14 straipsnis 📖 BDAR. Informacija, kuri turi būti pateikta, kai asmens duomenys yra gauti ne iš duomenų subjekto

14 straipsnis BDAR. Informacija, kuri turi būti pateikta, kai asmens duomenys yra gauti ne iš duomenų subjekto

Article 14 GDPR. Information to be provided where personal data have not been obtained from the data subject

1. Kai asmens duomenys yra gauti ne iš duomenų subjekto, duomenų valdytojas pateikia duomenų subjektui šią informaciją:

1. Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information:

a) duomenų valdytojo ir duomenų valdytojo atstovo, jei taikoma, tapatybę ir kontaktinius duomenis;

(a) the identity and the contact details of the controller and, where applicable, of the controller’s representative;

b) duomenų apsaugos pareigūno, jei taikoma, kontaktinius duomenis;

(b) the contact details of the data protection officer, where applicable;

c) duomenų tvarkymo tikslus, kuriais ketinama tvarkyti asmens duomenis, taip pat duomenų tvarkymo teisinį pagrindą;

(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;

d) atitinkamų asmens duomenų kategorijas;

(d) the categories of personal data concerned;

e) jei jos yra, asmens duomenų gavėjus arba asmens duomenų gavėjų kategorijas;

(e) the recipients or categories of recipients of the personal data, if any;

f) kai taikoma, apie duomenų valdytojo ketinimą asmens duomenis perduoti gavėjui trečiojoje valstybėje arba tarptautinei organizacijai ir Komisijos sprendimo dėl tinkamumo buvimą ar nebuvimą, o 46 ar 47 straipsniuose arba 49 straipsnio 1 dalies antroje pastraipoje nurodytų perdavimų atveju – tinkamas arba pritaikytas apsaugos priemones ir būdus, kaip gauti jų kopiją arba kur suteikiama galimybė su jais susipažinti.

(f) where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means to obtain a copy of them or where they have been made available.

Jungtys

46 straipsnis BDAR. Duomenų perdavimas taikant tinkamas apsaugos priemones

Article 46 GDPR. Transfers subject to appropriate safeguards

47 straipsnis BDAR. Įmonei privalomos taisyklės

Article 47 GDPR. Binding corporate rules

49 straipsnis BDAR. Nukrypti leidžiančios nuostatos konkrečiais atvejais

Article 49 GDPR. Derogations for specific situations

1. Jeigu nepriimtas sprendimas dėl tinkamumo pagal 45 straipsnio 3 dalį arba nenustatytos tinkamos apsaugos priemonės pagal 46 straipsnį, įskaitant įmonei privalomas taisykles, asmens duomenų perdavimas į trečiąją valstybę arba tarptautinei organizacijai arba tokių perdavimų seka atliekami tik su viena iš šių sąlygų:

1. In the absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions:

[…]

Kai perdavimas negali būti grindžiamas 45 arba 46 straipsnio nuostata, įskaitant nuostatas dėl įmonei privalomų taisyklių, ir netaikoma jokia pirmoje pastraipoje nurodyta konkrečioje situacijoje nukrypti leidžianti nuostata, perdavimas nėra kartojamas, yra susijęs tik su ribotu duomenų subjektų skaičiumi, yra būtinas įtikinamų duomenų valdytojo ginamų teisėtų interesų, kai nėra už juos viršesnių duomenų subjekto interesų ar teisių ir laisvių, tikslais, jeigu duomenų valdytojas yra įvertinęs visas su duomenų perdavimu susijusias aplinkybes ir, remdamasis tuo vertinimu, yra nustatęs tinkamas su asmens duomenų apsauga susijusias apsaugos priemones. Duomenų valdytojas praneša priežiūros institucijai apie duomenų perdavimą. Be 13 ir 14 straipsniuose nurodytos informacijos, duomenų valdytojas praneša duomenų subjektui apie duomenų perdavimą ir apie įtikinamus ginamus teisėtus interesus.

Where a transfer could not be based on a provision in Article 45 or 46, including the provisions on binding corporate rules, and none of the derogations for a specific situation referred to in the first subparagraph of this paragraph is applicable, a transfer to a third country or an international organisation may take place only if the transfer is not repetitive, concerns only a limited number of data subjects, is necessary for the purposes of compelling legitimate interests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject, and the controller has assessed all the circumstances surrounding the data transfer and has on the basis of that assessment provided suitable safeguards with regard to the protection of personal data. The controller shall inform the supervisory authority of the transfer. The controller shall, in addition to providing the information referred to in Articles 13 and 14, inform the data subject of the transfer and on the compelling legitimate interests pursued.

[…]

2. Be 1 dalyje nurodytos informacijos, duomenų valdytojas pateikia duomenų subjektui toliau nurodytą papildomą informaciją, būtiną tvarkymo sąžiningumui ir skaidrumui duomenų subjekto atžvilgiu užtikrinti:

2. In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject:

Jungtys

Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0.

3.1 Transparency [24]

_{[24]Elaboration on how to understand the concept of transparency can be found in Article 29 Working Party. „Guidelines on transparency under Regulation 2016/679“. WP 260 rev.01, 11 April 2018. ec.europa.eu/newsroom/article29/document.cfm?action=display&doc_id=51025 – endorsed by the EDPB}

65. The controller must be clear and open with the data subject about how they will collect, use and share personal data. Transparency is about enabling data subjects to understand, and if necessary, make use of their rights in Articles 15 to 22. The principle is embedded in Articles 12, 13, 14 and 34. Measures and safeguards put in place to support the principle of transparency should also support the implementation of these Articles.

66. Key design and default elements for the principle of transparency may include:

•Clarity – Information shall be in clear and plain language, concise and intelligible.

•Semantics – Communication should have a clear meaning to the audience in question.

•Accessibility – Information shall be easily accessible for the data subject.

•Contextual – Information should be provided at the relevant time and in the appropriate form.

•Relevance – Information should be relevant and applicable to the specific data subject.

•Universal design – Information shall be accessible to all data subjects, include use of machine readable languages to facilitate and automate readability and clarity.

•Comprehensible – Data subjects should have a fair understanding of what they can expect with regards to the processing of their personal data, particularly when the data subjects are children or other vulnerable groups.

• Multi-channel – Information should be provided in different channels and media, not only the textual, to increase the probability for the information to effectively reach the data subject.

• Layered – The information should be layered in a manner that resolves the tension between completeness and understanding, while accounting for data subjects’ reasonable expectations.

a) asmens duomenų saugojimo laikotarpį arba, jei tai neįmanoma, kriterijus, taikomus tam laikotarpiui nustatyti;

(a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to article 14(2)(a) GDPR:

7.4.7 Retention

Control

The organization should not retain PII for longer than is necessary for the purposes for which the PII is processed.

Implementation guidance

The organization should develop and maintain retention schedules for information it retains, taking into account the requirement to retain PII for no longer than is necessary.

…

Prisijungti
norėdami pasiekti visą tekstą

b) kai duomenų tvarkymas atliekamas pagal 6 straipsnio 1 dalies f punktą, teisėtus duomenų valdytojo arba trečiosios šalies interesus;

(b) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;

Jungtys

6 straipsnis BDAR. Tvarkymo teisėtumas

Article 6 GDPR. Lawfulness of processing

1. Duomenų tvarkymas yra teisėtas tik tuo atveju, jeigu taikoma bent viena iš šių sąlygų, ir tik tokiu mastu, kokiu ji yra taikoma:

1. Processing shall be lawful only if and to the extent that at least one of the following applies:

[…]

f) tvarkyti duomenis būtina siekiant teisėtų duomenų valdytojo arba trečiosios šalies interesų, išskyrus atvejus, kai tokie duomenų subjekto interesai arba pagrindinės teisės ir laisvės, dėl kurių būtina užtikrinti asmens duomenų apsaugą, yra už juos viršesni, ypač kai duomenų subjektas yra vaikas.

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

[…]

c) teisę prašyti, kad duomenų valdytojas leistų susipažinti su duomenų subjekto asmens duomenimis ir juos ištaisytų arba ištrintų, arba apribotų duomenų tvarkymą, ir teisę nesutikti, kad duomenys būtų tvarkomi, taip pat teisę į į duomenų perkeliamumą;

(c) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability;

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraphs to article 14(2)(c) GDPR:

7.3.5 Providing mechanism to object to PII processing

Control

The organization should provide a mechanism for PII principals to object to the processing of their PII.

Implementation guidance

Some jurisdictions provide PII principals with a right to object to the processing of their PII.

…

Prisijungti
norėdami pasiekti visą tekstą

d) kai duomenų tvarkymas grindžiamas 6 straipsnio 1 dalies a punktu arba 9 straipsnio 2 dalies a punktu, teisę bet kuriuo metu atšaukti sutikimą, nedarant poveikio sutikimu grindžiamo duomenų tvarkymo iki sutikimo atšaukimo teisėtumui;

(d) where processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

ISO 27701 Jungtys

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to article 14(2)(d) GDPR:

7.3.4 Providing mechanism to modify or withdraw consent

Control

The organization should provide a mechanism for PII principals to modify or withdraw their consent.

Implementation guidance

The organization should inform PII principals of their rights related to withdrawing consent (which may vary by jurisdiction) at any time, and provide the mechanism to do so.

…

Prisijungti
norėdami pasiekti visą tekstą

Jungtys

6 straipsnis BDAR. Tvarkymo teisėtumas

Article 6 GDPR. Lawfulness of processing

1. Duomenų tvarkymas yra teisėtas tik tuo atveju, jeigu taikoma bent viena iš šių sąlygų, ir tik tokiu mastu, kokiu ji yra taikoma:

1. Processing shall be lawful only if and to the extent that at least one of the following applies:

a) duomenų subjektas davė sutikimą, kad jo asmens duomenys būtų tvarkomi vienu ar keliais konkrečiais tikslais;

(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

[…]

9 straipsnis BDAR. Specialių kategorijų asmens duomenų tvarkymas

Article 9 GDPR. Processing of special categories of personal data

1. Draudžiama tvarkyti asmens duomenis, atskleidžiančius rasinę ar etninę kilmę, politines pažiūras, religinius ar filosofinius įsitikinimus ar narystę profesinėse sąjungose, taip pat tvarkyti genetinius duomenis, biometrinius duomenis, siekiant konkrečiai nustatyti fizinio asmens tapatybę, sveikatos duomenis arba duomenis apie fizinio asmens lytinį gyvenimą ir lytinę orientaciją.

1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.

[…]

2. 1 dalis netaikoma, jei taikoma viena iš toliau nurodytų sąlygų:

2. Paragraph 1 shall not apply if one of the following applies:

a) duomenų subjektas aiškiai sutiko, kad tokie asmens duomenys būtų tvarkomi vienu ar keliais nurodytais tikslais, išskyrus atvejus, kai Sąjungos arba valstybės narės teisėje numatyta, kad 1 dalyje nurodyto draudimo duomenų subjektas negali panaikinti;

(a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;

[…]

Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0.

3.2 Lawfulness

67. The controller must identify a valid legal basis for the processing of personal data. Measures and safeguards should support the requirement to make sure that the whole processing lifecycle is in line with the relevant legal grounds of processing.

e) teisę pateikti skundą priežiūros institucijai;

(e) the right to lodge a complaint with a supervisory authority;

f) koks yra asmens duomenų kilmės šaltinis, ir, jei taikoma, ar duomenys gauti iš viešai prieinamų šaltinių;

(f) from which source the personal data originate, and if applicable, whether it came from publicly accessible sources;

g) tai, kad esama 22 straipsnio 1 ir 4 dalyse nurodyto automatizuoto sprendimų priėmimo, įskaitant profiliavimą, ir, bent tais atvejais, prasmingą informaciją apie loginį jo pagrindimą, taip pat tokio duomenų tvarkymo reikšmę ir numatomas pasekmes duomenų subjektui.

(g) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

ISO 27701 Jungtys

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to article 14(2)(g) GDPR:

7.3.10 Automated decision making

Control

The organization should identify and address obligations, including legal obligations, to the PII principals resulting from decisions made by the organization which are related to the PII principal based solely on automated processing of PII.

…

Prisijungti
norėdami pasiekti visą tekstą

Jungtys

22 straipsnis BDAR. Automatizuotas atskirų sprendimų priėmimas, įskaitant profiliavimą

Article 22 GDPR. Automated individual decision-making, including profiling

1. Duomenų subjektas turi teisę, kad jam nebūtų taikomas tik automatizuotu duomenų tvarkymu, įskaitant profiliavimą, grindžiamas sprendimas, dėl kurio jam kyla teisinės pasekmės arba kuris jam panašiu būdu daro didelį poveikį.

1. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

4 straipsnis BDAR. Apibrėžtys

Article 4 GDPR. Definitions

Šiame reglamente:

For the purposes of this Regulation:

[…]

4) profiliavimas – bet kokios formos automatizuotas asmens duomenų tvarkymas, kai asmens duomenys naudojami siekiant įvertinti tam tikrus su fiziniu asmeniu susijusius asmeninius aspektus, visų pirma siekiant išanalizuoti ar numatyti aspektus, susijusius su to fizinio asmens darbo rezultatais, ekonomine situacija, sveikatos būkle, asmeniniais pomėgiais, interesais, patikimumu, elgesiu, buvimo vieta arba judėjimu;

(4) ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

[…]

3. Duomenų valdytojas 1 ir 2 dalyse nurodytą informaciją pateikia:

3. The controller shall provide the information referred to in paragraphs 1 and 2:

a) per pagrįstą laikotarpį nuo asmens duomenų gavimo, bet ne vėliau kaip per vieną mėnesį, atsižvelgiant į konkrečias asmens duomenų tvarkymo aplinkybes;

(a) within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed;

b) jeigu asmens duomenys bus naudojami ryšiams su duomenų subjektu palaikyti – ne vėliau kaip pirmą kartą susisiekiant su tuo duomenų subjektu; arba

(b) if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject; or

c) jeigu numatoma asmens duomenis atskleisti kitam duomenų gavėjui – ne vėliau kaip atskleidžiant duomenis pirmą kartą.

(c) if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed.

4. Kai duomenų valdytojas ketina toliau tvarkyti asmens duomenis kitu tikslu nei tas, kuriuo asmens duomenys buvo gauti, prieš toliau tvarkydamas tuos duomenis duomenų valdytojas pateikia duomenų subjektui informaciją apie tą kitą tikslą ir visą papildomą atitinkamą informaciją, kaip nurodyta 2 dalyje.

4. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were obtained, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2.

5. 1–4 dalys netaikomos, jeigu ir tiek, kiek:

5. Paragraphs 1 to 4 shall not apply where and insofar as:

a) duomenų subjektas jau turi informacijos;

(a) the data subject already has the information;

b) tokios informacijos pateikimas yra neįmanomas arba tam reikėtų neproporcingų pastangų, visų pirma kai duomenys tvarkomi archyvavimo tikslais viešojo intereso labui, mokslinių ar istorinių tyrimų tikslais arba statistiniais tikslais laikantis 89 straipsnio 1 dalyje nurodytų sąlygų ir apsaugos priemonių arba jeigu dėl šio straipsnio 1 dalyje nurodytos pareigos gali tapti neįmanoma arba ji gali labai sukliudyti pasiekti to tvarkymo tikslus. Tokiais atvejais duomenų valdytojas imasi tinkamų priemonių duomenų subjekto teisėms ir laisvėms ir teisėtiems interesams apsaugoti, įskaitant viešą informacijos paskelbimą;

(b) the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available;

Jungtys

89 straipsnis BDAR. Apsaugos priemonės ir nukrypti leidžiančios nuostatos, susijusios su duomenų tvarkymu archyvavimo tikslais viešojo intereso labui, mokslinių ar istorinių tyrimų tikslais arba statistiniais tikslais

Article 89 GDPR. Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

1. Duomenų tvarkymui archyvavimo tikslais viešojo intereso labui, mokslinių ar istorinių tyrimų tikslais arba statistiniais tikslais pagal šį reglamentą taikomos tinkamos duomenų subjekto teisių ir laisvių apsaugos priemonės. Tomis apsaugos priemonėmis užtikrinama, kad būtų įdiegtos techninės ir organizacinės priemonės, visų pirma siekiant užtikrinti, kad būtų laikomasi duomenų kiekio mažinimo principo. Tos priemonės gali apimti pseudonimų suteikimą, jeigu tie tikslai gali būti pasiekti tuo būdu. Visais atvejais, kai tuos tikslus galima pasiekti toliau tvarkant duomenis, iš kurių negalima arba nebegalima nustatyti duomenų subjektų tapatybės, tų tikslų siekiama tuo būdu.

1. Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.

[…]

Article 29 Working Party Guidelines on transparency under Regulation 2016/679

“Proves impossible”

The situation where it “proves impossible” under Article 14.5(b) to provide the information is an all or nothing situation because something is either impossible or it is not; there are no degrees of impossibility. Thus if a data controller seeks to rely on this exemption it must demonstrate the factors that actually prevent it from providing the information in question to data subjects. If, after a certain period of time, the factors that caused the “impossibility” no longer exist and it becomes possible to provide the information to data subjects then the data controller should immediately do so. In practice, there will be very few situations in which a data controller can demonstrate that it is actually impossible to provide the information to data subjects. The following example demonstrates this.

Article 29 Working Party Guidelines on transparency under Regulation 2016/679

“Disproportionate effort”

In determining what may constitute either impossibility or disproportionate effort under Article 14.5(b), it is relevant that there are no comparable exemptions under Article 13 (where personal data is collected from a data subject). The only difference between an Article 13 and an Article 14 situation is that in the latter, the personal data is not collected from the data subject. It therefore follows that impossibility or disproportionate effort typically arises by virtue of circumstances which do not apply if the personal data is collected from the data subject. In other words, the impossibility or disproportionate effort must be directly connected to the fact that the personal data was obtained other than from the data subject.

Guidelines on consent under Regulation 2016/679

Scientific research

153. Recital 33 seems to bring some flexibility to the degree of specification and granularity of consent in the context of scientific research. Recital 33 states: “It is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. Therefore, data subjects should be allowed to give their consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research. Data subjects should have the opportunity to give their consent only to certain areas of research or parts of research projects to the extent allowed by the intended purpose.”

c) duomenų gavimas ar atskleidimas aiškiai nustatytas Sąjungos arba valstybės narės teisėje, ir kurie taikomi duomenų valdytojui ir kuriuose nustatytos tinkamos teisėtų duomenų subjekto interesų apsaugos priemonės; arba

(c) obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject’s legitimate interests; or

Jungtys

Article 29 Working Party Guidelines on transparency under Regulation 2016/679

The factors referred to above in Recital 62 (number of data subjects, the age of the data and any appropriate safeguards adopted) may be indicative of the types of issues that contribute to a data controller having to use disproportionate effort to notify a data subject of the relevant Article 14 information.

Article 14.5(c) allows for a lifting of the information requirements in Articles 14.1, 14.2 and 14.4 insofar as the obtaining or disclosure of personal data “is expressly laid down by Union or Member State law to which the controller is subject”. This exemption is conditional upon the law in question providing “appropriate measures to protect the data subject’s legitimate interests”. Such a law must directly address the data controller and the obtaining or disclosure in question should be mandatory upon the data controller. Accordingly, the data controller must be able to demonstrate how the law in question applies to them and requires them to either obtain or disclose the personal data in question. While it is for Union or Member State law to frame the law such that it provides “appropriate measures to protect the data subject’s legitimate interests”, the data controller should ensure (and be able to demonstrate) that its obtaining or disclosure of personal data complies with those measures. Furthermore, the data controller should make it clear to data subjects that it obtains or discloses personal data in accordance with the law in question, unless there is a legal prohibition preventing the data controller from doing so. This is in line with Recital 41 of the GDPR, which states that a legal basis or legislative measure should be clear and precise, and its application should be foreseeable to persons subject to it, in accordance with the case law of the Court of Justice of the EU and the European Court of Human Rights. However, Article 14.5(c) will not apply where the data controller is under an obligation to obtain data directly from a data subject, in which case Article 13 will apply. In that case, the only exemption under the GDPR exempting the controller from providing the data subject with information on the processing will be that under Article 13.4 (i.e. where and insofar as the data subject already has the information). However, as referred to below at paragraph 68, at a national level, Member States may also legislate, in accordance with Article 23, for further specific restrictions to the right to transparency under Article 12 and to information under Articles 13 and 14.

d) kai asmens duomenys privalo išlikti konfidencialūs laikantis Sąjungos ar valstybės narės teise reglamentuojamos profesinės paslapties prievolės, įskaitant įstatais nustatytą prievolę saugoti paslaptį.

(d) where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy.

Europos Sąjungos Bendrasis duomenų apsaugos reglamentas (BDAR)

General Data Protection Regulation (EU GDPR)

The latest consolidated version of the Regulation with corrections by Corrigendum, OJ L 127, 23.5.2018, p. 2 ((EU) 2016/679). Source: EUR-lex.

Ekspertų komentarai ISO 27701 Gairės & Byla Teisė Palikite komentarą

Ekspertų komentarai

(EN) To facilitate the work of our consultants, we have collected all the requirements and information that have to be mentioned and created a convenient checklist. Next to each paragraph, we have placed links to specific GDPR articles and guidelines. We grouped all the information into 7 sections:

Controller’s identity
Purpose and lawful basis for processing
Personal data
Transfers of data to third countries
Rights
Changes (in privacy notices)
Form (of information provided)

It looks like this:

…

Prisijungti
norėdami pasiekti visą tekstą

(EN) Author

(EN) Siarhei Varankevich CIPP/E, CIPM, CIPT, MBA, FIP

(EN) Co-Founder & CEO of Data Privacy Office LLC. Data Protection Trainer and Principal Consultant

(EN) Ask a question

(EN)

Data Subject Request Letter Sample

Concern: Request of information regarding my personal data

Dear Madam, Dear Sir,

I have a right to be informed, under Article 14 of the General Data Protection Regulation (GDPR), about personal data concerning me that you are processing and that you obtained from any other sources than me…

…

Prisijungti
norėdami pasiekti visą tekstą

(EN) Author

(EN) Louis-Philippe Gratton PhD, LLM

(EN) Privacy Expert

(EN) Ask a question

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to article 14 GDPR:

7.3.2 Determining information for PII principals

Control

The organization should determine and document the information to be provided to PII principals regarding the processing of their PII and the timing of such a provision.

Implementation guidance

The organization should determine the legal, regulatory and/or business requirements for when information is to be provided to the PII principal (e.g. prior to processing, within a certain time from when it is requested, etc.) and for the type of information to be provided.

…

Prisijungti
norėdami pasiekti visą tekstą

Gairės & Byla Teisė

(EN)