PROTECTING PERSONAL DATA AS AN ADMINISTRATIVE OBLIGATION IN A DIGITAL ENVIRONMENT

PROTECTING PERSONAL DATA AS AN ADMINISTRATIVE OBLIGATION IN A DIGITAL ENVIRONMENT PROTECTING PERSONAL DATA AS AN ADMINISTRATIVE OBLIGATION IN A DIGITAL ENVIRONMENT  Imene Ouahrani University of Abu Bakr Belkaid - Tlemcen (Algeria) [email protected] Received: 15- 06- 2026 Accepted: 15- 08- 2026 Published: 22- 09- 2026 Abstract: The protection of personal data has become a fundamental administrative obligation in the digital age, driven by the expansion of information and communication technologies and e-government services. Public administrations collect and process significant amounts of personal information, requiring effective safeguards against unauthorized access, disclosure, and cyber threats. This obligation is grounded in the protection of privacy and adherence to principles such as legality, transparency, purpose limitation, and data minimization. In Algeria, legislative reforms have reinforced personal data protection, seeking to balance digital transformation with the preservation of fundamental rights and freedoms while enhancing public trust in digital administration. Keywords: Privacy Rights; Law No. 25-11.

Technological advancements and the digital transformation of public administration have led to an increasing reliance on electronic means for collecting, processing, and storing data, making personal data one of the most critical resources on which modern administration relies to carry out its functions. However, this development has been accompanied by an increase in privacy-related risks, such as cyberattacks, unauthorized data leaks, and the misuse of personal information.  Corresponding author

PROTECTING PERSONAL DATA AS AN ADMINISTRATIVE OBLIGATION IN A DIGITAL ENVIRONMENT Consequently, the protection of personal data has become an administrative obligation requiring the administration to take the legal, regulatory, and technical measures necessary to ensure that individuals’ rights are respected in an evolving digital environment. This leads us to the following question: To what extent has management succeeded in fulfilling its commitment to data protection in the context of digital transformation? Objectives of the Study: This study aims to define the legal framework for the protection of personal data in the digital environment by analyzing the relevant legal texts, assessing the effectiveness of such protection, and proposing ways to improve it. Methodology: A descriptive-analytical approach was adopted, involving the presentation and analysis of national legal texts, supplemented by a comparative approach where appropriate. To further explore this topic, we have decided to divide our study into two main sections: the definition of personal data under Algerian law (Section 1), and (Section 2), which addresses the administrative obligations regarding the protection of personal data. THE FIRST TOPIC: DEFINITION OF PERSONAL DATA UNDER ALGERIAN LAW In the age of digitalization and the increasing use of information and communication technology, personal data has become a valuable resource used in many fields, such as management, healthcare, commerce, education, security, and others. Given this widespread use, there is a clear need for a legal and regulatory framework that ensures the protection of privacy and governs how such data is collected and processed. FIRST REQUIREMENT: DEFINITION OF PERSONAL DATA First and foremost, the Algerian legislature has enshrined legal protection for individuals’ privacy in several laws, including: Firstly: The 2020 Constitution: In this context, Article 47 of the Constitution1 was explicitly established to protect individuals when their personal data is processed, recognizing this as a fundamental constitutional right no less important than other public rights and freedoms, thereby reflecting the Algerian state’s commitment to protecting the privacy of its citizens. Secondly: Decree No. 75-58, which incorporates the Civil Code2, provides in Article 48 as follows: "Any person who has suffered an unlawful infringement of a right inherent to his or her person may seek an injunction to stop such infringement and compensation for any damage suffered". Thirdly: The legislature has also criminalized any infringement of personal data in the Penal Code under Articles 394 bis through 394 bis 73. However, these general provisions cannot cover breaches involving automatically processed personal data, particularly in light of technological advances. Although telecommunications were regulated in 2000 under Law No. 2000-03, the law did not address automatically processed personal data4. For its part, Law No. 09-04 on specific rules for the prevention and combating of crimes related to information and communication technology5, defines information data as “any presentation of facts, information, or concepts in a form suitable for processing within an information system, including the appropriate software that enables the information system to perform its function.” It specifies the crimes applicable to such data without addressing automatically processed personal data or criminalizing attacks against it.

PROTECTING PERSONAL DATA AS AN ADMINISTRATIVE OBLIGATION IN A DIGITAL ENVIRONMENT The same applies to Law No. 18-046, which establishes rules governing postal and electronic communications and repealed Law No. 2000-03; it did not define “personal data,” but merely required that the privacy of subscribers and their personal data be protected in service provision regulations. Law No. 18-07 of June 10, 20187, is considered the first law in Algeria dedicated to the protection of natural persons with regard to the processing of personal data; therefore, it pays particular attention to defining the concepts and terminology it contains. It should be noted that the aforementioned law was amended by Law No. 25-11 dated July 24, 2025. Article 2 defines personal data as follows: " Personal data means any information, regardless of its medium, relating to an identified or identifiable natural person; the data subject is referred to below as the person concerned, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her physical, physiological, genetic, biometric, psychological, economic, social, or cultural identity ". We therefore conclude that the Algerian legislature has based its definition of personal data on several fixed and variable characteristics of an individual that distinguish him or her from others8, with the aim of protecting individuals from any infringement of their privacy and the rights inherent to their personality in cyberspace. This definition was inspired by comparative legal texts, such as French legislation9. SECOND REQUIREMENT: TYPES OF PERSONAL DATA Personal data is typically classified into several specific categories in the field of data protection, the most important of which are: Firstly: General Personal Information: Including first and last name, mailing address and email address, personal photos, marital status, resume, date of birth, phone number, Social Security number, national ID number, passwords, and bank account information. Secondly: Sensitive Personal Data: This refers to data whose disclosure could lead to discrimination, and includes the following:

PROTECTING PERSONAL DATA AS AN ADMINISTRATIVE OBLIGATION IN A DIGITAL ENVIRONMENT THE SECOND TOPIC: ADMINISTRATIVE COMMITMENT TO THE PROTECTION OF PERSONAL DATA In the course of going about their daily business, individuals come into contact with and interact with various government agencies, which retain certain information in exchange for the services they provide. FIRST REQUIREMENT: MANIFESTATIONS OF ADMINISTRATIVE COMMITMENT TO THE PROTECTION OF PERSONAL DATA The protection of personal data is no longer merely an option; it has become an administrative obligation that reflects the requirements of the rule of law and strengthens trust between the government and citizens in the digital environment. We summarize the manifestations of this administrative obligation as follows: Firstly: The legal obligation to comply with the laws governing data collection and processing. Secondly: Informing citizens about how their data is collected and the purpose for which it is used. Thirdly: The administration processes data by collecting, recording, storing, matching, encrypting, deleting, or destroying it. This process is carried out by natural persons, public or private legal entities, or through service providers. Fourthly: Prior oversight exercised by the National Authority for the Protection of Personal Data: The establishment of the National Authority for the Protection of Personal Data is a concrete implementation of Article 47 of the 2020 Constitution, with the aim of striking a balance between the requirements of public order and security on the one hand, and the rights and freedoms of individuals on the other12. It is an independent administrative authority with legal personality and financial and administrative autonomy13. Among the functions of the National Authority, as set forth in Article 25 of Law No. 18- 07, as amended and supplemented: Article 25 of Law No. 18-07, as amended and supplemented:

PROTECTING PERSONAL DATA AS AN ADMINISTRATIVE OBLIGATION IN A DIGITAL ENVIRONMENT 11- Imposing administrative sanctions ranging from warnings, reprimands, temporary or permanent revocation of the permit or license, and fines in the event that the data controller violates the procedures established by law14. 12- Establishing standards in the field of personal data protection.

PROTECTING PERSONAL DATA AS AN ADMINISTRATIVE OBLIGATION IN A DIGITAL ENVIRONMENT It should be noted that the penalty is linked to the act itself—that is, the processing or the order to process— and therefore, modifying the data by inserting new data in place of the previous data without notifying the National Data Protection Authority is also considered conduct punishable under the same framework set forth in Article 56 referred to above; however, the process of deleting data does not fall within the scope of the penalty provided for in Article

PROTECTING PERSONAL DATA AS AN ADMINISTRATIVE OBLIGATION IN A DIGITAL ENVIRONMENT  Accelerating Algeria’s accession to Convention No. 108 on the Protection of Individuals with regard to Automatic Processing of Personal Data, adopted by the Council of Europe in 1981. Margins:

PROTECTING PERSONAL DATA AS AN ADMINISTRATIVE OBLIGATION IN A DIGITAL ENVIRONMENT One (1) representative from the Minister of Foreign Affairs One (1) representative from the Minister in charge of the Interior One (1) representative from the Minister of Justice and Keeper of the Seals One (1) representative from the Minister in charge of Postal Services, Telecommunications, Technologies, and Digitalization One (1) representative from the Minister in charge of Health One (1) representative from the Minister of Labor, Employment, and Social Security

PROTECTING PERSONAL DATA AS AN ADMINISTRATIVE OBLIGATION IN A DIGITAL ENVIRONMENT 10. Presidential Decree No. 26-07, establishing a structure responsible for information system security and data protection in public institutions, administrations and agencies, Official Gazette No. 04, Algeria, 18 January 2026. Journal Articles 11. Nouara Hamlil, “Protection of Personal Data in the Context of E-Government,” Journal of Law and Political Science, Faculty of Law and Political Science, University of Tizi Ouzou, Vol. 15, No. 2, Algeria, 2020, p. 34. 12. Abdelhadi Ben Zita, “The Need to Establish an Independent Administrative Authority as a Mechanism for the Legal Protection of Personal Data in the Face of the Use of Information Technology,” Al-Haqiqa Journal, Ahmed Draia University, Adrar, Vol. 39, 2016, p. 72. 13. Azzedine Tebache, “Criminal Protection of Personal Data in Algerian Legislation: A Study in Light of Law No. 18-07 on the Protection of Natural Persons with Regard to the Processing of Personal Data,” Academic Journal of the Researcher, Vol. 02, 2018, p. 40. 14. Abdelhadi Kahlaoui, Abdelhadi Ben Zita, “Mechanisms for the Protection of Personal Data Under Law No. 18-07 on the Protection of Natural Persons with Regard to the Processing of Personal Data,” Journal of Law and Political Science, Vol. 7, No. 2, 2021, p. 125. Theses / Dissertations 15. Safia Bachtan, Legal Protection of Privacy: A Comparative Study, Ph.D. Thesis, Faculty of Law and Political Science, Mouloud Mammeri University of Tizi Ouzou, Algeria, 2012, p. 233.