Nascleanúint
RGCS (GDPR) > Airteagal 36. Réamhchomhairliúchán
Íoslódáil PDF

Airteagal 36 RGCS (GDPR). Réamhchomhairliúchán

Article 36 GDPR. Prior consultation

1. Rachaidh an rialaitheoir i gcomhairle leis an údarás maoirseachta sula ndéanfar an phróiseáil i gcás ina léirítear sa mheasúnú tionchair ar chosaint sonraí faoi Airteagal 35 gur dóchúil go mbainfeadh ardriosca leis an bpróiseáil in éagmais bearta a bheadh le glacadh ag an rialaitheoir chun an riosca sin a mhaolú.

1. The controller shall consult the supervisory authority prior to processing where a data protection impact assessment under Article 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk.

Téacsanna gaolmhara

2. I gcás ina measann an t-údarás maoirseachta go sáródh an phróiseáil atá beartaithe agus dá dtagraítear i mír 1 an Rialachán seo, go háirithe i gcás nach sainaithníonn an rialaitheoir an riosca go leordhóthanach nó nach ndéanann sé an riosca a mhaolú go leordhóthanach, cuirfidh an t-údarás maoirseachta comhairle i scríbhinn ar fáil don rialaitheoir, laistigh de thréimhse ocht seachtaine ar a laghad ón iarraidh ar chomhairliúchán a fháil, agus, nuair is infheidhme ar an bpróiseálaí, féadfaidh sé aon cheann de na cumhachtaí atá aige dá dtagraítear in Airteagal 58 a úsáid. Féadfar síneadh sé seachtaine a chur leis an tréimhse sin, agus castacht na próiseála atá beartaithe á cur san áireamh. Cuirfidh an t-údarás maoireseachta an rialaitheoir agus, i gcás inarb infheidhme, an próiseálaí ar an eolas faoi aon síneadh den sórt sin agus faoi na cúiseanna a bhí leis an moill laistigh de mhí amháin ón iarraidh ar chomhairliúchán a fháil. Féadfar na tréimhsí sin a chur ar fionraí go dtí go mbeidh faisnéis a d’iarr an t-údarás maoirseachta chun críocha an chomhairliúcháin faighte aige.

2. Where the supervisory authority is of the opinion that the intended processing referred to in paragraph 1 would infringe this Regulation, in particular where the controller has insufficiently identified or mitigated the risk, the supervisory authority shall, within period of up to eight weeks of receipt of the request for consultation, provide written advice to the controller and, where applicable to the processor, and may use any of its powers referred to in Article 58. That period may be extended by six weeks, taking into account the complexity of the intended processing. The supervisory authority shall inform the controller and, where applicable, the processor, of any such extension within one month of receipt of the request for consultation together with the reasons for the delay. Those periods may be suspended until the supervisory authority has obtained information it has requested for the purposes of the consultation.

3. Nuair a rachaidh sé i gcomhairle leis an údarás maoirseachta de bhun mhír 1, cuirfidh an rialaitheoir an méid a leanas ar fáil don údarás maoirseachta:

3. When consulting the supervisory authority pursuant to paragraph 1, the controller shall provide the supervisory authority with:

(a) nuair is infheidhme, freagrachtaí faoi seach an rialaitheora, na rialaitheoirí comhpháirteacha agus na bpróiseálaithe a dhéanann an phróiseáil, go háirithe le haghaidh próiseáil laistigh de ghrúpa gnólachtaí;

(a) where applicable, the respective responsibilities of the controller, joint controllers and processors involved in the processing, in particular for processing within a group of undertakings;

(b) críocha agus modhanna na próiseála beartaithe;

(b) the purposes and means of the intended processing;

(c) na bearta agus coimircí dá bhforáiltear chun cearta agus saoirsí na n-ábhar sonraí a chosaint de bhun an Rialacháin seo;

(c) the measures and safeguards provided to protect the rights and freedoms of data subjects pursuant to this Regulation;

(d) nuair is infheidhme, sonraí teagmhála an oifigigh cosanta sonraí;

(d) where applicable, the contact details of the data protection officer;

(e) an measúnú tionchair ar chosaint sonraí dá bhforáiltear in Airteagal 35; agus

(e) the data protection impact assessment provided for in Article 35; and

Téacsanna gaolmhara

(f) aon fhaisnéis eile a iarrann an t-údarás maoirseachta.

(f) any other information requested by the supervisory authority.

4. Rachaidh na Ballstáit i gcomhairle leis an údarás maoirseachta agus togra á ullmhú acu le haghaidh bearta reachtacha atá le glacadh ag parlaimint náisiúnta nó le haghaidh beart rialála bunaithe ar bheart reachtach den sórt sin, a bhaineann le próiseáil sonraí pearsanta.

4. Member States shall consult the supervisory authority during the preparation of a proposal for a legislative measure to be adopted by a national parliament, or of a regulatory measure based on such a legislative measure, which relates to processing.

5. D’ainneoin mhír 2, féadfar, le dlí Ballstáit, a cheangal ar na rialaitheoirí dul i gcomhairle leis an údarás maoirseachta, agus údarú a fháil uaidh roimh ré, i dtaobh sonraí pearsanta a phróiseáil ionas go bhféadfadh an rialaitheoir cúram éigin a chur i gcrích ar mhaithe le leas an phobail, lena n-áirítear an phróiseáil i ndáil le coimirce shóisialta agus sláinte phoiblí.

5. Notwithstanding paragraph 1, Member State law may require controllers to consult with, and obtain prior authorisation from, the supervisory authority in relation to processing by a controller for the performance of a task carried out by the controller in the public interest, including processing in relation to social protection and public health.

ISO 27701 Recitals Leave a comment
ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27001, section 4.2.

Here is the relevant paragraph to article 36 GDPR:

5.2.2 Understanding the needs and expectations of interested parties

The organization shall include among its interested parties (see ISO/IEC 27001:2013, 4.2), those parties having interests or responsibilities associated with the processing of PII, including the PII principals.

(EN) […]


to read the full text

Recitals

(94) I gcás ina léirítear le measúnú tionchair ar chosaint sonraí go mbeadh ardriosca do chearta agus do shaoirsí daoine nádúrtha ag gabháil leis an bpróiseáil, in éagmais na gcoimircí, na mbeart slándála agus na sásraí a bheartaítear leis an riosca a mhaolú, agus i gcás ina bhfuil an rialaitheoir den tuairim nach bhféadfaí an riosca a mhaolú ar bhealach réasúnach ó thaobh na dteicneolaíochtaí atá ar fáil agus ó thaobh na gcostas chur chun feidhme, ba cheart dul i gcomhairle leis an údarás maoirseachta sula gcuirfí tús le gníomhaíochtaí próiseála. Is dóigh do dtiocfaidh ardriosca den sórt sin as cineálacha áirithe próiseála sonraí pearsanta agus as méid agus as minicíocht na próiseála, a d'fhéadfadh dochar a dhéanamh freisin do chearta agus do shaoirsí an duine nádúrtha nó a d'fhéadfadh cur as do chearta agus do shaoirsí an duine nádúrtha sin. Ba cheart don údarás maoirseachta freagairt don iarraidh ar chomhairliúchán laistigh de thréimhse shonraithe. Mura mbeidh freagairt ann ón údarás maoirseachta laistigh den tréimhse sin, ba cheart nár dhochar é sin d'aon idirghabháil ón údarás maoirseachta i gcomhréir leis na cúraimí sin atá air agus leis na cumhachtaí sin atá aige a leagtar síos sa Rialachán seo, lena n-áirítear an chumhacht cosc a chur ar oibríochtaí próiseála. Mar chuid den phróiseas comhairliúcháin sin, féadfar an toradh ar mheasúnú tionchair ar chosaint sonraí a dhéantar maidir leis an bpróiseáil a chur faoi bhráid an údaráis mhaoirseachta, go háirithe na bearta atá beartaithe leis an riosca do chearta agus do shaoirsí na ndaoine nádúrtha a mhaolú.

(94) Where a data protection impact assessment indicates that the processing would, in the absence of safeguards, security measures and mechanisms to mitigate the risk, result in a high risk to the rights and freedoms of natural persons and the controller is of the opinion that the risk cannot be mitigated by reasonable means in terms of available technologies and costs of implementation, the supervisory authority should be consulted prior to the start of processing activities. Such high risk is likely to result from certain types of processing and the extent and frequency of processing, which may result also in a realisation of damage or interference with the rights and freedoms of the natural person. The supervisory authority should respond to the request for consultation within a specified period. However, the absence of a reaction of the supervisory authority within that period should be without prejudice to any intervention of the supervisory authority in accordance with its tasks and powers laid down in this Regulation, including the power to prohibit processing operations. As part of that consultation process, the outcome of a data protection impact assessment carried out with regard to the processing at issue may be submitted to the supervisory authority, in particular the measures envisaged to mitigate the risk to the rights and freedoms of natural persons.

(95) Ba cheart don phróiseálaí cuidiú leis an rialaitheoir, más gá agus arna iarraidh sin dó nó di, agus é á áirithiú ag an rialaitheoir go bhfuil na hoibleagáidí a eascraíonn as measúnuithe tionchair ar chosaint sonraí a dhéanamh agus as réamhchomhairliúchán leis an údarás maoirseachta á gcomhlíonadh.

(95) The processor should assist the controller, where necessary and upon request, in ensuring compliance with the obligations deriving from the carrying out of data protection impact assessments and from prior consultation of the supervisory authority.

(96) D'fhonn a áirithiú go bhfuil an phróiseáil a bheartaítear i gcomhréir leis an Rialachán seo agus, go háirithe, chun an riosca atá ann don ábhar sonraí a mhaolú, ba cheart dul i gcomhairle leis an údarás maoirseachta freisin agus beart reachtach nó beart rialála á ullmhú, ar beart é lena bhforáiltear do phróiseáil sonraí pearsanta.

(96) A consultation of the supervisory authority should also take place in the course of the preparation of a legislative or regulatory measure which provides for the processing of personal data, in order to ensure compliance of the intended processing with this Regulation and in particular to mitigate the risk involved for the data subject.

Leave a comment
[js-disqus]