Nascleanúint
RGCS (GDPR) > Airteagal 5. Prionsabail a bhaineann le próiseáil sonraí pearsanta
Íoslódáil PDF

Airteagal 5 RGCS (GDPR). Prionsabail a bhaineann le próiseáil sonraí pearsanta

Article 5 GDPR. Principles relating to processing of personal data

1. Maidir le sonraí pearsanta:

1. Personal data shall be:

(a) déanfar iad a phróiseáil ar bhealach atá dleathach, cothrom agus trédhearcach i ndáil leis an ábhair sonraí (“dlíthiúlacht, cothroime agus trédhearcacht”);

(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);

Tráchtaireacht
ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to article 5(1)(a) GDPR:

7.2.2 Identify lawful basis

Control

The organization should determine, document and comply with the relevant lawful basis for the processing of PII for the identified purposes.

Implementation guidance

Some jurisdictions require the organization to be able to demonstrate that the lawfulness of processing was duly established before the processing.

(EN) […]


to read the full text

Dlí Treoirlínte & Cásanna Recitals

(39) Ba cheart aon phróiseáil a dhéantar ar shonraí pearsanta a bheith dleathach agus cothrom. Ba cheart é a bheith trédhearcach do dhaoine nádúrtha go ndéantar sonraí pearsanta a bhaineann leo a bhailiú, a úsáid, a cheadú nó go ndéantar iad a phróiseáil ar bhealach eile agus a mhéid a dhéantar na sonraí a phróiseáil nó a dhéanfar iad a phróiseáil. Ceanglaítear le prionsabal na trédhearcachta go mbeadh sé éasca rochtain a fháil ar aon fhaisnéis agus ar aon chumarsáid a bhaineann le próiseáil na sonraí pearsanta sin agus go mbeadh sé éasca an fhaisnéis sin agus an chumarsáid sin a thuiscint, agus go ndéanfaí teanga shoiléir shimplí a úsáid. Baineann an prionsabal sin, go háirithe, le faisnéis a thugtar do na hábhair sonraí maidir le céannacht an rialaitheora agus le críocha na próiseála agus le faisnéis bhreise chun próiseáil chothrom thrédhearcach a áirithiú i ndáil leis na daoine nádúrtha lena mbaineann agus a gceart dearbhú agus teachtaireacht a fháil i ndáil leis na sonraí pearsanta a bhaineann leo agus atá á bpróiseáil. Ba cheart daoine nádúrtha a chur ar an eolas faoi rioscaí, rialacha, coimircí agus cearta a bhaineann le próiseáil sonraí pearsanta agus faoin mbealach lena gcearta a fheidhmiú i ndáil le próiseáil den sórt sin. Ba cheart, go háirithe, do na críocha sonracha ar chucu a dhéantar sonraí pearsanta a phróiseáil a bheith lánsoiléir agus dlisteanach agus ba cheart iad a chinneadh tráth bhailiú na sonraí pearsanta. Ba cheart na sonraí pearsanta a bheith leordhóthanach, ábhartha agus teoranta don mhéid is gá chun na gcríoch a ndéantar iad a phróiseáil ina leith. Éilítear leis seo, go háirithe, go ndéantar a áirithiú go bhfuil an tréimhse a stóráiltear na sonraí pearsanta lena linn teoranta go dtí íosmhéid dhocht. Níor cheart sonraí pearsanta a phróiseáil ach mura bhféadfaí críoch na próiseála a bhaint amach go réasúnta ar bhealach eile. Chun a áirithiú nach gcoinnítear na sonraí pearsanta níos faide ná mar is gá, ba cheart don rialaitheoir teorainneacha ama a shocrú don léirscriosadh nó chun athbhreithniú tréimhsiúil a dhéanamh. Ba cheart gach beart réasúnta a dhéanamh chun a áirithiú go gceartaítear nó go scriostar sonraí pearsanta míchruinne. Ba cheart sonraí pearsanta a phróiseáil ar bhealach lena n-áirithítear slándáil agus rúndacht iomchuí na sonraí pearsanta, lena n-áirítear chun cosc a chur ar rochtain neamhúdaraithe ar shonraí pearsanta nó ar úsáid neamhúdaraithe sonraí pearsanta agus an trealamh a úsáidtear leis an bpróiseáil a dhéanamh.

(39) Any processing of personal data should be lawful and fair. It should be transparent to natural persons that personal data concerning them are collected, used, consulted or otherwise processed and to what extent the personal data are or will be processed. The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used. That principle concerns, in particular, information to the data subjects on the identity of the controller and the purposes of the processing and further information to ensure fair and transparent processing in respect of the natural persons concerned and their right to obtain confirmation and communication of personal data concerning them which are being processed. Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing. In particular, the specific purposes for which personal data are processed should be explicit and legitimate and determined at the time of the collection of the personal data. The personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed. This requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict minimum. Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means. In order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review. Every reasonable step should be taken to ensure that personal data which are inaccurate are rectified or deleted. Personal data should be processed in a manner that ensures appropriate security and confidentiality of the personal data, including for preventing unauthorised access to or use of personal data and the equipment used for the processing.

Téacsanna gaolmhara

(b) déanfar iad a bhailiú chun críocha sonraithe sainráite dlisteanacha agus ní dhéanfar iad a phróiseáil tuilleadh ar shlí atá ar neamhréir leis na críocha sin; tuilleadh próiseála a dhéantar ar shonraí pearsanta chun críocha cartlannú a dhéanamh ar mhaithe le leas an phobail, chun críocha taighde eolaíoch agus stairiúil nó chun críocha staidrimh, ní mheasfar, i gcomhréir le hAirteagal 89(1), go bhfuil sí ar neamhréir leis na críocha tosaigh (“teorannú de réir cuspóra”);

(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);

Tráchtaireacht
ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraphs to article 5(1)(b) GDPR:

7.2.1 Identify and document purpose

Control

The organization should identify and document the specific purposes for which the PII will be processed.

Implementation guidance

The organization should ensure that PII principals understand the purpose for which their PII is processed. It is the responsibility of the organization to clearly document and communicate this to PII principals.

(EN) […]


to read the full text

Dlí Treoirlínte & Cásanna Téacsanna gaolmhara

(c) beidh siad leormhaith, ábhartha agus teoranta don mhéid is gá maidir leis na críocha dá ndéantar iad a phróiseáil (“íoslaghdú sonraí”);

(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);

Tráchtaireacht
ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraphs to article 5(1)(c) GDPR:

7.4.1 Limit collection

Control

The organization should limit the collection of PII to the minimum that is relevant, proportional and necessary for the identified purposes.

Implementation guidance

The organization should limit the collection of PII to what is adequate, relevant and necessary in relation to the identified purposes. This includes limiting the amount of PII that the organization collects indirectly (e.g. through web logs, system logs, etc.).

Privacy by default implies that, where any optionality in the collection and processing of PII exists, each option should be disabled by default and only enabled by explicit choice of the PII principal.

7.4.4 PII minimization objectives

Control

The organization should define and document data minimization objectives and what mechanisms (such as de-identification) are used to meet those objectives.

(EN) […]


to read the full text

Dlí Treoirlínte & Cásanna Téacsanna gaolmhara

(d) beidh siad cruinn agus, i gcás inar gá, coimeádfar suas le dáta iad; déanfar gach beart réasúnta chun a áirithiú go léirscriostar nó go gceartaítear sonraí pearsanta míchruinne gan mhoill, ag féachaint do na críocha ar chucu a dhéantar iad a phróiseáil (“cruinneas”);

(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);

Tráchtaireacht
ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraphs to article 5(1)(d) GDPR:

7.3.6 Access, correction and/or erasure

Control

The organization should implement policies, procedures and/or mechanisms to meet their obligations to PII principals to access, correct and/or erase their PII.

Implementation guidance

The organization should implement policies, procedures and/or mechanisms for enabling PII principals to obtain access to, correct and erase of their PII, if requested and without undue delay.

(EN) […]


to read the full text

Téacsanna gaolmhara

(e) déanfar iad a choinneáil i bhfoirm nach gceadaítear léi na hábhair sonraí a shainaithint ach go ceann tréimhse nach faide ná mar is gá chun na críocha sin ar chucu a dhéantar na sonraí pearsanta a phróiseáil a bhaint amach; féadfar sonraí pearsanta a stóráil le haghaidh tréimhsí níos faide a mhéid nach ndéanfar na sonraí sin a phróiseáil ach amháin chun críocha cartlannú a dhéanamh ar mhaithe le leas an phobail, chun críocha taighde eolaíoch nó stairiúil nó chun críocha staidrimh i gcomhréir le hAirteagal 89(1) faoi réir chur chun feidhme na mbeart iomchuí teicniúil agus eagraíochtúil a cheanglaítear leis an Rialachán seo d’fhonn cearta agus saoirsí an ábhair sonraí a choimirciú (“teorannú stórála”);

(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);

Tráchtaireacht
ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraphs to article 5(1)(e) GDPR:

7.4.4 PII minimization objectives

Control

The organization should define and document data minimization objectives and what mechanisms (such as de-identification) are used to meet those objectives.

Implementation guidance

Organizations should identify how the specific PII and amount of PII collected and processed is limited relative to the identified purposes.

(EN) […]


to read the full text

Dlí Treoirlínte & Cásanna Téacsanna gaolmhara

(f) déanfar iad a phróiseáil ar chaoi go n-áirithítear slándáil iomchuí na sonraí pearsanta, lena n-áirítear cosaint ar phróiseáil neamhúdaraithe nó neamhdhleathach agus ar chailleadh, scrios nó damáiste de thaisme, agus úsáid á baint as bearta iomchuí teicniúla nó eagraíochtúla (“sláine agus rúndacht”);

(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

Tráchtaireacht
ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27002, section 6.2.1.

Here is the relevant paragraphs to article 5(1)(f) GDPR:

6.3.2.1 Mobile device policy

Implementation guidance

The organization should ensure that the use of mobile devices does not lead to a compromise of PII.

(EN) […]


to read the full text

Dlí Treoirlínte & Cásanna Téacsanna gaolmhara

2. Is é an rialaitheoir a bheidh freagrach as mír 1 a chomhlíonadh, agus beidh sé in ann an comhlíonadh sin a thaispeáint (“cuntasacht”).

2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27002, section 18.1.3.

Here is the relevant paragraphs to article 5(2) GDPR:

6.15.1.3 Protection of records

Implementation guidance

Review of current and historical policies and procedures can be required (e.g. in the cases of customer dispute resolution and investigation by a supervisory authority).

(EN) […]


to read the full text

Dlí Treoirlínte & Cásanna Recitals

(82) Chun comhlíonadh an Rialacháin seo a thaispeáint, ba cheart don rialaitheoir nó don phróiseálaí taifid a choinneáil ar ghníomhaíochtaí próiseála atá faoina chúram. Ba cheart é a bheith d'oibleagáid ar gach rialaitheoir agus próiseálaí comhoibriú leis an údarás maoirseachta agus na taifid sin a chur ar fáil don údarás, arna iarraidh sin dó, le go bhféadfaí é a úsáid chun faireachán a dhéanamh ar na hoibríochtaí próiseála sin.

(82) In order to demonstrate compliance with this Regulation, the controller or processor should maintain records of processing activities under its responsibility. Each controller and processor should be obliged to cooperate with the supervisory authority and make those records, on request, available to it, so that it might serve for monitoring those processing operations.

Téacsanna gaolmhara
Recitals Dlí Treoirlínte & Cásanna Leave a comment
Recitals

(39) Ba cheart aon phróiseáil a dhéantar ar shonraí pearsanta a bheith dleathach agus cothrom. Ba cheart é a bheith trédhearcach do dhaoine nádúrtha go ndéantar sonraí pearsanta a bhaineann leo a bhailiú, a úsáid, a cheadú nó go ndéantar iad a phróiseáil ar bhealach eile agus a mhéid a dhéantar na sonraí a phróiseáil nó a dhéanfar iad a phróiseáil. Ceanglaítear le prionsabal na trédhearcachta go mbeadh sé éasca rochtain a fháil ar aon fhaisnéis agus ar aon chumarsáid a bhaineann le próiseáil na sonraí pearsanta sin agus go mbeadh sé éasca an fhaisnéis sin agus an chumarsáid sin a thuiscint, agus go ndéanfaí teanga shoiléir shimplí a úsáid. Baineann an prionsabal sin, go háirithe, le faisnéis a thugtar do na hábhair sonraí maidir le céannacht an rialaitheora agus le críocha na próiseála agus le faisnéis bhreise chun próiseáil chothrom thrédhearcach a áirithiú i ndáil leis na daoine nádúrtha lena mbaineann agus a gceart dearbhú agus teachtaireacht a fháil i ndáil leis na sonraí pearsanta a bhaineann leo agus atá á bpróiseáil. Ba cheart daoine nádúrtha a chur ar an eolas faoi rioscaí, rialacha, coimircí agus cearta a bhaineann le próiseáil sonraí pearsanta agus faoin mbealach lena gcearta a fheidhmiú i ndáil le próiseáil den sórt sin. Ba cheart, go háirithe, do na críocha sonracha ar chucu a dhéantar sonraí pearsanta a phróiseáil a bheith lánsoiléir agus dlisteanach agus ba cheart iad a chinneadh tráth bhailiú na sonraí pearsanta. Ba cheart na sonraí pearsanta a bheith leordhóthanach, ábhartha agus teoranta don mhéid is gá chun na gcríoch a ndéantar iad a phróiseáil ina leith. Éilítear leis seo, go háirithe, go ndéantar a áirithiú go bhfuil an tréimhse a stóráiltear na sonraí pearsanta lena linn teoranta go dtí íosmhéid dhocht. Níor cheart sonraí pearsanta a phróiseáil ach mura bhféadfaí críoch na próiseála a bhaint amach go réasúnta ar bhealach eile. Chun a áirithiú nach gcoinnítear na sonraí pearsanta níos faide ná mar is gá, ba cheart don rialaitheoir teorainneacha ama a shocrú don léirscriosadh nó chun athbhreithniú tréimhsiúil a dhéanamh. Ba cheart gach beart réasúnta a dhéanamh chun a áirithiú go gceartaítear nó go scriostar sonraí pearsanta míchruinne. Ba cheart sonraí pearsanta a phróiseáil ar bhealach lena n-áirithítear slándáil agus rúndacht iomchuí na sonraí pearsanta, lena n-áirítear chun cosc a chur ar rochtain neamhúdaraithe ar shonraí pearsanta nó ar úsáid neamhúdaraithe sonraí pearsanta agus an trealamh a úsáidtear leis an bpróiseáil a dhéanamh.

(39) Any processing of personal data should be lawful and fair. It should be transparent to natural persons that personal data concerning them are collected, used, consulted or otherwise processed and to what extent the personal data are or will be processed. The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used. That principle concerns, in particular, information to the data subjects on the identity of the controller and the purposes of the processing and further information to ensure fair and transparent processing in respect of the natural persons concerned and their right to obtain confirmation and communication of personal data concerning them which are being processed. Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing. In particular, the specific purposes for which personal data are processed should be explicit and legitimate and determined at the time of the collection of the personal data. The personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed. This requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict minimum. Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means. In order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review. Every reasonable step should be taken to ensure that personal data which are inaccurate are rectified or deleted. Personal data should be processed in a manner that ensures appropriate security and confidentiality of the personal data, including for preventing unauthorised access to or use of personal data and the equipment used for the processing.

Dlí Treoirlínte & Cásanna Leave a comment
[js-disqus]