... 5. 유럽 데이터보호이사회 의장은 제1항에 명시된 결정을 부당한 지체 없이 관련 감독기관에게 통보해야 한다. 집행위원회에도 통보해야 한다. 감독기관이 제6항에 명시된 최종 결정을 통보한 후 이는 지체 없이 유럽 데이터보호이사회 웹사이트에 게재되어야 한다. ...
... 5. The Chair of the Board shall notify, without undue delay, the decision referred to in paragraph 1 to the supervisory authorities concerned. It shall inform the Commission thereof. The decision shall be published on the website of the Board without delay after the supervisory authority has notified the final decision referred to in paragraph 6. ...
... 8. 집행위원회는 적정한 보호 수준이 보장되거나 또는 더 이상 보장되지 않는다고 판단된 제3국, 제3국의 영토와 지정 부문, 및 국제기구 목록을 유럽연합 관보 및 웹사이트에 게재해야 한다. ...
... 8. The Commission shall publish in the Official Journal of the European Union and on its website a list of the third countries, territories and specified sectors within a third country and international organisations for which it has decided that an adequate level of protection is or is no longer ensured. ...
... (58) 투명성의 원칙에 따라 대중 또는 정보주체에 제공되는 정보는 간결하고 이용이 용이하며 이해하기 쉬워야 하고, 명확하고 평이한 언어의 사용에 더해 적절한 경우 시각화 기법을 활용해야 한다. 그 같은 정보는 대중에게 제공될 시 웹사이트를 통해 전자 양식으로 제공될 수 있다. 이는 온라인 광고 등 활동주체(actors)의 확산 및 관행의 기술적 복잡성으로 인해 정보주체가 누가 무슨 목적으로 본인에 관한 개인정보를 수집하는지 여부를 파악하기 어려운 상황과 특히 관련이 있다. 아동에게 특정한 보호수단이 필요하다는 것을 고려할 때 아동을 대상으로 한 (데이터)처리 시 정보제공 및 통지 일체는 해당 아동이 쉽게 이해할 수 있는 명확하고 평이한 언어로 이루어져야 한다. ...
... (58) The principle of transparency requires that any information addressed to the public or to the data subject be concise, easily accessible and easy to understand, and that clear and plain language and, additionally, where appropriate, visualisation be used. Such information could be provided in electronic form, for example, when addressed to the public, through a website. This is of particular relevance in situations where the proliferation of actors and the technological complexity of practice make it difficult for the data subject to know and understand whether, by whom and for what purpose personal data relating to him or her are being collected, such as in the case of online advertising. Given that children merit specific protection, any information and communication, where processing is addressed to a child, should be in such a clear and plain language that the child can easily understand. ...
... (143) 어떠한 개인 또는 법인이라도 유럽연합 기능에 관한 조약(TFEU) 제263조에 규정된 조건에 따라 유럽 데이터보호이사회의 결정을 취소하기 위해 사법재판소에 소송을 제기할 권리를 가진다. 이사회 결정의 수신대상으로서, 결정에 대해 이의를 제기하고자 하는 관련 감독기관들은 유럽연합 기능에 관한 조약(TFEU) 제263조에 따라 통지받은 후 두 달 이내에 소송을 제기하여야 한다. 유럽 데이터보호이사회의 결정이 컨트롤러, 프로세서나 민원인에게 직간접적으로 관련된 사안인 경우, 후자는 유럽연합 기능에 관한 조약(TFEU) 제263조에 따라 유럽 데이터보호이사회의 홈페이지에 게시된 후 두 달 이내에 그 결정의 취소에 대한 소송을 제기할 수 있다. 유럽연합 기능에 관한 조약(TFEU) 제263조에 따른 이 권리를 침해하지 않고, 각 개인이나 법인은 본인에 대해 법적 효력을 발생시킬 감독기관의 결정에 대해 관할국의 법정에서 유효한 사법적 구제를 받아야 한다. 이러한 결정은 특히 감독기관의 조사, 시정 및 인가 권한의 행사 또는 민원의 기각이나 거부와 관련 있다. 그러나 유효한 사법적 구제에 대한 권리에는 감독기관이 발표한 의견이나 제공한 자문 등 법적 구속력이 없는 감독기관의 조치는 포함되지 않는다. 감독기관에 대한 소송 절차는 해당 감독기관이 설립된 회원국의 법정에서 해당 회원국의 절차법에 따라 시행되어야 한다. 해당 법정은 전적인 사법권을 행사해야 하고 여기에는 제기된 논쟁과 관련한 사실 및 법률에 대한 모든 질의사항을 검토하는 사법권도 포함되어야 한다. ...
... (143) Any natural or legal person has the right to bring an action for annulment of decisions of the Board before the Court of Justice under the conditions provided for in Article 263 TFEU. As addressees of such decisions, the supervisory authorities concerned which wish to challenge them have to bring action within two months of being notified of them, in accordance with Article 263 TFEU. Where decisions of the Board are of direct and individual concern to a controller, processor or complainant, the latter may bring an action for annulment against those decisions within two months of their publication on the website of the Board, in accordance with Article 263 TFEU. Without prejudice to this right under Article 263 TFEU, each natural or legal person should have an effective judicial remedy before the competent national court against a decision of a supervisory authority which produces legal effects concerning that person. Such a decision concerns in particular the exercise of investigative, corrective and authorisation powers by the supervisory authority or the dismissal or rejection of complaints. However, the right to an effective judicial remedy does not encompass measures taken by supervisory authorities which are not legally binding, such as opinions issued by or advice provided by the supervisory authority. Proceedings against a supervisory authority should be brought before the courts of the Member State where the supervisory authority is established and should be conducted in accordance with that Member State's procedural law. Those courts should exercise full jurisdiction, which should include jurisdiction to examine all questions of fact and law relevant to the dispute before them. ...
... ...
... Moreover, necessary information should also be provided in the right context, at the appropriate time. Since the controller carries out many processing operations using the data collected on the website, a general privacy policy on the website alone is not sufficient for the controller to meet the requirements of transparency. The controller therefore designs an information flow, presenting the data subject with relevant information within the appropriate contexts using e.g. informational snippets or pop-ups. For example, when asking the data subject to enter personal data, the controller informs the data subject of how the personal data will be processed and why that personal data is necessary for the processing. ...
... 6. 선임 감독기관 또는 경우에 따라 민원을 접수한 감독기관은 제1항에 명시된 결정을 근거로 부당한 지체 없이, 늦어도 유럽 데이터보호이사회가 결정을 게재한 후 1개월 이내에 최종 결정을 채택해야 한다. 선임 감독기관 또는 경우에 따라 민원을 접수한 감독기관은 최종 결정이 컨트롤러나 프로세서 및 정보주체에 각각 고지되는 날짜를 유럽 데이터보호이사회에 통보해야 한다. 관련 감독기관들의 최종 결정은 제60조(7), (8) 및 (9)항의 조건으로 채택되어야 한다. 최종 결정은 제1항에 명시된 결정을 지칭하며, 제5항에 따라 유럽 데이터보호이사회 웹사이트에 제1항의 결정이 게재될 것임을 명시해야 한다. 최종 결정에는 제1항에 명시된 결정이 첨부되어야 한다. ...
... 6. The lead supervisory authority or, as the case may be, the supervisory authority with which the complaint has been lodged shall adopt its final decision on the basis of the decision referred to in paragraph 1 of this Article, without undue delay and at the latest by one month after the Board has notified its decision. The lead supervisory authority or, as the case may be, the supervisory authority with which the complaint has been lodged, shall inform the Board of the date when its final decision is notified respectively to the controller or the processor and to the data subject. The final decision of the supervisory authorities concerned shall be adopted under the terms of Article 60(7), (8) and (9). The final decision shall refer to the decision referred to in paragraph 1 of this Article and shall specify that the decision referred to in that paragraph will be published on the website of the Board in accordance with paragraph 5 of this Article. The final decision shall attach the decision referred to in paragraph 1 of this Article. ...
... ...
... It is however important to recall that Recital 23 confirms that the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, the mention on the website of its e-mail or geographical address, or of its telephone number without an international code, does not, of itself, provide sufficient evidence to demonstrate the controller or processor’s intention to offer goods or a services to a data subject located in the Union. In this context, the EDPB recalls that when goods or services are inadvertently or incidentally provided to a person on the territory of the Union, the related processing of personal data would not fall within the territorial scope of the GDPR. ...
... ...
... 18. [Example 2] A local municipality is planning road maintenance works. As the road works may disrupt traffic for a long time, the municipality offers its citizens the opportunity to subscribe to an email list to receive updates on the progress of the works and on expected delays. The municipality makes clear that there is no obligation to participate and asks for consent to use email addresses for this (exclusive) purpose. Citizens that do not consent will not miss out on any core service of the municipality or the exercise of any right, so they are able to give or refuse their consent to this use of data freely. All information on the road works will also be available on the municipality’s website. ...
... ...
... 96. [Example 17] A data controller may also obtain explicit consent from a visitor to its website by offering an explicit consent screen that contains Yes and No check boxes, provided that the text clearly indicates the consent, for instance “I, hereby, consent to the processing of my data”, and not for instance, “It is clear to me that my data will be processed”. It goes without saying that the conditions for informed consent as well as the other conditions for obtaining valid consent should be met. ...
... ...
... Both Articles 13 and 14 refer to the obligation on the data controller to “provide the data subject with all of the following information…” The operative word here is “provide”. This means that the data controller must take active steps to furnish the information in question to the data subject or to actively direct the data subject to the location of it (e.g. by way of a direct link, use of a QR code, etc.). The data subject must not have to actively search for information covered by these articles amongst other information, such as terms and conditions of use of a website or app. The example at paragraph 11 illustrates this point. As noted above at paragraph 17, WP29 recommends that the entirety of the information addressed to data subjects should also be available to them in one single place or one complete document (e.g. whether in a digital form on a website or in paper format) which can be easily accessed should they wish to consult the entirety of the information. ...