélemy, à Saint-Pierre-et-Miquelon, en Nouvelle-Calédonie, en Polynésie française, à Wallis-et-Futuna et dans les Terres australes et antarctiques françaises de l’ensemble des dispositions de la loi n° 78-17 du 6 janvier 1978 précitée relevant de la compétence de l’État ».
La Nouvelle-Calédonie, la Polynésie française, les Terres australes et antarctiques françaises, Wallis-et-Futuna, Saint-Pierre-et-Miquelon et Saint-Barthélemy sont des pays et territoires d’outre-mer relevant du régime spécial d’association à l’Union européenne prévu par la quatrième partie du traité sur le fonctionnement de l’Union européenne. Le règlement et la directive du 27 avril 2016 ne s’y appliquent pas.
Aussi, en Nouvelle-Calédonie, en Polynésie française, dans les Terres australes et antarctiques françaises et à Wallis-et-Futuna, qui sont régis par le principe de spécialité législative, la loi du 6 janvier 1978 continuera à s’appliquer dans sa rédaction antérieure à la loi déférée. À Saint-Pierre-et-Miquelon et à Saint-Barthélemy, qui sont régis par le principe d’identité législative, la loi déférée est applicable, y compris en ce qu’elle renvoie à des dispositions du règlement du 27 avril 2016.
Par voie de conséquence, il ne résulte pas de l’absence de disposition spécifique déterminant les modalités d’application de la loi déférée dans les collectivités d’outre-mer précitées une méconnaissance de l’objectif de valeur constitutionnelle d’accessibilité et d’intelligibilité de la loi.
Il résulte de tout ce qui précède que le grief tiré de l’atteinte à cet objectif doit en tout état de cause être écarté.

– Sur certaines dispositions de l’article 1er :

L’article 1er de la loi déférée modifie l’article 11 de la loi du 6 janvier 1978, relatif aux missions de la Commission nationale de l’informatique et des libertés. En vertu de la deuxième phrase du a du 4° de cet article 11, ainsi modifié, cette commission peut « être consultée par le Président de l’Assemblée nationale, par le Président du Sénat ou par les commissions compétentes de l’Assemblée nationale et du Sénat ainsi qu’à la demande d’un président de groupe parlementaire sur toute proposition de loi relative à la protection des données à caractère personnel ou au traitement de telles données ».
Selon les requérants, en adoptant ces dispositions sans préciser à quel moment de l’examen parlementaire de la proposition de loi cette saisine de la Commission nationale de l’informatique et des libertés serait possible, ni dans quel délai son avis doit être rendu, ni quelle publicité peut lui être donnée, le législateur aurait méconnu l’étendue de sa compétence et contrevenu aux exigences de clarté et de sincérité du débat parlementaire.
Aux termes du second alinéa de l’article 1er de la loi organique du 20 janvier 2017 mentionnée ci-dessus, pris sur le fondement du dernier alinéa de l’article 34 de la Constitution, la loi « fixe les règles relatives à la composition et aux attributions ainsi que les principes fondamentaux relatifs à l’organisation et au fonctionnement des autorités administratives indépendantes et des autorités publiques indépendantes ». Il incombe au législateur d’exercer pleinement la compétence que lui confie la Constitution et, en particulier, son article 34.
En prévoyant que la Commission nationale de l’informatique et des libertés peut être consultée sur une proposition de loi relative à la protection ou au traitement de données à caractère personnel par le président, par les commissions compétentes ainsi qu’à la demande d’un président de groupe d’une assemblée parlementaire, le législateur a suffisamment défini la nouvelle attribution ainsi conférée à cette autorité administrative indépendante. Les conditions et modalités selon lesquelles cette faculté peut être mise en œuvre ne relèvent pas du domaine de la loi.
Par conséquent, la deuxième phrase du a du 4° de l’article 11 de la loi du 6 janvier 1978, qui ne méconnaît ni les exigences de clarté et de sincérité du débat parlementaire, ni aucune autre exigence constitutionnelle, est conforme à la Constitution.

– Sur certaines dispositions de l’article 4 :

L’article 4 modifie les articles 17 et 18 de la loi du 6 janvier 1978 relatifs à la procédure suivie devant la formation restreinte de la Commission nationale de l’informatique et des libertés, laquelle prononce les sanctions à l’encontre des responsables de traitements de données ou de leurs sous-traitants en cas de manquement aux obligations découlant du règlement du 27 avril 2016 et de la loi du 6 janvier 1978. En particulier, le 2° du même article 4 insère un deuxième alinéa à l’article 17 de cette loi afin de prévoir que les membres de la formation restreinte délibèrent hors la présence des agents de la commission, à l’exception de ceux en charge de la tenue de la séance.
Les requérants soutiennent que la circonstance que les agents des services en charge des sanctions sont placés sous l’autorité du président de la commission méconnaîtrait le principe d’impartialité. Par ailleurs, en ne prévoyant pas de séparation au sein du collège de la commission entre les membres de sa formation restreinte et les autres membres, ces dispositions ne garantiraient pas la séparation entre les fonctions de poursuite et d’instruction et celles de jugement et de sanction qu’impose ce même principe.
Selon l’article 16 de la Déclaration de 1789 : « Toute société dans laquelle la garantie des droits n’est pas assurée, ni la séparation des pouvoirs déterminée, n’a point de Constitution ».
Ni le principe de la séparation des pouvoirs, ni aucun autre principe ou règle de valeur constitutionnelle, ne font obstacle à ce qu’une autorité administrative ou publique indépendante, agissant dans le cadre de prérogatives de puissance publique, puisse exercer un pouvoir de sanction dans la mesure nécessaire à l’accomplissement de sa mission, dès lors que l’exercice de ce pouvoir est assorti par la loi de mesures destinées à assurer la protection des droits et libertés constitutionnellement garantis. En particulier, doivent être respectés les principes d’indépendance et d’impartialité découlant de l’article 16 de la Déclaration de 1789.
En premier lieu, le deuxième alinéa de l’article 17 de la loi du 6 janvier 1978 prévoit que seuls parmi les agents de la Commission nationale de l’informatique et des libertés peuvent être présents au cours des délibérés de sa formation restreinte ceux chargés de la tenue de la séance. La circonstance que ces agents sont placés sous l’autorité du président de cette commission ne méconnaît pas le principe d’impartialité.
En second lieu, ni les dispositions contestées ni le reste de l’article 4 de la loi déférée ne modifient les règles relatives à la séparation au sein de la Commission nationale de l’informatique et des libertés entre, d’une part, les fonctions de poursuite et d’instruction et, d’autre part, celles de jugement et de sanction. Dès lors, l’argumentation des requérants sur ce point n’est pas opérante à l’encontre des dispositions de l’article 4.
Il résulte de tout ce qui précède que le deuxième alinéa de l’article 17 de la loi du 6 janvier 1978, qui ne méconnaît aucune autre exigence constitutionnelle, est conforme à la Constitution.

– Sur certaines dispositions de l’article 5 :

L’article 5 étend le droit d’accès et le droit de communication reconnu par l’article 44 de la loi du 6 janvier 1978 aux membres et agents habilités de la Commission nationale de l’informatique et des libertés. Son 5° complète cet article 44 d’un paragraphe V, qui exclut le contrôle de la commission sur les opérations de traitement effectuées, dans l’exercice de leur fonction juridictionnelle, par les juridictions.
Les requérants soutiennent que, en ne prévoyant pas, au profit des pouvoirs publics constitutionnels, d’exception aux pouvoirs de contrôle de la commission, ces dispositions méconnaîtraient le principe d’autonomie des pouvoirs publics constitutionnels qui découle de la séparation des pouvoirs protégée par l’article 16 de la Déclaration de 1789 et serait inhérent à l’identité constitutionnelle de la France.
En premier lieu, la Commission nationale de l’informatique et des libertés n’exerce ses pouvoirs de contrôle que dans les limites et sous les garanties prévues par le règlement du 27 avril 2016 et la loi du 6 janvier 1978. En particulier, elle ne les exerce que, conformément au 2° de l’article 11 de cette loi, afin de veiller à ce que les traitements de données à caractère personnel soient mis en œuvre conformément aux dispositions de la même loi et aux autres dispositions relatives à la protection des données personnelles prévues par les textes législatifs et règlementaires du droit de l’Union européenne et les engagements internationaux de la France.
En second lieu et en tout état de cause, les opérations de contrôle de la Commission nationale de l’informatique et des libertés ne sauraient mettre en cause le fonctionnement régulier des pouvoirs publics constitutionnels.
Il résulte de ce qui précède que le grief tiré de la méconnaissance du principe de séparation des pouvoirs doit être écarté.
Le paragraphe V de l’article 44 de la loi du 6 janvier 1978, qui ne méconnaît aucune autre exigence constitutionnelle, est conforme à la Constitution.

– Sur certaines dispositions de l’article 7 :

Le 2° de l’article 7 réécrit l’article 45 de la loi du 6 janvier 1978 pour prévoir les différentes mesures susceptibles d’être prises par la Commission nationale de l’informatique et des libertés en cas de manquement aux obligations découlant du règlement du 27 avril 2016 et de la loi du 6 janvier 1978. Les paragraphes I et II de cet article 45 permettent au président de la commission de prononcer respectivement des avertissements ou des mises en demeure. Son paragraphe III prévoit que le président de la commission, le cas échéant après avoir adressé un avertissement ou prononcé une mise en demeure, peut saisir la formation restreinte de la commission en vue du prononcé d’une ou plusieurs mesures, dont une amende pouvant atteindre, en vertu de la deuxième phrase de son 7°, 20 millions d’euros ou, s’agissant d’une entreprise, 4 % de son chiffre d’affaires.
Les requérants soutiennent que, en permettant au président de la Commission nationale de l’informatique et des libertés de prononcer des mises en demeure susceptibles d’être rendues publiques, qui constitueraient des sanctions ayant le caractère de punition, le paragraphe II de l’article 45 méconnaîtrait le principe d’impartialité dès lors que ces mesures sont instruites et prononcées par une seule autorité. Par ailleurs, selon eux, en permettant qu’un même comportement donne lieu successivement à un avertissement ou à une mise en demeure de la part du président de la commission puis à des sanctions prises par la formation restreinte, le premier alinéa du paragraphe III de ce même article 45 méconnaîtrait le principe de proportionnalité des peines. En outre, en ne précisant pas les critères selon lesquels un tel cumul est possible, ce paragraphe III méconnaîtrait le principe d’égalité devant la loi. Enfin, dès lors que le montant maximal de l’amende prévue à la deuxième phrase du 7° du paragraphe III de l’article 45 a été porté à 20 millions d’euros ou, s’agissant d’une entreprise, à 4 % du chiffre d’affaires, le législateur aurait dû accroître les droits et garanties des personnes ainsi sanctionnées, sauf à méconnaître le droit à un procès équitable.
L’article 45 de la loi du 6 janvier 1978 confie à la Commission nationale de l’informatique et des libertés le pouvoir de prendre des mesures et sanctions en vue de prévenir, mettre fin ou réprimer les manquements, commis par les responsables de traitements de données personnelles ou leurs sous-traitants, aux dispositions du règlement du 27 avril 2016 et de cette loi.
En premier lieu, lorsqu’un manquement constaté est susceptible de faire l’objet d’une mise en conformité, le premier alinéa du paragraphe II de l’article 45 permet au président de la commission de mettre en demeure le responsable du traitement ou son sous-traitant de prendre les mesures nécessaires à cette fin. Elle vise ainsi à permettre à son destinataire de se mettre en conformité avec le règlement du 27 avril 2016 ou la loi du 6 janvier 1978. Sa méconnaissance n’emporte aucune conséquence. Si cette mise en demeure peut être rendue publique, à la demande du président et sur décision du bureau de la commission, cette publicité ne lui confère pas, en l’espèce, la nature d’une sanction ayant le caractère d’une punition. Par conséquent, le grief tiré de la méconnaissance du principe d’impartialité doit être écarté comme inopérant.
En second lieu, selon l’article 8 de la Déclaration de 1789 : « La loi ne doit établir que des peines strictement et évidemment nécessaires et nul ne peut être puni qu’en vertu d’une loi établie et promulguée antérieurement au délit, et légalement appliquée ». Les principes ainsi énoncés ne concernent pas seulement les peines prononcées par les juridictions pénales mais s’étendent à toute sanction ayant le caractère d’une punition. Le principe de nécessité des délits et des peines ne fait pas obstacle à ce que les mêmes faits commis par une même personne puissent faire l’objet de poursuites différentes aux fins de sanctions de nature administrative ou pénale en application de corps de règles distincts. Si l’éventualité que deux procédures soient engagées peut conduire à un cumul de sanctions, le principe de proportionnalité implique qu’en tout état de cause le montant global des sanctions éventuellement prononcées ne dépasse pas le montant le plus élevé de l’une des sanctions encourues.
Il ressort du paragraphe I de l’article 45 de la loi du 6 janvier 1978 que l’avertissement qu’il prévoit est adressé par le président de la commission au responsable d’un traitement de données ou à son sous-traitant lorsque « les opérations de traitements envisagées » sont susceptibles de violer les dispositions du règlement du 27 avril 2016 ou de la loi du 6 janvier 1978. Ainsi, cet avertissement est adressé, à titre préventif, à son destinataire avant même la commission d’un manquement. Il n’est donc pas une sanction ayant le caractère d’une punition. Ainsi, dès lors que ni les avertissements ni les mises en demeure prononcées par le président de la commission ne constituent des sanctions ayant le caractère de punition, la circonstance qu’une sanction prévue par le paragraphe III de l’article 45 se cumule avec ces mesures ne saurait être regardé comme constituant un cumul de sanctions. Par conséquent, le grief tiré de la méconnaissance du principe de proportionnalité des peines doit être écarté.
En troisième lieu, selon l’article 6 de la Déclaration de 1789, la loi « doit être la même pour tous, soit qu’elle protège, soit qu’elle punisse ». Le principe d’égalité devant la loi ne s’oppose ni à ce que législateur règle de façon différente des situations différentes, ni à ce qu’il déroge à l’égalité pour des raisons d’intérêt général, pourvu que, dans l’un et l’autre cas, la différence de traitement qui en résulte soit en rapport direct avec l’objet de la loi qui l’établit.
En prévoyant que le président de la Commission nationale de l’informatique et des libertés peut saisir la formation restreinte en vue du prononcé de l’une des mesures ou sanctions prévues par le paragraphe III de l’article 45 lorsque le responsable d’un traitement ou son sous-traitant n’a pas respecté les obligations découlant du règlement du 27 avril 2016 ou de la loi du 6 janvier 1978, le cas échéant en complément d’un avertissement ou d’une mise en demeure, le législateur n’a institué aucune différence de traitement. Par conséquent, le grief tiré de la méconnaissance du principe d’égalité devant la loi doit être écarté.
En dernier lieu, les exigences d’impartialité, lorsqu’une autorité administrative indépendante prononce une amende, ne sauraient varier en fonction de son montant maximal. Par conséquent, le grief tiré de la méconnaissance du principe d’impartialité à l’encontre de la deuxième phrase du 7° du paragraphe III de l’article 45 doit être écarté.
Il résulte de tout ce qui précède que le paragraphe I, le premier alinéa du paragraphe II et la deuxième phrase du 7° du paragraphe III de l’article 45 de la loi du 6 janvier 1978, qui ne méconnaissent en tout état de cause aucune autre exigence constitutionnelle, sont conformes à la Constitution.

– Sur certaines dispositions de l’article 13 :

L’article 13 modifie l’article 9 de la loi du 6 janvier 1978 afin de fixer le régime des traitements de données à caractère personnel relatives aux condamnations pénales, aux infractions ou aux mesures de sûreté connexes, lorsque ces traitements ne sont pas mis en œuvre par les autorités compétentes à des fins pénales au sens de la directive du 27 avril 2016.
Selon le premier alinéa nouveau de cet article 9, de tels traitements peuvent être effectués soit « sous le contrôle de l’autorité publique », soit par les personnes énumérées aux 1° à 5° du même article. Parmi ces dernières, l’article 13 de la loi déférée ajoute, respectivement aux 1° et 3° de l’article 9, les personnes morales de droit privé collaborant au service public de la justice et les personnes physiques ou morales qui, en tant que victimes ou mises en cause ou pour le compte de celles-ci, cherchent à préparer, à exercer et à suivre une action en justice et à faire exécuter la décision rendue.
Selon les requérants, ces dispositions seraient entachées d’incompétence négative, faute pour le législateur d’avoir suffisamment précisé les catégories de personnes désormais autorisées à mettre en œuvre de tels traitements de données pénales à des fins autres que policières et judiciaires. En outre, elles ne comporteraient pas les garanties nécessaires à la protection du droit au respect de la vie privée, en particulier en ce qu’elles ne prévoient pas d’autorisation administrative préalable de ces traitements.

. En ce qui concerne le 1° de l’article 13 :

Selon l’article 34 de la Constitution, la loi fixe les règles concernant les garanties fondamentales accordées aux citoyens pour l’exercice des libertés publiques. Il incombe au législateur d’exercer pleinement la compétence que lui confie la Constitution et, en particulier, son article 34.
L’article 10 du règlement européen du 27 avril 2016 n’autorise le traitement de données à caractère personnel en matière pénale ne relevant pas de la directive également datée du 27 avril 2016 que dans certaines hypothèses, parmi lesquelles figure la mise en œuvre de tels traitements « sous le contrôle de l’autorité publique ». Le législateur s’est borné à reproduire ces termes dans les dispositions contestées, sans déterminer lui-même ni les catégories de personnes susceptibles d’agir sous le contrôle de l’autorité publique, ni quelles finalités devraient être poursuivies par la mise en œuvre d’un tel traitement de données. En raison de l’ampleur que pourraient revêtir ces traitements et de la nature des informations traitées, ces dispositions affectent, par leurs conséquences, les garanties fondamentales accordées aux citoyens pour l’exercice des libertés publiques. Dès lors, les mots « sous le contrôle de l’autorité publique ou » sont entachés d’incompétence négative.
Pour les motifs énoncés ci-dessus, les mots « sous le contrôle de l’autorité publique ou » figurant au 1° de l’article 13 sont contraires à la Constitution. Les mots « condamnations pénales, aux infractions ou aux mesures de sûreté connexes ne peuvent être effectués que » figurant au premier alinéa de l’article 9 de la loi du 6 janvier 1978 sont conformes à la Constitution.

. En ce qui concerne les 2° et 3° de l’article 13 :

La liberté proclamée par l’article 2 de la Déclaration de 1789 implique le droit au respect de la vie privée. Par suite, la collecte, l’enregistrement, la conservation, la consultation et la communication de données à caractère personnel doivent être justifiés par un motif d’intérêt général et mis en œuvre de manière adéquate et proportionnée à cet objectif.
En premier lieu, d’une part, en adoptant les dispositions du 2° de l’article 13, le législateur a entendu permettre la mise en œuvre de traitements de données à caractère personnel relatives aux condamnations pénales, aux infractions ou aux mesures de sûreté connexes par des personnes collaborant au service public de la justice, telles que des associations d’aide aux victimes ou d’accompagnement de personnes placées sous main de justice. D’autre part, en adoptant les dispositions du 3° du même article, le législateur a également entendu ouvrir cette faculté aux personnes victimes ou mises en cause dans une procédure pénale, afin de leur permettre de préparer ou de mettre en œuvre un recours en justice. Ce faisant, le législateur a poursuivi des objectifs d’intérêt général.
En second lieu, d’une part, en prévoyant qu’elles s’appliquent aux personnes morales de droit privé collaborant au service public de la justice appartenant à des catégories dont la liste est fixée par décret en Conseil d’État, pris après avis motivé et publié de la Commission nationale de l’informatique et des libertés, ainsi qu’aux personnes agissant soit en tant que victimes ou mises en cause soit pour le compte de ces dernières, les dispositions contestées circonscrivent suffisamment le champ des personnes ainsi autorisées à mettre en œuvre un traitement de données à caractère personnel en matière pénale.
D’autre part, la mise en œuvre de ces traitements ne peut être effectuée, dans le premier cas, que dans la mesure strictement nécessaire à la mission exercée par la personne collaborant au service public de la justice et, dans le second, que pour une durée strictement proportionnée aux finalités poursuivies par les personnes victimes ou mises en cause. Dans ce dernier cas, la communication à un tiers n’est possible que sous les mêmes conditions et dans la mesure strictement nécessaire à la poursuite des mêmes finalités.
Enfin, la mise en œuvre de ces traitements de données est subordonnée au respect des garanties prévues par le règlement du 27 avril 2016, en particulier les conditions posées à ses articles 5 et 6, et à celles prévues par la loi du 6 janvier 1978.
Il résulte de ce qui précède que le législateur, qui n’était pas tenu de prévoir un dispositif d’autorisation préalable des traitements de données en cause, n’a pas méconnu le droit au respect de la vie privée. Il n’est pas davantage resté en deçà de sa compétence. Les griefs tirés de la méconnaissance de l’article 2 de la Déclaration de 1789 et de l’article 34 de la Constitution doivent ainsi être écartés.
Les mots « ainsi que les personnes morales de droit privé collaborant au service public de la justice et appartenant à des catégories dont la liste est fixée par décret en Conseil d’État, pris après avis motivé et publié de la Commission nationale de l’informatique et des libertés, dans la mesure strictement nécessaire à leur mission » figurant au 1° de l’article 9 de la loi du 6 janvier 1978 et les dispositions du 3° du même article, qui ne méconnaissent aucune autre exigence constitutionnelle, sont conformes à la Constitution.

– Sur certaines dispositions de l’article 16 :

L’article 16 prévoit une nouvelle rédaction du chapitre IX de la loi du 6 janvier 1978, consacré aux traitements de données à caractère personnel dans le domaine de la santé. Le 3° de l’article 53 de cette loi, dans cette nouvelle rédaction, en exclut toutefois les traitements mis en œuvre aux fins d’assurer « la prise en charge des prestations par les organismes d’assurance maladie complémentaire ».
Les requérants estiment que, du fait de cette exclusion, les organismes d’assurance maladie complémentaire privés pourraient avoir accès aux données à caractère personnel issues de la facturation des soins, sans avoir à recueillir le consentement préalable des patients et que ces organismes pourraient utiliser ces données pour « fixer le prix des assurances » ou « à des fins de choix thérapeutique ou médical ». Il en résulterait une atteinte à « la liberté pour le patient de choisir son médecin et la liberté du médecin de choisir la thérapie la plus adaptée au patient ».
Les dispositions contestées se bornent à excepter les traitements mis en œuvre par les organismes d’assurance maladie complémentaire, pour le service de leurs prestations, de l’application des dispositions particulières du chapitre IX de la loi du 6 janvier 1978 relatives aux traitements des données de santé.
Par conséquent, d’une part, elles n’exemptent pas ces mêmes traitements du respect des autres dispositions du règlement du 27 avril 2016 et de la loi du 6 janvier 1978 relatives aux principes régissant le traitement des données à caractère personnel et aux droits reconnus aux personnes dont les données sont collectées. À cet égard, en vertu de l’article 5 de ce règlement, les données de santé recueillies dans le cadre de ces traitements ne peuvent faire l’objet d’un traitement ultérieur incompatible avec la finalité d’origine du traitement, qui ne peut être, en vertu des dispositions contestées, que le service des prestations d’assurance maladie.
D’autre part, les dispositions contestées n’ont, en tout état de cause, pas pour effet d’autoriser ces organismes à imposer à leurs assurés le choix d’un médecin ni d’interdire la prise, par ce dernier, de décisions médicales.
Il résulte de tout ce qui précède que le grief manque en fait. Les mots « la prise en charge des prestations par les organismes d’assurance maladie complémentaire » figurant au 3° de l’article 53 de la loi du 6 janvier 1978, qui ne méconnaissent aucune exigence constitutionnelle, sont conformes à la Constitution.

– Sur certaines dispositions de l’article 20 :

L’article 20 introduit un nouvel article 7-1 dans la loi du 6 janvier 1978 aux termes duquel un mineur peut consentir seul à un traitement de données à caractère personnel « en ce qui concerne l’offre directe de services de la société de l’information à compter de l’âge de quinze ans ». Selon le deuxième alinéa de cet article : « Lorsque le mineur est âgé de moins de quinze ans, le traitement n’est licite que si le consentement est donné conjointement par le mineur concerné et le ou les titulaires de l’autorité parentale à l’égard de ce mineur ».
Les requérants soutiennent que le deuxième alinéa de cet article 7-1 méconnaîtrait l’exigence d’application du droit européen qui résulte de l’article 88-1 de la Constitution. Selon eux, en prévoyant que, lorsqu’un mineur est âgé de moins de quinze ans, le traitement de ses données à caractère personnel n’est licite que si sont à la fois recueillis le consentement du mineur et celui d’un des titulaires de l’autorité parentale, le législateur aurait énoncé une règle contraire au règlement du 27 avril 2016, qui exigerait, dans une telle hypothèse, le seul recueil du consentement d’un des titulaires de l’autorité parentale.
Selon le 1 de l’article 8 du règlement du 27 avril 2016 : « Lorsque l’article 6, paragraphe 1, point a), s’applique, en ce qui concerne l’offre directe de services de la société de l’information aux enfants, le traitement des données à caractère personnel relatives à un enfant est licite lorsque l’enfant est âgé d’au moins 16 ans. Lorsque l’enfant est âgé de moins de 16 ans, ce traitement n’est licite que si, et dans la mesure où, le consentement est donné ou autorisé par le titulaire de la responsabilité parentale à l’égard de l’enfant. – Les États membres peuvent prévoir par la loi un âge inférieur pour ces finalités pour autant que cet âge inférieur ne soit pas en-dessous de 13 ans ».
Il résulte de l’emploi des termes « donné ou autorisé » que le règlement permet aux États membres de prévoir soit que le consentement doit être donné pour le mineur par le titulaire de l’autorité parentale, soit que le mineur est autorisé à consentir par le titulaire de l’autorité parentale, ce qui suppose alors le double consentement prévu par le texte critiqué. Les dispositions contestées ne sont donc pas manifestement incompatibles avec le règlement auquel elles adaptent le droit interne. Il en résulte que le grief tiré de la méconnaissance de l’article 88-1 de la Constitution doit être écarté.
Le deuxième alinéa de l’article 7-1 de la loi du 6 janvier 1978, qui ne méconnaît aucune autre exigence constitutionnelle, est conforme à la Constitution.

– Sur certaines dispositions de l’article 21 :

L’article 21 modifie l’article 10 de la loi du 6 janvier 1978 afin d’étendre les cas dans lesquels, par exception, une décision produisant des effets juridiques à l’égard d’une personne ou l’affectant de manière significative peut être prise sur le seul fondement d’un traitement automatisé de données à caractère personnel. En vertu du 2° de cet article 10, il en va ainsi des décisions administratives individuelles dès lors que l’algorithme de traitement utilisé ne porte pas sur des données sensibles, que des recours administratifs sont possibles et qu’une information est délivrée sur l’usage de l’algorithme.
Les requérants estiment qu’en autorisant l’administration à prendre des décisions individuelles sur le seul fondement d’un algorithme, celle-ci serait conduite à renoncer à l’exercice de son pouvoir d’appréciation des situations individuelles, de sorte que le 2° de l’article 10 de la loi du 6 janvier 1978 méconnaîtrait la garantie des droits et l’article 21 de la Constitution. Ces exigences seraient également méconnues en raison de l’existence d’algorithmes « auto-apprenants » susceptibles de réviser eux-mêmes les règles qu’ils appliquent, empêchant, selon eux, de ce fait, l’administration de connaître les règles sur le fondement desquelles la décision administrative a été effectivement prise. Par ailleurs, les requérants estiment que, faute de garanties suffisantes, le législateur aurait porté atteinte « aux principes de valeur constitutionnelle régissant l’exercice du pouvoir réglementaire », dans la mesure où, d’une part, il ne serait pas garanti que les règles appliquées par les algorithmes seront conformes au droit et, d’autre part, l’administration aurait abandonné son pouvoir réglementaire aux algorithmes définissant leurs propres règles. Les règles appliquées par ce dernier type d’algorithmes ne pouvant être déterminées à l’avance, il en résulterait également une méconnaissance du « principe de publicité des règlements ». Enfin, les requérants soutiennent que les dispositions contestées sont dénuées de portée normative ou, à défaut, qu’elles seraient contraires, par leur complexité, à l’objectif de valeur constitutionnelle d’accessibilité et d’intelligibilité de la loi.
L’article 21 de la Constitution confie le pouvoir réglementaire au Premier ministre, sous réserve des dispositions de l’article 13.
Les dispositions contestées autorisent l’administration à adopter des décisions individuelles ayant des effets juridiques ou affectant de manière significative une personne sur le seul fondement d’un algorithme.
Toutefois, en premier lieu, ces dispositions se bornent à autoriser l’administration à procéder à l’appréciation individuelle de la situation de l’administré, par le seul truchement d’un algorithme, en fonction des règles et critères définis à l’avance par le responsable du traitement. Elles n’ont ni pour objet ni pour effet d’autoriser l’administration à adopter des décisions sans base légale, ni à appliquer d’autres règles que celles du droit en vigueur. Il n’en résulte dès lors aucun abandon de compétence du pouvoir réglementaire.
En deuxième lieu, le seul recours à un algorithme pour fonder une décision administrative individuelle est subordonné au respect de trois conditions. D’une part, conformément à l’article L. 311-3-1 du code des relations entre le public et l’administration, la décision administrative individuelle doit mentionner explicitement qu’elle a été adoptée sur le fondement d’un algorithme et les principales caractéristiques de mise en œuvre de ce dernier doivent être communiquées à la personne intéressée, à sa demande. Il en résulte que, lorsque les principes de fonctionnement d’un algorithme ne peuvent être communiqués sans porter atteinte à l’un des secrets ou intérêts énoncés au 2° de l’article L. 311-5 du code des relations entre le public et l’administration, aucune décision individuelle ne peut être prise sur le fondement exclusif de cet algorithme. D’autre part, la décision administrative individuelle doit pouvoir faire l’objet de recours administratifs, conformément au chapitre premier du titre premier du livre quatrième du code des relations entre le public et l’administration. L’administration sollicitée à l’occasion de ces recours est alors tenue de se prononcer sans pouvoir se fonder exclusivement sur l’algorithme. La décision administrative est en outre, en cas de recours contentieux, placée sous le contrôle du juge, qui est susceptible d’exiger de l’administration la communication des caractéristiques de l’algorithme. Enfin, le recours exclusif à un algorithme est exclu si ce traitement porte sur l’une des données sensibles mentionnées au paragraphe I de l’article 8 de la loi du 6 janvier 1978, c’est-à-dire des données à caractère personnel « qui révèlent la prétendue origine raciale ou l’origine ethnique, les opinions politiques, les convictions religieuses ou philosophiques ou l’appartenance syndicale d’une personne physique », des données génétiques, des données biométriques, des données de santé ou des données relatives à la vie sexuelle ou l’orientation sexuelle d’une personne physique.
En dernier lieu, le responsable du traitement doit s’assurer de la maîtrise du traitement algorithmique et de ses évolutions afin de pouvoir expliquer, en détail et sous une forme intelligible, à la personne concernée la manière dont le traitement a été mis en œuvre à son égard. Il en résulte que ne peuvent être utilisés, comme fondement exclusif d’une décision administrative individuelle, des algorithmes susceptibles de réviser eux-mêmes les règles qu’ils appliquent, sans le contrôle et la validation du responsable du traitement.
Il résulte de tout ce qui précède que le législateur a défini des garanties appropriées pour la sauvegarde des droits et libertés des personnes soumises aux décisions administratives individuelles prises sur le fondement exclusif d’un algorithme. Les griefs tirés de la méconnaissance de l’article 16 de la Déclaration de 1789 et de l’article 21 de la Constitution doivent donc être écartés. Le 2° de l’article 10 de la loi du 6 janvier 1978, qui n’est pas non plus dépourvu de portée normative ou inintelligible et ne méconnaît aucune autre exigence constitutionnelle, est conforme à la Constitution.

– Sur certaines dispositions de l’article 30 :

L’article 30 insère un nouveau chapitre XIII dans la loi du 6 janvier 1978, comportant des articles 70-1 à 70-27 et applicable aux traitements de données relevant de la directive du 27 avril 2016. Ces dispositions régissent les traitements de données à caractère personnel mis en œuvre « à des fins de prévention et de détection des infractions pénales, d’enquêtes et de poursuites en la matière ou d’exécution de sanctions pénales, y compris la protection contre les menaces pour la sécurité publique et la prévention de telles menaces ». Le premier alinéa du nouvel article 70-1 détermine notamment les personnes autorisées à mettre en œuvre de tels traitements. Le nouvel article 70-2 fixe les conditions dans lesquelles des données sensibles, au sens du paragraphe I de l’article 8 de la loi du 6 janvier 1978, peuvent faire l’objet d’un tel traitement.
Selon les requérants, ces dispositions ne préciseraient pas suffisamment les personnes ainsi autorisées à mettre en œuvre des traitements de données à caractère personnel relatives à des infractions, enquêtes ou poursuites pénales. En outre, elles ne définiraient pas les « garanties appropriées pour les droits et libertés de la personne concernée » auxquelles elles font référence lorsque ces traitements comportent des données sensibles. Il en résulterait une méconnaissance par le législateur de l’étendue de sa compétence.
En premier lieu, en vertu du premier alinéa de l’article 70-1, les dispositions du chapitre XIII de la loi du 6 janvier 1978, régissant les traitements de données à caractère personnel dans le domaine pénal, s’appliquent, d’une part, aux autorités publiques compétentes en matière de prévention et de détection des infractions pénales, d’enquêtes et de poursuites pénales et d’exécution de sanctions pénales, y compris en matière de protection contre les menaces pour la sécurité publique susceptibles de déboucher sur une infraction pénale et de prévention de telles menaces. Elles s’appliquent, d’autre part, à tout autre organisme ou entité à qui une disposition de droit interne a confié, à ces mêmes fins, l’exercice de l’autorité publique et des prérogatives de puissance publique. Ce faisant, le législateur a suffisamment défini les catégories de personnes susceptibles de mettre en œuvre les traitements de données en cause.
En second lieu, l’article 70-2 prévoit que le traitement de données sensibles n’est possible qu’en cas de nécessité absolue, sous réserve de garanties appropriées pour les droits et libertés de la personne en cause, et s’il est autorisé par une disposition législative ou réglementaire, s’il vise à protéger les intérêts vitaux d’une personne physique ou s’il porte sur des données manifestement rendues publiques par la personne en cause. En mentionnant ainsi les « garanties appropriées pour les droits et libertés », qui s’ajoutent à celles prévues au chapitre XIII de la loi du 6 janvier 1978, le législateur a entendu faire référence aux règles relatives à la collecte, à l’accès et à la sécurisation des données, déterminées au cas par cas en fonction de la finalité de chaque traitement en cause. Ainsi, en adoptant les dispositions contestées, le législateur n’est pas resté en deçà de la compétence que lui attribue l’article 34 de la Constitution pour fixer les règles concernant les garanties fondamentales accordées aux citoyens pour l’exercice des libertés publiques.
Le grief tiré de la méconnaissance de l’article 34 de la Constitution doit ainsi être écarté. Le premier alinéa de l’article 70-1 et l’article 70-2 de la loi du 6 janvier 1978, qui ne méconnaissent en tout état de cause aucune autre exigence constitutionnelle, sont conformes à la Constitution.

– Sur certaines dispositions de l’article 36 :

L’article 36 réécrit l’article 230-8 du code de procédure pénale définissant les conditions dans lesquelles peuvent être effacées les mentions relatives aux antécédents judiciaires figurant dans un traitement de données à caractère personnel opéré aux fins de faciliter la constatation des infractions à la loi pénale. Ces dispositions prévoient que le procureur de la République est compétent pour ordonner l’effacement ou la rectification de ces données, d’office ou à la demande de la personne concernée par les données. Aux termes des quatrième à huitième phrases du premier alinéa de l’article 230-8 : « La personne concernée peut former cette demande sans délai à la suite d’une décision devenue définitive de relaxe, d’acquittement, de condamnation avec dispense de peine ou dispense de mention au casier judiciaire, de non-lieu ou de classement sans suite. Dans les autres cas, la personne ne peut former sa demande, à peine d’irrecevabilité, que lorsque ne figure plus aucune mention de nature pénale dans le bulletin n° 2 de son casier judiciaire. En cas de décision de relaxe ou d’acquittement devenue définitive, les données personnelles concernant les personnes mises en cause sont effacées, sauf si le procureur de la République en prescrit le maintien, auquel cas elles font l’objet d’une mention. Lorsque le procureur de la République prescrit le maintien des données personnelles relatives à une personne ayant bénéficié d’une décision de relaxe ou d’acquittement devenue définitive, il en avise la personne concernée. En cas de décision de non-lieu ou de classement sans suite, les données personnelles concernant les personnes mises en cause font l’objet d’une mention, sauf si le procureur de la République ordonne l’effacement des données personnelles ».
Les requérants soutiennent que les quatrième à huitième phrases du premier alinéa de l’article 230-8 du code de procédure pénale contreviennent au droit au respect de la vie privée dès lors qu’une personne n’ayant pas fait l’objet d’une décision définitive de relaxe, d’acquittement, de condamnation avec dispense de peine ou dispense de mention au casier judiciaire, de non-lieu ou de classement sans suite ne peut demander l’effacement ou la rectification des mentions la concernant que « lorsque ne figure plus aucune mention de nature pénale dans le bulletin n° 2 de son casier judiciaire », alors même que cette mention peut être sans lien avec l’inscription à l’origine de la demande. Par ailleurs, la distinction opérée par ces dispositions, en ce qui concerne l’effacement d’office des données, entre les personnes relaxées ou acquittées et celles ayant fait l’objet d’une décision de non-lieu ou de classement sans suite serait contraire au principe d’égalité devant la loi.

. En ce qui concerne le grief tiré de la méconnaissance du droit au respect de la vie privée :

D’une part, en autorisant la création de traitements de données à caractère personnel recensant des antécédents judiciaires et l’accès à ces traitements par des autorités investies par la loi d’attributions de police judiciaire et par certains personnels investis de missions de police administrative, le législateur a entendu leur confier un outil d’aide à l’enquête judiciaire et à certaines enquêtes administratives. Il a ainsi poursuivi les objectifs de valeur constitutionnelle de recherche des auteurs d’infractions et de prévention des atteintes à l’ordre public.
D’autre part, figurent dans ce fichier des données particulièrement sensibles pouvant être consultées non seulement aux fins de constatation des infractions à la loi pénale, de rassemblement des preuves de ces infractions et de recherche de leurs auteurs, mais également à d’autres fins de police administrative. Par ailleurs, le législateur n’a pas fixé la durée maximum de conservation des informations enregistrées. Toutefois, d’une part, les dispositions contestées permettent à toute personne ayant bénéficié d’une décision définitive de relaxe, d’acquittement, de condamnation avec dispense de peine ou de mention au casier judiciaire, de non-lieu ou de classement sans suite, de demander sans délai l’effacement ou la rectification des données la concernant. D’autre part, en l’absence d’une telle décision, la personne peut demander l’effacement ou la rectification des données dès lors qu’il ne figure plus aucune mention de nature pénale dans le bulletin n° 2 de son casier judiciaire. Indépendamment des règles légales de retrait des mentions d’une condamnation au bulletin n° 2, le juge pénal peut exclure expressément une telle mention lorsqu’il prononce cette condamnation ou par jugement rendu postérieurement sur la requête du condamné. Enfin, la mention est supprimée en cas de réhabilitation acquise de plein droit ou de réhabilitation judiciaire.
Il résulte de ce qui précède que le grief tiré de la méconnaissance au droit au respect de la vie privée doit être écarté.

. En ce qui concerne le grief tiré de la méconnaissance du principe d’égalité devant la loi :

En application des dispositions contestées, le législateur a traité différemment les personnes ayant fait l’objet d’une décision de relaxe ou d’acquittement devenue définitive et celles ayant fait l’objet d’une décision de non-lieu ou de classement sans suite. Alors que, pour les premières, les données personnelles doivent être effacées d’office du traitement, pour les secondes, les données sont conservées sauf décision contraire du procureur de la République.
Toutefois, cette différence de traitement correspond à une différence de situation, les décisions de relaxe ou d’acquittement étant revêtues de l’autorité de la chose jugée et faisant obstacle à ce que la personne soit à nouveau condamnée ou poursuivie pour les mêmes faits alors que les décisions de non-lieu à l’issue d’une instruction ou de classement sans suite n’entraînent pas l’extinction de l’action publique. Cette différence de traitement est en rapport avec l’objet de la loi, qui est de permettre la conservation de données aux fins notamment de faciliter la constatation des infractions à la loi pénale. Le grief tiré de la méconnaissance du principe d’égalité devant la loi doit donc être écarté.
Il résulte de tout ce qui précède que les quatrième à huitième phrases du premier alinéa de l’article 230-8 du code de procédure pénale, qui ne méconnaissent aucune autre exigence constitutionnelle, sont conformes à la Constitution.

– Sur les autres dispositions :

Le Conseil constitutionnel n’a soulevé d’office aucune question de conformité à la Constitution et ne s’est donc pas prononcé sur la constitutionnalité des autres dispositions que celles examinées dans la présente décision.

LE CONSEIL CONSTITUTIONNEL DÉCIDE :

Article 1er. – Les mots « sous le contrôle de l’autorité publique ou » figurant au 1° de l’article 13 de la loi relative à la protection des données personnelles sont contraires à la Constitution.

Article 2. – Sont conformes à la Constitution les dispositions suivantes, dans leur rédaction résultant de la loi déférée :

– le deuxième alinéa de l’article 7-1 de la loi n° 78-17 du 6 janvier 1978 relative à l’informatique, aux fichiers et aux libertés ;

– les mots « condamnations pénales, aux infractions ou aux mesures de sûreté connexes ne peuvent être effectués que » figurant au premier alinéa de l’article 9 de la même loi du 6 janvier 1978, les mots « ainsi que les personnes morales de droit privé collaborant au service public de la justice et appartenant à des catégories dont la liste est fixée par décret en Conseil d’État, pris après avis motivé et publié de la Commission nationale de l’informatique et des libertés, dans la mesure strictement nécessaire à leur mission » figurant au 1° du même article et le 3° du même article ;

– le 2° de l’article 10 de la même loi ;

– la deuxième phrase du a du 4° de l’article 11 de la même loi ;

– le deuxième alinéa de l’article 17 de la même loi ;

– le paragraphe V de l’article 44 de la même loi ;

– le paragraphe I, le premier alinéa du paragraphe II et la deuxième phrase du 7° du paragraphe III de l’article 45 de la même loi ;

– les mots « la prise en charge des prestations par les organismes d’assurance maladie complémentaire » figurant au 3° de l’article 53 de la même loi ;

– le premier alinéa de l’article 70-1 et l’article 70-2 de la même loi ;

– les quatrième à huitième phrases du premier alinéa de l’article 230-8 du code de procédure pénale.

Article 3. – Cette décision sera publiée au Journal officiel de la République française.

Jugé par le Conseil constitutionnel dans sa séance du 12 juin 2018, où siégeaient:

M. Laurent FABIUS, Président,

Mme Claire BAZY MALAURIE,

MM. Valéry GISCARD d’ESTAING,

Jean-Jacques HYEST,

Lionel JOSPIN,

Mmes Dominique LOTTIN,

Corinne LUQUIENS,

Nicole MAESTRACCI et

M. Michel PINAULT.

Rendu public le 12 juin 2018.

06Jul/18

Loi n° 2018-493 du 20 juin 2018 relative à la protection des données personnelles

6 julio, 2018Francia, LeyLegislación de Francia, Legislation France, Loi n° 2018-493 du 20 juin 2018 relative à la protection des données personnelles. (JORF n°0141 du 21 juin 2018 texte n° 1).José Cuervo

Loi n° 2018-493 du 20 juin 2018 relative à la protection des données personnelles. (JORF n°0141 du 21 juin 2018 texte n° 1).

L’Assemblée nationale et le Sénat ont délibéré,

L’Assemblée nationale a adopté,

Vu la décision du Conseil constitutionnel n° 2018-765 DC du 12 juin 2018 ;

Le Président de la République promulgue la loi dont la teneur suit :

Titre Ier : DISPOSITIONS D’ADAPTATION COMMUNES AU RÈGLEMENT (UE) 2016/679 DU PARLEMENT EUROPÉEN ET DU CONSEIL DU 27 AVRIL 2016 ET À LA DIRECTIVE (UE) 2016/680 DU PARLEMENT EUROPÉEN ET DU CONSEIL DU 27 AVRIL 2016

Chapitre Ier : Dispositions relatives à la Commission nationale de l’informatique et des libertés

Article 1

L’article 11 de la loi n° 78-17 du 6 janvier 1978 relative à l’informatique, aux fichiers et aux libertés est ainsi modifié :

1° Au début du premier alinéa, est ajoutée la mention : « I.-» ;

2° Après la première phrase du même premier alinéa, est insérée une phrase ainsi rédigée : « Elle est l’autorité de contrôle nationale au sens et pour l’application du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité » ;

3° Le 1° est complété par les mots : « et peut, à cette fin, apporter une information adaptée aux collectivités territoriales, à leurs groupements et aux petites et moyennes entreprises » ;

4° Le 2° est ainsi modifié :

a) Le premier alinéa est complété par les mots : « et aux autres dispositions relatives à la protection des données personnelles prévues par les textes législatifs et réglementaires, le droit de l’Union européenne et les engagements internationaux de la France » ;

b) Au a, les mots : « autorise les traitements mentionnés à l’article 25, » et, à la fin, les mots : « et reçoit les déclarations relatives aux autres traitements » sont supprimés ;

c) Après le même a, il est inséré un a bis ainsi rédigé :

« a bis) Elle établit et publie des lignes directrices, recommandations ou référentiels destinés à faciliter la mise en conformité des traitements de données à caractère personnel avec les textes relatifs à la protection des données à caractère personnel et à procéder à l’évaluation préalable des risques par les responsables de traitement et leurs sous-traitants. Elle prend en compte la situation des personnes dépourvues de compétences numériques. Elle encourage l’élaboration de codes de conduite définissant les obligations qui incombent aux responsables de traitement et à leurs sous-traitants, compte tenu du risque inhérent aux traitements de données à caractère personnel pour les droits et libertés des personnes physiques, notamment des mineurs, et des besoins spécifiques des collectivités territoriales, de leurs groupements et des micro-entreprises, petites entreprises et moyennes entreprises ; elle homologue et publie les méthodologies de référence destinées à favoriser la conformité des traitements de données de santé à caractère personnel ; »

d) Le b est ainsi rédigé :

« b) En concertation avec les organismes publics et privés représentatifs des acteurs concernés, elle établit et publie des règlements types en vue d’assurer la sécurité des systèmes de traitement de données à caractère personnel et de régir les traitements de données biométriques, génétiques et de santé. A ce titre, sauf pour les traitements mis en œuvre pour le compte de l’Etat agissant dans l’exercice de ses prérogatives de puissance publique, elle peut prescrire des mesures, notamment techniques et organisationnelles, supplémentaires pour le traitement des données biométriques, génétiques et de santé en application du 4 de l’article 9 du r èglement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité et des garanties complémentaires en matière de traitement de données à caractère personnel relatives aux condamnations pénales et aux infractions conformément à l’article 10 du même règlement ; »

e) Après le f, il est inséré un f bis ainsi rédigé :

« f bis) Elle peut décider de certifier des personnes, des produits, des systèmes de données ou des procédures aux fins de reconnaître qu’ils se conforment au règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité et à la présente loi. Elle prend en considération, à cette fin, les besoins spécifiques des collectivités territoriales, de leurs groupements et des micro-entreprises, petites entreprises et moyennes entreprises. Elle agrée, aux mêmes fins, des organismes certificateurs, sur la base, le cas échéant, de leur accréditation par l’organisme national d’accréditation mentionné au b du 1 de l’article 43 du même règlement ou décide, conjointement avec cet organisme, que ce dernier procède à leur agrément, dans des conditions précisées par décret en Conseil d’Etat pris après avis de la Commission nationale de l’informatique et des libertés. La commission élabore ou approuve les critères des référentiels de certification et d’agrément ; »

f) Au g, après le mot : « certification », sont insérés les mots : «, par des tiers agréés ou accrédités selon les modalités mentionnées au f bis du présent 2°, » ;

g) A la fin du h, les mots : « d’accès concernant les traitements mentionnés aux articles 41 et 42 » sont remplacés par les mots : « ou saisines prévues aux articles 41,42 et 70-22 » ;

h) Sont ajoutés des i et j ainsi rédigés :

« i) Elle peut établir une liste des traitements susceptibles de créer un risque élevé devant faire l’objet d’une consultation préalable conformément à l’article 70-4 ;

« j) Elle mène des actions de sensibilisation auprès des médiateurs de la consommation et des médiateurs publics, au sens de l’article L. 611-1 du code de la consommation, en vue de la bonne application de la présente loi ; »

5° Après la première phrase du a du 4°, est insérée une phrase ainsi rédigée :

« Elle peut également être consultée par le Président de l’Assemblée nationale, par le Président du Sénat ou par les commissions compétentes de l’Assemblée nationale et du Sénat ainsi qu’à la demande d’un président de groupe parlementaire sur toute proposition de loi relative à la protection des données à caractère personnel ou au traitement de telles données. » ;

6° Après le même 4°, il est inséré un 5° ainsi rédigé :

« 5° Elle peut présenter des observations devant toute juridiction à l’occasion d’un litige relatif à l’application de la présente loi et des dispositions relatives à la protection des données personnelles prévues par les textes législatifs et règlementaires, le droit de l’Union européenne, y compris le règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité, et les engagements internationaux de la France. » ;

7° Au début du vingt-sixième alinéa, est ajoutée la mention : « II.-» ;

8° L’avant-dernier alinéa est supprimé.

Article 2

Le I de l’article 13 de la loi n° 78-17 du 6 janvier 1978 précitée est ainsi modifié :

1° Au 6°, le mot : « ou » est remplacé par le mot : « et » ;

2° Au 7°, après le mot : « numérique », sont insérés les mots : « et des questions touchant aux libertés individuelles ».

Article 3

L’article 15 de la loi n° 78-17 du 6 janvier 1978 précitée est ainsi modifié :

1° Après le premier alinéa, il est inséré un alinéa ainsi rédigé :

« L’ordre du jour de la commission réunie en formation plénière est rendu public. » ;

2° Sont ajoutés trois alinéas ainsi rédigés :

«-au 4 de l’article 34 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité, pour les décisions donnant acte du respect des conditions mentionnées au 3 du même article 34 ;

«-aux a et h du 3 de l’article 58 du même règlement.

« Un décret en Conseil d’Etat, pris après avis de la Commission nationale de l’informatique et des libertés, fixe les conditions et limites dans lesquelles le président de la commission et le vice-président délégué peuvent déléguer leur signature. »

Article 4

La loi n° 78-17 du 6 janvier 1978 précitée est ainsi modifiée :

1° Au premier alinéa de l’article 17, après le mot : « restreinte », sont insérés les mots : « prend les mesures et », après le mot : « traitements », sont insérés les mots : « ou des sous-traitants » et, après le mot : « découlant », sont insérés les mots : « du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité et » ;

2° Après le même premier alinéa, il est inséré un alinéa ainsi rédigé :

« Ses membres délibèrent hors de la présence des agents de la commission, à l’exception de ceux chargés de la tenue de la séance. » ;

3° Les deux derniers alinéas de l’article 18 sont ainsi rédigés :

« Le commissaire du Gouvernement assiste à toutes les délibérations de la commission réunie en formation plénière ainsi qu’à celles des réunions de son bureau qui ont pour objet l’exercice des attributions déléguées en application de l’article 16. Il peut assister aux séances de la formation restreinte, sans être présent au délibéré. Il est rendu destinataire de l’ensemble des avis et décisions de la commission et de la formation restreinte.

« Sauf en matière de mesures ou de sanctions relevant du chapitre VII, il peut provoquer une seconde délibération de la commission, qui doit intervenir dans les dix jours suivant la délibération initiale. »

Article 5

L’article 44 de la loi n° 78-17 du 6 janvier 1978 précitée est ainsi modifié :

1° Au premier alinéa du I, les mots : « et qui sont à usage professionnel » sont supprimés ;

2° Le II est ainsi modifié :

a) A la première phrase du premier alinéa, les mots : « de locaux professionnels privés » sont remplacés par les mots : « de ces lieux, locaux, enceintes, installations ou établissements » ;

b) La dernière phrase du dernier alinéa est complétée par les mots : « dont la finalité est l’exercice effectif des missions prévues au III » ;

3° Les trois premiers alinéas du III sont remplacés par deux alinéas ainsi rédigés :

« III.-Pour l’exercice des missions relevant de la Commission nationale de l’informatique et des libertés en application du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité et de la présente loi, les membres et agents mentionnés au premier alinéa du I du présent article peuvent demander communication de tous documents nécessaires à l’accomplissement de leur mission, quel qu’en soit le support, et en prendre copie. Ils peuvent recueillir, notamment sur place ou sur convocation, tout renseignement et toute justification utiles et nécessaires à l’accomplissement de leur mission. Ils peuvent accéder, dans des conditions préservant la confidentialité à l’égard des tiers, aux programmes informatiques et aux données ainsi qu’en demander la transcription par tout traitement approprié dans des documents directement utilisables pour les besoins du contrôle. Le secret ne peut leur être opposé sauf concernant les informations couvertes par le secret professionnel applicable aux relations entre un avocat et son client, par le secret des sources des traitements journalistiques ou, sous réserve du deuxième alinéa du présent III, par le secret médical.

« Le secret médical est opposable s’agissant des informations qui figurent dans un traitement nécessaire aux fins de la médecine préventive, de la recherche médicale, des diagnostics médicaux, de l’administration de soins ou de traitements, ou de la gestion de service de santé. La communication des données médicales individuelles incluses dans cette catégorie de traitement ne peut alors se faire que sous l’autorité et en présence d’un médecin. » ;

4° Avant le dernier alinéa du même III, sont insérés deux alinéas ainsi rédigés :

« Pour le contrôle de services de communication au public en ligne, les membres et agents mentionnés au premier alinéa du I peuvent réaliser toute opération en ligne nécessaire à leur mission sous une identité d’emprunt. À peine de nullité, leurs actes ne peuvent constituer une incitation à commettre une infraction. L’utilisation d’une identité d’emprunt est sans incidence sur la régularité des constatations effectuées conformément au troisième alinéa du présent III. Un décret en Conseil d’Etat, pris après avis de la Commission nationale de l’informatique et des libertés, précise les conditions dans lesquelles ces membres et agents procèdent dans ces cas à leurs constatations.

« Les membres et agents mentionnés au premier alinéa du I peuvent, à la demande du président de la commission, être assistés par des experts. » ;

5° Il est ajouté un V ainsi rédigé :

« V.-Dans l’exercice de son pouvoir de contrôle portant sur les traitements relevant du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité et de la présente loi, la Commission nationale de l’informatique et des libertés n’est pas compétente pour contrôler les opérations de traitement effectuées, dans l’exercice de leur fonction juridictionnelle, par les juridictions. »

Article 6

La loi n° 78-17 du 6 janvier 1978 précitée est ainsi modifiée :

1° Après l’article 48, il est inséré un chapitre VII bis, intitulé : « De la coopération » et comprenant les articles 49 à 49-5 tels qu’ils résultent des 2° à 4° du présent article ;

2° L’article 49 est ainsi rédigé :

« Art. 49.-Dans les conditions prévues aux articles 60 à 67 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité, la Commission nationale de l’informatique et des libertés met en œuvre des procédures de coopération et d’assistance mutuelle avec les autorités de contrôle des autres Etats membres de l’Union européenne et réalise avec ces autorités des opérations conjointes.

« La commission, le président, le bureau, la formation restreinte et les agents de la commission mettent en œuvre, chacun pour ce qui le concerne, les procédures mentionnées au premier alinéa du présent article.

« La commission peut charger le bureau :

« 1° D’exercer ses prérogatives en tant qu’autorité concernée, au sens du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité, et en particulier d’émettre une objection pertinente et motivée au projet de décision d’une autre autorité de contrôle ;

« 2° Lorsque la commission adopte un projet de décision en tant qu’autorité chef de file ou autorité compétente, de mettre en œuvre les procédures de coopération, de contrôle de la cohérence et de règlement des litiges prévues par le règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité et d’arrêter la décision au nom de la commission. » ;

3° Après le même article 49, sont insérés des articles 49-1 à 49-4 ainsi rédigés :

« Art. 49-1.-I.-Pour l’application de l’article 62 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité, la Commission nationale de l’informatique et des libertés coopère avec les autorités de contrôle des autres Etats membres de l’Union européenne, dans les conditions prévues au présent article.

« II.-Qu’elle agisse en tant qu’autorité de contrôle chef de file ou en tant qu’autorité concernée au sens des articles 4 et 56 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité, la Commission nationale de l’informatique et des libertés est compétente pour traiter une réclamation ou une éventuelle violation des dispositions du même règlement affectant par ailleurs d’autres Etats membres. Le président de la commission invite les autres autorités de contrôle concernées à participer aux opérations de contrôle conjointes qu’il décide de conduire.

« III.-Lorsqu’une opération de contrôle conjointe se déroule sur le territoire français, des membres ou agents habilités de la commission, agissant en tant qu’autorité de contrôle d’accueil, sont présents aux côtés des membres et agents des autres autorités de contrôle participant, le cas échéant, à l’opération. A la demande de l’autorité de contrôle d’un Etat membre, le président de la commission peut habiliter, par décision particulière, ceux des membres ou agents de l’autorité de contrôle concernée qui présentent des garanties comparables à celles requises des agents de la commission, en application de l’article 19 de la présente loi, à exercer, sous son autorité, tout ou partie des pouvoirs de vérification et d’enquête dont disposent les membres et les agents de la commission.

« IV.-Lorsque la commission est invitée à contribuer à une opération de contrôle conjointe décidée par l’autorité de contrôle d’un autre Etat membre, le président de la commission se prononce sur le principe et les conditions de la participation, désigne les membres et agents habilités et en informe l’autorité requérante dans les conditions prévues à l’article 62 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité.

« Art. 49-2.-I.-Les traitements mentionnés à l’article 70-1 font l’objet d’une coopération entre la Commission nationale de l’informatique et des libertés et les autorités de contrôle des autres Etats membres de l’Union européenne dans les conditions prévues au présent article.

« II.-La commission communique aux autorités de contrôle des autres Etats membres les informations utiles et leur prête assistance en mettant notamment en œuvre, à leur demande, des mesures de contrôle telles que des mesures de consultation, d’inspection et d’enquête.

« La commission répond à une demande d’assistance mutuelle formulée par une autre autorité de contrôle dans les meilleurs délais et au plus tard un mois après réception de la demande contenant toutes les informations nécessaires, notamment sa finalité et ses motifs. Elle ne peut refuser de satisfaire à cette demande que si elle n’est pas compétente pour traiter l’objet de la demande ou les mesures qu’elle est invitée à exécuter, ou si une disposition du droit de l’Union européenne ou du droit français y fait obstacle.

« La commission informe l’autorité de contrôle requérante des résultats obtenus ou, selon le cas, de l’avancement du dossier ou des mesures prises pour donner suite à la demande.

« La commission peut, pour l’exercice de ses missions, solliciter l’assistance d’une autorité de contrôle d’un autre Etat membre de l’Union européenne.

« La commission donne les motifs de tout refus de satisfaire à une demande lorsqu’elle estime ne pas être compétente ou lorsqu’elle considère que satisfaire à la demande constituerait une violation du droit de l’Union européenne ou du droit français.

« Art. 49-3.-Lorsque la commission agit en tant qu’autorité de contrôle chef de file s’agissant d’un traitement transfrontalier au sein de l’Union européenne, elle communique sans tarder aux autres autorités de contrôle concernées le rapport du rapporteur mentionné au premier alinéa de l’article 47 ainsi que l’ensemble des informations utiles de la procédure ayant permis d’établir le rapport, avant l’éventuelle audition du responsable de traitement ou de son sous-traitant. Les autorités concernées sont mises en mesure d’assister, par tout moyen de retransmission approprié, à l’audition par la formation restreinte du responsable de traitement ou de son sous-traitant, ou de prendre connaissance d’un procès-verbal dressé à la suite de l’audition.

« Après en avoir délibéré, la formation restreinte soumet son projet de décision aux autres autorités de contrôle concernées conformément à la procédure définie à l’article 60 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité. A ce titre, elle se prononce sur la prise en compte des objections pertinentes et motivées émises par ces autorités et saisit, si elle décide d’écarter l’une des objections, le comité européen de la protection des données conformément à l’article 65 du même règlement.

« Les conditions d’application du présent article sont définies par décret en Conseil d’Etat, après avis de la Commission nationale de l’informatique et des libertés.

« Art. 49-4.-Lorsque la commission agit en tant qu’autorité de contrôle concernée, au sens du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité, le président de la commission est saisi des projets de mesures correctrices soumis à la commission par une autorité de contrôle chef de file.

« Lorsque ces mesures sont d’objet équivalent à celles définies aux I et II de l’article 45 de la présente loi, le président décide, le cas échéant, d’émettre une objection pertinente et motivée, selon les modalités prévues à l’article 60 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité.

« Lorsque ces mesures sont d’objet équivalent à celles définies au III de l’article 45 de la présente loi, le président saisit la formation restreinte. Le président de la formation restreinte ou le membre de la formation restreinte qu’il désigne peut, le cas échéant, émettre une objection pertinente et motivée selon les mêmes modalités. » ;

4° L’article 49 bis devient l’article 49-5.

Article 7

I.-Le chapitre VII de la loi n° 78-17 du 6 janvier 1978 précitée est ainsi modifié :

1° L’intitulé est ainsi rédigé : « Mesures et sanctions prises par la formation restreinte de la Commission nationale de l’informatique et des libertés » ;

2° Les articles 45 à 48 sont ainsi rédigés :

« Art. 45.-I.-Le président de la Commission nationale de l’informatique et des libertés peut avertir un responsable de traitement ou son sous-traitant du fait que les opérations de traitement envisagées sont susceptibles de violer les dispositions du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité ou de la présente loi.

« II.-Lorsque le responsable de traitement ou son sous-traitant ne respecte pas les obligations résultant du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité ou de la présente loi, le président de la Commission nationale de l’informatique et des libertés peut, si le manquement constaté est susceptible de faire l’objet d’une mise en conformité, prononcer à son égard une mise en demeure, dans le délai qu’il fixe :

« 1° De satisfaire aux demandes présentées par la personne concernée en vue d’exercer ses droits ;

« 2° De mettre les opérations de traitement en conformité avec les dispositions applicables ;

« 3° A l’exception des traitements qui intéressent la sûreté de l’Etat ou la défense, de communiquer à la personne concernée une violation de données à caractère personnel ;

« 4° De rectifier ou d’effacer des données à caractère personnel, ou de limiter le traitement de ces données.

« Dans le cas prévu au 4° du présent II, le président peut, dans les mêmes conditions, mettre en demeure le responsable de traitement ou son sous-traitant de notifier aux destinataires des données les mesures qu’il a prises.

« Le délai de mise en conformité peut être fixé à vingt-quatre heures en cas d’extrême urgence.

« Le président prononce, le cas échéant, la clôture de la procédure de mise en demeure.

« Le président peut demander au bureau de rendre publique la mise en demeure. Dans ce cas, la décision de clôture de la procédure de mise en demeure fait l’objet de la même publicité.

« III.-Lorsque le responsable de traitement ou son sous-traitant ne respecte pas les obligations résultant du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité ou de la présente loi, le président de la Commission nationale de l’informatique et des libertés peut également, le cas échéant après lui avoir adressé l’avertissement prévu au I du présent article ou, le cas échéant en complément d’une mise en demeure prévue au II, saisir la formation restreinte de la commission en vue du prononcé, après procédure contradictoire, de l’une ou de plusieurs des mesures suivantes :

« 1° Un rappel à l’ordre ;

« 2° Une injonction de mettre en conformité le traitement avec les obligations résultant de la présente loi ou du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité ou de satisfaire aux demandes présentées par la personne concernée en vue d’exercer ses droits, qui peut être assortie, sauf dans des cas où le traitement est mis en œuvre par l’Etat, d’une astreinte dont le montant ne peut excéder 100 000 € par jour de retard à compter de la date fixée par la formation restreinte ;

« 3° A l’exception des traitements qui intéressent la sûreté de l’Etat ou la défense ou de ceux relevant du chapitre XIII de la présente loi lorsqu’ils sont mis en œuvre pour le compte de l’Etat, la limitation temporaire ou définitive du traitement, son interdiction ou le retrait d’une autorisation accordée en application du même règlement ou de la présente loi ;

« 4° Le retrait d’une certification ou l’injonction, à l’organisme certificateur concerné, de refuser une certification ou de retirer la certification accordée ;

« 5° La suspension des flux de données adressées à un destinataire situé dans un pays tiers ou à une organisation internationale ;

« 6° La suspension partielle ou totale de la décision d’approbation des règles d’entreprise contraignantes ;

« 7° A l’exception des cas où le traitement est mis en œuvre par l’Etat, une amende administrative ne pouvant excéder 10 millions d’euros ou, s’agissant d’une entreprise, 2 % du chiffre d’affaires annuel mondial total de l’exercice précédent, le montant le plus élevé étant retenu. Dans les hypothèses mentionnées aux 5 et 6 de l’article 83 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité, ces plafonds sont portés, respectivement, à 20 millions d’euros et 4 % dudit chiffre d’affaires. La formation restreinte prend en compte, dans la détermination du montant de l’amende, les critères précisés au même article 83.

« Le projet de mesure est, le cas échéant, soumis aux autres autorités de contrôle concernées selon les modalités définies à l’article 60 du même règlement.

« Art. 46.-I.-Lorsque le non-respect des dispositions du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité ou de la présente loi entraîne une violation des droits et libertés mentionnés à l’article 1er de la présente loi et que le président de la commission considère qu’il est urgent d’intervenir, il saisit la formation restreinte, qui peut, dans le cadre d’une procédure d’urgence contradictoire définie par décret en Conseil d’Etat, adopter l’une des mesures suivantes :

« 1° L’interruption provisoire de la mise en œuvre du traitement, y compris d’un transfert de données hors de l’Union européenne, pour une durée maximale de trois mois, si le traitement n’est pas au nombre de ceux qui intéressent la sûreté de l’Etat ou la défense ou de ceux relevant du chapitre XIII lorsqu’ils sont mis en œuvre pour le compte de l’Etat ;

« 2° La limitation du traitement de certaines des données à caractère personnel traitées, pour une durée maximale de trois mois, si le traitement n’est pas au nombre de ceux qui intéressent la sûreté de l’Etat ou la défense ou de ceux relevant du même chapitre XIII lorsqu’ils sont mis en œuvre pour le compte de l’Etat ;

« 3° La suspension provisoire de la certification délivrée au responsable de traitement ou à son sous-traitant ;

« 4° La suspension provisoire de l’agrément délivré à un organisme de certification ou un organisme chargé du respect d’un code de conduite ;

« 5° La suspension provisoire de l’autorisation délivrée sur le fondement du III de l’article 54 de la présente loi ;

« 6° L’injonction de mettre en conformité le traitement avec les obligations résultant du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité ou de la présente loi ou de satisfaire aux demandes présentées par la personne concernée en vue d’exercer ses droits, qui peut être assortie, sauf dans le cas où le traitement est mis en œuvre par l’Etat, d’une astreinte dont le montant ne peut excéder 100 000 € par jour de retard à compter de la date fixée par la formation restreinte ;

« 7° Un rappel à l’ordre ;

« 8° L’information du Premier ministre pour qu’il prenne, le cas échéant, les mesures permettant de faire cesser la violation constatée, si le traitement en cause est au nombre de ceux qui intéressent la sûreté de l’Etat ou la défense ou de ceux relevant du chapitre XIII de la présente loi lorsqu’ils sont mis en œuvre pour le compte de l’Etat. Le Premier ministre fait alors connaître à la formation restreinte les suites qu’il a données à cette information au plus tard quinze jours après l’avoir reçue.

« II.-En cas de circonstances exceptionnelles prévues au 1 de l’article 66 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité, lorsque la formation restreinte adopte les mesures provisoires prévues aux 1° à 4° du I du présent article, elle informe sans délai de la teneur des mesures prises et de leurs motifs les autres autorités de contrôle concernées, le comité européen de la protection des données et la Commission européenne.

« Lorsque la formation restreinte a pris de telles mesures et qu’elle estime que des mesures définitives doivent être prises, elle met en œuvre les dispositions du 2 de l’article 66 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité.

« III.-Pour les traitements relevant du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité, lorsqu’une autorité de contrôle compétente en application du même règlement n’a pas pris de mesure appropriée dans une situation où il est urgent d’intervenir afin de protéger les droits et libertés des personnes concernées, la formation restreinte, saisie par le président de la commission, peut demander au comité européen de la protection des données un avis d’urgence ou une décision contraignante d’urgence dans les conditions et selon les modalités prévues aux 3 et 4 de l’article 66 dudit règlement.

« IV.-En cas d’atteinte grave et immédiate aux droits et libertés mentionnés à l’article 1er de la présente loi, le président de la commission peut en outre demander, par la voie du référé, à la juridiction compétente d’ordonner, le cas échéant sous astreinte, toute mesure nécessaire à la sauvegarde de ces droits et libertés.

« Art. 47.-Les mesures prévues au III de l’article 45 et aux 1° à 7° du I de l’article 46 sont prononcées sur la base d’un rapport établi par l’un des membres de la Commission nationale de l’informatique et des libertés, désigné par le président de celle-ci parmi les membres n’appartenant pas à la formation restreinte. Ce rapport est notifié au responsable de traitement ou à son sous-traitant, qui peut déposer des observations et se faire représenter ou assister. Le rapporteur peut présenter des observations orales à la formation restreinte mais ne prend pas part à ses délibérations. La formation restreinte peut entendre toute personne dont l’audition lui paraît susceptible de contribuer utilement à son information, y compris, à la demande du secrétaire général de la commission, les agents des services de celle-ci.

« La formation restreinte peut rendre publiques les mesures qu’elle prend. Elle peut également ordonner leur insertion dans des publications, journaux et supports qu’elle désigne, aux frais des personnes sanctionnées.

« Sans préjudice des obligations d’information qui incombent au responsable de traitement ou à son sous-traitant en application de l’article 34 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité, la formation restreinte peut ordonner que ce responsable ou ce sous-traitant informe individuellement, à ses frais, chacune des personnes concernées de la violation relevée des dispositions de la présente loi ou du règlement précité ainsi que, le cas échéant, de la mesure prononcée.

« Lorsque la formation restreinte a prononcé une sanction pécuniaire devenue définitive avant que le juge pénal ait statué définitivement sur les mêmes faits ou des faits connexes, celui-ci peut ordonner que l’amende administrative s’impute sur l’amende pénale qu’il prononce.

« L’astreinte est liquidée par la formation restreinte, qui en fixe le montant définitif.

« Les sanctions pécuniaires et les astreintes sont recouvrées comme les créances de l’Etat étrangères à l’impôt et au domaine.

« Art. 48.-Lorsqu’un organisme de certification ou un organisme chargé du respect d’un code de conduite a manqué à ses obligations ou n’a pas respecté les dispositions du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité ou celles de la présente loi, le président de la Commission nationale de l’informatique et des libertés peut, le cas échéant après mise en demeure, saisir la formation restreinte de la commission, qui peut prononcer, dans les mêmes conditions que celles prévues aux articles 45 à 47, le retrait de l’agrément qui a été délivré à cet organisme. »

II.-A.-Au deuxième alinéa de l’article 226-16 du code pénal, la référence : « I » est remplacée par la référence : « III ».

B.-Le deuxième alinéa de l’article 226-16 du code pénal demeure applicable, dans sa rédaction antérieure à la présente loi, aux faits commis avant l’entrée en vigueur de celle-ci.

Chapitre II : Dispositions relatives à certaines catégories de données

Article 8

L’article 8 de la loi n° 78-17 du 6 janvier 1978 précitée est ainsi modifié :

1° Le I est ainsi rédigé :

« I.-Il est interdit de traiter des données à caractère personnel qui révèlent la prétendue origine raciale ou l’origine ethnique, les opinions politiques, les convictions religieuses ou philosophiques ou l’appartenance syndicale d’une personne physique ou de traiter des données génétiques, des données biométriques aux fins d’identifier une personne physique de manière unique, des données concernant la santé ou des données concernant la vie sexuelle ou l’orientation sexuelle d’une personne physique. » ;

2° Le II est ainsi modifié :

a) A la fin du 7°, les mots : « et dans les conditions prévues à l’article 25 de la présente loi » sont supprimés ;

b) Le 8° est ainsi rédigé :

« 8° Les traitements comportant des données concernant la santé justifiés par l’intérêt public et conformes aux dispositions du chapitre IX de la présente loi ; »

c) Sont ajoutés des 9° à 11° ainsi rédigés :

« 9° Les traitements conformes aux règlements types mentionnés au b du 2° du I de l’article 11 mis en œuvre par les employeurs ou les administrations qui portent sur des données biométriques strictement nécessaires au contrôle de l’accès aux lieux de travail ainsi qu’aux appareils et aux applications utilisés dans le cadre des missions confiées aux salariés, aux agents, aux stagiaires ou aux prestataires ;

« 10° Les traitements portant sur la réutilisation des informations publiques figurant dans les jugements et décisions mentionnés, respectivement, à l’article L. 10 du code de justice administrative et à l’article L. 111-13 du code de l’organisation judiciaire, sous réserve que ces traitements n’aient ni pour objet ni pour effet de permettre la réidentification des personnes concernées ;

« 11° Les traitements nécessaires à la recherche publique au sens de l’article L. 112-1 du code de la recherche, mis en œuvre dans les conditions prévues au 2 de l’article 9 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité, après avis motivé et publié de la Commission nationale de l’informatique et des libertés rendu selon les modalités prévues à l’article 28 de la présente loi. » ;

3° Le III est ainsi rédigé :

« III.-N’entrent pas dans le champ de l’interdiction prévue au I les données à caractère personnel mentionnées au même I qui sont appelées à faire l’objet, à bref délai, d’un procédé d’anonymisation préalablement reconnu conforme aux dispositions de la présente loi par la Commission nationale de l’informatique et des libertés. » ;

4° Le IV est ainsi rédigé :

« IV.-De même, ne sont pas soumis à l’interdiction prévue au I les traitements, automatisés ou non, justifiés par l’intérêt public et autorisés dans les conditions prévues au II de l’article 26. »

Titre II : MARGES DE MANŒUVRE PERMISES PAR LE RÈGLEMENT (UE) 2016/679 DU PARLEMENT EUROPÉEN ET DU CONSEIL DU 27 AVRIL 2016 RELATIF À LA PROTECTION DES PERSONNES PHYSIQUES À L’ÉGARD DU TRAITEMENT DES DONNÉES À CARACTÈRE PERSONNEL ET À LA LIBRE CIRCULATION DE CES DONNÉES, ET ABROGEANT LA DIRECTIVE 95/46/CE

Article 9

L’article 2 de la loi n° 78-17 du 6 janvier 1978 précitée est ainsi modifié :

1° Au premier alinéa, après les mots : « traitements automatisés », sont insérés les mots :« en tout ou partie » ;

2° L’avant-dernier alinéa est complété par les mots : «, que cet ensemble soit centralisé, décentralisé ou réparti de manière fonctionnelle ou géographique ».

Chapitre Ier : Champ d’application territorial des dispositions complétant le règlement (UE) 2016/679

Article 10

Le chapitre Ier de la loi n° 78-17 du 6 janvier 1978 est complété par un article 5-1 ainsi rédigé :

« Art. 5-1.-Les règles nationales prises sur le fondement des dispositions du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 relatif à la protection des personnes physiques à l’égard du traitement des données à caractère personnel et à la libre circulation de ces données, et abrogeant la directive 95/46/ CE renvoyant au droit national le soin d’adapter ou de compléter les droits et obligations prévus par ce règlement s’appliquent dès lors que la personne concernée réside en France, y compris lorsque le responsable de traitement n’est pas établi en France.

« Toutefois, lorsqu’est en cause un des traitements mentionnés au 2 de l’article 85 du même règlement, les règles nationales mentionnées au premier alinéa du présent article sont celles dont relève le responsable de traitement, lorsqu’il est établi dans l’Union européenne. »

Chapitre II : Dispositions relatives à la simplification des formalités préalables à la mise en œuvre des traitements

Article 11

I.-L’article 22 de la loi n° 78-17 du 6 janvier 1978 précitée est ainsi rédigé :

« Art. 22.-Un décret en Conseil d’Etat, pris après avis motivé et publié de la Commission nationale de l’informatique et des libertés, détermine les catégories de responsables de traitement et les finalités de ces traitements au vu desquelles ces derniers peuvent être mis en œuvre lorsqu’ils portent sur des données comportant le numéro d’inscription des personnes au répertoire national d’identification des personnes physiques. La mise en œuvre des traitements intervient sans préjudice des obligations qui incombent aux responsables de traitement ou à leurs sous-traitants en application de la section 3 du chapitre IV du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité.

« N’entrent pas dans le champ d’application du premier alinéa du présent article ceux des traitements portant sur des données à caractère personnel parmi lesquelles figure le numéro d’inscription des personnes au répertoire national d’identification des personnes physiques ou qui requièrent une consultation de ce répertoire :

« 1° Qui ont exclusivement des finalités de statistique publique, sont mis en œuvre par le service statistique public et ne comportent aucune des données mentionnées au I de l’article 8 ou à l’article 9 ;

« 2° Qui ont exclusivement des finalités de recherche scientifique ou historique ;

« 3° Qui ont pour objet de mettre à la disposition des usagers de l’administration un ou plusieurs téléservices de l’administration électronique définis à l’article 1er de l‘ordonnance n° 2005-1516 du 8 décembre 2005 relative aux échanges électroniques entre les usagers et les autorités administratives et entre les autorités administratives, mis en œuvre par l’Etat, une personne morale de droit public ou une personne morale de droit privé gérant un service public.

« Pour les traitements dont les finalités sont mentionnées aux 1° et 2° du présent article, le numéro d’inscription au répertoire national d’identification des personnes physiques fait préalablement l’objet d’une opération cryptographique lui substituant un code statistique non signifiant. Cette opération est renouvelée à une fréquence définie par décret en Conseil d’Etat, pris après avis motivé et publié de la Commission nationale de l’informatique et des libertés. Les traitements ayant comme finalité exclusive de réaliser cette opération cryptographique ne sont pas soumis au premier alinéa.

« Pour les traitements dont les finalités sont mentionnées au 1°, l’utilisation du code statistique non signifiant n’est autorisée qu’au sein du service statistique public.

« Pour les traitements dont les finalités sont mentionnées au 2°, l’opération cryptographique et, le cas échéant, l’interconnexion de deux fichiers par l’utilisation du code spécifique non signifiant qui en est issu ne peuvent être assurées par la même personne ni par le responsable de traitement.

« A l’exception des traitements mentionnés au deuxième alinéa de l’article 55, le présent article n’est pas applicable aux traitements de données à caractère personnel dans le domaine de la santé qui sont régis par le chapitre IX. »

II.-L’article 27 de la loi n° 78-17 du 6 janvier 1978 précitée est ainsi rédigé :

« Art. 27.-Sont autorisés par décret en Conseil d’Etat, pris après avis motivé et publié de la Commission nationale de l’informatique et des libertés, les traitements de données à caractère personnel mis en œuvre pour le compte de l’Etat, agissant dans l’exercice de ses prérogatives de puissance publique, qui portent sur des données génétiques ou sur des données biométriques nécessaires à l’authentification ou au contrôle de l’identité des personnes. »

III.-Les articles 23 à 25 de la loi n° 78-17 du 6 janvier 1978 précitée sont abrogés.

IV.-L’article 226-16-1 A du code pénal est abrogé.

Chapitre III : Obligations incombant aux responsables de traitement et à leurs sous-traitants

Article 12

L’article 35 de la loi n° 78-17 du 6 janvier 1978 précitée est ainsi modifié :

1° Au début du premier alinéa, est ajoutée la mention : « I.-» ;

2° Sont ajoutés deux alinéas ainsi rédigés :

« Le présent I est applicable aux traitements ne relevant ni du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité, ni du chapitre XIII de la présente loi.

« II.-Dans le champ d’application du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité, le sous-traitant respecte les conditions prévues par ce règlement. »

Chapitre IV : Dispositions relatives à certaines catégories particulières de traitements

Article 13

L’article 9 de la loi n° 78-17 du 6 janvier 1978 précitée est ainsi modifié :

1° Au premier alinéa, les mots : « infractions, condamnations et mesures de sûreté ne peuvent être mis en œuvre que » sont remplacés par les mots : « condamnations pénales, aux infractions ou aux mesures de sûreté connexes ne peuvent être effectués que [dispositions déclarées non conformes à la Constitution par la décision du Conseil constitutionnel n° 2018-765 DC du 12 juin 2018.] » ;

2° Le 1° est complété par les mots : « ainsi que les personnes morales de droit privé collaborant au service public de la justice et appartenant à des catégories dont la liste est fixée par décret en Conseil d’Etat, pris après avis motivé et publié de la Commission nationale de l’informatique et des libertés, dans la mesure strictement nécessaire à leur mission » ;

3° Le 3° est ainsi rédigé :

« 3° Les personnes physiques ou morales, aux fins de leur permettre de préparer et, le cas échéant, d’exercer et de suivre une action en justice en tant que victime, mise en cause, ou pour le compte de ceux-ci et de faire exécuter la décision rendue, pour une durée strictement proportionnée à ces finalités. La communication à un tiers n’est alors possible que sous les mêmes conditions et dans la mesure strictement nécessaire à la poursuite de ces mêmes finalités ; »

4° Il est ajouté un 5° ainsi rédigé :

« 5° Les réutilisateurs des informations publiques figurant dans les jugements mentionnés à l’article L. 10 du code de justice administrative et les décisions mentionnées à l’article L. 111-13 du code de l’organisation judiciaire, sous réserve que les traitements mis en œuvre n’aient ni pour objet ni pour effet de permettre la réidentification des personnes concernées. »

Article 14

I.-L’article 36 de la loi n° 78-17 du 6 janvier 1978 précitée est ainsi modifié :

1° Au premier alinéa, les mots : « historiques, statistiques ou scientifiques » sont remplacés par les mots : « archivistiques dans l’intérêt public, à des fins de recherche scientifique ou historique ou à des fins statistiques » ;

2° Les deuxième à dernier alinéas sont supprimés ;

3° Sont ajoutés deux alinéas ainsi rédigés :

« Lorsque les traitements de données à caractère personnel sont mis en œuvre par les services publics d’archives à des fins archivistiques dans l’intérêt public conformément à l’article L. 211-2 du code du patrimoine, les droits prévus aux articles 15,16 et 18 à 21 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité ne s’appliquent pas dans la mesure où ces droits rendent impossible ou entravent sérieusement la réalisation de ces finalités. Les conditions et garanties appropriées prévues à l’article 89 du même règlement sont déterminées par le code du patrimoine et les autres dispositions législatives et réglementaires applicables aux archives publiques. Elles sont également assurées par le respect des normes conformes à l’état de l’art en matière d’archivage électronique.

« Un décret en Conseil d’Etat, pris après avis motivé et publié de la Commission nationale de l’informatique et des libertés, détermine dans quelles conditions et sous réserve de quelles garanties il peut être dérogé en tout ou partie aux droits prévus aux articles 15,16,18 et 21 du même règlement, en ce qui concerne les autres traitements mentionnés au premier alinéa du présent article. »

II.-Au 4° du IV de l’article L. 1461-1 du code de la santé publique, le mot : « deuxième » est remplacé par le mot : « premier ».

Article 15

A la fin de la seconde phrase de l’article L. 212-4-1 du code du patrimoine, les mots : « à fiscalité propre » sont supprimés.

Article 16

I.-Le chapitre IX de la loi n° 78-17 du 6 janvier 1978 précitée est ainsi rédigé :

« Chapitre IX.- Traitements de données à caractère personnel dans le domaine de la santé

« Section 1.- Dispositions générales

« Art. 53.-Outre aux dispositions du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité, les traitements contenant des données concernant la santé des personnes sont soumis aux dispositions du présent chapitre, à l’exception des catégories de traitements suivantes :

« 1° Les traitements relevant des 1° à 6° du II de l’article 8 ;

« 2° Les traitements permettant d’effectuer des études à partir des données recueillies en application du 6° du même II lorsque ces études sont réalisées par les personnels assurant ce suivi et destinées à leur usage exclusif ;

« 3° Les traitements mis en œuvre aux fins d’assurer le service des prestations ou le contrôle par les organismes chargés de la gestion d’un régime de base d’assurance maladie ainsi que la prise en charge des prestations par les organismes d’assurance maladie complémentaire ;

« 4° Les traitements effectués au sein des établissements de santé par les médecins responsables de l’information médicale, dans les conditions prévues au deuxième alinéa de l’article L. 6113-7 du code de la santé publique ;

« 5° Les traitements effectués par les agences régionales de santé, par l’Etat et par la personne publique qu’il désigne en application du premier alinéa de l’article L. 6113-8 du même code, dans le cadre défini au même article L. 6113-8.

« Art. 54.-I.-Les traitements relevant du présent chapitre ne peuvent être mis en œuvre qu’en considération de la finalité d’intérêt public qu’ils présentent. La garantie de normes élevées de qualité et de sécurité des soins de santé et des médicaments ou des dispositifs médicaux constitue une finalité d’intérêt public.

« II.-Des référentiels et règlements types, au sens des a bis et b du 2° du I de l’article 11, s’appliquant aux traitements relevant du présent chapitre sont établis par la Commission nationale de l’informatique et des libertés, en concertation avec l’Institut national des données de santé mentionné à l’article L. 1462-1 du code de la santé publique et des organismes publics et privés représentatifs des acteurs concernés.

« Les traitements conformes à ces référentiels peuvent être mis en œuvre à la condition que leurs responsables adressent préalablement à la Commission nationale de l’informatique et des libertés une déclaration attestant de cette conformité.

« Ces référentiels peuvent également porter sur la description et les garanties de procédure permettant la mise à disposition en vue de leur traitement de jeux de données de santé présentant un faible risque d’impact sur la vie privée.

« III.-Les traitements mentionnés au I qui ne sont pas conformes à un référentiel mentionné au II ne peuvent être mis en œuvre qu’après autorisation de la Commission nationale de l’informatique et des libertés.

« IV.-La Commission nationale de l’informatique et des libertés peut, par décision unique, délivrer à un même demandeur une autorisation pour des traitements répondant à une même finalité, portant sur des catégories de données identiques et ayant des catégories de destinataires identiques.

« V.-La Commission nationale de l’informatique et des libertés se prononce dans un délai de deux mois à compter de la réception de la demande. Toutefois, ce délai peut être prolongé une fois pour la même durée sur décision motivée de son président ou lorsque l’Institut national des données de santé est saisi en application du second alinéa de l’article 61.

« Lorsque la Commission nationale de l’informatique et des libertés ne s’est pas prononcée dans ces délais, la demande d’autorisation est réputée acceptée. Cette disposition n’est toutefois pas applicable si l’autorisation fait l’objet d’un avis préalable en application de la section 2 du présent chapitre et que l’avis ou les avis rendus ne sont pas expressément favorables.

« Art. 55.-Par dérogation à l’article 54, les traitements de données à caractère personnel dans le domaine de la santé mis en œuvre par les organismes ou les services chargés d’une mission de service public figurant sur une liste fixée par arrêté des ministres chargés de la santé et de la sécurité sociale, pris après avis de la Commission nationale de l’informatique et des libertés, ayant pour seule finalité de répondre, en cas de situation d’urgence, à une alerte sanitaire et d’en gérer les suites, au sens de la section 1 du chapitre III du titre Ier du livre IV de la première partie du code de la santé publique, sont soumis aux seules dispositions de la section 3 du chapitre IV du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité.

« Les traitements mentionnés au premier alinéa du présent article qui utilisent le numéro d’inscription des personnes au répertoire national d’identification des personnes physiques sont mis en œuvre dans les conditions prévues à l’article 22 de la présente loi.

« Les dérogations régies par le premier alinéa du présent article prennent fin un an après la création du traitement si ce dernier continue à être mis en œuvre au delà de ce délai.

« Art. 56.-Nonobstant les règles relatives au secret professionnel, les membres des professions de santé peuvent transmettre au responsable de traitement de données autorisé en application de l’article 54 les données à caractère personnel qu’ils détiennent.

« Lorsque ces données permettent l’identification des personnes, leur transmission doit être effectuée dans des conditions de nature à garantir leur confidentialité. La Commission nationale de l’informatique et des libertés peut adopter des recommandations ou des référentiels sur les procédés techniques à mettre en œuvre.

« Lorsque le résultat du traitement de données est rendu public, l’identification directe ou indirecte des personnes concernées doit être impossible.

« Les personnes appelées à mettre en œuvre le traitement de données ainsi que celles qui ont accès aux données sur lesquelles il porte sont astreintes au secret professionnel sous les peines prévues à l’article 226-13 du code pénal.

« Art. 57.-Toute personne a le droit de s’opposer à ce que des données à caractère personnel la concernant fassent l’objet de la levée du secret professionnel rendue nécessaire par un traitement de la nature de ceux mentionnés à l’article 53.

« Les informations concernant les personnes décédées, y compris celles qui figurent sur les certificats des causes de décès, peuvent faire l’objet d’un traitement de données, sauf si l’intéressé a, de son vivant, exprimé son refus par écrit.

« Art. 58.-Les personnes auprès desquelles sont recueillies des données à caractère personnel ou à propos desquelles de telles données sont transmises sont individuellement informées conformément aux dispositions du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité.

« Toutefois, ces informations peuvent ne pas être délivrées si la personne concernée a entendu faire usage du droit qui lui est reconnu par l’article L. 1111-2 du code de la santé publique d’être laissée dans l’ignorance d’un diagnostic ou d’un pronostic.

« Art. 59.-Sont destinataires de l’information et exercent les droits de la personne concernée par le traitement les titulaires de l’exercice de l’autorité parentale, pour les mineurs, ou la personne chargée d’une mission de représentation dans le cadre d’une tutelle, d’une habilitation familiale ou d’un mandat de protection future, pour les majeurs protégés dont l’état ne leur permet pas de prendre seuls une décision personnelle éclairée.

« Par dérogation au premier alinéa du présent article, pour les traitements de données à caractère personnel réalisés dans le cadre de recherches mentionnées aux 2° et 3° de l’article L. 1121-1 du code de la santé publique ou d’études ou d’évaluations dans le domaine de la santé, ayant une finalité d’intérêt public et incluant des personnes mineures, l’information peut être effectuée auprès d’un seul des titulaires de l’exercice de l’autorité parentale s’il est impossible d’informer l’autre titulaire ou s’il ne peut être consulté dans des délais compatibles avec les exigences méthodologiques propres à la réalisation de la recherche, de l’étude ou de l’évaluation au regard de ses finalités. Le présent alinéa ne fait pas obstacle à l’exercice ultérieur, par chaque titulaire de l’exercice de l’autorité parentale, des droits mentionnés au premier alinéa.

« Pour ces traitements, le mineur âgé de quinze ans ou plus peut s’opposer à ce que les titulaires de l’exercice de l’autorité parentale aient accès aux données le concernant recueillies au cours de la recherche, de l’étude ou de l’évaluation. Le mineur reçoit alors l’information et exerce seul ses droits.

« Pour ces mêmes traitements, le mineur âgé de quinze ans ou plus peut s’opposer à ce que les titulaires de l’exercice de l’autorité parentale soient informés du traitement de données si le fait d’y participer conduit à révéler une information sur une action de prévention, un dépistage, un diagnostic, un traitement ou une intervention pour laquelle le mineur s’est expressément opposé à la consultation des titulaires de l’autorité parentale, en application des articles L. 1111-5 et L. 1111-5-1 du code de la santé publique, ou si les liens de famille sont rompus et que le mineur bénéficie à titre personnel du remboursement des prestations en nature de l’assurance maladie et maternité et de la couverture complémentaire mise en place par la loi n° 99-641 du 27 juillet 1999 portant création d’une couverture maladie universelle. Il exerce alors seul ses droits.

« Art. 60.-Une information relative aux dispositions du présent chapitre doit notamment être assurée dans tout établissement ou centre où s’exercent des activités de prévention, de diagnostic et de soins donnant lieu à la transmission de données à caractère personnel en vue d’un traitement mentionné au présent chapitre.

« Section 2.- « Dispositions particulières relatives aux traitements à des fins de recherche, d’étude ou d’évaluation dans le domaine de la santé

« Art. 61.-Les traitements automatisés de données à caractère personnel dont la finalité est ou devient la recherche ou les études dans le domaine de la santé ainsi que l’évaluation ou l’analyse des pratiques ou des activités de soins ou de prévention sont soumis à la section 1 du présent chapitre, sous réserve de la présente section.

« L’Institut national des données de santé mentionné à l’article L. 1462-1 du code de la santé publique peut se saisir ou être saisi, dans des conditions définies par décret en Conseil d’Etat, par la Commission nationale de l’informatique et des libertés ou le ministre chargé de la santé sur le caractère d’intérêt public que présentent les traitements mentionnés au premier alinéa du présent article.

« Art. 62.-Au titre des référentiels mentionnés au II de l’article 54 de la présente loi, des méthodologies de référence sont homologuées et publiées par la Commission nationale de l’informatique et des libertés. Elles sont établies en concertation avec l’Institut national des données de santé mentionné à l’article L. 1462-1 du code de la santé publique et des organismes publics et privés représentatifs des acteurs concernés.

« Lorsque le traitement est conforme à une méthodologie de référence, il peut être mis en œuvre, sans autorisation mentionnée à l’article 54 de la présente loi, à la condition que son responsable adresse préalablement à la Commission nationale de l’informatique et des libertés une déclaration attestant de cette conformité.

« Art. 63.-Dans le cas où la recherche nécessite l’examen des caractéristiques génétiques, le consentement éclairé et exprès des personnes concernées doit être obtenu préalablement à la mise en œuvre du traitement de données. Le présent article n’est pas applicable aux recherches réalisées en application de l’article L. 1131-1-1 du code de la santé publique.

« Art. 64.-L’autorisation du traitement est accordée par la Commission nationale de l’informatique et des libertés dans les conditions définies à l’article 54, après avis :

« 1° Du comité compétent de protection des personnes mentionné à l’article L. 1123-6 du code de la santé publique, pour les demandes d’autorisation relatives aux recherches impliquant la personne humaine mentionnées à l’article L. 1121-1 du même code ;

« 2° Du comité d’expertise pour les recherches, les études et les évaluations dans le domaine de la santé, pour les demandes d’autorisation relatives à des études ou à des évaluations ainsi qu’à des recherches n’impliquant pas la personne humaine, au sens du 1° du présent article. Un décret en Conseil d’Etat, pris après avis de la Commission nationale de l’informatique et des libertés, fixe la composition de ce comité et définit ses règles de fonctionnement. Les membres du comité d’expertise sont soumis à l’article L. 1451-1 du code de la santé publique.

« Les dossiers présentés dans le cadre de la présente section, à l’exclusion des recherches impliquant la personne humaine, sont déposés auprès d’un secrétariat unique assuré par l’Institut national des données de santé, qui assure leur orientation vers les instances compétentes.

« Art. 65.-Dans le respect des missions et des pouvoirs de la Commission nationale de l’informatique et des libertés et aux fins de renforcer la bonne application des règles de sécurité et de protection des données, un comité d’audit du système national des données de santé est institué. Ce comité d’audit définit une stratégie d’audit puis une programmation, dont il informe la commission. Il fait réaliser des audits sur l’ensemble des systèmes réunissant, organisant ou mettant à disposition tout ou partie des données du système national des données de santé à des fins de recherche, d’étude ou d’évaluation ainsi que sur les systèmes composant le système national des données de santé.

« Le comité d’audit comprend des représentants des services des ministères chargés de la santé, de la sécurité sociale et de la solidarité, de la Caisse nationale d’assurance maladie, responsable du traitement du système national des données de santé, des autres producteurs de données du système national des données de santé, de l’Institut national des données de santé, ainsi qu’une personne représentant les acteurs privés du domaine de la santé. Des personnalités qualifiées peuvent y être désignées. Le président de la Commission nationale de l’informatique et des libertés, ou son représentant, y assiste en tant qu’observateur.

« Les audits, dont le contenu est défini par le comité d’audit, sont réalisés par des prestataires sélectionnés selon des critères et modalités permettant de disposer de garanties attestant de leur compétence en matière d’audit de systèmes d’information et de leur indépendance à l’égard de l’entité auditée.

« Le prestataire retenu soumet au président du comité d’audit la liste des personnes en charge de chaque audit et les informations permettant de garantir leurs compétences et leur indépendance.

« Les missions d’audit s’exercent sur pièces et sur place. La procédure suivie inclut une phase contradictoire. La communication des données médicales individuelles ne peut se faire que sous l’autorité et en présence d’un médecin, s’agissant des informations qui figurent dans un traitement nécessaire aux fins de la médecine préventive, de la recherche médicale, des diagnostics médicaux, de l’administration de soins ou de traitements, ou de la gestion de service de santé.

« Pour chaque mission diligentée, des échanges ont lieu, si nécessaire, entre les personnes en charge des audits, le président du comité d’audit, le responsable du traitement mentionné au II de l’article L. 1461-1 du code de la santé publique et le président de la Commission nationale de l’informatique et des libertés.

« Si le comité d’audit a connaissance d’informations de nature à révéler des manquements graves en amont ou au cours d’un audit ou en cas d’opposition ou d’obstruction à l’audit, un signalement est adressé sans délai par le président du comité d’audit au président de la Commission nationale de l’informatique et des libertés.

« Chaque mission diligentée établit un rapport relevant notamment les anomalies constatées et les manquements aux règles applicables aux systèmes d’information audités.

« Si la mission constate, à l’issue de l’audit, de graves manquements, elle en informe sans délai le président du comité d’audit, qui informe sans délai le président de la Commission nationale de l’informatique et des libertés et le responsable du traitement mentionné au II de l’article L. 1461-1 du code de la santé publique.

« En cas d’urgence, le directeur général de la Caisse nationale d’assurance maladie peut suspendre temporairement l’accès au système national des données de santé avant le terme de l’audit s’il dispose d’éléments suffisamment préoccupants concernant des manquements graves aux règles précitées. Il doit en informer immédiatement le président du comité et le président de la commission. Le rétablissement de l’accès ne peut se faire qu’avec l’accord de ce dernier au regard des mesures correctives prises par l’entité auditée. Ces dispositions sont sans préjudice des prérogatives propres de la Commission nationale de l’informatique et des libertés.

« Le rapport définitif de chaque mission est transmis au comité d’audit, au président de la Commission nationale de l’informatique et des libertés et au responsable du traitement audité.

« Un décret en Conseil d’Etat, pris après avis de la Commission nationale de l’informatique et des libertés, précise la composition du comité et définit ses règles de fonctionnement ainsi que les modalités de l’audit. »

II.-Le code de la santé publique est ainsi modifié :

1° Au 7° de l’article L. 1122-1, la référence : « 57 » est remplacée par la référence : « 58 » ;

2° Au treizième alinéa de l’article L. 1123-7, la référence : « au I de l’article 54 » est remplacée par la référence : « à l’article 61 » ;

3° Au second alinéa du IV de l’article L. 1124-1, la référence : « du II de l’article 54 » est remplacée par la référence : « de l’article 64 » ;

4° Au 6° de l’article L. 1461-7, la référence : « 56 » est remplacée par la référence : « 57 » ;

5° La seconde phrase du sixième alinéa de l’article L. 6113-7 est ainsi rédigée : « Les conditions de cette désignation et les modes d’organisation de la fonction d’information médicale, en particulier les conditions dans lesquelles des personnels placés sous l’autorité du praticien responsable ou des commissaires aux comptes intervenant au titre de la mission légale de certification des comptes mentionnée à l’article L. 6145-16 peuvent contribuer au traitement de données, sont fixés par décret. »

Article 17

La seconde phrase de l’article L. 312-9 du code de l’éducation est complétée par les mots : «, ainsi qu’aux règles applicables aux traitements de données à caractère personnel ».

Article 18

I.-L’article L. 4123-9-1 du code de la défense est ainsi rédigé :

« Art. L. 4123-9-1.-I.-Le responsable d’un traitement, automatisé ou non, ne peut traiter les données dans lesquelles figure la mention de la qualité de militaire des personnes concernées que si cette mention est strictement nécessaire à l’une des finalités du traitement.

« A l’exclusion des traitements mis en œuvre pour le compte de l’Etat, des collectivités territoriales et de leurs groupements ainsi que des associations à but non lucratif, les responsables des traitements informent le ministre compétent de la mise en œuvre de traitements comportant, dans le respect de l’obligation prévue au premier alinéa du présent I, la mention de la qualité de militaire.

« Les personnes accédant aux données à caractère personnel de militaires peuvent faire l’objet d’une enquête administrative aux seules fins d’identifier si elles constituent une menace pour la sécurité des militaires concernés. Le ministre compétent peut demander au responsable de traitement la communication de l’identité de ces personnes dans le seul but de procéder à cette enquête. Celle-ci peut comporter la consultation de traitements automatisés de données à caractère personnel relevant de l’article 26 de la loi n° 78-17 du 6 janvier 1978 relative à l’informatique, aux fichiers et aux libertés, selon les règles propres à chacun d’eux.

« Dans l’hypothèse où le ministre compétent considère, sur le fondement de l’enquête administrative, que cette menace est caractérisée, il en informe sans délai le responsable du traitement qui est alors tenu de refuser à ces personnes l’accès aux données à caractère personnel de militaires y figurant.

« II.-Sans préjudice du 1 de l’article 33 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 relatif à la protection des personnes physiques à l’égard du traitement des données à caractère personnel et à la libre circulation de ces données, et abrogeant la directive 95/46/ CE, en cas de divulgation ou d’accès non autorisé à des données des traitements mentionnés au I du présent article, le responsable du traitement avertit sans délai le ministre compétent.

« III.-Un décret en Conseil d’Etat, pris après avis de la Commission nationale de l’informatique et des libertés, détermine les conditions d’application du présent article.

« IV.-Est puni :

« 1° D’un an d’emprisonnement et de 100 000 € d’amende le manquement, y compris par négligence, à l’obligation prévue au deuxième alinéa du I du présent article ;

« 2° De trois ans d’emprisonnement et de 300 000 € d’amende le fait de permettre aux personnes mentionnées au dernier alinéa du I l’accès aux données comportant la mention de la qualité de militaire contenues dans un traitement mentionné au présent article ;

« 3° De trois ans d’emprisonnement et de 300 000 € d’amende le fait pour un responsable de traitement de ne pas procéder, y compris par négligence, à la notification mentionnée au II. »

II.-Les responsables des traitements de données à caractère personnel comportant la mention de la qualité de militaire disposent, lorsque cette mention n’est pas strictement nécessaire à l’une des finalités du traitement, d’un délai d’un an à compter de la publication de la présente loi pour procéder à sa suppression ou à son remplacement par celle de la qualité d’agent public.

III.-Le dernier alinéa de l’article 226-16 et le second alinéa de l’article 226-17-1 du code pénal sont supprimés.

IV.-Les III et IV de l’article 117 de la loi n° 2016-731 du 3 juin 2016 renforçant la lutte contre le crime organisé, le terrorisme et leur financement, et améliorant l’efficacité et les garanties de la procédure pénale sont abrogés.

Chapitre V : Dispositions particulières relatives aux droits des personnes concernées

Article 19

Au premier alinéa de l’article 7 de la loi n° 78-17 du 6 janvier 1978 précitée, après le mot : « concernée », sont insérés les mots : «, dans les conditions mentionnées au 11) de l’article 4 et à l’article 7 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité, ».

Article 20

La section 1 du chapitre II de la loi n° 78-17 du 6 janvier 1978 précitée est complétée par un article 7-1 ainsi rédigé :

« Art. 7-1.-En application du 1 de l’article 8 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité, un mineur peut consentir seul à un traitement de données à caractère personnel en ce qui concerne l’offre directe de services de la société de l’information à compter de l’âge de quinze ans.

« Lorsque le mineur est âgé de moins de quinze ans, le traitement n’est licite que si le consentement est donné conjointement par le mineur concerné et le ou les titulaires de l’autorité parentale à l’égard de ce mineur.

« Le responsable de traitement rédige en des termes clairs et simples, aisément compréhensibles par le mineur, les informations et communications relatives au traitement qui le concerne. »

Article 21

I.-L’article 10 de la loi n° 78-17 du 6 janvier 1978 précitée est ainsi rédigé :

« Art. 10.-Aucune décision de justice impliquant une appréciation sur le comportement d’une personne ne peut avoir pour fondement un traitement automatisé de données à caractère personnel destiné à évaluer certains aspects de la personnalité de cette personne.

« Aucune décision produisant des effets juridiques à l’égard d’une personne ou l’affectant de manière significative ne peut être prise sur le seul fondement d’un traitement automatisé de données à caractère personnel, y compris le profilage, à l’exception :

« 1° Des cas mentionnés aux a et c du 2 de l’article 22 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité, sous les réserves mentionnées au 3 du même article 22 et à condition que les règles définissant le traitement ainsi que les principales caractéristiques de sa mise en œuvre soient communiquées, à l’exception des secrets protégés par la loi, par le responsable de traitement à l’intéressé s’il en fait la demande ;

« 2° Des décisions administratives individuelles prises dans le respect de l’article L. 311-3-1 et du chapitre Ier du titre Ier du livre IV du code des relations entre le public et l’administration, à condition que le traitement ne porte pas sur des données mentionnées au I de l’article 8 de la présente loi. Ces décisions comportent, à peine de nullité, la mention explicite prévue à l’article L. 311-3-1 du code des relations entre le public et l’administration. Pour ces décisions, le responsable de traitement s’assure de la maîtrise du traitement algorithmique et de ses évolutions afin de pouvoir expliquer, en détail et sous une forme intelligible, à la personne concernée la manière dont le traitement a été mis en œuvre à son égard.

« Par dérogation au 2° du présent article, aucune décision par laquelle l’administration se prononce sur un recours administratif mentionné au titre Ier du livre IV du code des relations entre le public et l’administration ne peut être prise sur le seul fondement d’un traitement automatisé de données à caractère personnel. »

II.-Le comité éthique et scientifique mentionné à l’article L. 612-3 du code de l’éducation remet chaque année, à l’issue de la procédure nationale de préinscription et avant le 1er décembre, un rapport au Parlement portant sur le déroulement de cette procédure et sur les modalités d’examen des candidatures par les établissements d’enseignement supérieur. Le comité peut formuler à cette occasion toute proposition afin d’améliorer la transparence de cette procédure.

Article 22

Après l’article L. 121-4-1 du code de l’éducation, il est inséré un article L. 121-4-2 ainsi rédigé :

« Art. L. 121-4-2.-L’autorité responsable des traitements de données à caractère personnel mis en œuvre dans les établissements publics d’enseignement scolaire met à la disposition du public le registre comportant la liste de ces traitements, établi conformément aux dispositions du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 relatif à la protection des personnes physiques à l’égard du traitement des données à caractère personnel et à la libre circulation de ces données, et abrogeant la directive 95/46/ CE comportant la liste de ces traitements. »

Article 23

Le III de l’article 32 de la loi n° 78-17 du 6 janvier 1978 précitée est complété par un alinéa ainsi rédigé :

« Lorsque les données à caractère personnel sont collectées auprès d’un mineur de moins de quinze ans, le responsable de traitement transmet au mineur les informations mentionnées au I du présent article dans un langage clair et facilement accessible. »

Article 24

L’article 40 de la loi n° 78-17 du 6 janvier 1978 précitée est complété par un III ainsi rédigé :

« III.-Un décret en Conseil d’Etat, pris après avis de la Commission nationale de l’informatique et des libertés, fixe la liste des traitements et des catégories de traitements autorisés à déroger au droit à la communication d’une violation de données régi par l’article 34 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité lorsque la notification d’une divulgation ou d’un accès non autorisé à ces données est susceptible de représenter un risque pour la sécurité nationale, la défense nationale ou la sécurité publique. La dérogation prévue au présent III n’est applicable qu’aux seuls traitements de données à caractère personnel nécessaires au respect d’une obligation légale qui requiert le traitement de ces données ou à l’exercice d’une mission d’intérêt public dont est investi le responsable de traitement. »

Chapitre VI : Voies de recours

Article 25

L’article 43 ter de la loi n° 78-17 du 6 janvier 1978 précitée est ainsi modifié :

1° Au II, après les mots : « aux dispositions », sont insérés les mots : « du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité ou » ;

2° Le même II est complété par les mots : « au vu des cas individuels présentés par le demandeur, qui en informe la Commission nationale de l’informatique et des libertés » ;

3° Le III est ainsi rédigé :

« III.-Cette action peut être exercée en vue soit de faire cesser le manquement mentionné au II, soit d’engager la responsabilité de la personne ayant causé le dommage afin d’obtenir la réparation des préjudices matériels et moraux subis, soit de ces deux fins.

« Toutefois, la responsabilité de la personne ayant causé le dommage ne peut être engagée que si le fait générateur du dommage est postérieur au 24 mai 2018. » ;

4° Le IV est complété par un alinéa ainsi rédigé :

« Lorsque l’action tend à la réparation des préjudices subis, elle s’exerce dans le cadre de la procédure individuelle de réparation définie au chapitre X du titre VII du livre VII du code de justice administrative et au chapitre Ier du titre V de la loi n° 2016-1547 du 18 novembre 2016 de modernisation de la justice du XXIe siècle. »

Article 26

La section 2 du chapitre V de la loi n° 78-17 du 6 janvier 1978 précitée est complétée par un article 43 quater ainsi rédigé :

« Art. 43 quater.-Toute personne peut mandater une association ou une organisation mentionnée au IV de l’article 43 ter aux fins d’exercer en son nom les droits prévus aux articles 77 à 79 et 82 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité. Elle peut également les mandater pour agir devant la Commission nationale de l’informatique et des libertés, contre celle-ci devant un juge ou contre le responsable de traitement ou son sous-traitant devant une juridiction lorsqu’est en cause un traitement relevant du chapitre XIII de la présente loi. »

Article 27

I.-La section 2 du chapitre V de la loi n° 78-17 du 6 janvier 1978 précitée est complétée par un article 43 quinquies ainsi rédigé :

« Art. 43 quinquies.-Dans le cas où, saisie d’une réclamation dirigée contre un responsable de traitement ou son sous-traitant, la Commission nationale de l’informatique et des libertés estime fondés les griefs avancés relatifs à la protection des droits et libertés d’une personne à l’égard du traitement de ses données à caractère personnel, ou de manière générale afin d’assurer la protection de ces droits et libertés dans le cadre de sa mission, elle peut demander au Conseil d’Etat d’ordonner la suspension d’un transfert de données, le cas échéant sous astreinte, et elle assortit alors ses conclusions d’une demande de question préjudicielle à la Cour de justice de l’Union européenne en vue d’apprécier la validité de la décision d’adéquation de la Commission européenne prise sur le fondement de l’article 45 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité ainsi que de tous les actes pris par la Commission européenne relativement aux garanties appropriées dans le cadre des transferts de données mentionnées à l’article 46 du même règlement. Lorsque le transfert de données en cause ne constitue pas une opération de traitement effectuée par une juridiction dans l’exercice de sa fonction juridictionnelle, la Commission nationale de l’informatique et des libertés peut saisir dans les mêmes conditions le Conseil d’Etat aux fins d’ordonner la suspension du transfert de données fondé sur une décision d’adéquation de la Commission européenne prise sur le fondement de l’article 36 de la directive (UE) 2016/680 du Parlement européen et du Conseil du 27 avril 2016 relative à la protection des personnes physiques à l’égard du traitement des données à caractère personnel par les autorités compétentes à des fins de prévention et de détection des infractions pénales, d’enquêtes et de poursuites en la matière ou d’exécution de sanctions pénales, et à la libre circulation de ces données, et abrogeant la décision-cadre 2008/977/ JAI du Conseil dans l’attente de l’appréciation par la Cour de justice de l’Union européenne de la validité de cette décision d’adéquation. »

II.-L’article 226-22-1 du code pénal est ainsi modifié :

1° Les mots : «, hors les cas prévus par la loi, » sont supprimés ;

2° Les mots : « la Communauté européenne en violation des mesures prises par la Commission des Communautés européennes ou par la Commission nationale de l’informatique et des libertés mentionnées à l’article 70 » sont remplacés par les mots : « l’Union européenne ou à une organisation internationale en violation du chapitre V du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 relatif à la protection des personnes physiques à l’égard du traitement des données à caractère personnel et à la libre circulation de ces données, et abrogeant la directive 95/46/ CE, ou des articles 70-25 à 70-27 ».

Article 28

En application de l’article 7 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité, lorsque le traitement repose sur le consentement de la personne concernée, le responsable de traitement doit être en mesure de démontrer que les contrats qu’il conclut portant sur des équipements ou services incluant le traitement de données à caractère personnel ne font pas obstacle au consentement de l’utilisateur final dans les conditions définies au 11 de l’article 4 du même règlement.

Peut en particulier faire obstacle à ce consentement le fait de restreindre sans motif légitime d’ordre technique ou de sécurité les possibilités de choix de l’utilisateur final, notamment lors de la configuration initiale du terminal, en matière de services de communication au public en ligne et aux applications accessibles sur un terminal, présentant des offres et des conditions d’utilisation de nature équivalente selon des niveaux différenciés de protection des données personnelles.

Titre III : DISPOSITIONS PORTANT TRANSPOSITION DE LA DIRECTIVE (UE) 2016/680 DU PARLEMENT EUROPÉEN ET DU CONSEIL DU 27 AVRIL 2016 RELATIVE À LA PROTECTION DES PERSONNES PHYSIQUES À L’ÉGARD DU TRAITEMENT DES DONNÉES À CARACTÈRE PERSONNEL PAR LES AUTORITÉS COMPÉTENTES À DES FINS DE PRÉVENTION ET DE DÉTECTION DES INFRACTIONS PÉNALES, D’ENQUÊTES ET DE POURSUITES EN LA MATIÈRE OU D’EXÉCUTION DE SANCTIONS PÉNALES, ET À LA LIBRE CIRCULATION DE CES DONNÉES, ET ABROGEANT LA DÉCISION-CADRE 2008/977/JAI DU CONSEIL

Article 29

I.-Le début du V de l’article 32 de la loi n° 78-17 du 6 janvier 1978 précitée est ainsi rédigé :

« V.-Sans préjudice de l’application des dispositions du chapitre XIII, les dispositions du I ne s’appliquent pas aux données recueillies dans les conditions prévues au III et utilisées lors d’un traitement mis en œuvre pour le compte de l’Etat et intéressant la sûreté de l’Etat, la défense ou la sécurité publique, dans la … (le reste sans changement). »

II.-Le VI de l’article 32 de la loi n° 78-17 du 6 janvier 1978 précitée est abrogé.

III.-Au premier alinéa de l’article 41 de la loi n° 78-17 du 6 janvier 1978 précitée, après les mots : « sécurité publique », sont insérés les mots : «, sous réserve de l’application des dispositions du chapitre XIII ».

IV.-A l’article 42 de la loi n° 78-17 du 6 janvier 1978 précitée, les mots : « prévenir, rechercher ou constater des infractions, ou de » sont supprimés.

Article 30

Le chapitre XIII de la loi n° 78-17 du 6 janvier 1978 précitée devient le chapitre XIV et, après le chapitre XII, il est rétabli un chapitre XIII ainsi rédigé :

« Chapitre XIII .- Dispositions applicables aux traitements relevant de la directive (UE 2016/680 du Parlement européen et du Conseil du 27 avril 2016 relative à la protection des personnes physiques à l’égard du traitement des données à caractère personnel par les autorités compétentes à des fins de prévention et de détection des infractions pénales, d’enquêtes et de poursuites en la matière ou d’exécution de sanctions pénales, et à la libre circulation de ces données, et abrogeant la décision-cadre 2008/977/ JAI du Conseil

« Section 1.- Dispositions générales

« Art. 70-1.-Le présent chapitre s’applique, le cas échéant par dérogation aux autres dispositions de la présente loi, aux traitements de données à caractère personnel mis en œuvre, à des fins de prévention et de détection des infractions pénales, d’enquêtes et de poursuites en la matière ou d’exécution de sanctions pénales, y compris la protection contre les menaces pour la sécurité publique et la prévention de telles menaces, par toute autorité publique compétente ou tout autre organisme ou entité à qui a été confié, à ces mêmes fins, l’exercice de l’autorité publique et des prérogatives de puissance publique, ci-après dénommés autorité compétente.

« Ces traitements ne sont licites que si et dans la mesure où ils sont nécessaires à l’exécution d’une mission effectuée, pour l’une des finalités énoncées au premier alinéa, par une autorité compétente au sens du même premier alinéa et où sont respectées les dispositions des articles 70-3 et 70-4. Le traitement assure notamment la proportionnalité de la durée de conservation des données à caractère personnel, compte tenu de l’objet du fichier et de la nature ou de la gravité des infractions concernées.

« Pour l’application du présent chapitre, lorsque les notions utilisées ne sont pas définies au chapitre Ier de la présente loi, les définitions de l’article 4 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité sont applicables.

« Art. 70-2.-Le traitement de données mentionnées au I de l’article 8 est possible uniquement en cas de nécessité absolue, sous réserve de garanties appropriées pour les droits et libertés de la personne concernée, et soit s’il est autorisé par une disposition législative ou réglementaire, soit s’il vise à protéger les intérêts vitaux d’une personne physique, soit s’il porte sur des données manifestement rendues publiques par la personne concernée.

« Art. 70-3.-Si le traitement est mis en œuvre pour le compte de l’Etat pour au moins l’une des finalités énoncées au premier alinéa de l’article 70-1, il est prévu par une disposition législative ou réglementaire prise dans les conditions prévues au I de l’article 26 et aux articles 28 à 31.

« Si le traitement porte sur des données mentionnées au I de l’article 8, il est prévu par une disposition législative ou réglementaire prise dans les conditions prévues au II de l’article 26.

« Art. 70-4.-Si le traitement est susceptible d’engendrer un risque élevé pour les droits et les libertés des personnes physiques, notamment parce qu’il porte sur des données mentionnées au I de l’article 8, le responsable de traitement effectue une analyse d’impact relative à la protection des données à caractère personnel.

« Si le traitement est mis en œuvre pour le compte de l’Etat, cette analyse d’impact est adressée à la Commission nationale de l’informatique et des libertés avec la demande d’avis prévue à l’article 30.

« Dans les autres cas, le responsable de traitement ou son sous-traitant consulte la Commission nationale de l’informatique et des libertés préalablement à la mise en œuvre du traitement de données à caractère personnel :

« 1° Soit lorsque l’analyse d’impact relative à la protection des données indique que le traitement présenterait un risque élevé si le responsable de traitement ne prenait pas de mesures pour atténuer le risque ;

« 2° Soit lorsque le type de traitement, en particulier en raison de l’utilisation de nouveaux mécanismes, technologies ou procédures, présente des risques élevés pour les libertés et les droits des personnes concernées.

« Art. 70-5.-Les données à caractère personnel collectées par les autorités compétentes pour les finalités énoncées au premier alinéa de l’article 70-1 ne peuvent être traitées pour d’autres finalités, à moins qu’un tel traitement ne soit autorisé par des dispositions législatives ou réglementaires ou par le droit de l’Union européenne. Lorsque des données à caractère personnel sont traitées à de telles autres fins, le règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité s’applique, à moins que le traitement ne soit effectué dans le cadre d’une activité ne relevant pas du champ d’application du droit de l’Union européenne.

« Lorsque les autorités compétentes sont chargées d’exécuter des missions autres que celles exécutées pour les finalités énoncées au premier alinéa de l’article 70-1, le règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité s’applique au traitement effectué à de telles fins, y compris à des fins archivistiques dans l’intérêt public, à des fins de recherche scientifique ou historique ou à des fins statistiques, à moins que le traitement ne soit effectué dans le cadre d’une activité ne relevant pas du champ d’application du droit de l’Union européenne.

« Si le traitement est soumis à des conditions spécifiques, l’autorité compétente qui transmet les données informe le destinataire de ces données à caractère personnel de ces conditions et de l’obligation de les respecter.

« L’autorité compétente qui transmet les données n’applique pas, en vertu du troisième alinéa du présent article, aux destinataires établis dans les autres Etats membres de l’Union européenne ou aux services, organes et organismes établis en vertu des chapitres 4 et 5 du titre V du traité sur le fonctionnement de l’Union européenne des conditions différentes de celles applicables aux transferts de données similaires à l’intérieur de l’Etat membre dont relève l’autorité compétente qui transmet les données.

« Art. 70-6.-Les traitements effectués pour l’une des finalités énoncées au premier alinéa de l’article 70-1 autre que celles pour lesquelles les données ont été collectées sont autorisés s’ils sont nécessaires et proportionnés à cette finalité, sous réserve du respect des dispositions prévues au chapitre Ier et au présent chapitre.

« Ces traitements peuvent comprendre l’archivage dans l’intérêt public, à des fins scientifiques, statistiques ou historiques, pour l’une des finalités énoncées au premier alinéa de l’article 70-1.

« Art. 70-7.-Les traitements à des fins archivistiques dans l’intérêt public, à des fins de recherche scientifique ou historique ou à des fins statistiques sont mis en œuvre dans les conditions prévues à l’article 36.

« Art. 70-8.-Les données à caractère personnel fondées sur des faits sont, dans la mesure du possible, distinguées de celles fondées sur des appréciations personnelles.

« Art. 70-9.-Aucune décision de justice impliquant une appréciation sur le comportement d’une personne ne peut avoir pour fondement un traitement automatisé de données à caractère personnel destiné à évaluer certains aspects de la personnalité de cette personne.

« Aucune autre décision produisant des effets juridiques à l’égard d’une personne ou l’affectant de manière significative ne peut être prise sur le seul fondement d’un traitement automatisé de données destiné à prévoir ou à évaluer certains aspects personnels relatifs à la personne concernée.

« Tout profilage qui entraîne une discrimination à l’égard des personnes physiques sur la base des catégories particulières de données à caractère personnel mentionnées au I de l’article 8 est interdit.

« Art. 70-10.-Les données à caractère personnel ne peuvent faire l’objet d’une opération de traitement de la part d’un sous-traitant que dans les conditions prévues aux 1,2 et 10 de l’article 28 et à l’article 29 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité et au présent article.

« Les sous-traitants doivent présenter des garanties suffisantes quant à la mise en œuvre de mesures techniques et organisationnelles appropriées, de manière que le traitement réponde aux exigences du présent chapitre et garantisse la protection des droits de la personne concernée.

« Le traitement par un sous-traitant est régi par un contrat ou un autre acte juridique, qui lie le sous-traitant à l’égard du responsable de traitement, définit l’objet et la durée du traitement, la nature et la finalité du traitement, le type de données à caractère personnel et les catégories de personnes concernées, les obligations et les droits du responsable de traitement ainsi que les mesures techniques et organisationnelles destinées à garantir la sécurité du traitement, et prévoit que le sous-traitant n’agit que sur instruction du responsable de traitement. Le contenu de ce contrat ou de cet acte juridique est précisé par décret en Conseil d’Etat pris après avis de la Commission nationale de l’informatique et des libertés.

« Section 2.- « Obligations incombant aux autorités compétentes et aux responsables de traitement de données à caractère personnel

« Art. 70-11.-Les autorités compétentes prennent toutes les mesures raisonnables pour garantir que les données à caractère personnel qui sont inexactes, incomplètes ou ne sont plus à jour soient effacées ou rectifiées sans tarder ou ne soient pas transmises ou mises à disposition. A cette fin, chaque autorité compétente vérifie, dans la mesure du possible, la qualité des données à caractère personnel avant leur transmission ou mise à disposition.

« Dans la mesure du possible, lors de toute transmission de données à caractère personnel, sont ajoutées des informations permettant à l’autorité compétente destinataire de juger de l’exactitude, de l’exhaustivité et de la fiabilité des données à caractère personnel et de leur niveau de mise à jour.

« S’il s’avère que des données à caractère personnel inexactes ont été transmises ou que des données à caractère personnel ont été transmises de manière illicite, le destinataire en est informé sans retard. Dans ce cas, les données à caractère personnel sont rectifiées ou effacées ou leur traitement est limité conformément à l’article 70-20.

« Art. 70-12.-Le responsable de traitement établit, dans la mesure du possible et le cas échéant, une distinction claire entre les données à caractère personnel de différentes catégories de personnes concernées, telles que :

« 1° Les personnes à l’égard desquelles il existe des motifs sérieux de croire qu’elles ont commis ou sont sur le point de commettre une infraction pénale ;

« 2° Les personnes reconnues coupables d’une infraction pénale ;

« 3° Les victimes d’une infraction pénale ou les personnes à l’égard desquelles certains faits portent à croire qu’elles pourraient être victimes d’une infraction pénale ;

« 4° Les tiers à une infraction pénale, tels que les personnes pouvant être appelées à témoigner lors d’enquêtes en rapport avec des infractions pénales ou des procédures pénales ultérieures, des personnes pouvant fournir des informations sur des infractions pénales ou des contacts ou des associés de l’une des personnes mentionnées aux 1° et 2°.

« Art. 70-13.-I.-Afin de démontrer que le traitement est effectué conformément au présent chapitre, le responsable de traitement et son sous-traitant mettent en œuvre les mesures prévues aux 1 et 2 des articles 24 et 25 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité et celles appropriées afin de garantir un niveau de sécurité adapté au risque, notamment en ce qui concerne le traitement portant sur des catégories particulières de données à caractère personnel mentionnées au I de l’article 8 de la présente loi.

« II.-En ce qui concerne le traitement automatisé, le responsable de traitement ou son sous-traitant met en œuvre, à la suite d’une évaluation des risques, des mesures destinées à :

« 1° Empêcher toute personne non autorisée d’accéder aux installations utilisées pour le traitement ;

« 2° Empêcher que des supports de données puissent être lus, copiés, modifiés ou supprimés de façon non autorisée ;

« 3° Empêcher l’introduction non autorisée de données à caractère personnel dans le fichier, ainsi que l’inspection, la modification ou l’effacement non autorisé de données à caractère personnel enregistrées ;

« 4° Empêcher que les systèmes de traitement automatisé puissent être utilisés par des personnes qui n’y sont pas autorisées à l’aide d’installations de transmission de données ;

« 5° Garantir que les personnes autorisées à utiliser un système de traitement automatisé ne puissent accéder qu’aux données à caractère personnel sur lesquelles porte leur autorisation ;

« 6° Garantir qu’il puisse être vérifié et constaté à quelles instances des données à caractère personnel ont été ou peuvent être transmises ou mises à disposition par des installations de transmission de données ;

« 7° Garantir qu’il puisse être vérifié et constaté a posteriori quelles données à caractère personnel ont été introduites dans les systèmes de traitement automatisé et à quel moment et par quelle personne elles y ont été introduites ;

« 8° Empêcher que, lors de la transmission de données à caractère personnel ainsi que lors du transport de supports de données, les données puissent être lues, copiées, modifiées ou supprimées de façon non autorisée ;

« 9° Garantir que les systèmes installés puissent être rétablis en cas d’interruption ;

« 10° Garantir que les fonctions du système opèrent, que les erreurs de fonctionnement soient signalées et que les données à caractère personnel conservées ne puissent pas être corrompues par un dysfonctionnement du système.

« Art. 70-14.-Le responsable de traitement et son sous-traitant tiennent un registre des activités de traitement dans les conditions prévues aux 1 à 4 de l’article 30 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité. Ce registre contient aussi la description générale des mesures visant à garantir un niveau de sécurité adapté au risque, notamment en ce qui concerne le traitement portant sur des catégories particulières de données à caractère personnel mentionnées au I de l’article 8 de la présente loi, l’indication de la base juridique de l’opération de traitement, y compris les transferts, à laquelle les données à caractère personnel sont destinées et, le cas échéant, le recours au profilage.

« Art. 70-15.-Le responsable de traitement ou son sous-traitant établit pour chaque traitement automatisé un journal des opérations de collecte, de modification, de consultation et de communication, y compris les transferts, l’interconnexion et l’effacement, portant sur de telles données.

« Les journaux des opérations de consultation et de communication permettent d’en établir le motif, la date et l’heure. Ils permettent également, dans la mesure du possible, d’identifier les personnes qui consultent ou communiquent les données et les destinataires de celles-ci.

« Ce journal est uniquement utilisé à des fins de vérification de la licéité du traitement, d’autocontrôle, de garantie de l’intégrité et de la sécurité des données et à des fins de procédures pénales.

« Ce journal est mis à la disposition de la Commission nationale de l’informatique et des libertés à sa demande.

« Art. 70-16.-Les articles 31,33 et 34 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité sont applicables aux traitements de données à caractère personnel relevant du présent chapitre.

« Si la violation de données à caractère personnel porte sur des données à caractère personnel qui ont été transmises par le responsable de traitement établi dans un autre Etat membre de l’Union européenne ou à celui-ci, le responsable de traitement établi en France notifie également la violation au responsable de traitement de l’autre Etat membre dans les meilleurs délais.

« La communication d’une violation de données à caractère personnel à la personne concernée peut être retardée, limitée ou ne pas être délivrée dès lors et aussi longtemps qu’une mesure de cette nature constitue une mesure nécessaire et proportionnée dans une société démocratique, en tenant compte des droits fondamentaux et des intérêts légitimes de la personne, pour éviter de gêner des enquêtes, des recherches ou des procédures administratives ou judiciaires, pour éviter de nuire à la prévention ou à la détection d’infractions pénales, aux enquêtes ou aux poursuites en la matière ou à l’exécution de sanctions pénales, pour protéger la sécurité publique, pour protéger la sécurité nationale ou pour protéger les droits et libertés d’autrui.

« Art. 70-17.-Sauf pour les juridictions agissant dans l’exercice de leur fonction juridictionnelle, le responsable de traitement désigne un délégué à la protection des données.

« Un seul délégué à la protection des données peut être désigné pour plusieurs autorités compétentes, en fonction de leur structure organisationnelle et de leur taille.

« Les dispositions des 5 et 7 de l’article 37, des 1 et 2 de l’article 38 et du 1 de l’article 39 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité, en ce qu’elles concernent le responsable de traitement, sont applicables aux traitements de données à caractère personnel relevant du présent chapitre.

« Section 3.-Droits de la personne concernée par un traitement de données à caractère personnel

« Art. 70-18.-I.-Le responsable de traitement met à la disposition de la personne concernée les informations suivantes :

« 1° L’identité et les coordonnées du responsable de traitement et, le cas échéant, celles de son représentant ;

« 2° Le cas échéant, les coordonnées du délégué à la protection des données ;

« 3° Les finalités poursuivies par le traitement auquel les données sont destinées ;

« 4° Le droit d’introduire une réclamation auprès de la Commission nationale de l’informatique et des libertés et les coordonnées de la commission ;

« 5° L’existence du droit de demander au responsable de traitement l’accès aux données à caractère personnel, leur rectification ou leur effacement, et l’existence du droit de demander une limitation du traitement des données à caractère personnel relatives à une personne concernée.

« II.-En plus des informations mentionnées au I, le responsable de traitement fournit à la personne concernée, dans des cas particuliers, les informations additionnelles suivantes afin de lui permettre d’exercer ses droits :

« 1° La base juridique du traitement ;

« 2° La durée de conservation des données à caractère personnel ou, à défaut lorsque ce n’est pas possible, les critères utilisés pour déterminer cette durée ;

« 3° Le cas échéant, les catégories de destinataires des données à caractère personnel, y compris ceux établis dans les Etats n’appartenant pas à l’Union européenne ou au sein d’organisations internationales ;

« 4° Au besoin, des informations complémentaires, en particulier lorsque les données à caractère personnel sont collectées à l’insu de la personne concernée.

« Art. 70-19.-La personne concernée a le droit d’obtenir du responsable de traitement la confirmation que des données à caractère personnel la concernant sont ou ne sont pas traitées et, lorsqu’elles le sont, le droit d’accéder auxdites données ainsi qu’aux informations suivantes :

« 1° Les finalités du traitement ainsi que sa base juridique ;

« 2° Les catégories de données à caractère personnel concernées ;

« 3° Les destinataires ou catégories de destinataires auxquels les données à caractère personnel ont été communiquées, en particulier les destinataires qui sont établis dans des Etats n’appartenant pas à l’Union européenne ou au sein d’organisations internationales ;

« 4° Lorsque cela est possible, la durée de conservation des données à caractère personnel envisagée ou, à défaut lorsque ce n’est pas possible, les critères utilisés pour déterminer cette durée ;

« 5° L’existence du droit de demander au responsable de traitement la rectification ou l’effacement des données à caractère personnel, et l’existence du droit de demander une limitation du traitement de ces données ;

« 6° Le droit d’introduire une réclamation auprès de la Commission nationale de l’informatique et des libertés et les coordonnées de la commission ;

« 7° La communication des données à caractère personnel en cours de traitement ainsi que toute information disponible quant à leur source.

« Art. 70-20.-I.-La personne concernée a le droit d’obtenir du responsable de traitement :

« 1° Que soient rectifiées dans les meilleurs délais des données à caractère personnel la concernant qui sont inexactes ;

« 2° Que soient complétées des données à caractère personnel la concernant incomplètes, y compris en fournissant à cet effet une déclaration complémentaire ;

« 3° Que soient effacées dans les meilleurs délais des données à caractère personnel la concernant lorsque le traitement est réalisé en violation des dispositions de la présente loi ou lorsque ces données doivent être effacées pour respecter une obligation légale à laquelle est soumis le responsable de traitement.

« II.-Lorsque l’intéressé en fait la demande, le responsable de traitement doit justifier qu’il a procédé aux opérations exigées en application du I.

« III.-Au lieu de procéder à l’effacement, le responsable de traitement limite le traitement :

« 1° Soit lorsque l’exactitude des données à caractère personnel est contestée par la personne concernée sans qu’il soit possible de déterminer si les données sont exactes ou non ;

« 2° Soit lorsque les données à caractère personnel doivent être conservées à des fins probatoires.

« Lorsque le traitement est limité en application du 1° du présent III, le responsable de traitement informe la personne concernée avant de mettre fin à la limitation du traitement.

« IV.-Le responsable de traitement informe la personne concernée de tout refus de rectifier ou d’effacer des données à caractère personnel ou de limiter le traitement de ces données, ainsi que des motifs du refus.

« V.-Le responsable de traitement communique la rectification des données à caractère personnel inexactes à l’autorité compétente de laquelle ces données proviennent.

« VI.-Lorsque des données à caractère personnel ont été rectifiées ou effacées ou que le traitement a été limité au titre des I et III, le responsable de traitement le notifie aux destinataires afin que ceux-ci rectifient ou effacent les données ou limitent le traitement des données sous leur responsabilité.

« Art. 70-21.-I.-Les droits de la personne physique concernée peuvent faire l’objet de restrictions selon les modalités prévues au II du présent article dès lors et aussi longtemps qu’une telle restriction constitue une mesure nécessaire et proportionnée dans une société démocratique en tenant compte des droits fondamentaux et des intérêts légitimes de la personne pour :

« 1° Eviter de gêner des enquêtes, des recherches ou des procédures administratives ou judiciaires ;

« 2° Eviter de nuire à la prévention ou à la détection d’infractions pénales, aux enquêtes ou aux poursuites en la matière ou à l’exécution de sanctions pénales ;

« 3° Protéger la sécurité publique ;

« 4° Protéger la sécurité nationale ;

« 5° Protéger les droits et libertés d’autrui.

« Ces restrictions sont prévues par l’acte instaurant le traitement.

« II.-Lorsque les conditions prévues au I sont remplies, le responsable de traitement peut :

« 1° Retarder ou limiter la communication à la personne concernée des informations mentionnées au II de l’article 70-18 ou ne pas communiquer ces informations ;

« 2° Refuser ou limiter le droit d’accès de la personne concernée prévu à l’article 70-19 ;

« 3° Ne pas informer la personne du refus de rectifier ou d’effacer des données à caractère personnel ou de limiter le traitement de ces données, ni des motifs de cette décision, par dérogation au IV de l’article 70-20.

« III.-Dans les cas mentionnés au 2° du II du présent article, le responsable de traitement informe la personne concernée, dans les meilleurs délais, de tout refus ou de toute limitation d’accès ainsi que des motifs du refus ou de la limitation. Ces informations peuvent ne pas être fournies lorsque leur communication risque de compromettre l’un des objectifs énoncés au I. Le responsable de traitement consigne les motifs de fait ou de droit sur lesquels se fonde la décision et met ces informations à la disposition de la Commission nationale de l’informatique et des libertés.

« IV.-En cas de restriction des droits de la personne concernée intervenue en application des II ou III, le responsable de traitement informe la personne concernée de la possibilité d’exercer ses droits par l’intermédiaire de la Commission nationale de l’informatique et des libertés. Hors le cas prévu au 1° du II, il l’informe également de la possibilité de former un recours juridictionnel.

« Art. 70-22.-En cas de restriction des droits de la personne concernée intervenue en application des II ou III de l’article 70-21, la personne concernée peut saisir la Commission nationale de l’informatique et des libertés.

« Les deuxième et troisième alinéas de l’article 41 sont alors applicables.

« Lorsque la commission informe la personne concernée qu’il a été procédé aux vérifications nécessaires, elle l’informe également de son droit de former un recours juridictionnel.

« Art. 70-23.-I.-Les informations mentionnées aux articles 70-18 à 70-20 sont fournies par le responsable de traitement à la personne concernée par tout moyen approprié, y compris par voie électronique et, de manière générale, sous la même forme que la demande.

« II.-Aucun paiement n’est exigé pour prendre les mesures et fournir ces mêmes informations, sauf en cas de demande manifestement infondée ou abusive.

« En cas de demande manifestement infondée ou abusive, le responsable de traitement peut également refuser de donner suite à la demande.

« En cas de contestation, la charge de la preuve du caractère manifestement infondé ou abusif des demandes incombe au responsable de traitement auquel elles sont adressées.

« Art. 70-24.-Les dispositions de la présente section ne s’appliquent pas lorsque les données à caractère personnel figurent soit dans une décision judiciaire, soit dans un dossier judiciaire faisant l’objet d’un traitement lors d’une procédure pénale. Dans ces cas, l’accès à ces données et les conditions de rectification ou d’effacement de ces données ne peuvent être régis que par les dispositions du code de procédure pénale.

« Section 4.- Transferts de données à caractère personnel vers des Etats n’appartenant pas à l’Union européenne ou vers des destinataires établis dans des Etats n’appartenant pas à l’Union européenne

« Art. 70-25.-Le responsable de traitement de données à caractère personnel ne peut transférer des données ou autoriser le transfert de données déjà transmises vers un Etat n’appartenant pas à l’Union européenne que lorsque les conditions suivantes sont respectées :

« 1° Le transfert de ces données est nécessaire à l’une des finalités énoncées au premier alinéa de l’article 70-1 ;

« 2° Les données à caractère personnel sont transférées à un responsable établi dans cet Etat n’appartenant pas à l’Union européenne ou au sein d’une organisation internationale qui est une autorité compétente chargée des fins relevant en France du premier alinéa de l’article 70-1 ;

« 3° Si les données à caractère personnel proviennent d’un autre Etat, l’Etat qui a transmis ces données a préalablement autorisé ce transfert conformément à son droit national.

« Toutefois, si l’autorisation préalable ne peut pas être obtenue en temps utile, ces données à caractère personnel peuvent être transmises à nouveau sans l’autorisation préalable de l’Etat qui a transmis ces données lorsque cette nouvelle transmission est nécessaire à la prévention d’une menace grave et immédiate pour la sécurité publique d’un autre Etat ou pour la sauvegarde des intérêts essentiels de la France. L’autorité dont provenaient ces données personnelles en est informée sans retard ;

« 4° La Commission européenne a adopté une décision d’adéquation en application de l’article 36 de la directive (UE) 2016/680 du Parlement européen et du Conseil du 27 avril 2016 précitée ou, en l’absence d’une telle décision, un instrument juridiquement contraignant fournit des garanties appropriées en ce qui concerne la protection des données à caractère personnel ou, en l’absence d’une telle décision et d’un tel instrument, le responsable de traitement a évalué toutes les circonstances du transfert et estime qu’il existe de telles garanties appropriées.

« Les garanties appropriées fournies par un instrument juridique contraignant mentionnées au 4° peuvent résulter soit des garanties relatives à la protection des données mentionnées dans les conventions mises en œuvre avec cet Etat n’appartenant pas à l’Union européenne, soit de dispositions juridiquement contraignantes exigées à l’occasion de l’échange de données.

« Lorsque le responsable de traitement autre qu’une juridiction effectuant une activité de traitement dans le cadre de ses activités juridictionnelles transfère des données à caractère personnel sur le seul fondement de l’existence de garanties appropriées au regard de la protection des données à caractère personnel, il avise la Commission nationale de l’informatique et des libertés des catégories de transferts relevant de ce fondement.

« Dans ce cas, le responsable de traitement doit garder trace de la date et de l’heure du transfert, des informations sur l’autorité compétente destinataire, de la justification du transfert et des données à caractère personnel transférées. Ces informations sont mises à la disposition de la Commission nationale de l’informatique et des libertés à sa demande.

« Lorsque la Commission européenne a abrogé, modifié ou suspendu une décision d’adéquation adoptée en application de l’article 36 de la directive (UE) 2016/680 du Parlement européen et du Conseil du 27 avril 2016 précitée, le responsable de traitement peut néanmoins transférer des données à caractère personnel ou autoriser le transfert de données déjà transmises vers un Etat n’appartenant pas à l’Union européenne si des garanties appropriées en ce qui concerne la protection des données à caractère personnel sont fournies dans un instrument juridiquement contraignant ou si ce responsable estime, après avoir évalué toutes les circonstances du transfert, qu’il existe des garanties appropriées au regard de la protection des données à caractère personnel.

« Art. 70-26.-Par dérogation à l’article 70-25, le responsable de traitement de données à caractère personnel ne peut, en l’absence de décision d’adéquation ou de garanties appropriées, transférer ces données ou autoriser le transfert de données déjà transmises vers un Etat n’appartenant pas à l’Union européenne que lorsque le transfert est nécessaire :

« 1° A la sauvegarde des intérêts vitaux de la personne concernée ou d’une autre personne ;

« 2° A la sauvegarde des intérêts légitimes de la personne concernée lorsque le droit français le prévoit ;

« 3° Pour prévenir une menace grave et immédiate pour la sécurité publique d’un autre Etat ;

« 4° Dans des cas particuliers, à l’une des finalités énoncées au premier alinéa de l’article 70-1 ;

« 5° Dans un cas particulier, à la constatation, à l’exercice ou à la défense de droits en justice en rapport avec les mêmes fins.

« Dans les cas mentionnés aux 4° et 5° du présent article, le responsable de traitement de données à caractère personnel ne transfère pas ces données s’il estime que les libertés et droits fondamentaux de la personne concernée l’emportent sur l’intérêt public dans le cadre du transfert envisagé.

« Lorsqu’un transfert est effectué aux fins de la sauvegarde des intérêts légitimes de la personne concernée, le responsable de traitement garde trace de la date et de l’heure du transfert, des informations sur l’autorité compétente destinataire, de la justification du transfert et des données à caractère personnel transférées. Il met ces informations à la disposition de la Commission nationale de l’informatique et des libertés à sa demande.

« Art. 70-27.-Toute autorité publique compétente mentionnée au premier alinéa de l’article 70-1 peut, dans certains cas particuliers, transférer des données à caractère personnel directement à des destinataires établis dans un Etat n’appartenant pas à l’Union européenne lorsque les autres dispositions de la présente loi applicables aux traitements relevant du même article 70-1 sont respectées et que les conditions ci-après sont remplies :

« 1° Le transfert est nécessaire à l’exécution de la mission de l’autorité compétente qui transfère ces données pour l’une des finalités énoncées au premier alinéa dudit article 70-1 ;

« 2° L’autorité compétente qui transfère ces données établit qu’il n’existe pas de libertés ni de droits fondamentaux de la personne concernée qui prévalent sur l’intérêt public rendant nécessaire le transfert dans le cas considéré ;

« 3° L’autorité compétente qui transfère ces données estime que le transfert à l’autorité compétente de l’autre Etat est inefficace ou inapproprié, notamment parce que le transfert ne peut pas être effectué en temps opportun ;

« 4° L’autorité compétente de l’autre Etat est informée dans les meilleurs délais, à moins que cela ne soit inefficace ou inapproprié ;

« 5° L’autorité compétente qui transfère ces données informe le destinataire de la finalité ou des finalités pour lesquelles les données à caractère personnel transmises doivent exclusivement faire l’objet d’un traitement par ce destinataire, à condition qu’un tel traitement soit nécessaire.

« L’autorité compétente qui transfère des données informe la Commission nationale de l’informatique et des libertés des transferts répondant aux conditions prévues au présent article.

« L’autorité compétente garde trace de la date et de l’heure de ce transfert, des informations sur le destinataire, de la justification du transfert et des données à caractère personnel transférées. »

Titre IV : DISPOSITIONS VISANT À FACILITER L’APPLICATION DES RÈGLES RELATIVES À LA PROTECTION DES DONNÉES À CARACTÈRE PERSONNEL PAR LES COLLECTIVITÉS TERRITORIALES

Article 31

Sans préjudice du dernier alinéa de l’article L. 5111-1 du code général des collectivités territoriales, peuvent être conclues entre les collectivités territoriales et leurs groupements des conventions ayant pour objet la réalisation de prestations de service liées au traitement de données à caractère personnel.

Les collectivités territoriales et leurs groupements peuvent se doter d’un service unifié ayant pour objet d’assumer en commun les charges et obligations liées au traitement de données à caractère personnel.

Article 32

I. ans les conditions prévues à l’article 38 de la Constitution et dans le respect des dispositions prévues aux titres Ier à III de la présente loi et au présent titre, le Gouvernement est autorisé à prendre par voie d’ordonnance les mesures relevant du domaine de la loi nécessaires :

1° A la réécriture de l’ensemble de la loi n° 78-17 du 6 janvier 1978 relative à l’informatique, aux fichiers et aux libertés afin d’apporter les corrections formelles et les adaptations nécessaires à la simplification et à la cohérence ainsi qu’à la simplicité de la mise en œuvre par les personnes concernées des dispositions qui mettent le droit national en conformité avec le règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 relatif à la protection des personnes physiques à l’égard du traitement des données à caractère personnel et à la libre circulation de ces données, et abrogeant la directive 95/46/CE et transposent la directive (UE) 2016/680 du Parlement européen et du Conseil du 27 avril 2016 relative à la protection des personnes physiques à l’égard du traitement des données à caractère personnel par les autorités compétentes à des fins de prévention et de détection des infractions pénales, d’enquêtes et de poursuites en la matière ou d’exécution de sanctions pénales, et à la libre circulation de ces données, et abrogeant la décision-cadre 2008/977/JAI du Conseil, telles que résultant de la présente loi ;

2° Pour mettre en cohérence avec ces changements l’ensemble de la législation applicable à la protection des données à caractère personnel, apporter les modifications qui seraient rendues nécessaires pour assurer le respect de la hiérarchie des normes et la cohérence rédactionnelle des textes, harmoniser l’état du droit, remédier aux éventuelles erreurs et omissions résultant de la présente loi et abroger les dispositions devenues sans objet ;

3° A l’adaptation et à l’extension à l’outre-mer des dispositions prévues aux 1° et 2° ainsi qu’à l’application à Saint-Barthélemy, à Saint-Pierre-et-Miquelon, en Nouvelle-Calédonie, en Polynésie française, à Wallis-et-Futuna et dans les Terres australes et antarctiques françaises de l’ensemble des dispositions de la loi n° 78-17 du 6 janvier 1978 précitée relevant de la compétence de l’Etat.

II.- Cette ordonnance est prise, après avis de la Commission nationale de l’informatique et des libertés, dans un délai de six mois à compter de la promulgation de la présente loi.

III. – Un projet de loi de ratification est déposé devant le Parlement dans un délai de six mois à compter de la publication de l’ordonnance.

Article 33

I.-Le livre II du code de la consommation, dans sa rédaction résultant de l’article 48 de la loi n° 2016-1321 du 7 octobre 2016 pour une République numérique, est ainsi modifié :

1° La sous-section 4 de la section 3 du chapitre IV du titre II est abrogée ;

2° Au premier alinéa de l’article L. 242-20, la référence : « L. 224-42-3, » est supprimée.

II.-Le II de l’article 48 de la loi n° 2016-1321 du 7 octobre 2016 pour une République numérique est abrogé.

Titre V : DISPOSITIONS DIVERSES ET FINALES

Article 34

La loi n° 78-17 du 6 janvier 1978 relative à l’informatique, aux fichiers et aux libertés est ainsi modifiée :

1° Au second alinéa du II de l’article 13, après la référence : « 3° », est insérée la référence : « du I » ;

2° L’article 15 est ainsi modifié :

a) Le quatrième alinéa est supprimé ;
b) Aux cinquième et sixième alinéas, après la référence : « 2° », est insérée la référence : « du I » ;
c) Au septième alinéa, après la référence : « 4° », est insérée la référence : « du I » ;
d) Le dernier alinéa est supprimé ;

3° Les troisième et dernier alinéas de l’article 16 sont supprimés ;

4° Au second alinéa de l’article 17, après la référence : « 2° », est insérée la référence : « du I » ;

5° Au second alinéa de l’article 21, après la référence : « 2° », est insérée la référence : « du I » ;

6° Au premier alinéa de l’article 29, la référence : « 25, » est supprimée ;

7° Le I de l’article 30 est ainsi modifié :

a) Au premier alinéa, le mot : « déclarations, » est supprimé ;

b) Aux 2° et 6°, la référence : « 25, » est supprimée ;

8° Le I de l’article 31 est ainsi modifié :

a) Au premier alinéa, la référence : « 23 à » est remplacée par la référence : « 26 et » ;

b) A la fin du 1°, les mots : « ou la date de la déclaration de ce traitement » sont supprimés ;

9° A la seconde phrase du second alinéa du II de l’article 39, les mots : « ou dans la déclaration » sont supprimés ;

10° A l’article 42, la référence : « 25, » est supprimée ;

11° L’article 67 est ainsi modifié :

a) Au premier alinéa, les références : « 22, les 1° et 3° du I de l’article 25, les articles » sont supprimées ;

b) Le quatrième alinéa est supprimé ;

c) La seconde phrase de l’avant-dernier alinéa est supprimée ;

12° L’article 70 est abrogé ;

13° La seconde phrase de l’article 71 est supprimée.

Article 35

– Pour les traitements ayant fait l’objet de formalités antérieurement au 25 mai 2018, la liste mentionnée à l’article 31 de la loi n° 78-17 du 6 janvier 1978 précitée, arrêtée à cette date, est mise à la disposition du public, dans un format ouvert et aisément réutilisable pour une durée de dix ans.
– Par dérogation au premier alinéa de l’article 22 de la loi n° 78-17 du 6 janvier 1978 relative à l’informatique, aux fichiers et aux libertés, la mise en œuvre des traitements comportant le numéro d’inscription des personnes au répertoire national d’identification des personnes physiques qui ont été autorisés avant le 25 mai 2018 en application des articles 25 et 27 de la même loi, dans leur rédaction antérieure à la présente loi, ne sont pas soumis à l’obligation d’être mentionnés dans le décret prévu au premier alinéa de l’article 22 de la loi n° 78-17 du 6 janvier 1978 précitée, sauf modification de ces traitements et au plus tard jusqu’au 25 mai 2020. Ces traitements restent soumis à l’ensemble des autres obligations découlant de la même loi et du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 relatif à la protection des personnes physiques à l’égard du traitement des données à caractère personnel et à la libre circulation de ces données, et abrogeant la directive 95/46/CE.

Article 36

I.-L’article 230-8 du code de procédure pénale est ainsi rédigé :

« Art. 230-8.-Le traitement des données à caractère personnel est opéré sous le contrôle du procureur de la République territorialement compétent, qui, d’office ou à la demande de la personne concernée, ordonne qu’elles soient effacées, complétées ou rectifiées, notamment en cas de requalification judiciaire, ou qu’elles fassent l’objet d’une mention. La rectification pour requalification judiciaire est de droit. Le procureur de la République se prononce dans un délai de deux mois sur les suites qu’il convient de donner aux demandes qui lui sont adressées. La personne concernée peut former cette demande sans délai à la suite d’une décision devenue définitive de relaxe, d’acquittement, de condamnation avec dispense de peine ou dispense de mention au casier judiciaire, de non-lieu ou de classement sans suite. Dans les autres cas, la personne ne peut former sa demande, à peine d’irrecevabilité, que lorsque ne figure plus aucune mention de nature pénale dans le bulletin n° 2 de son casier judiciaire. En cas de décision de relaxe ou d’acquittement devenue définitive, les données personnelles concernant les personnes mises en cause sont effacées, sauf si le procureur de la République en prescrit le maintien, auquel cas elles font l’objet d’une mention. Lorsque le procureur de la République prescrit le maintien des données personnelles relatives à une personne ayant bénéficié d’une décision de relaxe ou d’acquittement devenue définitive, il en avise la personne concernée. En cas de décision de non-lieu ou de classement sans suite, les données personnelles concernant les personnes mises en cause font l’objet d’une mention, sauf si le procureur de la République ordonne l’effacement des données personnelles. Lorsque les données personnelles relatives à la personne concernée font l’objet d’une mention, elles ne peuvent faire l’objet d’une consultation dans le cadre des enquêtes administratives prévues aux articles L. 114-1 et L. 234-1 à L. 234-3 du code de la sécurité intérieure et à l’article 17-1 de la loi n° 95-73 du 21 janvier 1995 d’orientation et de programmation relative à la sécurité. Les décisions du procureur de la République prévues au présent alinéa ordonnant le maintien ou l’effacement des données personnelles ou ordonnant qu’elles fassent l’objet d’une mention sont prises pour des raisons liées à la finalité du fichier au regard de la nature ou des circonstances de commission de l’infraction ou de la personnalité de l’intéressé.

« Les décisions d’effacement ou de rectification des informations nominatives prises par le procureur de la République sont portées à la connaissance des responsables de tous les traitements automatisés pour lesquels, sous réserve des règles d’effacement ou de rectification qui leur sont propres, ces mesures ont des conséquences sur la durée de conservation des données personnelles.

« Les décisions du procureur de la République sont susceptibles de recours devant le président de la chambre de l’instruction.

« Le procureur de la République dispose pour l’exercice de ses fonctions d’un accès direct aux traitements automatisés de données à caractère personnel mentionnés à l’article 230-6. »

II.-A la dernière phrase du deuxième alinéa de l’article 230-9 du code de procédure pénale, les mots : « d’un » sont remplacés par les mots : « de deux ».

III.-Le premier alinéa de l’article 804 du code de procédure pénale est ainsi rédigé :

« Le présent code est applicable, dans sa rédaction résultant de loi n° 2018-493 du 20 juin 2018 relative à la protection des données personnelles, en Nouvelle-Calédonie, en Polynésie française et dans les îles Wallis et Futuna, sous réserve des adaptations prévues au présent titre et aux seules exceptions : ».

Article 37

Les titres Ier à III et les articles 34 et 35 entrent en vigueur le 25 mai 2018.

Toutefois, l’article 70-15 de la loi n° 78-17 du 6 janvier 1978 précitée entre en vigueur à une date fixée par décret, et au plus tard :

1° Le 6 mai 2023 lorsqu’une telle obligation exigerait des efforts disproportionnés ;

2° Le 6 mai 2026 lorsque, à défaut d’un tel report, il en résulterait de graves difficultés pour le fonctionnement du système de traitement automatisé.

La liste des traitements concernés par ces reports et les dates auxquelles, pour ces traitements, l’entrée en vigueur de cette obligation est reportée sont déterminées par voie réglementaire.

La seconde phrase du 2° de l’article 10 de la loi n° 78-17 du 6 janvier 1978 précitée, dans sa rédaction résultant de l’article 21 de la présente loi, entre en vigueur le 1er juillet 2020.

L’article 22 entre en vigueur à compter de la rentrée de l’année scolaire 2018-2019.

La présente loi sera exécutée comme loi de l’Etat.

Fait à Paris, le 20 juin 2018.

Emmanuel Macron

Par le Président de la République :

Le Premier ministre, Edouard Philippe

Le ministre d’Etat, ministre de l’intérieur, Gérard Collomb

La garde des sceaux, ministre de la justice, Nicole Belloubet

Le ministre de l’Europe et des affaires étrangères, Jean-Yves Le Drian

La ministre des armées, Florence Parly

Le ministre de la cohésion des territoires, Jacques Mézard

La ministre des solidarités et de la santé, Agnès Buzyn

Le ministre de l’économie et des finances, Bruno Le Maire

La ministre de la culture, Françoise Nyssen

Le ministre de l’éducation nationale, Jean-Michel Blanquer

La ministre de l’enseignement supérieur, de la recherche et de l’innovation, Frédérique Vidal

La ministre auprès du ministre de l’Europe et des affaires étrangères, chargée des affaires européennes, Nathalie Loiseau

Le secrétaire d’Etat auprès du Premier ministre, chargé du numérique, Mounir Mahjoubi

06Jul/18

Lei Constitucional nº 1/V/99 de 23 de Novembro with Amendments in: 2010 (Lei Constitucional nº 1/VII/2010 de 3 de Mai)

6 julio, 2018Cabo Verde, ConstituciónCape Verde's Constitution of 1999 (Lei Constitucional nº 1/V/99 de 23 de Novembro) with Amendments in: 2010 (Lei Constitucional nº 1/VII/2010 de 3 de Mai) (Official Bulletin (B.O.) Supplement, Derecho Informático, I Série, I Serie nº 17 of 3 May 2010, Legislacion de Cabo Verde, Legislation Cape Verde, Rectified by the B.O. nº 28 of 26 July 2010José Cuervo

Cape Verde’s Constitution of 1999 (Lei Constitucional nº 1/V/99 de 23 de Novembro) with Amendments in: 2010 (Lei Constitucional nº 1/VII/2010 de 3 de Mai) (Official Bulletin (B.O.) Supplement, I Serie nº 17 of 3 May 2010, Rectified by the B.O. nº 28 of 26 July 2010, I Serie).

PART II.- FUNDAMENTAL RIGHTS AND DUTIES

TITLE I.- GENERAL PRINCIPLES

Article 15 (Recognition of the inviolability of rights, liberties and guarantees)

The State shall recognize as inviolable the rights and liberties enshrined in the Constitution and shall guarantee their protection.
All public authorities shall have the duty to respect and to guarantee the free exercise of rights and liberties and the fulfillment of constitutional or legal duties.

TITLE II.- RIGHTS, LIBERTIES AND GUARANTEES

CHAPTER I.- ON INDIVIDUAL RIGHTS, LIBERTIES AND GUARANTEES

Article 29.- (Right to freedom)

The right to freedom shall be inviolable.
Personal freedoms, of thought, of expression, and of information, of association, of religion, of worship, of intellectual, artistic and cultural creation, of demonstration and the remaining freedoms enshrined in the Constitution, in general or conventional international law, received in the domestic legal order, and in the laws, shall be guaranteed.
No one may be forced to declare his or her ideology, religion or cult, political or trade union affiliation.

Article 41 (The right to identity, to personality, to a good name, to an image and to privacy)

Everyone shall be guaranteed the rights to personal identity, to the development of his or her personality and to civil capacity, which may only be limited by judicial decision and in cases and under terms established in the law.
Every citizen shall have the right to a good name, to honor and reputation, to an image and privacy in his or her personal and family life.

Article 44 (Inviolability of correspondence and telecommunications)

The secrecy of correspondence and of telecommunications shall be guaranteed, except in cases in which, by judicial decision rendered under the law of criminal proceedings, interference, by public authorities, with correspondence and telecommunications is allowed.

Article 45 (Use of computer resources and protection of personal data)

1. All citizens shall have the right of access to computerized data relating to them, and may demand the correctin and updating thereof. They shall also have the right to know the purposes for which the data will be used, under the terms of the law.

2. The use of computerized media shall be prohibited for the logging and processing of individually identifiable data related to political, philosophical or ideological convictions, to religious faith, to party or trade union affiliation or to private life except:

a) With the express consent of the person whom the data concern;

b) With prior authorization foreseen by law and guarantees of non-discrimination;

c) When the purpose of the statistical data processing is not individually identifiable.

3. The law shall regulate the protection of personal data in computer registers, the conditions of access to data banks, of the format and of use by public authorities and private entities of such banks or of computer supports of same.

4. Access to data bases or computerized archives, files and récords for obtaining data personal data related to third parties, as well as the transfer of personal data from one computerized file to another pertaining to different services or institutions, shall be prohibited except in cases established by law or by judicial decision.

5. Under no circumstance shall a unique number be assigned to citizens.

6. Everyone shall be guaranteed access to computer networks of public use, defining the law or regime applicable to the flow of trans-border data and the forms of protection of personal data and of others whose safeguard is justified by reasons of national interest, as well as the regime of limitation of access, for defending the juridical values safeguarded by the provisions of paragraph 4 of Article 48.

7. Personal data held in manual filing systems shall have exactly the same protection foreseen contemplated in the previous paragraphs, under the terms of the law.

Article 46 (Habeas data)

Habeas data shall be granted to every citizen in order to ensure his or her knowledge of information stored in files, file folders or a computerized register concerning him or her, and also that he or she may be informed of its purpose and may demand the correcting or updating of the data.
The law shall regulate the procedure of habeas data

Article 48 (Freedoms of expression and of information)

1. Everyone shall have the freedom to express and to disseminate his or her ideas in word, image or by any other means, and no one may be subjected to discomfort, on account of his or her political, philosophical, religious or other opinions.

2. Everyone shall have the freedom to inform and to be informed, procuring receiving and disseminating information and ideas in any form, without limitations, discrimination or impediments.

3. Limitations in the exercise of these freedoms, of any kind or form of censorship, shall be prohibited.

4. The freedoms of expression and of information shall have as limits the right to honor and to consideration for people, the right to a good name, to image and to privacy of personal and family life.

5. Freedom of expression and of information shall also be limited:

a) By the duty of protection of children and youth;

b) By the prohibition of advocacy of violence, pedophilia, racism, xenophobia and of any form of discrimination, particularly against women;

c) By the banning of the dissemination of appeals for the practice of the acts referred to in the previous subparagraph.

6. Offences committed in the exercise of freedom of expression and of information shall entail civil, disciplinary and criminal responsibility of the violator, under the terms of the law.

7. All natural or legal persons, on conditions of equality and efficacy, shall have the right of reply and of correction, as well as the right of compensation for damages suffered, as a result of offences committed in the exercise of freedom of expression and information.

Article 54 (Freedom of intellectual, artistic and cultural creation)

The intellectual, cultural and scientific creation, as well as the dissemination of literary, artistic and scientific works shall be free.
The law shall guarantee the protection of copyrights.

05Jul/18

Decreto-Lei nº 33/2007, de 24 de Setembro, de Cabo Verde

5 julio, 2018Cabo Verde, Decreto Ley24 setembro de 2007, a actividade de certificação, bem como a contratação electrónica. (B.O. da República de Cabo Verde, de 24 de Setembro, Decreto-Lei nº 33/2007, I Série, Legislation Cabo Verde, nº 36)., o reconhecimento da sua efi cácia jurídica, regula o uso da assinatura electrónicaJosé Cuervo

Decreto-Lei nº 33/2007, de 24 de Setembro, regula o uso da assinatura electrónica,
o reconhecimento da sua efi cácia jurídica, a actividade de certificação, bem como a contratação electrónica. (B.O. da República de Cabo Verde, 24 setembro de 2007, I Série, nº 36).

1. A evolução tecnológica determina a revisão do regime jurídico da assinatura digital estabelecido no Decreto-Lei nº 49/2003, de 24 de Novembro, em ordem à adopção de uma terminologia tecnologicamente neutra. Assim, as referências que traduziam a opção pelo modelo tecnológico prevalecente, a assinatura digital produzida através de técnicas criptográficas, são eliminadas. A expressão «assinatura digital» é substituída, consoante os casos, por «assinatura electrónica qualificada» ou por «assinatura electrónica qualificada certificada por entidade certificadora credenciada». As referências a «chaves privadas» são substituídas por «dados de criação de assinatura» e as referências a «chaves públicas» são substituídas por «dados de verificação de assinatura».

Estabelecem-se três modalidades de assinaturas electrónicas: a assinatura electrónica, a assinatura electrónica avançada e a assinatura electrónica qualificada, que correspondem a diferentes graus de segurança e fiabilidade.

Introduzem-se, correspondentemente, novas definições no artigo 2.º e são reforçados os deveres das entidades certificadoras que emitem certificados qualificados. A avaliação e certificação da conformidade dos produtos de assinatura electrónica utilizados na prestação de serviços de assinatura electrónica qualificada por uma entidade certificadora ou na criação e verificação de assinatura electrónica qualificada é atribuída a organismos de certificação. Para além do mais, visando assegurar uma melhor e maior fiscalização destas entidades pelos titulares e por terceiros, entendeu-se criar um registo junto da autoridade credenciadora, que, ainda que tenha um carácter meramente declarativo, é obrigatório para as entidades certificadoras que emitem certificados qualificados.

Mantém-se a possibilidade de as entidades certificadoras que emitem assinaturas electrónicas especialmente seguras e fiáveis, as assinaturas electrónicas qualificadas, solicitarem a sua credenciação junto da autoridade credenciadora. As assinaturas electrónicas qualificadas emitidas por uma entidade certificadora credenciada têm a força probatória de documento particular assinado, nos termos do artigo 376.º do Código Civil, enquanto as restantes modalidades de assinatura electrónica são livremente apreciadas pelo tribunal.

Clarifica-se o regime aplicável às assinaturas electrónicas de pessoas colectivas ao admitir-se expressamente que pessoas colectivas possam ser titulares de um dispositivo de criação de assinatura. Todavia, o presente Decreto-Lei não estabelece, em matéria de representação das pessoas colectivas, um regime diverso do resultante das disposições que regulam especialmente esta questão. Dentro da posição adoptada de neutralidade das tecnologias em relação ao direito, cabe à entidade certificadora verificar se a assinatura garante a intervenção das pessoas singulares que, estatutária ou legalmente, representam a pessoa colectiva.

As disposições relativas aos certificados de outros Estados são, igualmente, alteradas para assegurar a livre circulação dos produtos de assinatura electrónica no mercado interno.

Todavia, a evolução tecnológica determinará a médio prazo a revisão e adaptação do regime estabelecido no presente diploma.

2. A contratação electrónica representa o tema de maior delicadeza deste diploma. Esclarece-se expressamente que o preceituado abrange todo o tipo de contratos, sejam ou não qualificáveis como comerciais.

O princípio instaurado continua a ser o da liberdade de recurso à via electrónica, para que a lei não levante obstáculos, com as excepções que se apontam. Para isso haverá que afastar o que se oponha a essa celebração. Particularmente importante se apresentava a exigência de forma escrita, consagrando-se a regra de que as declarações emitidas por via electrónica satisfazem as exigências legais de forma escrita quando oferecem as mesmas garantias de fidedignidade, inteligibilidade e conservação.

Outro ponto muito sensível é o do momento da conclusão do contrato, estando em causa o significado do aviso de recepção da encomenda, que pode tomar-se como aceitação ou não. Adopta-se esta última posição, pois o aviso de recepção destina-se a assegurar a efectividade da comunicação electrónica, apenas, e não a exprimir uma posição negocial. Mas esclarece-se também que a oferta de produtos ou serviços em linha representa proposta contratual ou convite a contratar, consoante contiver ou não todos os elementos necessários para que o contrato fi que concluído com a aceitação.

Procura também regular-se a chamada contratação entre computadores, portanto a contratação inteiramente automatizada, sem intervenção humana. Estabelece-se que se regula pelas regras comuns enquanto estas não pressupuserem justamente a actuação humana. Esclarece-se também em que moldes são aplicáveis nesse caso as disposições sobre erro.

O transporte de mercadorias é o ramo comercial onde se prevê recurso mais frequente ás comunicações electrónicas, de onde a necessidade de uma normação que facilitasse o emprego desses meios de comunicação. Em dois artigos, são enunciadas disposições aplicáveis quer aos documentos de transporte não negociáveis quer à transferência de direitos sobre as mercadorias por meio de um conhecimento de embarque negociável ou transferível, abrangendo os princípios enunciados nos dois artigos são aplicáveis não só ao transporte marítimo, como também ao transporte de mercadorias por outros meios, como o transporte aéreo e o transporte rodoviário.

Institui-se uma entidade de supervisão para a contratação electrónica Quando a competência não couber a entidades especiais, funciona uma entidade de supervisão central: essa função é desempenhada pela Agência Nacional das Comunicações (ANAC). A entidade de supervisão tem funções no domínio da instrução dos processos contra-ordenacionais, que se prevêem, e da aplicação das coimas respectivas.

3. Estabelece-se pela primeira vez um regime sancionatório para as infracções no âmbito das assinaturas e da contratação electrónicas. O montante das coimas é fixado entre molduras muito amplas, de modo a serem dissuasoras, mas, simultaneamente, se adequarem à grande variedade de situações que se podem configurar.

Às contra-ordenações podem estar associadas sanções acessórias; mas as sanções acessórias mais graves terão necessariamente de ser confirmadas em juízo, por iniciativa oficiosa da própria entidade de supervisão.

Prevêem-se providências provisórias, a aplicar pela entidade de supervisão competente, e que esta pode instaurar, modificar e levantar a todo o momento. Enfim, é ainda objectivo deste diploma permitir o recurso a meios de solução extrajudicial de litígios para os conflitos surgidos neste domínio, sem que a legislação geral traga impedimentos, nomeadamente à solução destes litígios por via electrónica.

4. Alterações, de maior ou menor envergadura, ora introduzidas no Decreto-Lei nº 49/2003, de 24 de Novembro, fazem-lhe perder a identidade inicial e reclamam uma outra sistemática, pelo que se optou, não pela sua republicação, mas, sim, pela edição de um novo diploma no qual são conservadas todas as disposições do diploma anterior que se mostrem ajustadas à evolução tecnológica.

5. Foram ouvidas a Agencia Nacional de Comunicações e as Associações de Defesa dos Consumidores.

Nestes termos,

No uso da faculdade conferida pela alínea a) do nº 2 do artigo 203º da Constituição, o Governo decreta o seguinte:

CAPÍTULO I.- Disposições Gerais

Artigo 1º.- Objecto

O presente diploma regula o uso da assinatura electrónica, o reconhecimento da sua eficácia jurídica, a actividade de certificação, bem como a contratação electrónica.

Artigo 2º.- Âmbito de aplicação

O disposto no presente diploma não prejudica a aplicação das normas legais, regulamentares ou convencionais que obriguem à utilização de documentos em suporte de papel ou outras formas ou modos especiais de os apresentar, formular, transmitir ou arquivar, designadamente quando estejam em causa:

a) Actos notariais e de registo;

b) Actos processuais;

c) Actos que titulam relações jurídicas pessoais;

d) Actos relativos a procedimentos concursais;

e) Situações em que seja exigida a presença física do signatário ou o reconhecimento presencial de assinatura.

Artigo 3º.- Definições

1. Para efeitos do presente diploma, entende-se por:

a) Assinatura digital: modalidade de assinatura electrónica avançada baseado em sistema criptográfico assimétrico composto de um algoritmo ou série de algoritmos, mediante o qual é gerado um par de chaves assimétricas exclusivas e interdependentes, uma das quais privada e outra pública, e que permite ao titular usar a chave privada para declarar a autoria do documento electrónico ao qual a assinatura é aposta e concordância com o seu conteúdo, e ao declaratário usar a chave pública para verificar se a assinatura foi criada mediante o uso da correspondente chave privada e se o documento electrónico foi alterado depois de aposta a assinatura;

b) Assinatura electrónica: os dados sob forma electrónica anexos ou logicamente associados a uma mensagem de dados e que sirvam de método de autenticação;

c) Assinatura electrónica avançada: assinatura electrónica que preenche os seguintes requisitos:

i) Identifica de forma unívoca o titular como autor do documento;

ii) A sua aposição ao documento depende apenas da vontade do titular;

iii) É criada com meios que o titular pode manter sob seu controlo exclusivo;

iv) A sua conexão com o documento permite detectar toda e qualquer alteração superveniente do conteúdo deste.

d) Assinatura electrónica qualificada: assinatura digital ou outra modalidade de assinatura electrónica avançada que satisfaça exigencias de segurança idênticas às da assinatura digital baseadas num certificado qualifi cado e criadas através de um dispositivo seguro de criação de assinatura;

e) Autoridade credenciadora: entidade competente para a credenciação e fiscalização das entidades certificadoras;

f) Certificado: documento electrónico que liga os dados de verificação de assinatura ao seu titular e confirma a identidade desse titular;

g) Certificado de assinatura: documento electrónico autenticado com assinatura digital e que certifique a titularidade de uma chave pública e o prazo de validade da mesma chave;

h) Certificado qualificado: certificado que contém os elementos referidos no artigo 67º, é emitido por entidade certificadora que reúne os requisitos definidos no artigo 69º;

i) Chave privada: elemento do par de chaves assimétricas destinado a ser conhecido apenas pelo seu titular, mediante o qual se apõe a assinatura digital no documento electrónico, ou se decifra um documento electrónico previamente cifrado com a correspondente chave pública;

j) Chave pública: elemento do par de chaves assimétricas destinado a ser divulgado, com o qual se verificaa assinatura digital aposta no documento electrónico pelo titular do par de chaves assimétricas, ou se cifra um documento electrónico a transmitir ao titular do mesmo par de chaves;

k) Comércio electrónico: a actividade pela qual uma pessoa, agindo a titulo profi ssional, obriga-se, mediante pagamento e atendendo a encomenda a distancia recebida ou processada por meios electrónicos, a fornecer bens ou prestar serviços de natureza civil ou comercial;

l) Correio electrónico: qualquer mensagem textual, vocal ou sonora ou gráfi ca enviada através de uma rede pública de comunicações que pode ser armazenada na rede ou no equipamento terminal do destinatário até o destinatário a recolher;

m) Credenciação: acto pelo qual é reconhecido a uma entidade que o solicite é que exerça actividade de entidade certificadora referida na alínea n) o preenchimento dos requisitos definidos no presente diploma para os efeitos nele previstos;

n) Documento electrónico: documento elaborado mediante processamento electrónico de dados;

o) Endereço electrónico: identificação de um equipamento informático adequado para receber e arquivar documentos electrónicos;

p) Entidade certificadora: entidade ou pessoa colectiva credenciada que cria ou fornece meios para a criação das chaves, emite os certificados de assinatura, assegura a respectiva publicidade é presta outros serviços relativos a assinaturas electrónicas;

q) Dados de criação de assinaturas: um conjunto único de dados, como códigos ou chaves criptográficas privadas, usado pelo signatário para a criação de uma assinatura electrónica;

r) Dados de verificação de assinaturas: um conjunto de dados, como códigos ou chaves criptográficas públicas, usado para verificar a assinatura electrónica;

s) Declarante de uma mensagem de dados: a pessoa, singular ou colectiva, por quem, ou em nome de quem, se for o caso, a mensagem de dados se considera ter sido expedida antes de arquivada, excluindo a pessoa que actuou como intermediário relativamente a essa mensagem de dados;

t) Destinatário de uma mensagem de dados: a pessoa, singular ou colectiva, por quem o declarante quer que a mensagem de dados seja recebida, excluindo a pessoa que actuou como intermediário relativamente a essa mensagem de dados;

u) Dispositivo de criação de assinaturas: um logicial configurado ou dispositivo de equipamento utilizado para possibilitar o tratamento dos dados de criação de assinaturas;

v) Dispositivo seguro de criação de assinatura: dispositivo de criação de assinatura que assegure, através de meios técnicos e processuais adequados, que:

i) Os dados necessários à criação de uma assinatura utilizados na geração de uma assinatura só possam ocorrer uma única vez e que a confidencialidade desses dados se encontré assegurada;

ii) Os dados necessários à criação de uma assinatura utilizados na geração de uma assinatura não possam, com um grau razoável de segurança, ser deduzidos de outros dados e que a assinatura esteja protegida contra falsificações realizadas através das tecnologías disponíveis;

iii) Os dados necessários à criação de uma assinatura utilizados na geração de uma assinatura possam ser eficazmente protegidos pelo titular contra a utilização ilegítima por terceiros; e

iv) Os dados que careçam de assinatura não sejam modificados e possam ser apresentados ao titular antes do processo de assinatura.

w) Intercâmbio electrónico de dados (EDI): a transmissão electrónica de declarações ou informações entre computadores, utilizando um padrão convencionado para a estruturação da informação;

x) Intermediário, relativamente a uma mensagem de dados: a pessoa que, em nome de outrem, expede, recebe ou arquiva uma mensagem de dados ou presta outros serviços relacionados com essa mensagem;

y) Mensagem de dados: a declaração ou informação expedida, recebida ou guardada em arquivo através de meios electrónicos, ópticos ou análogos, incluindo o intercâmbio electrónico de dados (EDI), correio electrónico, telegramas, mensagens telex ou telecópias;

z) Organismo de certificação: entidade pública ou privada competente para a avaliação e certificação da conformidade dos processos, sistemas e produtos de assinatura electrónica com os requisitos a que se refere a alínea c) do nº 1 do artigo 45º;

aa) Produto de assinatura electrónica: suporte lógico, dispositivo de equipamento ou seus componentes específicos, destinados a ser utilizados na prestação de serviços de assinatura electrónica qualificada por uma entidade certificadora ou na criação e verificação de assinatura electrónica qualificada;

bb) Signatário ou titular: uma pessoa singular que detém um dispositivo de criação de assinaturas e o utiliza em seu próprio nome, ou em nome da pessoa singular ou colectiva ou da entidade que representa;

cc) Sistema de informação: todo o sistema utilizado para criar, enviar, receber, arquivar, ou procesar de alguma outra forma mensagens de dados;

dd) Validação cronológica: declaração de entidade certificadora que atesta a data e hora da criação, expedição ou recepção de um documento electrónico.

Artigo 4º.- Interpretação

1. Na interpretação do presente diploma deve ter-se em conta a necessidade de promover a uniformidade de aplicação das normas sobre o comércio electrónico a nível internacional e de assegurar o respeito da boa fé das relações comerciais.

2. As questões concernentes às matérias reguladas pelo presente diploma e que não são expressamente resolvidas por ele, são decididas segundo os seguintes principios gerais de direito que a inspiram:

a) Facilitar o comércio electrónico dentro e além das fronteiras nacionais;

b) Convalidar as operações efectuadas por meio das novas tecnologias de informação;

c) Fomentar e estimular a aplicação de novas tecnologías de informação;

d) Promover a uniformidade do direito aplicável ao comércio electrónico;

e) Apoiar as novas práticas comerciais.

Artigo 5º.- Modificação mediante acordó Salvo estipulação em contrário, nas relações entre as partes que criem, enviem, recebam, arquivem ou processem mensagens de dados, as disposições do Capítulo II podem ser modificadas mediante acordo.

CAPÍTULO II.- Mensagens de Dados

Secção I.- Aplicação dos requisitos jurídicos às mensagens de dados

Artigo 6º.- Eficácia legal

Nenhuma declaração ou informação contida numa mensagem de dados pode ser contestada quanto à sua validade e eficácia jurídicas com fundamento único no facto de se encontrar em forma de mensagem de dados.

Artigo 7º.- Incorporação por referência

Não podem ser contestadas validade e eficácia jurídicas e força probatória de uma informação com fundamento único no facto de não se encontrar contida na mensagem de dados desde que a mesma figura implicitamente na mensagem de dados em forma de remissão.

Artigo 8º.- Forma escrita

Nos casos em que a lei sujeita a validade do acto à observância de forma escrita, este requisito considerase cumprido numa mensagem de dados, desde que a informação contida nesta seja acessível para consultas posteriores.

Artigo 9º.- Forma original

1. Quando a lei exija que a informação seja apresentada e conservada na sua forma original, este requisito considera-se satisfeito através de uma mensagem de dados na medida em que:

a) Exista garantia fiável de que seja conservada a integridade da informação, desde o momento em que esta se criou em sua forma definitiva, como mensagem de dados ou outra forma;

b) Relativamente apenas à apresentação, se tal informação possa ser mostrada à pessoa ou entidade a quem se deva apresentar.

2. Para efeitos do número anterior:

a) A integridade da declaração ou informação afere-se pelo facto de o respectivo conteúdo permanecer completo e inalterado, sem prejuízo da adição de qualquer alteração que ocorra no curso normal da expedição, apresentação («display»), impressão ou arquivamento;

b) A fiabilidade requerida é determinada tendo em conta os fins para os quais a declaração ou informação foi expedida e todas as demais circunstancia relevante existente ao momento.

Artigo 10º.- Forma e força probatória

1. A mensagem de dados satisfaz o requisito legal de forma escrita quando o seu conteúdo seja susceptível de representação como declaração escrita.

2. Quando lhe seja aposta uma assinatura electrónica qualificada certificada por uma entidade certificadora credenciada, a mensagem de dados com o conteúdo referido no número anterior tem a força probatória de documento particular assinado, nos termos do artigo 376.º do Código Civil.

3. Quando lhe seja aposta uma assinatura electrónica qualificada certificada por uma entidade certificadora credenciada, a mensagem de dados cujo conteúdo não seja susceptível de representação como declaração escrita tem a força probatória prevista no artigo 368.º do Código Civil e na legislação processual penal.

4. O disposto nos números anteriores não obsta à utilização de outro meio de comprovação da autoria e integridade de mensagem de dados, incluindo outras modalidades de assinatura electrónica, desde que tal meio seja adoptado pelas partes ao abrigo de válida convenção sobre prova ou seja aceite pela pessoa a quem for oposto o documento.

5. Sem prejuízo do disposto no número anterior, o valor probatório das mensagens de dados aos quais não seja aposta uma assinatura electrónica qualificada certificada por entidade certificadora credenciada é apreciado nos termos gerais de direito.

6. Sem prejuízo do disposto no número anterior, o valor probatório das mensagens de dados aos quais não seja aposta uma assinatura electrónica qualificada certificada por entidade certificadora credenciada é apreciado nos termos gerais de direito.

Artigo 11º.- Cópias de documentos

As cópias de mensagens de dados electrónicos, sobre idêntico ou diferente tipo de suporte, são válidas e eficazes nos termos gerais de direito e têm a força probatória atribuída às cópias fotográficas pelo nº 2 do artigo 387º do Código Civil e pelas correspondentes disposições da lei processual penal, se forem observados os requisitos aí previstos.

Artigo 12º.- Conservação das mensagens de dados

1. Quando a lei exija que determinados documentos, registos ou informações sejam conservados, essa exigencia considera-se satisfeita quando se cumprirem as condições seguintes:

a) Que a informação que contenha a mensagem de dados seja acessível para sua consulta ulterior;

b) Que a mensagem de dados seja conservada no formato em que foi criada, enviada ou recebida ou em formato que permita demonstrar que reproduz com exactidão a informação criada, enviada ou recebida; e

c) Que ficam conservadas, se houver, as informações que permitem determinar a origem e o destino da mensagem de dados, bem como a data e a hora em que foram enviadas, recebidas ou produzidas.

2. A pessoa que, por força de lei, esteja obrigada a guardar em arquivo certos documentos ou registos pode para tal recorrer aos serviços de terceiros, contanto que seja observado o disposto no nº 1.

Secção II.- Mensagens de dados em especial

Artigo 13º.- Autoria

1. Uma mensagem de dados considera-se como sendo da autoria do declarante se foi expedida pelo próprio.

2. Considera-se, ainda, como sendo da autoria do declarante a mensagem de dados expedida por:

a) Uma pessoa com poderes para representar o declarante em relação a essa mensagem de dados;

b) Um sistema de informação programado pelo declarante ou em seu nome para funcionar automaticamente.

3. Ao destinatário assiste o direito de considerar que a mensagem de dados é da autoria do declarante se:

a) Para determinar se a mensagem de dados é da autoria do declarante o destinatário utilizou um procedimento previamente acordado com o declarante para esse efeito;

b) A mensagem de dados tal como foi recebida pelo destinatário resultou das acções de uma pessoa cuja relação com o declarante ou seu representante permite a essa pessoa o acesso ao método utilizado pelo declarante para certificar que uma mensagem de dados é da sua autoria.

4. O disposto no número anterior não se aplica:

a) A partir do momento em que o destinatário foi informado pelo declarante da mensagem de dados de que a mesma não é da sua autoria e disponha de tempo sufi ciente para actuar em conformidade;

b) Em qualquer momento, no caso da alínea b) do número anterior, se o destinatário conheceu ou podia ter conhecido, se tivesse usado de diligência de um homem médio ou utilizado os procedimentos acordados ou regulamentados, que a mensagem de dados não é da autoria do declarante.

Artigo 14º.- Autonomia e duplicação

O destinatário tem legitimidade para considerar cada mensagem de dados como autónoma em face das demais recebidas e actuar em conformidade, salvo se a mensagem de dados for a duplicação de outra mensagem de dados e o destinatário sabia ou podia ter sabido desse facto, se tivesse usado de diligência de um homem médio ou utilizado os procedimentos acordados ou regulamentados.

Artigo 15º.- Tempo e lugar da expedição e recepção

1. A expedição de uma mensagem de dados verificase quando esta entra num sistema de informação fora do controlo do declarante ou da pessoa que expediu a mensagem de dados em nome do declarante.

2. O momento da recepção de uma mensagem de dados é determinado do seguinte modo:

a) Se o destinatário indicou um sistema de informação com a finalidade de receber mensagens de dados, a recepção verificaseno momento em que a mensagem de dados entra no sistema de informação designado; ou, se a mensagem de dados é expedida para um sistema de informação do destinatário que não é o sistema designado, no momento em que a mensagem de dados é recuperada pelo destinatário;

b) Se o destinatário não designou um sistema de informação, a recepção verificasequando a mensagem de dados entra num qualquer sistema de informação do destinatário.

3. Uma mensagem de dados considera-se como tendo sido:

a) Expedida do lugar onde o declarante tem o seu estabelecimento, ou, não sendo empresário, o seu domicílio;

b) Recebida no lugar onde o destinatário tem o estabelecimento, ou, não sendo empresário, o seu domicílio.

4. O disposto no nº 2 aplica-se não obstante o lugar onde o sistema de informação está localizado ser diferente do lugar onde a mensagem de dados é considerada como recebida nos termos do número anterior.

5. Para os efeitos do nº 3:

a) Se o declarante ou o destinatário tiver mais de um estabelecimento, é considerado o estabelecimento que tiver uma relação mais estreita com a transacção relacionada com a mensagem de dados ou, no caso de não haver uma transacção, seu estabelecimento principal;

b) Se o declarante ou o destinatário não tiver estabelecimento, releva para este efeito a sua residência habitual.

Artigo 16º.- Correspondência com a vontade do autor

1. Se a mensagem de dados for do declarante ou se presumir sê-lo, ou se o destinatário tiver razões para actuar nessa pressuposição, este tem legitimidade para:

a) Considerar a mensagem de dados, tal como foi recebida, como sendo aquela que o declarante quis expedir;

b) Actuar em conformidade.

2. O destinatário não tem a legitimidade referida no número anterior se conhecia ou podia ter conhecido, se tivesse usado de diligência de um homem médio ou utilizado os procedimentos acordados ou regulamentados, que a transmissão determinou um erro na mensagem de dados tal como foi recebida.

3. O destinatário também não tem a legitimidade referida na alínea b) do nº 1 se a mensagem estiver sujeita a confirmação da recepção, imposta pelo declarante ou com ele acordada, enquanto essa confirmação não for efectuada.

Artigo 17º.- Confirmação da recepção

Se o declarante receber do destinatário a confi rmação da recepção, presume-se que a mensagem de dados em questão foi recebida pelo destinatário, mas esta presunção não implica que a mensagem de dados corresponda à mensagem recebida.
Se a confirmação recebida referir que a mensagem de dados satisfaz as exigências técnicas acordadas ou estabelecidas em padrões aplicáveis, presume-se que essas exigências foram satisfeitas.

Artigo 18º.- Modo de confirmação da recepção

A confirmação da recepção de uma mensagem de dados é efectuada pelo modo ou método específi co acordado entre as partes ou, inexistindo tal acordo, através de:

a) Qualquer comunicação nesse sentido feita pelo destinatário, automatizada ou não;

b) Qualquer conduta do destinatário da qual o declarante possa concluir, objectivamente, ter o destinatário recebido a mensagem de dados.

Artigo 19º.- Mensagens condicionadas a confirmação da recepção

O declarante pode exigir ou acordar com o destinatário, antes ou durante a expedição de uma mensagem de dados, que a recepção desta seja confirmada.
Se o declarante tiver determinado que a mensagem de dados é condicionada à confirmação da recepção, a mensagem de dados é inefi caz até ao momento em que seja efectuada tal confirmação.
Se o declarante não tiver estabelecido que a mensagem de dados é condicionada à confirmação da recepção, e esta não tiver sido recebida pelo declarante dentro do prazo que, no caso, se mostrar aplicável ou razoável, o declarante pode comunicar ao destinatário que não foi recebida confirmação e estabelecer um prazo para ese efeito.
Se a confirmação da recepção não for recebida no prazo indicado, o declarante pode, mediante comunicação ao destinatário, revogar ou anular a mensagem de dados ou exercer quaisquer outros direitos que, pelo facto, lhe assistam.

Artigo 20º.- Concessão de direitos e aquisições de obrigações por meio de mensagens de dados

Quando se conceda algum direito a uma pessoa determinada e a nenhuma outra, ou quando esta Adquira alguma obrigação, e a lei requeira que, para que o acto produza efeito, o direito ou a obrigação tenham de transferir-se a essa pessoa mediante o envio ou a utilização de um documento impresso, este requisito considera-se satisfeito se o direito ou obrigação se transfere pelo uso de uma ou mais mensagens de dados, sempre que se empregue um método confi ável para garantir a singularidade das ditas mensagens electrónicas.
Para os fins do número anterior, o grau de confiabilidade requerido deve ser determinado à luz dos fins para os quais os direitos ou obrigações foram transferidos e levando-se em consideração todas as circunstâncias do caso, inclusive qualquer acordo relevante.
As normas jurídica que se apliquem obrigatoriamente aos contratos de transporte de mercadorias que constem de um documento impresso não deixam de ser aplicáveis a um contrato de transporte de mercadorias que conste de uma ou mais mensagens de dados pela simples razão de que o contrato consta de uma tal mensagem ao invés de um documento impresso.

Artigo 21º.- Comunicação de documentos electrónicos

O documento electrónico comunicado por um meio de comunicações electrónicas considera-se enviado e recebido pelo destinatário se for transmitido para o endereço electrónico defi nido por acordo das partes e neste for recebido.
São oponíveis entre as partes e a terceiros a data e a hora da criação, da expedição ou da recepção de um documento electrónico que contenha uma validação cronológica emitida por uma entidade certificadora.
A comunicação do documento electrónico, assinado de acordo com os requisitos do presente diploma, por meio de comunicações electrónicas que assegure a efectiva recepção equivale à remessa por via postal registada e, se a recepção for comprovada por mensagem de confi rmação dirigida ao remetente pelo destinatário com assinatura digital e recebida pelo remetente, equivale à remessa por via postal registada com aviso de recepção.
Os dados e documentos comunicados por meio de comunicações electrónicas consideram-se em poder do remetente até à recepção pelo destinatário.
Os operadores que assegurem a comunicação de documentos electrónicos por meio de comunicações electrónicas não podem tomar conhecimento do seu conteúdo, nem duplicá-los por qualquer meio ou ceder a terceiros qualquer informação, ainda que resumida ou por extracto, sobre a existência ou sobre o conteúdo desses documentos, salvo quando se trate de informação que, pela sua natureza ou por indicação expressa do seu remetente, se destine a ser tornada pública.

Artigo 22º.- Documentos electrónicos dos organismos públicos

Os organismos públicos podem emitir documentos electrónicos com assinatura digital aposta em conformidade com as normas do presente diploma.
Nas operações relativas à criação, emissão, arquivo, reprodução, cópia e transmissão de documentos electrónicos que formalizem actos administrativos através de sistemas informáticos, incluindo a sua transmissão por meios de telecomunicações, os dados relativos ao organismo interessado e à pessoa que tenha praticado cada acto administrativo devem ser indicados de forma a torná-los facilmente identifi cáveis e a comprovar a função ou cargo desempenhado pela pessoa signatária de cada documento.
Os serviços e entidades públicas podem, mediante aprovação da entidade de direcção, superintendencia ou tutela, emitir normas regulamentares relativas aos requisitos a que devem obedecer os documentos que recebam por via electrónica, sem prejuízo das instruções e directivas que sejam superiormente defi nidas com vista à uniformização de procedimentos.

CAPÍTULO III.- Contratação Electrónica

Secção I.- Contratação electrónica em geral

Artigo 23º.- Âmbito

As disposições deste capítulo são aplicáveis a todo o tipo de contratos celebrados por via electrónica ou informática, sejam ou não qualificáveis como comerciais.

Artigo 24º.- Liberdade de celebração

1. É livre a celebração de contratos por via electrónica, sem que a validade ou eficácia destes seja prejudicada pela utilização deste meio.

2. São excluídos do princípio da admissibilidade os negócios jurídicos:

a) Familiares e sucessórios;

b) Que exijam a intervenção de tribunais, entes públicos ou outros entes que exerçam poderes públicos, nomeadamente quando aquela intervenção condicione a produção de efeitos em relação a terceiros e ainda os negocios legalmente sujeitos a reconhecimento ou autenticação notariais;

c) Reais imobiliários, com excepção do arrendamento;

d) De caução e de garantia, quando não se integrarem na actividade profissional de quem as presta.

3. Só tem de aceitar a via electrónica para a celebração de um contrato quem se tiver vinculado a proceder dessa forma.

4. São proibidas cláusulas contratuais gerais que imponham a celebração por via electrónica dos contratos com consumidores.

Artigo 25º.- Forma

As declarações emitidas por via electrónica satisfazem a exigência legal de forma escrita quando contidas em suporte que ofereça as mesmas garantias de fi dedignidade, inteligibilidade e conservação.
O documento electrónico vale como documento assinado quando satisfi zer os requisitos da legislação sobre assinatura electrónica e certificação.

Artigo 26º.- Erro nas comunicações electrónicas

1. Um contrato concluído por uma pessoa ou um consumidor que acesse a um sistema automatizado de informação é inefi caz caso a pessoa ou o consumidor haja cometido um erro de digitação em uma mensagem de dados e o sistema automatizado de informação não lhe ofereceu a possibilidade de corrigir o erro, desde que a pessoa que invoque o erro notifi que a sua contraparte do erro assim que possível.

2. Uma pessoa ou o consumidor não pode invocar um erro com base no número anterior se:

a) A pessoa ou o consumidor absteve-se de tomar as medidas cabíveis, inclusive medidas em conformidade com as instruções recebidas da outra parte, para devolver ou destruir os bens ou serviços recebidos, quando os houver;

b) A pessoa ou consumidor fez uso ou recebeu um valor ou proveito material dos bens ou serviços recebidos da outra parte.

3. O fornecedor que celebre contratos por via electrónica deve disponibilizar aos destinatários, salvo acordó em contrário das partes que não sejam consumidores, meios técnicos eficazes que lhes permitam identifi car e corrigir erros de introdução, antes de formular uma ordem de encomenda.

4. O disposto no número anterior não é aplicável aos contratos celebrados exclusivamente por correio electrónico ou outro meio de comunicação individual equivalente.

Artigo 27º.- Informações prévias

1. O prestador de serviços em rede que celebre contratos em linha deve facultar aos destinatários, antes de ser dada a ordem de encomenda, informação mínima inequívoca que inclua:

a) O processo de celebração do contrato;

b) O arquivamento ou não do contrato pelo prestador de serviço e a acessibilidade àquele pelo destinatário;

c) A língua ou línguas em que o contrato pode ser celebrado;

d) Os meios técnicos que o prestador disponibiliza para poderem ser identificados e corrigidos erros de introdução que possam estar contidos na ordem de encomenda;

e) Os termos contratuais e as cláusulas gerais do contrato a celebrar;

f) Os códigos de conduta de que seja subscritor e a forma de os consultar electronicamente;

g) O mais que for determinado pela entidade de supervisão do comércio electrónico.

2. O disposto no número anterior é derrogável por acordo em contrário das partes que não sejam consumidores.

3. O disposto nos números anteriores não é aplicável aos contratos celebrados exclusivamente por correio electrónico ou outro meio de comunicação individual equivalente.

Artigo 28º.- Ordem de encomenda e aviso de recepção

Logo que receba uma ordem de encomenda por via exclusivamente electrónica, o prestador de serviços debe acusar a recepção igualmente por meios electrónicos, salvo acordo em contrário com a parte que não seja consumidora.
É dispensado o aviso de recepção da encomenda nos casos em que há a imediata prestação em linha do produto ou serviço.
O aviso de recepção deve conter a identifi cação fundamental do contrato a que se refere.
O prestador satisfaz o dever de acusar a recepção se enviar a comunicação para o endereço electrónico que foi indicado ou utilizado pelo destinatário do serviço.
A encomenda torna-se definitiva com a confi rmação do destinatário, dada na sequência do aviso de recepção, reiterando a ordem emitida.
O disposto no número anterior não é aplicável aos contratos celebrados exclusivamente por correio electrónico ou outro meio de comunicação individual equivalente.

Artigo 29º.- Apresentação dos termos contratuais e cláusulas gerais

Os termos contratuais e as cláusulas gerais, bem como o aviso de recepção, devem ser sempre comunicados de maneira que permita ao destinatário armazená-los e reproduzi-los.
A ordem de encomenda, o aviso de recepção e a confirmação da encomenda consideram-se recebidos logo que os destinatários têm a possibilidade de aceder a eles.

Artigo 30º.- Proposta contratual e convite a contratar

A oferta de produtos ou serviços em linha representa uma proposta contratual quando contiver todos os elementos necessários para que o contrato fi que concluido com a simples aceitação do destinatário, representando, caso contrário, um convite a contratar.
O mero aviso de recepção da ordem de encomenda não tem signifi cado para a determinação do momento da conclusão do contrato.

Artigo 31º.- Operações automatizadas

1. Salvo convenção em contrário das partes, podem-se concluir contratos pela interacção de um sistema de informação automatizada com uma pessoa ou pela interacção de dois ou mais sistemas de informação automatizada entre si, mesmo que nenhuma pessoa seja chamada a examinar as acções individuais levadas a cabo por tais sistemas ou o contrato que delas resulte.

2. À contratação celebrada nos termos do nº 1 é aplicável o regime comum, salvo quando este pressupuser uma actuação.

3. São aplicáveis as disposições sobre erro:

a) Na formação da vontade, se houver erro de programação;

b) Na declaração, se houver defeito de funcionamento da máquina;

c) Na transmissão, se a mensagem chegar deformada ao seu destino.

4. A outra parte não pode opor-se à impugnação por erro sempre que lhe fosse exigível que dele se apercebesse, nomeadamente pelo uso de dispositivos de detecção de erros de introdução.

Artigo 32º.- Entidade de supervisão central

É instituída uma entidade de supervisão central com atribuição na contratação electrónica, salvo nas matérias em que lei especial atribua competência sectorial a outra entidade.
As funções de entidade de supervisão central são exercidas pela Agência Nacional de Comunicações (ANAC).
A entidade de supervisão funciona como organismo de referência para os contactos que se estabeleçam no seu domínio, fornecendo, quando requeridas, informações aos destinatários e ao público em geral.
Cabe às entidades de supervisão, além das atribuições gerais já assinaladas e das que lhes forem especifi camente atribuídas:

a) Elaborar regulamentos e dar instruções sobre práticas a ser seguidas para cumprimento do disposto no presente capítulo;

b) Fiscalizar o cumprimento do preceituado sobre o comércio electrónico;

c) Instaurar e instruir processos contra-ordenacionais e, bem assim, aplicar as sanções previstas;

d) Determinar a suspensão da actividade dos prestadores de serviços em face de graves irregularidades e por razões de urgência;

e) Publicitar em rede os códigos de conduta mais significativos de que tenha conhecimento;

f) Publicitar outras informações, nomeadamente decisões judiciais neste domínio.

Secção II.- Contratação electrónica em especial em áreas específicas

Artigo 33º.- Transporte de mercadorias

Sem prejuízo do disposto no Capítulo II, esta secção aplica-se a quaisquer dos seguintes actos, entre outros, que guardem relação com um contrato de transporte de mercadorias, ou com o seu cumprimento:

a) Actos relativos à recepção e embarque de mercadorias:

i) Indicação de marcas, número, quantidade ou peso da mercadoria;

ii) Declaração da natureza ou valor da mercadoria;

iii) Emissão de recibo da mercadoria;

iv) Confirmação do carregamento da mercadoria.

b) Actos relativos ao contrato e condições de transporte:

i) Notificação dos termos e condições do contrato;

ii) Fornecimento de instruções ao transportador.

c) Actos relativos às condições de entrega da mercadoria:

i) Reclamação da entrega da mercadoria;

ii) Autorização para proceder à entrega da mercadoria;

iii) Notificação de avaria ou perda da mercadoria.

d) Fornecimento de qualquer outra informação relativa ao cumprimento do contrato;

e) Promessa de efectuar a entrega da mercadoria à pessoa designada ou à pessoa autorizada a reclamar a entrega;

f) Concessão, aquisição, desistência, restituição, transferência ou negociação de direitos sobre a mercadoria;

g) Aquisição ou transferência de direitos e obrigações derivados do contrato.

Artigo 34º.- Documentos de transporte

Com reserva ao disposto no número seguinte, nos casos em que a lei requeira que qualquer dos actos enunciados no artigo anterior se realize por escrito ou por meio de um documento impresso, este requisito é satisfeito se o acto se realiza por meio de uma ou mais mensagens de dados.
Aplica-se o disposto no nº 1 tanto se o requisito Nele previsto esteja expresso em forma de uma obrigação quanto se a lei simplesmente preveja consequências para quando o acto não se realize por escrito ou por meio de um documento impresso.
Quando uma ou mais mensagens de dados forem utilizadas para efectuar qualquer um dos actos enunciados nas alíneas f) e g) do artigo anterior, não é válido nenhum documento impresso utilizado para efectivar quaisquer daqueles actos a menos que o uso de mensagens de dados se haja interrompido e substituído pelo uso de documentos impressos.
Todo documento impresso que se emita nos termos do número anterior deve conter uma declaração sobre tal substituição, não podendo, em caso algum, a substituição das mensagens de dados por documentos impressos, afectar os direitos e obrigações das partes envolvidas.

CAPÍTULO IV.- Assinaturas Electrónicas

Artigo 35º.- Igualdade de tratamento das tecnologias de assinatura

Nenhuma disposição do presente diploma, com excepção do artigo 5º, deve ser aplicada de modo a excluir, restringir ou privar de efeito jurídico qualquer dispositivo para criar uma assinatura electrónica que cumpra com os requisitos enunciados no nº 2 do artigo 36º ou que cumpra de outro modo os requisitos da lei aplicável.

Artigo 36º.- Assinatura

1. Quando a lei requeira a assinatura de uma pessoa para a validade, eficácia ou prova de um acto juridico, ou simplesmente atribua conseqüências a ausência de assinatura, considerar-se-á satisfeito este requisito por uma mensagem electrónica em que se utilize uma assinatura electrónica sufi cientemente fiavel, à luz de todas as circunstâncias do caso, inclusive de qualquer acordó entre as partes e dos fins para os quais a mensagem foi gerada ou comunicada.

2. Para os fins do número anterior, considera-se fiavel a assinatura electrónica:

a) Se o dispositivo de assinatura, no contexto em que for utilizado, corresponder exclusivamente ao signatário e estiver, no momento da assinatura, sob o seu controle exclusivo;

b) Se a assinatura permitir a identifi cação do signatário;

c) Se for possível detectar qualquer alteração da assinatura electrónica feita depois do momento da assinatura; e

d) Se for possível detectar qualquer alteração da informação ocorrida após o momento da assinatura nos casos em que o requisito legal da assinatura tenha por objetivo assegurar a integridade da informação à qual a assinatura corresponda.

3. A assinatura electrónica apoiada por um certificado emitido de conformidade com as disposições do Capítulo V, a qual se designa “assinatura electrónica avançada” goza, até prova em contrario, da presunção de fiabilidade e substitui, para todos os efeitos legais, a aposição de selos, carimbos, marcas ou outros sinais identificadores do seu titular.

4. O grau de fiabilidade de uma assinatura electrónica que nao seja uma assinatura electrónica avançada nos termos do nº 3 aprecia-se em conformidade com os criterios enunciados no nº 2.

Artigo 37º.- Condições mínimas para o reconhecimento das assinaturas avançadas

1. Para que possa ser reconhecido como avançado para os fins do nº 3 do artigo 36º um dispositivo de criação de assinatura deve garantir, por meios e procedimentos técnicos apropriados que:

a) Os dados de criação da assinatura electrónica não podem praticamente ser encontrados mais de uma vez e que sua confidencialidade esteja razoavelmente assegurada;

b) Exista garantia sufi ciente de que os dados de criação da assinatura electrónica não podem ser obtidos por dedução e que a assinatura seja protegida contra falsificação pelos meios técnicos actualmente disponíveis;

c) Os dados de criação da assinatura electrónica possam ser protegidos de maneira fi ável pelo signatário legítimo contra uso indevido por outrem.

2. Os dados de criação da assinatura electrónica não devem causar nenhuma alteração no contéudo do acto a ser fi rmado nem criar obstáculos ao seu conhecimento exacto pelo signatário antes de assiná-lo.

Artigo 38º.- Normas de conduta do signatário

O titular do dispositivo de assinatura electrónica avançada deve actuar imediatamente para evitar a utilização não autorizada de seu dispositivo de assinatura.
Sempre que o signatário viera saber que um dispositivo de assinatura electrónica seu está comprometido ou quando as circunstâncias de que tenha conhecimento dêem lugar a um risco considerável de que o dispositivo de assinatura electrónica esteja comprometido, debe o signatário imediatamente fazer uso dos meios que lhe proporcione o prestador de serviços de certificação conforme à alínea h) do artigo 58º, ou de outra forma fazer o que razoavelmente esteja ao seu alcance para notificar de tal fato qualquer pessoa que, segundo possa razoavelmente prever o signatário, possa vir a fi ar-se na assinatura electrónica ou prestar serviços que apoiem o signatário.
Sempre que se empregue um certificado para referendar uma assinatura electrónica avançada, o signatário deve actuar com diligência razoável para assegurar-se da exatidão e exaustão de todas as declarações que haja feito em relação com o ciclo vital do certificado ou que nele se hajam de consignar.

Artigo 39º.- Assinatura electrónica qualificada

1. A aposição de uma assinatura electrónica qualifi cada a um documento electrónico equivale à assinatura autógrafa dos documentos com forma escrita sobre suporte de papel e cria a presunção de que:

a) A pessoa que apôs a assinatura electrónica qualificada é o titular desta ou é representante, com poderes bastantes, da pessoa colectiva titular da assinatura electrónica qualificada;

b) A assinatura electrónica qualificada foi aposta com a intenção de assinar o documento electrónico;

c) O documento electrónico não sofreu alteração desde que lhe foi aposta a assinatura electrónica qualificada.

2. A assinatura electrónica qualificada deve referir-se inequivocamente a uma só pessoa singular ou colectiva e ao documento ao qual é aposta.

3. A aposição de assinatura electrónica qualificada substitui, para todos os efeitos legais, a aposição de selos, carimbos, marcas ou outros sinais identificadores do seu titular.

4. A aposição de assinatura electrónica qualificada que conste de certificado que esteja revogado, caduco ou suspenso na data da aposição ou não respeite as condições dele constantes equivale à falta de assinatura.

Artigo 40º.- Conduta da parte que se fia no certificado

A parte que se fie no certificado arca com as consequências de não haver tomado medidas razoáveis para verificar a fiabilidade da assinatura electrónica; ou, quando a assinatura electrônica esteja referendada por um certificado, de não haver tomado medidas razoáveis para verificar a validade, suspensão ou revogação do certificado ou não haver tomado em conta qualquer limitação com relação ao certificado.

Artigo 41º.- Obtenção dos dados de assinatura e certificado

Quem pretenda utilizar uma assinatura electrónica qualificada ou avançada deve, nos termos do nº 1 do artigo 66º, gerar ou obter os dados de criação e verificação de assinatura, bem como obter o respectivo certificado emitido por entidade certificadora nos termos deste diploma.

CAPÍTULO V.- Certificação

Secção I.- Certificação

Subsecção I.- Acesso à actividade de certificação

Artigo 42º.- Livre acesso à actividade de certificação

É livre o exercício da actividade de entidade certificadora, sendo facultativa a solicitação da credenciação regulada nos artigos 45º e seguintes.
Sem prejuízo do disposto no número anterior, as entidades certificadoras que emitam certificados qualificados devem proceder ao seu registo junto da autoridade credenciadora, nos termos a fi xar por portaria do Ministro responsável pelas Comunicações.
A credenciação e o registo estão sujeitos ao pagamento de taxas em função dos custos associados às tarefas administrativas, técnicas, operacionais e de fiscalização correspondentes, nos termos a fi xar por portaria conjunta dos Ministros responsáveis pelas Finanças e Comunicações, que constituem receita da autoridade credenciadora.

Artigo 43º.- Livre escolha da entidade certificadora

É livre a escolha da entidade certificadora.
A escolha de entidade determinada não pode constituir condição de oferta ou de celebração de qualquer negócio jurídico.

Artigo 44º.- Entidade competente para a credenciação

A credenciação de entidades certificadoras para efeitos do presente diploma compete à autoridade credenciadora.

Artigo 45º.- Credenciação da entidade certificadora

1. É concedida a credenciação de entidades certificadoras de assinaturas digitais, mediante pedido apresentado à autoridade credenciadora, a entidades que satisfaçam os seguintes requisitos:

a) Estejam dotadas de capital e meios fi nanceiros adequados;

b) Dêem garantias de absoluta integridade e independencia no exercício da actividade de certificação de assinaturas digitais;

c) Disponham de recursos técnicos e humanos que satisfaçam os padrões de segurança e de eficácia que sejam previstos na regulamentação a que se refere o artigo 89º;

d) Mantenham contrato de seguro válido para cobertura adequada da responsabilidade civil emergente da actividade de certificação.

2. A credenciação é válida pelo período de três anos, podendo ser objecto de renovação por períodos de igual duração.

Artigo 46º.- Pedido de credenciação

1. O pedido de credenciação de entidade certificadora de assinaturas electrónicas deve ser instruído com os seguintes documentos:

a) Estatutos da pessoa colectiva e, tratando-se de sociedade, contrato de sociedade;

b) Tratando-se de sociedade, relação de todos os sócios, com especifi cação das respectivas participações, bem como dos membros dos órgãos de administração e de fiscalização, e, tratándose de sociedade anónima, relação de todos os accionistas com participações significativas, directas ou indirectas;

c) Declarações subscritas por todas as pessoas singulares e colectivas referidas no nº 1 do artigo 48º de que não se encontram em nenhuma das situações indiciadoras de inidoneidade referidas no respectivo nº 2;

d) Prova do substrato patrimonial e dos meios financeiros disponíveis e, designadamente, tratando-se de sociedade, da realização integral do capital social;

e) Descrição da organização interna e plano de segurança;

f) Demonstração dos meios técnicos e humanos exigidos, nos termos do diploma regulamentar a que se refere a alínea c) do nº 1 do artigo 34º, incluindo certificados de conformidade dos produtos de assinatura electrónica emitidos por organismo reconhecido de certificação acreditado nos termos previstos no artigo 87º;

g) Designação do auditor de segurança;

h) Programa geral da actividade prevista para os primeiros três anos;

i) Descrição geral das actividades exercidas nos últimos três anos ou no tempo decorrido desde a constituição, se for inferior, e balanço e contas dos exercícios correspondentes;

j) Comprovação de contrato de seguro válido para cobertura adequada da responsabilidade civil emergente da actividade de certificação.

2. Se à data do pedido a pessoa colectiva não estiver constituída, o pedido é instruído, em substituição do previsto na alínea a) do número anterior, com os seguintes documentos:

a) Acta da reunião em que foi deliberada a constituição;

b) Projecto de estatutos ou contrato de sociedade;

c) Declaração de compromisso, subscrita por todos os fundadores, de que no acto de constituição, e como condição dela, estará integralmente realizado o substrato patrimonial exigido por lei.

3. As declarações previstas na alínea c) do nº 1 podem ser entregues em momento posterior ao pedido, nos termos e prazo que a autoridade credenciadora fixar.

4. Consideram-se como participações significativas, para os efeitos do presente diploma, as que igualem ou excedam 10% do capital da sociedade anónima.

5. O pedido de renovação de credenciação deve ser instruído com os seguintes documentos:

a) Programa geral da actividade prevista para os próximos três anos;

b) Descrição geral das actividades exercidas nos últimos três anos, e balanço e contas dos exercícios correspondentes;

c) Declaração que todos os elementos referidos no nº 1 e nos números 3 e 4 do artigo 83º não sofreram alteração desde a sua apresentação à autoridade credenciadora.

Artigo 47º.- Requisitos patrimoniais

As entidades certificadoras privadas, que sejam pessoas colectivas devem estar dotadas de capital social no valor mínimo previsto em portaria conjunta dos membros do Governo responsáveis pelas fi nanças e comunicações electrónicas, ou, não sendo sociedades, do substrato patrimonial equivalente.
O substrato patrimonial, e designadamente o capital social mínimo de sociedade, encontrar-se a sempre integralmente realizado à data da credenciação, se a pessoa colectiva estiver já constituída, ou será sempre integralmente realizado com a constituição da pessoa colectiva, se esta ocorrer posteriormente.

Artigo 48º.- Requisitos de idoneidade

1. Os membros dos órgãos de administração e fiscalização, os empregados, comitidos e representantes das entidades certificadoras com acesso aos actos e instrumentos de certificação, os sócios da sociedade e, tratando-se de sociedade anónima, os accionistas com participações significativas serão sempre pessoas de reconhecida idoneidade.

2. Entre outras circunstâncias atendíveis, considerase indiciador de falta de idoneidade o facto de a pessoa ter sido:

a) Condenada, no País ou no estrangeiro, por crime de furto, roubo, burla, burla informática e nas comunicações, extorsão, abuso de confiança, infidelidade, falsificação, falsas declarações, insolvência dolosa, insolvência negligente, favorecimento de credores, emissão de cheques sem provisão, abuso de cartão de garantia ou de crédito, apropriação ilegítima de bens do sector público ou cooperativo, administração danosa em unidade económica do sector público ou cooperativo, usura, suborno, corrupção, recepção não autorizada de depósitos ou otros fundos reembolsáveis, prática ilícita de actos ou operações inerentes à actividade seguradora ou dos fundos de pensões, branqueamento de capitais, abuso de informação, manipulação do mercado de valores mobiliários ou crime previsto no Código das Sociedades Comerciais;

b) Declarada, por sentença nacional ou estrangeira, falida ou insolvente ou julgada responsável por falência ou insolvência de empresa por ela dominada ou de cujos órgãos de administração ou fiscalização tenha sido membro;

c) Sujeita a sanções, no País ou no estrangeiro, pela prática de infracções às normas legais ou regulamentares que regem as actividades de produção, autenticação, registo e conservação de documentos, e designadamente as do notariado, dos registos públicos, do funcionalismo judicial, das bibliotecas públicas, e da certificação de assinaturas electrónicas qualificadas.

3. A falta dos requisitos de idoneidade previstos no presente artigo constitui fundamento de recusa e de revogação da credenciação, nos termos da alínea c) do nº 1 do artigo 52º e da alínea f) do nº 1 do artigo 54º.

Artigo 49º.- Auditor externo de segurança

As entidades certificadoras credenciadas devem ter um auditor externo de segurança de reconhecido mérito e idoneidade.
Ao auditor incumbe verificar e avaliar regularmente os equipamentos e sistemas utilizados na actividade de certificação, bem como emitir pareceres, sugestões e recomendações, com vista a assegurar a efi ciência, fiabilidade e segurança dos mesmos.
O auditor deve submeter à autoridade credenciadora, até 31 de Março de cada ano, um relatório anual de onde constem todos os dados relevantes para a fiscalização da eficiência, fiabilidade e segurança dos equipamentos e sistemas utilizados na actividade de certificação.
A designação do auditor de segurança está sujeita a aprovação prévia pela autoridade credenciadora.

Artigo 50º.- Seguro obrigatório de responsabilidade civil

O membro do Governo responsável pelas Finanças define, por Portaria, as características do contrato de seguro de responsabilidade civil a que se refere a alínea d) do nº 1 do artigo 45º.

Artigo 51º.- Decisão

A autoridade credenciadora pode solicitar dos requerentes informações complementares e proceder, por si ou por quem para o efeito designar, às averiguações, inquirições e inspecções que entenda necessárias para a apreciação do pedido.
A decisão sobre o pedido de credenciação deve ser notificada aos interessados no prazo de 15 dias úteis, a contar da recepção do pedido ou, se for o caso, a contar da recepção das informações complementares solicitadas ou da conclusão das diligências que entenda necessárias, não podendo no entanto exceder o prazo de seis meses sobre a data da recepção daquele.
A autoridade credenciadora pode incluir na credenciação condições adicionais desde que necessárias para assegurar o cumprimento das disposições legais e regulamentares aplicáveis ao exercício da actividade pela entidade certificadora.
A emissão da credenciação deve ser acompanhada da emissão pela autoridade credenciadora do certificado das chaves a ser usado pela entidade certificadora na emissão de certificados.
A credenciação é inscrita no registo a que se refere o nº 2 do artigo 42º e publicada na II Série do Boletim Oficial.

Artigo 52º.- Recusa de credenciação

1 A credenciação é recusada sempre que:

a) O pedido de credenciação não estiver instruído com todas as informações e documentos necessários;

b) A instrução do pedido enfermar de inexactidões ou falsidades;

c) A autoridade credenciadora não considerar demonstrado algum dos requisitos enumerados nos artigos 45º e 48º.

2 Se o pedido estiver deficientemente instruído, a autoridade credenciadora, antes de recusar a credenciação, notifica o requerente, dando-lhe prazo de 30 dias para suprir a deficiência.

Artigo 53º.- Caducidade da credenciação

1. A credenciação caduca nos seguintes casos:

a) Quando a actividade de certificação não seja iniciada no prazo de 12 meses após a recepção da notificação da credenciação;

b) Quando, tratando-se de pessoa colectiva, esta seja dissolvida, sem prejuízo dos actos necessários à respectiva liquidação;

c) Quando, findo o prazo de validade, a credenciação não tenha sido objecto de renovação.

2. A caducidade da credenciação é inscrita no registo a que se refere o número 2 do artigo 42º e publicada na II Série do Boletim Oficial.

Artigo 54º.- Revogação da credenciação

1. A credenciação é revogada, sem prejuízo de outras sanções aplicáveis nos termos da lei, quando se verifique alguma das seguintes situações:

a) Se tiver sido obtida por meio de falsas declarações ou outros expedientes ilícitos;

b) Se deixar de se verificar algum dos requisitos enumerados no artigo 45º;

c) Se a entidade cessar a actividade de certificação ou a reduzir para nível insignificante por período superior a 12 meses;

d) Se ocorrerem irregularidades graves na administração, organização ou fiscalização interna da entidade;

e) Se no exercício da actividade de certificação ou de outra actividade social forem praticados actos ilícitos que lesem ou ponham em perigo a confiança do público na certificação;

f) Se supervenientemente se verificar alguma das circunstâncias de inidoneidade referidas no artigo 48º em relação a qualquer das pessoas a que alude o seu nº 1;

g) Se os certificados do organismo de certificação referidos na alínea f) do nº 1 do artigo 46º tiverem sido revogados;

h) Qualquer modificação feita no estatuto social das Entidades Certificadoras.

2. A revogação da credenciação compete à autoridade credenciadora, em decisão fundamentada que deve ser notificada à entidade no prazo de 8 dias úteis.

3. A decisão de revogação é inscrita no registo a que se refere o nº 2 do artigo 42º e publicada na II Série do Boletim Oficial.

Artigo 55º.- Anomalias nos órgãos de administração e fiscalização

Se por qualquer motivo deixarem de estar preenchidos os requisitos legais e estatutários do normal funcionamento dos órgãos de administração ou fiscalização, a autoridade credenciadora fixa prazo para ser regularizada a situação.
Não sendo regularizada a situação no prazo fixado, é revogada a credenciação nos termos do artigo anterior.

Artigo 56º.- Registo informático dos certificados qualificados e conservação

As entidades certificadoras credenciadas devem organizar e manter, permanentemente actualizado, um registo informático dos certificados qualificados emitidos, suspensos, revogados ou caducados, o qual deve ser protegido contra alterações não autorizadas e estar acessível a qualquer pessoa para consulta, designadamente por meios informáticos.
As entidades certificadoras devem utilizar sistemas fiáveis de conservação dos certificados, de tal forma que:

a) A inserção de dados e alterações só possa ser feita por pessoas autorizadas;

b) Os certificados só possam ser consultados pelo público nos casos em que tenha sido obtido o consentimento do titular;

c) A autenticidade das informações contidas nos certificados possa ser verificada;

d) Quaisquer alterações de carácter técnico susceptíveis de afectar os requisitos de segurança do sistema possam ser imediatamente detectáveis.

Artigo 57º.- Comunicação de alterações

Devem ser comunicadas à autoridade credenciadora, no prazo de 30 dias, as alterações das entidades certificadoras relativas a:

a) Firma ou denominação;

b) Objecto;

c) Local da sede, salvo se a mudança ocorrer dentro do mesmo concelho ou para concelho limítrofe;

d) Substrato patrimonial ou património, desde que se trate de uma alteração significativa;

e) Estrutura de administração e de fiscalização;

f) Limitação dos poderes dos órgãos de administração e fiscalização;

g) Cisão, fusão e dissolução;

h) Qualquer modificação feita no estatuto social.

Artigo 58º.- Registo de alterações

O registo das pessoas referidas no nº 1 do artigo 48º deve ser solicitado à autoridade credenciadora no prazo de 15 dias após assumirem qualquer das qualidades Nele referidas, mediante pedido da entidade certificadora ou dos interessados, juntamente com as provas de que se encontram preenchidos os requisitos definidos no mesmo artigo, sob pena de a credenciação ser revogados.
Pode a entidade certificadora ou os interesados solicitar o registo provisório, antes da assunção por estes de qualquer das qualidades referidas no nº 1 do artigo 48º, devendo a conversão do registo em definitivo ser requerida no prazo de 30 dias a contar da designação, sob pena de caducidade.
Em caso de recondução, esta é averbada no registo, a pedido da entidade certificadora ou dos interessados.
O registo é recusado em caso de inidoneidade, nos termos do artigo 48º, e a recusa deve ser comunicada aos interessados e à entidade certificadora, a qual toma as medidas adequadas para que aqueles cessem imediatamente funções ou deixem de estar para com a pessoa colectiva na relação prevista no mesmo artigo, seguindose no aplicável o disposto no artigo 56º;
Sem prejuízo do que resulte de outras disposições legais aplicáveis, a falta de registo não determina por si só a invalidade dos actos jurídicos praticados pela pessoa em causa no exercício das suas funções.

Subsecção II.- Exercício da actividade de certificação

Artigo 59º.- Atribuição e deveres da entidade certificadora

1. A entidade certificadora tem por atribuição geral assegurar elevados níveis de segurança do sistema indispensável para a criação da confiança relativamente ás firmas electrónicas.

2. Compete à entidade certificadora que emite certificados qualificados:

a) Estar dotada dos requisitos patrimoniais estabelecidos no artigo 47º;

b) Oferecer garantias de absoluta integridade e independência no exercício da actividade de certificação;

c) Demonstrar a fiabilidade necessária para o exercício da actividade de certificação;

d) Manter um contrato de seguro válido para a cobertura adequada da responsabilidade civil emergente da actividade de certificação, nos termos previstos no artigo 50º;

e) Dispor de recursos técnicos e humanos que satisfaçam os padrões de segurança e eficácia, nos termos do diploma regulamentar;

f) Utilizar sistemas e produtos fiáveis protegidos contra qualquer modificação e que garantam a segurança técnica dos processos para os quais estejam previstos;

g) Adoptar medidas adequadas para impedir a falsificação ou alteração dos dados constantes dos certificados e, nos casos em que a entidade certificadora gere dados de criação de assinaturas, garantir a sua confidencialidade durante o processo de criação;

h) Utilizar sistemas fiáveis de conservação dos certificados, de forma que:

i) Os certificados só possam ser consultados pelo público nos casos em que tenha sido obtido o consentimento do seu titular;

ii) Apenas as pessoas autorizadas possam inserir dados e alterações aos certificados;

iii) A autenticidade das informações possa ser verificada; e

iv) Quaisquer alterações de carácter técnico susceptíveis de afectar os requisitos de segurança sejam imediatamente detectáveis.

i) Verificar rigorosamente a identidade dos requerentes titulares dos certificados e, tratando-se de representantes de pessoas colectivas, os respectivos poderes de representação, bem como, quando aplicável, as qualidades específi cas a que se refere a alínea i) do nº 1 do artigo 67º;

j) Conservar os elementos que comprovem a verdadeira identidade dos requerentes titulares de certificados com pseudónimo;

k) Informar os requerentes, por forma escrita, de modo completo e claro, sobre o processo de emissão de certificados qualificados e os termos e condições exactos de utilização do certificado qualificado, incluindo eventuais restrições à sua utilização;

l) Cumprir as regras de segurança para tratamento de dados pessoais estabelecidas na legislação respectiva;

m) Não armazenar ou copiar dados de criação de assinaturas do titular a quem a entidade certificadora tenha oferecido serviços de gestão de chaves;

n) Assegurar o funcionamento de um serviço que:

i) Permita a consulta, de forma célere e segura, do registo informático dos certificados emitidos, revogados, suspensos ou caducados; e

ii) Garanta, de forma imediata e segura, a revogação, suspensão ou caducidade dos certificados.

o) Proceder à publicação imediata da revogação ou suspensão dos certificados, nos casos previstos no presente diploma;

p) Assegurar que a data e hora da emissão, suspensão e revogação dos certificados possam ser determinadas através de validação cronológica;

q) Oferecer e facilitar os serviços de registo e estampado cronológico (Time-stamping digital- DTS) na transmissão e recepção de dados;

r) Conservar os certificados que emitir, por um período não inferior a 20 anos.

3. As entidades de certificação, previamente autorizadas pela entidade de credenciação, podem delegar nas unidade de registos a função de validação de identidade e de otros dados dos subscritores de certificados, bem como a função de registo das apresentações e dos trâmites que lhes sejam formulados.

Artigo 60º.- Validação cronológica

As entidades certificadoras credenciadas devem estar dotadas de um sistema de validação cronológica de documentos electrónicos, podendo o mesmo ser utilizado para a prestação de serviços ao público.
O sistema de validação cronológica é aprovado pela autoridade credenciadora, a qual deve verificar, em particular, a segurança, fiabilidade e idoneidade do método de aferição da data e hora.
A data e hora constantes de declaração de validação cronológica emitida por entidade credenciada são oponíveis entre as partes e perante terceiros.

Artigo 61º.- Protecção de dados

As entidades certificadoras só podem coligir dados pessoais necessários ao exercício das suas actividades e obtê-los directamente das pessoas interessadas na titularidade de pares de chaves e respectivos certificados, ou de terceiros junto dos quais aquelas pessoas autorizem a sua colecta.
Os dados pessoais coligidos pela entidade certificadora não podem ser utilizados para outra finalidade que não seja a de certificação, salvo se outro uso for consentido expressamente por lei ou pela pessoa interessada.
As entidades certificadoras e a autoridade credenciadora devem respeitar as normas legais vigentes sobre a protecção, tratamento e circulação dos dados pessoais e sobre a protecção da privacidade no sector das telecomunicações.
As entidades certificadoras devem comunicar à autoridade judiciária, sempre que esta o ordenar nos termos legalmente previstos, os dados relativos à identidade dos titulares de certificados que sejam emitidos com pseudónimo seguindo-se, no aplicável, o regime estabelecido na legislação processual penal.

Artigo 62º.- Responsabilidade civil

A entidade certificadora é responsável civilmente pelos danos sofridos pelos titulares dos certificados e quaisquer terceiros, em consequência do incumprimento culposo dos deveres decorrentes do presente diploma e sua regulamentação.
São nulas as convenções de exoneração e limitação da responsabilidade previstas no nº 1.
Sem prejuízo do disposto no número anterior, as entidades certificadoras não são responsáveis pelos prejuízos resultantes do uso de um certificado que ultrapasse os limites fixados para a sua utilização ou o valor das transacções para os quais o certificado possa ser utilizado, desde que tais limites tenham sido claramente levados ao conhecimento dos usuários através de declaração feita no próprio certificado.

Artigo 63º.- Declaração de práticas de certificação

Nenhuma entidade certificadora credenciada pode iniciar a actividade de emissão de certificados qualificados sem antes assegurar adequada publicidade à declaração de práticas de certificação, designadamente por meios informáticos.
A declaração de práticas de certificação deve obedecer a padrões internacionalmente reconhecidos, sem prejuízo da sua conformidade com as disposições da presente lei.
A declaração de práticas de certificação e as respectivas alterações devem ser submetidas à aprovação da autoridade credenciadora.

Artigo 64º.- Cessação da actividade

No caso de pretender cessar voluntariamente a sua actividade, a entidade certificadora deve comunicar essa intenção à autoridade credenciadora e às pessoas a quem tenha emitido certificados que permaneçam em vigor, com a antecipação mínima de três meses, indicando também qual a entidade certificadora à qual transmite a sua documentação ou a revogação dos certificados no termo daquele prazo, devendo neste último caso colocar a sua documentação à guarda da autoridade credenciadora.
A entidade certificadora que se encontre em risco de decretação de falência, de processo de recuperação de empresa ou de cessação da actividade por qualquer outro motivo alheio à sua vontade deve informar imediatamente a autoridade credenciadora.
No caso previsto no número anterior, se a entidade certificadora viera cessar a sua actividade, a autoridade credenciadora promove a transmissão da documentação daquela para outra entidade certificadora ou, se tal transmissão for impossível, a revogação dos certificados emitidos e a conservação dos elementos de tais certificados pelo prazo em que deveria fazê-lo a entidade certificadora.
A cessação da actividade de entidade certificadora que emite certificados qualificados é inscrita no registo a que se refere o nº 2 do artigo 32º e publicada na II Série do Boletim Oficial.

Artigo 65º.- Prestação de serviços de certificação por terceiros

Os serviços de certificação podem ser prestados e administrados total ou parcialmente por terceiros.
Para os fins do número anterior, as entidades de certificação devem demonstrar o seu vínculo contratual com a entidade de certificação que possua a a tecnologia.
A autoridade de credenciamento e de controle determina as condições sob as quais as entidades de certificação possam prestar seus serviços por intermédio de um terceiro.

Secção III.- Certificados

Artigo 66º.- Emissão dos certificados qualificados

A entidade certificadora emite, a pedido de uma pessoa singular ou colectiva interessada e a favor desta, os dados de criação e de verificação de assinatura ou, se tal for solicitado, coloca à disposição os meios técnicos necessários para que esta os crie, devendo sempre verificar, por meio legalmente idóneo e seguro, a identidade e, quando existam, os poderes de representação da requerente.
A entidade certificadora emite, a pedido do titular, uma ou mais vias do certificado e do certificado complementar.
A entidade certificadora deve tomar medidas adequadas para impedir a falsificação ou alteração dos dados constantes dos certificados e assegurar o cumprimento das normas legais e regulamentares aplicáveis recorrendo a pessoal devidamente habilitado.
A entidade certificadora fornece aos titulares dos certificados as informações necessárias para a utilização correcta e segura das assinaturas, nomeadamente as respeitantes:

a) Às obrigações do titular do certificado e da entidade certificadora;

b) Ao procedimento de aposição e verificação de assinatura;

c) À conveniência de os documentos aos quais foi aposta uma assinatura serem novamente assinados quando ocorrerem circunstancias técnicas que o justifiquem.

Artigo 67º.- Conteúdo dos certificados qualificados

1. O certificado qualifi cado deve conter, pelo menos, as seguintes informações:

a) Nome ou denominação do titular da assinatura e outros elementos necessários para uma identificação inequívoca e, quando existam poderes de representação, o nome do seu representante ou representantes habilitados, ou um pseudónimo do titular, claramente identificado como tal;

b) Nome e assinatura electrónica qualificada da entidade certificadora, bem como a indicação do país onde se encontra estabelecida;

c) Dados de verificação de assinatura correspondentes aos dados de criação de assinatura detidos pelo titular;

d) Número de série do certificado;

e) Início e termo de validade do certificado;

f) Identificadores de algoritmos utilizados na verifi cação de assinaturas do titular e da entidade certificadora;

g) Indicação de o uso do certificado ser ou não restrito a determinados tipos de utilização, bem como eventuais limites do valor das transacções para as quais o certificado é válido;

h) Limitações convencionais da responsabilidade da entidade certificadora, sem prejuízo do disposto no nº 2 do artigo 62º;

i) Eventual referência a uma qualidade específica do titular da assinatura, em função da utilização a que o certificado estiver destinado;

j) Indicação de que é emitido como certificado qualificado.

2. A pedido do titular podem ser incluídas no certificado ou em certificado complementar informações relativas a poderes de representação conferidos ao titular por terceiro, à sua qualifi cação profissional ou a outros atributos, mediante fornecimento da respectiva prova, ou com a menção de se tratar de informações não confirmadas.

Artigo 68º.- Suspensão de certificados qualificados

1. A entidade certificadora suspende o certificado:

a) A pedido do titular, devidamente identificado para o efeito;

b) Quando existam fundadas razões para crer que o certificado foi emitido com base em informações erróneas ou falsas, que as informações nele contidas deixaram de ser conformes com a realidade ou que a confidencialidade dos dados de criação de assinatura não está assegurada.

2. A suspensão com um dos fundamentos previstos na alínea b) do número anterior deve ser sempre motivada e comunicada no prazo máximo de 24 horas ao titular, bem como imediatamente inscrita no registo do certificado, podendo ser levantada quando se verifique que tal fundamento não corresponde à realidade.

Artigo 69º.- Revogação de certificados qualificados

1. A entidade certificadora revoga o certificado:

a) A pedido do titular, devidamente identificado para o efeito;

b) Quando, após suspensão do certificado, se confirme que o certificado foi emitido com base em informações erróneas ou falsas, que as informações nele contidas deixaram de ser conformes com a realidade, ou que a confidencialidade dos dados de criação de assinatura não está assegurada;

c) Quando a entidade certificadora cesse as suas actividades sem ter transmitido a sua documentação a outra entidade certificadora;

d) Quando a autoridade credenciadora ordene a revogação do certificado por motivo legalmente fundado;

e) Quando tomar conhecimento do falecimento, interdição ou inabilitação da pessoa singular ou da extinção da pessoa colectiva.

2. A decisão de revogação do certificado com um dos fundamentos previstos nas alíneas b), c), e d) do número 1, deve ser sempre fundamentada e comunicada ao titular, bem como imediatamente inscrita.

3. A revogação do certificado não tem efeitos retroactivos.

Artigo 70º.- Aspectos comuns da suspensão e revogação

A suspensão e a revogação do certificado são oponíveis a terceiros a partir da inscrição no registo respectivo, salvo se for provado que o seu motivo já era do conhecimento do terceiro.
A entidade certificadora conserva as informações referentes aos certificados durante um prazo não inferior a 20 anos a contar da suspensão ou revogação de cada certificado e facultá-las-á a qualquer interessado.
A revogação ou suspensão do certificado indicará a data e hora a partir das quais produzem efeitos, não podendo essa data e hora ser anterior àquela em que essa informação for divulgada publicamente.
A partir da suspensão ou revogação de um certificado, ou do termo do seu prazo de validade, é proibida a emissão de certificado referente aos mesmos dados de criação de assinatura pela mesma ou outra entidade certificadora.

Artigo 71º.- Obrigações do titular

O titular do certificado deve tomar todas as medidas de organização e técnicas que sejam necessárias para evitar danos a terceiros e para preservar a confidencialidade de toda a informação transmitida.
Em caso de dúvida quanto à perda de confidencialidade dos dados de criação de assinatura, o titular debe pedir a suspensão do certificado e, se a perda for confirmada, a sua revogação.
A partir da suspensão ou revogação de um certificado ou do termo do seu prazo de validade, é proibida ao titular a utilização dos respectivos dados de criação de assinatura para gerar uma assinatura electrónica.
Sempre que se verifiquem motivos que justifi quem a revogação ou suspensão do certificado, deve o respectivo titular efectuar, no prazo de 24 horas, o correspondente pedido de suspensão ou revogação à entidade certificadora.
As obrigações previstas no presente artigo aplicam-se, com as necessárias adaptações, a quem no certificado conste como representado.

Artigo 72º.- Certificados emitidos no exterior

1. Os certificados emitidos por entidades certificadoras sediadas no exterior são equiparados aos certificados qualificados emitidos por entidade certificadora estabelecida em Cabo Verde, desde que se verifique alguma das seguintes circunstâncias:

a) O certificado preencha os requisitos previstos para os certificados qualificados e seja garantido por entidade certificadora credenciada em Cabo Verde;

b) O certificado ou a entidade certificadora sejam reconhecidos em Cabo Verde em virtude de instrumento de direito internacional ou de acordo regional.

2. Nos casos a que se refere a alínea a) do número anterior, a entidade certificadora de Cabo Verde é responsável pelo certificado emitido no exterior nos mesmos termos em que o é pelos certificados qualificados que emite.

3. A autoridade credenciadora deve divulgar pelos meios de publicidade que considerar adequados, bem como facultar aos interessados, as informações de que dispuser acerca quer dos certificados emitidos por entidades certificadoras sediadas no exterior que sejam reconhecidos em Cabo Verde, quer, a pedido dos mesmos, das entidades certificadoras credenciadas em Estados estrangeiros.

CAPÍTULO VI.- Autoridade Credenciadora

Artigo 73º.- Designação de autoridade credenciadora

As funções de autoridade credenciadora são atribuídas à Agência Nacional das Comunicações.

Artigo 74º.- Competências da autoridade de credenciação

Compete à Autoridade de Credenciação:

a) Acreditar as entidades de certificação;

b) Controlar as entidades de certificação;

c) Cobrar taxas pelos serviços de acreditação;

d) Velar por que as entidades de certificação respondam pelo prejuízo causado a toda entidade ou pessoa física ou jurídica que se fi e razoavelmente nos certificados;

e) Auditar as entidades de certificação;

f) Velar por que os dispositivos de segurança de criação de assinaturas electrónicas sejam conformes às condiçoes previstas no artigo 28º;

g) Celebrar acordos reconhecimento mútuo com autoridades de credenciação de países estrangeiros, desde que previamente autorizada pelo departamento governamantal responsável pelas comunicações;

h) Manter informações na internet sobre a lista de entidades de certificação, e a suspensão e revogação de certificados digitais, bem como sobre os demais aspectos relevantes da certificação;

i) Definir os requisitos técmicos que qualifiquem a idoneidade de actividades desenvolvidas pelas entidades de certificação;

j) Avaliar as actividades desenvolvidas pelas entidades de certificação autorizadas conforme os requisitos técnicos definidos nos termos da alínea anterior;

k) Velar pelo adequado funcionamento e eficiente prestação de serviço por parte de entidades de certificação em conformidade com as disposições legais e regulamantares da actividade;

l) O mais que lhe for cometido por lei.

Artigo 75º .- Outros poderes da autoridade de credenciação

A autoridade de credenciação pode exigir dos prestadores de serviços que armazenem informações fornecidas pelos destinatários de seus serviços que ajam com as precauções que deles se possam razoavelmente esperar, a fim de detectar e impedir atividades ilícitas, conforme viera ser definido em lei.

Artigo 76º.- Suspensão e revogação do credenciamento das entidades certificadoras

O credenciamento da entidade certificadora é suspenso sempre que a entidade certificadora falte gravemente com as obrigações previstas no presente diploma.
A autoridade credenciadora suspende o credenciamento por um período máximo de um mês após ouvida a entidade certificadora.
Em caso de reincidência ou de falta grave à suas obrigações, o credenciamento é revogado.

CAPÍTULO VII.- Regime Sancionatório e Fiscalização

Secção I.- Regime sancionatório

Artigo 77º.- Regime sancionatório

Sem prejuízo de outras consequências legalmente previstas e da responsabilidade civil e criminal que ao caso couber, a violação ou incumprimento das disposições do presente diploma.

Artigo 78º.- Sanções

1. As infracções cometidas no âmbito do presente diploma são punidas com as seguintes sanções:

a) Coima de 1. 000.000$00 (um milhão de escudos) a 5.000.000$00 (cinco milhão de escudos), pela violação do disposto nos artigos 59º, 61º e 67º.

b) Coima de 500.000$00 (quinhentos mil escudos) a 2500.000$00 (dois milhões e quinhentos mil escudos), pela violação do disposto nos artigos 49º, 63º, 64º, 83º, nº s 2 e 3;

c) Coima de 40.000$00 (quarenta mil escudos) a 150 000$00 (cento e cinquenta mil escudos) nos restantes casos.

2. A emissão de certificados com a designação de qualificados sem que tenha sido dado cumprimento ao disposto no nº 2 do artigo 42º é punida nos termos da alínea a) do número anterior.

Artigo 79º.- Sanções acessórias

Às contra-ordenações acima previstas pode ser aplicada a sanção acessória de apreensão de bens que sejam veículo da prática da infracção.
Em função da gravidade da infracção, da culpa do agente ou da prática reincidente das infracções, pode ser aplicada, simultaneamente com as coimas previstas no artigo anterior, a sanção acessória de encerramento do estabelecimento ou revogação da do certificado.

Artigo 80º.- Publicidade

Pode dar-se adequada publicidade à punição por contra-ordenação, bem como às sanções acessórias aplicadas nos termos do presente diploma.

Artigo 81º.- Destino das coimas

O montante das coimas cobradas reverte para o Estado e para a entidade que as aplicou na proporção de 60 % e 40%, respectivamente.

Artigo 82º.- Competência autoridade de supervisão ou credenciadora

Compete à autoridade de supervisão ou credenciadora instaurar e instruir os procedimentos relativos às infracções previstas no presente diploma, bem como a aplicação das respectivas sanções.

Secção II.- Fiscalização

Artigo 83º.- Fiscalização

A autoridade credenciadora pode proceder à inspecção dos estabelecimentos utilizados na actividade de certificação e ao exame, no local, de documentos, objectos, equipamentos e procedimentos operacionais, podendo no decorrer da inspecção fazer as cópias e registos que sejam necessários.
As entidades certificadoras devem fornecer à autoridade credenciadora, de modo pronto e exaustivo, todas as informações que ela lhes solicite para fins de fiscalização da sua actividade.
As entidades certificadoras credenciadas devem comunicar à autoridade credenciadora, no prazo máximo de 48 horas, quaisquer alterações aos elementos referidos nos artigos 55º e 56º, bem como todas as situações que determinem ou possam vir a determinar a cessação da respectiva actividade.
Até ao último dia útil de cada semestre, as entidades certificadoras credenciadas devem enviar à autoridade credenciadora uma versão actualizada das relações referidas na alínea b) do nº 1 do artigo 46º.

Artigo 84º.- Dever de comunicar

As pessoas ou entidades que prestem serviços de auditoria às entidades certificadoras credenciadas devem comunicar à autoridade credenciadora as infracções que detectem no exercício das suas funções, bem como a ocorrência de situações que possam pôr em causa a eficiência, fiabilidade e segurança dos equipamentos e sistemas utilizados na actividade de certificação.

Artigo 85º.- Recursos

Nos recursos interpostos das decisões tomadas pela autoridade supervisora ou credenciadora no exercício dos seus poderes de credenciação, supervisão e fiscalização, presume-se, até prova em contrário, que a suspensão da eficácia determina grave lesão do interesse público.

Artigo 86º.- Colaboração das autoridades

A autoridade credenciadora pode solicitar às autoridades policiais e judiciárias e a quaisquer outras autoridades e serviços públicos toda a colaboração ou auxílio que julgue necessários para a credenciação e fiscalização da actividade de certificação.

CAPÍTULO VIII.- Disposições finais e transitórias

Artigo 87º.- Organismos de certificação

A conformidade dos produtos de assinatura electrónica com os requisitos técnicos a que se refere a alínea c) do nº 1 do artigo 45º é verifi cada e certificada pelo organismo de certificação acreditado no âmbito do Sistema Cabo-Verdiano de Qualidade.

Artigo 88º.- Regimes criptográficos especiais

As disposições desta lei não prejudicam a aplicação de nenhum texto relativo ao regime do material de guerra, armas e munições, ou aos meios criptográfi cos especialmente concebidos para fins de defesa ou segurança nacional.

Artigo 89º.- Normas regulamentares

A regulamentação do presente diploma, nomeadamente no que se refere às normas de carácter técnico e de segurança, deve constar de Decreto Regulamentar, a adoptar no prazo de 150 dias.
Os serviços e organismos da Administração Pública podem emitir normas regulamentares relativas aos requisitos a que devem obedecer os documentos que recebam por via electrónica.

Artigo 90º.- Endereços electrónicos dos serviços públicos

O Governo determina quais os serviços públicos que devem disponibilizar um endereço electrónico para efeitos de contactos por parte de empresários e consumidores, em matérias pertinentes ao exercício de actividades comerciais, bem como o prazo e forma de publicitação de tais endereços.

Artigo 91º.- Remissões

Consideram-se efectuadas para o presente diploma as remissões feitas para o Decreto-Lei nº 49/2003, de 24 de Novembro.

Artigo 92º – O alargamento para três do número farmácias por Revogação

É revogado o Decreto-Lei nº 49/2003, de 24 de Novembro.

Artigo 93º.- Entrada em vigor

O presente diploma entra em vigor no dia seguinte ao da sua publicação.

Visto e aprovado em Conselho de Ministros.

José Maria Pereira Neves

Manuel Inocêncio Sousa

Cristina Duarte

José Brito

José Manuel Gomes Andrade

Promulgado em 13 de Setembro de 2007.

Publique-se.

O Presidente da República, PEDRO VERONA RODRIGUES PIRES

Referendado em 17 de Setembro de 2007.

O Primeiro-Ministro, José Maria Pereira Neves

04Jul/18

Código Penal de Cabo Verde (aprovado pelo Decreto Legislativo n° 4/2003 de 18 de Novembro de 2003).

4 julio, 2018CódigoCódigo Penal de Cabo Verde, Decreto Legislativo n° 4/2003 de 18 de Novembro de 2003, Derecho Informático, Legislación Informática Cabo VerdeJosé Cuervo

Código Penal (aprovado pelo Decreto Legislativo n° 4/2003 de 18 de Novembro de 2003).

TITULO II.- CRIMES CONTRA O PATRIMÓNIO

CAPITULO III.- CRIMES CONTRA O PATRIMÓNIO EM GERAL

SECÇÃO I.- BURLAS E ABUSO DE INCAPAZES

Artigo 212.° (Burla informática)

Será punido nos termos do artigo 210.° quem obtiver, para si ou para terceiro, vantagem ilícita, com prejuízo patrimonial para outra pessoa, interferindo no resultado de tratamento de dados ou mediante estruturação incorrecta de programa informático, utilização incorrecta ou incompleta de dados, utilização de dados sem autorização ou intervenção por qualquer outro modo não autorizada no processamento.

TITULO VI.- CRIMES CONTRA A ORDEM PUBLICA E A SEGURANÇA COLECTIVA

CAPITULO II.- CRIMES CONTRA A SEGURANÇA COLECTIVA

Artigo 304.° (Atentado contra comunicações e outros serviços essenciais)

1 – Quem destruir, danificar ou inutilizar, subtrair ou desviar coisa ou energia, impedindo ou perturbando, desse modo, a exploração de serviços de comunicações ou de fornecimento ao público de água, electricidade ou energia, e criando perigo para a vida ou para a integridade física de outrem, ou, ainda, para bens patrimoniais alheios de elevado valor, será punido com pena de prisão de 2 a 8 anos.

2 – Na mesma pena incorrerá quem criar o perigo referido no número anterior, destruindo, danificando ou inutilizando instalações para aproveitamento, produção, armazenamento, condução ou distribuição de água, electricidade, gás, óleo, gasolina ou energia.

3 – Se o perigo for causado por negligência, a pena será de prisão de 1 a 4 anos.

4 – Se a conduta mencionada nos n.°s 1 e 2 for levada a cabo com negligência, a pena será de prisão até 3 anos ou de multa de 80 a 200 dias.

02Jul/18

A0624

2 julio, 2018Certificados RevistaJosé Cuervo

A0624

02Jul/18

A0627

2 julio, 2018Certificados RevistaJosé Cuervo

A0627

02Jul/18

A0629

2 julio, 2018Certificados RevistaJosé Cuervo

A0629

02Jul/18

A0630

2 julio, 2018Certificados RevistaJosé Cuervo

A0630

02Jul/18

A0631

2 julio, 2018Certificados RevistaJosé Cuervo

A0631

02Jul/18

A0632

2 julio, 2018Certificados RevistaJosé Cuervo

A0632

02Jul/18

A0634

2 julio, 2018Certificados RevistaJosé Cuervo

A0634

02Jul/18

A0637

2 julio, 2018Certificados RevistaJosé Cuervo

A0637

02Jul/18

A0638

2 julio, 2018Certificados RevistaJosé Cuervo

A0638

02Jul/18

A0642

2 julio, 2018Certificados RevistaJosé Cuervo

A0642

02Jul/18

A0647

2 julio, 2018Certificados RevistaJosé Cuervo

A0647

02Jul/18

A0646

2 julio, 2018Certificados RevistaJosé Cuervo

A0646

02Jul/18

A0645

2 julio, 2018Certificados RevistaJosé Cuervo

A0645

02Jul/18

A0644

2 julio, 2018Certificados RevistaJosé Cuervo

A0644

02Jul/18

A0643

2 julio, 2018Certificados RevistaJosé Cuervo

A0643

02Jul/18

A0641

2 julio, 2018Certificados RevistaJosé Cuervo

A0641

02Jul/18

A640

2 julio, 2018Certificados RevistaJosé Cuervo

A0640

02Jul/18

A0639

2 julio, 2018Certificados RevistaJosé Cuervo

A0639

02Jul/18

A0636

2 julio, 2018Certificados RevistaJosé Cuervo

A0636

02Jul/18

A0635

2 julio, 2018Certificados RevistaJosé Cuervo

A0635

02Jul/18

A0633

2 julio, 2018Certificados RevistaJosé Cuervo

A0633

02Jul/18

A0628

2 julio, 2018Certificados RevistaJosé Cuervo

A0628

02Jul/18

A0626

2 julio, 2018Certificados RevistaJosé Cuervo

A0626

02Jul/18

A0625

2 julio, 2018Certificados RevistaJosé Cuervo

A0625

02Jul/18

A0623

2 julio, 2018Certificados RevistaJosé Cuervo

02Jul/18

A0622

2 julio, 2018Certificados RevistaJosé Cuervo

02Jul/18

A0621

2 julio, 2018Certificados RevistaJosé Cuervo

A0621

02Jul/18

A0620

2 julio, 2018Certificados RevistaJosé Cuervo

A0620

02Jul/18

A0619

2 julio, 2018Certificados RevistaJosé Cuervo

A0619

02Jul/18

A0618

2 julio, 2018Certificados RevistaJosé Cuervo

A0618

02Jul/18

A0617

2 julio, 2018Certificados RevistaJosé Cuervo

A0617

02Jul/18

A0616

2 julio, 2018Certificados RevistaJosé Cuervo

A0616

01Jul/18

Número 19, primer semestre de 2018

1 julio, 2018RevistaCertificado Revista Electrónica Informática Jurídica, Número 19, primer semestre de 2018José Cuervo

ISSN 1989-5852
Título clave: Revista informática jurídica
Tít. abreviado: Rev. inform. jurid.

Introducción
Batista Avila, Yordan
Casí Ladrón de Guevara, Yosvanys
Castro Dieguez, Fidel Enrique
Equipo de formación Áudea
Fernández, Plácida
Figueredo Leon, Angel Enrique
Fonseca Hernández, Juan Antonio
Fornaris Montero, Danilo
García Pérez, Celia Maliuska
González Mojena, Yanetsys
Hechavarría Derronselet, Yoendris
Márquez Delgado, José Eduardo
Martínez Álvarez, Manuel Jacinto
Medel Viltres, Yamira
Medela, Marina
Moratilla, José Carlos
Palacio Ramírez, Luis Alberto
Plá Hernández, Omar
Reinaldo Filho, Demócrito
Rodríguez Ramírez, María Isabel
Saavedra, Fernando
Sala Simón, Iker
Vázquez Riverón, Arelys
Verdecia Jiménez, Liusvani Victor
Zato, Cristina
Avila Aguilera, Yadira de la Caridad
Guerra Cantero, Lisbert Milagros
Incencio Piñeiro, Grettel Susel
León Fonseca, Marcos Antonio
López Tamayo, Pedro Ángel
Martínez, Antonio
Martínez Pérez, Elena
Muñiz Maldonado, Noralys
Rodrigo, Borja
Ron Zambrano, Marlon
Vásconez Silva, Daniel

Introducción

En este decimonoveno número de la Revista, aparecen artículos de colaboradores por orden alfabético.

Un agradecimiento especial a los 19 colaboradores que han aportado sus artículos para hacer posible la publicación semestral de esta revista, que ya lleva 9 años y medio

Un cordial saludo para todos y gracias por vuestra colaboración.

José Cuervo Álvarez

Avila Aguilera, Yadira de la Caridad

Sitio web aprendiendo openoffice: Una alternativa para desarrollar la cultura informática en los estudiantes de la Universidad(31.01.2018) (Trabajo en colaboración con Yordan Batista Avila y Pedro Ángel López Tamayo)

Batista Avila, Yordan

Sitio web aprendiendo openoffice: Una alternativa para desarrollar la cultura informática en los estudiantes de la Universidad(31.01.2018) (Trabajo en colaboración con Yadira de la Caridad Avila Aguilera y Pedro Ángel López Tamayo)

Fonseca Hernández, Juan Antonio

Árboles y su implementación en Object Pascal (31.01.2018) (Trabajo en colaboración con Noralys Muñiz Maldonado y Marcos Antonio León Fonseca)
Archivos de recursos y de configuración en Delphi (31.01.2018) (Trabajo en colaboración con Marcos Antonio León Fonseca y Noralys Muñoz Maldonado)

Guerra Cantero, Lisbert Milagros

Sistema de gestión de información de las Actividades estratégicas en la Dirección Municipal de Planificación Física del Municipio Bartolomé Masó (10.05.2018) (Trabajo en colaboración con Ing. Elena Martínez Pérez e Ing. Grettel Susel Incencio Piñeiro)
Sistema de gestión de la información de los procesos de recibo y molinería en la UEB Faustino Vega (31.05.2018) (Trabajo en colaboración con Ing. Elena Martínez Pérez e Ing. Grettel Susel Incencio Piñeiro)
Sistema de gestión para el control de los portadores energéticos en la empresa de Servicios Técnicos e Industriales de Manzanillo (30.06.2018) (Trabajo en colaboración con Ing. Elena Martínez Pérez e Ing. Grettel Susel Incencio Piñeiro)

Incencio Piñeiro, Grettel Susel

Sistema de gestión de información de las Actividades estratégicas en la Dirección Municipal de Planificación Física del Municipio Bartolomé Masó (10.05.2018) (Trabajo en colaboración con Ing. Elena Martínez Pérez e Ing. Lisbert Milagros Guerra Cantero)
Sistema de gestión de la información de los procesos de recibo y molinería en la UEB Faustino Vega (31.05.2018) (Trabajo en colaboración con Ing. Elena Martínez Pérez e Ing. Lisbert Milagros Guerra Cantero)
Sistema de gestión para el control de los portadores energéticos en la empresa de Servicios Técnicos e Industriales de Manzanillo (30.06.2018) (Trabajo en colaboración con Ing. Elena Martínez Pérez e Ing. Lisbert Milagros Guerra Cantero)

León Fonseca, Marcos Antonio

Árboles y su implementación en Object Pascal (31.01.2018) (Trabajo en colaboración con Noralys Muñiz Maldonado y Juan Antonio Fonseca Hernández)
Archivos de recursos y de configuración en Delphi (31.01.2018) (Trabajo en colaboración con Juan Antonio Fonseca Hernández y Noralys Muñoz Maldonado)

López Tamayo, Pedro Ángel

Sitio web aprendiendo openoffice: Una alternativa para desarrollar la cultura informática en los estudiantes de la Universidad(31.01.2018) (Trabajo en colaboración con Yordan Batista Avila y Yadira de la Caridad Avila Aguilera)

Martínez, Antonio

Responsable GRC. Áudea Seguridad de la Información

Seguridad en la gestión de proveedores o encargados de tratamiento. ISO/IEC 27018 y RGPD (21.03.2018)

Martínez Pérez, Elena

Sistema de gestión de información de las Actividades estratégicas en la Dirección Municipal de Planificación Física del Municipio Bartolomé Masó (10.05.2018) (Trabajo en colaboración con Ing. Grettel Susel Incencio Piñeiro e Ing. Lisbert Milagros Guerra Cantero)
Sistema de gestión de la información de los procesos de recibo y molinería en la UEB Faustino Vega (31.05.2018) (Trabajo en colaboración con Ing. Grettel Susel Incencio Piñeiro e Ing. Lisbert Milagros Guerra Cantero)
Sistema de gestión para el control de los portadores energéticos en la empresa de Servicios Técnicos e Industriales de Manzanillo (30.06.2018) (Trabajo en colaboración con Ing. Grettl Susel Incencio Piñeiro e Ing. Lisbert Milagros Guerra Cantero)

Medela, Marina

Departamento Legal de Áudea Seguridad de la Información

Data brokers, mercaderes de la intimidad (14 de febrero de 2018)
El conflicto de intereses del DPO (14 de febrero de 2018)

Moratilla, José Carlos

Departamento Legal. Áudea Seguridad de la Información

Reglamento General de Protección de Datos (RGPD) : Cara B / Pista 1 (21.03.2018)
Reglamento General de Protección de Datos (RGPD) : Cara B / Pista 2 (21.03.2018)

Muñiz Maldonado, Noralys

Árboles y su implementación en Object Pascal (31.01.2018) (Trabajo en colaboración con Marcos Antonio León Fonseca y Juan Antonio Fonseca Hernández)
Archivos de recursos y de configuración en Delphi (31.01.2018) (Trabajo en colaboración con Marcos Antonio León Fonseca y Juan Antonio Fonseca Hernández)

Reinaldo Filho, Demócrito

A nova Lei Alemã que obriga provedores de Redes Sociais a remover conteúdo publicado por usuários. Um modelo para o Brasil? (31.01.2018)

Rodrigo, Borja

Cibersecurity Departament de Áudea Seguridad de la Información

Criptomonedas: Bitcoin y su funcionamiento (14 de febrero de 2018)

Ron Zambrano, Marlon

Estudiante de Derecho de la Universidad Central de Ecuador (UCE)

Retos que plantean las nuevas tecnologías en los conflictos armados (13 de abril de 2018) (Trabajo en colaboración con Daniel Vasconez Silva)

Saavedra, Fernando

Cibersecurity Manager. Responsable Ciberseguridad de Áudea Seguridad de la Información

Artículo de Opinión relacionado con el Nuevo OWASP Top 10 2017
Seguridad en SDLC (10.05.2018)
Doble factor de autenticación (10.05.2018)

Vásconez Silva, Daniel

Estudiante de Derecho de la Universidad Central de Ecuador (UCE)

Retos que plantean las nuevas tecnologías en los conflictos armados (13 de abril de 2018) (Trabajo en colaboración con Marlon Ron Zambrano)

Vázquez Riverón, Arelys

Gestión de información del combustible en la empresa eléctrica Granma (10.05.2018)

Zato, Cristina

Departamento Legal. Áudea Seguridad de la Información.

El inolvidable derecho al olvido (21.03.2018)

12Jun/18

The Law of Mongolia on Telecommunications, October 18, 2001

12 junio, 2018Ley, Mongolia2001, Derecho Informático, Legislación de Mongolia, October 18, The Law of Mongolia on TelecommunicationsJosé Cuervo

The Law of Mongolia on Telecommunications, October 18, 2001 (Amended by the aw of May 15, 2003, the Law of January 27, 2005, the Law of December 19, 2008, the Law of July 08, 2010, the Law of December 15, 2011, the Law of July 01, 2014)

October 18, 2001 Ulaan baatar

CHAPTER ONE.- GENERAL PROVISIONS

Article 1. Purpose of this Law

1.1 The purpose of this Law is to regulate relations between State, citizen and legal persons engaged in the creation, utilization and protection of communications network in Mongolia.

Article 2. Legislation on communications

2.1 The legislation on communications is comprised of the Constitution of Mongolia, this law and other acts of legislations consistent with those laws.

2.2 If an international treaty to which Mongolia is a party is inconsistent with this law, then the provisions of the international treaty shall prevail.

Article 3. Definitions of terms

3.1 In this law the below mentioned terms shall have the following meanings:

3.1.1 “Line” means any conductors (such as wire, capacity) used for broadcasting, transmitting and receiving information and complex of insulators, ducts, poles, towers and other materials used for their protection.

3.1.2 “Network” means a set of lines used for broadcasting, transmitting and receiving information between two or more users, furthermore a device system for receiving, sorting, transporting and delivering mail.

3.1.3 “Operation” means the repair, maintenance, testing and adjustment of communications network for its sustainable functioning.

3.1.4 “Service” means a delivery of service providing satisfaction of communications and information demands of customers through communications network.

3.1.5“Provider” means a legal person or citizen holding license for communications universal service.

(This subparagraph was amended by the Law of May 15, 2003)

3.1.6 “Customer” means a citizen or legal person having the right to purchase service in the contract of communications service.

3.1.7 “point of interconnection” means an interconnection point of lines and networks between operators, and operator and customer.

3.1.8 “Universal service obligations” meansin the frame work of state policy, a delivery of telecommunications’ essential service to population of remote areas and areas without service access, at real cost.

3.1.9 “Universal service obligations fund” means assets accumulated for implementation of Universal service obligation.

(Subparagraph amended by the Law of May 15, 2003)

3.1.10 “Communications” means all types of technology for telecommunications, radio and television broadcasting, postal service and information as well.

(Subparagraph amended by the Law of May 15, 2003)

3.1.11 “Telecommunications service” means transmission of all kinds of information through telecommunications network.

(Subparagraph amended by the Law of May 15, 2003)

3.1.12 “Integrated numbering plan” means numerical meanings of codes for identifying international, domestic or local networks and subscribers as well as calling directions.

(Subparagraph amended by the Law of May 15, 2003)

3.1.13 “Number portability service” means service allows user to transfer with the number which is using at the present, while quits from account of one telecommunication service provider and registers to other telecommunication service provider.

(Subparagraph added by the Law of July 01, 2014)

CHAPTER TWO.- POWERS OF STATE BODIES IN RELATION TO TELECOMMUNICATIONS

Article 4. Powers of State Ih Hural

4.1 The State Ih Hural shall elaborate the State policy on communications.

Article 5. Powers of Government

5.1 The Government shall exercise the following full powers on communications:

5.1.1 implement the State policy on communications, organize applications of the legislation on communications;

5.1.2 set up Communications Regulatory Commission and ratify its Charter.

5.1.3 establish Universal Service Obligations Fund and approve procedure of its disbursement.

Article 6. Powers of the State administrative body in charge of telecommunication

(Title added by the Law of January 27, 2005 and amended by the Law of December 19, 2008)

6.1 The State administrative body in charge of telecommunication shall exercise the following powers:

(Provision amended by the Law of January 27, 2005 and by the Law of December 19, 2008)

6.1.1 to implement legislation and decisions of the Government on communications;

6.1.2 to elaborate policy on Communications

6.1.3 to formulate policy on creation of competition in communications market;

6.1.4 to approve procedures on establishment of costs for regulatory service to license holders;

6.1.5 to approve the integrated numbering plan

6.1.6 to elaborate policy on universal service obligations , monitor its implementation

6.1.7. to ensure reliability, immediate- responding and quality of communications service and monitor security protection of communications and correspondences privacy

6.1.8. to develop policy on qualified manpower in communications sector

(Subparagraph amended by the Law of May 15, 2003)

6.1.9. to organize scientific research, to plan and develop technical, technological, organizational plans to ensure stability work of state owned major network in frame of implementation of policy

(Subparagraph amended by the Law of December 19, 2008)

6.1.10. to develop projects, assessment and analyze in purpose to expand and development of the state owned major network according to the strategic plans

(Subparagraph amended by the Law of December 19, 2008)

6.1.11. to manage investment of the state owned major network, to conclude network operation agreements with providers

(Subparagraph amended by the Law of December 19, 2008)

6.1.12. to accumulate capital in universal service fund, spend it in intended purpose, report the implementation to the Prime Minister

(Subparagraph amended by the Law of December 19, 2008)

6.1.13. to provide professional and methodical assistance to state administration, administrative units and relevant organizations in purpose of implementation of the state policy on communication

(Subparagraph amended by the Law of December 19, 2008)

6.1.14 other powers stipulated in the Legislation.

(Paragraph amended by the Law of May 15, 2003 and by the Law of December 19, 2008)

6.2 Authorized body, which is appointing and dismissing agree on designated candidates for administration of fully and partially state owned legal entities which is providing communication service shall consent with state administrative body in charge of communication.

(Paragraph amended by the Law of January 27, 2005 and by the Law of December 19, 2008)

Article 7. Powers of Governors at all territorial levels

7.1. Governors at each territorial level shall exercise the following powers on communications:

7.1.1 to undertake measures to improve communications service on their territories in collaboration with relevant authorities.

7.1.2 to approve and monitor schedules of mail delivery in their territories; to undertake measures for allocation of identifiable addresses in each street, square, building, apartment and fence in the capital city, subprovince (soum), district, subdivision (bag) and subdistrict (khoroo).

(Subparagraph edited by the Law of May 15, 2003)

7.1.3 to organize rehabilitation works of damages and deficiencies in communications network due to emergence case of natural disaster and force majeure.

(Subparagraph edited by the Law of May 15, 2003)

7.1.4 to support and assist initiatives to establish and utilize radio, television and other communications networks;

(Subparagraph edited by the Law of May 15, 2003)

7.1.5. other powers stipulated in the legislation.

(Subparagraph edited by the Law of May 15, 2003)

Article 8. Communications Regulatory Commission

8.1. The Regulatory Commission for Communications /hereinafter “Regulatory Commission“/ shall work with duties to develop effective and fair competition environment for market participants such as business entity of all type property, citizen, to issue license, to make professional analysis and decisions.

(Paragraph amended by the Law of December 15, 2011)

8.2. The Regulatory Commission shall consist of the Chairman and nonexecutive 6 Members.

8.3. The Prime Minister nominates Chairman and members of Regulatory Commission.

(Paragraph amended by the Law of January 27, 2005 and the Law of December 19, 2008)

8.4. The term of office of both the Chairman and Members shall be 6 years. Terms of the first nomination of Members of Regulatory Commission shall be 2,4 and 6 years, and further they shall be nominated for a 6 year term.

8.5. The Chairman of Regulatory Commission can be re-nominated for one more term.

8.6 Persons to be nominated as the Chairman and the Members of Regulatory Commission shall be citizens of Mongolia, who have worked by their profession minimum 5 years and met the following requirements:

8.6.1 Having university degree in legal, economics, information communications, management or technical field; highly qualified and experienced, skillful organizer.

8.6.2 The Chairman and Members of the Regulatory Commission shall not be persons who posses 20 or more than 20 per cent of common stock of the service provider or persons with common interests with the late.

8.7. The Chairman and Members of the Commission shall have rights of State Inspectors.

8.8. The Regulatory Commission shall have working staff.

8.9. The Regulatory Commission shall have local sub-councils comprised of onexecutive members.

8.10. The Regulatory Commission shall be funded by fees for regulatory services provided to licensees and payments for use of radio frequencies and other services.

8.11. The Government shall ratify the annual budget of Regulatory Commission. The Regulatory Commission shall report to the Government its budget performance and work each year.

8.12. The Regulatory Commission shall have its financial report audited and published annually.

8.13. The Regulatory Commission’s some duties that provided by the law could be carried out by others on the basis of a contract.

(Paragraph added by the Law of July 01, 2014)

Article 9. Powers of Regulatory Commission

9.1 The Regulatory Commission shall exercise the following powers:

9.1.1 to furnish authorized organizations with information and develop proposals on the State policy on communications;

9.1.2 to grant, suspend and revoke licenses, monitor applications of license conditions and requirements, establish contracts within the framework of policies on communications;

(Subparagraph amended by the Law of December 15, 2011)

9.1.3 to determine technical conditions and requirements for equipment of communications network and customers, and certify;

9.1.4 to approve general terms of interconnection agreements between networks and procedures of revenue distribution;

9.1.5 to approve accounting methodologies for service tariffs, monitor service tariffs dominating at the market;

9.1.6 to create conditions for fair competition in communications sector;

9.1.7 to ensure implementation of universal service obligations;

9.1.8 to work out communications standards, have them duly approved by relevant authorities, and monitor their applications;

9.1.9 to elaborate an integrated numbering plan of networks and implement it;

9.1.10 to make radio frequency allocations and conduct monitoring;

9.1.11 to determine regulatory service fees stipulated in 6.1.4 of this Law.

9.1.12 to settle various disputes between license holder and customers within its specified powers.

9.1.13 to introduce (domesticate), manage, implement the number portability service, to approve relevant regulation to this service

(Subparagraph added by the Law of July 01, 2014)

9.1.14 other powers stipulated in the legislation

(Subparagraph amended by the Law of July 01, 2014)

Article 10. The Post Telecommunications Authority

(Article repealed by the Law of December 19, 2008)

CHAPTER THREE.- UNIVERSAL SERVICE OBLIGATION FUND

Article 11 Universal Service Obligations Fund

11.1. The Universal Service Obligations Fund shall be accumulated and disbursed with purpose of construction of new networks, expansion and renovation of existing network, providing necessary telecommunications service to remote areas and populations without access.

11.2. The Universal Service Obligations Fund shall be formed from the following sources:

11.2.1. donation, loan and aid grants;

11.2.2. others

11.3. Universal Service Obligations Fund shall be disbursed only for purposes stipulated in article 1.1. of this Law.

CHAPTER FOUR.- LICENSE

Article 12 License

12.1 The Regulatory Commission shall grant a license to a legal person and citizen planning to conduct the following activities on the territory of Mongolia:

12.1.1 to provide service specified in article 15.8.7 of Law on licensing.

(Subparagraph amended by the Law of May 15, 2003)

12.1.2. to use radio frequency and radio spectrum

(Subparagraph amended by the Law of May 15, 2003)

12.1.3. (Subparagraph repealed by the Law of May 15, 2003)

12.2 A term of licenses shall not exceed 20 years.

12.3 The Regulatory Commission shall register communications service, operation and manufacturing by citizens or legal persons except the mentioned in the 12.1 of the Law.

Article 13. Documents for applications for license

13.1 The citizen and legal person applying for license shall forward to the Regulatory Commission its application with documents spelled out in the law.

13.2 The application for license shall enclose documents stipulated in the legislation, and additionally shall enclose the following documents:

13.2.1 Accounting and information on the applicant’s capability in finance, economic and technical resources as well as in professional capacity;

13.2.2 Information on its activities. (Coverage of its service, location, technology and tariff offer.)

Article 14. Issuance of license and refusal of license application

14.1 If the Regulatory Commission grants the license, then it shall conclude contract with the licensee. The Contract includes:

14.1.1 specific region to be covered and service access;

14.1.2 technological specifications of communications lines, network and equipment;

14.1.3 prevention measures and obligations in case of emergency circumstances of war and natural calamities;

14.1.4 pre-conditions for the interconnection;

14.1.5 rights and duties of the Regulatory Commission and the licensee.

14.1.6 other.

14.2 The license applied for shall be refused by the Regulatory Commission if:

14.2.1 there is not radio frequency bandwidth which the applicant requested for;

14.2.2 The applicant has not been furnished with financialeconomical, technical and professional capacity required to set up and operate communications network;

14.2.3 safety or interest and national securities aspects would be prejudiced as a result of license being granted;

14.3 If several applications are submitted for a license for one area then there shall be selection tendering.

Article 15. Revoking a license

15.1 Apart from those provisions specified in the Law on licensing, the Regulatory Commission shall be entitled to revoke licenses if:

15.1.1 The Licensee fails to comply with its obligations under the Communications laws and contract.

15.1.2 The Licensee discloses privacy of communications and correspondences relations;

15.1.3 The Licensee has not started its business specified in the license for 1 year since its issuance.

15.1.4 The Licensee conducts activities not specified in the Law and contract.

15.2 The Regulatory Commission shall not be liable for any claim for damages derived from the revocation of license under the provision of Article 15.1;

15.3 If there is disagreement in connection to revocation and suspension of license, any claim shall be submitted to the Court.

CHAPTER FIVE.- COMMUNICATIONS NETWORK

Article 16. Types of communications network

16.1 Communications network shall consist of telecommunications, postal service, radio and television broadcasting and information /Internet, computer and other/ networks.

16.2 Communications network shall be classified as public service and internal or special usage networks according to their purposes;

Article 17 . Telecommunications network

17.1 Telecommunications network includes all lines, equipment and other facilities required for transmission or reception of signs, signals, sounds, images and other information between customers.

17.2 Backbone telecommunications network means public network which consists of international and domestic long distance transmission, and international long distance switching facilities. The Backbone network may belong to State property.

17.3 The possessor of telecommunications network shall organize a network through integrated technical and technological management, which operates without interruptions.

17.4 The backbone network may be constructed and possessed by all type property entity and individuals.

Article 18. Postal service network

18.1. All postal network, its usage, service related relations shall be regulated by the Law.

(Paragraph amended by the Law of May 15, 2003)

Article 19. Radio and Television Broadcasting network

19.1Radio and Television broadcasting network comprise of all equipment and facilities required for transmission or reception of radio and television broadcasts.

19.2 The radio and television broadcasting network shall be used by the program producers of radio and television broadcasting on the basis of contract with the service- provider

Article 20. Communications network for special purpose

20.1 For the purpose to ensure defense and security of Mongolia and to keep civil protection, criminal and social orders, state or local administrative bodies shall establish and operate communications network for special purpose.

20.2 The communications network for special purpose shall be under protection of the State.

20.3 The Government of Mongolia shall determine proce contract concluded with the operator- service provider.

20.5 Confidentiality and protection of the information of communications for special purpose during transmission through communications network shall be carried by the body specified in Article 20.1.

Article 21. Communications network for internal purpose

21.1 Any enterprise and business entity may establish and operate communications network for internal needs, which allows prompt coordination of its technological management.

21.2 Based on the license issued by the Regulatory Commission it shall be allowed to be interconnected to backbone telecommunications network and provide service.

Article 22. Connections to communications network

22.1 The possessor of network for special and internal purposes, and possessor of newly constructed network shall bear all responsibility in respect to additional lines and equipment required to demarcation points of interconnection with network possessed by other persons.

22.2 Within its technical capability, the operator shall provide conditions for connections of other network to own network without any hindrance.

22.3 The network demarcation point shall be determined by the Regulatory Commission.

Article 23. Mobilization of communications network

23.1 Pursuant to the event of imposition of war and martial law, or extreme natural emergency conditions in Mongolia, the communications network shall be mobilized in accordance with the legislation.

CHAPTER SIX.- RIGHTS AND OBLIGATIONS OF SERVICE PROVIDER AND CUSTOMER

Article 24. Responsibilities of service provider

24.1 Rights, obligations and responsibilities of the service providers and customers shall be regulated by contract in accordance with the Civil Code.

Article 25. Provider’s rights and obligations.

25.1 The Provider shall enjoy the following rights:

25.1.1 To determine tariff for communication services on the basis of method provided by the Regulatory Commission.

25.1.2 To cease provision of the service and terminate contract if the customer fails to fulfill contract obligations.

25.1.3 Other rights specified in the contact.

25.2 The service provider shall have the following obligations:

25.2.1 to ensure to the provision to customer without discrimination, of reliable service in accordance with the license.

25.2.2 to be subject to provisions and rules of technical and technological requirements as well as standards of communications operations, service and expansion;

25.2.3 to notify in advance both the Regulatory Commission and customers on any new replacement, expansion, modification of service and temporary interruption of communications equipment.

25.2.4 To protect and keep privacy of all information and data transmitted through communications network.

25.2.5 allow usage of the network by others without any prevention in accordance with the legislation in the case of circumstances stipulated in Article 23.1 of this Law;

25.2.6 not to interrupt communications service except those fixed in the legislation, to bear all responsibility under the Civil Law if any loss occurred to customers.

25.2.7 to give required information to the Regulatory Commission on specified time.

25.2.8 to connect authorized bodies to the communication network, to provide conditions to use it in accordance regulation specified in article 9.1.1. of Law on intelligence activities

(Subparagraph added by the Law of July 08, 2010)

25.2.9. to compose technical conditions of telecommunication number portability within providers .

(Subparagraph added by the Law of July 01, 2014)

25.2.10. other powers stipulated by the law and contract.

(Provision added by the Law of July 08, 2010 and by the Law of July 01, 2014)

25.3 The employee of service providing body shall have free access to maintain and repair its own communications lines, network housed in the premises of state-protected enterprises and organizations.

25.4. (Paragraph repealed by the Law of May 15, 2003)

Article 26. Rights and obligations of customers

26.1 The customer shall have the following rights:

26.1.1 to select and use the certified equipment, which complies with standards and technical requirements of communications network.

26.1.2 to demand the repair of deficiencies occurred in communications network on the time specified in contract and get information on it.

26.1.3 to claim compensation under the Civil Code if stopped the service or did not operate the equipment for reason other than specified in article 23.1 of this Law.

(Provision amended by the Law of May 15, 2003)

26.1.4 Other rights stipulated in the Contract.

26.2 The customer shall have the following obligations:

26.2.1 to protect communications network and equipment housed in the customer’s premises or region, and notify service providers on any damages or deficiencies occurred or to be occurred.

26.2.2 to pay charges for communications service in time specified in the Contract.

26.2.3 to use certified equipment compatible to requirements given by communications service providers.

26.2.4 Other obligations stipulated in the Contract.

CHAPTER SEVEN.- PROTECTION OF COMMUNICATIONS NETWORK

Article 27. Obligations of legal entity, organization and citizen

27.1 The business entity, organization and citizen shall have the following duties in regard to the protection of communications network:

27.1.1 obtain permission from the service provider for setting up links and networks, constructing facilities, surveying and mapping of engineering lines and network furthermore in the case of replacement, conduct such work at own expenses.

27.1.2 obtain identifiable address and code from post office and if any modification, update on time.

(Subparagraph repealed by the Law of May 15, 2003)

27.1.3 to refrain from posting any explosives (weapons, gunpowder, bullets, etc) or radioactive and flammable items (gasoline, fuel, spirits, acid, alkali, etc) and other items prohibited by the customs clearance.

(Subparagraph repealed by the Law of May 15, 2003)

Article 28. Protection of rights of way

28.1. “Protection of rights of way of communications” means an area of land and space designated for communications network assigned from the integrated Land fund of Mongolia. The dimensions of protection rights of way shall be as follows:

28.1.1 an area 10 meters on either side of all open-air lines;

28.1.2 an area 5 meters on either side of all cable lines

28.1.3 an area within 300 meters radius of a station established for transmission via microwave station or satellite;

28.1.4 any area considered harmful to humans because of the capacity of radio and television transmitting equipment and radio frequency generators.

28.2 In accordance with their respective powers, the Central State administrative body and local government shall resolve all aspects in regard to the rights of way of communications network.

Article 29. Control over protection of rights of ways

29.1 The rights of ways of communications shall under control of service provider.

29.2 The signs indicating rights of ways of communications shall be erected along directions of the lines.

29.3 It shall be prohibited to carry out the following works on the rights of ways:

29.3.1 construction of building, erection of ger and fence, and cultivation of trees.

29.3.2 disposal of any heavy items, leakage of chemical and caustic substances, which may cause serious damages to, cables.

29.3.3 to pass across open-air lines with transportation with excessively tall load.

29.4 If the performer of order is entitled to carry out works on rights of ways of communications, then he/she shall obtain approval from service provider of such actions.

29.5 The performer of order on rights of ways of communications after completion of works on them shall take actions to restore and refurbish the site to its original state at own expenses.

CHAPTER EIGHT.- SUPERVISION AND LIABILITIES

Article 30. Control over communications operations, services and manufacturing

30.1 The State Communications inspectors shall conduct control over and inspect compliance with the legislation, technical and technological standards in process of communications operations, services and manufacturing.

30.2 The State Communications inspectors in addition to powers specified in the Law of State control and inspection shall have the following powers:

30.2.1 to monitor adherence of the legislation of communications and radio frequency, and issuance of licenses, and control and inspect of performance;

30.2.2 to inspect implementation and adherence of the relevant technological norms and rules, standards and technical requirements and other legal provisions governing communications operations, services and manufacturing;

30.2.3 to terminate unlicensed communications operations, services and manufacturing and unregistered usage of radio frequency.

Article 31. Adjudicating

31.1 The Regulatory Commission and its branch, representative offices shall be entitled within their competence to settle disputes among licensees, and licensee and customer.

31.2 If the licensee or customer is not agree to settlement of disputes as mentioned in clause 1 of this article he/she shall have right to submit complaint to the Court.

Article 32. Liability for breach of the Law

32.1 If an infringement of the legislation is held not constitute a criminal offence, state inspectors on communications shall impose on the offending person the following administrative penalties:

32.1.1any person who causes damage to any communications equipment installed on common use territories shall be fined between 10000-25000 tugrugs, and business entity or organization shall be fined between 100000- 250000 tugrugs.

32.1.2 any person during survey and mapping activities of building and facilities, and engineering lines and network has cut and moved without prior permission communications lines, network housed on that site, and as result of such work made damage to lines, network (communications cables, open-air lines, subscriber cable box, built-in wires, transformer, ducts, post office box, etc.) and made out of order, shall be fined in the case of citizen or officials between 25 000-35 000 tugrugs, in the case of business entity and organization shall be fined between 150 000-250 000 tugrugs.

32.1.3 any person who dismantles or defaces any sign erected along communications lines and network, or causes damage to communications poles, or leaves extraneous items in cable box, manholes, ducts or post office box shall be fined between 3 000 to 10 000 tugrugs, and in the case of business entity and organization shall be fined between 30 000 to 150 000 tugrugs.

32.1.4 any person who has made without license an interconnection to communications network, using interconnection acquired transmitted information, and conducted communications operations and service, then such activities shall be terminated immediately, shall be fined between 10 000 to 35 000 tugrugs, and in the case of business entity and organization shall be fined between 50 000 to 250 000 tugrugs.

32.1.5 any person who breaches Article 29.3 and 29.4 of this Law shall be fined between 5 000 to 35 000 tugrugs, and in the case of business entity and organization shall be fined between 150 000 to 250 000 tugrugs.

32.1.6any person who breaches Article 25.2.6 of this Law shall be fined between 5 000 to 35 000 tugrugs, and in the case of business entity and organization shall be fined between 100 000 to 250 000 tugrugs.

(Subparagraph amended by the Law of May 15, 2003)

32.1.7any person who breaches Article 25.2.2 and 25.2.3 shall be fined between 15 000 to 25 000 tugrugs, and in the case of business entity and organization shall be fined between 100 000 to 200 000 tugrugs.

(Subparagraph amended by the Law of May 15, 2003)

Article 33. Compensation for damage

33.1 Damages caused by the guilty party by infringement of the communications legislation shall be compensated in accordance with legislation.

CHAIRMAN OF STATE IH HURAL OF MONGOLIA

TUMUR.S

16May/18

Constitution of the Republic of Serbia 2006.

16 mayo, 2018Constitución, SerbiaConstitution of the Republic of Serbia 2006., Derecho Informático, Legislación de SerbiaJosé Cuervo

Considering the state tradition of the Serbian people and equality of all

citizens and ethnic communities in Serbia,

Considering also that the Province of Kosovo and Metohija is an

integral part of the territory of Serbia, that it has the status of a substantial autonomy

within the sovereign state of Serbia and that from such status of the Province of

Kosovo and Metohija follow constitutional obligations of all state bodies to uphold and

protect the state interests of Serbia in Kosovo and Metohija in all internal and foreign

political relations,

the citizens of Serbia adopt

CONSTITUTION OF THE REPUBLIC OF SERBIA

SECTION ONE.- CONSTITUTION PRINCIPLES

Republic of Serbia

Article 1

Republic of Serbia is a state of Serbian people and all citizens who

live in it, based on the rule of law and social justice, principles of civil democracy,

human and minority rights and freedoms, and commitment to European principles

and values.

Sovereignty holders

Article 2

Sovereignty is vested in citizens who exercise it through referendums,

people’s initiative and freely elected representatives.

No state body, political organization, group or individual may usurp the

sovereignty from the citizens, nor establish government against freely expressed will

of the citizens.

Rule of law

Article 3

Rule of law is a fundamental prerequisite for the Constitution which is

based on inalienable human rights.

The rule of law shall be exercised through free and direct elections,

constitutional guarantees of human and minority rights, separation of power,

independent judiciary and observance of Constitution and Law by the authorities.

Division of power

Article 4

The legal system is unique.

Government system shall be based on the division of power into

legislative, executive and judiciary.

Relation between three branches of power shall be based on balance

and mutual control.

Judiciary power shall be independent.

Political parties

Article 5

The role of political parties in democratic shaping of the political will of

the citizens shall be guaranteed and recognized.

Political parties may be established freely.

Activities of political parties aiming at forced overthrow of

constitutional system, violation of guaranteed human or minority rights, inciting racial,

national or religious hatred, shall be prohibited.

Political parties may not exercise power directly or submit it to their

control.

Prohibition of the conflict of interests

Article 6

No person may perform a state or public function in conflict with their

other functions, occupation or private interests.

The presence of conflict of interest and liability for its resolution shall

be regulated by the Constitution and Law.

Coat of arms, flag and national anthem

Article 7

The Republic of Serbia shall have coat of arms, flag and national

anthem.

The coat of arms of the Republic of Serbia shall be used in the form of

the Large Coat of Arms and Small Coat of Arms.

The flag of the Republic of Serbia shall exist and be used as the

National Flag and State Flag.

National anthem of the Republic of Serbia shall be official song «Bože

pravde».

Appearance and use of the coat of arms, flag and national anthem

shall be regulated by law.

Territory and border

Article 8

The territory of the Republic of Serbia is inseparable and indivisible.

The border of the Republic of Serbia is inviolable and may be altered

in a procedure applied to amend the Constitution.

Capital City

Article 9

The capital city of the Republic of Serbia is Belgrade.

Language and script

Article 10

Serbian language and Cyrillic script shall be in official use in the

Republic of Serbia.

Official use of other languages and scripts shall be regulated by the

law based on the Constitution.

Secularity of the State

Article 11

The Republic of Serbia is a secular state.

Churches and religious communities shall be separated from the

state.

No religion may be established as state or mandatory religion.

Provincial autonomy and local self-government

Article 12

State power is restricted by the right of citizens to provincial autonomy

and local self-government.

The right of citizens to provincial autonomy and local self-government

shall be subjected only to supervision of constitutionality and legality.

Protection of citizens and Serbs abroad

Article 13

The Republic of Serbia shall protect the rights and interests of its

citizens in abroad.

The Republic of Serbia shall develop and promote relations of Serbs

living abroad with the kin state.

Protection of national minorities

Article 14

The Republic of Serbia shall protect the rights of national minorities.

The State shall guarantee special protection to national minorities for

the purpose of exercising full equality and preserving their identity.

Gender equality

Article 15

The State shall guarantee the equality of women and men and

develop equal opportunities policy.

International relations

Article 16

The foreign policy of the Republic of Serbia shall be based on

generally accepted principles and rules of international law.

Generally accepted rules of international law and ratified international

treaties shall be an integral part of the legal system in the Republic of Serbia and

applied directly.

Ratified international treaties must be in accordance with the

Constitution.

Status of foreign nationals

Article 17

Pursuant to international treaties, foreign nationals in the Republic of

Serbia shall have all rights guaranteed by the Constitution and law with the exception

of rights to which only the citizens of the Republic of Serbia are entitled under the

Constitution and law.

SECTION TWO.- HUMAN AND MINORITY RIGHTS AND FREEDOMS

Fundamental Principles

Direct implementation of guaranteed rights

Article 18

Human and minority rights guaranteed by the Constitution shall be

implemented directly.

The Constitution shall guarantee, and as such, directly implement

human and minority rights guaranteed by the generally accepted rules of

international law, ratified international treaties and laws. The law may prescribe

manner of exercising these rights only if explicitly stipulated in the Constitution or

necessary to exercise a specific right owing to its nature, whereby the law may not

under any circumstances influence the substance of the relevant guaranteed right.

Provisions on human and minority rights shall be interpreted to the

benefit of promoting values of a democratic society, pursuant to valid international

standards in human and minority rights, as well as the practice of international

institutions which supervise their implementation.

Purpose of constitutional guarantees

Article 19

Guarantees for inalienable human and minority rights in the

Constitution have the purpose of preserving human dignity and exercising full

freedom and equality of each individual in a just, open, and democratic society based

on the principle of the rule of law.

Restriction of human and minority rights

Article 20

Human and minority rights guaranteed by the Constitution may be

restricted by the law if the Constitution permits such restriction and for the purpose

allowed by the Constitution, to the extent necessary to meet the constitutional

purpose of restriction in a democratic society and without encroaching upon the

substance of the relevant guaranteed right.

Attained level of human and minority rights may not be lowered.

When restricting human and minority rights, all state bodies,

particularly the courts, shall be obliged to consider the substance of the restricted

right, pertinence of restriction, nature and extent of restriction, relation of restriction

and its purpose and possibility to achieve the purpose of the restriction with less

restrictive means.

Prohibition of discrimination

Article 21

All are equal before the Constitution and law.

Everyone shall have the right to equal legal protection, without

discrimination.

All direct or indirect discrimination based on any grounds, particularly

on race, sex, national origin, social origin, birth, religion, political or other opinion,

property status, culture, language, age, mental or physical disability shall be

prohibited.

Special measures which the Republic of Serbia may introduce to

achieve full equality of individuals or group of individuals in a substantially unequal

position compared to other citizens shall not be deemed discrimination.

Protection of human and minority rights and freedoms

Article 22

Everyone shall have the right to judicial protection when any of their

human or minority rights guaranteed by the Constitution have been violated or

denied, they shall also have the right to elimination of consequences arising from the

violation.

The citizens shall have the right to address international institutions in

order to protect their freedoms and rights guaranteed by the Constitution.

Human Rights and Freedoms

Dignity and free development of individuals

Article 23

Human dignity is inviolable and everyone shall be obliged to respect and

protect it.

Everyone shall have the right to free development of his personality if this

does not violate the rights of others guaranteed by the Constitution.

Right to life

Article 24

Human life is inviolable.

There shall be no death penalty in the Republic of Serbia.

Cloning of human beings shall be prohibited.

Inviolability of physical and mental integrity

Article 25

Physical and mental integrity is inviolable.

Nobody may be subjected to torture, inhuman or degrading treatment or

punishment, nor subjected to medical and other experiments without their free consent.

Prohibition of slavery, servitude and forced labour

Article 26

No person may be kept in slavery or servitude.

All forms of human trafficking are prohibited.

Forced labour is prohibited. Sexual or financial exploitation of person

in unfavourable position shall be deemed forced labour.

Labour or service of persons serving sentence of imprisonment if their

labour is based on the principle of voluntarity with financial compensation, labour or

service of military persons, nor labour or services during war or state of emergency in

accordance with measures prescribed on the declaration of war or state of

emergency, shall not be considered forced labour.

Right to freedom and security

Article 27

Everyone has the right to personal freedom and security. Depriving of

liberty shall be allowed only on the grounds and in a procedure stipulated by the law.

Any person deprived of liberty by a state body shall be informed promptly

in a language they understand about the grounds for arrest or detention, charges brought

against them, and their rights to inform any person of their choice about their arrest or

detention without delay.

Any person deprived of liberty shall have the right to initiate proceedings

where the court shall review the lawfulness of arrest or detention and order the release if

the arrest or detention was against the law.

Any sentence which includes deprivation of liberty may be proclaimed

solely by the court.

Treatment of persons deprived of liberty

Article 28

Persons deprived of liberty must be treated humanely and with

respect to dignity of their person.

Any violence towards persons deprived of liberty shall be prohibited.

Extorting a statement shall be prohibited.

Special Rights in Case of Arrest and Detention without Decision

of the Court

Article 29

Any person deprived of liberty without decision of the court shall be

informed promptly about the right to remain silent and about the right to be questioned only

in the presence of a defense counsel they chose or a defense counsel who will provide

legal assistance free of charge if they are unable to pay for it.

Any person deprived of liberty without a decision of the court must be

brought before the competent court without delay and not later than 48 hours, otherwise

they shall be released.

Detention

Article 30

Any person under reasonable doubt of committing a crime may be

remanded to detention only upon the decision of the court, should detention be necessary

to conduct criminal proceedings.

If the detainee has not been questioned when making a decision on

detention or if the decision on holding in detention has not been carried out immediately

after the pronouncement, the detainee must be brought before the competent court within

48 hours from the time of sending to detention which shall reconsider the decision on

detention.

A written decision of the court with explanation for reasons of detention

shall be delivered to the detainee not later than 12 hours after pronouncing. The court shall

decide on the appeal to decision detention and deliver it to the detainee within 48 hours.

Duration of detention

Article 31

The court shall reduce the duration of detention to the shortest period

possible, keeping in mind the grounds for detention. Sentencing to detention under a

decision of the court of first instance shall not exceed three months during investigation,

whereas higher court may extend it for another three months, in accordance with the law. If

the indictment is not raised by the expiration of the said period, the detainee shall be

released.

The court shall reduce the duration of detention after the bringing of

charges to the shortest possible period, in accordance with the law.

Detainee shall be allowed pre-trial release as soon as grounds for

remanding to detention cease to exist.

Right to a fair trial

Article 32

Everyone shall have the right to a public hearing before an independent

and impartial tribunal established by the law within reasonable time which shall pronounce

judgement on their rights and obligations, grounds for suspicion resulting in initiated

procedure and accusations brought against them.

Everyone shall be guaranteed the right to free assistance of an interpreter

if the person does not speak or understand the language officially used in the court and the

right to free assistance of an interpreter if the person is blind, deaf, or dumb.

The press and public may be excluded from all or part of the court

procedure only in the interest of protecting national security, public order and morals in a

democratic society, interests of juveniles or the protection of private life of the parties, in

accordance with the law.

Special rights of persons charged with criminal offense

Article 33

Any person charged with criminal offense shall have the right to be

informed promptly, in accordance with the law, in the language which this person

understands and in detail about the nature and cause of the accusation against him, as

well as the evidence against him.

Any person charged with criminal offense shall have the right to defend

himself personally or through legal counsel of his own choosing, to contact his legal

counsel freely and to be allowed adequate time and facilities for preparing his defense.

Any person charged with criminal offense without sufficient means to pay

for legal counsel shall have the right to a free legal counsel when the interests of justice so

require and in compliance with the law.

Any person charged with criminal offense available to the court shall have

the right to a trial in his presence and may not be sentenced unless he has been given the

opportunity to a hearing and defense.

Any person prosecuted for criminal offense shall have the right to present

evidence in his favour by himself or through his legal counsel, to examine witnesses

against him and demand that witnesses on his behalf be examined under the same

conditions as the witnesses against him and in his presence.

Any person prosecuted for criminal offense shall have the right to a trial

without undue delay.

Any person charged or prosecuted for criminal offense shall not be

obligated to provide self-incriminating evidence or evidence to the prejudice of persons

related to him, nor shall he be obliged to confess guilt.

Any other natural person prosecuted for other offences punishable by law

shall have all the rights of a person charged with criminal offense pursuant to the law and

in accordance with it.

Legal certainty in criminal law

Article 34

No person may be held guilty for any act which did not constitute a criminal

offence under law or any other regulation based on the law at the time when it was

committed, nor shall a penalty be imposed which was not prescribed for this act .

The penalties shall be determined pursuant to a regulation in force at the

time when the act was committed, save when subsequent regulation is more lenient for the

perpetrator. Criminal offences and penalties shall be laid down by the law.

Everyone shall be presumed innocent for a criminal offence until convicted

by a final judgement of the court.

No person may be prosecuted or sentenced for a criminal offence for

which he has been acquitted or convicted by a final judgement, for which the charges have

been rejected or criminal proceedings dismissed by final judgement, nor may court ruling

be altered to the detriment of a person charged with criminal offence by extraordinary legal

remedy. The same prohibitions shall be applicable to all other proceedings conducted for

any other act punishable by law.

In special cases, reopening of proceedings shall be allowed in accordance

with criminal legislation if evidence is presented about new facts which could have

influenced significantly the outcome of proceedings had they been disclosed at the time of

the trial, or if serious miscarriage of justice occurred in the previous proceedings which

might have influenced its outcome.

Criminal prosecution or execution of punishment for a war crime,

genocide, or crime against humanity shall not be subject to statute of limitation.

Right to rehabilitation and compensation

Article 35

Any person deprived of liberty, detained or convicted for a criminal offence

without grounds or unlawfully shall have the right to rehabilitation and compensation of

damage by the Republic of Serbia, as well as other rights stipulated by the law.

Everyone shall have the right to compensation of material or non-material

damage inflicted on him by unlawful or irregular work of a state body, entities exercising

public powers, bodies of the autonomous province or local self-government.

The law shall stipulate conditions under which the injured party may

demand compensation for damage directly from the person that inflicted the damage.

Right to equal protection of rights and legal remedy

Article 36

Equal protection of rights before courts and other state bodies, entities

exercising public powers and bodies of the autonomous province or local self-government

shall be guaranteed.

Everyone shall have the right to an appeal or other legal remedy against

any decision on his rights, obligations or lawful interests.

Right to legal person

Article 37

Everyone shall have legal capacity.

Upon becoming of age all persons shall become capable of deciding

independently about their rights and obligations. A person becomes of age after turning 18.

A person may choose and use personal name and name of their children

freely.

Right to citizenship

Article 38

Acquiring and terminating citizenship of the Republic of Serbia shall be

regulated by the law.

A citizen of the Republic of Serbia may not be expelled or deprived of

citizenship or the right to change it.

Any child born in the Republic of Serbia shall have the right to citizenship of

the Republic of Serbia unless conditions have been met to acquire citizenship of some

other country.

Freedom of movement

Article 39

Everyone shall have the right to free movement and residence in the

Republic of Serbia, as well as the right to leave and return.

Freedom of movement and residence, as well as the right to leave the

Republic of Serbia may be restricted by the law if necessary for the purpose of conducting

criminal proceedings, protection of public order, prevention of spreading contagious

diseases or defense of the Republic of Serbia.

Entry and stay of foreign nationals in the Republic of Serbia shall be

regulated by the law. A foreign national may be expelled only under decision of the

competent body, in a procedure stipulated by the law and if time to appeal has been

provided for him and only when there is no threat of persecution based on his race,

sex, religion, national origin, citizenship, association with a social group, political

opinions, or when there is no threat of serious violation of rights guaranteed by this

Constitution.

Inviolability of home

Article 40

A person’s home shall be inviolable.

No one may enter a person’s home or other premises against the will of

their tenant nor conduct a search in them. The tenant of the home or other premises shall

have the right to be present during the search in person or through his legal representative

together with two other witnesses who may not be under age.

Entering a person’s home or other premises, and in special cases

conducting search without witnesses, shall be allowed without a court order if necessary

for the purpose of immediate arrest and detention of a perpetrator of a criminal offence or

to eliminate direct and grave danger for people or property in a manner stipulated by the

law.

Confidentiality of letters and other means of communication

Article 41

Confidentiality of letters and other means of communication shall be

inviolable.

Derogation shall be allowed only for a specified period of time and based

on decision of the court if necessary to conduct criminal proceedings or protect the safety

of the Republic of Serbia, in a manner stipulated by the law.

Protection of personal data

Article 42

Protection of personal data shall be guaranteed.

Collecting, keeping, processing and using of personal data shall be

regulated by the law.

Use of personal data for any the purpose other the one were collected for

shall be prohibited and punishable in accordance with the law, unless this is necessary to

conduct criminal proceedings or protect safety of the Republic of Serbia, in a manner

stipulated by the law.

Everyone shall have the right to be informed about personal data

collected about him, in accordance with the law, and the right to court protection in

case of their abuse.

Freedom of thought, conscience and religion

Article 43

Freedom of thought, conscience, beliefs and religion shall be guaranteed,

as well as the right to stand by one’s belief or religion or change them by choice.

No person shall have the obligation to declare his religious or other beliefs.

Everyone shall have the freedom to manifest their religion or religious

beliefs in worship, observance, practice and teaching, individually or in community with

others, and to manifest religious beliefs in private or public.

Freedom of manifesting religion or beliefs may be restricted by law only if

that is necessary in a democratic society to protect lives and health of people, morals of

democratic society, freedoms and rights guaranteed by the Constitution, public safety and

order, or to prevent inciting of religious, national, and racial hatred.

Parents and legal guardians shall have the right to ensure religious

and moral education of their children in conformity with their own convictions.

Churches and religious communities

Article 44

Churches and religious communities are equal and separated from the

state.

Churches and religious communities shall be equal and free to organize

independently their internal structure, religious matters, to perform religious rites in public,

to establish and manage religious schools, social and charity institutions, in accordance

with the law.

Constitutional Court may ban a religious community only if its activities

infringe the right to life, right to mental and physical health, the rights of child, right to

personal and family integrity, public safety and order, or if it incites religious, national or

racial intolerance.

Conscientious objection

Article 45

No person shall be obliged to perform military or any other service

involving the use of weapons if this opposes his religion or beliefs.

Any person pleading conscientious objection may be called upon to fulfill

military duty without the obligation to carry weapons, in accordance with the law.

Freedom of thought and expression

Article 46

The freedom of thought and expression shall be guaranteed, as well as the

freedom to seek, receive and impart information and ideas through speech, writing, art or

in some other manner.

Freedom of expression may be restricted by the law if necessary to protect

rights and reputation of others, to uphold the authority and objectivity of the court and to

protect public health, morals of a democratic society and national security of the Republic

of Serbia.

Freedom of expressing national affiliation

Article 47

National affiliation may be expressed freely.

No person shall be obliged to declare his national affiliation.

Promotion of respect for diversity

Article 48

The Republic of Serbia shall promote understanding, recognition and respect of

diversity arising from specific ethnic, cultural, linguistic or religious identity of its

citizens through measures applied in education, culture and public information.

Prohibition of inciting racial, ethnic and religious hatred

Article 49

Any inciting of racial, ethnic, religious or other inequality or hatred shall be prohibited

and punishable.

Freedom of the media

Article 50

Everyone shall have the freedom to establish newspapers and other forms

of public information without prior permission and in a manner laid down by the law.

Television and radio stations shall be established in accordance with the

law.

Censorship shall not be applied in the Republic of Serbia. Competent court

may prevent the dissemination of information through means of public informing only when

this is necessary in a democratic society to prevent inciting to violent overthrow of the

system established by the Constitution or to prevent violation of territorial integrity of the

Republic of Serbia, to prevent propagation of war or instigation to direct violence, or to

prevent advocacy of racial, ethnic or religious hatred enticing discrimination, hostility or

violence.

The law shall regulate the exercise of right to correct false, incomplete

or inaccurately imparted information resulting in violation of rights or interests of any

person, and the right to react to communicated information.

Right to information

Article 51

Everyone shall have the right to be informed accurately, fully and timely

about issues of public importance. The media shall have the obligation to respect this right.

Everyone shall have the right to access information kept by state bodies and

organizations with delegated public powers, in accordance with the law.

Electoral right

Article 52

Every citizen of age and working ability of the Republic of Serbia shall have

the right to vote and be elected.

Suffrage shall be universal and equal for all, the elections shall be free and

direct and voting is carried out by secret ballot in person.

Election right shall be protected by the law and in accordance with the law.

Right to participate in management of public affairs

Article 53

Citizens shall have the right to take part in the management of public affairs and to

assume public service and functions under equal conditions.

Freedom of assembly

Article 54

Citizens may assemble freely.

Assembly held indoors shall not be subjected to permission or registering.

Gathering, demonstrations and other forms of assembly held outdoors

shall be reported to the state body, in accordance with the law.

Freedom of assembly may be restricted by the law only if necessary to

protect public health, morals, rights of others or the security of the Republic of Serbia.

Freedom of association

Article 55

Freedom of political, union and any other form of association shall be

guaranteed, as well as the right to stay out of any association.

Associations shall be formed without prior approval and entered in the

Secret and paramilitary associations shall be prohibited.

Constitutional Court may ban only such associations the activity of which is

aimed at violent overthrow of constitutional order, violation of guaranteed human or

minority rights, or inciting of racial, national and religious hatred.

Judges of Constitutional Court, judges, public prosecutors, Defender of

Citizens, members of police force and military persons may not be members of political

parties.

Right to petition

Article 56

Everyone shall have the right to put forward petitions and other proposals

alone or together with others, to state bodies, entities exercising public powers, bodies of

the autonomous province and local self-government units and to receive reply from them if

they so request.

No person may suffer detrimental consequences for putting forward a

petition or proposal.

No person may suffer detrimental consequences for opinions stated in the

petition or proposal unless they constitute a criminal offense.

Right to asylum

Article 57

Any foreign national with reasonable fear of prosecution based on his race,

gender, language, religion, national origin or association with some other group, political

opinions, shall have the right to asylum in the Republic of Serbia.

The procedure for granting asylum shall be regulated by the law.

Right to property

Article 58

Peaceful tenure of a person’s own property and other property rights

acquired by the law shall be guaranteed.

Right of property may be revoked or restricted only in public interest

established by the law and with compensation which can not be less than market value.

The law may restrict the manner of using the property.

Seizure or restriction of property to collect taxes and other levies or

fines shall be permitted only in accordance with the law.

Right to inheritance

Article 59

Right to inheritance shall be guaranteed in accordance with the law.

Right to inheritance may not be denied or restricted for failing to observe

public duties.

Right to work

Article 60

Right to work shall be guaranteed in accordance with the law.

Everyone shall have the right to choose his occupation freely.

All work places shall be available to everyone under equal conditions.

Everyone shall have the right to respect of his person at work, safe and

healthy working conditions, necessary protection at work, limited working hours, daily and

weekly interval for rest, paid annual holiday, fair remuneration for work done and legal

protection in case of termination of working relations. No person may forgo these rights.

Women, young and disabled persons shall be provided with special

protection at work and special work conditions in accordance with the law.

Right to strike

Article 61

The employed shall have the right to strike in accordance with the law and

collective agreement.

The right to strike may be restricted only by the law in accordance with

nature or type of business activity.

Right to enter into marriage and equality of spouses

Article 62

Everyone shall have the right to decide freely on entering or dissolving a

marriage.

Marriage shall be entered into based on the free consent of man and

woman before the state body.

Contracting, duration or dissolution of marriage shall be based on the

equality of man and woman.

Marriage, marital and family relations shall be regulated by the law.

Extramarital community shall be equal with marriage, in accordance with

the law.

Freedom to procreate

Article 63

Everyone shall have the freedom to decide whether they shall procreate or

not.

The Republic of Serbia shall encourage the parents to decide to have

children and assist them in this matter.

Rights of the child

Article 64

A child shall enjoy human rights suitable to their age and mental maturity.

Every child shall have the right to personal name, entry in the registry of

births, the right to learn about its ancestry, and the right to preserve his own identity.

A child shall be protected from psychological, physical, economic and any

other form of exploitation or abuse.

A child born out of wedlock shall have the same rights as a child born in

wedlock.

Rights of the child and their protection shall be regulated by the law.

Rights and duties of parents

Article 65

Parents shall have the right and duty to support, provide upbringing and

education to their children in which they shall be equal.

All or individual rights may be revoked from one or both parents only by the

ruling of the court if this is in the best interests of the child, in accordance with the law.

Special protection of the family, mother, single parent and child

Article 66

Families, mothers, single parents and any child in the Republic of Serbia

shall enjoy special protection in the Republic of Serbia in accordance with the law.

Mothers shall be given special support and protection before and after

childbirth.

Special protection shall be provided for children without parental care and

mentally or physically handicapped children.

Children under 15 years of age may not be employed, nor may children

under 18 years of age be employed at jobs detrimental to their health or morals.

Right to legal assistance

Article 67

Everyone shall be guaranteed right to legal assistance under conditions

stipulated by the law.

Legal assistance shall be provided by legal professionals, as an

independent and autonomous service, and legal assistance offices established in the units

of local self-government in accordance with the law.

The law shall stipulate conditions for providing free legal assistance.

Health care

Article 68

Everyone shall have the right to protection of their mental and physical

health.

Health care for children, pregnant women, mothers on maternity leave,

single parents with children under seven years of age and elderly persons shall be

provided from public revenues unless it is provided in some other manner in accordance

with the law.

Health insurance, health care and establishing of health care funds shall

be regulated by the law.

The Republic of Serbia shall assist development of health and physical

culture.

Social protection

Article 69

Citizens and families that require welfare for the purpose of overcoming

social and existential difficulties and creating conditions to provide subsistence, shall have

the right to social protection the provision of which is based on social justice, humanity and

respect of human dignity.

Rights of the employees and their families to social protection and

insurance shall be regulated by the law.

The employees shall have the right to salary compensation in case of

temporary inability to work, as well as the r

Disabled people, war veterans and victims of war shall be provided special

protection in accordance with the law.

Social insurance funds shall be established in accordance with the law.

Pension insurance

Article 70

Pension insurance shall be regulated by the law.

The Republic of Serbia shall see to economic security of the pensioners.

Right to education

Article 71

Everyone shall have the right to education.

Primary education is mandatory and free, whereas secondary education is

free.

All citizens shall have access under equal conditions to higher education.

The Republic of Serbia shall provide for free tertiary education to successful and talented

students of lower property status in accordance with the law.

Establishment of schools and universities shall be regulated by the law.

Autonomy of university

Article 72

Autonomy of universities, faculties and scientific institutions shall be

guaranteed.

Universities, faculties and scientific institutions shall decide freely on their

organization and work in accordance with the law.

Freedom of scientific and artistic creativity

Article 73

Scientific and artistic creativity shall be unrestricted.

Authors of scientific and artistic works shall be guaranteed moral and

material rights in accordance with the law.

The Republic of Serbia shall assist and promote development of

science, culture and art.

Healthy environment

Article 74

Everyone shall have the right to healthy environment and the right to timely

and full information about the state of environment.

Everyone, especially the Republic of Serbia and autonomous provinces,

shall be accountable for the protection of environment.

Everyone shall be obliged to preserve and improve the environment.

Rights of Persons Belonging to National Minorities

Basic Provision

Article 75

Persons belonging to national minorities shall be guaranteed special individual or

collective rights in addition to the rights guaranteed to all citizens by the Constitution.

Individual rights shall be exercised individually and collective rights in community with

others, in accordance with the Constitution, law and international treaties.

Persons belonging to national minorities shall take part in decision-making

or decide independently on certain issues related to their culture, education, information

and official use of languages and script through their collective rights in accordance with

the law.

Persons belonging to national minorities may elect their national councils in

order to exercise the right to self-governance in the field of culture, education, information

and official use of their language and script, in accordance with the law.

Prohibition of discrimination against national minorities

Article 76

Persons belonging to national minorities shall be guaranteed equality

before the law and equal legal protection.

Any discrimination on the grounds of affiliation to a national minority shall

be prohibited.

Specific regulations and provisional measures which the Republic of Serbia

may introduce in economic, social, cultural and political life for the purpose of

achieving full equality among members of a national minority and citizens who belong

to the majority, shall not be considered discrimination if they are aimed at eliminating

extremely unfavourable living conditions which particularly affect them.

Equality in administering public affairs

Article 77

Members of national minorities shall have the right to participate in

administering public affairs and assume public positions, under the same conditions

as other citizens.

When taking up employment in state bodies, public services, bodies of

autonomous province and local self-government units, the ethnic structure of

population and appropriate representation of members of national minorities shall be

taken into consideration.

Prohibition of forced assimilation

Article 78

Forced assimilation of members of national minorities shall be strictly

prohibited.

Protection of members of national minorities from all activities directed

towards their forced assimilation shall be regulated by the Law.

Undertaking measures, which would cause artificial changes in ethnic

structure of population in areas where members of national minorities live traditionally

and in large numbers, shall be strictly prohibited.

Right to preservation of specificity

Article 79

Members of national minorities shall have a right to: expression,

preservation, fostering, developing and public expression of national, ethnic, cultural,

religious specificity; use of their symbols in public places; use of their language and

script; have proceedings also conducted in their languages before state bodies,

organisations with delegated public powers, bodies of autonomous provinces and

local self-government units, in areas where they make a significant majority of

population; education in their languages in public institutions and institutions of

autonomous provinces; founding private educational institutions; use of their name

and family name in their language; traditional local names, names of streets,

settlements and topographic names also written in their languages, in areas where

they make a significant majority of population; complete, timely and objective

information in their language, including the right to expression, receiving, sending

and exchange of information and ideas; establishing their own mass media, in

accordance with the Law.

Under the Law and in accordance with the Constitution, additional rights of

members of national minorities may be determined by provincial regulations.

Right to association and cooperation with compatriots

Article 80

Members of national minorities may found educational and cultural

associations, which are funded voluntarily.

The Republic of Serbia shall acknowledge a specific role of educational and

cultural associations of national minorities in their exercise of rights of members of

national minorities.

Members of national minorities shall have a right to undisturbed relations

and cooperation with their compatriots outside the territory of the Republic of Serbia.

Developing the spirit of tolerance

Article 81

In the field of education, culture and information, Serbia shall give impetus

to the spirit of tolerance and intercultural dialogue and undertake efficient measures

for enhancement of mutual respect, understanding and cooperation among all people

living on its territory, regardless of their ethnic, cultural, linguistic or religious identity.

PART THREE.- ECONOMIC SYSTEM AND PUBLIC FINANCES

Economic system

Basic principles

Article 82

Economic system in the Republic of Serbia shall be based on market

economy, open and free market, freedom of entrepreneurship, independence of

business entities and equality of private and other types of assets.

The Republic of Serbia shall represent a unique economic area with a

single commodity, labour, capital and services market.

The impact of the market economy on social and economic status of the

employed shall be adjusted through social dialogue between trade unions and

employers.

Freedom of entrepreneurship

Article 83

Entrepreneurship shall be permitted.

Entrepreneurship may be restricted by the Law, for the purpose of

protection of people’s health, environment and natural goods and security of the

Republic of Serbia.

Status on the market

Article 84

Everyone shall have equal legal status on the market.

Acts, which are contrary to the Law and restrict free competition by creating

or abusing monopolistic or dominant status, shall be strictly prohibited.

Rights gained through capital investments, in accordance with the Law, may

not be curtailed by the Law.

Foreign persons shall be equalled on the market with domestic persons.

Proprietary rights of foreigners

Article 85

Foreign natural and legal entities may obtain real estate property, in

accordance with the Law or international contract.

Foreigners may obtain a concession right for natural resources and goods,

as well as other rights stipulated by the Law.

Equality of all types of assets

Article 86

Private, cooperative and public assets shall be guaranteed. Public assets

shall become state assets, assets of the autonomous province and assets of local

self-government units. All types of assets shall have equal legal protection.

The existing social assets shall become private assets under the terms, in a

manner and within the deadlines stipulated by the Law.

Resources from the public assets shall be appropriated in a manner and

under the terms stipulated by the Law.

State assets

Article 87

Natural resources, goods which are stipulated by the Law as goods of

public interest and assets used by the bodies of the Republic of Serbia shall be the

state assets. State assets shall include other things and rights, according to the Law.

Natural and legal entities may obtain particular rights on particular goods in

public use, under the terms and in a manner stipulated by the Law.

Natural resources shall be utilised under the terms and in a manner

stipulated by the Law.

Assets of autonomous provinces and local self-government units, method of

its utilisation and management shall be stipulated by the Law.

Land

Article 88

Utilisation and management of agricultural land, forest land and municipal

building land on private assets shall be permitted.

The Law may restrict the models of utilisation and management, that is

stipulate terms of utilisation and management, in order to eliminate the danger of

causing damage to environment or prevent violation of rights and legally based

interests of other persons.

Protection of heritage

Article 89

Everyone shall be obliged to protect natural rarities and scientific, cultural

and historical heritage, as well as goods of public interest in accordance with the

Law.

The Republic of Serbia, autonomous provinces and local self-government

units shall be held particularly accountable for the protection of heritage.

Protection of consumers

Article 90

The Republic of Serbia shall protect consumers.

Activities directed against health, security and privacy of consumers, as well

as all other dishonest activities on the market, shall be strictly prohibited.

Public finances

Taxes and other revenues

Article 91

Resources which are used for the purpose of funding competences of the

Republic of Serbia, autonomous provinces and local self-government units shall be

provided from taxes and other revenues, stipulated by the Law.

Obligation of paying taxes and other dues shall be general and based on

economic power of taxpayers.

Budget

Article 92

The Republic of Serbia, autonomous provinces and local self-government

units shall have budgets, which must outline all receipts and expenses with which

they are funding their competences.

The Law shall stipulate the deadlines within which the Budget must be

adopted, as well as method of temporary funding.

Realisation of all budgets shall be audited by the State Audit Institution.

The National Assembly shall discuss the financial statement proposal of the

Budget upon the received evaluation of the State Audit Institution.

Public debt

Article 93

The Republic of Serbia, autonomous provinces and local self-government

units may be indebted.

Terms and procedure of getting into debts shall be stipulated by the Law.

Balancing development

Article 94

The Republic of Serbia shall take care of balanced and sustainable regional

development, in accordance with the Law.

National Bank of Serbia

Article 95

The National Bank of Serbia shall be a central bank of the Republic of

Serbia, independent and subject to supervision by the National Assembly to which it

accounts for its work.

The National Bank of Serbia shall be managed by the Governor elected by

the National Assembly.

The Law on the National Bank of Serbia shall be enacted.

State Audit Institution

Article 96

The State Audit Institution shall be the supreme state body for auditing public

finances in the Republic of Serbia, independent and subject to supervision by the

National Assembly to which it accounts for its work.

The Law on the State Audit Institution shall be enacted.

PART FOUR.- COMPETENCES OF THE REPUBLIC OF SERBIA

Competences of the Republic of Serbia

Article 97

The Republic of Serbia shall organise and provide for:

sovereignty, independence, territorial integrity and security of the Republic of

Serbia, its international status and relations with other countries and

international organisations;

exercise and protection of freedoms and rights of citizens; constitutionality

and legality; proceedings before courts and other state bodies; liabilities and

sanctions for violation of freedoms and rights of citizens stipulated by the

Constitution and for violation of laws, other regulations and general acts;

amnesty and pardon for criminal offences;

territorial organisation of the Republic of Serbia; system of local selfgovernment;
defence and security of the Republic of Serbia and its citizens; measures in

case of the state of emergency;

system of crossing the border and control of the trade in goods, services and

passenger traffic over border crossing; status of foreigners and foreign legal

entities;

single market; legal status of business entities; system of performing

particular economic and other activities; commodity reserves; monetary,

banking, foreign exchange and customs system; international economic

relations; system of foreign credit relations; fiscal system;

property and bonded relations and protection of all types of assets;
system in the area of labour relations, protection at work, employment, social

insurance and other forms of social security; other economic and social

relations of public interest;

sustainable development; system of protection and improvement of

environment; protection and improvement of flora and fauna; production,

trade and transport of arms, poisonous, inflammable, explosive, radioactive

and other hazardous substances;

system in areas of health care, social security, protection of war veterans and

the disabled , protection of children, education, culture and protection of

cultural goods, sport, public information, system of public services;

control of legality of managing resources of legal entities; financial audit of

public finances; collection of statistical and other data of public interest;

development of the Republic of Serbia, policy and measures for spurring

balanced development of particular areas of the Republic of Serbia, including

the development of underdeveloped areas; organisation and utilisation of

space; scientific and technological development;

regime and security in all areas of transport,
holidays and symbols of the Republic of Serbia;
funding of exercising rights and duties of the Republic of Serbia, stipulated by

the Constitution and Law;

organisation, competences and work of the bodies of the Republic;
other relations of interest to the Republic of Serbia, in accordance with the

Constitution.

PART FIVE.- ORGANISATION OF GOVERNMENT

National Assembly

Status of the National Assembly

Article 98

The National Assembly shall be the supreme representative body and

holder of constitutional and legislative power in the Republic of Serbia.

Competences

Article 99

The National Assembly shall:

adopt and amend the Constitution,
decide on changes concerning borders of the Republic of Serbia,
call for the Republic referendum,
ratify international contracts when the obligation of their ratification is

stipulated by the Law,

decide on war and peace and declare state of war and emergency,
supervise the work of security services,
enact laws and other general acts within the competence of the Republic of

Serbia,

give previous approval for the Statute of the autonomous province,
adopt defence strategy,
adopt development plan and spatial plan,
adopt the Budget and financial statement of the Republic of Serbia, upon the

proposal of the Government,

grant amnesty for criminal offences.

Within its election rights, the National Assembly shall:

elect the Government, supervise its work and decide on expiry of the term of

office of the Government and ministers,

appoint and dismiss judges of the Constitutional Court,
appoint the President of the Supreme Court of Cassation, presidents of

courts, Republic Public Prosecutor, public prosecutors, judges and deputy

public prosecutors, in accordance with the Constitution,

appoint and dismiss the Governor of the National Bank of Serbia and

supervise his/her work,

appoint and dismiss the Civic Defender and supervise his/her work,
appoint and dismiss other officials stipulated by the Law.

The National Assembly shall also perform other functions stipulated by the

Constitution and Law.

Constitution of the National Assembly

Article 100

The National Assembly shall consist of 250 deputies, who are elected on

direct elections by secret ballot, in accordance with the Law.

In the National Assembly, equality and representation of different genders

and members of national minorities shall be provided, in accordance with Law.

Election of deputies and constitution of the National Assembly

Article 101

Elections for deputies shall be called by the President of the Republic, 90

days before the end of the term of office of the National Assembly, so that elections

are finished within the following 60 days.

The first session of the National Assembly shall be convened by the

Chairman of the National Assembly from the previous session, so that the session is

held not later than 30 days from the day of declaring the final election results.

At the first session, the National Assembly shall confirm deputies’ terms of

office.

The National Assembly shall be constituted by confirmation of terms of

office of the two thirds of deputies.

Against the decision made in relation to confirmation of terms of office, an

appeal may be lodged before the Constitutional Court, which decides on it within 72

hours.

By means of confirming terms of office of the two thirds of deputies, the

term of office of the previous session of the National Assembly shall end.

Status of Deputies

Article 102

The term of office of the deputy shall begin on the day of confirmation of

terms of office in the National Assembly and last four years, that is until the expiry of

terms of office of deputies of that session of the National Assembly.

Under the terms stipulated by the Law, a deputy shall be free to irrevocably

put his/her term of office at disposal to the political party upon which proposal he or

she has been elected a deputy.

Deputy may not be a deputy in the Assembly of the autonomous province,

nor an official in bodies of executive government and judiciary, nor may he or she

perform other functions, affairs and duties, which represent a conflict of interest,

according to the Law.

Election, expiry of the term of office and status of deputies shall be

stipulated by the Law.

Immunity of deputies

Article 103

Deputies shall enjoy immunity.

Deputies may not accept criminal or other liability for the expressed opinion

or cast vote in performing the deputy’s function.

Deputy who uses his/her immunity may not be detained, nor may he or she

be involved in criminal or other proceedings in which prison sentence may be

pronounced, without previous approval by the National Assembly.

Deputy found in the act of committing any criminal offence for which the

prison sentence longer than five years is not envisaged, may be detained without

previous approval by the National Assembly.

There shall be no deadlines stipulated for the criminal or other proceedings

in which the immunity is established.

Failure to use the immunity shall not exclude the right of the National

Assembly to establish the immunity.

President and Vice Presidents of the National Assembly

Article 104

By means of majority votes of all deputies, the National Assembly shall

elect the President and one or more Vice Presidents of the National Assembly.

The President of the National Assembly shall represent the National

Assembly, convoke its sessions, preside over them and perform other activities

stipulated by the Constitution, Law and Rules of Procedure of the National Assembly.

Method of decision making in the National Assembly

Article 105

The National Assembly shall adopt decisions by majority vote of deputies at

the session at which majority of deputies are present.

By means of majority vote of all deputies the National Assembly shall:

grant amnesty for criminal offences,
declare and call off the state of emergency,
order measures of departure from human and minority rights in the state of

war and emergency,

enact the Law by which the Republic of Serbia delegates particular issues

falling within its competence to autonomous provinces and local selfgovernment

units,

give previous approval for the Statute of the autonomous province,
decide on the Rules of Procedure pertaining to its work,
cancel immunities of deputies, the President of the Republic, members of the

Government and Civic Defender,

adopt the Budget and financial statement,
elect members of the Government and decide on the end of the term of office

of the Government and ministers,

decide on response to interpellation,
elect judges of the Constitutional Court and decide on their dismissal and end

of their term of office,

elect the President of the Supreme Court of Cessation, presidents of courts,

Republic Public Prosecutor and public prosecutors and decide on the end of

their term of office,

elect judges and deputy public prosecutors, in accordance with the

Constitution,

elect and dismiss the Governor of the National Bank of Serbia, Governors’

Council and Civic Defender,

also perform other election competences of the National Assembly .

By means of majority vote of all deputies, the National Assembly shall

decide on laws which regulate:

referendum and national initiative,
enjoying of individual and collective rights of members of national minorities,
development and spatial plan,
public debt,
territories of autonomous provinces and local self-government units,
conclusion and ratification of international contracts,
other issues stipulated by the Constitution.

Sessions

Article 106

The National Assembly shall be convoked for two regular sessions per year.

The first regular session shall start on the first weekday of March, while the

second regular session shall start on the first weekday of October. Regular sessions

may not last longer than 90 days.

The National Assembly shall be convoked for extraordinary session upon

the request of at least one third of deputies or upon the request of the Government,

with previously determined agenda.

The National Assembly shall be convoked without announcement upon the

declaration of the state of war or emergency.

Right to propose laws

Article 107

A right to propose laws, other regulations and general acts shall belong to

every deputy, the Government, assemblies of autonomous provinces or at least

30,000 voters.

The Civic Defender and National Bank of Serbia shall have a right to

propose laws falling within their competence.

Referendum

Article 108

Upon the request of the majority of all deputies or at least 100,000 voters,

the National Assembly shall call the referendum on issues falling within its

competence, in accordance with the Constitution and Law.

The subject of the referendum may not include duties deriving from

international contracts, laws pertaining to human and minority rights and freedoms,

fiscal and other financial laws, the budget and financial statement, introduction of the

state of emergency and amnesty, as well as issues pertaining to election

competences of the National Assembly.

Dissolution of the National Assembly

Article 109

The President of the Republic may dissolve the National Assembly, upon

the elaborated proposal of the Government.

The Government may not propose dissolution of the National Assembly, if a

proposal has been submitted for the vote of no confidence in the Government or if

the issue of its confidence has been raised.

The National Assembly shall be dissolved if it fails to elect the Government

within 90 days from the day of its constitution.

The National Assembly may not be dissolved during the state of war and

emergency.

The President of the Republic shall be obliged to dissolve the National

Assembly upon his/her decree, in cases stipulated by the Constitution.

Simultaneously with the dissolution of the National Assembly, the President

of the Republic shall schedule elections for deputies, so that elections finish not later

than 60 days from the day of their announcement.

The National Assembly, which has been dissolved, shall only perform

current or urgent tasks, stipulated by the Law. In case of declaration of the state of

war or emergency, its full competence shall be reestablished and last until the end of

the state of war, that is, emergency.

Law on the National Assembly

Article 110

The Law on the National Parliament shall be enacted.

The President of the Republic

Status of the President of the Republic

Article 111

The President of the Republic shall express state unity of the Republic of

Serbia.

Competences

Article 112

The President of the Republic shall:

represent the Republic of Serbia in the country and abroad,
promulgate laws upon his decree, in accordance with the Constitution,
propose to the National Assembly a candidate for the Prime Minister, after

considering views of representatives of elected lists of candidates,

propose to the National Assembly holders of positions, in accordance with the

Constitution and Law,

appoint and dismiss, upon his/her decree, ambassadors of the Republic of

Serbia, upon the proposal of the Government,

receive letters of credit and revocable letters of credit of foreign diplomatic

representatives,

grant amnesties and award honours,
administer other affairs stipulated by the Constitution.

In accordance with the Law, the President of the Republic shall command

the Army and appoint, promote and relieve officers of the Army of Serbia.

Promulgation of laws

Article 113

The President of the Republic shall be obliged to issue a decree on

promulgation of laws or to return the law for reconsideration with a written

explanation to the National Assembly, within maximum 15 days from the day of

adoption of the law, that is, not later than within seven days, if the law has been

adopted by emergency procedure.

If the National Assembly decides to vote again on the law, which has been

returned for reconsideration by the President of the Republic, the law shall be

adopted by the majority vote from the total number of deputies.

The President of the Republic shall be obliged to promulgate the newly

adopted Law.

If the President of the Republic fails to issue a decree on promulgation of

the law within the deadline stipulated by the Constitution, the decree shall be issued

by the Chairman of the National Assembly.

Election

Article 114

The President of the Republic shall be elected on direct elections, by secret

ballot, in accordance with the Law.

Elections for the President of the Republic shall be scheduled by the

Chairman of the National Assembly, 90 days before the end of term of office of the

President of the Republic, so that elections finish within the following 60 days, in

accordance with the Law.

While assuming the office, the President of the Republic shall take the

following oath before the National Assembly:

“I do solemnly swear that I will devote all my efforts to preserve the

sovereignty and integrity of the territory of the Republic of Serbia, including Kosovo

and Metohija as its constituent part, as well as to provide exercise of human and

minority rights and freedoms, respect and protection of the Constitution and laws,

preservation of peace and welfare of all citizens of the Republic of Serbia and

perform all my duties conscientiously and responsibly.”

Incompatibility of positions

Article 115

The President of the Republic may not perform another public function or

professional duty.

Term of office

Article 116

The term of office of the President of the Republic shall last five years and

begin from the day of taking of the oath before the National Assembly.

If the term of office of the President of the Republic expires during the state

of war or emergency, it shall be extended so that it lasts until the expiry of three

months from the day of the end of the state of war, that is, of emergency.

No one shall be elected to a position of the President of the Republic more

than twice.

The term of office of the President of the Republic shall end with expiry of

the period of time for which he or she has been elected, by his/her resignation or

released of duty.

The President of the Republic shall tender his/her resignation to the

Chairman of the National Assembly.

Resignation

Article 117

When the President of the Republic tenders his/her resignation, he or she

shall then inform about this the general public and the Chairman of the National

Assembly.

The term of office of the President of the Republic shall end on the day of

his/her resignation.

Dismissal

Article 118

The President of the Republic shall be dismissed for the violation of the

Constitution, upon the decision of the National Assembly, by the votes of at least two

thirds of deputies.

Procedure for the dismissal may be initiated by the National Assembly,

upon the proposal of at least two thirds of deputies.

The Constitutional Court shall have the obligation to decide on the violation

of the Constitution, upon the initiated procedure for dismissal, not later than within 45

days.

Immunity

Article 119

The President of the Republic shall enjoy the immunity as a deputy.

The National Assembly shall decide on the immunity of the President of the

Republic.

Replacement of the President of the Republic

Article 120

When the President of the Republic is prevented from performing his/her

duties or his/her term of office ends before the expiry of the period of time for which

he or she has been elected, he or she shall be replaced by the Chairman of the

National Assembly.

The Chairman of the National Assembly may replace the President of the

Republic for maximum three months.

The Chairman of the National Assembly shall be obliged to schedule

elections for the President of the Republic so that they are held not later than three

months from the beginning of indisposition of the President of the Republic, that is

the end of his/her term of office for which he or she has been elected.

Law on the President of the Republic

Article 121

The Law on the President of the Republic shall be enacted.

Government

Status of the Government

Article 122

The Government shall be the holder of executive power in the Republic of

Serbia.

Competences

Article 123

The Government shall:

establish and pursue policy,
execute laws and other general acts of the National Assembly,
adopt regulations and other general acts for the purpose of law enforcement,
propose to the National Assembly laws and other general acts and gives its

opinion on those laws and general acts, when another mover proposes them,

direct and adjust the work of public administration bodies and perform

supervision of their work,

administer other affairs stipulated by the Constitution and Law.

Responsibilities of the Government

Article 124

The Government shall account to the National Assembly for the policy of

the Republic of Serbia, for enforcement of laws and other general acts of the National

Assembly, as well as for the work of the public administration bodies.

Prime Minister and members of the Government

Article 125

The Government shall consist of the Prime Minister, one or more Vice

Presidents and ministers.

The Prime Minister shall manage and direct the work of the Government,

take care of coordinated political activities of the Government, coordinate the work of

members of the Government and represent the Government.

Ministers shall account for their work and situation within the competence of

their ministries to the Prime Minister, Government and National Assembly.

Incompatibility of functions

Article 126

Member of the Government may not be a deputy in the National Assembly,

deputy in the Assembly of the autonomous province and representative in the

Assembly of the local self-government units, nor may he or she be a member of the

executive council of the autonomous province or executive body of the local selfgovernment

unit.

Other functions, actions or private interests which are incompatible with the

position of a member of the Government shall be stipulated by the Law.

Election of the Government

Article 127

A candidate for the Prime Minister shall be proposed to the National

Assembly by the President of the Republic, after he or she considers the opinions of

representatives of elected election lists.

The candidate for the Prime Minister shall present to the National Assembly

the Government’s Programme and propose its constitution.

The National Assembly shall simultaneously vote on the Government’s

Programme and election of the Prime Minister and members of the Government.

The Government shall be elected if the majority of the total number of

deputies votes for its election.

Commencement and termination of term of office of the Government and

members of the Government

Article 128

The term of office of the Government shall last until the expiry of the term of

office of the National Assembly which elected it.

The term of office of the Government shall commence on the day of taking

an oath before the National Assembly.

The term of office of the Government shall terminate before the period of

time for which it has been elected, by the vote of no confidence, dissolution of the

National Assembly, resignation of the President of the Republic and in other cases

stipulated by the Constitution.

The Government whose term of office has expired may only perform affairs

stipulated by the Law, until the election of the new Government.

The Government whose term of office has expired may not propose the

dissolution of the National Assembly.

The term of office of the member of the Government shall expire before the

expiry of the period of time for which he or she has been elected, by accepting

his/her resignation, by the vote of no confidence in the National Assembly and

dismissal by the National Assembly, upon the proposal of the Prime Minister.

Interpellation

Article 129

At least 50 deputies may propose interpellation in relation to the work of the

Government or particular member of the Government.

The Government shall have the obligation to respond to interpellation within

30 days.

The National Assembly shall discuss and vote on the response to

interpellation submitted by the Government or member of the Government to whom

the interpellation is directed.

After voting for the endorsement of the response, the National Assembly

continues to work according to the adopted agenda.

If the National Assembly fails to endorse the response of the Government or

the member of the Government by voting, it shall initiate a vote of no confidence in

the Government or a member of the Government, unless the Prime Minister, that is a

member of the Government resign beforehand, after the rejection of the response to

the interpellation.

The issue which was a subject of interpellation, may not be discussed again

before the expiry of the 90-day deadline.

Vote of no confidence in the Government or the member of the Government

Article 130

A vote of no confidence in the Government or the particular member of the

Government may be requested by at least 60 deputies.

The proposal for the vote of no confidence in the Government or the

particular member of the Government shall be discussed by the National Assembly at

the next first session, not later than five days after the submission of the proposal.

After the discussion is concluded, they shall vote on the proposal.

The proposal for the vote of no confidence in the Government or the

member of the Government shall be accepted by the National Assembly, if more than

a half of the total number of deputies votes for it.

If the National Assembly passes a vote of no confidence in the Government,

the President of the Republic shall be obliged to initiate proceedings for election of

the new Government. If the National Assembly fails to elect the new Government

within 30 days from the passing of a vote of no confidence, the President of the

Republic shall be obliged to dissolve the National Assembly and schedule elections.

If the National Assembly passes a vote of no confidence in the member of

the Government, the President of the Republic shall be obliged to initiate

proceedings for election of a new member of the Government, in accordance with the

Law.

If the National Assembly fails to pass a vote of no confidence in the

Government or the member of the Government, signatories of the proposal may not

submit a new proposal for a vote of no confidence before the expiry of the 180-day

deadline.

Vote of confidence in the Government

Article 131

The Government may require a vote of its confidence.

Upon the request of the Government, proposal for a vote of confidence in

the Government may be discussed at the current session of the National Assembly,

and if the Government has failed to submit such a proposal, the proposal shall be

discussed on the next first session, not later than five days from its submission. After

the discussion is concluded, they shall vote on the proposal.

The proposal for the vote of confidence in the Government or the member

of the Government shall be accepted by the National Assembly, if more than a half of

the total number of deputies votes for it.

If the National Assembly fails to pass a vote of confidence in the

Government, the term of office of the Government ends and the President of the

Republic shall be obliged to initiate proceedings for election of the new Government.

If the National Assembly fails to elect the new Government within 30 days from the

day of passing of vote of no confidence, the President of the Republic shall be

obliged to dissolve the National Assembly and schedule elections.

Resignation of the Prime Minister

Article 132

The Prime Minister may tender his/her resignation to the National

Assembly.

The Prime Minister shall tender his/her resignation to the Chairman of the

National Assembly and, at the same time, inform the President of the Republic and

general public.

At the next first session, the National Assembly shall confirm the resignation

of the Prime Minister.

The term of office of the Government shall terminate on the day of

confirmation of the resignation of the Prime Minister.

After the National Assembly confirms the resignation of the Prime Minister,

the President of the Republic shall be obliged to initiate the proceedings for election

of the new Government. If the National Assembly fails to elect the new Government

within 30 days from the day of confirmation of the resignation of the Prime Minister,

the President of the Republic shall be obliged to dissolve the National Assembly and

schedule elections.

Resignation and dismissal of the member of the Government

Article 133

The member of the Government may tender his/her resignation to the Prime

Minister.

The Prime Minister shall submit the resignation of the member of the

Government to the Chairman of the National Assembly and the National Assembly

shall confirm the resignation at the next first session.

The Prime Minister may propose to the National Assembly a dismissal of

particular member of the Government.

The National Assembly shall discuss and vote on the proposal for dismissal

of the member of the Government at the next first session.

Decision on Dismissal of the Member of the Government shall be adopted if

the majority of the total number of deputies votes for it.

The term of office of the member of the Government who has tendered

his/her resignation shall terminate on the day of confirmation of resignation, and for

the member of the Government who has been dismissed, the term of office shall

terminate on the day of adoption of the Decision on Dismissal.

Status and responsibilities of the member of the Government who has

tendered his/her resignation or for whom the proposal for dismissal has been

submitted shall be stipulated by the Law, until the termination of the term of office.

The Prime Minister shall be obliged to initiate proceedings for election of the

new member of the Government, after the expiry of the term of office of the member

of the Government due to tendered resignation or dismissal.

Immunity of the President and member of the Government

Article 134

The Prime Minister and the member of the Government shall not be held

accountable for opinions expressed at sittings of the Government and sessions of the

National Assembly, or for the cast vote at the sittings of the Government.

The Prime Minister and the member of the Government shall enjoy

immunity as a deputy. The Government shall decide on the immunity of the Prime

Minister and the member of the Government.

The Law on the Government

Article 135

The Law on the Government shall be enacted.

Public Administration

Status of the Public Administration

Article 136

The Public Administration shall be independent, bound by the Constitution

and Law and it shall account for its work to the Government.

Public Administration affairs shall be performed by ministries and other

public administration bodies, stipulated by the Law.

Public Administration affairs and the number of ministries shall be stipulated

by the Law.

Internal organisation of ministries and other public administration bodies

and organisations shall be regulated by the Government.

Delegation of public powers and public services

Article 137

In the interest of more efficient and rational exercise of citizens’ rights and

duties and satisfying their needs of vital importance for life and work, the Law may

stipulate delegation of performing particular affairs falling within the competence of

the Republic of Serbia to the autonomous province and local self-government unit.

According to the Law, particular public powers may be delegated to

enterprises, institutions, organisations and individuals.

According to the Law, particular public powers may be also delegated to

specific bodies through which they perform regulatory function in particular fields or

affairs.

The Republic of Serbia, autonomous provinces and local self-government

units may establish public services.

Affairs or duties for which public services are established, their organisation

and work shall be stipulated by the Law.

Civic Defender

Article 138

The Civic Defender shall be independent state body who shall protect

citizens’ rights and monitor the work of public administration bodies, body in charge

of legal protection of proprietary rights and interests of the Republic of Serbia, as well

as other bodies and organisations, companies and institutions to which public powers

have been delegated.

The Civic Defender shall not be authorised to monitor the work of the

National Assembly, President of the Republic, Government, Constitutional Court,

courts and Public Prosecutor’s Offices.

The Civic Defender shall be elected and dismissed by the National

Assembly, in accordance with the Constitution and Law.

The Civic Defender shall account for his/her work to the National Assembly.

The Civic Defender shall enjoy immunity as a deputy. The National

Assembly shall decide on the immunity of the Civic Defender.

The Law on the Civic Defender shall be enacted.

The Army of Serbia

Competences

Article 139

The Army of Serbia shall defend the country from external armed threat and

perform other missions and tasks, in accordance with the Constitution, Law and

principles of international law, which regulate the use of force.

Use of the Army outside the borders

Article 140

The Army of Serbia may be used outside the borders of the Republic of

Serbia only upon the decision of the National Assembly of the Republic of Serbia.

Control over the Army of Serbia

Article 141

The Army of Serbia shall be subject to democratic and civil control.

The Law on the Army of Serbia shall be enacted.

Courts

Judiciary principles

Article 142

Judicial power shall be unique on the territory of the Republic of Serbia.

Courts shall be separated and independent in their work and they shall

perform their duties in accordance with the Constitution, Law and other general acts,

when stipulated by the Law, generally accepted rules of international law and ratified

international contracts.

The hearing before the court shall be public and may be restricted only in

accordance with the Constitution.

Judges and jurors shall participate in a trial, in the manner stipulated by the

Law.

The Law may also regulate that only judges may participate in a trial in

particular courts and in particular cases.

The court shall decide on matters within the Council, while the Law may

stipulate that a single judge may decide on particular matters.

Types of courts

Article 143

Judicial power in the Republic of Serbia shall belong to courts of general

and special jurisdiction.

Establishing, organisation, jurisdiction, system and structure of courts shall

be regulated by the Law.

Provisional courts, courts-martial or special courts may not be established.

The Supreme Court of Cassation shall be the Supreme Court in the

Republic of Serbia.

The seat of the Supreme Court of Cassation shall be in Belgrade.

President of the Supreme Court of Cassation

Article 144

President of the Supreme Court of Cassation shall be elected by the

National Assembly, upon the proposal of the High Judicial Council and received

opinion of the meeting of the Supreme Court of Cassation and competent committee

of the National Assembly.

President of the Supreme Court of Cassation shall be elected for the period

of five years and may not be reelected.

Term of office of the President of the Supreme Court of Cassation shall

terminate before the expiry of the time for which he or she has been elected upon

his/her personal request, under the terms stipulated by the Law pertaining to the

termination of the term of office of the judge or dismissal for reasons stipulated by the

Law pertaining to dismissal of the President of Court.

Decision on the end of term of office of the President of the Supreme Court

of Cassation shall be adopted by the National Assembly, in accordance with the Law,

while the decision on dismissal shall be adopted upon the proposal of the High

Judicial Council.

Court decisions

Article 145

Court decisions shall be passed in the name of people.

Court decisions are based on the Constitution and Law, the ratified

international treaty and regulation passed on the grounds of the Law.

Court decisions shall be obligatory for all and may not be a subject of

extrajudicial control.

A court decision may only be reconsidered by an authorised court in a

legal proceedings prescribed by the Law.

A passed sentence may be fully or partially forgiven without a court

decision, by general pardon or amnesty.

Permanent tenure of office

Article 146

A judge shall have a permanent tenure.

Exceptionally, a person who is elected a judge for the first time shall

be elected for the period of three years.

Election of judges

Article 147

On proposal of the High Judicial Council, the National Assembly shall elect

as a judge the person who is elected to the post of judge for the first time.

Tenure of office of a judge who was elected to the post of judge shall last

three years.

In accordance with the Law, the High Judicial Council shall elect judges to

the posts of permanent judges, in that or other court.

In addition, the High Judicial Council shall decide on election of judges who

hold the post of permanent judges to other or higher court.

Termination of a judge’s tenure of office

Article 148

A judge’s tenure of office shall terminate at his/her own request, upon

coming into force of legally prescribed conditions or upon relief of duty for reasons

stipulated by the Law, as well as if he/she is not elected to the position of a permanent

judge.

The High Judicial Council shall pass a decision on termination of a judge’s

tenure of office. A judge shall have the right to appeal with the Constitutional Court against

this decision. The lodged appeal shall not include the right to lodge a Constitutional appeal.

The proceedings, grounds and reasons for termination of a judge’s tenure

of office, as well as the reasons for the relief of duty of the President of Court shall be

stipulated by the Law.

Independence of judge

Article 149

In performing his/her judicial function, a judge shall be independent and

responsible only to the Constitution and the Law.

Any influence on a judge while performing his/her judicial function shall be

prohibited.

Non-transferability of judge

Article 150

A judge shall have the right to perform his/her judicial function in the court

to which he/she was elected, and may be relocated or transferred to another court only on

his/her own consent.

In case of revocation of the court or the substantial part of the jurisdiction of

the court to which he/she was elected, a judge may exceptionally, without his/her consent,

be permanently relocated or transferred to another court, in accordance with the Law.

Immunity

Article 151

A judge may not be held responsible for his/her expressed opinion or

voting in the process of passing a court decision, except in cases when he/she committed

a criminal offence by violating the Law.

A judge may not be detained or arrested in the legal proceedings instituted

due to a criminal offence committed in performing their judicial function without the

approval of the High Judicial Council.

Incompatibility of judiciary function

Article 152

A judge shall be prohibited to engage in political actions.

Other functions, actions or private interests which are incompatible with the

judiciary function shall be stipulated by the Law.

The High Judicial Council

Status, constitution and election

Article 153

The High Judicial Council is an independent and autonomous body which

shall provide for and guarantee independence and autonomy of courts and judges.

The High Judicial Council shall have eleven members.

The High Judicial Council shall be constituted of the President of the

Supreme Court of Cassation, the Minister responsible for justice and the President of the

authorised committee of the National Assembly as members ex officio and eight electoral

members elected by the National Assembly, in accordance with the Law.

Electoral members shall include six judges holding the post of permanent

judges, of which one shall be from the territory of autonomous provinces, and two

respected and prominent lawyers who have at least 15 years of professional experience,

of which one shall be a solicitor, and the other a professor at the law faculty.

Presidents of Court may not be electoral members of the High Judicial

Council.

Tenure of office of the High Judicial Council’s members shall last five

years, except for the members appointed ex officio.

A member of the High Judicial Council shall enjoy immunity as a judge.

Jurisdiction of the High Judicial Council

Article 154

The High Judicial Council shall appoint and relieve of judges, in

accordance with the Constitution and the Law, propose to the National Assembly the

election of judges in the first election to the post of judge, propose to the National

Assembly the election of the President of the Supreme Court of Cassation as well as

presidents of courts, in accordance with the Constitution and the Law, participate in the

proceedings of terminating the tenure of office of the President of the Supreme Court of

Cassation and presidents of courts, in the manner stipulated by the Constitution and the

Law, and perform other duties specified by the Law.

Legal remedy

Article 155

An appeal may be lodged with the Constitutional Court against a

decision of the High Judicial Council, in cases stipulated by the Law.

Public Prosecutor’s Office

Status and jurisdiction

Article 156

Public Prosecutor’s Office shall be an independent state body which shall

prosecute the perpetrators of criminal offences and other punishable actions, and take

measures in order to protect constitutionality and legality.

Public Prosecutor’s Office shall perform its function on the grounds of the

Constitution, Law, ratified international treaty and regulation passed on the grounds of the

Law.

Establishment and organisation

Article 157

Establishment, organisation and jurisdiction of Public Prosecutor’s Office

shall be specified by the Law.

The Republic Public Prosecutor’s Office shall be the supreme Public

Prosecutor’s Office in the Republic of Serbia.

The Republic Public Prosecutor

Article 158

The Republic Public Prosecutor shall perform the function of the Public

Prosecutor’s Office within the rights and duties of the Republic of Serbia.

The Republic Public Prosecutor shall be elected by the National Assembly,

on the Government proposal and upon obtaining the opinion of the authorised committee

of the National Assembly.

The Republic Public Prosecutor shall be elected for the period of six years

and may be re-elected.

Tenure of office of the Republic Public Prosecutor shall terminate if he/she

is not re-elected, at his/her own request, upon coming into force of legally prescribed

conditions or upon relief of duty for reasons stipulated by the Law.

The decision on termination of tenure of office of the Republic Public

Prosecutor shall be adopted by the National Assembly, in accordance with the Law,

bearing in mind that it shall pass a decision on relief of duty on the Government proposal.

Public Prosecutors and Deputy Public Prosecutors

Article 159

A Public Prosecutor shall perform the function of the Public

Prosecutor’s Office.

A Public Prosecutor shall be elected by the National Assembly, on the

Government proposal.

Tenure of office of the Public Prosecutor shall last six years and

he/she may be re-elected.

A Deputy Public Prosecutor shall stand in for the Public Prosecutor in

performing the function of the Public Prosecutor’s Office and shall be obliged to act

according to his/her instructions.

On proposal of the State Prosecutors Council, the National Assembly

shall elect as a Deputy Public Prosecutor the person who is elected to this function

for the first time.

Tenure of office of a Deputy Public Prosecutor elected to that function

for the first time shall last three years.

In accordance with the Law, the State Prosecutors Council shall elect

Deputy Public Prosecutors to permanently perform that function, in that or other

Public Prosecutor’s Office.

In addition, the State Prosecutors Council shall decide on the election

of Deputy Public Prosecutors who permanently perform that function in another or

superior Public Prosecutor’s Office.

Responsibility

Article 160

The Republic Public Prosecutor shall account for the work of the

Public Prosecutor’s Office and his/her own work to the National Assembly.

Public Prosecutors shall account for the work of the Public

Prosecutor’s Office and their own work to the Republic Public Prosecutor and the

National Assembly, whereas Junior Prosecutors shall account for their work to their

immediately superior Public Prosecutor as well.

Deputy Public Prosecutors shall be held responsible for their work to

the Public Prosecutor.

Termination of Public Prosecutor and Deputy Public Prosecutor’s tenure of office

Article 161

A Public Prosecutor and Deputy Public Prosecutor may terminate their

tenure of office at their own request, upon coming into force of legally prescribed conditions

or upon relief of duty for reasons stipulated by the Law. A Public Prosecutor’s tenure of

office shall terminate even if he/she is not re-elected, and Deputy Public Prosecutor’s

tenure off office shall terminate if he/she is not permanently elected to that function.

A decision on termination of a Public Prosecutor’s tenure of office shall be

adopted by the National Assembly, in accordance with the Law, and it shall pass a

decision on relief of duty on the Government proposal.

A decision on termination of a Deputy Public Prosecutor’s tenure of office

shall be passed by the State Prosecutors Council.

A Public Prosecutor and Deputy Public Prosecutor may lodge an appeal

with the Constitutional Court against the decision on termination of their tenure of office.

The lodged appeal shall not include the right to lodge a Constitutional appeal.

The proceedings, grounds and reasons for termination of a Public

Prosecutor and Deputy Public Prosecutor’s tenure of office shall be regulated by the Law.

Immunity

Article 162

A Public Prosecutor and Deputy Public Prosecutor may not be held

responsible for the expressed opinion while performing the function of prosecutors, except

in cases when a Public Prosecutor or Deputy Public Prosecutor commits a criminal offence

by violating the law.

A Public Prosecutor or a Deputy Public Prosecutor may not be detained or

arrested in the legal proceedings instituted due to a criminal offence committed in

performing the prosecutor’s function or service without the approval of the authorised

committee of the National Assembly.

Incompatibility of prosecutor’s function

Article 163

Public Prosecutors and Deputy Public Prosecutors shall be prohibited to

engage in political actions.

Other functions, activities or private interests which are incompatible with

the prosecutor’s function shall be stipulated by the Law.

Status, constitution and election of the State Prosecutors

Council

Article 164

The State Prosecutors Council is an autonomous body which shall provide

for and guarantee the autonomy of Public Prosecutors and Deputy Public Prosecutors, in

accordance with the Law.

The State Prosecutors Council shall have 11 members.

The State Prosecutors Council shall be constituted of the Republic Public

Prosecutor, the Minister responsible for justice and the President of the authorised

committee of the National Assembly as members ex officio and eight electoral members

elected by the National Assembly, in accordance with the Law.

Electoral members shall include six Public Prosecutors or Deputy Public

Prosecutors holding permanent posts, of which one shall be from the territory of

autonomous provinces, and two respected and prominent lawyers who have at least 15

years of professional experience, of which one shall be a solicitor, and the other a

professor at the law faculty.

Tenure of office of the State Prosecutors Council’s members shall last five

years, except for the members appointed ex officio.

A member of the State Prosecutors Council shall enjoy immunity as a

Public Prosecutor.

Jurisdiction of the State Prosecutors Council

Article 165

The State Prosecutors Council shall propose to the National Assembly the

candidates for the first election of a Deputy Public Prosecutor, elect Deputy Public

Prosecutors to permanently perform that function, elect Deputy Public Prosecutors holding

permanent posts as Deputy Public Prosecutors in other Public Prosecutor’s Office, decide

in the proceedings of termination of Deputy Public Prosecutors’ tenure of office in the

manner stipulated by the Constitution and the Law, and perform other duties specified in

the Law.

PART SIX.- THE CONSTITUTIONAL COURT

Status

Article 166

The Constitutional Court shall be an autonomous and independent state

body which shall protect constitutionality and legality, as well as human and minority rights

and freedoms.

The Constitutional Court decisions are final, enforceable and generally

binding.

Jurisdiction

Article 167

The Constitutional Court shall decide on:

compliance of laws and other general acts with the Constitution,

generally accepted rules of the international law and ratified

international treaties,

compliance of ratified international treaties with the Constitution,
compliance of other general acts with the Law,
compliance of the Statute and general acts of autonomous provinces

and local self-government units with the Constitution and the Law,

compliance of general acts of organisations with delegated public

powers, political parties, trade unions, civic associations and collective

agreements with the Constitution and the Law.

The Constitutional Court shall:

decide on the conflict of jurisdictions between courts and state bodies,
decide on the conflict of jurisdictions between republic and provincial

bodies or bodies of local self-government units,

decide on the conflict of jurisdictions between provincial bodies and

bodies of local self-government units,

decide on electoral disputes for which the court jurisdiction has not

been specified by the Law,

perform other duties stipulated by the Constitution and the Law.

The Constitutional Court shall decide on the banning of a political party,

trade union organisation or civic association.

The Constitutional Court shall perform other duties stipulated by the

Constitution.

Assessment of constitutionality and legality

Article 168

A proceedings of assessing the constitutionality may be instituted by state

bodies, bodies of territorial autonomy or local self-government, as well as at least 25

deputies. The procedure may also be instituted by the Constitutional Court.

Any legal or natural person shall have the right to an initiative to institute a

proceedings of assessing the constitutionality and legality.

The Law or other general acts which is not in compliance with the

Constitution or the Law shall cease to be effective on the day of publication of the

Constitutional Court decision in the official journal.

Before passing the final decision and under the terms specified by the Law,

the Constitutional Court may suspend the enforcement of an individual general act or

action undertaken on the grounds of the Law or other general act whose constitutionality or

legality it assesses.

The Constitutional Court may assess the compliance of the Law and other

general acts with the Constitution, compliance of general acts with the Law, even when

they ceased to be effective, if the proceedings of assessing the constitutionality has been

instituted within no more than six months since they ceased to be effective.

Assessment of constitutionality of the law prior to its coming into force

Article 169

At the request of at least one third of deputies, the Constitutional Court

shall be obliged within seven days to assess constitutionality of the law which has been

passed, but has still not been promulgated by a decree.

If a law is promulgated prior to adopting the decision on constitutionality,

the Constitutional Court shall proceed with the proceedings as requested, according to the

regular proceedings of assessing the constitutionality of a law.

If the Constitutional Court passes a decision on non-constitutionality of a

law prior to its promulgation, that decision shall come into force on the day of promulgation

of the law.

The proceedings of assessing constitutionality may not be instituted

against the law whose compliance with the Constitution was established prior to its coming

into force.

Constitutional appeal

Article 170

A constitutional appeal may be lodged against individual general acts or

actions performed by state bodies or organisations exercising delegated public powers

which violate or deny human or minority rights and freedoms guaranteed by the

Constitution, if other legal remedies for their protection have already been applied or not

specified..

Ensuring the enforcement of decisions

Article 171

Everyone shall be obliged to observe and enforce the Constitutional

Court’s decision.

The Constitutional Court shall regulate in its decision the manner of its

enforcement, whenever deemed necessary.

Enforcement of the Constitutional Court’s decisions shall be regulated by

the Law.

Organisation of the Constitutional Court. Election and appointment of the Constitutional Court justices

Article 172

The Constitutional Court shall have 15 justices who shall be elected and

appointed for the period of nine years.

Five justices of the Constitutional Court shall be appointed by the National

Assembly, another five by the President of the Republic, and another five at the general

session of the Supreme Court of Cassation.

The National Assembly shall appoint five justices of the Constitutional

Court form among ten candidates proposed by the President of the Republic, the

President of the Republic shall appoint five justices of the Constitutional Court from among

ten candidates proposed by the National Assembly, and the general session of the

Supreme Court of Cassation shall appoint five justices from among ten candidates

proposed at a general session by the High Judicial Court and the State Prosecutor

Council.

On each of the proposed lists of candidates, one of the appointed

candidates must come from the territory of autonomous provinces.

A justice of the Constitutional Court shall be elected and appointed from

among the prominent lawyers who have at least 40 years of experience in practicing the

law.

One person may be elected or appointed a justice of the Constitutional

Court on two occasions at the most.

Justices of the Constitutional Court shall elect the president from among

their representatives for the period of three years, in a secret ballot.

Conflict of interest. Immunity

Article 173

A justice of the Constitutional Court may not engage in another public or

professional function or action, except for the professorship a law faculty in the Republic of

Serbia, in accordance with the Law.

A justice of the Constitutional Court shall enjoy immunity as a deputy. The

Constitutional Court shall decide on its immunity.

Termination of the tenure of office of the Constitutional Court justice

Article 174

Tenure of office of the Constitutional Court justice shall terminate upon

expiry of the period for which he/she had been elected or appointed, at his/her own

request, after meeting the requirements regulated by the Law for obtaining the old age

pension or by relief of duty.

A justice of the Constitutional Court shall be relieved of duty if he/she

violates the prohibition of the conflict of interest, permanently loses the ability to discharge

the function of a justice of the Constitutional Court, or is convicted of a penalty of

imprisonment or criminal offence which makes him/her ineligible for the post of the

Constitutional Court justice.

The National Assembly shall decide on the termination of a justice’s tenure

of office, on request of movers authorised for election, as well as on appointment for

election of a justice of the Constitutional Court. An initiative to institute the proceedings of

relieving of duty may be submitted by the Constitutional Court.

The manner of deciding in the Constitutional Court. The Law on the Constitutional Court

Article 175

The Constitutional Court shall adjudicate by the majority of votes cast by all

justices of the Constitutional Court.

A decision to autonomously institute the proceedings of assessing the

constitutionality or legality shall be passes by the Constitutional Court by two thirds of the

majority votes cast by all justices.

Organisation of the Constitutional Court and the proceedings before the

Constitutional Court, as well as the legal effect of its decisions shall be regulated by the

Law.

PART SEVEN.- TERRITORIAL ORGANISATION

Provincial autonomy and local self-government

Concept

Article 176

Citizens shall have the right to the provincial autonomy and local selfgovernment,

which they shall exercise directly or through their freely elected

representatives.

Autonomous provinces and local self-government units shall have the

status of legal entities.

Definition the competences

Article 177

Local self-government units shall be competent in those matters which

may be realised, in an effective way, within a local self-government unit, and autonomous

provinces in those matters which may be realised, in an effective way, within an

autonomous province, which shall not be the competence of the Republic of Serbia.

What matters shall be of republic, provincial or local interest shall be

specified by the Law.

Delegation of competences

Article 178

The Republic of Serbia may, in accordance with the law, delegate

particular matters within its competence to autonomous provinces and local selfgovernment

units.

According to its decision, an autonomous province may delegate particular

matters within its competence to local self-government units.

Resources to execute the delegated competences shall be provided for by

the Republic of Serbia or an autonomous province, depending on who the competences

were delegated by.

Right and duties of autonomous provinces and local self-government units

and powers of the Republic of Serbia and autonomous provinces in the process of

monitoring the execution of delegated competences shall be regulated by the Law.

The right to autonomous organisation of bodies

Article 179

Autonomous provinces, in accordance with the Constitution and the

Statute, and local self-government units, in accordance with the Constitution and the Law,

shall autonomously regulate the organisation and competences of its bodies and public

services.

The Assembly of an autonomous province and local self-government unit

Article 180

The Assembly shall be the supreme body of the autonomous province

and a local self-government unit.

The Assembly shall be constitutes of deputies, and the assembly of a

local self-government unit of councilors.

Deputies and councilors shall be elected for the period of four years,

in direct elections by secret ballot, namely, deputies in accordance with the decision

of the Assembly of the autonomous province, and councilors in accordance with the

Law.

In those autonomous provinces and local self-government units with

the population of mixed nationalities, a proportional representation of national

minorities in assemblies shall be provided for, in accordance with the Law.

Cooperation of autonomous provinces and local self-government units

Article 181

Autonomous provinces and local self-government units shall cooperate

with the corresponding territorial communities and local self-government units from other

countries, within the foreign policy of the Republic of Serbia, observing the territorial

integrity and legal system of the Republic of Serbia.

Autonomous provinces

Concept, establishment and territory of autonomous province

Article 182

Autonomous provinces shall be autonomous territorial communities

established by the Constitution, in which citizens exercise the right to the provincial

autonomy.

In the Republic of Serbia, there are the Autonomous Province of Vojvodina

and the Autonomous Province of Kosovo and Metohija. The substantial autonomy of the

Autonomous province of Kosovo and Metohija shall be regulated by the special law which

shall be adopted in accordance with the proceedings envisaged for amending the

Constitution.

New autonomous provinces may be established, and already established

ones may be revoked or merged following the proceedings envisaged for amending the

Constitution. The proposal to establish new, or revoke or merge the existing autonomous

provinces shall be established by citizens in a referendum, in accordance with the Law.

Territory of autonomous provinces and the terms under which borders

between autonomous provinces may be altered shall be regulated by the Law. Territory of

autonomous provinces may not be altered without the consent of its citizens given in a

referendum, in accordance with the Law.

Competences of autonomous provinces

Article 183

Autonomous provinces shall, in accordance with the Constitution and their

Statutes, regulate the competences, election, organisation and work of bodies and

services they establish.

Autonomous provinces shall, in accordance with the Law, regulate the

matters of provincial interest in the following fields:

urban planning and development,
agriculture, water economy, forestry, hunting, fishery, tourism, catering,

spas and health resorts, environmental protection, industry and

craftsmanship, road, river and railway transport and road repairs,

organising fairs and other economic events,

education, sport, culture, health care and social welfare and public

informing at the provincial level.

Autonomous provinces shall see to exercising human and minority rights,

in accordance with the Law.

Autonomous provinces shall establish their symbols, as well as the manner

in which they shall be put to use.

Autonomous provinces shall manage the provincial assets in the manner

stipulated by the Law.

Autonomous provinces shall, in accordance with the Constitution and the

Law, have direct revenues, provide the resources for local self-government units for

performing the delegated affairs and adopt their budget and annual balance sheet.

Financial autonomy of autonomous provinces

Article 184

An autonomous province shall have direct revenues for financing its

competences.

A kind and amount of direct revenues shall be stipulated by the Law.

The Law shall specify the share of autonomous provinces in the part of

revenue of the Republic of Serbia.

The budget of the Autonomous Province of Vojvodina shall amount to at

least 7% in relation to the budget of the Republic of Serbia, bearing in mind that threesevenths

of the budget of the Autonomous Province of Vojvodina shall be used for

financing the capital expenditures.

Legal acts of autonomous province

Article 185

The Statute shall be the supreme legal act of the autonomous province.

The Statute of the Autonomous Province of Vojvodina shall be adopted by

its Assembly, subject to prior approval of the National Assembly.

The autonomous province shall enact other decisions and general acts

pertaining to matters within its competences.

Monitoring the work of bodies of autonomous province

Article 186

The Government may institute, before the Constitutional Court, the

proceedings of assessing the constitutionality and legality of a decision adopted by the

autonomous province, prior to its coming into force. In that sense, prior to passing its

decision, the Constitutional Court may defer coming into force of the challenged decision of

the autonomous province.

Protection of the provincial autonomy

Article 187

A body designated by the Statute of the autonomous province shall have a

right to lodge an appeal with the Constitutional Court, if an individual legal act or action of a

state body or body of local self-government unit obstructs performing the competences of

the autonomous province.

A body designated by the Statute of the autonomous province may

institute the proceedings of assessing the constitutionality or legality of the law and other

legal act of the Republic of Serbia or the legal act of the local self-government unit which

violates the right to the provincial autonomy.

Local self-government

General provisions

Article 188

Local self-government units shall be municipalities, towns and the City of

Belgrade.

The territory and seat of a local self-government unit shall be specified by

the Law.

Establishment, revocation or alteration of the territory of a local selfgovernment

unit shall be preceded by a referendum on the territory of that local selfgovernment

unit.

Affairs of a local self-government unit shall be financed form the direct

revenues of the local self-government unit, the budget of the Republic of Serbia, in

accordance with the Law, and the budget of the Autonomous Province of Vojvodina, in

cases when the autonomous province delegated the performing of affairs within its

competences, in accordance with the decision of the Assembly of the Autonomous

Province.

Status of local self-government units

Article 189

Municipalities shall be established and revoked by the Law.

A town shall be established by the Law, in accordance with the criteria

stipulated by the Law regulating local self-government.

A town shall have competences delegated to the municipality by the

Constitution, whereas other competences may be delegated to it by the Law.

It may be envisaged in the Statute of the town to establish two or more

town municipalities on the territory of the town. The Statute of the town shall regulate the

affairs falling within the town competence performed by town municipalities.

The status of the City of Belgrade, the capital of the Republic of Serbia,

shall be regulated by the Law on the Capital and the Statute of the City of Belgrade. The

City of Belgrade shall have competences delegated to the municipality and city by the

Constitution and the Law, and other competences may be delegated to it in accordance

with the Law on the Capital.

Competence of municipality

Article 190

The municipality shall, through its bodies, and in accordance with the Law:

regulate and provide for the performing and development of municipal

activities;

regulate and provide for the use of urban construction sites and

business premises;

be responsible for construction, reconstruction, maintenance and use

of local network of roads and streets and other public facilities of

municipal interest; regulate and provide for the local transport;

be responsible for meeting the needs of citizens in the field of

education, culture, health care and social welfare, child welfare, sport

and physical culture;

be responsible for development and improvement of tourism,

craftsmanship, catering and commerce;

be responsible for environmental protection, protection against natural

and other disasters; protection of cultural heritage of the municipal

interest;

protection, improvement and use of agricultural land;
perform other duties specified by the Law.

The municipality shall autonomously, in accordance with the Law, adopt its

budget and annual balance sheet, the urban development plan and municipal

development programme, establish the symbols of the municipality, as well as their use.

The municipality shall see to exercising, protection and improvement of

human and minority rights, as well as to public informing in the municipality.

The municipality shall autonomously manage the municipal assets, in

accordance with the Law.

The municipality shall, in accordance with the Law, prescribe offences

related to violation of municipal regulations.

Municipal legal acts and bodies

Article 191

The Statute shall be the supreme legal act of the municipality. The Statute

shall be adopted by the Municipal Assembly.

The Municipal Assembly shall pass general acts within its competences,

adopt the budget and annual balance sheet, adopt the development plan and the

municipal spatial plan, schedule the municipal referendum and perform other duties

specified by the Law and the Statute.

Municipal bodies shall be the Municipal Assembly and other bodies

designated by the Statute, in accordance with the Law.

The Municipal Assembly shall decide on the election of municipal

executive bodies, in accordance with the Law and the Statute.

Election of executive bodies of the town and the City of Belgrade shall be

regulated by the Law.

Monitoring the work of municipality

Article 192

The Government shall be obliged to cancel the enforcement of the

municipal general act which it considers to be in noncompliance with the Constitution or

the Law, and institute the proceedings of assessing its constitutionality or legality within five

days.

The Government may, under the terms specified by the Law, dismiss the

Municipal Assembly.

Simultaneously with the dismissal of the Municipal Assembly, the

Government shall appoint a temporary body which shall perform duties within the

competences of the Assembly, taking into consideration the political and national

composition of the dismissed Municipal Assembly.

Protection of local self-government

Article 193

The body designated by the Statute of the municipality shall have the right

to lodge an appeal with the Constitutional Court if an individual legal act or action by a state

body or body of local self-government unit obstructs performing the competences of the

municipality.

The body designated by the Statute of the municipality may institute the

proceedings of assessing the constitutionality or legality of the Law or other legal act of the

Republic of Serbia or autonomous province which violates the right to local selfgovernment.

PART EIGHT.- CONSTITUTIONALITY AND LEGALITY

Hierarchy of domestic and international general legal acts

Article 194

The legal system of the Republic of Serbia shall be unique.

The Constitution shall be the supreme legal act of the Republic of Serbia.

All laws and other general acts enacted in the Republic of Serbia must be

in compliance with the Constitution.

Ratified international treaties and generally accepted rules of ithe

international law shall be part of the legal system of the Republic of Serbia. Ratified

international treaties may not be in noncompliance with the Constitution.

Laws and other general acts enacted in the Republic of Serbia may not be

in noncompliance with the ratified international treaties and generally accepted rules of the

International Law.

Hierarchy of domestic general legal acts

Article 195

All by-laws of the Republic of Serbia, general acts of organisations with

delegated public powers, political parties, trade unions and civic associations and collective

agreements must be in compliance with the Law.

Statutes, decisions and other general acts of autonomous provinces and

local self-government units must be in compliance with the Law.

All general acts of autonomous provinces and local self-government units

must be in compliance with their statutes.

Publication of laws and other general acts

Article 196

Laws and all other general acts shall be published prior to coming into

force.

The Constitution, laws and by-laws of the Republic of Serbia shall be

published in the republic official journal, and statutes, decisions and other general acts of

autonomous provinces shall be published in provincial official journals.

Statutes and general acts of local self-government units shall be published

in local official journals.

Laws and other general acts shall come into force no earlier than on the

eighth day from the day of publication and may come into force earlier only if there

are particularly justified grounds for that, specified at the time of their adoption.

Prohibition of retroactive effect of laws and other general acts

Article 197

Laws and other general acts may not have a retroactive effect.

Exceptionally, only some of the law provisions may have a retroactive

effect, if so required by general public interest as established in the procedure of

adopting the Law.

A provision of the Penal Code may have a retroactive effect only if it shall

be more favourable for the perpetrator.

Legality of administration

Article 198

Individual acts and actions of state bodies, organisations with delegated

public powers, bodies of autonomous provinces and local self-government units must be

based on the Law.

Legality of final individual acts deciding on a right, duty or legally grounded

interest shall be subject to reassessing before the court in an administrative proceedings, if

other form of court protection has not been stipulated by the Law.

Language of proceedings

Article 199

Everyone shall have the right to use his/her language in the proceedings

before the court, other state body or organisation performing public powers, when his/her

right or duty is decided on.

Unfamiliarity with the language of the proceedings may not be an

impediment for the exercise and protection of human and minority rights.

State of emergency

Article 200

When the survival of the state or its citizens is threatened by a public

danger, the National Assembly shall proclaim the state of emergency.

The decision on the state of emergency shall be effective 90 days at the

most. Upon expiry of this period, the National Assembly may extend the decision on the

state of emergency for another 90 days, by the majority votes of the total number of

deputies.

During the state of emergency, the National Assembly shall convene

without any special call for assembly and it may not be dismissed.

When proclaiming the state of emergency, the National Assembly may

prescribe the measures which shall provide for derogation from human and minority

rights guaranteed by the Constitution.

When the National Assembly is not in a position to convene, the decision

proclaiming the state of emergency shall be adopted by the President of the Republic

together with the President of the National Assembly and the Prime Minister, under the

same terms as by the National Assembly.

When the National Assembly is not in a position to convene, the measures

which provide for derogation from human and minority rights may be prescribed by the

Government, in a decree, with the President of the Republic as a co-signatory.

Measures providing for derogation from human and minority rights

prescribed by the National Assembly or Government shall be effective 90 days at the most,

and upon expiry of that period may be extended under the same terms.

When the decision on the state of emergency has not been passed by the

National Assembly, the National Assembly shall verify it within 48 hours from its passing,

that is, as soon as it is in a position to convene. If the National Assembly does not verify

this decision, it shall cease to be effective upon the end of the first session of the National

Assembly held after the proclamation of the state of emergency.

In cases when the measures providing for derogation from human and

minority rights have not been prescribed by the National Assembly, the Government shall

be obliged to submit the decree on measures providing for derogation from human and

minority rights to be verified by the National Assembly within 48 hours from its passing, that

is, as soon as the National Assembly is in a position to convene. In other respects, the

measures providing for derogation shall cease to be effective 24 hours prior to the

beginning of the first session of the National Assembly held after the proclamation of the

state of emergency.

The state of war

Article 201

The National Assembly shall proclaim the state of war.

When the National Assembly is not in a position to convene, the

decision on proclamation of the state of war shall be passed by the President of the

Republic together with the President of the National Assembly and the Prime

Minister.

When proclaiming the state of war, the National Assembly may

prescribe the measures which shall provide for derogation from human and minority

rights guaranteed by the Constitution.

When the National Assembly is not in a position to convene, the measures

which provide for derogation from human and minority rights guaranteed by the

Constitution shall be decided on by the President of the Republic together with the

President of the National Assembly and the Prime Minister.

All measures prescribed in the period of the state of war shall be

verified by the National Assembly when in a position to convene.

Derogation form human and minority rights in the state of emergency and war

Article 202

Upon proclamation of the state of emergency or war, derogations from

human and minority rights guaranteed by the Constitution shall be permitted only to the

extent deemed necessary.

Measures providing for derogation shall not bring about differences based

on race, sex, language, religion, national affiliation or social origin.

Measures providing for derogation from human and minority rights shall

cease to be effective upon ending of the state of emergency or war.

Measures providing for derogation shall by no means be permitted in terms

of the rights guaranteed pursuant to Articles 23, 24, 25, 26, 28, 32, 34, 37, 38, 43, 45, 47,

49, 62 , 63, 64 and 78 of the Constitution.

PART NINE.- AMENDING THE CONSTITUTION

Proposal to amend the Constitution and adoption of the amendment to the Constitution

Article 203

A proposal to amend the Constitution may be submitted by at least one

third of the total number of deputies, the President of the Republic, the Government and at

least 150,000 voters.

The National Assembly shall decide on amending the Constitution.

A proposal to amend the Constitution shall be adopted by a two-third

majority of the total number of deputies.

If the required majority of votes has not been achieved, the amending of

the Constitution according to the issues contained in the submitted proposal which has not

been adopted shall not be considered in the following twelve months.

In case the National Assembly adopts the proposal for amending the

Constitution, an act on amending the Constitution shall be drafted, that is, considered.

The National Assembly shall adopt an act on amending the Constitution by

a two-third majority of the total number of deputies and may decide to have it endorsed in

the republic referendum by the citizens.

The National Assembly shall be obliged to put forward the act on

amending the Constitution in the republic referendum to have it endorsed, in cases when

the amendment of the Constitution pertains to the preamble of the Constitution, principles

of the Constitution, human and minority rights and freedoms, the system of authority,

proclamation the state of war and emergency, derogation from human and minority rights

in the state of emergency or war or the proceedings of amending the Constitution.

When the act on amending the Constitution is put forward for

endorsement, the citizens shall vote in the referendum within no later than 60 days from

the day of adopting the act on amending the Constitution. The amendment to the

Constitution shall be adopted if the majority of voters who participated in the referendum

voted in favour of the amendment.

The act on amending the Constitution endorsed in the republic referendum

shall come into force once promulgated by the National Assembly.

If the National Assembly does not decide to put forward the act on

amending the Constitution for endorsement, the amendment of the Constitution shall be

adopted by voting in the National Assembly, and the act on amending the Constitution

shall come into force once promulgated by the National Assembly.

Prohibition to amend the Constitution

Article 204

The Constitution shall not be amended in the time of the state of war or

emergency.

Constitutional law

Article 205

A constitutional law shall be enacted for the enforcement of the

amendments to the Constitution.

A constitutional law shall be adopted by a two-third majority of the total

number of deputies.

PART TEN.- FINAL PROVISION

Article 206

This Constitution shall come into force on the day of its promulgation

in the National Assembly.

15May/18

Legea 235/2015

15 mayo, 2018Ley, RumaníaJosé Cuervo

Legea 235/2015 pentru modificarea si completarea Legii nr. 506/2004 privind prelucrarea datelor cu caracter personal si protectia vietii private in sectorul comunicatiilor electronice. (Publicat in Monitorul Oficial, Partea I nr. 767 din 14 octombrie 2015)

Parlamentul Romaniei adopta prezenta lege.

Articol unic

Legea nr. 506/2004 privind prelucrarea datelor cu caracter personal si protectia vietii private in sectorul comunicatiilor electronice, publicata in Monitorul Oficial al Romaniei, Partea I, nr. 1.101 din 25 noiembrie 2004, cu modificarile si completarile ulterioare, se modifica si se completeaza dupa cum urmeaza:

1. La articolul 2 alineatul (1), dupa litera b) se introduce o noua litera, litera b.1), cu urmatorul cuprins:

«b.1) date de identificare a echipamentului.- date tehnice ale furnizorilor de servicii de comunicatii destinate publicului si ale furnizorului de retele publice de comunicatii electronice, care permit identificarea amplasamentului echipamentelor de comunicatii ale acestora, prelucrate in scopul transmiterii unei comunicari printr-o retea de comunicatii electronice sau in scopul facturarii contravalorii acestei operatiuni;»

2. La articolul 5, alineatul (1) se modifica si va avea urmatorul cuprins:

«Art. 5
(1) Datele de trafic referitoare la abonati si la utilizatori, prelucrate si stocate de catre furnizorul unei retele publice de comunicatii electronice sau de catre furnizorul unui serviciu de comunicatii electronice destinat publicului, trebuie sa fie sterse sau transformate in date anonime, atunci cand nu mai sunt necesare la transmiterea unei comunicari, dar nu mai tarziu de 3 ani de la data efectuarii comunicarii, cu exceptia situatiilor prevazute la alin. (2), (3) si (5).»

3. La articolul 5, dupa alineatul (2) se introduce un nou alineat, alineatul (2.1), cu urmatorul cuprins:

«(2.1) Prelucrarea datelor de trafic efectuata in scopul stabilirii obligatiilor contractuale ce privesc abonatii serviciilor de comunicatii cu plata in avans este permisa pana la implinirea unui termen de 3 ani de la data efectuarii comunicarii.»

4. Dupa articolul 12 se introduce un nou articol, articolul 12.1, cu urmatorul cuprins:

«Articolul 12.1 Accesul la date al autoritatilor

(1) La solicitarea instantelor de judecata sau la solicitarea organelor de urmarire penala ori a organelor de stat cu atributii in domeniul apararii si securitatii nationale, cu autorizarea prealabila a judecatorului stabilit potrivit legii, furnizorii de servicii de comunicatii electronice destinate publicului si furnizorii de retele publice de comunicatii electronice pun la dispozitia acestora, de indata, dar nu mai tarziu de 48 de ore, datele de trafic, datele de identificare a echipamentului si datele de localizare, in conformitate cu prevederile referitoare la protectia datelor cu caracter personal.

(2) Solicitarile privind datele prevazute la alin. (1), formulate de catre organele de stat cu atributii in domeniul apararii si securitatii nationale, sunt supuse dispozitiilor art. 14, 15 si art. 17-23 din Legea nr. 51/1991 privind securitatea nationala a Romaniei, republicata.

(3) Solicitarile, respectiv raspunsurile, daca sunt transmise in format electronic, se semneaza cu semnatura electronica extinsa bazata pe un certificat calificat, eliberat de un furnizor de servicii de certificare acreditat. Fiecare persoana care certifica datele sub semnatura electronica raspunde, potrivit legii, pentru integritatea si securitatea acestor date.

(4) Solicitarile prevazute la alin. (1) se proceseaza in conditii de confidentialitate.

(5) Datele de trafic, datele de identificare a echipamentului si datele de localizare solicitate conform alin. (1) nu fac obiectul stergerii sau anonimizarii de catre furnizori, atunci cand solicitarea formulata in temeiul alin. (1) este insotita sau urmata de o notificare cu privire la necesitatea mentinerii lor, in scopul identificarii si conservarii probelor sau indiciilor temeinice, in cadrul investigatiilor pentru combaterea infractiunilor sau in domeniul apararii si securitatii nationale, atata timp cat subzista motivele care au stat la baza solicitarii, dar nu mai mult de 5 ani de la data solicitarii sau, dupa caz, pana la pronuntarea unei hotarari definitive a instantei de judecata.

(6) Instantele de judecata, organele de urmarire penala sau organele de stat cu atributii in domeniul apararii si securitatii nationale notifica furnizorilor incetarea motivelor care au stat la baza solicitarii sau, dupa caz, pronuntarea unei hotarari judecatoresti definitive.»

14May/18

Decizia Nr. 23/2012

14 mayo, 2018Decisión, RumaníaDecizia Nr. 23/2012 privind stabilirea cazurilor in care nu este necesara notificarea prelucrarii unor date cu caracter personal (Publicat in Monitorul Oficial, Derecho Informático, Legislación de Rumania, Partea I Nr. 216 din 2 aprilie 2012)José Cuervo

Decizia Nr. 23/2012 privind stabilirea cazurilor in care nu este necesara notificarea prelucrarii unor date cu caracter personal (Publicat in Monitorul Oficial, Partea I Nr. 216 din 2 aprilie 2012)

AUTORITATEA NATIONALA DE SUPRAVEGHERE A PRELUCRARII DATELOR CU CARACTER PERSONAL

Vazand Referatul Nr. 25 din 7 martie 2012 al Biroului juridic si comunicare din cadrul Autoritatii Nationale de Supraveghere a Prelucrarii Datelor cu Caracter Personal privind propunerea emiterii unei decizii privind stabilirea unor cazuri in care nu este necesara notificarea prelucrarii unor date cu caracter personal, in aplicarea prevederilor art. 22 alin. (9) din Legea Nr. 677/2001 pentru protectia persoanelor cu privire la prelucrarea datelor cu caracter personal si libera circulatie a acestor date, cu modificarile si completarile ulterioare, conform carora autoritatea de supraveghere poate stabili cazuri in care notificarea nu este necesara, luand in considerare faptul ca anumite prelucrari de date nu sunt susceptibile, in cazul utilizarii lor regulate, de a afecta cel putin aparent, drepturile persoanelor vizate, in temeiul prevederilor art. 3 alin. (5) si (6) din Legea Nr. 102/2005 privind infiintarea, organizarea si functionarea Autoritatii Nationale de Supraveghere a Prelucrarii Datelor cu Caracter Personal, cu modificarile si completarile ulterioare, si ale art. 6 alin. (2) lit. b) din Regulamentul de organizare si functionare a Autoritatii Nationale de Supraveghere a Prelucrarii Datelor cu Caracter Personal, aprobat prin Hotararea Biroului permanent al Senatului nr. 16/2005, cu modificarile si completarile ulterioare, presedintele Autoritatii Nationale de Supraveghere a Prelucrarii Datelor cu Caracter Personal emite prezenta decizie.

Art. 1

Notificarea prelucrarii datelor cu caracter personal nu este necesara in urmatoarele cazuri:

a) cand prelucrarea datelor cu caracter personal este efectuata de persoanele fizice sau de entitatile private care desfasoara o activitate independenta, autorizata in baza unei legi speciale, in scopul indeplinirii atributiilor lor legale;

b) cand prelucrarea datelor cu caracter personal este efectuata in scopul gestionarii bazei de date detinute de Arhivele Nationale;

c) cand prelucrarea datelor cu caracter personal este efectuata in scopul imprumuturilor de carti, opere cinematografice, artistice, alte opere audiovizuale, precum si de reproduceri ale acestora de catre entitatile de drept public si privat;

d) cand prelucrarea datelor cu caracter personal este efectuata de autoritatea judecatoreasca in scopul indeplinirii atributiilor sale legale, altele decat cele prevazute la art. 2 alin. (5) din Legea nr. 677/2001 pentru protectia persoanelor cu privire la prelucrarea datelor cu caracter personal si libera circulatie a acestor date, cu modificarile si completarile ulterioare;

e) cand prelucrarea datelor cu caracter personal este efectuata de autoritatile administratiei publice locale, precum si de autoritatile administratiei publice la nivel judetean si al municipiului Bucuresti, in scopul indeplinirii atributiilor lor legale;

f) cand prelucrarea datelor cu caracter personal este efectuata in scopul intermedierii tranzactiilor imobiliare;

g) cand prelucrarea datelor cu caracter personal referitoare la proprii membri este efectuata de partidele politice, cu conditia ca datele sa nu fie dezvaluite unor terti fara consimtamantul persoanei vizate.

Art. 2

Exceptiile de la obligatia de a notifica prevazute la art. 1 nu exonereaza operatorul de indeplinirea celorlalte obligatii care ii revin potrivit dispozitiilor legale aplicabile in domeniul protectiei datelor cu caracter personal.

Art. 3

La articolul 1 din Decizia presedintelui Autoritatii Nationale de Supraveghere a Prelucrarii Datelor cu Caracter Personal nr. 91/2008 privind cazurile in care este permisa notificarea simplificata a prelucraarii datelor cu caracter personal, publicata in Monitorul Oficial al Romaniei, Partea I, nr. 654 din 28 iulie 2006, se abroga literele a), b), c), d), f), g), h) si j).

Art. 4

Formularul tipizat al notificarilor, aprobat prin Decizia presedintelui Autoritatii Nationale de Supraveghere a Prelucrarii Datelor cu Caracter Personal Nr. 95/2008 privind stabilirea formularului tipizat al notificarilor prevazute de Legea Nr. 677/2001 pentru protectia persoanelor cu privire la prelucarea datelor cu caracter personal si libera circulatie a acestor date, publicata in Monitorul Oficial al Romaniei, Partea I, nr. 876 din 24 decembrie 2008, se modifica prin inlocuirea coordonatelor de contact ale Autoritatii Nationale de Supraveghere a Prelucrarii Datelor cu Caracter Personal cu actualele coordonate, astfel: «Bd. Gheorghe Magheru nr. 28/30, sectorul 1, Bucuresti, telefon 031.805.9211».

Art. 5

Prezenta decizie intra in vigoare la data publicarii in Monitorul Oficial al Romaniei, Partea I.

Art. 6

Prezenta decizie nu aduce atingere prevederilor Deciziei presedintelui Autoritatii Nationale de Supraveghere a Prelucrarii Datelor cu Caracter Personal nr. 90/2006 privind cazurile in care nu este necesara notificarea prelucrarii unor date cu caracter personal, publicata in Monitorul Oficial al Romaniei, Partea I, Nr. 654 din 28 iulie 2006, ale Deciziei presedintelui Autoritatii Nationale de Supraveghere a Prelucrarii Datelor cu Caracter Personal Nr. 100/2007 privind stabilirea cazurilor in care nu este necesara notificarea prelucrarii unor date cu caracter personal, publicata in Monitorul Oficial al Romaniei, Partea I, Nr. 823 din 3 decembrie 2007, si ale Deciziei presedintelui Autoritatii Nationale de Supraveghere a Prelucrarii Datelor cu Caracter Personal Nr. 28/2007 privind transferurile datelor cu caracter personal catre alte state, publicata in Monitorul Oficial al Romaniei, Partea I, Nr. 182 din 16 martie 2007.

Presedintele Autoritatii Nationale de Supraveghere a Prelucrarii Datelor cu Caracter Personal, Georgeta Basarabescu

Bucuresti, 26 martie 2012.

14May/18

Legea Nr. 81 din 13 iunie 2012

14 mayo, 2018Ley, RumaníaJosé Cuervo

Legea Nr. 81/2012 pentru modificarea si completarea Legii Nr. 238/2009 privind reglementarea prelucrarii datelor cu caracter personal de catre structurile/unitatile Ministerului Administratiei si Internelor in activitatile de prevenire, cercetare si combatere a infractiunilor, precum si de mentinere si asigurare a ordinii publice (Publicat in Monitorul Oficial, Partea I nr. 400 din 14 iunie 2012)

Parlamentul Romaniei adopta prezenta lege.

Art. I. –
Legea Nr. 238/2009 privind reglementarea prelucrării datelor cu caracter personal de către structurile/unitățile Ministerului Administrației și Internelor în activitățile de prevenire, cercetare și combatere a infracțiunilor, precum și de menținere și asigurare a ordinii publice, publicată în Monitorul Oficial al României, Partea I, Nr. 405 din 15 iunie 2009, se modifică și se completează după cum urmează:

1. La articolul 1, după alineatul (2) se introduce un nou alineat, alineatul (3), cu următorul cuprins:

«(3) Prezenta lege nu se aplică prelucrărilor și transferului de date cu caracter personal efectuate în îndeplinirea atribuțiilor legale de structurile/unitățile M.A.I. în domeniul apărării naționale și securității naționale, în limitele și cu restricțiile stabilite de lege.»

2. După articolul 1 se introduce un nou articol, articolul 1.1, cu următorul cuprins:

«Art. 1.1. –
În înțelesul prezentei legi, termenii și expresiile de mai jos au următoarea semnificație:

a) interconectare .- operațiunea de a pune în legătură datele cu caracter personal cuprinse într-un fișier, bază de date sau sistem de evidență automat cu cele cuprinse într-unul sau mai multe fișiere, baze de date sau sisteme de evidență automate care sunt gestionate de operatori diferiți sau de către același operator, dar având scopuri diferite, similare sau corelate, după caz;

b) semnalare .- setul de date introduse într-un sistem de evidență a datelor cu caracter personal referitoare la persoane sau bunuri cu privire la care au fost dispuse unele măsuri, în condițiile legii, în vederea realizării unui interes public, a respectării regimului liberei circulații a persoanelor și bunurilor sau a asigurării ori menținerii ordinii și siguranței publice;

c) blocare .- marcarea unor date cu caracter personal stocate, în scopul limitării prelucrării pe viitor;

d) atribuirea de referințe .- marcarea unor date cu caracter personal stocate, fără a avea ca scop limitarea prelucrării lor ulterioare;

e) transformarea în date anonime .- modificarea datelor cu caracter personal, astfel încât detaliile privind circumstanțele personale sau materiale să nu mai permită atribuirea acestora unei persoane fizice identificate sau identificabile sau atribuirea să fie posibilă doar în condițiile unei investiții disproporționate de timp, costuri și forță de muncă;

f) consimțământul persoanei vizate .- orice manifestare de voință, liberă, specifică și informată, prin care persoana vizată acceptă să fie prelucrate datele cu caracter personal care o privesc;

g) evidență pasivă .- fișier sau bază de date cu caracter personal constituit în scopul accesării limitate și ulterior ștergerii datelor stocate din sistemul de evidență.»

3. După articolul 5 se introduc două noi articole, articolele 5.1 și 5.2, cu următorul cuprins:

«Art. 5.1. –
(1) Datele cu caracter personal se blochează atunci când există motive întemeiate să se considere că ștergerea lor ar putea afecta drepturile, libertățile și interesele legitime ale persoanei vizate.

(2) Datele blocate se prelucrează doar în scopul care a împiedicat ștergerea lor.

(3) Datele blocate se șterg de îndată ce nu mai sunt necesare scopului prevăzut la alin. (2).

Art. 5.2. –
Structurile/unitățile M.A.I. prelucrează suplimentar date cu caracter personal, într-un alt scop decât cel pentru care datele au fost colectate, dacă sunt îndeplinite următoarele condiții:

a) prelucrarea este compatibilă cu scopul în care au fost colectate datele;

b) scopul în care urmează a fi prelucrate suplimentar datele cu caracter personal de către structurile/unitățile M.A.I. sau entitățile cărora urmează să le fie comunicate datele se încadrează în atribuțiile sau, după caz, obligațiile ce le revin potrivit legii;

c) prelucrarea este necesară și proporțională în raport cu noul scop.»

4. Articolul 7 se modifică și va avea următorul cuprins:

«Art. 7. –
(1) Datele cu caracter personal deținute de structurile/unitățile M.A.I. potrivit scopurilor prevăzute la art. 1 alin. (1) pot fi transferate următorilor destinatari:

a) autorităților polițienești, judiciare sau altor autorități competente din statele membre ori organismelor sau instituțiilor Uniunii Europene cu atribuții în domeniul cooperării polițienești ori judiciare în materie penală;

b) Organizației Internaționale a Poliției Criminale – Interpol sau altor instituții internaționale similare;

c) organismelor de poliție din state terțe.

(2) Transferul datelor cu caracter personal prevăzut la alin. (1) se realizează în una dintre următoarele situații:

a) există o prevedere legală expresă în legislația națională sau într-un tratat ratificat de România;

b) există prevederi legale care reglementează cooperarea polițienească sau cooperarea judiciară internațională în materie penală;

c) când transferul este necesar pentru prevenirea unui pericol grav și iminent asupra vieții, integrității corporale sau sănătății unei persoane ori a proprietății acesteia, precum și pentru combaterea unei infracțiuni grave prevăzute de lege, cu respectarea legii române.»

5. La articolul 8, alineatul (3) se modifică și va avea următorul cuprins:

«(3) În situația în care au fost transmise date incorecte sau neactualizate, structurile/unitățile M.A.I. au obligația să îi informeze pe destinatarii respectivelor date asupra neconformității acestora, cu menționarea datelor care au fost modificate sau, dacă este cazul, cu precizarea că datele transmise trebuie rectificate, șterse ori blocate.»

6. La articolul 8, după alineatul (3) se introduc trei noi alineate, alineatele (4)-(6), cu următorul cuprins:

«(4) În situația în care se constată că au fost transmise date cu caracter personal în mod ilegal, structurile/unitățile M.A.I. au obligația de a-i informa pe destinatarii acestor date, cu precizarea că datele transmise trebuie șterse de îndată.

(5) În situația în care se constată că structurilor/unităților M.A.I. le-au fost transmise date cu caracter personal incorecte sau neactualizate, datele se rectifică, se șterg sau, după caz, se blochează, în condițiile legii. Dacă structurilor/unităților M.A.I. le sunt transmise în mod eronat sau ilegal astfel de date, acestea se șterg sau, după caz, se blochează de îndată. Entitatea care a transmis datele este informată cu privire la măsura adoptată și motivul adoptării acesteia.

(6) În cazul în care structurilor/unităților M.A.I. le sunt transmise, potrivit legii, date cu caracter personal nesolicitate, acestea au obligația de a verifica dacă datele sunt necesare în scopul pentru care au fost transmise. Datele care nu sunt necesare scopului se șterg sau, după caz, se blochează de îndată. Entitatea care a transmis datele este informată cu privire la măsura adoptată și motivul adoptării acesteia.»

7. La articolul 9, alineatul (1) se modifică și va avea următorul cuprins:

«Art. 9. –
(1) La comunicarea datelor cu caracter personal către alte autorități sau instituții publice, entități de drept privat care își desfășoară activitatea pe teritoriul României sau în afara acestuia, ori către destinatarii prevăzuți la art. 7 alin. (1), structurile/unitățile M.A.I. atenționează destinatarii asupra interdicției de a prelucra datele comunicate în alte scopuri decât cele specificate în cererea de comunicare.»

8. La articolul 9, după alineatul (1) se introduc două noi alineate, alineatele (1.1) și (1.2), cu următorul cuprins:

«(1.1) La comunicarea datelor cu caracter personal potrivit alin. (1) i se indică destinatarului limitări ale prelucrării, dacă este cazul, și termene de păstrare adecvate și se precizează obligația de a șterge datele cu caracter personal transmise la expirarea termenului indicat sau, dacă este cazul, de a proceda la blocarea acestora. Termenele de păstrare comunicate nu pot depăși termenele stabilite prin prevederi legale ori, după caz, cele stabilite de structurile/unitățile M.A.I. prin reguli proprii, potrivit dispozițiilor art. 14 pentru acele categorii de date cu caracter personal pe care le dețin și urmează să facă obiectul comunicării.

(1.2) În cazul în care se comunică date cu caracter personal destinatarilor prevăzuți la art. 7 alin. (1) lit. a), pot fi comunicate limitări ale prelucrării doar dacă acestea sunt stabilite de lege, iar termenele de păstrare sunt cele stabilite prin prevederi legale ori, după caz, de structurile/unitățile M.A.I. prin reguli proprii, potrivit dispozițiilor art. 14.»

9. La articolul 9, după alineatul (2) se introduce un nou alineat, alineatul (3), cu următorul cuprins:

«(3) Structurile/Unitățile M.A.I. pot solicita destinatarilor prevăzuți la alin. (1), cărora le-au fost comunicate date cu caracter personal, informații cu privire la modul în care acestea au fost prelucrate.»

10. După articolul 9 se introduc cinci noi articole, articolele 9.1-9.5, cu următorul cuprins:

«Art. 9.1. –

(1) Pentru datele cu caracter personal comunicate de către alte autorități competente sau entități de drept privat din afara teritoriului României, în cazul în care este precizat un termen de păstrare a datelor, structurile/unitățile M.A.I. au obligația de a șterge ori, după caz, de a bloca datele la expirarea termenului de păstrare a datelor indicat. În cazul în care nu este precizat un termen de păstrare a datelor, sunt aplicabile termenele de stocare a datelor cu caracter personal, stabilite pentru acele categorii de date, de către structurile/unitățile M.A.I., potrivit dispozițiilor art. 14.

(2) În cazul datelor cu caracter personal prevăzute la alin. (1), structurile/unitățile M.A.I. au obligația de a verifica periodic, o dată la 3 ani, necesitatea stocării acestora.

(3) Datele cu caracter personal a căror stocare nu mai este necesară se șterg sau, după caz, se blochează, chiar dacă nu s-a împlinit termenul precizat de entitatea care le-a transmis ori cel prevăzut de regulile stabilite potrivit dispozițiilor art. 14.

(4) Dispozițiile alin. (1) nu se aplică dacă la momentul expirării termenului de păstrare a datelor, indicat de autoritatea competentă sau entitatea de drept privat din afara teritoriului României, datele cu caracter personal sunt în continuare necesare pentru efectuarea de acte premergătoare în vederea începerii urmăririi penale, pentru desfășurarea urmăririi penale sau pentru executarea unei pedepse.

Art. 9.2. –
Datele cu caracter personal comunicate de către autoritățile competente ale unui stat membru al Uniunii Europene, denumit în continuare stat membru, pot fi prelucrate suplimentar de către structurile/unitățile M.A.I., în alt scop decât cel pentru care au fost transmise, în una dintre următoarele situații:

a) pentru prevenirea, constatarea, cercetarea sau urmărirea penală a infracțiunilor ori executarea pedepselor, altele decât cele pentru care au fost comunicate;

b) pentru derularea altor proceduri judiciare sau administrative direct legate de prevenirea, constatarea, cercetarea ori urmărirea penală a infracțiunilor ori executarea pedepselor;

c) pentru prevenirea unui pericol iminent și grav la adresa ordinii și siguranței publice;

d) în orice alt scop, cu consimțământul prealabil al statului membru care transmite sau cu consimțământul persoanei vizate, potrivit legii.

Art. 9.3. –
(1) Datele cu caracter personal comunicate de către autoritățile competente ale unui alt stat membru pot fi transferate de structurile/unitățile M.A.I. către autorități competente dintr-un stat care nu este membru al Uniunii Europene, denumit în continuare stat terț, sau către organisme internaționale, numai dacă sunt îndeplinite, cumulativ, următoarele condiții:

a) se impune pentru prevenirea, constatarea, cercetarea sau urmărirea penală a infracțiunilor ori executarea pedepselor;

b) datele cu caracter personal sunt comunicate organismului internațional ori autorității statului terț competente în prevenirea, constatarea, cercetarea sau urmărirea penală a infracțiunilor sau pentru executarea pedepselor;

c) există acordul statului membru care a comunicat datele pentru transfer;

d) statul terț sau organismul internațional în cauză asigură un nivel corespunzător de protecție pentru prelucrarea de date urmărită.

(2) Datele cu caracter personal pot fi comunicate în condițiile prevăzute la alin. (1), fără acordul statului membru, numai dacă transferul de date este strict necesar pentru prevenirea unui pericol grav și iminent la adresa ordinii și siguranței publice a unui stat membru ori a unui stat terț sau a intereselor fundamentale ale unui stat membru, iar acordul prealabil nu poate fi obținut în timp util.

(3) În situația prevăzută la alin. (2), unitatea/structura M.A.I. care efectuează comunicarea de date cu caracter personal are obligația de a informa de îndată autoritatea competentă din statul membru care a furnizat datele.

(4) Prin excepție de la prevederile alin. (1) lit. d), datele cu caracter personal pot fi comunicate către autoritățile competente dintr-un stat terț sau către organismele internaționale, cu respectarea dispozițiilor art. 30 lit. d) ori e) din Legea nr. 677/2001, cu modificările și completările ulterioare.

Art. 9.4. –

(1) Datele cu caracter personal comunicate de către autoritățile competente ale unui alt stat membru pot fi transferate către entități de drept privat dintr-un stat membru, altul decât cel care a furnizat datele, numai dacă sunt îndeplinite, cumulativ, următoarele condiții:

a) autoritatea competentă din statul membru care a comunicat datele și-a dat acordul pentru efectuarea prelucrării;

b) niciun interes specific legitim al persoanei vizate nu împiedică transmiterea;

c) în situații specifice, comunicarea este esențială pentru autoritatea competentă care transmite date unei entități private.

(2) Cazurile specifice pentru care se consideră îndeplinită condiția prevăzută la alin. (1) lit. c) sunt determinate de următoarele situații:

a) îndeplinirea unei obligații prevăzute de lege în sarcina entității private;

b) prevenirea, constatarea, cercetarea sau urmărirea penală a infracțiunilor ori executarea pedepselor;

c) prevenirea unui pericol iminent și grav la adresa ordinii și siguranței publice;

d) prevenirea unei vătămări grave a drepturilor persoanei.

(3) Structurile/Unitățile M.A.I. au obligația de a informa entitățile de drept privat cărora le sunt comunicate datele potrivit alin. (1) cu privire la scopurile pentru care, în mod exclusiv, pot fi utilizate datele cu caracter personal comunicate.

Art. 9.5. –
La cerere, structurile/unitățile M.A.I. informează autoritățile competente ale unui alt stat membru care au transmis date cu caracter personal cu privire la modul în care acestea au fost prelucrate, în termen de 15 zile de la înregistrarea solicitării.»

11. La articolul 10, alineatul (2) se modifică și va avea următorul cuprins:

«(2) În scopul prevăzut la alin. (1), interconectarea sistemelor de evidență a datelor cu caracter personal sau a mijloacelor automate de prelucrare a datelor cu caracter personal, constituite potrivit art. 2, se poate realiza și cu sistemele de evidență ori cu mijloacele automate de prelucrare a datelor cu caracter personal deținute de alți operatori, autorități și instituții publice naționale.»

12. La articolul 10, după alineatul (2) se introduc două noi alineate, alineatele (2.1) și (2.2), cu următorul cuprins:

«(2.1) Interconectările prevăzute la alin. (1) și (2) sunt posibile numai cu acordul prealabil al Autorității naționale de supraveghere. În cazul obținerii acordului prealabil, structura/unitatea M.A.I. notifică prelucrarea Autorității naționale de supraveghere, în condițiile prevăzute la art. 3.

(2.2) În scopul prevăzut la alin. (1), interconectarea sistemelor de evidență a datelor cu caracter personal sau a mijloacelor automate de prelucrare a datelor cu caracter personal, constituite potrivit art. 2, se poate realiza și cu sistemele de evidență sau cu mijloacele automate de prelucrare a datelor cu caracter personal deținute de alți operatori, entități de drept privat.»

13. La articolul 10, alineatul (3) se modifică și va avea următorul cuprins:

«(3) Interconectările prevăzute la alin. (2.2) sunt permise numai în cazul efectuării actelor premergătoare, al urmăririi penale sau al judecării unei infracțiuni în baza unei autorizări emise de procurorul competent să efectueze ori să supravegheze, într-un caz determinat, efectuarea actelor premergătoare sau urmărirea penală ori, în cazul judecării unei infracțiuni, de judecătorul anume desemnat de la instanța căreia îi revine competența de a judeca fondul cauzei pentru care sunt prelucrate datele respective.»

14. La articolul 10, alineatul (5) se abrogă.

15. După articolul 10 se introduc cinci noi articole, articolele 10.1-10.5, cu următorul cuprins:

«Art. 10.1. –
(1) În cazul activităților de prevenire a infracțiunilor, de menținere și de asigurare a ordinii publice, sistemele de evidență a datelor cu caracter personal sau mijloacele automate de prelucrare a datelor cu caracter personal, constituite potrivit art. 2, pot fi interconectate cu:

a) Registrul național de evidență a persoanelor;

b) Registrul național de evidență a pașapoartelor simple;

c) Registrul național de evidență a permiselor de conducere și a vehiculelor înmatriculate.

(2) În cazul activităților prevăzute la alin. (1), structurile/unitățile M.A.I. pot interconecta sistemele de evidență a datelor cu caracter personal sau, după caz, mijloacele automate de prelucrare a datelor cu caracter personal pe care le dețin pentru scopuri similare ori corelate.

(3) Interconectările prevăzute la alin. (1) și (2) se notifică Autorității naționale de supraveghere prin modificarea/ completarea notificării sau depunerea unei noi notificări.

(4) În cazul activităților prevăzute la alin. (1), structurile/unitățile M.A.I. pot interconecta sistemele de evidență a datelor cu caracter personal sau, după caz, mijloacele automate de prelucrare a datelor cu caracter personal pe care le dețin pentru scopuri diferite, numai cu acordul prealabil al Autorității naționale de supraveghere. În cazul obținerii acordului, structurile/unitățile M.A.I. notifică prelucrarea datelor Autorității naționale de supraveghere prin modificarea/ completarea notificării sau depunerea unei noi notificări.

(5) Dispozițiile alin. (1)-(4) sunt aplicabile și în cazul activităților de control la frontieră, executate, în condițiile legii, de structura specializată a M.A.I, care impun interconectarea sistemelor de evidență a datelor cu caracter personal sau a mijloacelor automate de prelucrare a datelor cu caracter personal, constituite potrivit dispozițiilor art. 2.

Art. 10.2. –

(1) Structurile/Unitățile M.A.I. pot configura sistemele de evidență a datelor cu caracter personal sau, după caz, mijloacele automate de prelucrare a datelor cu caracter personal pe care le dețin pentru scopuri corelate sau diferite, astfel încât semnalările cu privire la persoane sau bunuri să fie accesibile în orice sistem ori mijloc de prelucrare.

(2) Sistemele de evidență a datelor cu caracter personal sau, după caz, mijloacele automate de prelucrare a datelor cu caracter personal deținute de structurile/unitățile M.A.I. se configurează astfel încât niciun utilizator să nu aibă acces decât la datele cu caracter personal strict necesare desfășurării atribuțiilor de serviciu. Structurile/Unitățile M.A.I. au obligația de a stabili categoriile de date la care are acces fiecare utilizator, în scopul îndeplinirii atribuțiilor de serviciu.

Art. 10.3. –
(1) În cazul sistemelor de evidență constituite potrivit scopurilor prevăzute la art. 1 alin. (1), structurile/unitățile M.A.I. pot permite autorităților, instituțiilor sau organizațiilor prevăzute la art. 7 accesul direct la sistemele gestionate, doar în condiții care să asigure securitatea datelor cu caracter personal, în următoarele situații:

a) în baza unui tratat ratificat de România;

b) în cadrul activității de cooperare polițienească și judiciară în materie penală efectuată în cadrul Uniunii Europene.

(2) Prelucrările efectuate potrivit alin. (1) se notifică Autorității naționale de supraveghere în condițiile art. 3.

(3) În situația prevăzută la alin. (1), prelucrarea datelor cu caracter personal de către autoritățile, instituțiile sau organizațiile prevăzute la art. 7 se permite doar pentru scopul stabilit prin tratat ori, după caz, printr-un instrument juridic al Uniunii Europene.

Art. 10.4. –

(1) În situațiile prevăzute la art. 10 alin. (1), structurile/unitățile M.A.I. dispun măsurile necesare pentru ca toate prelucrările de date cu caracter personal să fie înregistrate în sistem într-un fișier de acces, în scopul monitorizării legalității efectuării prelucrărilor.

(2) Sistemele de evidență sau mijloacele automate de prelucrare a datelor cu caracter personal gestionate de către structurile/unitățile M.A.I. trebuie să fie configurate astfel încât să genereze fișierele de acces și în situația în care structurilor/unităților M.A.I. li se permite accesul direct în sistemele de evidență gestionate de autoritățile, instituțiile sau organizațiile prevăzute la art. 7.

(3) Fișierele de acces trebuie să cuprindă cel puțin data, ora exactă, motivul prelucrării, datele de identificare a autorității, instituției sau, după caz, a organizației care a efectuat prelucrarea, precum și codul de identificare a utilizatorului care a efectuat prelucrarea. Dacă este cazul, fișierele de acces pot conține și datele cu caracter personal care au făcut obiectul prelucrării.

(4) Fișierele de acces pot fi utilizate doar în scopul verificării legalității prelucrării sau pentru asigurarea securității datelor cu caracter personal.

Art. 10.5. –
La cerere, structurile/unitățile M.A.I. comunică, în termen de 15 zile, autorităților competente în domeniul protecției datelor cu caracter personal din afara teritoriului României, înregistrările referitoare la prelucrările efectuate în sistemele de evidență gestionate de entitățile din statul a cărui autoritate a formulat cererea.»

16. La articolul 11, după alineatul (6) se introduce un nou alineat, alineatul (7), cu următorul cuprins:

«(7) În situația în care structurile/unitățile M.A.I. nu pot da curs cererilor formulate în exercitarea dreptului de intervenție în scopul rectificării, ștergerii ori, după caz, blocării datelor cu caracter personal, transmit persoanei vizate un răspuns scris în care sunt menționate motivele care stau la baza imposibilității soluționării solicitării, precum și faptul că aceasta are dreptul de a se adresa Autorității naționale de supraveghere sau, după caz, instanței de judecată.»

17. După articolul 11 se introduc patru noi articole, articolele 11.1-11.4, cu următorul cuprins:

«Art. 11.1. –

(1) În cazul în care structurile/unitățile M.A.I. formulează cereri pentru comunicarea datelor cu caracter personal adresate unor autorități competente ori entități de drept privat din afara teritoriului României, pot solicita ca persoana vizată să nu fie informată cu privire la prelucrare numai dacă sunt aplicabile dispozițiile art. 11 alin. (2). La încetarea motivelor pentru care s-a formulat o astfel de solicitare, structurile/unitățile M.A.I. informează în scris autoritatea competentă ori entitatea de drept privat din afara teritoriului României cu privire la faptul că persoana vizată, ale cărei date cu caracter personal au fost comunicate, poate fi informată cu privire la această prelucrare.

(2) În cazul în care autoritățile competente ale unui stat membru solicită, cu ocazia comunicărilor de date cu caracter personal de către structurile/unitățile M.A.I., ca persoana vizată să nu fie informată, structurile/unitățile M.A.I. dispun informarea persoanei vizate doar cu consimțământul autorității competente solicitante.

Art. 11.2. –

În situația în care cererea persoanei vizate în contextul prelucrării datelor cu caracter personal se referă la o prelucrare efectuată de către o autoritate competentă ori entitate de drept privat din afara teritoriului României în sistemele de evidență gestionate de structurile/unitățile M.A.I., prin derogare de la prevederile art. 13 alin. (3), ale art. 14 alin. (3) și ale art. 15 alin. (4) din Legea nr. 677/2001, cu modificările și completările ulterioare, i se răspunde solicitantului cât mai curând posibil, dar nu mai târziu de 60 de zile de la data primirii cererii. În acest termen, structurile/unitățile M.A.I. solicită informații autorității competente ori entității de drept privat din afara teritoriului României care a efectuat prelucrarea.

Art. 11.3. –

(1) În cazul în care exactitatea unor date cu caracter personal este contestată de persoana vizată, iar exactitatea sau inexactitatea datelor respective nu se poate stabili cu certitudine, acestora li se pot atribui referințe. La cererea persoanei vizate, atribuirea de referințe este obligatorie.

(2) Datele cu caracter personal cărora le-au fost atribuite referințe nu pot fi comunicate decât în scopul stabilirii corectitudinii acestora.

(3) Referințele atribuite potrivit alin. (1) pot fi înlăturate în unul dintre următoarele cazuri:

a) la solicitarea ori cu acordul persoanei vizate, atunci când exactitatea sau, după caz, inexactitatea datelor cu caracter personal a fost stabilită;

b) atunci când există o hotărâre a instanței de judecată sau autorizarea Autorității naționale de supraveghere.

Art. 11.4. –

(1) Structurile/Unitățile M.A.I., în calitate de operatori, răspund pentru prejudiciul cauzat persoanei vizate în urma unei prelucrări de date cu caracter personal, chiar și în situația în care prejudiciul a fost cauzat prin prelucrarea, în condițiile legii, a unor date cu caracter personal inexacte furnizate de o autoritate competentă a unui stat membru.

(2) În situația în care structurile/unitățile M.A.I. sunt obligate, în condițiile legii, la plata unor despăgubiri pentru prejudiciile cauzate persoanei vizate ca urmare a prelucrării unor date cu caracter personal inexacte furnizate de o autoritate competentă a unui stat membru, acestea sunt obligate să dispună măsurile necesare pentru recuperarea sumelor plătite ca despăgubire de la autoritatea care a furnizat datele respective.

(3) Pentru a se asigura îndeplinirea obligației prevăzute la alin. (2), structurile/unitățile M.A.I., care au plătit despăgubiri pentru prejudiciile cauzate persoanei vizate ca urmare a prelucrării unor date cu caracter personal inexacte, informează autoritatea competentă din statul membru care a furnizat aceste date și solicită rambursarea sumei plătite ca despăgubire. Cu această ocazie, structurile/unitățile M.A.I. comunică faptul că prejudiciul a fost cauzat exclusiv ca urmare a prelucrării, în condițiile legii, a datelor inexacte furnizate de autoritatea competentă din statul membru, și nu din culpa structurii/unității M.A.I. care a primit datele cu caracter personal, și anexează documente din care să rezulte:

a) că structura/unitatea M.A.I. a fost obligată la plata despăgubirii pentru prejudiciile cauzate persoanei vizate și că a plătit o sumă de bani;

b) că datele cu caracter personal ale persoanei vizate provin de la această autoritate competentă din statul membru;

c) datele de identificare a contului în care urmează a fi virate sumele de bani.

(4) În situația în care structurilor/unităților M.A.I. li se solicită, de către autorități competente din statele membre, rambursarea unor sume plătite de acestea ca despăgubiri pentru prejudicii cauzate persoanelor vizate ca urmare a prelucrării unor date cu caracter personal inexacte furnizate de structurile/unitățile M.A.I., înainte de plata sumelor solicitate, structurile/unitățile M.A.I. trebuie să verifice dacă:

a) prejudiciul a fost cauzat exclusiv ca urmare a prelucrării datelor inexacte furnizate în condițiile indicate de structura/unitatea M.A.I., și nu din culpa autorității competente solicitante;

b) solicitarea este însoțită de documente din care să rezulte că autoritatea competentă din statul membru a fost obligată la plata despăgubirii pentru prejudiciile cauzate persoanei vizate ca urmare a furnizării de către structurile/unitățile M.A.I. a unor informații inexacte și a că plătit o sumă de bani.»

18. La articolul 12, alineatul (1) se modifică și va avea următorul cuprins:

«Art. 12. –
(1) Datele cu caracter personal stocate în îndeplinirea activităților prevăzute la art. 1 alin. (1) se șterg sau se transformă în date anonime atunci când nu mai sunt necesare scopurilor pentru care au fost colectate ori, după caz, se blochează, în condițiile legii. În situații justificate, datele pot fi trecute în evidență pasivă și stocate, pentru o perioadă care nu poate fi mai mare decât termenul de stocare stabilit inițial potrivit scopului în care au fost colectate.»

19. După articolul 15 se introduce următoarea mențiune:

«Prezenta lege transpune în legislația națională Decizia-cadru 2008/977/JAI a Consiliului din 27 noiembrie 2008 privind protecția datelor cu caracter personal prelucrate în cadrul cooperării polițienești și judiciare în materie penală, publicată în Jurnalul Oficial al Uniunii Europene seria L nr. 350 din 30 decembrie 2008 și creează cadrul juridic necesar aplicării art. 24-32 din Decizia 2008/615/JAI a Consiliului din 23 iunie 2008 privind intensificarea cooperării transfrontaliere, în special în domeniul combaterii terorismului și a criminalității transfrontaliere, publicată în Jurnalul Oficial al Uniunii Europene seria L nr. 210 din 6 august 2008.»

Art. II. –

Legea nr. 238/2009 privind reglementarea prelucrării datelor cu caracter personal de către structurile/unitățile Ministerului Administrației și Internelor în activitățile de prevenire, cercetare și combatere a infracțiunilor, precum și de menținere și asigurare a ordinii publice, publicată în Monitorul Oficial al României, Partea I, nr. 405 din 15 iunie 2009, cu modificările și completările aduse prin prezenta lege, va fi republicată în Monitorul Oficial al României, Partea I, dându-se textelor o nouă numerotare.

Această lege a fost adoptată de Parlamentul României, cu respectarea prevederilor art. 75 și ale art. 76 alin. (2) din Constituția României, republicată.

PREȘEDINTELE CAMEREI DEPUTAȚILOR

ROBERTA ALMA ANASTASE

PREȘEDINTELE SENATULUI

VASILE BLAGA

București, 13 iunie 2012.

12May/18

Legea nr. 238/2009

12 mayo, 2018Ley, Rumaníacercetare și combatere a infracțiunilor, Derecho Informátcio, Legea nr. 238/2009 privind reglementarea prelucrării datelor cu caracter personal de către structurile/unitățile Ministerului Administrației și Internelor în activitățile de prevenire, Legislación de Rumania, precum și de menținere și asigurare a ordinii publice.José Cuervo

Legea nr. 238/2009 privind reglementarea prelucrării datelor cu caracter personal de către structurile/unitățile Ministerului Administrației și Internelor în activitățile de prevenire, cercetare și combatere a infracțiunilor, precum și de menținere și asigurare a ordinii publice. (Publicată în Monitorul Oficial al României, Partea I, nr. 405 din 15 iunie 2009).

CAPITOLUL I: Dispoziţii generale

Art. 1

(1)Prezenta lege reglementează prelucrarea automată şi neautomată a datelor cu
caracter personal pentru realizarea activităţilor de prevenire, cercetare şi
combatere a infracţiunilor, precum şi de menţinere şi asigurare a ordinii publice
de către structurile/unităţile Ministerului Administraţiei şi Internelor, potrivit
competenţelor acestora.

(2)Structurile/Unităţile Ministerului Administraţiei şi Internelor, denumite în
continuare structurile/unităţile M.A.I., care desfăşoară, potrivit competenţelor,
activităţile prevăzute la alin. (1), în calitate de operatori, dobândite în condiţiile
Legii nr. 677/2001 pentru protecţia persoanelor cu privire la prelucrarea datelor
cu caracter personal şi libera circulaţie a acestor date, cu modificările şi
completările ulterioare, prelucrează date cu caracter personal în exercitarea
atribuţiilor legale.

(3)Prezenta lege nu se aplică prelucrărilor şi transferului de date cu caracter
personal efectuate în îndeplinirea atribuţiilor legale de structurile/unităţile M.A.I.
în domeniul apărării naţionale şi securităţii naţionale, în limitele şi cu restricţiile
stabilite de lege.

Art. 2

În înţelesul prezentei legi, termenii şi expresiile de mai jos au următoarea
semnificaţie:

a)interconectare – operaţiunea de a pune în legătură datele cu caracter personal
cuprinse într-un fişier, bază de date sau sistem de evidenţă automat cu cele
cuprinse într-unui sau mai multe fişiere, baze de date sau sisteme de evidenţă
automate care sunt gestionate de operatori diferiţi sau de către acelaşi operator,
dar având scopuri diferite, similare sau corelate, după caz;

b)semnalare – setul de date introduse într-un sistem de evidenţă a datelor cu
caracter personal referitoare la persoane sau bunuri cu privire la care au fost
dispuse unele măsuri, în condiţiile legii, în vederea realizării unui interes public, a
respectării regimului liberei circulaţii a persoanelor şi bunurilor sau a asigurării ori
menţinerii ordinii şi siguranţei publice;

c)blocare – marcarea unor date cu caracter personal stocate, în scopul limitării
prelucrării pe viitor;

d)atribuirea de referinţe – marcarea unor date cu caracter personal stocate, fără
a avea ca scop limitarea prelucrării lor ulterioare;

e)transformarea în date anonime – modificarea datelor cu caracter personal,
astfel încât detaliile privind circumstanţele personale sau materiale să nu mai
permită atribuirea acestora unei persoane fizice identificate sau identificabile sau
atribuirea să fie posibilă doar în condiţiile unei investiţii disproporţionate de timp,
costuri şi forţă de muncă;

f)consimţământul persoanei vizate – orice manifestare de voinţă, liberă, specifică
şi informată, prin care persoana vizată acceptă să fie prelucrate datele cu
caracter personal care o privesc;

g)evidenţă pasivă – fişier sau bază de date cu caracter personal constituit în
scopul accesării limitate şi ulterior ştergerii datelor stocate din sistemul de
evidenţă.

Art. 3

(1)Pentru realizarea activităţilor prevăzute la art. 1 alin. (1), structurile/unităţile
M.A.I. constituie, organizează şi deţin, potrivit atribuţiilor legale, sisteme de
evidenţă şi utilizează mijloace automate şi neautomate de prelucrare a datelor cu
caracter personal, în condiţiile legii.

(2)Structurile/Unităţile M.A.I. utilizează sisteme de evidenţă şi/sau mijloace
automate şi neautomate de prelucrare a datelor cu caracter personal, cu
respectarea drepturilor omului şi aplicarea principiilor legalităţii, necesităţii,
confidenţialităţii, proporţionalităţii şi numai dacă, prin utilizarea acestora, este
asigurată protecţia datelor prelucrate.

(3)Înaintea introducerii unui sistem de evidenţă sau a unui mijloc
automat/neautomat de prelucrare a datelor cu caracter personal care este
susceptibil să prezinte anumite riscuri privind datele prelucrate,
structurile/unităţile M.A.I. consultă Autoritatea Naţională de Supraveghere a
Prelucrării Datelor cu Caracter Personal, denumită în continuare Autoritatea
naţională de supraveghere, care, dacă este cazul, stabileşte garanţii adecvate,
potrivit legii.

CAPITOLUL II: Notificarea prelucrărilor datelor cu caracter personal

Art. 4

(1)Prelucrările de date cu caracter personal sunt notificate Autorităţii naţionale
de supraveghere. Notificarea se efectuează anterior oricărei prelucrări, în
condiţiile legii.

(2)Notificarea prelucrării automate sau neautomate a datelor cu caracter
personal prin sisteme de evidenţă a datelor cu caracter personal, realizată
potrivit legii de către structurile/unităţile M.A.I., cuprinde, pe lângă informaţiile
prevăzute la art. 22 alin. (8) din Legea nr. 677/2001, cu modificările şi
completările ulterioare, în mod corespunzător şi informaţii referitoare la natura
fiecărui sistem de evidenţă a datelor cu caracter personal care are legătură cu
prelucrarea, precum şi la destinatarii cărora le sunt comunicate datele.

(3)Notificarea prelucrării datelor cu caracter personal prin sisteme de evidenţă
constituite în anumite cazuri numai pentru perioada necesară realizării unor
activităţi de prevenire, cercetare şi combatere a infracţiunilor, precum şi de
menţinere şi asigurare a ordinii publice se face cu respectarea condiţiilor
prevăzute la alin. (2), numai dacă prelucrarea nu a făcut obiectul unei notificări
anterioare.

CAPITOLUL III: Colectarea datelor cu caracter personal

Art. 5

(1)Pentru realizarea activităţilor prevăzute la art. 1 alin. (1), structurile/unităţile
M.A.I. colectează date cu caracter personal, cu sau fără consimţământul
persoanei vizate, în condiţiile legii.

(2)Colectarea datelor cu caracter personal fără consimţământul persoanei vizate
pentru realizarea activităţilor prevăzute la art. 1 alin. (1) se face numai dacă
această măsură este necesară pentru prevenirea unui pericol iminent cel puţin
asupra vieţii, integrităţii corporale sau sănătăţii unei persoane ori a proprietăţii
acesteia, precum şi pentru combaterea unei anumite infracţiuni.

(3)Colectarea datelor cu caracter personal pentru realizarea activităţilor
prevăzute la art. 1 alin. (1) se efectuează de personalul structurilor/unităţilor
M.A.I. numai în scopul îndeplinirii atribuţiilor de serviciu.

(4)Colectarea datelor cu caracter personal în scopurile prevăzute la art. 1 alin.
(1) trebuie să fie limitată la datele necesare pentru prevenirea unui pericol
iminent cel puţin asupra vieţii, integrităţii corporale sau sănătăţii unei persoane
ori a proprietăţii acesteia, precum şi pentru combaterea unei anumite infracţiuni.

(5)Colectarea de date privind persoana fizică exclusiv datorită faptului că aceasta
are o anumită origine rasială, anumite convingeri religioase ori politice, un
anumit comportament sexual sau datorită apartenenţei acesteia la anumite
mişcări ori organizaţii care nu contravin legii este interzisă.

(6)Prin excepţie de la prevederile alin. (5), structurile/unităţile M.A.I. colectează
şi prelucrează, cu respectarea garanţiilor prevăzute de Legea nr. 677/2001, cu
modificările şi completările ulterioare, date exclusiv în baza acestor criterii numai
dacă, într-un caz determinat, sunt necesare pentru efectuarea actelor
premergătoare sau a urmăririi penale, ca urmare a săvârşirii unei infracţiuni.
Prevederile art. 4 se aplică în mod corespunzător.

(7)Prevederile alin. (6) nu aduc atingere dispoziţiilor legale care reglementează
obligaţia autorităţilor publice de a respecta şi de a ocroti viaţa intimă, familială şi
privată.

CAPITOLUL IV: Stocarea datelor cu caracter personal

Art. 6

(1)Pentru realizarea scopurilor activităţilor prevăzute la art. 1 alin. (1),
structurile/unităţile M.A.I. stochează numai acele date cu caracter personal care
sunt exacte, complete şi necesare îndeplinirii atribuţiilor legale sau obligaţiilor
rezultate din instrumente juridice internaţionale la care România este parte.

(2)Stocarea diferitelor categorii de date cu caracter personal se realizează prin
ordonarea acestora în funcţie de gradul lor de acurateţe şi exactitate. Datele cu
caracter personal bazate pe opinii şi interpretări personale rezultate din
activităţile prevăzute la art. 1 alin. (1) sunt ordonate în mod distinct.

(3)Structurile/Unităţile M.A.I. au obligaţia de a verifica periodic calitatea datelor
prevăzute la alin. (2), conform regulilor stabilite potrivit art. 31 alin. (1) lit. b).

(4)În situaţia în care datele cu caracter personal stocate se dovedesc a fi
inexacte sau incomplete, structurile/unităţile M.A.I. care le deţin au obligaţia să
le şteargă, distrugă, modifice, actualizeze sau, după caz, să le completeze.

(5)Structurile/Unităţile M.A.I. stochează datele cu caracter personal colectate în
scopuri administrative separat de datele cu caracter personal colectate în
scopurile prevăzute la art. 1 alin. (1).

Art. 7

(1)Datele cu caracter personal se blochează atunci când există motive întemeiate
să se considere că ştergerea lor ar putea afecta drepturile, libertăţile şi interesele
legitime ale persoanei vizate.

(2)Datele blocate se prelucrează doar în scopul care a împiedicat ştergerea lor.

(3)Datele blocate se şterg de îndată ce nu mai sunt necesare scopului prevăzut
la alin. (2).

Art. 8

Structurile/Unităţile M.A.I. prelucrează suplimentar date cu caracter personal,
într-un alt scop decât cel pentru care datele au fost colectate, dacă sunt
îndeplinite următoarele condiţii:

a)prelucrarea este compatibilă cu scopul în care au fost colectate datele;

b)scopul în care urmează a fi prelucrate suplimentar datele cu caracter personal
de către structurile/unităţile M.A.I. sau entităţile cărora urmează să le fie
comunicate datele se încadrează în atribuţiile sau, după caz, obligaţiile ce le revin
potrivit legii;

c)prelucrarea este necesară şi proporţională în raport cu noul scop.

CAPITOLUL V: Comunicarea datelor cu caracter personal

Art. 9

(1)Comunicarea datelor cu caracter personal între structurile/unităţile M.A.I. se
face numai în cazul în care este necesară pentru exercitarea competenţelor şi
îndeplinirea atribuţiilor legale ce le revin.

(2)Comunicarea de date cu caracter personal către alte autorităţi sau instituţii
publice se poate efectua numai în următoarele situaţii:

a)în baza unei prevederi legale exprese ori cu autorizarea Autorităţii naţionale de
supraveghere;

b)când datele sunt indispensabile îndeplinirii atribuţiilor legale ale destinatarului
şi numai dacă scopul în care se face colectarea sau prelucrarea de către
destinatar nu este incompatibil cu scopul pentru care datele au fost colectate de
structurile/unităţile M.A.I., iar comunicarea datelor de structurile/unităţile M.A.I.
se realizează în conformitate cu atribuţiile legale ale acestora.

(3)Prin excepţie de la prevederile alin. (2), comunicarea datelor cu caracter
personal către alte autorităţi sau instituţii publice este permisă în următoarele
situaţii:

a)persoana vizată şi-a exprimat consimţământul expres şi neechivoc pentru
comunicarea datelor sale;

b)comunicarea este necesară pentru a preveni un pericol grav şi iminent cel
puţin asupra vieţii, integrităţii corporale sau sănătăţii unei persoane ori a
proprietăţii acesteia.

(4)Comunicarea datelor cu caracter personal către entităţi de drept privat care îşi
desfăşoară activitatea pe teritoriul României se efectuează numai dacă există o
obligaţie legală expresă sau cu autorizarea Autorităţii naţionale de supraveghere.

(5)Prin excepţie de la prevederile alin. (4), comunicarea datelor cu caracter
personal către entităţi de drept privat care îşi desfăşoară activitatea pe teritoriul
României sau în afara acestuia este permisă dacă persoana vizată şi-a dat
consimţământul în mod expres şi neechivoc pentru comunicarea datelor sale sau
dacă este necesară pentru a preveni un pericol grav şi iminent cel puţin asupra
vieţii, integrităţii corporale sau sănătăţii unei persoane ori a proprietăţii acesteia sau a unei alte persoane ameninţate.

Art. 10

(1)Datele cu caracter personal deţinute de structurile/unităţile M.A.I. potrivit
scopurilor prevăzute la art. 1 alin. (1) pot fi transferate următorilor destinatari:

a)autorităţilor poliţieneşti, judiciare sau altor autorităţi competente din statele
membre ori organismelor sau instituţiilor Uniunii Europene cu atribuţii în
domeniul cooperării poliţieneşti ori judiciare în materie penală;

b)Organizaţiei Internaţionale a Poliţiei Criminale – Interpol sau altor instituţii
internaţionale similare;

c)organismelor de poliţie din state terţe.

(2)Transferul datelor cu caracter personal prevăzut la alin. (1) se realizează în
una dintre următoarele situaţii:

a)există o prevedere legală expresă în legislaţia naţională sau într-un tratat
ratificat de România;

b)există prevederi legale care reglementează cooperarea poliţienească sau
cooperarea judiciară internaţională în materie penală;

c)când transferul este necesar pentru prevenirea unui pericol grav şi iminent
asupra vieţii, integrităţii corporale sau sănătăţii unei persoane ori a proprietăţii
acesteia, precum şi pentru combaterea unei infracţiuni grave prevăzute de lege,
cu respectarea legii române.

Art. 11

(1)Cererile pentru comunicarea datelor cu caracter personal adresate
structurilor/unităţilor M.A.I. de către alte structuri/unităţi ale M.A.I., alte
autorităţi sau instituţii publice, entităţi de drept privat care îşi desfăşoară
activitatea pe teritoriul României sau în afara acestuia şi organisme de poliţie ale
altor state trebuie să conţină datele de identificare a solicitantului, precum şi
motivarea şi scopul cererii, conform prevederilor legale interne sau celor cuprinse
în acordurile internaţionale la care România este parte. Cererile care nu conţin
aceste date şi nu sunt conforme prevederilor legale interne sau celor cuprinse în
acordurile internaţionale la care România este parte se resping.

(2)Înainte de comunicare, structurile/unităţile M.A.I. verifică dacă datele
solicitate sunt exacte, complete şi actualizate. În cazul în care se constată că nu
sunt corecte, complete sau actualizate, datele nu se comunică. În comunicări
trebuie indicate, după caz, datele care rezultă din hotărâri ale instanţelor
judecătoreşti ori din actele prin care s-a dispus neînceperea urmăririi penale,
clasarea, scoaterea de sub urmărire penală, încetarea urmăririi penale sau
trimiterea în judecată, precum şi datele bazate pe opinii şi interpretări personale
rezultate din activităţile prevăzute la art. 1 alin. (1). Datele bazate pe opinii şi
interpretări personale rezultate din activităţile prevăzute la art. 1 alin. (1) trebuie
verificate la sursă înainte de a fi comunicate, iar gradul de acurateţe şi exactitate
al acestor date trebuie întotdeauna menţionat cu ocazia comunicării.

(3)În situaţia în care au fost transmise date incorecte sau neactualizate,
structurile/unităţile M.A.I. au obligaţia să îi informeze pe destinatarii respectivelor
date asupra neconformităţii acestora, cu menţionarea datelor care au fost
modificate sau, dacă este cazul, cu precizarea că datele transmise trebuie
rectificate, şterse ori blocate.

(4)În situaţia în care se constată că au fost transmise date cu caracter personal
în mod ilegal, structurile/unităţile M.A.I. au obligaţia de a-i informa pe destinatarii
acestor date, cu precizarea că datele transmise trebuie şterse de îndată.

(5)În situaţia în care se constată că structurilor/unităţilor M.A.I. le-au fost
transmise date cu caracter personal incorecte sau neactualizate, datele se
rectifică, se şterg sau, după caz, se blochează, în condiţiile legii. Dacă
structurilor/unităţilor M.A.I. le sunt transmise în mod eronat sau ilegal astfel de
date, acestea se şterg sau, după caz, se blochează de îndată. Entitatea care a
transmis datele este informată cu privire la măsura adoptată şi motivul adoptării
acesteia.

(6)În cazul în care structurilor/unităţilor M.A.I. le sunt transmise, potrivit legii,
date cu caracter personal nesolicitate, acestea au obligaţia de a verifica dacă
datele sunt necesare în scopul pentru care au fost transmise. Datele care nu sunt
necesare scopului se şterg sau, după caz, se blochează de îndată. Entitatea care
a transmis datele este informată cu privire la măsura adoptată şi motivul
adoptării acesteia.

Art. 12

(1)La comunicarea datelor cu caracter personal către alte autorităţi sau instituţii
publice, entităţi de drept privat care îşi desfăşoară activitatea pe teritoriul
României sau în afara acestuia, ori către destinatarii prevăzuţi la art. 10 alin. (1),
structurile/unităţile M.A.I. atenţionează destinatarii asupra interdicţiei de a
prelucra datele comunicate în alte scopuri decât cele specificate în cererea de
comunicare.

(2)La comunicarea datelor cu caracter personal potrivit alin. (1) i se indică
destinatarului limitări ale prelucrării, dacă este cazul, şi termene de păstrare
adecvate şi se precizează obligaţia de a şterge datele cu caracter personal
transmise la expirarea termenului indicat sau, dacă este cazul, de a proceda la
blocarea acestora. Termenele de păstrare comunicate nu pot depăşi termenele
stabilite prin prevederi legale ori, după caz, cele stabilite de structurile/unităţile
M.A.I. prin reguli proprii, potrivit dispoziţiilor art. 31, pentru acele categorii de
date cu caracter personal pe care le deţin şi urmează să facă obiectul
comunicării.

(3)În cazul în care se comunică date cu caracter personal destinatarilor prevăzuţi
la art. 10 alin. (1) lit. a), pot fi comunicate limitări ale prelucrării doar dacă
acestea sunt stabilite de lege, iar termenele de păstrare sunt cele stabilite prin
prevederi legale ori, după caz, de structurile/unităţile M.A.I. prin reguli proprii,
potrivit dispoziţiilor art. 31.

(4)Prelucrarea datelor de către destinatari în alte scopuri decât cele care au
format obiectul cererii se poate realiza numai cu acordul structurilor/unităţilor
M.A.I. care le-au comunicat şi numai cu respectarea prevederilor art. 9 alin. (2)-
(5) şi ale art. 10.

(5)Structurile/Unităţile M.A.I. pot solicita destinatarilor prevăzuţi la alin. (1),
cărora le-au fost comunicate date cu caracter personal, informaţii cu privire la
modul în care acestea au fost prelucrate.

Art. 13

(1)Pentru datele cu caracter personal comunicate de către alte autorităţi
competente sau entităţi de drept privat din afara teritoriului României, în cazul în
care este precizat un termen de păstrare a datelor, structurile/unităţile M.A.I. au
obligaţia de a şterge ori, după caz, de a bloca datele la expirarea termenului de
păstrare a datelor indicat. În cazul în care nu este precizat un termen de păstrare
a datelor, sunt aplicabile termenele de stocare a datelor cu caracter personal,
stabilite pentru acele categorii de date de către structurile/unităţile M.A.I.,
potrivit dispoziţiilor art. 31.

(2)În cazul datelor cu caracter personal prevăzute la alin. (1), structurile/unităţile
M.A.I. au obligaţia de a verifica periodic, o dată la 3 ani, necesitatea stocării
acestora.

(3)Datele cu caracter personal a căror stocare nu mai este necesară se şterg sau,
după caz, se blochează, chiar dacă nu s-a împlinit termenul precizat de entitatea
care le-a transmis Ori cel prevăzut de regulile stabilite potrivit dispoziţiilor art. 31.

(4)Dispoziţiile alin. (1) nu se aplică dacă la momentul expirării termenului de
păstrare a datelor, indicat de autoritatea competentă sau entitatea de drept
privat din afara teritoriului României, datele cu caracter personal sunt în
continuare necesare pentru efectuarea de acte premergătoare în vederea
începerii urmăririi penale, pentru desfăşurarea urmăririi penale sau pentru
executarea unei pedepse.

Art. 14

Datele cu caracter personal comunicate de către autorităţile competente ale unui
stat membru al Uniunii Europene, denumit în continuare stat membru, pot fi
prelucrate suplimentar de către structurile/unităţile M.A.I., în alt scop decât cel
pentru care au fost transmise, în una dintre următoarele situaţii:

a)pentru prevenirea, constatarea, cercetarea sau urmărirea penală a
infracţiunilor ori executarea pedepselor, altele decât cele pentru care au fost
comunicate;

b)pentru derularea altor proceduri judiciare sau administrative direct legate de
prevenirea, constatarea, cercetarea ori urmărirea penală a infracţiunilor ori
executarea pedepselor;

c)pentru prevenirea unui pericol iminent şi grav la adresa ordinii şi siguranţei
publice;

d)în orice alt scop, cu consimţământul prealabil al statului membru care
transmite sau cu consimţământul persoanei vizate, potrivit legii.

Art. 15

(1)Datele cu caracter personal comunicate de către autorităţile competente ale
unui alt stat membru pot fi transferate de structurile/unităţile M.A.I. către
autorităţi competente dintr-un stat care nu este membru al Uniunii Europene,
denumit în continuare stat terţ, sau către organisme internaţionale, numai dacă
sunt îndeplinite, cumulativ, următoarele condiţii:

a)se impune pentru prevenirea, constatarea, cercetarea sau urmărirea penală a
infracţiunilor ori executarea pedepselor;

b)datele cu caracter personal sunt comunicate organismului internaţional ori
autorităţii statului terţ competente în prevenirea, constatarea, cercetarea sau
urmărirea penală a infracţiunilor sau pentru executarea pedepselor;

c)există acordul statului membru care a comunicat datele pentru transfer;

d)statul terţ sau organismul internaţional în cauză asigură un nivel corespunzător
de protecţie pentru prelucrarea de date urmărită.

(2)Datele cu caracter personal pot fi comunicate în condiţiile prevăzute la alin.
(1), fără acordul statului membru, numai dacă transferul de date este strict
necesar pentru prevenirea unui pericol grav şi iminent la adresa ordinii şi
siguranţei publice a unui stat membru ori a unui stat terţ sau a intereselor
fundamentale ale unui stat membru, iar acordul prealabil nu poate fi obţinut în
timp util.

(3)În situaţia prevăzută la alin. (2), unitatea/structura M.A.I. care efectuează
comunicarea de date cu caracter personal are obligaţia de a informa de îndată
autoritatea competentă din statul membru care a furnizat datele.

(4)Prin excepţie de la prevederile alin. (1) lit. d), datele cu caracter personal pot
fi comunicate către autorităţile competente dintr-un stat terţ sau către
organismele internaţionale, cu respectarea dispoziţiilor art. 30 lit. d) ori e) din
Legea nr. 677/2001, cu modificările şi completările ulterioare.

Art. 16

(1)Datele cu caracter personal comunicate de către autorităţile competente ale
unui alt stat membru pot fi transferate către entităţi de drept privat dintr-un stat
membru, altul decât cel care a furnizat datele, numai dacă sunt îndeplinite,
cumulativ, următoarele condiţii:

a)autoritatea competentă din statul membru care a comunicat datele şi-a dat
acordul pentru efectuarea prelucrării;

b)niciun interes specific legitim al persoanei vizate nu împiedica transmiterea;

c)în situaţii specifice, comunicarea este esenţială pentru autoritatea competentă
care transmite date unei entităţi private.

(2)Cazurile specifice pentru care se consideră îndeplinită condiţia prevăzută la
alin. (1) lit. c) sunt determinate de următoarele situaţii:

a)îndeplinirea unei obligaţii prevăzute de lege în sarcina entităţii private;

b)prevenirea, constatarea, cercetarea sau urmărirea penală a infracţiunilor ori
executarea pedepselor;

c)prevenirea unui pericol iminent şi grav la adresa ordinii şi siguranţei publice;

d)prevenirea unei vătămări grave a drepturilor persoanei.

(3)Structurile/Unităţile M.A.I. au obligaţia de a informa entităţile de drept privat
cărora le sunt comunicate datele potrivit alin. (1) cu privire la scopurile pentru
care, în mod exclusiv, pot fi utilizate datele cu caracter personal comunicate.

Art. 17

La cerere, structurile/unităţile M.A.I. informează autorităţile competente ale unui
alt stat membru care au transmis date cu caracter personal cu privire la modul în
care acestea au fost prelucrate, în termen de 15 zile de la înregistrarea solicitării.

Art. 18

(1)Pentru realizarea activităţilor de cercetare şi combatere a infracţiunilor,
structurile/unităţile M.A.I. pot interconecta sistemele de evidenţă a datelor cu
caracter personal sau, după caz, mijloacele automate de prelucrare a datelor cu
caracter personal pe care le deţin pentru scopuri diferite.

(2)În scopul prevăzut la alin. (1), interconectarea sistemelor de evidenţă a
datelor cu caracter personal sau a mijloacelor automate de prelucrare a datelor
cu caracter personal, constituite potrivit art. 3, se poate realiza şi cu sistemele de
evidenţă ori cu mijloacele automate de prelucrare a datelor cu caracter personal
deţinute de alţi operatori, autorităţi şi instituţii publice naţionale.

(3)Interconectările prevăzute la alin. (1) şi (2) sunt posibile numai cu acordul
prealabil al Autorităţii naţionale de supraveghere. În cazul obţinerii acordului
prealabil, structura/unitatea M.A.I. notifică prelucrarea Autorităţii naţionale de
supraveghere, în condiţiile prevăzute la art. 4.

(4)În scopul prevăzut la alin. (1), interconectarea sistemelor de evidenţă a
datelor cu caracter personal sau a mijloacelor automate de prelucrare a datelor
cu caracter personal, constituite potrivit art. 3, se poate realiza şi cu sistemele de
evidenţă sau cu mijloacele automate de prelucrare a datelor cu caracter personal
deţinute de alţi operatori, entităţi de drept privat.

(5)Interconectările prevăzute la alin. (4) sunt permise numai în cazul efectuării
actelor premergătoare, al urmăririi penale sau al judecării unei infracţiuni în baza
unei autorizări emise de procurorul competent să efectueze ori să supravegheze,
într-un caz determinat, efectuarea actelor premergătoare sau urmărirea penală
ori, în căzui judecării unei infracţiuni, de judecătorul anume desemnat de la
instanţa căreia îi revine competenţa de a judeca fondul cauzei pentru care sunt
prelucrate datele respective.

(6)Accesul direct sau printr-un serviciu de comunicaţii electronice la un sistem de
evidenţă a datelor cu caracter personal care face obiectul interconectării, potrivit
alin. (1), este permis numai în condiţiile legii şi cu respectarea prevederilor art. 1
alin. (1) şi ale art. 6-24.

Art. 19

(1)În cazul activităţilor de prevenire a infracţiunilor, de menţinere şi de asigurare
a ordinii publice, sistemele de evidenţă a datelor cu caracter personal sau
mijloacele automate de prelucrare a datelor cu caracter personal, constituite
potrivit art. 3, pot fi interconectate cu:

a)Registrul naţional de evidenţă a persoanelor;

b)Registrul naţional de evidenţă a paşapoartelor simple;

c)Registrul naţional de evidenţă a permiselor de conducere şi a vehiculelor
înmatriculate,

(2)În cazul activităţilor prevăzute la alin. (1), structurile/ unităţile M.A.I. pot
interconecta sistemele de evidenţă a datelor cu caracter personal sau, după caz,
mijloacele automate de prelucrare a datelor cu caracter personal pe care le deţin
pentru scopuri similare ori corelate.

(3)Interconectările prevăzute la alin. (1) şi (2) se notifică Autorităţii naţionale de
supraveghere prin modificarea/ completarea notificării sau depunerea unei noi
notificări.

(4)În cazul activităţilor prevăzute la alin. (1), structurile/ unităţile M.A.I. pot
interconecta sistemele de evidenţă a datelor cu caracter personal sau, după caz,
mijloacele automate de prelucrare a datelor cu caracter personal pe care le deţin
pentru scopuri diferite, numai cu acordul prealabil al Autorităţii naţionale de
supraveghere. În cazul obţinerii acordului, structurile/unităţile M.A.I. notifică
prelucrarea datelor Autorităţii naţionale de supraveghere prin
modificarea/completarea notificării sau depunerea unei noi notificări.

(5)Dispoziţiile alin. (1)-(4) sunt aplicabile şi în cazul activităţilor de control la
frontieră, executate, în condiţiile legii, de structura specializată a M.A.I, care
impun interconectarea sistemelor de evidenţă a datelor cu caracter personal sau
a mijloacelor automate de prelucrare a datelor cu caracter personal, constituite
potrivit dispoziţiilor art. 3.

Art. 20

(1)Structurile/Unităţile M.A.I. pot configura sistemele de evidenţă a datelor cu
caracter personal sau, după caz, mijloacele automate de prelucrare a datelor cu
caracter personal pe care le deţin pentru scopuri corelate sau diferite, astfel încât
semnalările cu privire la persoane sau bunuri să fie accesibile în orice sistem ori
mijloc de prelucrare.

(2)Sistemele de evidenţă a datelor cu caracter personal sau, după caz, mijloacele
automate de prelucrare a datelor cu caracter personal deţinute de
structurile/unităţile M.A.I. se configurează astfel încât niciun utilizator să nu aibă
acces decât la datele cu caracter personal strict necesare desfăşurării atribuţiilor
de serviciu. Structurile/Unităţile M.A.I. au obligaţia de a stabili categoriile de date
la care are acces fiecare utilizator, în scopul îndeplinirii atribuţiilor de serviciu.

Art. 21

(1)În cazul sistemelor de evidenţă constituite potrivit scopurilor prevăzute la art.
1 alin. (1), structurile/unităţile M.A.I. pot permite autorităţilor, instituţiilor sau
organizaţiilor prevăzute la art. 10 accesul direct la sistemele gestionate, doar în
condiţii care să asigure securitatea datelor cu caracter personal, în următoarele
situaţii:

a)în baza unui tratat ratificat de România;

b)în cadrul activităţii de cooperare poliţienească şi judiciară în materie penală
efectuată în cadrul Uniunii Europene.

(2)Prelucrările efectuate potrivit alin. (1) se notifică Autorităţii naţionale de
supraveghere în condiţiile art. 4.

(3)În situaţia prevăzută la alin. (1), prelucrarea datelor cu caracter personal de
către autorităţile, instituţiile sau organizaţiile prevăzute la art. 10 se permite doar
pentru scopul stabilit prin tratat ori, după caz, printr-un instrument juridic al
Uniunii Europene.

Art. 22

(1)În situaţiile prevăzute la art. 18 alin. (1), structurile/unităţile M.A.I., dispun
măsurile necesare pentru ca toate prelucrările de date cu caracter personal să fie
înregistrate în sistem într-un fişier de acces, în scopul monitorizării legalităţii
efectuării prelucrărilor.

(2)Sistemele de evidenţă sau mijloacele automate de prelucrare a datelor cu
caracter personal gestionate de către Structurile/unităţile M.A.I. trebuie să fie
configurate astfel încât să genereze fişierele de acces şi în situaţia în care
structurilor/unităţilor M.A.I. li se permite accesul direct în sistemele de evidenţă
gestionate de autorităţile, instituţiile sau organizaţiile prevăzute la art. 10.

(3)Fişierele de acces trebuie să cuprindă cel puţin data, ora exactă, motivul
prelucrării, datele de identificare a autorităţii, instituţiei sau, după caz, a
organizaţiei care a efectuat prelucrarea, precum şi codul de identificare a
utilizatorului care a efectuat prelucrarea. Dacă este cazul, fişierele de acces pot
conţine şi datele cu caracter personal care au făcut obiectul prelucrării.

(4)Fişierele de acces pot fi utilizate doar în scopul verificării legalităţii prelucrării
sau pentru asigurarea securităţii datelor cu caracter personal.

Art. 23

La cerere, structurile/unităţile M.A.I. comunică, în termen de 15 zile, autorităţilor
competente în domeniul protecţiei datelor cu caracter personal din afara
teritoriului României, înregistrările referitoare la prelucrările efectuate în
sistemele de evidenţă gestionate de entităţile din statul a cărui autoritate a
formulat cererea.

CAPITOLUL VI: Drepturile persoanei vizate

Art. 24

(1)Structurile/Unităţile M.A.I. asigură condiţiile de exercitare a drepturilor
conferite de lege persoanei vizate, cu respectarea Legii nr. 677/2001, cu
modificările şi completările ulterioare, şi a prezentei legi.

(2)Prevederile referitoare la exercitarea drepturilor persoanei vizate, prevăzute
de Legea nr. 677/2001, cu modificările şi completările ulterioare, nu se aplică
pe perioada în care o asemenea măsură este necesară pentru evitarea
prejudicierii activităţilor specifice de prevenire, cercetare şi combatere a
infracţiunilor, precum şi de menţinere şi asigurare a ordinii publice, ca urmare a
cunoaşterii de persoana vizată a faptului că datele sale cu caracter personal sunt
prelucrate, sau este necesară pentru protejarea persoanei vizate ori a drepturilor
şi libertăţilor altor persoane, în cazul în care există date şi informaţii că aceste
drepturi şi libertăţi sunt puse în pericol.

(3)În cazul aplicării excepţiilor de la exercitarea drepturilor persoanei vizate,
prevăzute la alin. (2), acestea trebuie motivate în scris. Necomunicarea motivelor
este posibilă numai în măsura în care este necesară bunei desfăşurări a
activităţilor prevăzute la art. 1 alin. (1) sau pentru protejarea drepturilor şi
libertăţilor altor persoane decât persoana vizată.

(4)În toate situaţiile, persoana vizată va fi informată cu privire la dreptul de a se
adresa Autorităţii naţionale de supraveghere sau, după caz, instanţei de
judecată, care va decide dacă măsurile luate de structurile/unităţile M.A.I.,
conform prevederilor alin. (2), sunt întemeiate.

(5)În situaţia în care, în urma exercitării dreptului de acces sau a dreptului de
intervenţie, rezultă că datele cu caracter personal sunt inexacte, irelevante sau
înregistrate în mod abuziv, acestea vor fi şterse sau rectificate prin anexarea unui
document, încheiat în acest sens, la sistemul de evidenţă ale cărui date cu
caracter personal au suferit modificări, deţinut de structurile/unităţile M.A.I.

(6)Măsurile prevăzute la alin. (5) se aplică tuturor documentelor care au legătură
cu sistemul de evidenţă a datelor cu caracter personal. În cazul în care acestea
nu sunt efectuate imediat, se va avea în vedere realizarea lor cel mai târziu la
data prelucrării ulterioare a datelor cu caracter personal sau la o următoare
comunicare a acestora.

(7)În situaţia în care structurile/unităţile M.A.I. nu pot da curs cererilor formulate
în exercitarea dreptului de intervenţie în scopul rectificării, ştergerii ori, după caz,
blocării datelor cu caracter personal, transmit persoanei vizate un răspuns scris în
care sunt menţionate motivele care stau la baza imposibilităţii soluţionării
solicitării, precum şi faptul că aceasta are dreptul de a se adresa Autorităţii
naţionale de supraveghere sau, după caz, instanţei de judecată.

Art. 25

(1)În cazul în care structurile/unităţile M.A.I. formulează cereri pentru
comunicarea datelor cu caracter personal adresate unor autorităţi competente ori
entităţi de drept privat din afara teritoriului României, pot solicita ca persoana
vizată să nu fie informată cu privire la prelucrare numai dacă sunt aplicabile
dispoziţiile art. 24 alin. (2). La încetarea motivelor pentru care s-a formulat o
astfel de solicitare, structurile/unităţile M.A.I. informează în scris autoritatea
competentă ori entitatea de drept privat din afara teritoriului României cu privire
la faptul că persoana vizată, ale cărei date cu caracter personal au fost
comunicate, poate fi informată cu privire la această prelucrare.

(2)În cazul în care autorităţile competente ale unui stat membru solicită, cu
ocazia comunicărilor de date cu caracter personal de către structurile/unităţile
M.A.I., ca persoana vizată să nu fie informată, structurile/unităţile M.A.I. dispun
informarea persoanei vizate doar cu consimţământul autorităţii competente
solicitante.

Art. 26

În situaţia în care cererea persoanei vizate în contextul prelucrării datelor cu
caracter personal se referă la o prelucrare efectuată de către o autoritate
competentă ori entitate de drept privat din afara teritoriului României în
sistemele de evidenţă gestionate de structurile/unităţile M.A.I., prin derogare de
la prevederile art. 13 alin. (3), ale art. 14 alin. (3) şi ale art. 15 alin. (4) din
Legea nr. 677/2001, cu modificările şi completările ulterioare, i se răspunde
solicitantului cât mai curând posibil, dar nu mai târziu de 60 de zile de la data
primirii cererii. În acest termen, structurile/unităţile M.A.I. solicită informaţii
autorităţii competente ori entităţii de drept privat din afara teritoriului României
care a efectuat prelucrarea.

Art. 27

(1)În cazul în care exactitatea unor date cu caracter personal este contestată de
persoana vizată, iar exactitatea sau inexactitatea datelor respective nu se poate
stabili cu certitudine, acestora li se pot atribui referinţe. La cererea persoanei
vizate, atribuirea de referinţe este obligatorie.

(2)Datele cu caracter personal cărora le-au fost atribuite referinţe nu pot fi
comunicate decât în scopul stabilirii corectitudinii acestora.

(3)Referinţele atribuite potrivit alin. (1) pot fi înlăturate în unul dintre
următoarele cazuri:

a)la solicitarea ori cu acordul persoanei vizate, atunci când exactitatea sau, după
caz, inexactitatea datelor cu caracter personal a fost stabilită;

b)atunci când există o hotărâre a instanţei de judecată sau autorizarea Autorităţii
naţionale de supraveghere.

Art. 28

(1)Structurile/Unităţile M.A.I., în calitate de operatori, răspund pentru prejudiciul
cauzat persoanei vizate în urma unei prelucrări de date cu caracter personal,
chiar şi în situaţia în care prejudiciul a fost cauzat prin prelucrarea, în condiţiile
legii, a unor date cu caracter personal inexacte furnizate de o autoritate
competentă a unui stat membru.

(2)În situaţia în care structurile/unităţile M.A.I. sunt obligate, în condiţiile legii, la
plata unor despăgubiri pentru prejudiciile cauzate persoanei vizate ca urmare a
prelucrării unor date cu caracter personal inexacte furnizate de o autoritate
competentă a unui stat membru, acestea sunt obligate să dispună măsurile
necesare pentru recuperarea sumelor plătite ca despăgubire de la autoritatea
care a furnizat datele respective.

(3)Pentru a se asigura îndeplinirea obligaţiei prevăzute la alin. (2),
structurile/unităţile M.A.I., care au plătit despăgubiri pentru prejudiciile cauzate
persoanei vizate ca urmare a prelucrării unor date cu caracter personal inexacte,
informează autoritatea competentă din statul membru care a furnizat aceste date
şi solicită rambursarea sumei plătite ca despăgubire. Cu această ocazie,
structurile/unităţile M.A.I. comunică faptul că prejudiciul a fost cauzat exclusiv ca
urmare a prelucrării, în condiţiile legii, a datelor inexacte furnizate de autoritatea
competentă din statul membru, şi nu din culpa structurii/unităţii M.A.I. care a
primit datele cu caracter personal şi anexează documente din care să rezulte:

a)că structura/unitatea M.A.I. a fost obligată la plata despăgubirii pentru
prejudiciile cauzate persoanei vizate şi că a plătit o sumă de bani;

b)că datele cu caracter personal ale persoanei vizate provin de la această
autoritate competentă din statul membru;

c)datele de identificare a contului în care urmează a fi virate sumele de bani.

(4)În situaţia în care structurilor/unităţilor M.A.I. li se solicită de către autorităţi
competente din statele membre rambursarea unor sume plătite de acestea ca
despăgubiri pentru prejudicii cauzate persoanelor vizate ca urmare a prelucrării
unor date cu caracter personal inexacte furnizate de structurile/unităţile M.A.I.,
înainte de plata sumelor solicitate, structurile/unităţile M.A.I. trebuie să verifice
dacă:

a)prejudiciul a fost cauzat exclusiv ca urmare a prelucrării datelor inexacte
furnizate în condiţiile indicate de structura/unitatea M.A.I., şi nu din culpa
autorităţii competente solicitante;

b)solicitarea este însoţită de documente din care să rezulte că autoritatea
competentă din statul membru a fost obligată la plata despăgubirii pentru
prejudiciile cauzate persoanei vizate ca urmare a furnizării de către
structurile/unităţile M.A.I. a unor informaţii inexacte şi că a plătit o sumă de bani.

CAPITOLUL VII: Încheierea operaţiunilor de prelucrare a datelor cu caracter personal

Art. 29

(1)Datele cu caracter personal stocate în îndeplinirea activităţilor prevăzute la
art. 1 alin. (1) se şterg sau se transformă în date anonime atunci când nu mai
sunt necesare scopurilor pentru care au fost colectate ori, după caz, se
blochează, în condiţiile legii. În situaţii justificate, datele pot fi trecute în evidenţă
pasivă şi stocate, pentru o perioadă care nu poate fi mai mare decât termenul de
stocare stabilit iniţial potrivit scopului în care au fost colectate.

(2)Înainte de ştergerea datelor cu caracter personal, potrivit alin. (1), şi dacă
activităţile prevăzute la art. 1 alin. (1) nu mai pot fi prejudiciate prin cunoaşterea
faptului că datele cu caracter personal au fost colectate şi stocate, persoana
vizată trebuie informată atunci când colectarea şi stocarea datelor s-au efectuat
fără consimţământul său.

(3)În condiţiile prevăzute la alin. (2), informarea persoanei vizate se realizează
de structurile/unităţile M.A.I. care au colectat şi stocat datele cu caracter
personal ale acesteia, în termen de 15 zile de la momentul în care activităţile
prevăzute la art. 1 alin (1) nu mai pot fi prejudiciate sau, după caz, de la
momentul comunicării către aceste structuri/unităţi ale M.A.I. a unei soluţii de
neîncepere a urmăririi penale, clasare, scoatere de sub urmărire penală sau
încetare a urmăririi penale.

(4)Prin excepţie de la prevederile alin. (1), datele cu caracter personal pot fi
stocate şi după îndeplinirea scopurilor pentru care au fost colectate, dacă este
necesară păstrarea acestora. Evaluarea necesităţii stocării datelor după
îndeplinirea scopurilor pentru care au fost colectate se realizează, în special, în
următoarele situaţii:

a)datele sunt necesare în vederea terminării urmăririi penale într-un caz determinat;

b)nu există o hotărâre judecătorească definitivă;

c)nu a intervenit reabilitarea;

d)nu a intervenit prescripţia executării pedepsei;

e)nu a intervenit amnistia;

f)datele fac parte din categorii speciale de date, potrivit Legii nr. 677/2001, cu
modificările şi completările ulterioare.

CAPITOLUL VIII: Securitatea datelor cu caracter personal

Art. 30

Structurile/Unităţile M.A.I. sunt obligate să ia toate măsurile necesare pentru a
asigura securitatea tehnică şi organizatorică adecvată a prelucrării datelor cu
caracter personal, astfel încât să prevină accesul, comunicarea sau distrugerea
neautorizată ori alterarea datelor. În acest scop, se au în vedere diferitele
caracteristici ale sistemelor de evidenţă a datelor cu caracter personal şi
conţinutul acestora.

CAPITOLUL IX: Dispoziţii finale

Art. 31

(1)Structurile/Unităţile M.A.I. care desfăşoară activităţile prevăzute la art. 1 alin.
(1) au obligaţia de a elabora reguli, dacă acestea nu sunt stabilite prin prevederi
legale exprese, cu privire la:

a)termenele de stocare a datelor cu caracter personal pe care le prelucrează;

b)verificările periodice asupra datelor cu caracter personal pentru ca acestea să
fie exacte, actuale şi complete;

c)ştergerea datelor cu caracter personal.

(2)În lipsa unor prevederi legale exprese care să stabilească regulile prevăzute la
alin. (1), structurile/unităţile M.A.I. care desfăşoară activităţile prevăzute la art. 1
alin. (1) au obligaţia ca, în termen de 30 de zile de la data intrării în vigoare a
prezentei legi, să stabilească aceste reguli, cu avizul Autorităţii naţionale de
supraveghere acordat în condiţiile legii.

Art. 32

Prevederile prezentei legi se completează cu dispoziţiile Legii nr. 677/2001, cu
modificările şi completările ulterioare.

12May/18

Legii nr. 506/2004 privind prelucrarea datelor cu caracter personal și protecția vieții private în sectorul comunicațiilor electronice

12 mayo, 2018Ley, RumaníaJosé Cuervo

Legii nr. 506/2004 privind prelucrarea datelor cu caracter personal și protecția vieții private în sectorul comunicațiilor electronice. (Publicat în Monitorul Oficial cu numărul 1101 din data de 25 noiembrie 2004)

Parlamentul României adoptă prezenta lege.

Art. 1: Dispoziţii generale

(1)Prezenta lege stabileşte condiţiile specifice de garantare a dreptului la
protecţia vieţii private în privinţa prelucrării datelor cu caracter personal în
sectorul comunicaţiilor electronice.

(2)Prevederile prezentei legi se aplică furnizorilor de reţele publice de comunicaţii
electronice şi furnizorilor de servicii de comunicaţii electronice destinate
publicului, precum şi furnizorilor de servicii cu valoare adăugată şi furnizorilor de
registre ale abonaţilor care, în cadrul activităţii lor comerciale, prelucrează date
cu caracter personal.

(3)Prevederile prezentei legi se completează cu prevederile Legii nr. 677/2001
pentru protecţia persoanelor cu privire la prelucrarea datelor cu caracter personal
şi libera circulaţie a acestor date.

(4)Prezenta lege nu se aplică prelucrărilor de date cu caracter personal
efectuate:

a)în cadrul activităţilor în domeniul apărării naţionale şi securităţii naţionale,
desfăşurate în limitele şi cu restricţiile stabilite de lege;

b)în cadrul activităţilor de combatere a infracţiunilor şi de menţinere a ordinii
publice, precum şi în cadrul altor activităţi în domeniul dreptului penal,
desfăşurate în limitele şi cu restricţiile stabilite de lege.

Art. 2: Definiţii

(1)În înţelesul prezentei legi, următorii termeni se definesc după cum urmează:

a)utilizator – orice persoană fizică ce beneficiază de un serviciu de comunicaţii
electronice destinat publicului, fără a avea în mod necesar calitatea de abonat al
acestui serviciu;

b)date de trafic – orice date prelucrate în scopul transmiterii unei comunicări
printr-o reţea de comunicaţii electronice sau în scopul facturării contravalorii
acestei operaţiuni;

c)date de localizare – orice date prelucrate într-o reţea de comunicaţii electronice,
care indică poziţia geografică a echipamentului terminal al utilizatorului unui
serviciu de comunicaţii electronice destinat publicului;

d)comunicare – orice informaţie schimbată sau transmisă între un număr
determinat de participanţi prin intermediul unui serviciu de comunicaţii
electronice destinat publicului; aceasta nu include informaţia transmisă publicului
printr-o reţea de comunicaţii electronice ca parte a unui serviciu de programe
audiovizuale, în măsura în care nu poate fi stabilită o legătură între informaţia în
cauză şi abonatul sau utilizatorul identificabil care o primeşte;

e)apel – conexiunea stabilită prin intermediul unui serviciu de telefonie destinat
publicului, care permite comunicarea bidirecţională în timp real;

f)serviciu cu valoare adăugată – orice serviciu care necesită prelucrarea datelor
de trafic sau a datelor de localizare, în alte scopuri decât transmiterea
comunicării ori facturarea contravalorii acestei operaţiuni;

g)poştă electronică – serviciul care constă în transmiterea printr-o reţea publică
de comunicaţii electronice a unor mesaje în format text, voce, sunet sau imagine,
care pot fi stocate în reţea sau în echipamentul terminal al destinatarului până la
recepţionarea de către destinatar.

(2)În cuprinsul prezentei legi sunt, de asemenea, aplicabile definiţiile prevăzute
la art. 3 lit. a), b), c) şi i) din Legea nr. 677/2001, art. 2 lit. a), b), c) şi h) din
Ordonanţa Guvernului nr. 34/2002 privind accesul la reţelele publice de
comunicaţii electronice şi la infrastructura asociată, precum şi interconectarea
acestora, aprobată cu modificări şi completări prin Legea nr. 527/2002, art. 2
alin. (1) lit. b) din Ordonanţa de urgenţă a Guvernului nr. 79/2002 privind
cadrul general de reglementare a comunicaţiilor, aprobată cu modificări şi
completări prin Legea nr. 591/2002, art. 1 pct. 1 şi 8 din Legea nr. 365/2002
privind comerţul electronic, cu modificările ulterioare, şi la art. 2 alin. (1) lit. c)
din Legea nr. 304/2003 pentru serviciul universal şi drepturile utilizatorilor cu
privire la reţelele şi serviciile de comunicaţii electronice.

Art. 3: Măsuri de securitate

(1)Furnizorul unui serviciu de comunicaţii electronice destinat publicului are
obligaţia de a lua toate măsurile tehnice şi organizatorice adecvate în vederea
garantării securităţii serviciului. În ceea ce priveşte securitatea reţelei, dacă este
necesar, furnizorul serviciului de comunicaţii electronice va lua măsurile de
securitate respective împreună cu furnizorul reţelei publice de comunicaţii
electronice. Măsurile adoptate trebuie să garanteze un nivel de securitate
proporţional cu riscul existent, având în vedere posibilităţile tehnice de ultimă oră
şi costurile implementării acestor măsuri.

(2)Autoritatea Naţională de Reglementare în Comunicaţii, denumită în continuare
ANRC, stabileşte condiţiile în care furnizorii trebuie să îşi îndeplinească obligaţia
prevăzută la alin. (1).

(3)În cazul existenţei unui risc determinat de încălcare a securităţii reţelei,
furnizorul unui serviciu de comunicaţii electronice destinat publicului este obligat:

a)să informeze abonaţii asupra existenţei acestui risc, precum şi asupra
posibilelor consecinţe ce decurg;

b)să informeze abonaţii asupra posibilităţilor de remediere;

c)să informeze abonaţii asupra costurilor probabile privind înlăturarea riscului.

Art. 4: Confidenţialitatea comunicărilor

(1)Confidenţialitatea comunicărilor transmise prin intermediul reţelelor publice de
comunicaţii electronice şi a serviciilor de comunicaţii electronice destinate
publicului, precum şi confidenţialitatea datelor de trafic aferente sunt garantate.

(2)Ascultarea, înregistrarea, stocarea şi orice altă formă de interceptare ori
supraveghere a comunicărilor şi a datelor de trafic aferente sunt interzise, cu
excepţia cazurilor următoare:

a)se realizează de utilizatorii care participă la comunicarea respectivă;

b)utilizatorii care participă la comunicarea respectivă şi-au dat, în prealabil,
consimţământul scris cu privire la efectuarea acestor operaţiuni;

c)se realizează de autorităţile competente, în condiţiile legii.

(3)Prevederile alin. (1) şi (2) nu aduc atingere posibilităţii de a efectua stocarea
tehnică necesară, în scopul transmiterii comunicării, în condiţiile respectării
confidenţialităţii.

(4)Prevederile alin. (1) şi (2) nu aduc atingere posibilităţii de a efectua
înregistrări autorizate, în condiţiile legii, ale comunicărilor şi datelor de trafic
aferente, atunci când acestea se realizează în cadrul unor practici profesionale
licite, în scopul de a furniza proba unui act comercial sau a unei comunicări
realizate în scopuri comerciale.

(5)Utilizarea unei reţele de comunicaţii electronice în scopul stocării de informaţii
în echipamentul terminal al unui abonat sau utilizator ori al obţinerii accesului la
informaţia stocată în acest mod este permisă numai cu îndeplinirea, în mod
cumulativ, a următoarelor condiţii:

a)abonatului sau utilizatorului în cauză i s-au furnizat informaţii clare şi complete,
în conformitate cu prevederile art. 12 din Legea nr. 677/2001, între altele cu
privire la scopul în care se efectuează stocarea sau accesul la informaţia stocată;

b)abonatului sau utilizatorului în cauză i s-a oferit posibilitatea de a refuza
stocarea sau accesul la informaţia stocată.

(6)Prevederile alin. (5) nu aduc atingere posibilităţii de a efectua stocarea sau
accesul tehnic în următoarele cazuri:

a)atunci când aceste operaţiuni sunt realizate în scopul exclusiv al efectuării sau
facilitării transmiterii unei comunicări printr-o reţea de comunicaţii electronice;

b)atunci când aceste operaţiuni sunt strict necesare pentru furnizarea unui
serviciu al societăţii informaţionale, solicitat expres de abonat sau utilizator.

Art. 5: Datele de trafic

(1)Datele de trafic referitoare la abonaţi şi utilizatori, prelucrate şi stocate de
către furnizorul unei reţele publice de comunicaţii electronice sau de către
furnizorul unui serviciu de comunicaţii electronice destinat publicului, trebuie să
fie şterse sau transformate în date anonime atunci când nu mai sunt necesare la
transmiterea unei comunicări, cu excepţia situaţiilor prevăzute la alin. (2), (3) şi
(5).

(2)Prelucrarea datelor de trafic efectuată în scopul facturării abonaţilor sau al
stabilirii obligaţiilor de plată pentru interconectare este permisă doar până la
împlinirea unui termen de 3 ani de la data scadenţei obligaţiei de plată
corespunzătoare.

(3)Furnizorul unui serviciu de comunicaţii electronice destinat publicului poate
prelucra datele prevăzute la alin. (1), în vederea comercializării serviciilor sale
sau a furnizării de servicii cu valoare adăugată, numai în măsura şi pe durata
necesară comercializării, respectiv furnizării acestor servicii, şi numai cu
consimţământul expres prealabil al abonatului sau utilizatorului la care se referă
datele respective. Abonatul sau, după caz, utilizatorul îşi poate retrage oricând
consimţământul exprimat cu privire la prelucrarea datelor de trafic.

(4)În cazurile prevăzute la alin. (2) şi (3), furnizorul serviciului de comunicaţii
electronice destinat publicului este obligat să informeze abonatul sau utilizatorul
cu privire la categoriile de date de trafic care sunt prelucrate şi la durata
prelucrării acestora. În cazul prevăzut la alin. (3), această informare trebuie să
aibă loc anterior obţinerii consimţământului abonatului sau utilizatorului.

(5)Prelucrarea datelor de trafic în condiţiile alin. (1)-(4) poate fi efectuată numai
de către persoanele care acţionează sub autoritatea furnizorilor de reţele publice
de comunicaţii electronice sau de servicii de comunicaţii electronice destinate
publicului, având ca atribuţii facturarea ori gestionarea traficului, relaţiile cu
clienţii, detectarea fraudelor, comercializarea serviciilor de comunicaţii electronice
sau furnizarea serviciilor cu valoare adăugată, şi este permisă numai în măsura în
care este necesară pentru îndeplinirea acestor atribuţii.

(6)Prevederile alin. (1)-(3) şi (5) nu aduc atingere posibilităţii autorităţilor
competente de a avea acces la datele de trafic, în condiţiile legii, în scopul
soluţionării litigiilor, în special a celor referitoare la interconectare sau la
facturare.

Art. 6: Facturarea detaliată

(1)Abonaţii primesc facturi nedetaliate.

(2)Emiterea facturilor detaliate se face la cererea abonaţilor, cu respectarea
dreptului la viaţă privată al utilizatorilor apelanţi şi al abonaţilor apelaţi.

(3)Informaţiile minime prezentate în cadrul facturilor detaliate sunt stabilite de
ANRC.

Art. 7: Prezentarea şi restricţionarea identităţii liniei apelante şi a liniei
conectate

(1)În cazul în care este oferită prezentarea identităţii liniei apelante, furnizorul
serviciului de comunicaţii electronice destinat publicului are obligaţia de a pune la
dispoziţie utilizatorului apelant pentru fiecare apel, precum şi abonatului apelant
pentru fiecare linie, printr-un mijloc simplu şi gratuit, posibilitatea de a ascunde
identitatea liniei apelante, indiferent de ţara de destinaţie a apelului.

(2)În cazul în care este oferită prezentarea identităţii liniei apelante, furnizorul
serviciului de comunicaţii electronice destinat publicului are obligaţia de a pune la
dispoziţie abonatului apelat, printr-un mijloc simplu şi, în limitele unei utilizări
rezonabile, gratuit, posibilitatea de a ascunde identitatea liniei apelante pentru
apelurile primite, indiferent de ţara de origine a acestora.

(3)În cazul în care este oferită prezentarea identităţii liniei apelante, când
prezentarea identităţii liniei apelante se face înainte de începerea convorbirii,
furnizorul serviciului de comunicaţii electronice destinat publicului are obligaţia de
a pune la dispoziţie abonatului apelat, printr-un mijloc simplu, posibilitatea de a
respinge apelurile primite pentru care identitatea liniei apelante a fost ascunsă de
utilizatorul sau abonatul apelant, indiferent de ţara de origine a apelurilor.

(4)În cazul în care este oferită prezentarea identităţii liniei conectate, furnizorul
serviciului de comunicaţii electronice destinat publicului are obligaţia de a pune la
dispoziţie abonatului apelat, printr-un mijloc simplu şi gratuit, posibilitatea de a
ascunde identitatea liniei conectate faţă de utilizatorul apelant, indiferent de ţara
de origine a apelurilor.

(5)În cazul în care este oferită prezentarea identităţii liniei apelante sau a liniei
conectate, furnizorii de servicii de comunicaţii electronice destinate publicului au
obligaţia de a informa publicul în acest sens, inclusiv cu privire la disponibilitatea
mijloacelor de ascundere a identităţii sau de respingere a apelurilor prevăzute la
alin. (1)-(4).

(6)Prevederile prezentului articol se aplică în cazul abonaţilor conectaţi la
comutatoare digitale şi, acolo unde este tehnic posibil şi nu se presupune un
efort economic disproporţionat, în cazul abonaţilor conectaţi la comutatoare
analogice.

Art. 8: Datele de localizare, altele decât datele de trafic

(1)Prelucrarea datelor de localizare, altele decât datele de trafic, referitoare la
utilizatorii sau abonaţii reţelelor publice de comunicaţii electronice sau ai
serviciilor de comunicaţii electronice destinate publicului, atunci când este
posibilă, este permisă numai în unul dintre următoarele cazuri:

a)datele în cauză sunt transformate în date anonime;

b)cu consimţământul expres prealabil al utilizatorului sau abonatului la care se
referă datele respective, în măsura şi pentru durata necesare furnizării unui
serviciu cu valoare adăugată;

c)atunci când serviciul cu valoare adăugată cu funcţie de localizare are ca scop
transmiterea unidirecţională şi nediferenţiată a unor informaţii către utilizatori.

(2)Furnizorul serviciului de comunicaţii electronice destinat publicului are
obligaţia de a pune la dispoziţie utilizatorului sau abonatului, anterior obţinerii
consimţământului acestuia, în conformitate cu prevederile alin. (1) lit. b),
informaţii referitoare la:

a)tipul de date de localizare, altele decât datele de trafic, care vor fi prelucrate;

b)scopurile şi durata prelucrării acestor date;

c)eventuala transmitere a datelor către un terţ, în scopul furnizării serviciului cu
valoare adăugată.

(3)Utilizatorii sau abonaţii care îşi dau consimţământul în vederea prelucrării
datelor în conformitate cu prevederile alin. (1) lit. b) au dreptul de a-şi retrage
oricând consimţământul exprimat cu privire la prelucrarea datelor sau de a refuza
temporar prelucrarea datelor în cauză pentru fiecare conectare la reţea sau
pentru fiecare transmitere a unei comunicări. Furnizorul serviciului de comunicaţii
electronice destinat publicului are obligaţia de a pune la dispoziţie utilizatorilor
sau abonaţilor un procedeu simplu şi gratuit pentru exercitarea acestor drepturi.

(4)Prelucrarea datelor de localizare, altele decât datele de trafic, în condiţiile alin.
(1)-(3), poate fi efectuată numai de către persoanele care acţionează sub
autoritatea furnizorului reţelei publice de comunicaţii electronice sau al serviciului
de comunicaţii electronice destinat publicului ori a terţului furnizor de servicii cu
valoare adăugată şi trebuie să se limiteze numai la ceea ce este necesar pentru
furnizarea serviciului cu valoare adăugată.

Art. 9: Excepţii

(1)Furnizorul unei reţele publice de comunicaţii electronice sau al unui serviciu de
comunicaţii electronice destinat publicului poate deroga de la prevederile art. 7
referitoare la oferirea posibilităţii de ascundere a identităţii liniei apelante, astfel:

a)temporar, în urma cererii unui abonat privind depistarea sursei unor apeluri
abuzive; în acest caz datele care permit identificarea abonatului apelant vor fi
păstrate şi puse la dispoziţie de către furnizorul reţelei publice de comunicaţii
electronice sau al serviciului de comunicaţii electronice destinat publicului, în
condiţiile legii;

b)pentru fiecare linie, în vederea soluţionării de către serviciile specializate de
intervenţie recunoscute în condiţiile legii, precum poliţie, pompieri sau
ambulanţă, a situaţiilor ce le sunt semnalate prin apeluri de urgenţă.

(2)În cazul prevăzut la alin. (1) lit. b), furnizorul unei reţele publice de
comunicaţii electronice sau al unui serviciu de comunicaţii electronice destinat
publicului poate deroga şi de la prevederile art. 8, referitoare la obţinerea
consimţământului abonatului sau utilizatorului cu privire la prelucrarea datelor de
localizare.

(3)Derogările prevăzute la alin. (1) şi (2) sunt permise în condiţiile stabilite de
Avocatul Poporului, cu consultarea ANRC.

(4)Prevederile prezentului articol se aplică în cazul abonaţilor conectaţi la
comutatoare digitale şi, acolo unde este tehnic posibil şi nu se presupune un
efort economic disproporţionat, în cazul abonaţilor conectaţi la comutatoare
analogice.

Art. 10: Redirecţionarea automată a apelului

(1)Furnizorul reţelei publice de comunicaţii electronice sau, după caz, al
serviciului de comunicaţii electronice destinat publicului are obligaţia de a pune la
dispoziţie fiecărui abonat un mijloc simplu şi gratuit de a bloca redirecţionarea
automată de către un terţ a apelurilor către echipamentul terminal al abonatului
respectiv.

(2)Prevederile prezentului articol se aplică în cazul abonaţilor conectaţi la
comutatoare digitale şi, acolo unde este tehnic posibil şi nu se presupune un
efort economic disproporţionat, în cazul abonaţilor conectaţi la comutatoare
analogice.

Art. 11: Registrele abonaţilor

(1)Persoanele care pun la dispoziţia publicului registre ale abonaţilor în formă
scrisă sau electronică sau care furnizează servicii de informaţii privind abonaţii au
obligaţia de a informa abonaţii asupra scopului întocmirii acestor registre în care
pot fi incluse datele lor cu caracter personal, precum şi asupra oricăror alte
posibilităţi de utilizare, bazate pe funcţii de căutare integrate registrelor în formă
electronică. Informarea este gratuită şi se realizează înainte ca abonaţii să fie
incluşi în registrele respective.

(2)Persoanele prevăzute la alin. (1) au obligaţia de a oferi în mod gratuit
abonaţilor următoarele posibilităţi:

a)de a decide dacă datele lor cu caracter personal, precum şi care dintre acestea
vor fi sau nu incluse într-un registru public al abonaţilor;

b)de a verifica, rectifica sau elimina datele lor cu caracter personal incluse într-un
registru al abonaţilor.

(3)Persoanele prevăzute la alin. (1) pot utiliza registrele publice ale abonaţilor în
alt scop decât pentru simpla căutare a datelor de contact, pe baza numelui şi,
dacă este necesar, a unui număr limitat de alţi parametri, numai cu
consimţământul expres prealabil al tuturor abonaţilor ce figurează în aceste
registre.

(4)Prevederile alin. (1) şi (2) se aplică în mod corespunzător şi abonaţilor
persoane juridice în privinţa includerii datelor care permit identificarea acestora
în registrele publice ale abonaţilor.

Art. 12: Comunicările nesolicitate

(1)Este interzisă efectuarea de comunicări comerciale prin utilizarea unor sisteme
automate de apelare care nu necesită intervenţia unui operator uman, prin fax
ori prin poşta electronică sau prin orice altă metodă care foloseşte serviciile de
comunicaţii electronice destinate publicului, cu excepţia cazului în care abonatul
vizat şi-a exprimat în prealabil consimţământul expres pentru a primi asemenea
comunicări.

(2)Fără a aduce atingere prevederilor alin. (1), dacă o persoană fizică sau
juridică obţine în mod direct adresa de poştă electronică a unui client, cu ocazia
vânzării către acesta a unui produs sau serviciu, în conformitate cu prevederile
Legii nr. 677/2001, persoana fizică sau juridică în cauză poate utiliza adresa
respectivă, în scopul efectuării de comunicări comerciale referitoare la produse
sau servicii similare pe care acea persoană le comercializează, cu condiţia de a
oferi în mod clar şi expres clienţilor posibilitatea de a se opune printr-un mijloc
simplu şi gratuit unei asemenea utilizări, atât la obţinerea adresei de poştă
electronică, cât şi cu ocazia fiecărui mesaj, în cazul în care clientul nu s-a opus
iniţial.

(3)În toate cazurile este interzisă efectuarea prin poştă electronică de comunicări
comerciale în care identitatea reală a persoanei în numele şi pe seama căreia
sunt făcute este ascunsă sau în care nu se specifică o adresă valabilă la care
destinatarul să poată transmite solicitarea sa referitoare la încetarea efectuării
unor asemenea comunicări.

(4)Prevederile alin. (1) şi (3) se aplică în mod corespunzător şi abonaţilor
persoane juridice.

Art. 13: Regim sancţionator

(1)Constituie contravenţii următoarele fapte:

a)neîndeplinirea obligaţiei prevăzute la art. 3 alin. (1), în condiţiile stabilite
potrivit art. 3 alin. (2);

b)neîndeplinirea obligaţiei de informare prevăzute la art. 3 alin. (3);

c)nerespectarea prevederilor art. 4 alin. (2) referitoare la interdicţia interceptării
şi supravegherii comunicărilor şi datelor de trafic aferente;

d)nerespectarea condiţiilor prevăzute la art. 4 alin. (5);

e)nerespectarea prevederilor art. 5 referitoare la prelucrarea datelor de trafic;

f)nerespectarea condiţiilor de emitere a facturilor stabilite potrivit art. 6;

g)încălcarea obligaţiilor referitoare la disponibilitatea mijloacelor de ascundere a
identităţii sau de respingere a apelurilor, precum şi la informarea publicului,
prevăzute la art. 7;

h)nerespectarea prevederilor art. 8, referitoare la prelucrarea datelor de
localizare, altele decât datele de trafic;

i)nerespectarea prevederilor art. 9, referitoare la condiţiile în care se poate
deroga de la prevederile art. 7 sau 8;

j)încălcarea obligaţiilor referitoare la posibilitatea de a bloca redirecţionarea
automată a apelurilor, prevăzute la art. 10;

k)neîndeplinirea obligaţiilor referitoare la întocmirea registrelor abonaţilor,
prevăzute la art. 11;

l)nerespectarea prevederilor art. 12, referitoare la comunicările nesolicitate.

(2)Contravenţiile prevăzute la alin. (1) lit. a)-j) şi l) se sancţionează cu amendă
de la 50.000.000 lei la 1.000.000.000 lei, iar pentru societăţile comerciale cu o
cifră de afaceri de peste 50.000.000.000 lei, prin derogare de la dispoziţiile
Ordonanţei Guvernului nr. 2/2001 privind regimul juridic al contravenţiilor,
aprobată cu modificări şi completări prin Legea nr. 180/2002, cu modificările
ulterioare, cu amendă în cuantum de până la 2 % din cifra de afaceri.

(3)Contravenţia prevăzută la alin. (1) lit. k), precum şi contravenţia prevăzută la
alin. (1) lit. h), săvârşite prin nerespectarea obligaţiei prevăzute la art. 8 alin. (1)
lit. b), se sancţionează cu amendă de la 300.000.000 lei la 1.000.000.000 lei, iar
pentru societăţile comerciale cu o cifră de afaceri de peste 50.000.000.000 lei,
prin derogare de la dispoziţiile Ordonanţei Guvernului nr. 2/2001, aprobată cu
modificări şi completări prin Legea nr. 180/2002, cu modificările ulterioare, cu
amendă în cuantum de până la 2 % din cifra de afaceri.

(4)Contravenţiile prevăzute la alin. (1) lit. a), b), f), g) şi j) se constată de
personalul de control împuternicit în acest scop al ANRC, iar sancţiunile se aplică,
prin rezoluţie scrisă, de către preşedintele ANRC.

(5)Constatarea contravenţiilor prevăzute la alin. (1) lit. c), d), e), h), i), k) şi l) şi
aplicarea sancţiunilor se efectuează de personalul de control împuternicit în acest
scop al Avocatului Poporului, în condiţiile Legii nr. 677/2001.

(6)În măsura în care prin prezenta lege nu se prevede altfel, contravenţiilor
prevăzute la alin. (1) li se aplică prevederile Ordonanţei Guvernului nr. 2/2001,
aprobată cu modificări şi completări prin Legea nr. 180/2002, cu modificările
ulterioare.

Art. 14: Dispoziţii tranzitorii şi finale

(1)Prevederile art. 11 nu se aplică în cazul registrelor abonaţilor întocmite sau
comercializate în formă scrisă ori în formă electronică accesibilă off-line înaintea
intrării în vigoare a prezentei legi.

(2)Pe data intrării în vigoare a prezentei legi se abrogă Legea nr. 676/2001
privind prelucrarea datelor cu caracter personal şi protecţia vieţii private în
sectorul telecomunicaţiilor, publicată în Monitorul Oficial al României, Partea I,
nr. 800 din 14 decembrie 2001, cu modificările ulterioare.

Art. 15: Transpunerea unor acte normative comunitare

Prezenta lege transpune Directiva 2002/58/CE a Parlamentului European şi a
Consiliului privind prelucrarea datelor cu caracter personal şi protecţia vieţii
private în sectorul comunicaţiilor electronice, publicată în Jurnalul Oficial al
Comunităţilor Europene nr. L 201 din 31 iulie 2002.

Această lege a fost adoptată de Parlamentul României, cu respectarea
prevederilor art. 75 şi ale art. 76 alin. (2) din Constituţia României, republicată.

PREŞEDINTELE CAMEREI DEPUTAŢILOR
VALER DORNEANU
PREŞEDINTELE SENATULUI
NICOLAE VĂCĂROIU

Publicat în Monitorul Oficial cu numărul 1101 din data de 25 noiembrie 2004

12May/18

Legea nr. 82/2012

12 mayo, 2018Ley, RumaníaDerecho Informático, Legea nr. 82/2012 - retinerea datelor generate sau prelucrate de furnizorii de retele publice de comunicatii electronice si de furnizorii de servicii de comunicatii electronice destinate publicului, Legislación de RumaniaJosé Cuervo

Legea nr. 82/2012 – retinerea datelor generate sau prelucrate de furnizorii de retele publice de comunicatii electronice si de furnizorii de servicii de comunicatii electronice destinate publicului

CAPITOLUL I.- Dispozitii generale

Art. 1. –

(1) Prezenta lege stabileste obligatia furnizorilor de retele publice de comunicatii electronice si a furnizorilor de servicii de comunicatii electronice destinate publicului de a retine anumite date generate sau prelucrate in cadrul activitatii lor pentru punerea acestora la dispozitia organelor de urmarire penala, instantelor de judecata si organelor de stat cu atributii in domeniul sigurantei nationale in scopul utilizarii lor in cadrul activitatilor de prevenire, de cercetare, de descoperire si de urmarire penala a infractiunilor grave sau pentru rezolvarea cauzelor cu persoane disparute ori pentru punerea in executare a unui mandat de arestare sau de executare a pedepsei.

(2) Prezenta lege se aplica datelor de trafic si de localizare a persoanelor fizice si a persoanelor juridice, precum si datelor necesare pentru identificarea unui abonat sau unui utilizator inregistrat.

(3) Prezenta lege se aplica doar datelor generate sau prelucrate ca urmare a unei comunicatii ori a unui serviciu de comunicatii si nu se aplica in ceea ce priveste continutul comunicarii sau informatiilor consultate in timpul utilizarii unei retele de comunicatii electronice, in aceste cazuri fiind aplicabile prevederile Codului de procedura penala, precum si cele ale legilor speciale in materie.

(4) Punerea in aplicare a prevederilor prezentei legi se face cu respectarea dispozitiilor Legii nr. 677/2001 pentru protectia persoanelor cu privire la prelucrarea datelor cu caracter personal si libera circulatie a acestor date, cu modificarile si completarile ulterioare, precum si ale Legii nr. 506/2004 privind prelucrarea datelor cu caracter personal si protectia vietii private in sectorul comunicatiilor electronice, cu modificarile si completarile ulterioare, precum si cu modificarile si completarile aduse prin prezenta lege.

Art. 2. –

(1) In intelesul prezentei legi, termenii si expresiile de mai jos au urmatoarele semnificatii:

a) date – informatiile privind traficul, localizarea, precum si informatiile necesare pentru identificarea unui abonat sau a unui utilizator;

b) utilizator – persoana fizica sau persoana juridica ce foloseste un serviciu de comunicatii electronice destinat publicului in scopuri personale sau profesionale, fara a fi in mod necesar abonat al acelui serviciu;

c) abonat – persoana fizica sau persoana juridica ce a incheiat un contract cu un furnizor de servicii de comunicatii electronice destinate publicului, in vederea furnizarii unor asemenea servicii;

d) serviciu de telefonie – apelul, inclusiv voce, mesagerie vocala, teleconferinta si transfer de date, serviciile suplimentare, inclusiv redirectionarea si transferul apelului si serviciile de mesagerie si multimedia, inclusiv serviciile de mesagerie scurta, serviciile multimedia imbunatatite;

e) infractiune grava – infractiunea care face parte din una dintre urmatoarele categorii:

1. infractiunile prevazute la art. 2 lit. b) din Legea nr. 39/2003 privind prevenirea si combaterea criminalitatii organizate, cu modificarile ulterioare, savarsite sau nu de un grup infractional organizat;

2. infractiunile prevazute in cap. IV din Legea nr. 535/2004 privind prevenirea si combaterea terorismului;

3. urmatoarele infractiuni prevazute de Codul penal, republicat, cu modificarile si completarile ulterioare: infractiuni contra sigurantei statului, pruncucidere, vatamare corporala grava, viol, talharie, act sexual cu un minor, distrugere, ultraj, evadare, inlesnirea evadarii, infractiunile de falsuri in inscrisuri, asociere pentru savarsirea de infractiuni, furt calificat sau inselaciune;

4. infractiunile de coruptie, infractiunile asimilate acestora, infractiunile in legatura directa cu infractiunile de coruptie sau cu cele asimilate acestora, precum si infractiunile impotriva intereselor financiare ale Uniunii Europene, prevazute de Legea nr. 78/2000 pentru prevenirea, descoperirea si sanctionarea faptelor de coruptie, cu modificarile si completarile ulterioare;

5. infractiunea de falsificare a unui instrument de plata electronica, prevazuta la art. 24 din Legea nr. 365/2002 privind comertul electronic, republicata;

6. infractiunile de evaziune fiscala, prevazute la art. 9 din Legea nr. 241/2005 pentru prevenirea si combaterea evaziunii fiscale, cu modificarile ulterioare;

7. infractiunea de pornografie infantila, prevazuta la art. 18 din Legea nr. 678/2001 privind prevenirea si combaterea traficului de persoane, cu modificarile si completarile ulterioare;

8. infractiunea de pornografie infantila prin sisteme informatice, prevazuta la art. 51 din Legea nr. 161/2003 privind unele masuri pentru asigurarea transparentei in exercitarea demnitatilor publice, a functiilor publice si in mediul de afaceri, prevenirea si sanctionarea coruptiei, cu modificarile si completarile ulterioare;

f) identificatorul utilizatorului – codul unic de identificare alocat unei persoane care se aboneaza sau se inregistreaza la un serviciu de acces la internet ori la un serviciu de comunicatii prin internet;

g) identificatorul celulei – codul de identificare a celulei in care se initiaza sau se finalizeaza un apel de telefonie mobila;

h) apel telefonic nereusit – comunicarea in cadrul careia apelul telefonic a fost conectat, dar nu a primit raspuns sau a facut obiectul unei interventii din partea administratorului retelei;

i) apel neconectat – apelul initiat de la un terminal telefonic sau echipament cu acces la un serviciu de telefonie, dar care nu s-a finalizat tehnic, in sensul stabilirii unei conexiuni intre apelant si apelat.

(2) In tot cuprinsul prezentei legi sunt, de asemenea, aplicabile definitiile prevazute la art. 3 din Legea nr. 677/2001, cu modificarile si completarile ulterioare, la art. 2 din Legea nr. 506/2004, cu modificarile si completarile ulterioare si cu modificarile si completarile aduse prin prezenta lege, precum si la art. 4 alin. (1) din Ordonanta de urgenta a Guvernului nr. 111/2011 privind comunicatiile electronice.

CAPITOLUL II.- Retinerea datelor

Art. 3. –

(1) Furnizorii de retele publice de comunicatii electronice si furnizorii de servicii de comunicatii electronice destinate publicului au obligatia de a asigura, pe cheltuiala proprie, crearea si administrarea unor baze de date in format electronic, in vederea retinerii urmatoarelor categorii de date, in masura in care sunt generate sau prelucrate de acestia:

a) date necesare pentru urmarirea si identificarea sursei unei comunicari;

b) date necesare pentru identificarea destinatiei unei comunicari;

c) date necesare pentru a determina data, ora si durata comunicarii;

d) date necesare pentru identificarea tipului de comunicare;

e) date necesare pentru identificarea echipamentului de comunicatie al utilizatorului sau a dispozitivelor ce servesc utilizatorului drept echipament;

f) date necesare pentru identificarea locatiei echipamentului de comunicatii mobile.

(2) Datele prevazute la alin. (1) se retin si se pastreaza timp de 6 luni de la data efectuarii comunicarii.

(3) Cheltuielile legate de crearea si administrarea bazelor de date sunt deductibile fiscal.

Art. 4. – Datele necesare pentru urmarirea si identificarea sursei unei comunicari cuprind:

a) in cazul retelelor de telefonie fixa si de telefonie mobila: numarul de telefon apelant, precum si numele si adresa abonatului sau ale utilizatorului inregistrat;

b) in cazul serviciilor de acces la internet, posta electronica si telefonie prin internet:

1. identificatorul alocat;

2. identificatorul de utilizator si numarul de telefon alocat pentru efectuarea oricarei comunicari prin reteaua publica de telefonie;

3. numele si adresa abonatului sau ale utilizatorului inregistrat, caruia i s-a alocat o adresa Internet Protocol, denumita in continuare adresa IP, un identificator de utilizator sau un numar de telefon, la momentul comunicarii.

Art. 5. – Datele necesare pentru identificarea destinatiei unei comunicari cuprind:

a) in cazul retelelor de telefonie fixa si de telefonie mobila:

1. numarul format sau apelat si, in cazurile care includ servicii suplimentare precum redirectionarea sau transferul apelului, numarul catre care este directionat apelul;

2. numele si adresa abonatului ori ale utilizatorului inregistrat;

b) in cazul serviciilor de acces la internet, posta electronica si telefonie prin internet:

1. identificatorul utilizatorului sau numarul de telefon al destinatarului unui apel telefonic prin internet;

2. numele si adresa abonatului sau ale utilizatorului inregistrat si identificatorul utilizatorului destinatar al comunicarii.

Art. 6. – Datele necesare pentru determinarea datei, orei si a duratei comunicarii cuprind:

a) in cazul retelelor de telefonie fixa si de telefonie mobila: data si ora initierii si incheierii unei comunicari;

b) in cazul serviciilor de acces la internet, posta electronica si telefonie prin internet:

1. data si ora conectarii si deconectarii de la serviciul de acces la internet, adresa IP alocata dinamic sau static unei comunicari de furnizorul de servicii de acces la internet, precum si identificatorul abonatului sau al utilizatorului inregistrat;

2. data si ora conectarii si deconectarii de la serviciul de posta electronica sau de telefonie prin internet.

Art. 7. – Datele necesare pentru identificarea tipului de comunicare cuprind:

a) in cazul retelelor de telefonie fixa si de telefonie mobila: informatii privind serviciul de telefonie utilizat;

b) in cazul comunicarilor prin serviciul de posta electronica si de telefonie prin internet: informatii privind serviciul de acces la internet utilizat.

Art. 8. – Datele necesare pentru identificarea echipamentului de comunicatie al utilizatorului sau a dispozitivelor ce servesc utilizatorului drept echipament cuprind:

a) in cazul retelelor de telefonie fixa: numarul de telefon al apelantului si numarul de telefon al apelatului;

b) in cazul retelelor de telefonie mobila:

1. numarul de telefon al apelantului si numarul de telefon al apelatului;

2. identitatea internationala de abonat mobil, denumita in continuare IMSI, a apelantului;

3. identitatea internationala a echipamentului mobil, denumita in continuare IMEI, a apelantului;

4. identitatea IMSI a apelatului;

5. identitatea IMEI a apelatului;

6. in cazul serviciilor anonime preplatite: data si ora activarii initiale a serviciului, precum si identificatorul celulei de la care a fost activat serviciul;

c) in cazul serviciilor de acces la internet, posta electronica si telefonie prin internet: numarul de telefon al apelantului in cazul accesului prin dial-up; linia DSL sau alt punct terminal al celui care initiaza comunicarea.

Art. 9. – Datele necesare pentru identificarea locatiei echipamentului de comunicatii mobile cuprind:

a) identificatorul celulei la inceputul comunicarii;

b) datele care permit stabilirea localizarii geografice a celulelor, prin referire la identificatorul acestora, pe durata in care datele comunicarii sunt retinute.

Art. 10. –

(1) Furnizorii de retele publice de comunicatii electronice si furnizorii de servicii de comunicatii electronice destinate publicului, aflati sub jurisdictie romana, au obligatia retinerii datelor referitoare la un apel nereusit in cazul in care aceste date sunt generate sau prelucrate si stocate, in cazul serviciului de telefonie, ori inregistrate, in cazul serviciului de acces la internet in cadrul activitatii de furnizare a serviciilor respective.

(2) Furnizorii de retele publice de comunicatii electronice si furnizorii de servicii de comunicatii electronice destinate publicului nu au obligatia retinerii datelor prevazute la art. 3 alin. (1) in cazul apelurilor neconectate.

Art. 11. –

(1) Furnizorii de retele publice de comunicatii electronice si furnizorii de servicii de comunicatii electronice destinate publicului, pe langa datele retinute potrivit prezentei legi, pot retine si alte date necesare activitatii lor comerciale, si anume pentru facturare sau alte plati pentru interconectare, precum si alte date prelucrate potrivit legii, la cererea clientilor, in scopuri de comercializare ori in vederea furnizarii de servicii, numai cu acordul prealabil al persoanei ale carei date sunt prelucrate, cu respectarea prevederilor Legii nr. 506/2004, cu modificarile si completarile ulterioare, precum si cu modificarile si completarile aduse prin prezenta lege.

(2) Datele retinute potrivit alin. (1) sunt exceptate de la prevederile prezentei legi.

Art. 12. –

(1) In aplicarea prevederilor prezentei legi sunt interzise interceptarea si retinerea continutului comunicarii sau a informatiilor consultate in timpul utilizarii unei retele de comunicatii electronice, in aceste cazuri fiind aplicabile prevederile Codului de procedura penala si cele ale legilor speciale in materie.

(2) Furnizorii de retele publice de comunicatii electronice si furnizorii de servicii de comunicatii electronice destinate publicului au obligatia de a retine numai acele categorii de date enumerate la art. 3 alin. (1), care sunt generate sau prelucrate ca urmare a desfasurarii activitatilor proprii in conditiile legii.

(3) La sfarsitul perioadei de retinere, toate datele retinute exclusiv in temeiul prezentei legi, cu exceptia datelor accesate si retinute conform legii, puse la dispozitia autoritatilor prevazute la art. 1 alin. (1), trebuie distruse, prin proceduri ireversibile, la data expirarii termenului prevazut la art. 3 alin. (2). Procedura distrugerii datelor retinute conform prezentei legi va fi reglementata prin normele metodologice de aplicare a prezentei legi, aprobate prin hotarare a Guvernului.

Art. 13. – Activitatea de retinere a datelor se realizeaza cu respectarea urmatoarelor principii:

a) datele retinute trebuie sa fie de aceeasi calitate si trebuie supuse aceleiasi securitati si protectii ca si datele din retea;

b) datele retinute trebuie supuse unor masuri tehnice si organizatorice corespunzatoare, in vederea protejarii acestora impotriva distrugerilor accidentale sau intentionate, alterarii ori pierderii accidentale, stocarii, prelucrarii, accesarii sau dezvaluirii neautorizate ori ilicite;

c) datele retinute trebuie supuse unor masuri tehnice si organizatorice corespunzatoare, in vederea asigurarii faptului ca numai personalul autorizat in acest sens are acces la aceste date;

d) datele sunt distruse la expirarea termenului prevazut la art. 3 alin. (2), cu exceptia celor care au fost accesate si retinute.

Art. 14. –

(1) In situatia in care datele prevazute la art. 4-9 pot fi retinute de mai multi furnizori de servicii de comunicatii electronice destinate publicului si de retele publice de comunicatii electronice, activitatea de retinere a datelor se face doar la furnizorul care prelucreaza datele prevazute la art. 3.

(2) Activitatea de retinere a datelor prevazute la art. 4-9 poate fi desfasurata, acolo unde este tehnic posibil si in urma unei intelegeri contractuale, de un tert, in numele unui furnizor de servicii de comunicatii electronice destinate publicului si de retele publice de comunicatii electronice, cu respectarea prevederilor art. 19 si 20 din Legea nr. 677/2001, cu modificarile si completarile ulterioare, ale Legii nr. 506/2004, cu modificarile si completarile ulterioare si cu modificarile si completarile aduse prin prezenta lege, precum si ale prezentei legi.

(3) Obligatia de retinere a datelor prevazute la art. 4-9 se aplica furnizorilor de servicii de comunicatii electronice destinate publicului si de retele publice de comunicatii electronice care aloca numerotatie, inclusiv in situatia portarii numerelor, in cazul serviciilor de telefonie fixa si mobila, respectiv adrese IP, in cazul serviciilor de date.

Art. 15. –

(1) Furnizorii de retele publice de comunicatii electronice si furnizorii de servicii de comunicatii electronice destinate publicului au obligatia de a colecta si de a transmite anual Ministerului Comunicatiilor si Societatii Informationale urmatoarele date statistice, in vederea urmaririi si controlului aplicarii prevederilor cuprinse in prezenta lege:

a) numarul cazurilor in care informatiile au fost furnizate organelor de urmarire penala, instantelor de judecata si organelor de stat cu atributii in domeniul securitatii nationale, in conformitate cu prevederile prezentei legi;

b) perioada de timp scursa intre data la care datele au fost retinute si data la care organele de urmarire penala, instantele de judecata sau organele de stat cu atributii in domeniul securitatii nationale au solicitat transmiterea acestor date;

c) numarul de cazuri in care solicitarile de date nu au putut fi indeplinite.

(2) Termenele pana la care trebuie transmise datele statistice se stabilesc prin normele metodologice de aplicare a prezentei legi.

(3) Ministerul Comunicatiilor si Societatii Informationale centralizeaza datele statistice primite de la furnizorii de retele publice de comunicatii electronice si furnizorii de servicii de comunicatii electronice destinate publicului si transmite anual Comisiei Europene statisticile elaborate in baza acestora. Statisticile nu vor contine date cu caracter personal sau informatii clasificate.

Art. 16. –

(1) Furnizorii de retele publice de comunicatii electronice si furnizorii de servicii de comunicatii electronice destinate publicului au obligatia ca, la solicitarea organelor de urmarire penala, a instantelor de judecata si a organelor de stat cu atributii in domeniul securitatii nationale, formulata in aplicarea dispozitiilor Codului de procedura penala, precum si a celor din legile speciale in materie, sa transmita acestora, in cel mult 48 de ore de la data solicitarii, datele retinute potrivit prezentei legi.

(2) In cazul in care nu este posibila transmiterea informatiilor solicitate in termenul prevazut la alin. (1), furnizorii sunt obligati sa anunte solicitantul cu privire la motivul intarzierii si, in orice caz, sa transmita informatiile solicitate in cel mult 5 zile de la data solicitarii initiale.

(3) Solicitarile organelor de urmarire penala, ale instantelor de judecata si ale organelor de stat cu atributii in domeniul securitatii nationale se vor face cu invocarea temeiului legal existent si se vor transmite in format electronic, semnate cu semnatura electronica extinsa bazata pe un certificat calificat eliberat de un furnizor de servicii de certificare acreditat.

(4) Furnizorii de retele publice de comunicatii electronice si furnizorii de servicii de comunicatii electronice destinate publicului au obligatia sa asigure semnarea datelor solicitate, utilizand o semnatura electronica extinsa bazata pe un certificat calificat eliberat de un furnizor de servicii de certificare acreditat. Semnarea electronica a datelor se va face in mod automat in momentul extragerii lor din bazele de date prevazute la art. 3 alin. (1).

(5) Orice persoana autorizata care transmite date retinute in baza prezentei legi are obligatia sa semneze datele transmise, utilizand o semnatura electronica extinsa bazata pe un certificat calificat eliberat de un furnizor de servicii de certificare acreditat, asumandu-si astfel responsabilitatea in ceea ce priveste integritatea datelor transmise.

(6) Orice persoana autorizata care primeste date retinute in baza prezentei legi are obligatia sa verifice integritatea datelor primite si sa certifice aceasta integritate prin semnarea datelor, utilizand o semnatura electronica extinsa bazata pe un certificat calificat eliberat de un furnizor de servicii de certificare acreditat.

(7) Fiecare persoana care certifica datele sub semnatura electronica raspunde potrivit legii pentru integritatea si securitatea acestor date.

(8) Aplicarea prevederilor alin. (3)-(7) se face cu respectarea procedurilor stabilite prin normele metodologice de aplicare a prezentei legi.

Art. 17. – Daca in cauza s-a dispus o solutie de neincepere a urmaririi penale, de scoatere de sub urmarire penala, de incetare a urmaririi penale sau de clasare, procurorul este obligat ca in termen de 5 zile de la dispunerea solutiei sa instiinteze despre aceasta persoana ale carei date au fost vizate de solicitare.

Art. 18. –

(1) Organele de cercetare ale politiei judiciare au dreptul sa solicite datele retinute in baza prezentei legi doar cu aprobarea procurorului care supravegheaza sau efectueaza urmarirea penala ori a procurorului competent potrivit procedurii de dare in urmarire a persoanelor si cu aprobarea judecatorului competent.

(2) Judecatorul se pronunta cu privire la solicitarea procurorului de transmitere a datelor in 48 de ore, prin incheiere motivata, in camera de consiliu.

Art. 19. –

(1) Daca in cauza s-a dispus o solutie de neincepere a urmaririi penale, de scoatere de sub urmarire penala, de incetare a urmaririi penale sau de clasare, suportul pe care sunt stocate informatiile se arhiveaza la sediul parchetului, in locuri speciale, in plic sigilat, cu asigurarea confidentialitatii, si se pastreaza pana la indeplinirea termenului de prescriptie a raspunderii penale pentru fapta ce a format obiectul cauzei, cand se distruge, incheind un proces-verbal in acest sens.

(2) Daca in cauza instanta a pronuntat o hotarare de condamnare, de achitare sau de incetare a procesului penal, ramasa definitiva, datele retinute se arhiveaza odata cu dosarul cauzei, la sediul instantei, cu respectarea prevederilor legale privind arhivarea documentelor in forma electronica.

Art. 20. – Autoritatile competente sa monitorizeze aplicarea prevederilor prezentei legi sunt Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal, denumita in continuare A.N.S.P.D.C.P. si Autoritatea Nationala pentru Administrare si Reglementare in Comunicatii, denumita in continuare ANCOM.

CAPITOLUL III.- Contraventii si sanctiuni

Art. 21. –

(1) Constituie contraventii si se sanctioneaza cu amenda de la 2.500 lei la 500.000 lei urmatoarele fapte:

a) neindeplinirea obligatiilor prevazute la art. 3 alin. (1);

b) neindeplinirea obligatiilor prevazute la art. 3 alin. (2);

c) neindeplinirea obligatiilor prevazute la art. 12 alin. (2) si (3);

d) nerespectarea principiilor prevazute la art. 13;

e) neindeplinirea obligatiilor prevazute la art. 16 alin. (1) si (2);

f) neindeplinirea obligatiilor prevazute la art. 25 alin. (4).

(2) Constatarea contraventiilor prevazute la alin. (1) lit. b), c), d) si e), precum si aplicarea sanctiunilor se efectueaza de catre personalul de control imputernicit in acest scop al A.N.S.P.D.C.P.

(3) Constatarea contraventiilor prevazute la alin. (1) lit. a) si f) si aplicarea sanctiunilor se fac de persoane imputernicite in acest sens din cadrul ANCOM.

(4) Contraventiilor prevazute la alin. (1) le sunt aplicabile dispozitiile Ordonantei Guvernului nr. 2/2001 privind regimul juridic al contraventiilor, aprobata cu modificari si completari prin Legea nr. 180/2002, cu modificarile si completarile ulterioare.

Art. 22. –

(1) Orice accesare intentionata, alterare sau transfer al datelor retinute in baza prezentei legi, fara autorizare, constituie infractiune si se pedepseste cu inchisoare de la unu la 5 ani.

(2) Tentativa se pedepseste.

Art. 23. – Nerespectarea obligatiei de comunicare in termenul prevazut la art. 17 atrage raspunderea penala, in conditiile legii.

CAPITOLUL IV.- Dispozitii finale

Art. 24. – La data intrarii in vigoare a prezentei legi, Legea nr. 506/2004 privind prelucrarea datelor cu caracter personal si protectia vietii private in sectorul comunicatiilor electronice, publicata in Monitorul Oficial al Romaniei, Partea I, nr. 1.101 din 25 noiembrie 2004, cu modificarile si completarile ulterioare, se modifica si se completeaza dupa cum urmeaza:

1. La articolul 5, alineatele (1) si (6) se modifica si vor avea urmatorul cuprins:

«Art. 5. – (1) Datele de trafic referitoare la abonati si utilizatori inregistrati, prelucrate si retinute de catre furnizorul unei retele publice de comunicatii electronice sau de catre furnizorul unui serviciu de comunicatii electronice destinat publicului, trebuie sa fie sterse sau transformate in date anonime atunci cand nu mai sunt necesare la transmiterea unei comunicari, cu exceptia situatiilor prevazute la alin. (2), (3) si (5).
…………………………………………………………………………………
(6) Prevederile alin. (1)-(3) si (5) nu aduc atingere posibilitatii organelor de urmarire penala, instantelor de judecata si organelor de stat cu atributii in domeniul securitatii nationale de a avea acces la datele de trafic, in conditiile legii.»

2. La articolul 8, dupa alineatul (5) se introduce un nou alineat, alineatul (6), cu urmatorul cuprins:

«(6) Dispozitiile prezentului articol nu aduc atingere posibilitatii organelor de urmarire penala, instantelor de judecata si organelor de stat cu atributii in domeniul securitatii nationale de a avea acces la datele generate sau prelucrate si pastrate de furnizorii de retele publice de comunicatii si de furnizorii de servicii de comunicatii electronice destinate publicului, in conditiile legii.»

Art. 25. –

(1) Prezenta lege intra in vigoare la 3 zile de la data publicarii in Monitorul Oficial al Romaniei, Partea I, cu exceptia prevederilor art. 12 alin. (3) si art. 16 alin. (3)-(8), care intra in vigoare la 90 de zile de la data publicarii prezentei legi in Monitorul Oficial al Romaniei, Partea I, si a prevederilor art. 21 alin. (1) lit. a) si e), care intra in vigoare la 6 luni de la data publicarii prezentei legi in Monitorul Oficial al Romaniei, Partea I.

(2) In termen de 3 luni de la intrarea in vigoare a prezentei legi potrivit alin. (1) teza I, Guvernul, la propunerea Ministerului Comunicatiilor si Societatii Informationale, Ministerului Administratiei si Internelor si Ministerului Justitiei, aproba prin hotarare normele metodologice de aplicare a prezentei legi.

(3) Furnizorii de retele publice de comunicatii si furnizorii de servicii de comunicatii electronice destinate publicului vor duce la indeplinire obligatia prevazuta la art. 3 alin. (1) si (2), cel mai tarziu in termen de 6 luni de la intrarea in vigoare a prezentei legi.

(4) Pana la implinirea termenului de 6 luni prevazut la alin. (3), furnizorii de retele publice de comunicatii si furnizorii de servicii de comunicatii electronice destinate publicului au obligatia de a informa ANCOM, la cerere, cu privire la actiunile intreprinse in vederea crearii bazelor de date prevazute la art. 3 alin. (1).

(5) Pana la implinirea termenului de 90 de zile prevazut la alin. (1), solicitarile organelor de urmarire penala, instantelor de judecata si organelor de stat cu atributii in domeniul securitatii nationale se vor face cu respectarea dispozitiilor legale in vigoare.

Art. 26. – La intrarea in vigoare a Legii nr. 286/2009 privind Codul penal, cu modificarile si completarile ulterioare, art. 2 alin. (1) lit. e) din prezenta lege se modifica si va avea urmatorul cuprins:

«e) infractiune grava – infractiunea care face parte din una dintre urmatoarele categorii:
1. infractiunile prevazute la art. 2 lit. b) din Legea nr. 39/2003 privind prevenirea si combaterea criminalitatii organizate, cu modificarile ulterioare, savarsite sau nu de un grup infractional organizat;
2. infractiunile prevazute in cap. IV din Legea nr. 535/2004 privind prevenirea si combaterea terorismului;
3. urmatoarele infractiuni prevazute de Legea nr. 286/2009 privind Codul penal, cu modificarile si completarile ulterioare: infractiunile contra securitatii nationale a statului, uciderea ori vatamarea nou-nascutului savarsita de catre mama, vatamare corporala, viol, talharie si talharie calificata, actul sexual cu un minor, distrugerea si distrugerea calificata, ultrajul, evadarea si inlesnirea evadarii, infractiunile de falsuri in inscrisuri, constituirea unui grup infractional organizat, furtul calificat, inselaciunea si inselaciunea privind asigurarile, falsificarea de titluri de credit sau instrumente de plata atunci cand priveste un instrument de plata electronica, santajul si pornografia infantila;
4. infractiunile de coruptie, infractiunile asimilate acestora, precum si infractiunile impotriva intereselor financiare ale Uniunii Europene, prevazute de Legea nr. 78/2000 pentru prevenirea, descoperirea si sanctionarea faptelor de coruptie, cu modificarile si completarile ulterioare;
5. infractiuni de evaziune fiscala prevazute la art. 9 din Legea nr. 241/2005 pentru prevenirea si combaterea evaziunii fiscale, cu modificarile ulterioare.»

Art. 27. – La intrarea in vigoare a Legii nr. 135/2010 privind Codul de procedura penala, sintagma «solutia de neincepere a urmaririi penale, de scoatere de sub urmarire penala, de incetare a urmaririi penale sau de clasare» din prezenta lege va fi inlocuita cu sintagma «solutia de clasare sau renuntare la urmarire penala», iar sintagma «hotarare de condamnare, achitare sau incetare a procesului penal» din prezenta lege va fi inlocuita cu sintagma «hotarare de condamnare, renuntare la aplicarea pedepsei, amanare a aplicarii pedepsei, achitarea sau incetarea procesului penal».

Aceasta lege a fost adoptata de Parlamentul Romaniei, cu respectarea prevederilor art. 75 si ale art. 76 alin. (1) din Constitutia Romaniei, republicata.

PRESEDINTELE CAMEREI DEPUTATILOR, ROBERTA ALMA ANASTASE

PRESEDINTELE SENATULUI, VASILE BLAGA

Bucuresti, 13 iunie 2012.

12May/18

Legea nr. 102/2005 din 3 mai 2005

12 mayo, 2018Ley, RumaníaLege nr. 102/2005 din 3 mai 2005, privind înființareaJosé Cuervo

Lege nr. 102/2005 din 3 mai 2005, privind înființarea, organizarea și funcționarea Autorității Naționale de Supraveghere a Prelucrării Datelor cu Caracter Personal. (Monitorul Oficil al României nr. 391 din 9 mai 2005. În vigoare de la 12 mai 2005). (Publicat în Monitorul Oficial cu numărul 391 din data de 9 mai 2005)

Parlamentul României adoptă prezenta lege.

CAPITOLUL I: Dispoziţii generale

Art. 1

(1)Se înfiinţează Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu
Caracter Personal, denumită în continuare Autoritatea naţională de
supraveghere, ca autoritate publică cu personalitate juridică, autonomă şi
independentă faţă de orice alte autoritate a administraţiei publice, ca şi faţă de
orice persoană fizică sau juridică din domeniul privat, care exercită atribuţiile ce îi
sunt date în competenţă prin dispoziţiile legale din domeniul prelucrării datelor cu
caracter personal şi al liberei circulaţii a acestor date.

(2)Autoritatea naţională de supraveghere are drept obiectiv apărarea drepturilor
şi libertăţilor fundamentale ale persoanelor fizice, în special a dreptului la viaţă
intimă, familială şi privată, în legătură cu prelucrarea datelor cu caracter personal
şi cu libera circulaţie a acestor date.

(3)Atribuţiile Autorităţii naţionale de supraveghere sunt reglementate prin Legea
nr. 677/2001 pentru protecţia persoanelor cu privire la prelucrarea datelor cu
caracter personal şi libera circulaţie a acestor date.

(4)Sediul Autorităţii naţionale de supraveghere este în municipiul Bucureşti.

Art. 2

(1)Autoritatea naţională de supraveghere îşi exercită atribuţiile în mod
transparent şi imparţial.

(2)În exercitarea atribuţiilor sale Autoritatea naţională de supraveghere nu se
substituie autorităţilor publice.

(3)Autoritatea naţională de supraveghere nu poate fi supusă nici unui mandat
imperativ sau reprezentativ şi nu poate fi obligată să se supună instrucţiunilor
sau dispoziţiilor altei autorităţi.

Art. 3

(1)Autoritatea naţională de supraveghere este condusă de un preşedinte, a cărui
funcţie este asimilată, din punctul de vedere al funcţiei de reprezentare, ordinii
de precădere, drepturilor salariale şi rangului de demnitate, celei de secretar de
stat.

(2)Preşedintele conduce întreaga activitate a Autorităţii naţionale de
supraveghere şi o reprezintă în faţa Senatului şi a Camerei Deputaţilor, în
raporturile cu Guvernul, ministerele, alte autorităţi ale administraţiei publice,
organizaţii neguvernamentale, precum şi cu persoane fizice şi juridice române şi
străine.

(3)În activitatea de conducere a Autorităţii naţionale de supraveghere
preşedintele este ajutat de un vicepreşedinte, a cărui funcţie este asimilată, din
punctul de vedere al funcţiei de reprezentare, ordinii de precădere, drepturilor
salariale şi rangului de demnitate, celei de subsecretar de stat.

(4)Preşedintele Autorităţii naţionale de supraveghere este ordonator principal de
credite.

(5)În exercitarea atribuţiilor sale preşedintele Autorităţii naţionale de
supraveghere emite decizii şi instrucţiuni obligatorii pentru toate instituţiile şi
unităţile la a căror activitate se referă.

(6)Deciziile şi instrucţiunile cu caracter normativ se publică în Monitorul Oficial al
României, Partea I.

(7)Autorităţile publice sunt obligate să comunice sau, după caz, să pună la
dispoziţie Autorităţii naţionale de supraveghere, în condiţiile legii, informaţiile,
documentele sau actele pe care le deţin în legătură cu cererile care au fost
adresate acesteia, acordându-i sprijin pentru exercitarea deplină a atribuţiilor
sale.

Art. 4

(1)Activitatea preşedintelui, a vicepreşedintelui şi a personalului Autorităţii
naţionale de supraveghere are caracter public.

(2)La cererea persoanelor lezate în drepturile şi libertăţile lor sau datorită unor
motive întemeiate, preşedintele Autorităţii naţionale de supraveghere poate
decide asupra caracterului confidenţial al activităţii desfăşurate în acest caz.

Art. 5

(1)Preşedintele Autorităţii naţionale de supraveghere prezintă anual rapoarte de
activitate în şedinţa plenară a Senatului. Rapoartele trebuie să cuprindă
informaţii relevante cu privire la activitatea Autorităţii naţionale de supraveghere.

Ele pot conţine recomandări privind modificarea legislaţiei sau măsuri de altă
natură pentru ocrotirea drepturilor şi libertăţilor cetăţenilor în legătură cu
prelucrarea datelor personale.

(2)Raportul anual se publică în Monitorul Oficial al României, Partea a II-a, după
prezentarea acestuia în plenul Senatului.

CAPITOLUL II: Numirea şi eliberarea din funcţie a preşedintelui şi
vicepreşedintelui Autorităţii naţionale de supraveghere

Art. 6

(1)Preşedintele şi vicepreşedintele Autorităţii naţionale de supraveghere sunt
numiţi de Senat, pentru un mandat cu durata de 5 ani. Mandatul preşedintelui şi
al vicepreşedintelui poate fi reînnoit o singură dată.

(2)Poate fi numită în funcţia de preşedinte sau de vicepreşedinte al Autorităţii
naţionale de supraveghere orice persoană cu cetăţenia română, absolventă a
unei instituţii de învăţământ superior juridic, în condiţiile legii. Preşedintele şi
vicepreşedintele sunt persoane independente politic, cu o solidă competenţă
profesională, o vechime de minimum 10 ani în specialitate, o bună reputaţie şi
care se bucură de o înaltă probitate civică.

(3)Calitatea de preşedinte sau de vicepreşedinte al Autorităţii naţionale de
supraveghere este incompatibilă cu orice altă funcţie publică sau privată, cu
excepţia funcţiilor didactice.

(4)Pe perioada în care ocupă aceste funcţii, preşedintele şi vicepreşedintele
Autorităţii naţionale de supraveghere nu pot face parte din partide sau din alte
structuri politice şi nu au dreptul să deţină, direct ori indirect, acţiuni sau părţi
sociale la societăţi comerciale cu obiect de activitate în domenii care se află în
competenţa Autorităţii naţionale de supraveghere.

Art. 7

(1)Propunerile de candidaţi pentru funcţia de preşedinte sau de vicepreşedinte al
Autorităţii naţionale de supraveghere se fac de către Biroul permanent al
Senatului, la recomandarea grupurilor parlamentare din cele două Camere ale
Parlamentului.

(2)Candidaţii depun la Comisia juridică, de numiri, disciplină, imunităţi şi validări
a Senatului actele prin care dovedesc că îndeplinesc condiţiile prevăzute de lege
pentru a exercita funcţia de preşedinte sau de vicepreşedinte al Autorităţii
naţionale de supraveghere. Candidaţii vor fi audiaţi de Comisia juridică, de
numiri, disciplină, imunităţi şi validări. Senatul hotărăşte asupra numirii acestora,
după audierea în plen.

(3)Numirea preşedintelui şi a vicepreşedintelui Autorităţii naţionale de
supraveghere se face cu votul majorităţii senatorilor. Dacă la primul tur de
scrutin nu se obţine această majoritate, se va organiza un nou tur de scrutin la
care vor participa numai candidaţii situaţi pe primele două locuri la turul de
scrutin anterior.

Art. 8

(1)Mandatul de preşedinte, respectiv de vicepreşedinte al Autorităţii naţionale de
supraveghere începe pe data numirii şi durează până la instalarea în funcţie a
noului preşedinte, respectiv vicepreşedinte.

(2)Înainte de începerea exercitării mandatului, preşedintele şi vicepreşedintele
Autorităţii naţionale de supraveghere vor depune în faţa plenului Senatului
următorul jurământ: «Jur să respect Constituţia şi legile ţării şi să apăr drepturile
şi libertăţile cetăţenilor, îndeplinindu-mi cu bună-credinţă şi imparţialitate
atribuţiile de preşedinte/vicepreşedinte al Autorităţii Naţionale de Supraveghere a
Prelucrării Datelor cu Caracter Personal. Aşa să-mi ajute Dumnezeu!»

(3)Jurământul poate fi depus, după caz, şi fără formula religioasă.

(4)Refuzul depunerii jurământului conduce la infirmarea numirii în funcţie a
preşedintelui, respectiv a vicepreşedintelui Autorităţii naţionale de supraveghere
şi deschide procedura pentru o nouă numire în funcţie.

Art. 9

(1)Mandatul preşedintelui, respectiv al vicepreşedintelui Autorităţii naţionale de
supraveghere, încetează înainte de termen în caz de demisie, revocare din
funcţie, incompatibilitate cu alte funcţii publice sau private, imposibilitate de a-şi
îndeplini atribuţiile mai mult de 90 de zile, constatată prin examen medical de
specialitate, ori în caz de deces.

(2)Revocarea din funcţie a preşedintelui, respectiv a vicepreşedintelui Autorităţii
naţionale de supraveghere intervine ca urmare a încălcării Constituţiei şi a legilor
sau în cazul neîndeplinirii corespunzătoare a atribuţiilor şi se face la propunerea
Biroului permanent al Senatului, pe baza raportului Comisiei juridice, de numiri,
disciplină, imunităţi şi validări, cu votul majorităţii senatorilor.

(3)Demisia, incompatibilitatea, imposibilitatea de îndeplinire a funcţiei sau
decesul se constată de către Biroul permanent al Senatului, în cel mult 10 zile de
la apariţia cauzei care determină încetarea mandatului.

CAPITOLUL III: Atribuţiile preşedintelui şi ale vicepreşedintelui
Autorităţii naţionale de supraveghere

Art. 10

Preşedintele Autorităţii naţionale de supraveghere are următoarele atribuţii:

a)organizează şi coordonează activitatea Autorităţii naţionale de supraveghere;

b)asigură informarea operatorilor şi a persoanelor vizate de operaţiunile de
prelucrare a datelor cu caracter personal despre drepturile şi obligaţiile ce le
revin şi urmăreşte modul de aplicare a legislaţiei privind prelucrarea datelor cu
caracter personal şi libera circulaţie a acestora;

c)asigură informarea operatorilor cu privire la obligaţiile ce le revin şi a
persoanelor vizate cu privire la drepturile de care beneficiază în contextul
prelucrării datelor cu caracter personal;

d)urmăreşte modul de aplicare a legislaţiei privind prelucrarea datelor cu caracter
personal şi libera circulaţie a acestor date;

e)primeşte şi repartizează cererile adresate de persoanele lezate prin încălcarea
drepturilor sau libertăţilor cetăţeneşti în legătură cu prelucrarea datelor cu
caracter personal şi libera circulaţie a acestor date şi decide asupra acestor
cereri;

f)urmăreşte rezolvarea, în condiţiile legii, a cererilor primite şi solicită persoanelor
juridice sau fizice în cauză încetarea încălcării drepturilor şi libertăţilor
cetăţeneşti, repunerea în drepturi a petiţionarului şi repararea pagubelor;

g)încadrează, în condiţiile legii, funcţionarii publici şi personalul angajat cu
contract de muncă şi exercită dreptul de autoritate administrativă şi disciplinară
asupra acestora;

h)exercită funcţia de ordonator principal de credite;

i)asigură cooperarea cu instituţii similare din străinătate;

j)îndeplineşte şi alte atribuţii prevăzute de prezenta lege, de legile speciale care
reglementează activitatea de prelucrare a datelor cu caracter personal şi libera
circulaţie a acestor date şi de Regulamentul de organizare şi funcţionare.

Art. 11

(1)Atribuţiile vicepreşedintelui Autorităţii naţionale de supraveghere sunt
prevăzute în regulamentul de organizare şi funcţionare a acesteia.

(2)Vicepreşedintele Autorităţii naţionale de supraveghere îndeplineşte atribuţiile
preşedintelui în caz de imposibilitate temporară de exercitare a funcţiei de către
acesta.

Art. 12

(1)Preşedintele Autorităţii naţionale de supraveghere îşi exercită atribuţiile din
oficiu sau la cererea persoanelor lezate prevăzute la art. 10 lit. e) şi f).

(2)Cererile pot fi adresate de orice persoană fizică, fără deosebire de cetăţenie,
vârstă, sex, apartenenţă politică sau convingeri religioase, precum şi de persoane
juridice.

Art. 13

(1)Autoritatea naţională de supraveghere are dreptul să facă investigaţii şi
controale prealabile, să ceară autorităţilor administraţiei publice orice informaţii
sau documente necesare investigaţiei, să audieze şi să ia declaraţii de la
conducătorii autorităţilor administraţiei publice şi de la orice funcţionar public sau
personal contractual care poate da informaţiile necesare soluţionării unei cereri
adresate Autorităţii naţionale de supraveghere în legătură cu prelucrarea datelor
cu caracter personal şi libera circulaţie a acestor date.

(2)Dispoziţiile alin. (1) se aplică şi celorlalte autorităţi şi instituţii publice, oricăror
servicii publice aflate sub coordonarea autorităţilor administraţiei publice, precum
şi persoanelor juridice sau fizice din sectorul privat care intră sub incidenţa
legislaţiei privind prelucrarea datelor cu caracter personal şi libera circulaţie a
acestor date.

Art. 14

(1)Preşedintele şi vicepreşedintele Autorităţii naţionale de supraveghere, precum
şi personalul acesteia au acces, în condiţiile legii, la documentele clasificate
deţinute de autorităţile publice sau de alte persoane juridice, în măsura în care
acestea sunt necesare pentru exercitarea atribuţiilor prevăzute de lege.

(2)Preşedintele şi vicepreşedintele Autorităţii naţionale de supraveghere, precum
şi personalul acesteia au obligaţia de a nu divulga sau de a nu face publice
informaţiile sau documentele clasificate la care au avut acces. Această obligaţie
se menţine şi după încetarea activităţii persoanelor respective în cadrul Autorităţii
naţionale de supraveghere, sub sancţiunea prevăzută de legea penală.

CAPITOLUL IV: Organizarea şi funcţionarea Autorităţii naţionale de
supraveghere

Art. 15

(1)Structura organizatorică a Autorităţii naţionale de supraveghere se aprobă de
preşedintele acesteia, cu avizul Biroului permanent al Senatului.

(2)Numărul maxim de posturi, exclusiv demnitarii, este de 50. Până la
rectificarea bugetară din cursul anului 2005, Autoritatea naţională de
supraveghere va avea un număr de 37 de posturi, exclusiv demnitarii.

(3)Regulamentul de organizare şi funcţionare se întocmeşte de Autoritatea
naţională de supraveghere şi se aprobă de Biroul permanent al Senatului.

(4)Statul de funcţii şi structura posturilor pe compartimente se aprobă de
preşedintele Autorităţii naţionale de supraveghere.

Art. 16

(1)Personalul Autorităţii naţionale de supraveghere este format din funcţionari
publici sau, după caz, personal contractual şi se încadrează prin examen sau
concurs, în condiţiile legii.

(2)Atribuţiile, sarcinile şi răspunderile individuale ale personalului Autorităţii
naţionale de supraveghere se stabilesc prin fişa postului, pe baza regulamentului
de organizare şi funcţionare.

(3)Angajarea, avansarea, precum şi modificarea şi încetarea raporturilor de
serviciu sau, după caz, de muncă ale personalului contractual din aparatul
Autorităţii naţionale de supraveghere se fac prin decizie a preşedintelui acesteia,
în condiţiile legii.

(4)Personalul Autorităţii naţionale de supraveghere nu poate deţine acţiuni sau
părţi sociale la societăţile comerciale cu obiect de activitate în domenii care se
află în competenţa acesteia şi nu poate avea calitatea de membru în organele de
conducere ale unor asemenea societăţi.

(5)Încălcarea prevederilor prezentei legi, a legilor speciale care reglementează
domeniul de activitate al Autorităţii naţionale de supraveghere sau a
regulamentului de organizare şi funcţionare atrage răspunderea penală,
contravenţională sau disciplinară, după caz.

Art. 17

(1)Autoritatea naţională de supraveghere are un buget propriu, care face parte
integrantă din bugetul de stat.

(2)Autoritatea naţională de supraveghere, cu consultarea Guvernului, îşi aprobă
bugetul propriu şi îl înaintează Guvernului în vederea includerii în bugetul de stat.
Obiecţiile preşedintelui la proiectul de buget întocmit de Guvern se prezintă
Parlamentului pentru soluţionare.

Art. 18

Salarizarea personalului Autorităţii naţionale de supraveghere se realizează
corespunzător funcţiilor similare din aparatul celor două Camere ale
Parlamentului, în condiţiile legii.

CAPITOLUL V: Dispoziţii finale şi tranzitorii

Art. 19

(1)Baza de date şi evidenţele, inclusiv arhiva şi celelalte documente deţinute şi
gestionate de Avocatul Poporului, referitoare la activitatea de protecţie a
persoanelor cu privire la prelucrarea datelor cu caracter personal, se preiau de
către Autoritatea naţională de supraveghere, pe bază de protocol de predareprimire,
încheiat în termen de 45 de zile de la data intrării în vigoare a prezentei
legi.

(2)La împlinirea termenului prevăzut la alin. (1), Autoritatea naţională de
supraveghere preia activitatea de protecţie a persoanelor cu privire la prelucrarea
datelor cu caracter personal şi personalul aferent acestei activităţi de la instituţia
Avocatul Poporului.

(3)Până la împlinirea termenului prevăzut la alin. (1), Guvernul va pune la
dispoziţie Autorităţii naţionale de supraveghere spaţiul şi dotările necesare
desfăşurării activităţii acesteia.

(4)După adoptarea regulamentului prevăzut la art. 15 alin. (3), dar nu mai târziu
de termenul prevăzut la alin. (1), Autoritatea naţională de supraveghere va
încadra personalul necesar pentru îndeplinirea atribuţiilor prevăzute de lege.

Art. 20

(1)Numărul de 37 de posturi şi fondurile aferente funcţionării Autorităţii naţionale
de supraveghere se asigură prin diminuarea corespunzătoare a numărului de
posturi şi a fondurilor aprobate pentru Avocatul Poporului.

(2)Ministerul Finanţelor Publice este autorizat să introducă modificările prevăzute
la alin. (1) în structura bugetului de stat, în structura şi volumul bugetelor celor
două instituţii – Avocatul Poporului şi Autoritatea naţională de supraveghere -,
precum şi în anexele la acestea.

Art. 21

Până la împlinirea termenului prevăzut la art. 19 alin. (1), Avocatul Poporului va
îndeplini în continuare atribuţiile prevăzute de lege în domeniul protecţiei
persoanelor cu privire la prelucrarea datelor cu caracter personal.

Art. 22

Legea nr. 677/2001 pentru protecţia persoanelor cu privire la prelucrarea
datelor cu caracter personal şi libera circulaţie a acestor date, publicată în
Monitorul Oficial al României, Partea I, nr. 790 din 12 decembrie 2001, se
modifică şi se completează după cum urmează:

1.Alineatul (1) al articolului 21 va avea următorul cuprins:

«Art. 21
(1) Autoritatea de supraveghere, în sensul prezentei legi, este Autoritatea
Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal.»

2.La articolul 21 alineatul (3), după litera d) se introduce o literă nouă, litera d1),
cu următorul cuprins:

«d1) informează persoanele fizice sau/şi juridice care activează în aceste domenii,
în mod direct sau prin intermediul structurilor asociative ale acestora, asupra
necesităţii respectării obligaţiilor şi îndeplinirii procedurilor prevăzute de prezenta
lege;»

3.La articolul 21 alineatul (3), după litera l) se introduce o literă nouă, litera m),
cu următorul cuprins:

«m) modul de organizare şi funcţionare a Autorităţii Naţionale de Supraveghere a
Prelucrării Datelor cu Caracter Personal se stabileşte prin lege.»

4.Alineatul (5) al articolului 27 se abrogă.

Art. 23

1.Declaraţia formulată la art. 2 pct. 3 din Legea nr. 682/2001 privind ratificarea
Convenţiei pentru protejarea persoanelor faţă de prelucrarea automatizată a
datelor cu caracter personal, adoptată la Strasbourg la 28 ianuarie 1981,
publicată în Monitorul Oficial al României, Partea I, nr. 830 din 21 decembrie
2001, se modifică şi va avea următorul cuprins:

«3. La art. 3 pct. 2 lit. c):
Prezenta convenţie se aplică şi prelucrărilor de date cu caracter personal
efectuate prin alte mijloace decât cele automate, care fac parte dintr-un sistem
de evidenţă sau care sunt destinate a fi incluse într-un asemenea sistem.
Autoritatea naţională competentă este Autoritatea Naţională de Supraveghere a
Prelucrării Datelor cu Caracter Personal.»

Art. 24

Pe data intrării în vigoare a prezentei legi, Biroul permanent al Senatului va
transmite, în termen de 10 zile, Comisiei juridice, de numiri, disciplină, imunităţi
şi validări propunerile de candidaţi pentru funcţia de preşedinte şi de
vicepreşedinte al Autorităţii naţionale de supraveghere, în conformitate cu
prevederile art. 7.

Această lege a fost adoptată de Parlamentul României cu respectarea
prevederilor art. 75 şi ale art. 76 alin. (1) din Constituţia României, republicată.

PREŞEDINTELE CAMEREI DEPUTAŢILOR
ADRIAN NĂSTASE
p. PREŞEDINTELE SENATULUI,
TEODOR MELEŞCANU

Publicat în Monitorul Oficial cu numărul 391 din data de 9 mai 2005

11May/18

LEGE nr. 278 din 15 octombrie 2007 privind aprobarea Ordonanţei de urgenţă a Guvernului nr. 36/2007 pentru abrogarea Legii nr. 476/2003 privind aprobarea taxei de notificare a prelucrărilor de date cu caracter personal, care cad sub incidenţa Legii nr. 677/2001 pentru protecţia persoanelor cu privire la prelucrarea datelor cu caracter personal şi libera circulaţie a acestor date Parlamentul României adoptă prezenta lege.

11 mayo, 2018Ley, RumaníaJosé Cuervo

Lege nr. 278 din 15 octombrie 2007 privind aprobarea Ordonanţei de urgenţă a
Guvernului nr. 36/2007 pentru abrogarea Legii nr. 476/2003 privind
aprobarea taxei de notificare a prelucrărilor de date cu caracter personal, care
cad sub incidenţa Legii nr. 677/2001 pentru protecţia persoanelor cu privire la
prelucrarea datelor cu caracter personal şi libera circulaţie a acestor date
Parlamentul României adoptă prezenta lege. (Publicat în Monitorul Oficial cu numărul 708 din data de 19 octombrie 2007)

Articol unic

Se aprobă Ordonanţa de urgenţă a Guvernului nr. 36/2007 pentru abrogarea
Legii nr. 476/2003 privind aprobarea taxei de notificare a prelucrărilor de date
cu caracter personal, care cad sub incidenţa Legii nr. 677/2001 pentru
protecţia persoanelor cu privire la prelucrarea datelor cu caracter personal şi
libera circulaţie a acestor date, publicată în Monitorul Oficial al României, Partea
I, nr. 335 din 17 mai 2007, cu următoarele modificări şi completări:

1.Titlul ordonanţei de urgenţă va avea următorul cuprins:
«ORDONANŢĂ DE URGENŢĂ pentru abrogarea Legii nr. 476/2003 privind
aprobarea taxei de notificare a prelucrărilor de date cu caracter personal, care
cad sub incidenţa Legii nr. 677/2001 pentru protecţia persoanelor cu privire la
prelucrarea datelor cu caracter personal şi libera circulaţie a acestor date şi a
alin. (7) al art. 22 din Legea nr. 677/2001 pentru protecţia persoanelor cu
privire la prelucrarea datelor cu caracter personal şi libera circulaţie a acestor
date»

2.La articolul unic se introduce un nou alineat, alineatul (2), cu următorul
cuprins:

«(2) Alin. (7) al art. 22 din Legea nr. 677/2001 pentru protecţia persoanelor cu
privire la prelucrarea datelor cu caracter personal şi libera circulaţie a acestor
date, publicată în Monitorul Oficial al României, Partea I, nr. 790 din 12
decembrie 2001, cu modificările şi completările ulterioare, se abrogă.»

Această lege a fost adoptată de Parlamentul României, cu respectarea
prevederilor art. 75 şi ale art. 76 alin. (2) din Constituţia României, republicată.

PREŞEDINTELE CAMEREI DEPUTAŢILOR
BOGDAN OLTEANU
PREŞEDINTELE SENATULUI
NICOLAE VĂCĂROIU

Publicat în Monitorul Oficial cu numărul 708 din data de 19 octombrie 2007

10May/18

Law on Personal Data Protection 2008

10 mayo, 2018Ley, SerbiaLaw on Personal Data Protection 2008 of Serbia, Legislación de Serbia, Legislación Derecho InformáticoJosé Cuervo

Law on Personal Data Protection 2008 (Official Gazette of the Republic of Serbia number 97/2008). Law on protection of personal data (Official Gazette of the Republic of Serbia, nos. 97/2008, 104/2009, 68/2012 and Decisión of the Constitutional Court 107/2012)

I.- BASIC PROVISIONS

Scope

Article 1

This Law shall set out the conditions for personal data collection and processing, the rights and protection of the rights of persons whose data are collected and processed, limitations to personal data protection, proceedings before an authority responsible for data protection, data security, data filing, data transfers outside the Republic of Serbia and enforcement of this Law.

Every natural person shall be entitled to personal data protection regardless of their nationality and residence, race, age, gender, language, religion, political and other affiliations, ethnicity, social background and status, wealth, birth, education, social position or any other personal characteristic.

The duties of personal data protection shall be carried out by the Commissioner for Information of Public Importance and Personal Data Protection (hereinafter referred to as the Commissioner), as an autonomous public authority who exercises his/her powers independently.

Purpose

Article 2

The purpose of this Law is to enable every natural person to exercise and have recourse to protection of their right to privacy and other rights and freedoms in the context of personal data protection.

Definition of Terms used in this Law

Article 3

As used herein, the following terms shall have the meaning set forth below:

1) «personal data» means any information relating to a natural person, regardless of the form of its presentation or the medium used (paper, tape, film, electronic media etc.), regardless on whose order, on whose behalf or for whose account such information is stored, regardless of the date of its creation or the place of its storage, regardless of the way in which such information is learned (directly, by listening,
watching etc., or indirectly, by accessing a document containing the information etc.) and regardless of any other characteristic of such information (hereinafter referred to as data);

2) «natural person» means any data subject identified or identifiable on the basis of his/her proper name, unique personal identification number, address code or any other distinguishing feature of his/her physical, psychological, spiritual, economic, cultural or social identity (hereinafter referred to as person);

3) «data processing» means any action taken in connection with data, including: collection, recording, transcription, multiplication, copying, transmission, searching, classification, storage, separation, crossing, merging, adaptation, modification, provision, use, granting access, disclosure, publication, dissemination, recording, organizing, keeping, editing, disclosure through transmission or otherwise, withholding, dislocation or other actions aimed at rendering the data inaccessible, as well as other actions carried out in connection with such data, regardless whether those actions are automated, semi-automated or otherwise performed (hereinafter referred to as processing);

4) «public authority» means a state authority, a territorial autonomy or local self-government authority or another authority or organization vested with public powers;

5) «data controller» means a natural person, legal entity or public authority responsible for data processing (hereinafter referred to as controller);

6) «data file» means any set of data undergoing automated or non-automated processing and available on personal grounds, case-related grounds or any other grounds, regardless of the mode of their filing and place of their storage;

7) «data user» means any natural person, legal entity or public authority authorized by virtue of the law or on the basis of a person’s consent to use data (hereinafter referred to as user);

8) «data processor» means any natural person, legal entity or public authority to whom/which a controller delegates certain processing-related duties under the law or on the basis of a contract (hereinafter referred to as processor);

9) «in writing» includes also electronically, subject to the provisions of the law governing electronic signature;

10) «Central Data File Register» (hereinafter referred to as the Central Register) means a record comprising a register of data files and a catalogue of data files, managed by the Commissioner.

Application of the Law

Article 4

The provisions of this Law shall apply to any automated processing, as well as to processing incorporated in non-automated data files.

Data excluded from the Scope of the Law

Article 5

Save where a person’s contrary interests manifestly prevail, certain provisions of this Law pertaining to processing requirements and to the rights and responsibilities in connection with processing shall not apply to the processing of:

1) Data available to everyone and published in mass media or publications or accessible in archives, museums and other similar organizations;

2) Data processed for family purposes and other personal purposes which are unavailable to third parties;

3) Data on members of political parties, associations, trade unions and other forms of alliances processed by such organizations, provided that the member concerned has given his/her consent in writing to waive the application of certain provisions of this Law to his/her personal data for a specified period of time, which however cannot exceed the term of his/her office;

4) Data published on oneself by a person capable of taking care of his/her interests.

Processing for Historical, Statistical or Research and Development Purposes

Article 6

Data collected and processed for other purposes can be processed solely for historical, statistical or research and development purposes, provided they are not used in decisionmaking or in the taking of measures against the person concerned and only if adequate safeguards are in place.

Safeguards for the protection of data archived solely for historical, statistical or research and development purposes shall be set out in a special regulation.

Controller appointed under Special Regulation

Article 7

If a special regulation governs the purpose and manner of processing, the controller can be appointed pursuant to such regulation.

II.- PROCESSING REQUIREMENTS

Inadmissibility of Processing

Article 8

Processing shall not be allowed:

1) If a natural person did not give his/her consent to processing, i.e. if processing is carried out without legal authority;

2) If processing is done for purposes other than those specified, regardless whether it is based on a person’s consent or on statutory powers for data processing without consent, unless it is done in order to raise funds for humanitarian purposes referred to in Article 12, item 2a) and Article 12a of this Act;

3) If the purpose of processing is vaguely defined, modified, inadmissible or already achieved;

4) If the data subject is identified or identifiable even after the purpose of such processing is achieved;

5) If the processing method is inadmissible;

6) If the processed data is unnecessary or unsuitable for the purpose of processing;

7) If the number or type of data processed is disproportionate taking into account the purpose of processing;

8) If the data are inaccurate and incomplete, i.e. if they are not based on a credible source or are outdated.

Decision made by Automated Processing

Article 9

Any decision producing legal consequences for a person or compromising his/her position cannot be based solely on data processed automatically and used in the assessment of some specific characteristic of his/hers (work ability, reliability, creditworthiness etc.).

Decisions referred to in paragraph 1 of this Article can be made where expressly provided for by the law or when a person’s request relating to contract execution or performance is adopted, provided that adequate safeguards are put in place.

In cases referred to in paragraph 2 of this Article, the person concerned must be informed of the automated data processing and the decision-making process.

Processing with Consent

Article 10

Consent to data processing is deemed to be valid if given by a person who has received prior information from the controller within the meaning of Article 15 of this Law.

A person’s valid consent can be given in writing of verbally for the record.

Consent may be given through a proxy.

A proxy’s power of attorney shall be notarized, unless provided otherwise by the law.

For persons incapable of giving their own consent, such consent shall be given by their appointed representatives or guardians.

Consent for processing of data on deceased persons may be given by the spouse, children above 15 years of age, parents, siblings, legal heirs or persons appointed for that purpose by the deceased.

Withdrawal of Consent

Article 11

Consent may be withdrawn.

A person’s valid withdrawal of consent can be made in writing or verbally for the record.

In case of withdrawal, the person who previously gave his/her consent shall reimburse the controller for any and all justifiable costs incurred and damage sustained, in accordance with the regulations pertaining to damage liability.

Data processing shall not be allowed once the consent has been withdrawn.

Processing without Consent

Article 12

Processing without consent shall be allowed in the following cases:

1) To achieve or protect vital interests of the data subject or a third party, in particular their life, health and physical integrity;

2) For the purpose of discharging duties laid down by a law, an enactment adopted pursuant to a law or a contract concluded between the person concerned and the controller, as well as for the purpose of contract preparation;

2a) To raise funds for humanitarian purposes;

3) In other cases envisaged by this Law or another regulation adopted pursuant to this Law, for the purpose of achieving a prevailing justifiable interest of the person concerned, the controller or a user.

Article 12a

In case referred to in Article 12, item 2a), the personal data already processed for specific purposes by the controller based on statutory authorization, may also be processed by the controller in order to raise funds for humanitarian purposes.

Processing by Public Authorities

Article 13

Public authorities shall process data without the consent of the person concerned if such processing is necessary for them to perform duties within their spheres of competence as defined by a law or another regulation with a view to achieving the interests of national or public safety, national defence, crime prevention, detection, investigation and prosecution, economic or financial interests of the state, protection of health and ethical norms, protection of rights and freedoms and other public interests, while processing in all other cases shall require the consent in writing from the person concerned.

Data Collection

Article 14

Data shall be collected from data subjects and from public authorities authorized under the law to collect such data.

Data may also be collected from third parties if:

1) envisaged by a contract concluded with a data subject;

2) envisaged by a law or another regulation passed pursuant to a law;

3) necessary taking into account the nature of the task;

4) data collection from a data subject is timeconsuming or requires disproportionately high resources;

5) data are collected for the purpose of achieving or protecting vital interests of a data subject, in particular his/her life, health and physical integrity.

Notification of Data Processing

Article 15

The controller who collects data from data subjects or from third parties shall, before data collection, inform the data subject or the third party of:

1) His/her identity, i.e. name and address or business name, or the identity of another person responsible for data processing under the law;

2) The purpose of data collection and subsequent processing;

3) The manner in which data will be used;

4) The identity or categories of persons who will use data;

5) The mandatory nature and legal grounds or else the voluntary nature of data provision and processing;

6) The right to withdraw one’s consent to processing and the legal consequences in the event of withdrawal;

7) The data subject’s rights in case of unlawful processing;

8) Other circumstances the withholding of which from a data subject or a third party would be contrary to conscientious treatment.

The obligation referred to in paragraph 1 of this Article shall not pertain where such information, taking into account the specific circumstances of a case, is impossible or obviously unnecessary or unsuitable, in particular if the data subject or the third party is already informed or if the data subject is unavailable.

A controller who collected data on a data subject from a third party shall inform the data subject of the requirements of paragraph 1 of this Article without delay or at the time of first processing at the latest, save where such informing, taking into account the circumstances of the case, is impossible or obviously unnecessary or unsuitable, in particular if the data subject is already informed or if the data subject is unavailable or if collection and processing of data obtained from a third party is provided for under the law.

In cases referred to in paragraph 3 of this Article, the controller shall inform the data subject as soon as reasonably possible or when required by the data subject.

The information referred to in paragraph 1 of this Article shall be provided in writing if the consent to processing is given in writing, except when the data subject or third person agrees to receive information verbally.

The controller shall notify the data subject and the data user of any modification, amendment or deletion of data without delay, and in any case not later than 15 days of the date of such modification, amendment or deletion.

Particularly Sensitive Data

Article 16

Data relating to ethnicity, race, gender, language, religion, political party affiliation, trade union membership, health status, receipt of social support, victims of violence, criminal record and sexual life shall be processed on the basis of informed consent of data subjects, save where the law does not allow the processing of such data even with the subject’s consent.

By way of derogation, data relating to political party affiliation, health status and receipt of social support may be processed without the consent of data subjects, insofar as this is allowed under the law.

In cases referred to in paragraphs 1 and 2 of this Article, processing must be specially labeled and protected by safeguards.

In cases referred to in paragraphs 1 and 2 of this Article, the Commissioner shall be entitled to access and ascertain the legality of data protection, wither ex officio or upon request of the data subject or controller.

The filing method and the safeguards applied to data referred to in paragraphs 1 and 2 of this Article shall be defined by the Government, upon obtaining the Commissioner’s opinion.

Consent to Processing of Particularly Sensitive Data

Article 17

Consent to processing of particularly sensitive shall be given in writing and shall contain a designation of the data processed, the purpose of processing and the manner of use of such consent.

If a person giving consent is illiterate or otherwise incapable of signing the consent in hand, such consent shall be valid if two witnesses confirm by their signatures that the document represents the true intent of the person giving the consent.

Withdrawal of Consent to Processing of Particularly Sensitive Data

Article 18

Article 11 of this Law shall apply mutatis mutandis to withdrawals of consent to processing of particularly sensitive data.

III.- RIGHTS OF DATA SUBJECTS AND PROTECTION OF RIGHTS OF DATA SUBJECTS

1. Rights

Right to Notification of Data Processing

Article 19

Data subjects shall have the right to be accurately and fully informed by the controller of the following:

1) Whether the controller is processing data on them and, if so, which processing operations it is performing;

2) Which data are being processed;

3) Who the data was collected from, i.e. who was the source of data;

4) The purposes for which the data is being processed;

5) The legal grounds for data processing;

6) Which data files contain the data;

7) Who uses such data;

8) Data and/or types of data that are used;

9) The purpose for which such data is used;

10) The legal grounds for the use of data;

11) Who receives the data;

12) Which data are transferred;

13) The purposes for which the data are transferred;

14) The legal grounds for data transfer;

15) The period in which the data are processed.

Right of Access

Article 20

Data subject shall have the right to request from controllers to access data relating to them.

The right of access to data relating to oneself shall include the right to review, read and listen to data, as well as the right to make notes.

Right to a Copy

Article 21

Data subjects shall have the right to request from controllers to obtain copies of data relating to them.

Controllers shall issue data copies (photocopies, audio-copies, video-copies, digital copies etc.) in the form in which such information is stored or in another form if such information would not be understandable to the data subject concerned if it were disclosed in the form in which it is stored.

Data subjects shall bear the necessary costs of making and providing copies of data.

Rights of Data Subjects upon obtaining Access to Data

Article 22

Data subjects shall have the right to require of controllers to correct, modify, update or delete data, as well as to a stay and suspension of processing.

Data subjects shall have the right to have their data deleted in the following cases:

1) If the purpose of processing is not clearly specified;

2) If the purpose of processing is changed, but the processing requirements for such changed purpose are not met;

3) If the purpose of processing has been achieved, i.e. if data is no longer needed for such purpose;

4) If data are processed by inadmissible means;

5) If data are such that their number or type is disproportionate to the purpose of processing;

6) If data are inaccurate and cannot be replaced with accurate ones by means of corrections;

7) If data are processed without consent or authority based on the law, as well as in other cases where processing is not allowed under this Law.

Data subjects shall have the right to have data processing stayed or suspended if they challenged the correctness, completeness and accuracy of data, as well as the right to have such data labeled as challenged pending a decision on their correctness, completeness and accuracy.

2. Restrictions

Restrictions of Rights

Article 23

The right to notification, access and copy may be restricted in the following cases:

1) If a data subject requests information referred to in Article 19, items 2) and 7) to 10) of this Law and the collector has already entered the data on him/her in a public register or has otherwise made them publicly available;

2) If a data subject abuses his/her right to notification, access and copy;

3) If the controller or another person has already notified to the data subject in accordance with Article 15 of this Law the information he/she requires, i.e. if the data subject has already accessed the information or obtained a copy and the data have not changed in the meantime;

4) If the controller would be prevented from performing duties within his sphere of competence;

5) If the provision of such information would significantly prejudice the interests of national or public safety, national defence or crime prevention, detection, investigation and prosecution;

6) If the provision of such information would significantly prejudice a major economic or financial interest of the state;

7) If the provision of such information would disclose data identified as confidential under a law or other regulations or enactment based on a law, insofar as the disclosure of such data could seriously prejudice an interest protected by the law;

8) If the provision of such information would seriously prejudice privacy or a vital interest of the data subject, in particular his/her life, health and physical integrity;

9) If data on the data subject are used solely for research and development purposes and statistical purposes, for as long as such usage of data continues.

Data subjects shall not have the right to access data during the stay of processing if the processing was stayed on their request.

3. Request

Request for Exercise of a Right

Article 24

Requests for notification, access and copy shall be submitted to controllers in writing, but controllers may also accept verbal requests for reasons of efficiency and cost-effectiveness. Requests for exercising one’s rights upon obtaining access to data shall be submitted to controllers in writing.

Requests referred to in paragraph 1 of this Article shall contain: information on identity of the person filing the request (name and surname, name of one parent, date and town/city of birth, unique personal identification number); residence or dwelling address; as well as any other necessary contact information.

Requests filed by legal heirs of deceased persons shall also contain information on identity of such deceased persons. Enclosed with such requests, requesters shall submit death certificate and evidence of the requester’s kinship with the deceased person.

Illiterate persons or persons unable to file requests in writing due to physical or other disabilities may make their requests verbally for the record.

Controllers may specify a format in which requests are to be filed, but they shall be required to take into consideration also any requests that are not made in such format.

If a request is unintelligible or incomplete, the controller shall instruct the requester to rectify any shortcomings.

If a requester fails to rectify shortcomings within the period specified, and in any case not later than 15 days of receipt of instruction to supplement a request, and if the shortcomings are such that the request cannot be processed, the controller shall dismiss such request as unacceptable by passing a relevant resolution.

4. Decision-making

Deciding on Requests for Notification, Access and Copy

Article 25

Controllers shall issue notices of filed requests without delay, and in any case not later than 15 days of the date of filing. Notices shall be issued in writing and, by way of exception, also verbally, if the requester agrees.

Controllers shall forthwith, and in any case not later than 30 days of receipt of an orderly request for access or obtaining a copy, enable the requester to access information or provide a copy of such information, as the case may be.

Together with the notice of granting access to data or of issuing copies of data, controllers shall also inform the requesters of the time, place and manner in which access to data will be enabled and the amount of necessary costs for producing copies of data and, if they do not have technical means at their disposal to issue a copy, they shall inform the requesters of the possibility to use their own equipment to make copies.

Requesters referred to in paragraph 2 of this Article may ask to access data at a time other than specified, where justifiable reasons for this pertain. As a rule, data shall be accessed on the controller’s official premises.

If justifiable reasons prevent controllers from acting upon a request within the time limit set out herein, they shall notify the requester accordingly and set a new time limit for request processing, which time limit cannot be longer than 30 days of expiry of the rime limit referred to in paragraphs 1 and 2 of this Article.

If a controller accepts a request for notification, access and copy, he shall make a note thereon.

If a controller rejects a request, he shall pass a resolution thereon, with an instruction on available remedies.

If a controller fails to respond to a request within the time limits set out in paragraphs 1 and 2 of this Article, or if a controller rejects a request, the requester may appeal to the Commissioner.

Deciding on Requests upon Obtaining Access to Data

Article 26

Controllers shall decide on requests field upon obtaining access to data referred to in Article 24 of this Law without delay, and in any case not later than 15 days of the date of filing, and shall notify the requesters of their decisions accordingly.

If a controller rejects a request referred to in paragraph 1 of this Article, the rationale of the ruling shall specify the reasons for rejection, as well as the reasons why processing is allowed.

A requester may lodge an appeal with the Commissioner against a ruling on rejection of request referred to in paragraph 1 of this Article within 15 days of receipt of such ruling.

If a controller finds that a request filed upon obtaining access to data is grounded, but has no technical capacities for acting upon such request without delay or urgent action upon such request would require disproportionately high amounts of time or resources, such controller shall ex officio mark such data as challenged and temporarily stay their processing.

If a controller that is a public authority establishes that a request filed upon obtaining access to data is grounded, it shall mark such data as challenged and temporarily stay their processing. Such controller shall not modify, amend, update or delete data or suspend processing if:

1) The time limit for mandatory data retaining has not expired;

2) Acting upon a request would manifestly be seriously prejudicial to the interests of other persons;

3) Because of a special method of data storage, acting upon a request is impossible or would require disproportionately high amounts of time or resources.

A mark indicating data as challenged under Article 22, paragraph 3 of this Law shall be deleted pursuant to a decision of a competent authority or with the consent of the person to whom such data relate.

5. Methods of Exercising Rights

Method of Exercising the Right of Access

Article 27

Controllers shall make data relating to data subjects available to such data subjects in a comprehensible form.

Controllers shall make all data available to requesters in the given state.

If data are kept in different formats (paper, audio, video or electronic record etc.), requesters shall be entitled to access data in the format of their choice, except where this is impracticable.

Any person who is incapable of accessing data without a guardian may do so with the help of a guardian.

Upon request from persons who need specialist assistance to understand the content of data relating to them, controllers shall provide such assistance.

Controllers shall not subject the exercise of the right to access data to any fees.

Where a controller has at its disposal data in the language in which a request is made, it shall make the data available to the requester and produce a copy in such language, except where the requester specifies otherwise and the controller has the necessary capacities to comply with the request.

Methods of Exercising the Right to Copy

Article 28

Controllers shall issue copies of data (photocopy, audio copy, video copy, digital copy etc.) in the format in which such data are stored or in another format if data would be unintelligible to the requester in the format in which they are stored.

Requester shall bear the necessary costs of making and providing copies of data.

6. Processing for the Purposes of Public Media

Article 29

Processing by journalists and other media workers for the sole purpose of publication by mass media, with the exception of processing for advertising purposes, shall be governed by the provisions of Articles 3, 5 and 8(1) to (5) and Articles 46 and 47 of this Law.

Data relating to affiliation of persons with political parties may be used for the purposes of processing referred to in paragraph 1 of this Article, insofar as such data are relevant taking into account the public office held by the person concerned.

Attachment of Replies and Other Information

Article 30

Controllers shall attach any replies, corrections, retractions or any other information published on request from a data subject referred to in Article 29 of this Law to the processed data and shall retain all such information for as long as the relevant data are kept.

Protection of Personality

Article 31

If the publication of data in mass media or in print constitutes a violation of a right or a legally protected interest of a person, the injured party may require the editor-in-chief and the publisher of a medium to notify him/her of the data processed about him/her, to grant him/her access to such data and to obtain a copy of such data, unless:

1) Such action would disclose data in connection with a data source which a journalist or another media worker is not required or willing to give;

2) Such action would disclose data in connection with a person who took part in the preparation and publication of such information and the editor-inchief is not willing to disclose such data;

3) Circumstances pertain in which notification, accessing or issuing copies of data would significantly hamper the provision of information of public importance to the general public.

7. Special Provisions

Forwarding of Requests to the Commissioner

Article 32

If controllers are not processing the pertinent data, they shall forward requests to the Commissioner, save where the requester objects to such action.

Handling by the Commissioner

Article 33

Upon receipt of a request, the Commissioner shall establish whether a controller is processing the requested data.

If the Commissioner finds that a controller is not processing the data, he/she shall forward the request to the controller that is actually processing the data and shall notify the requester accordingly or shall instruct the requester to address the controller that is processing the data, as appropriate, taking into account the need to ensure that the request is handled in the most efficient way possible.

If the Commissioner finds that a controller is processing the data, he/she shall pass a ruling ordering such controller to decide on the request.

Controllers shall decide on requests referred to in paragraph 2 of this Article within the time limits set out in Article 25, paragraph 1, and Article 26, paragraph 1 of this Law from the date of submission, while decisions on requests referred to in paragraph 3 of this Article shall be made within seven days of service of the Commissioner’s ruling.

Proxy

Article 34

The rights enshrined in this Law may be exercised in person or through proxies.

A proxy must have a notarized power of attorney.

Retention and Use in the Event of Death

Article 35

In the event of death or if a missing person is declared dead, data collected under a contract or on the basis of consent given in writing shall be retained in accordance with the conditions set out in the contract or consent, while data collected pursuant to the law shall be retained for at least a year of the date of death or the data on which a missing person is declared dead, after which they shall be destroyed.

An official notice shall be made of any destruction of data.

Consent for the use of data on deceased persons shall be given by the persons referred to in Article 10, paragraph 6 of this Law.

Controllers’ Duties

Article 36

If a data file is formed under a contract or on the basis of consent in writing and such contract is terminated or such consent in writing is withdrawn, the controller shall delete the data within 15 days of contract termination or withdrawal of consent, unless provided for or agreed otherwise.

Application of Provisions of the Law on Administrative Proceedings mutatis mutandis

Article 37

The provisions of the law governing general administrative proceedings shall apply mutatis mutandis to the procedure of deciding upon requests, unless provided otherwise in this Law.

IV.- APPEAL PROCEDURE

Right of Appeal

Article 38

Persons filing requests for exercising a right related to processing may lodge appeals with the Commissioner:

1) Against a controller’s decision rejecting or denying a request;

2) If a controller fails to decide on a request within the specified time limit;

3) If a controller fails to grant access to data or issue a copy thereof or fails to do so within the time limit and in the manner provided for in this Law;

4) If a controller makes the issuing of a copy of data subject to the payment of a fee the amount of which exceeds the necessary costs of producing a copy;

5) If a controller, in violation of the Law, hampers or prevents the exercise of rights.

Appeals may be lodged within 15 days of the date of service of a decision rejecting or denying a request or upon expiry of the specified time limit for deciding and handling.

Enclosed with an appeal, requesters shall submit the relevant request with evidence of delivery to the controller and the challenged decision.

Handling of Appeals by the Commissioner

Article 39

The Commissioner shall decide on appeals within 30 days of lodging at the latest. Appeals shall be forwarded to the controller for reply. The appellant may file a rejoinder to the contestations stated in the appeal.

The Commissioner shall reject by means of resolutions all untimely or incomplete appeals or appeals lodged by unauthorized persons.

If the Commissioner, acting on an appeal lodged for failure to act upon request, establishes that the appeal is grounded, he/she shall order the controller to act upon request within a specified period of time.

If the controller, after the lodging of an appeal for failure to act upon request, but before the Commissioner rules on such appeal, enables the exercise of the right to access data or obtain a copy or if decides upon such request, the Commissioner shall terminate appeal proceedings by a resolution.

Appeal proceedings shall also be terminated if the appellant waives the appeal.

Establishment of Facts in Appeal Proceedings

Article 40

The Commissioner shall take such actions to establish the facts as may be necessary in order to rule on an appeal.

The Commissioner or a person specifically authorized by the Commissioner shall be given access to data or data files for the purpose of establishing the facts, except in cases referred to in Article 45, paragraph 2 of this Law.

Mandatory Nature and Enforcement of Rulings

Article 41

The Commissioner’s rulings on appeals shall be binding, final and enforceable.

Where necessary, the Government shall ensure that the Commissioner’s rulings are enforced and may regulate in more detail the manner in which such rulings are to be enforced.

Legal Remedies against Rulings

Article 42

The Commissioner’s rulings may be challenged in administrative proceedings.

Other Procedural Provisions

Article 43

The procedure of ruling on an appeal shall be governed by the law on general administrative proceedings, unless provided otherwise in this Law.

V.- COMMISSIONER

Competences

Article 44

The Commissioner shall:

1) Supervise the enforcement of data protection;

2) Decide on appeals in cases set out in this Law;

3) Maintain the Central Register;

4) Supervise and allow transborder transfer of data from the Republic of Serbia;

5) Point out the identified cases of abuse in data collection;

6) Produce a list of countries and international organizations with adequate provisions on data protection;

7) Give his/her opinion on the formation of new data files or introduction of new information technologies in data processing;

8) Give his/her opinion in case of doubt whether a data set constitutes a data file within the meaning of this Law;

9) Give his/her opinion to the Government in the procedure of enactment of instruments governing the methods of data filing and safeguards for particularly sensitive data;

10) Monitor the implementation of data safeguards and suggests improvements;

11) Give proposals and recommendations for improving data protection;

12) Give prior opinion on whether a certain processing method constitutes specific risk for a citizen’s rights and freedoms;

13) Keep up to date with the data protection arrangements in other countries;

14) Cooperate with authorities responsible for data protection supervision in other countries;

15) Determine the way in which data are to be handled if a data controller ceased to exist, unless provided otherwise;

16) Perform other duties within his/her sphere of competence.

The Commissioner may have a deputy responsible for personal data protection.

The Commissioner shall forward the report he/she submits to the National Assembly to the President of the Republic, the Government and the Ombudsperson and shall make it available to the general public through appropriate means.

Right of Access and Examination

Article 45

The Commissioner shall have the right of access to and examination of:

1) Data and data files;

2) Complete set of documents relating to data collection and other processing activities, as well as to the exercise of data subjects’ rights under this Law;

3) General enactments of controllers;

4) Premises and equipment used by controllers.

VI.- DATA SECURITY

Confidentiality Duty

Article 46

The Commissioner, the Deputy Commissioner and the staff of the expert service shall keep the confidentiality of all data they learn during the performance of their duties, in accordance with the law and other regulations governing data confidentiality, unless provided otherwise.

The duty referred to in paragraph 1 of this Article shall subsist even after the Commissioner and the Deputy Commissioner have left office and after the staff of the expert service terminated their employment.

Controllers shall inform processors and persons who have access to data with the data confidentiality safeguards.

Organizational and Technical Measures

Article 47

Data must be adequately protected from abuse, destruction, loss, unauthorized alterations or access.

Controllers and processors shall take all necessary technical, human resources and organizational measures to protect data in accordance with the established standards and procedures in order to protect data from loss, damage, inadmissible access, modification, publication and any other abuse, as well as to provide for an obligation of keeping data confidentiality for all persons who work on data
processing.

VII.- RECORDS

Data Processing Records

Article 48

Controllers shall establish and maintain records containing the following information:

1) Type of data and name of data file;

2) Type of processing activities;

3) Business name, name, head office and address of the controller;

4) Date of commencement of data processing or date of data file creation;

5) The purpose of processing;

6) The legal grounds for data processing or creation of data file;

7) The category of data subjects;

8) The type and degree of data confidentiality;

9) The method of data collection and keeping;

10) The time limit for data keeping and use;

11) Business name, name, head office and address of the data user;

12) The mark under which data are transferred in or out of the Republic of Serbia, with an indication of the state or international organization and the foreign data user, the legal grounds and the purpose of transborder transfer in or out of the country;

13) Safeguards put in place to protect data;

14) Requests concerning data processing.

Controllers shall not be required to set up and maintain records for the processing of: data collected solely for family purposes and other personal purposes within the meaning of Article 5, item 2) of this Law; data processed for the purpose of maintaining registers required by the law; data in data files that contain only publicly available data; and data relating to persons whose identity remains undisclosed and the controller, the processor or the user is not authorized to establish such person’s identity.

Controllers shall update the records whenever a change occurs in relation to the basic data referred to in paragraph 1 of this Article within 15 days of the date when such change occurs.

The format of records and the manner of keeping of records referred to in paragraph 1 of this Article shall be specified by the Government.

Notification of the Commissioner

Article 49

Before the commencement of data processing or creation of data files, as the case may be, controllers shall notify the Commissioner of their intent to form a data file, with enclosed data referred to in Article 48 of this Law, as well as of any intended subsequent processing, such notification being due before the processing takes place and in any case not later than 15 days before the formation of the data file or before data processing.

The notification duty set out in paragraph 1 of this Article shall not apply to the commencement of data processing or creation of data files in cases where special regulations govern the purpose of processing, the type of data processed, the categories of users with access to the data and the period during which such data will be retained.

Prior Verification

Article 50

Upon receipt of a notification referred to in Article 49 of this Law and before the formation of a data file, the Commissioner shall verify any processing activities that could significantly prejudice the rights of data subjects.

The method in which verifications referred to in paragraph 1 of this Article are to be carried out shall be specified in an enactment passed by the Commissioner.

Duty to Submit

Article 51

Controllers shall submit to the Commissioner records of data files or changes in data records at the latest within 15 days of the date of data file formation or change.

The notifications referred to in Article 49, paragraph 1 of this Law and the records referred to in paragraph 1 of this Article shall be entered in the Central Register.

Central Register

Article 52

The Commissioner shall form and maintain the Central Register.

The Central Register shall comprise a register of data files and a catalogue of data files.

The register of data files shall contain the data referred to in Article 51, paragraph 2 of this Law.

The catalogue of data files shall contain a description of recorded data files.

The Central Register shall be public and has to be published on the Internet.

The Commissioner shall once a year publish an inventory of data files in the «Official Gazette of the Republic of Serbia».

The Commissioner shall deny access to the record of data files upon request of a data controller, provided this is necessary for the achievement of a prevailing interest of national or public safety, national defence, crime prevention, detection, investigation and prosecution, or economic or financial interests of the state, or if a law or another regulation or enactment adopted pursuant to a law provide for the
confidentiality of the record of data files.

VIII.- TRANSBORDER TRANSFER OF DATA OUT OF THE REPUBLIC OF SERBIA

Article 53

Data can be transferred from the Republic of Serbia to a state party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data.

Data may be transferred from the Republic of Serbia to a state that is not a party to the Convention referred to in paragraph 1 of this Article or an international organization if such state or international organization has a regulation or a data transfer agreement in force which provides a level of data protection equivalent to that envisaged by the Convention.

In cases of transborder transfer of data referred to in paragraph 2 of this Article, the Commissioner shall determine whether the requirements are met and safeguards put in place for the transfer of data from the Republic of Serbia and shall authorize such transfer.

IX.- SUPERVISION

Competence

Article 54

The implementation of and compliance with this Law shall be supervised by the Commissioner.

The Commissioner shall perform the duties referred to in paragraph 1 of this Article through authorized officers.

Authorized officers shall carry out their supervision duties in a professional and timely fashion and shall produce records of their enforcement activities.

In supervising the enforcement of the Law, authorized officers shall use knowledge acquired ex officio or learned from appellants or third parties.

In supervising the enforcement of the Law, authorized officers shall furnish their official identification documents. The format of such identification documents shall be prescribed by the Commissioner.

Facilitation of Supervision

Article 55

Persons responsible for data protection under this Law shall enable authorized officers to freely carry out supervision duties and shall give them access to all necessary documents.

Commissioner’s Supervision Powers

Article 56

If violations of the provisions of this Law pertaining to processing are identified in the course of supervision, the Commissioner shall caution the controller against any irregularities in processing.

On the basis of the findings of an authorized officer, the Commissioner may:

1) Order the rectification of such irregularities within a specified period of time;

2) Temporarily ban any processing carried out contrary to the provisions of this Law;

3) Order the deletion of data collected without proper legal grounds.

Orders referred to in paragraph 2 of this Article shall not be subject to appeal, but they may be challenged in administrative proceedings.

The implementation of measures referred to in paragraph 2 of this Article shall be governed by an enactment of the Commissioner.

The Commissioner shall ex officio file petitions for institution of infringement proceedings in cases of violation of the provisions of this Law.

X.- PENAL PROVISIONS

Article 57

A fine in the amount of RSD 50,000 to 1,000,000 shall be charged for infringement to a collector, a processor or a user with the status of a legal entity that:

1) Processes data without consent, contrary to the provisions of Article 12 of this Law;

2) Processes data contrary to the provisions of Article 13 of this Law;

3) Collects data from a third party contrary to the provisions of Article 14, paragraph 2 of this Law;

4) Before the collection of data, fails to inform the data subject or a third party of the requirements of Article 15, paragraph 1 of this Law;

5) Processes particularly sensitive data contrary to the provisions of Articles 16 to 18 of this Law;

6) Fails to make all data available in their current format, contrary to Article 27, paragraph 2 of this Law;

7) Fails to issue a copy of data in the current format, contrary to Article 28, paragraph 1 of this Law;

8) Fails to delete data from a data file contrary to Article 36 of this Law;

9) Fails to proceed in accordance with the Commissioner’s ruling on appeal (Article 41, paragraph 1 of this Law);

10) Acts in violation of the confidentiality duty referred to in Article 46, paragraphs 1 and 2 of this Law;

11) Acts in violation of the duty to take the measures referred to in Article 47, paragraph 2 of this Law;

12) Fails to form or update a record in violation of Article 48, paragraphs 1 and 3 of this Law;

13) Fails to notify the Commissioner of its intent to form a data file within the specified period of time, contrary to Article 49, paragraph 1 of this Law;

14) Fails to submit to the Commissioner its record of data files or changes in data files within the specified period of time (Article 51, paragraph 1 of this Law);

15) Transfers data from the Republic of Serbia contrary to Article 53 of this Law;

16) Fails to enable an authorized officer to freely perform supervision activities and grant him/her access to all necessary documents (Article 55 of this Law);

17) Fails to act on the Commissioner’s orders (Article 56, paragraph 2 of this Law).

For infractions referred to in paragraph 1 of this Article, an entrepreneur shall be charged a fine in the amount of RSD 20,000 to 500,000.

For infractions referred to in paragraph 1 of this Article, a natural person or the responsible officer of a legal entity, public authority, body or territorial autonomy and local selfgovernment unit shall be charged a fine in the amount of RSD 5,000 to 50,000.

XI.- TRANSITIONAL AND FINAL PROVISIONS

Article 58

The head office, appointment, termination of office, procedure for relieving of duty, the status of the Commissioner, the Deputy Commissioner and the expert service, funding and reporting shall be governed by the provisions of the Law on Free Access to Information of Public Importance («Official Gazette of the Republic of Serbia» Nos. 120/04 and 54/07).

Article 59

The Commissioner for Information of Public Importance, established under the Law on Free Access to Information of Public Importance («Official Gazette of the Republic of Serbia» Nos. 120/04 and 54/07) shall continue to operate as the Commissioner for Information of Public Importance and Personal

Data Protection.

Article 60

Secondary legislation hereunder shall be passed within six months of the date when this Law comes into force.

Article 61

Data files and records formed by the date when this Law comes into force shall be harmonized with the provisions hereof within 12 months of the date when this Law comes into force.

Data controllers shall submit the records referred to in Article 48 of this Law to the Commissioner within 12 months of the date when this Law comes into force.

Article 62

As of the date when this Law comes into force, the Personal Data Protection Law («Official Gazette of FRY» No. 24/98 and 26/98-Corrigendum) shall be superseded and extinguished.

Article 63

This Law shall come into force on the eighth day of its publication in the «Official Gazette of the Republic of Serbia» and shall take effect as of 1 January 2009.

10May/18

Curso de Fundamentos de Ciberseguridad

10 mayo, 2018seminarioslos Fundamentos de la Ciberseguridad, Nuevo curso ES-CIBERJosé Cuervo

Nuevo curso ES-CIBER, los Fundamentos de la Ciberseguridad

ES-CIBER y el equipo de Ciberseguridad de Áudea lanzan un nuevo curso que tiene por objetivo proporcionar una visión general acerca de los conceptos más importantes asociados a la Ciberseguridad, analizando las principales vulnerabilidades y amenazas que se pueden sufrir. Además se dará a conocer los diferentes tipos de ataques que pueden realizarse, las principales contramedidas para fortificar las redes y protocolos así como recomendaciones y consejos prácticos para mantener cibersegura tu organización.

El curso Fundamentos de Ciberseguridad está disponible en modalidad online a través de Audea Campus, la plataforma e-learning de ES-CIBER y puedes comprar tu licencia desde la tienda online.

Además durante el mes de junio, lanzamos la primera convocatoria presencial que se impartirá a lo largo de 3 días siguiendo este itinerario (descárgate la ficha completa):

Introducción a la Seguridad Informática
Ataques y Malware
Auditorías de Seguridad
Seguridad en redes Wifi
Contramedidas y Protección
Criptografía

El Curso Presencial Fundamentos de Ciberseguridad tendrá lugar 18 al 20 de junio en horario de 08:30 a 14:30, reserva tu plaza cuanto antes del 1 de mayo del 2018 para la primera convocatoria tendrás un 10% de descuento.

Si estás interesado en realizar el curso en tu empresa, ponte en contacto con nosotros.

Equipo ES-CIBER

[email protected]

01May/18

Law of Mongolia on Information Transparency and Right to Information 16 day 06 of 2011

1 mayo, 2018Ley, MongoliaDerecho Informático, Law of Mongolia on Information Transparency and Right to Information 16 day 06 of 2011, Legislación de MongoliaJosé Cuervo

Law of Mongolia on the Information Transparency and Right to Information June 16, 2011

Ulaanbaatar

CHAPTER ONE.- GENERAL PROVISIONS

Article 1. The purpose of the law

1.1. The purpose of this law is to regulate relations pertaining to ensuring transparency of the state, and rights of citizen, legal entities to seek and receive information.

Article 2. Legislation on the Information transparency and Right to information

2.1. The Legislation on the Information transparency and right to information shall consist of the Constitution of Mongolia, Law on the State Secret, Law on Approval of the State classified information list, the Law on Privacy, this law and other legislative acts adopted pursuant to these laws.

2.2. If an international treaty to which Mongolia is a party is inconsistent with this law, then such provisions of the international treaty shall prevail.

Article 3. Scope of the law

3.1. This law shall regulate relations with respect following organizations financed by the state and local budget:

3.1.1. Secretariat of the State Ikh Hural (Parliament);

3.1.2. Office of the President;

3.1.3. Government Cabinet;

3.1.4. Administrative office of the National Security Council;

3.1.5. State central administrative or other state administrative organizations;

3.1.6. Judiciary and prosecutor’s offices of all instances;

3.1.7. Institutions established by the State Ikh Hural with exception of the Government Cabinet;

3.1.8. Administrative offices of local municipal and self-governing bodies, local government owned or partial ownership legal entities;

3.1.9. State owned or partially owned legal entities;

3.1.10. Non-governmental organizations executing the particular functions of the executive branch in accordance with the 19.1, of Mongolian Law on Government and

3.1.11. Mongolian National Public Radio and Television organization.

3.2. This law shall not apply in ensuring transparency in operation of the armed forces, authority of border protection and intelligence organization.

(Article amended by the Law, of February 16, 2014)

3.3. This Law shall not apply when receiving and resolving petition, comment, complaint and statements in pursuant to the article 4 of the Law on the resolution of Petition and complaints lodged by citizens to the state organizations and the public official.

Article 4. Definition of terms

4.1. The terms found in this law shall bear the following meanings:

4.1.1. “citizen” means a citizen of Mongolia, foreign citizen lawfully residing in Mongolia, or stateless person lawfully residing in Mongolia;

4.1.2. “website” means electronic document and information placed in the internet in public domain;

4.1.3. “electronic document” means digital data that may be generated, transmitted, received and stored using computer, computer software and other similar type of tools;

4.1.4.“digital signature” means digital data, a part of the electronic document, that is generated through the crypto graphical conversion of information using digital signature personal key for the purpose of protecting digital document from forgery or modification;

4.1.5. “regular update ” means a update of a certain information not less than once in 14 days;

4.1.6. “update each case ” means a renewal of a certain information within 3 days in the event the information is amended or modified, or the information is changed in whole;

4.1.7. “placing information in an easily understandable manner” means providing complete conditions to acquaint with the information;

4.1.8. “expenses for information release” means expenses of photocopying, copying, and delivering through mail, and other required expenses for the purpose of releasing information to citizens and legal entities;

4.1.9. “repeated violation” means three or more violations of legislations on Information transparency and Right to information; and

4.1.10.“serious violation” means illegal concealment of information, forgery, tampering, and destruction of documents, and violation of citizen’s right to information in other forms that has led or may have led to significant losses by the state, citizen, business entities and other organizations.

Article 5. Principles of the activities to ensure the Information transparency and Right to information

5.1. The following principles shall apply in the activities to ensure the information transparency and right to information:

5.1.1. Rule of Law;

5.1.2. Respect for lawful interests of citizens and legal entities;

5.1.3. Openness of all information with exception of the state classified information in pursuant to the Law;

5.1.4. Independence;

5.1.5. Promptness of the information release activities.

CHAPTER TWO.- INFORMATION TRANSPARENCY

Article 6. Information transparency

6.1. Information transparency shall have the following categories:

6.1.1. Operational transparency;

6.1.2. Human resource transparency;

6.1.3. Budget and financial transparency;

6.1.4. Transparency in the procurement of goods, works and services by the state and local government.

Article 7. Operational transparency

7.1. Unless otherwise provided in the laws, organization specified in the article 3.1 of this Law shall take the following measures to ensure its operational transparency:

7.1.1. to place the organizational mission, strategic objectives, priority areas and measures implemented to achieve those objectives and priorities, outcome, and organizational structures on its website or information board in an easily understandable manner and update regularly;

7.1.2. to place the full name, position, procedure and contact details of the officer in charge for public relations, public service and timetable to receive citizens on its website and information board in an easily understandable manner and update regularly;

7.1.3. to place the list of documents required for getting services on its website and information board in an easily understandable manner and update regularly;

7.1.4. to place the legislations, rules, procedures and the guidance on its website and information board in an easily understandable manner and update regularly;

7.1.5. to place any policy document or draft decision that establishes public norms on its website in an easily understandable manner not less than 30 days, to receive comments and proposals from the relevant governmental and non-governmental organization, professional experts, scholars and citizens, and to incorporate the proposals if deems grounded;

7.1.6. to take organizational measures to improve the means and methods of the services being rendered;

7.1.7. to place in and inform the name of the non-governmental organization, which executes the particular functions of the state organization in accordance with article 19.1 of the Law of Mongolia on Government, and the organization’s address, web page, and direction of its activities through web page and information board in an easily understandable manner in the case of;

7.1.8. to place the name, address and field of activities of the license holder, and issuance and expiry date of license on its website in an easily understandable manner if such organization issues license for certain types of business activities or other activities, and update regularly;

7.1.9. to place information about the implementation, progress and status of the project and program funded by the state budget, the foreign loan and aid in the sector on its website, and update regularly;

7.1.10. other information specified in legislations.

Article 8. Transparency of the human resource

8.1. Unless otherwise provided in the laws, organization specified in the article 3.1 of this Law shall take the following measures to ensure its transparency of the human resource:

8.1.1. to place job vacancy announcements on its website and information board in an easily understandable manner, update regularly, and announce through public press and media;

8.1.2. to place civil servants’ code of ethics on the website or information board in an easily understandable manner, and update regularly;

8.1.3. to place evaluation and monitoring regulations and procedures of the human resources strategy and its implementation on the website in an easily understandable manner and update regularly;

8.1.4. to place or inform about the measures to ensure the transparency of the human resource management on its website in an easily understandable manner;

8.1.5. to place or inform about the measures to improve the performance evaluation of employees on its website in an easily understandable manner;

8.1.6. to inform any other information specified in laws and legislations.

Article 9. Transparency of the budget and finance

9.1. Relation arising from the budget and financial transparency of the entity stated in the article 3.1 of this law shall be regulated by the Law on Transparency of accounting.

(Article amended by the Law, of January 16,2014)

9.1.1.(Article repealed by the Law, of January 16,2014)

9.1.2 (Article repealed by the Law, of January 16,2014)

9.1.3.(Article repealed by the Law, of January 16,2014)

9.1.4. (Article repealed by the Law, of January 16,2014)

9.1.5. (Article repealed by the Law, of January 16,2014)

9.1.6. (Article repealed by the Law, of January 16,2014)

9.2 (Article repealed by the Law, of June 01,2014)

9.3 (Article repealed by the Law, of June 01, 2014).

Article 10. Transparency in the procurement of goods, works and services by the state and local government financing

10.1 Relation arising from transparency of the entity stated in the Article 3.1 of this law on purchasing goods, work and service and by the state and local property and stated shall be regulated by the Law on transparency of accounting.

(Article amended by the Law, of June 01, 2014).

10.1.1

(Provision repealed by the Law, of June 01, 2014).

10.1.2

(Provision repealed by the Law, of June 01, 2014).

10.1.3

(Provision repealed by the Law, of June 01, 2014).

10.1.4

(Provision repealed by the Law, of June 01, 2014).

10.1.5

(Provision repealed by the Law, of June 01, 2014).

10.1.6

(Provision repealed by the Law, of June 01, 2014).

10.1.7

(Provision repealed by the Law, of June 01, 2014).

1.1.8

(Provision repealed by the Law, of June 01, 2014).

CHAPTER THREE.- PROCEDURE TO ACCESS AND TO PROVIDE WITH INFORMATION

Article 11. To receive information

11.1. Citizens and legal entities shall be entitled to receive the following information except the information prohibited by law to publicly disclose for the purpose of ensuring human rights, freedom, national security, and organization’s lawful interest from the organization specified in the article 3.1 of this Law;

11.1.1.All types of information, documents, agreements and contracts in possession of the organization;

11.1.2. Information related to the property in possession of the organization; and

11.1.3. Any other information related to the activities of the organization.

11.2. Any official of the organization, specified in the article 3.1 of this law, with mandate to receive a request for information from the citizen and legal entity is prohibited to make any other requirements not specified in this law.

11.3. The request for information by the citizen and legal entity shall meet the following requirements:

11.3.1. to provide information of his/her full name, address, e-mail address, telephone number, number of national ID or its equivalent and signature in case of a citizen,;

11.3.2. to provide name, address, e-mail address and the state registration number of the legal entity, and the signature of the competent person authorized to represent the legal entity, in case of a legal entity;

11.4. In case a citizen is unable to sign due to a reasonable excuse as specified in the provision 11.3.1 of this law, others may be authorized to sign on his/her behalf, and if citizens made joint request, all the citizens shall sign or their representative shall sign and attach evidencing document of his/her power to represent.

Article 12. Rights and obligations of the person who request information

12.1. An information requesting party shall have the following rights in exercising his/her rights:

12.1.1. to be equal;

12.1.2. to choose the means to receive information;

12.1.3. shall not have obligation to explain the need and ground of requesting information;

12.1.4. to receive additional reference on issues related to information;

12.1.5. to have oral explanation made on the content of the information;

12.1.6. to know the official source of the information;

12.1.7. if deems his/her right to receive information is violated, to make complaint to the respective organization and official; and

12.1.8. any other rights specified in the laws.

12.2. An information requesting party shall have the following obligations when receiving information:

12.2.1. to comply with the procedure to receive information specified in the laws;

12.2.2. not to violate the Constitution of Mongolia, other laws, rights and lawful interests of others when exercising his/her right to receive information; and

12.2.3. to articulate the required information realistically.

Article 13. Review of the request

13.1. An official who received the request from citizen and legal entity for information (“Request”) shall examine the request as follows:

13.1.1. if the request meets the requirements specified in the article 11.3 of this Law;

13.1.2. to check the accuracy of the personal information related to the citizen and legal entity using Number of national ID or its equivalent document;

13.1.3. to check whether the required information is in the possession of the organization, if not to transfer the request to the relevant organization within 2 business days and inform the citizen and legal entity about the transfer; and

13.1.4. to check if there is a ground specified in the article 18 of this law.

13.2. The request shall be turn in on the following grounds in addition to the grounds specified in the article 18 of this Law:

13.2.1. a request fails to meet the requirements specified in the article 11.3 of this Law; and

13.2.2. information mentioned in the request is not in possession of the organization, and it deems impossible to transfer the request to relevant organization.

13.3. When turning in the request, the reason and ground shall be clearly specified.

Article 14. Release of information

14.1. An organization specified in the article 3.1 of this Law is obliged to release information related to the activities of the organization, except the information prohibited publicly disclose as specified in the laws and legislations, to citizens and legal entities.

14.2. An organization specified in the article 3.1 of this Law shall establish facility to meet citizens, and a timetable to receive request and publicly inform of it.

14.3. An organization specified in the article 3.1 of this law is prohibited to illegally destroy information in its possession and infringe rights of citizen to exercise his/her right to receive information.

14.4. An organization specified in the provision 3.1.10 of this Law shall be obligated to release the following information in public domain:

14.4.1. information that reflects or indicates the existing or potential impact of the activities, manufacturing, servicing, equipment and technology used by the organization on the environment and health of the population;

14.4.2. information specifying the harmful impact of all types of poisonous or radioactive substances, those are in the possession of the organization, which might damage the environment and health of the population, in the event the procedures of storage and protection is violated; and

14.4.3. Any other information which is to be publicly disclosed as required by laws.

14.5. An organization specified in the provision 3.1.10 of this Law is obliged to approve the list of its secrets and publicly inform of it.

14.6. Information may be provided orally, in written and electronically, and citizen and legal entity may examine the information in person.

14.7. A request whose response can be immediately provided shall be resolved and responded immediately.

14.8. Unless otherwise provided by laws, information shall be given within 7 business days to a citizen and legal entity who have made the request and if the request is made jointly, the information shall be given to any one of the citizens on their behalf.

14.9. If deems necessary, period specified in the article 14.8 of this Law may be extended once by 7 days.

14.10. Date on which the request was responded, name of the official who prepared the response and the form of the information shall be noted in the record and stored.

Article 15. Receipt and release of information in electronic form

15.1. A citizen and legal entity may request to receive information in an electronic form.

15.2. In the event the request is made to receive information in an electronic form, citizen and legal entity shall prepare electronic document and include digital signature, a number of its own national ID or equivalent document and send the information through e-mail.

15.3. In the event the information is provided to citizen and legal entity in electronic form, the respective official of the organization shall prepare electronic document including his/her digital signature and send the information through e-mail to the person who made the request.

15.4. When releasing information in electronic form, the procedures specified in the articles 11-14 of this Law shall be complied with.

Article 16. Service fee

16.1. The service fee shall apply for citizens and legal entities receives information.

16.2. The amount of service fee specified in the article 16.1 of this Law shall be established by the management of the organization in commensurate with the expenses to be incurred in relation to the release of such information, and the calculation methodology and procedures for the payment of such fees, its discount and waiver shall be approved by the Government of Mongolia.

16.3. The service fees specified in article 16.1 of this Law shall not be imposed at the same time with other service fees.

16.4. The amount of service fees shall not exceed the direct expenses related to release of such information such as copying and delivery through mail.

Article 17. Making complaints, and reviewing and resolving complaints

17.1. Complaint may be made on the action or inaction of the organization and official who have violated the rights of citizens and legal entities to receive information to higher level organization or official, the National commission for Human rights, or court.

17.2. The relations related to the resolution and consideration of the complaints specified in the article 17.1 of this Law shall be regulated by the following laws:

17.2.1. Law on the resolution of application and complaint submitted by the citizens to state organization and official, Law on Administrative Procedure, and Law on Civil Procedure if the complaint is made to higher level organization or official;

17.2.2. Law on the National Commission for Human Rights of Mongolia if the complaint is made to National Commission for Human Rights;

17.2.3. Law on Administrative Procedure and Law on Civil Procedure if the complaint is filed to court.

CHAPTER FOUR.- PROHIBITIONS IN RELEASING CERTAIN TYPES OF INFORMATION TO CITIZENS AND LEGAL ENTITIES

Article 18. Special circumstances

18.1. In the following circumstances, it is prohibited to disclose the information to others:

18.1.1. if there are well-grounded reasons that the public release of the concerned information might be detrimental to the national security and public interest of Mongolia;

18.1.2. if the concerned information is related to matters under review by the Mongol Bank, the Financial Regulatory Commission, state administrative organizations in charge of competition or specialized inspection;

18.1.3. if it is necessary to protect the secrets of state, organization and individual during the process of inquiry, investigation and prosecution;

18.1.4. if the concerned information is related to the process of concluding international treaty or agreement; and

18.1.5. others specified in laws and legislations.

Article 19. Intellectual property protection

19.1. It is prohibited to disclose intellectual property related information without the permission by the owner.

Article 20. Protection of privacy

20.1. Unless otherwise provided by law, if individual has not agreed in written, it is prohibited to disclose his/her information except the information of his/her parents’ name, first name, age, gender, profession, education, official position, work address and telephone number.

Article 21. Protection of organization’s secret

21.1. It is prohibited to disclose, without the written permission given by the respective official of the business entity (executive management or other persons to whom the authority is given to), secret information, technological solution, project, research document and other information related to required machineries and equipment, whose disclosure might be detrimental to the lawful interest of the organization, or those taken under its confidentiality or protection for the purpose of protecting its market and advantage in the fair competition, or those related to the unique activities of the organizations and business entities specified in the article 3.2 of the Law on Organization’s secret.

CHAPTER FIVE.- ORGANIZING AND SUPERVISING THE IMPLEMENTATION OF LEGISLATION

Article 22. Powers of the State administrative organization in charge of information technology issues

22.1. State Administrative organization in charge of Information technology shall exercise the following powers with regard to ensuring information transparency and right to information:

22.1.1. to put information specified in the articles 7, 8.1, 9 and 10 of this Law into electronic form, create information base, distribute, use and prepare common regulation to ensure the reliability of their un-interrupted operation, storage and protection;

22.1.2. to organize training among state organizations and provide professional and methodological assistance on the issues of storing information into electronic form, creating information base, distribution, use, and ensuring the reliability of their un-interrupted operation, storage and protection; and

22.1.3. other powers provided by in laws and legislations.

22.2. The regulation specified in the provision 22.1.1 of this Law shall be approved by the Government.

Article 23. Record keeping

23.1. An organization specified in the article 3.1 of this Law shall keep the record in order to ensure the possibility to monitor the implementation of the laws and legislations on information transparency and right to information, and the record shall reflect the following:

23.1.1. name and address of the citizens and legal entities those made the request;

23.1.2. time on which the request for information is received, reviewed and returned, and information is provided; and

23.1.3. others.

Article 24. Supervising the implementation of the legislations on Information transparency and right to information

24.1. An organization and official specified in the article 3.1 of this Law shall organize the monitoring over the implementation of the legislation on the Information transparency and right to information within the powers specified in laws.

24.2. Measure to ensure the information transparency shall be reflected in the result based contract between the Chief of Budget manager and the General manager and it shall be considered as a one of the evaluation criteria points.

CHAPTER SIX.- MISCELLANEOUS

Article 25. Liability for violations of legislations on information transparency and right to information

25.1. Any one of the disciplinary liabilities, those are provided in the article 26 of the Law on Civil Service, shall be imposed on the civil servant, considering the characters of the violation, who violated the laws and legislations on the Information transparency and right to information by the competent authority who appointed the civil servant.

25.2. A civil servant who repeatedly or seriously violated the right of the citizen and legal entity to receive information shall be dismissed from his job on the ground specified in the provision 25.1.1 of the Law on Civil Service by the competent official.

25.3. A judge shall fine the respective decision making person who violated the article 25.2 of this Law by tugrugs equal to five times the minimum labor wage.

CHAIRMAN OF THE STATE IKH HURAL OF MONGOLIA

DEMBEREL D.

23Abr/18

Decreto nº 377 de 25 de julio de 2013, Ley sobre el uso de medios electrónicos para el Estado de Aguascalientes

23 abril, 2018Ley, México20 de febrero de 2017)., Decreto nº 377 de 25 de julio de 2013, Derecho Informático, Legislación de Mexico, Ley sobre el uso de medios electrónicos para el Estado de Aguascalientes. (Publicada en el Periódico Oficial del Estado el 23 de Septiembre de 2013). (Última modificación Periódico Oficial del EstadoJosé Cuervo

Decreto nº 377 de 25 de julio de 2013, Ley sobre el uso de medios electrónicos para el Estado de Aguascalientes. (Publicada en el Periódico Oficial del Estado el 23 de Septiembre de 2013). (Última modificación Periódico Oficial del Estado, 20 de febrero de 2017).

ING. CARLOS LOZANO DE LA TORRE, Gobernador Constitucional del Estado de Aguascalientes, a sus habitantes sabed:

Que por el H. Congreso del Estado se me ha comunicado lo siguiente:

La LXI Legislatura del Poder Legislativo del Estado Libre y Soberano de Aguascalientes, en virtud de su función y facultad constitucional, ha tenido a bien expedir el siguiente:

Decreto Número 377

LEY SOBRE EL USO DE MEDIOS ELECTRÓNICOS PARA EL ESTADO DE AGUASCALIENTES

CAPÍTULO I.- DISPOSICIONES GENERALES

ARTÍCULO 1º.-

La presente Ley es de orden público e interés general y tiene por objeto regular y promover en el Estado de Aguascalientes el uso de medios, documentos y Firma Electrónica, por parte de los Poderes Ejecutivo, Legislativo, Judicial, Organismos Paraestatales, los Ayuntamientos, así como de los particulares para agilizar, simplificar y hacer más accesibles todos los actos y tramites en que intervengan. A falta de disposición expresa en esta Ley será de aplicación supletoria la normatividad de la materia aplicable al acto o trámite a realizarse. Quedan exceptuados de la aplicación de esta Ley:

a) Los actos o procedimientos, que por disposición legal expresa exijan la firma autógrafa.

b) Los actos o procedimientos que por disposición legal exijan una formalidad que no sea susceptible de cumplirse mediante la firma electrónica.

ARTÍCULO 2º.-

Para los efectos de esta Ley, se entenderá por:

I. Actos: las comunicaciones, trámites, servicios, actos jurídicos y administrativos, así como procedimientos administrativos en los cuales los particulares y los servidores públicos de las dependencias y entidades de la Administración Pública Estatal y Municipal, que utilicen la firma electrónica avanzada; y (ADICIONADA POR DECRETO Nº 59 PUBLICADO EN EL P.O.E. DEL 20 DE FEBRERO DE 2017)

II. Autoridad Certificadora: Al órgano designado por el Poder Ejecutivo, que tiene a su cargo los servicios de certificación de firma electrónica;

III. Certificado Electrónico: El documento firmado electrónicamente por un Prestador de Servicios de Certificación que vincula los datos de firma a su autor y confirma su identidad;

IV. Contraloría: La Secretaría de Fiscalización y Rendición de Cuentas;

V. Datos de Creación de Firma Electrónica: Los datos únicos, las claves o llaves criptográficas privadas que el titular obtiene del Prestador de Servicios de Certificación y se utilizan para crear la Firma Electrónica;

VI. Dispositivo de Creación de Firma Electrónica: El mecanismo o instrumento por medio del cual se capta o recepta la Firma Electrónica o mensaje de datos y que al firmar el mismo le dan a éste un carácter único que asocia de manera directa el contenido del documento con la Firma Electrónica del firmante;

VII. Dispositivo de Verificación de Firma Electrónica: La aplicación por medio de la cual se verifican los datos de creación de Firma Electrónica para determinar si un documento o mensaje de datos, ha sido firmado utilizando la clave o llave criptográfica privada controlada por el firmante, permitiendo asociar la identidad del firmante con el contenido del documento o mensaje de datos por tener éste el resguardo físico y el control personal del Certificado Electrónico;

VIII. Documento Electrónico: El documento o archivo electrónico en cualquier formato sea este alfanumérico, de video o audio el cual sea firmado con un Certificado Electrónico con validez jurídica;

IX. Entes Públicos: Los Poderes Ejecutivo, Legislativo y Judicial; Organismos Paraestatales y Ayuntamientos;

XI. Firma Electrónica Avanzada o Fiable: La que es generada con un certificado reconocido legalmente a través de un dispositivo seguro de creación de firma y tiene, en relación a la información firmada, un valor jurídico equivalente al de la firma Autógrafa;

XII. Firmante: la persona o proceso que utiliza los datos de Firma Electrónica Avanzada o Fiable; (ADICIONADA POR DECRETO Nº 59 PUBLICADO EN EL P.O.E. DEL 20 DE FEBRERO DE 2017)

XIII. Ley: La Ley Sobre el Uso de Medios Electrónicos para el Estado de Aguascalientes;

XIV. Medios Electrónicos: Dispositivos Tecnológicos para transmitir o almacenar datos de información, a través de computadoras, líneas telefónicas, enlaces dedicados, microondas o de cualquier otra tecnología;

XV. Mensaje de Datos: La información generada, enviada, recibida, archivada o comunicada a través de medios de comunicación electrónica, que puede tener documentos electrónicos; (ADICIONADA POR DECRETO Nº 59 PUBLICADO EN EL P.O.E. DEL 20 DE FEBRERO DE 2017)

XVI. Prestador de Servicios de Certificación: La persona moral o física que preste servicios relacionados con firmas electrónicas y que expide Certificados Electrónicos;

XVII. Sello Electrónico: Es una cadena de caracteres que está asociada al emisor del documento y a los datos emitidos que permiten conocer si el documento es auténtico o ha sido alterado;

XVIII. Titulares de Certificados de Firma Electrónica: Los ciudadanos, representantes légales de empresas o Entidades Públicas, Privados y Servidores Públicos que posean un Certificado Electrónico con validez jurídica; y

XIX. Unidad de Firma Electrónica: La Oficina Administrativa responsable de ejercer las atribuciones en materia de registro de prestadores de servicios de certificación relacionados con la Firma Electrónica.

ARTÍCULO 3º.-

Los Entes Públicos deberán gestionar el uso de la Firma Electrónica para dar trámite a los asuntos y documentos que generen sean internos o externos así como los trámites y servicios que tramiten a la ciudadanía; sin perjuicio que puedan seguir emitiendo documentos con firma autógrafa.

Los Titulares de los Entes Públicos determinarán los servidores públicos que, para los efectos de su cargo, realizarán el trámite correspondiente para la obtención y/o uso de la Firma Electrónica Avanzada; o bien, éstos serán los que establezca la normatividad interna de la dependencia o entidad pública de que se trate. (ADICIONADO POR DECRETO Nº 59, PUBLICADO EN EL P.O.E DE 20 DE FEBRERO DE 2017)

Para la obtención de la Firma Electrónica Avanzada, el solicitante realizará el trámite correspondiente ante la autoridad certificadora o con los prestadores de servicios de certificación, cumpliendo los requisitos y procedimientos establecidos en el Reglamento. (ADICIONADO POR DECRETO Nº 59,PUBLICADO EN EL P.O.E DE 20 DE FEBRERO DE 2017)

ARTÍCULO 4º.-

Corresponde a la Unidad de Firma Electrónica:

I. Establecer la coordinación y gestiones necesarias para impulsar la disponibilidad de los Servicios de Certificación Electrónica;

II. Habilitar la utilización de la Firma Electrónica con validez jurídica con todas sus características;

III. Fomentar y difundir el uso de la Firma Electrónica en todos los trámites y servicios;

IV. Formular los requisitos específicos, directrices y lineamientos para la implementación y uso de la Firma Electrónica; y

V. Las que establezcan esta Ley y demás Ordenamientos Jurídicos y Administrativos aplicables.

ARTÍCULO 5º.-

Corresponde a la Secretaría de Desarrollo Económico:

I. Promover y difundir la utilización generalizada de la Firma Electrónica dentro de los procesos de negocios de las empresas establecidas en el Estado de Aguascalientes;

II. Proporcionar a las micros, pequeñas y medianas empresas, cooperativas y en general al sector productivo y empresarial, la información necesaria para implementar los mecanismos de medios digitales, incentivos y facilidades que les permitan implementar esta tecnología en sus procesos de operación;

III. Gestionar la obtención de los recursos e implementos para la habilitación y uso de la Firma Electrónica para las transacciones, operaciones, trámites, y demás actos legales en la Administración Pública del Estado de Aguascalientes; y

IV. Asesorar a los Entes Públicos para el funcionamiento de los programas que utilicen Firma Electrónica.

ARTÍCULO 6º.-

Corresponde a la Unidad de Firma Electrónica emitir acuerdos meramente técnicos para la incorporación de Firma Electrónica en los tramites y procedimientos que se lleven a cabo en la administración pública del Estado.

CAPÍTULO II.- DE LOS ALCANCES DE LA FIRMA ELECTRÓNICA

ARTÍCULO 7º.-

Las disposiciones de esta Ley no modifican los ordenamientos legales en materia de cualquier acto jurídico en el que sea requerida la firma autógrafa o manuscrita o rúbrica escrita sobre documento de papel. En las actuaciones y trámites a que se refiere esta Ley, los documentos emitidos que contengan o se realicen con el uso de Firma Electrónica, tendrán la misma validez legal que los documentos que se generen y firmen en documento de papel. Todo documento que tiene un medio en papel, firma autógrafa o rúbrica podrá ser habilitado para tener un formato electrónico si cuenta con la Firma Electrónica de conformidad con la presente Ley. Todo documento que sea originado por medio de una Firma Electrónica será admisible como prueba documental en cualquier juicio.

ARTÍCULO 8º.-

La Firma Electrónica será aceptada por los Entes Públicos como si se tratase de un documento con firma autógrafa.

Serán válidos los documentos con Firma Electrónica emitidos por las personas dotadas de fe pública. Los documentos que contengan información digital en formatos de audio y video serán válidos cuando se emitan con Firma Electrónica.

ARTÍCULO 9°.-

La Firma Electrónica tendrá validez jurídica únicamente en los siguientes documentos:

I- Los que contengan información digital en formatos de audio y video;

II. Los que emitan los Servidores Públicos en ejercicio de sus funciones; y los titulares de los Órganos Paraestatales de acuerdo o conforme con su normatividad interna;

III. Los emitidos por particulares;

IV. Los demás que establezca esta Ley y otros ordenamientos aplicables.

ARTÍCULO 10.-

La Firma Electrónica vincula a su autor con el contenido del documento electrónico, de la misma forma en que la firma autógrafa lo hace respecto del documento en el que se encuentra asentada.

ARTÍCULO 11.-

El firmante que use una Firma Electrónica reconoce como propio y auténtico el documento electrónico que por su medio se genere. Por el uso de su Firma Electrónica el firmante aceptará que su Firma Electrónica expresa su voluntad o consentimiento para todo efecto legal.

ARTÍCULO 12.-

La identidad legal del firmante queda establecida por el hecho de que su Firma Electrónica lo relaciona de manera directa y exclusiva con el contenido del documento electrónico y los datos que le componen originalmente, dado que el firmante tiene bajo su exclusivo control los medios de generación de dicha firma.

ARTÍCULO 13.-

El uso de la Firma Electrónica y documentos electrónicos en los términos de la presente Ley implica:

I. Que la Firma Electrónica vincula de manera indubitable al firmante con un documento electrónico, sea esta de página escrita con caracteres alfanuméricos, o archivo de imagen, video, audio o cualquier otro formato tecnológicamente disponible, el cual se asocia por medio de un dispositivo de creación de firma, con los datos que se encuentran exclusivamente bajo control del firmante y que expresan en medio digital su identidad;

II. Que el usuario de la Firma Electrónica tiene la responsabilidad de prevenir cualquier alteración en el contenido de los documentos que emita, por tener el control exclusivo de los medios para insertar la referida firma, cuyo uso garantiza la integridad y autenticidad de lo firmado; y

III. Que el documento electrónico ha sido originado utilizando un Certificado Electrónico con validez jurídica por medio de un dispositivo seguro de creación de firma.

CAPÍTULO III.- DEL USO DE LA FIRMA ELECTRÓNICA EN LOS ENTES PÚBLICOS

ARTÍCULO 14.-

Los Entes Públicos impulsarán el uso de la Firma Electrónica para la expedición de documentos electrónicos con validez jurídica semejante a la de documentos firmados en papel para todo tipo de actuaciones oficiales y actos jurídicos.

ARTÍCULO 15.-

Los Entes Públicos deberán utilizar Certificados Electrónicos emitidos por la propia Unidad de Firma Electrónica o por Prestadores de Servicios de Certificación; registrados ante la propia Unidad de Firma Electrónica.

ARTÍCULO 16.-

El Prestador de Servicios de Certificación comprobará la identidad del Servidor Público facilitando los medios tecnológicos para la creación del Certificado Electrónico con validez jurídica y asegurándose de que tal certificado sea generado y quede bajo el control exclusivo del titular del certificado.

ARTÍCULO 17.-

Los Certificados Electrónicos serán expedidos a los Servidores Públicos por los Prestadores de Servicios de Certificación que sean registrados, previo cumplimiento de todos los requerimientos que se establezcan para tal efecto. (REFORMADO POR DECRETO Nº 59, PUBLICADO EN EL P.O.E. DEL 20 DE FEBRERO DE 2017)

ARTÍCULO 18.-

Todos los documentos electrónicos y en general los que emitan los servidores públicos habilitados bajo el sistema de Firma Electrónica deberán especificar su fecha y hora de creación, así como la fecha de expiración del cargo conforme a la norma de metrología aplicable. (REFORMADO POR DECRETO Nº 59, PUBLICADO EN EL P.O.E. DEL 20 DE FEBRERO DE 2017)

ARTÍCULO 19.-

Los Entes Públicos deberán contar con una infraestructura segura de resguardo o archivo de documentos electrónicos oficiales, que permita la debida clasificación y disponibilidad de los documentos en los términos de la Ley de Transparencia y Acceso a la Información Pública del Estado de Aguascalientes y sus Municipios. (REFORMADO POR DECRETO Nº 59, PUBLICADO EN EL P.O.E. DEL 20 DE FEBRERO DE 2017)

ARTÍCULO 20.-

Para la conservación, almacenamiento y disponibilidad de los documentos electrónicos se deberá cumplir lo señalado en la Ley de Transparencia y Acceso a la Información Pública del Estado de Aguascalientes y sus Municipios, así como en las normas aplicables que para tal efecto se expidan. (REFORMADO POR DECRETO Nº 59, PUBLICADO EN EL P.O.E. DEL 20 DE FEBRERO DE 2017)

ARTÍCULO 21.-

Los Entes Públicos deberán habilitar una Oficialía de Partes Electrónica, que funcionará de acuerdo a la hora oficial mexicana, que asentará los datos de fecha y hora en todos los documentos electrónicos que se emitan y/o reciban. Tales datos determinarán para todos los efectos de Ley la vigencia y vencimiento de los plazos.

ARTÍCULO 22.-

Los Entes Públicos habilitarán, en sus respectivos ámbitos de competencia, un portal de internet y un correo electrónico, podrán asimismo habilitar cuentas en redes sociales de internet a efecto de difundir la información relativa a los servicios públicos y trámites administrativos prestados en el ámbito de sus respectivas competencias.

Corresponderá a la Unidad de Firma Electrónica la gestión de un portal de internet único que concentrará la información de los servicios públicos y trámites administrativos prestados por cada uno de los Entes Públicos. El Sistema de Gobierno Electrónico del Estado de Aguascalientes se regirá por los siguientes principios rectores: (REFORMADO POR DECRETO Nº 59, PUBLICADO EN EL P.O.E. DEL 20 DE FEBRERO DE 2017)

a) Acceso Universal: Disponer el acceso al sistema en cualquier momento sin mayores restricciones a las establecidas para atender, o en su caso sustanciar servicios públicos o trámites Administrativos que los expresamente establecidos en los ordenamientos aplicables.

b) Simplicidad: Diseñar un sistema caracterizado por la facilidad en su consulta y la sencillez en su interacción de acuerdo con las preferencias y necesidades de los usuarios.

c) Confiabilidad: Asegurar que la información proveída sea auténtica a efecto de garantizar su seguridad y eficacia jurídica.

d) Innovación: Incorporar continuamente nuevas tecnologías de la información con base en la eficiencia de resultados y la optimización de costos.

e) Participación Multisectorial: Impulsar la colaboración del Sector Privado y el Sector Social en la implementación y la vigilancia del Gobierno Electrónico.

f) Seguridad: Disponer de adecuados niveles de seguridad que garanticen la protección de datos personales de conformidad con lo establecido en los ordenamientos aplicables.

g) Simplificación Administrativa: Procurar la reducción de los requisitos y formalidades para la atención, y en su caso, sustanciación electrónica de los servicios públicos y trámites administrativos; (REFORMADO POR DECRETO Nº 59, PUBLICADO EN EL P.O.E. DEL 20 DE FEBRERO DE 2017)

h) Compatibilidad Internacional: La observación en el cumplimiento de los estándares internacionales; y (ADICIONADO POR DECRETO Nº 59, PUBLICADO EN EL P.O.E. DEL 20 DE FEBRERO DE 2017)

i) Neutralidad Tecnológica: La utilización de cualquier tecnología sin que se favorezca alguna en particular. (ADICIONADO POR DECRETO Nº 59, PUBLICADO EN EL P.O.E. DEL 20 DE FEBRERO DE 2017)

CAPÍTULO IV.- DE LOS DERECHOS Y OBLIGACIONES DE LOS TITULARES DE CERTIFICADOS DE FIRMA ELECTRÓNICA Y DE LOS PRESTADORES DEL SERVICIO DE CERTIFICACIÓN

ARTÍCULO 23.-

Los titulares de Certificados Electrónicos tendrán los siguientes derechos:

I. A la protección y resguardo de datos reservados y confidenciales en los términos de la Ley de Transparencia y Acceso a la Información Pública y la Ley de Protección de Datos Personales;

II. A modificar y actualizar los datos que sobre su identidad se encuentren contenidos en el certificado que en su caso fuera requerido, previa presentación del soporte correspondiente que acredite dichos cambios;

III. De Solicitar constancia de la existencia y registro de sus Certificados Electrónicos, cuando a sus intereses convenga;

IV. A recibir información sobre los procedimientos de creación de su Firma Electrónica, instrucciones de uso de los Certificados Electrónicos, costos del prestador y de las certificaciones de los Prestadores de Servicios de Certificación; y

V. Conocer los datos de domicilio y Dirección Electrónica del Prestador de Servicios de Certificación y la autoridad que los regula para presentar quejas, solicitar aclaraciones o tramitar la expedición de reportes de uso de sus certificados.

ARTÍCULO 24.-

Los titulares de Certificados Electrónicos tendrán las siguientes obligaciones:

I. Proporcionar al Prestador de Servicios de Certificación datos verdaderos, completos y exactos al momento de tramitar la emisión de su Certificado Electrónico con validez jurídica;

II. Resguardar la confidencialidad de su Certificado Electrónico con validez jurídica, así como de las contraseñas y/o claves que le sean proporcionados;

III. Mantener un control físico, personal y exclusivo de su Certificado Electrónico, no compartible con persona alguna;

IV. Denunciar la divulgación de los datos asociados al uso de su Certificado Electrónico;

V. Dar aviso a la Unidad de Firma Electrónica de terminación del empleo, cargo o comisión; tratándose de Servidor Público;

VI. Mantener actualizados los datos contenidos en el Certificado Electrónico; y

VII. Dar aviso inmediato al Prestador de Servicios de Certificación ante cualquier circunstancia que ponga en riesgo la privacidad del uso de su Certificado de Firma Electrónica para la cancelación del mismo.

ARTÍCULO 25.-

Para la expedición de Certificados Electrónicos el Prestador del Servicio deberá:

I. Verificar fidedignamente los datos personales y datos de representación del titular del certificado. Sólo expedirá el certificado después de comprobar de manera indubitable la información que acredita la identidad del titular;

II. Requerir la presencia física del solicitante para acreditar su identidad;

III. Verificar la veracidad de la información declarada por el solicitante con documentos oficiales que acrediten estos datos, asentando la referencia correspondiente en los registros electrónicos que se produzcan;

IV. Hacer saber ante la Unidad de Firma Electrónica que la información consignada en el certificado es correcta;

V. Corroborar y acreditar que el titular del certificado esté en posesión tanto de los datos de creación como los de verificación de firma que el certificado ampara;

VI. Certificar la correspondencia de los datos de creación y verificación de firma habilitados por el certificado expedido al titular;

VII. Poner bajo la disposición y resguardo exclusivo del titular el Certificado Electrónico en un Dispositivo Físico Seguro;

VIII. Abstenerse de reproducir, copiar, transcribir o guardar los datos de creación de la Firma Electrónica emitida al titular del certificado;

IX. Conservar registro de la información relacionada a la emisión del certificado por un plazo no menor a quince años para que pueda ser consultado de manera permanente;

X. Implementar los mecanismos de protección apropiados para la prevención de actos de falsificación de certificados y asegurar la plena confidencialidad del proceso de emisión y entrega del Certificado Electrónico al titular;

XI. Mantener en funcionamiento permanente y sin interrupción los servicios de Autenticación de Certificados Electrónicos a través de la red pública de Internet;

XII. Documentar que el titular del certificado tiene conocimiento pleno de las obligaciones y consecuencias legales de la recepción del Certificado Electrónico. En este acto recabará firma de reconocimiento de estas obligaciones y consecuencias por parte del titular; y

XIII. Otorgar garantía mediante póliza de fianza o cualesquier otro medio durante el tiempo que preste el servicio, a fin de responder ante posibles daños y perjuicios.

ARTÍCULO 26.-

Los Certificados Electrónicos deben contener:

I. La indicación de que se expiden como tales;

II. En el caso de los Servidores Públicos los datos relacionados con su identidad;

III. El Código de Identificación Único del Certificado;

IV. La identificación del Prestador de Servicios de Certificación, que expide el certificado así como en su caso la Razón Social, su domicilio, Dirección de Correo Electrónico y los datos de acreditación por la autoridad o por el Prestador de Servicios de Certificación;

V. Nombre y datos relacionados con la identidad del titular del certificado;

VI. Período de vigencia del certificado;

VII. La fecha y hora de la emisión;

VIII. El alcance de las responsabilidades que asuma el titular de certificación;

IX. La referencia de la tecnología empleada para la creación de la Firma Electrónica; y

X. Las limitaciones que en su caso se establezcan para al uso del certificado del uso de la Firma Electrónica para los representantes de las personas físicas y morales.

ARTÍCULO 27.-

Los Certificados Electrónicos de personas morales tendrán plena validez jurídica, en términos de lo dispuesto por el Código Civil, de Procedimientos Civiles y demás Leyes de la materia:

I. Describirán los datos de identificación personal del firmante quien deberá asumir la responsabilidad jurídica del resguardo del Certificado Electrónico;

II. Serán siempre expedidos a nombre de una persona física específica la cual deberá acreditar que tiene la facultad de responsabilizarse personalmente del resguardo del Certificado Electrónico que sea emitido a nombre de su representada o poderdante, así como expresar claramente los alcances del poder otorgado; y

III. Se podrán definir en estos certificados las restricciones adicionales establecidas a las facultades del representante, que deberán asentarse explícitamente en el texto del certificado.

ARTÍCULO 28.-

Los Certificados Electrónicos dejarán de surtir efectos en los siguientes casos:

I. Expiración de vigencia del certificado el cual no podrá ser superior a 6 años; contados a partir de la fecha en que se hubiese expedido. Tratándose de servidores públicos no podrá ser superior a la duración de su encargo. Antes que concluya el periodo de vigencia podrá el firmante renovarlo ante el Prestador de Servicios de Certificación;

II. Cancelación por el Prestador de Servicios de Certificación, a solicitud del firmante o por la persona física o moral representada por este o por un tercero autorizado; (REFORMADO POR DECRETO Nº 59, PUBLICADO EN EL P.O.E. DEL 20 DE FEBRERO DE 2017)

III. Por la pérdida o inutilización por daños del dispositivo que contenga dicho certificado;

IV. Por haberse comprobado que al momento de su expedición, el certificado no cumplió con los requisitos en la Ley, situación que no afectará los derechos de terceros de buena fe;

V. Alterarse el mecanismo de soporte del Certificado Electrónico o violarse el secreto de los datos de creación de firma;

VI. Extravío o robo del certificado, daño o falla irrecuperable del mecanismo de soporte del certificado;

VII. Fallecimiento del firmante o interdicción judicialmente declarada;

VIII. Falsedad o inexactitud de los datos proporcionados por el firmante al momento de la obtención del Certificado Electrónico;

IX. Terminación de actividades del Prestador de Servicios de Certificación, autorizada o comprobada por la unidad de firma electrónica correspondiente, cuando la Administración de dicho certificado no haya sido transferida a otro Prestador de Servicios de Certificación, en cuyo caso se deberá notificar al titular del certificado y en su caso recabar la autorización del firmante; y (REFORMADO POR DECRETO Nº 59, PUBLICADO EN EL P.O.E. DEL 20 DE FEBRERO DE 2017)

X. Por resolución judicial o de autoridad competente que lo ordene.

ARTÍCULO 29.-

Tan pronto como se haga del conocimiento del Prestador de Servicios de Certificación alguna de las causales de cesación de los efectos de un Certificado Electrónico este deberá actualizar de manera inmediata el servicio de consulta y autentificación de certificados por él expedidos para reflejar el estado de expiración del certificado. En dicho caso dará aviso inmediato al titular o al representante legal acerca de la fecha y hora de expiración o suspensión temporal de la vigencia del Certificado Electrónico.

ARTÍCULO 30.-

Los certificados podrán ser temporalmente suspendidos a solicitud del firmante.

ARTÍCULO 31.-

Tendrán plena validez, en términos de lo dispuesto por la Ley los Certificados Electrónicos que cumplan cualquiera de las siguientes condiciones:

I. Que hayan sido expedidos por un Prestador de Servicios de Certificación registrado por la Unidad de Firma Electrónica;

II. Que fueron emitidos por un Prestador de Servicios de Certificación reconocido por el Gobierno Federal o por los Gobiernos de las Entidades Federativas; y

III. Que sean emitidos por autoridades Certificadoras de otros países siempre que se encuentren vigentes y hubiesen sido generados de acuerdo a su marco legal.

ARTÍCULO 32.-

El dispositivo seguro de creación de firma deberá proporcionar las siguientes condiciones:

I. Que los contenidos que integran y distinguen el carácter específico del documento son únicos, pues se pueden originar una sola vez, resguardando de esta manera la integridad del documento o mensaje de datos;

II. Que asegure que los datos de creación de firma no pueden ser generados a partir de los datos de verificación de la firma y que la firma en sí misma no puede ser falsificada de acuerdo a la tecnología disponible;

III. Que garantice que el documento electrónicamente firmado es Único, Inalterable, Infalsificable y mantiene su integridad una vez estampada la firma creada sobre el contenido;

IV. Que los datos de generación puedan ser resguardados de manera segura por el titular y no puedan quedar al alcance de terceros; y

V. Que no modifica el contenido del documento firmado. (REFORMADO EL PRIMERO PÁRRAFO DE ESTE ARTÍCULO POR DECRETO Nº 59, PUBLICADO POR EL P.O.E. DEL 20 DE FEBRERO DE 2017)

CAPÍTULO V.- DE LA PRESTACIÓN DE SERVICIOS DE CERTIFICACIÓN

ARTÍCULO 33.-

El Prestador de Servicios de Certificación deberá cumplir los siguientes requisitos:

I. Demostrar que cuenta con la infraestructura tecnológica requerida para la emisión, distribución, gestión y resguardo de los Certificados Electrónicos;

II. Contar con los medios técnicos idóneos para determinar con exactitud la hora y fecha en que se expida, suspenda o revoque definitivamente un certificado y faciliten la consulta pública sobre su vigencia;

III. Contar con una infraestructura tecnológica segura que evite riesgos a la seguridad de los dispositivos de creación y verificación de Firma Electrónica y los Directorios de Autentificación de los Certificados Electrónicos, así como que garanticen la estricta confidencialidad de la información personal y de todo tipo que conserve sobre las personas físicas y morales que hagan uso de los servicios de Certificación Electrónica;

IV. Contar con personal técnico calificado con conocimiento y experiencia en la infraestructura tecnológica que fundamente el servicio;

V. Contar con procedimientos administrativos y de seguridad que garanticen la confidencialidad en el tratamiento de la información de los solicitantes y la seguridad física del recinto en que materialmente se establezca la infraestructura tecnológica del servicio; y

VI. Conservar la información relacionada a los datos de creación y verificación de firmas al menos por 15 años.

ARTÍCULO 34.-

Podrán también prestar el servicio de Expedición de Certificados de Firma Electrónica, previa acreditación ante la Unidad de Firma Electrónica:

a) La propia Unidad de Firma Electrónica del Gobierno del Estado de Aguascalientes;

b) Las instituciones públicas conforme a las Leyes que le son aplicables;

c) Los Notarios Públicos y Corredores Públicos; y

d) Las personas morales de carácter privado que contengan esa función dentro de su objeto social en el Acta Constitutiva. (REFORMADO ESTE INCISO POR DECRETO Nº 59, PUBLICADO EN EL P.O.E. DEL 20 DE FEBRERO DE 2017)

ARTÍCULO 35.-

Son obligaciones de los Prestadores de Servicios de Certificación que hubieren expedido Certificados Electrónicos las siguientes:

I. No almacenar ni copiar los datos de creación de firma de la persona a la que se expida el certificado;

II. Poner a disposición del solicitante de un certificado, información gratuita por medio electrónico o escrito relativa a las obligaciones del titular, los procedimientos de resguardo de los datos de creación de la firma y los pasos a seguir para avisar al Prestador de Servicios de Certificación sobre la pérdida o utilización indebida de estos, los requisitos para verificar la identidad del titular y la autenticidad del resto de los datos que se muestren en el certificado, los medios de preservación de la seguridad de los datos del certificado, instrucciones detalladas de utilización del certificado, los métodos de resolución de conflictos que pudieran presentarse por la prestación de los Servicios de Certificación y el procedimiento de garantía de responsabilidad patrimonial con que cuente;

III. Poner a disposición de la autoridad judicial o del Ministerio Público en ejercicio de funciones, la información que le requiera formalmente sobre la identidad del titular de un Certificado Electrónico, los detalles de uso del certificado y cualquier otra información que se encuentre en su poder;

IV. Actualizar continuamente el Directorio de Certificados Electrónicos expedidos detallando si están vigentes, suspendidos temporalmente o revocados así como asegurar la disponibilidad de un servicio de consulta de la vigencia de los certificados rápido y de acceso permanente;

V. Resguardar de manera segura la integridad y confidencialidad de la información del Directorio de Certificados;

VI. Colocar a disposición del público en general su declaración de prácticas de certificación detallando dentro de lo dispuesto por la presente Ley sus obligaciones en materia de administración de la infraestructura de creación y verificación de Firma Electrónica, los procedimientos de solicitud, expedición, utilización, suspensión y revocación de vigencia de los certificados, las características de la infraestructura de seguridad tecnológica y organizacional;

VII. Disponer de medios seguros de resguardo de la confiabilidad de la Firma Electrónica a largo plazo; y

VIII. Dar constancia de la autenticidad de las Firmas Electrónicas de un documento al ser requerido por Juez o Agente del Ministerio Público.

ARTÍCULO 36.-

Si un Prestador de Servicios de Certificación deja de proporcionar servicios tendrá las siguientes obligaciones:

I. Hacer del conocimiento del Ente Público con al menos 120 días de antelación, y con 90 días de anticipación a todos los titulares de Certificados Electrónicos con validez jurídica que hayan sido expedidos por el Prestador de Servicios, avisando si pretende trasladar la Administración de sus Certificados Electrónicos a otro Prestador de Servicios;

II. Si recaba el consentimiento expreso del titular del certificado podrá transferir la Administración de los Servicios de Autentificación de los Certificados a otro Prestador de Servicios de Certificación;

III. De no ser transferida la Administración del Certificado a otro Prestador de Servicios la vigencia del certificado deberá expirar; y

IV. Obtener la autorización previa de los titulares de los Certificados Electrónicos y, en su caso, de las personas morales para la transferencia de la Administración de los Certificados de Validez Jurídica.

ARTÍCULO 37.-

El Prestador de Servicios de Certificación será responsable de:

I. Los daños y perjuicios ocasionados en la prestación de servicios a cualquier persona derivados del incumplimiento de las disposiciones establecidas por esta Ley; y

II. De los daños y perjuicios causados al titular o a terceros derivados de la actuación de las personas que asigne para prestar los servicios de identificación de titulares, revisión de documentos, expedición de Certificados Electrónicos, resguardo de los sistemas y de cualquier otra actividad relacionada con la prestación de su servicio al público.

ARTÍCULO 38.-

El Prestador de Servicios de Certificación no será responsable de los daños y perjuicios ocasionados al titular o a un tercero por:

I. Descuido o negligencia por parte del titular en el resguardo de los datos de creación de firma o la pérdida de su confidencialidad;

II. Cuando el titular no avise sin demora el cambio de información relevante contenido en el certificado;

III. Quebrantamiento de las limitaciones establecidas al uso del certificado al momento de su expedición;

IV. Inexactitud o falseamiento de la información entregada al Prestador del Servicio para la generación del certificado;

V. Utilización extemporánea del certificado habiendo este expirado o encontrarse en un estado de suspensión temporal;

VI. Demora en la solicitud de suspensión o revocación del certificado cuando se tenga en duda la confidencialidad del medio de creación de la firma;

VII. Cuando puedan ser atribuidos a la negligencia del receptor de la firma, por transgredir las restricciones establecidas respecto de su uso, cuando no tome en cuenta el estado de suspensión temporal o revocación definitiva; y

VIII. Cuando la inexactitud de los datos consignados, hubiesen sido obtenidos por un documento oficial o expedidos por Fedatario Público.

ARTÍCULO 39.-

La Unidad de Firma Electrónica podrá verificar en todo tiempo que los Prestadores de Servicios registrados cumplan con los requisitos y obligaciones previstos en esta Ley y demás disposiciones aplicables.

T R A N S I T O R I O S:

ARTÍCULO PRIMERO.-

La presente Ley entrará en vigencia al día siguiente de su publicación en el Periódico Oficial del Estado.

ARTÍCULO SEGUNDO.-

A más tardar en 90 días posteriores a la entrada en vigencia de la presente Ley, los Entes obligados deberán iniciar la actualización de las disposiciones Reglamentarias o Administrativas necesarias para dar cumplimiento a la presente Ley.

ARTÍCULO TERCERO.-

El Poder Ejecutivo habilitará y adscribirá a la dependencia que considere conveniente la Unidad de Firma Electrónica a que se refiere el Artículo 2º, Fracción XVI de esta Ley, en un plazo no mayor a 60 días posteriores a la entrada en vigencia de la presente Ley.

Al Ejecutivo para su promulgación y publicación.

Dado en el Salón de Sesiones “Soberana Convención Revolucionaria de Aguascalientes”, a los veinticinco días del mes de julio del año dos mil trece.

Lo que tenemos el honor de comunicar a Usted, para los efectos constitucionales conducentes

Aguascalientes, Ags., a 25 de julio del año 2013.

SUFRAGIO EFECTIVO. NO REELECCIÓN. LA MESA DIRECTIVA:

Dip. Mario Antonio Guevara Palomino, PRESIDENTE.

Dip. Miriam Dennis Ibarra Rangel, PRIMERA SECRETARIA.

Dip. Kendor Gregorio Macías Martínez, SEGUNDO SECRETARIO.

En cumplimiento de lo dispuesto por la fracción I del Artículo 46 de la Constitución Política del Estado de Aguascalientes y para su debida publicación y observancia, promulgo el presente Decreto en la Residencia del Poder Ejecutivo del Estado, en la Ciudad de Aguascalientes, Ags., a 20 de septiembre de 2013.-

Carlos Lozano de la Torre.

El Jefe de Gabinete, Antonio Javier Aguilera García

P.O.E. 20 DE FEBRERO DE 2017.

DECRETO NÚMERO 59.

ARTICULO UNICO.-

SE REFORMAN LOS ARTICULOS 17, 18, 19 Y 20; EL INCISO G) Y SEGUNDO PARRAFO DEL ARTICULO 22; LAS FRACCIONES II Y IX DEL ARTICULO 28; EL PRIMER PARRAFO DEL ARTICULO 32; Y EL INCISO D) DEL ARTICULO 34.

ASIMISMO SE ADICIONAN LAS FRACCIONES I, XII Y XV AL ARTICULO 2°, RECORRIENDOSE RESPECTIVAMENTE LA NUMERACION DE LAS SUBSECUENTES; UN SEGUNDO Y TERCER PARRAFOS AL ARTICULO 3°; Y LOS INCISOS H) E I) AL ARTICULO 22 DE LA LEY SOBRE EL USO DE MEDIOS ELECTRONICOS PARA EL ESTADO DE AGUASCALIENTES.

T R A N S I T O R I O

ARTICULO PRIMERO.-

El presente decreto iniciara su vigencia a partir del día siguiente de su publicación en el Periódico Oficial del estado de Aguascalientes.

Author: José Cuervo

ISSN 1989-5852 Título clave: Revista informática jurídica Tít. abreviado: Rev. inform. jurid.

Introducción

Batista Avila, Yordan

Casí Ladrón de Guevara, Yosvanys

Castro Dieguez, Fidel Enrique

Equipo de formación Áudea

Fernández, Plácida

Figueredo Leon, Angel Enrique

Fonseca Hernández, Juan Antonio

Fornaris Montero, Danilo

García Pérez, Celia Maliuska

González Mojena, Yanetsys

Hechavarría Derronselet, Yoendris

Márquez Delgado, José Eduardo

Martínez Álvarez, Manuel Jacinto

Medel Viltres, Yamira

Medela, Marina

Moratilla, José Carlos

Palacio Ramírez, Luis Alberto

Plá Hernández, Omar

Reinaldo Filho, Demócrito

Rodríguez Ramírez, María Isabel

Saavedra, Fernando

Sala Simón, Iker

Vázquez Riverón, Arelys

Verdecia Jiménez, Liusvani Victor

Zato, Cristina

MÁSTER UNIVERSITARIOS

Coffee Break

Almoço

Coffee Break

ISSN 1989-5852 Título clave: Revista informática jurídica Tít. abreviado: Rev. inform. jurid.

Introducción

Avila Aguilera, Yadira de la Caridad

Batista Avila, Yordan

Fonseca Hernández, Juan Antonio

Guerra Cantero, Lisbert Milagros

Incencio Piñeiro, Grettel Susel

León Fonseca, Marcos Antonio

López Tamayo, Pedro Ángel

Martínez, Antonio

Martínez Pérez, Elena

Medela, Marina

Moratilla, José Carlos

Muñiz Maldonado, Noralys

Reinaldo Filho, Demócrito

Rodrigo, Borja

Ron Zambrano, Marlon

Saavedra, Fernando

Vásconez Silva, Daniel

Vázquez Riverón, Arelys

Zato, Cristina

ISSN 1989-5852
Título clave: Revista informática jurídica
Tít. abreviado: Rev. inform. jurid.

ISSN 1989-5852
Título clave: Revista informática jurídica
Tít. abreviado: Rev. inform. jurid.