LQPD, the Andorran Data Protection Agency, its powers, infractions and sanctions

Article 46 establishes the Andorran Data Protection Agency (APDA), created in 2003, as an independent public-law institution with its own legal personality, acting with full independence from Andorra's public administrations. Article 50bis places the Agency under a Head, designated by the Consell General by a two-thirds qualified majority, who exercises the Agency's legal and institutional representation independently and neutrally.

Article 61 gives a data subject the right to lodge a complaint with the Agency electronically or in person, and lets a representative body, organisation or non-profit association active in data-subject-rights protection lodge the complaint and pursue judicial remedies on the data subject's behalf.

Articles 62 and 63 give the Agency investigatory powers to demand information, conduct data-protection audits, access a controller's or processor's premises, equipment and processing means, and notify suspected infringements.

Article 65 splits the sanctioning procedure into an investigative phase run by the Agency's inspectors and a sanctioning phase decided by the Head of the Agency, and Article 69 requires the Head to notify the competent court and suspend the administrative procedure if signs of criminal conduct emerge during it.

Article 67 gives the Agency corrective powers, including a warning, a reprimand, an order to comply with a data subject's rights request, an order bringing processing into compliance, a temporary or definitive limitation or ban on processing, and an order suspending data flows to a third country or international organisation, cumulative with an administrative fine under Article 68.

Article 68 sets the criteria for an administrative fine, including the nature, gravity and duration of the infringement, intent or negligence, mitigating measures taken, the degree of cooperation with the Agency, and prior infringements, and caps the total fine for several infringements from the same conduct at the amount set for the most serious infringement.

Article 70 sets the limitation period for infringements at three years for very serious infringements, two years for serious infringements, and one year for minor infringements.

Article 71 gives any person who has suffered material or non-material damage from an infringement of this law the right to compensation from the controller or processor, holds every controller or processor involved in the same processing jointly and severally liable, and excuses one that proves it bears no responsibility for the damage.

Article 72 classifies infringements as very serious, serious or minor, with a very serious infringement including processing without a lawful basis, processing prohibited special categories of data without an Article 9 exception, and deliberately reversing an anonymisation process to re-identify a data subject.

Article 73 sanctions a very serious infringement with a fine of thirty thousand and one to one hundred thousand euros, a serious infringement with fifteen thousand and one to thirty thousand euros, and a minor infringement with five hundred to fifteen thousand euros, with no separate turnover-based tier. Article 74 limits the sanction against Andorra's general administration, the comuns, the Consell General, the judiciary and other listed public bodies to a reprimand rather than a fine.