27 pants 📖 VDAR. Tādu pārziņu vai apstrādātāju pārstāvji, kuri neveic uzņēmējdarbību Savienībā

27 pants VDAR. Tādu pārziņu vai apstrādātāju pārstāvji, kuri neveic uzņēmējdarbību Savienībā

Article 27 GDPR. Representatives of controllers or processors not established in the Union

1. Ja piemēro 3. panta 2. punktu, pārzinis vai apstrādātājs rakstiski ieceļ savu pārstāvi Savienībā.

1. Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union.

Savienojumi

3 pants VDAR. Teritoriālā darbības joma

Article 3 GDPR. Territorial scope

[…]

2. Šo regulu piemēro Savienībā esošu datu subjektu personas datu apstrādei, ko veic pārzinis vai apstrādātājs, kas neveic uzņēmējdarbību Savienībā, ja apstrādes darbības ir saistītas ar:

2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

a) preču vai pakalpojumu piedāvāšanu šādiem datu subjektiem Savienībā, neatkarīgi no tā, vai no datu subjekta tiek prasīta samaksa; vai

(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

b) viņu uzvedības novērošanu, ciktāl viņu uzvedība notiek Savienībā.

(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

[…]

2. Šā panta 1. punktā minēto pienākumu nepiemēro:

2. The obligation laid down in paragraph 1 of this Article shall not apply to:

a) apstrādei, kura ir neregulāra, neietver – plašā mērogā – 9. panta 1. punktā minēto īpašo datu kategoriju apstrādi vai 10. pantā minēto personas datu par sodāmību un pārkāpumiem apstrādi, un ja ir maz ticams, ka tā radīs risku fizisku personu tiesībām un brīvībām, ņemot vērā apstrādes raksturu, kontekstu, apmēru un nolūkus; vai

(a) processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or

Savienojumi

9 pants VDAR. Īpašu kategoriju personas datu apstrāde

Article 9 GDPR. Processing of special categories of personal data

1. Ir aizliegta tādu personas datu apstrāde, kas atklāj rases vai etnisko piederību, politiskos uzskatus, reliģisko vai filozofisko pārliecību vai dalību arodbiedrībās, un ģenētisko datu, biometrisko datu, lai veiktu fiziskas personas unikālu identifikāciju, veselības datu vai datu par fiziskas personas dzimumdzīvi vai seksuālo orientāciju apstrāde.

1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.

[…]

10 pants VDAR. Personas datu par sodāmību un pārkāpumiem apstrāde

Article 10 GDPR. Processing of personal data relating to criminal convictions and offences

Personas datu apstrādi par sodāmību un pārkāpumiem vai ar tiem saistītiem drošības pasākumiem, pamatojoties uz 6. panta 1. punktu, veic tikai oficiālas iestādes kontrolē vai tad, ja apstrādi atļauj Savienības vai dalībvalsts tiesību akti, paredzot atbilstošas garantijas datu subjektu tiesībām un brīvībām. Jebkādu visaptverošu sodāmības reģistru uzglabā tikai oficiālas iestādes kontrolē.

Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.

Guidelines on Data Protection Officers (‘DPOs’)

2.1.3 ‘LARGE SCALE’

In any event, the WP29 recommends that the following factors, in particular, be considered when determining whether the processing is carried out on a large scale:

• the number of data subjects concerned – either as a specific number or as a proportion of the relevant population

• the volume of data and/or the range of different data items being processed

• the duration, or permanence, of the data processing activity

• the geographical extent of the processing activity.

Examples of large-scale processing include:

• processing of patient data in the regular course of business by a hospital

• processing of travel data of individuals using a city’s public transport system (e.g. tracking via travel cards)

• processing of real time geo-location data of customers of an international fast food chain for statistical purposes by a processor specialised in providing these services

• processing of customer data in the regular course of business by an insurance company or a bank

• processing of personal data for behavioural advertising by a search engine

• processing of data (content, traffic, location) by telephone or internet service providers.

Examples that do not constitute large-scale processing include:

• processing of patient data by an individual physician

• processing of personal data relating to criminal convictions and offences by an individual lawyer.

b) publiskai iestādei vai struktūrai.

(b) a public authority or body.

Savienojumi

Guidelines on Data Protection Officers (‘DPOs’)

2.1.1 ‘PUBLIC AUTHORITY OR BODY’

The GDPR does not define what constitutes a ‘public authority or body’. The WP29 considers that such a notion is to be determined under national law. Accordingly, public authorities and bodies include national, regional and local authorities, but the concept, under the applicable national laws, typically also includes a range of other bodies governed by public law [12]. In such cases, the designation of a DPO is mandatory.

_{[12] See, e.g. the definition of ‘public sector body’ and ‘body governed by public law’ in Article 2(1) and (2) of Directive 2003/98/EC of the European Parliament and of the Council of 17 November 2003 on the re-use of public-sector information (OJ L 345, 31.12.2003, p. 90).}

A public task may be carried out, and public authority may be exercised [13] not only by public authorities or bodies but also by other natural or legal persons governed by public or private law, in sectors such as, according to national regulation of each Member State, public transport services, water and energy supply, road infrastructure, public service broadcasting, public housing or disciplinary bodies for regulated professions.

_{[13] Article 6(1)(e).}

3. Pārstāvis veic uzņēmējdarbību vienā no tām dalībvalstīm, kur atrodas datu subjekti, kuru personas datus apstrādā saistībā ar preču vai pakalpojumu piedāvāšanu tiem vai kuru uzvedība tiek novērota.

3. The representative shall be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are.

Savienojumi

Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)

Offering of goods or services, irrespective of whether a payment of the data subject is required, to data subjects in the Union

The first activity triggering the application of Article 3(2) is the “offering of goods or services”, a concept which has been further addressed by EU law and case law, which should be taken into account when applying the targeting criterion. The offering of services also includes the offering of information society services, defined in point (b) of Article 1(1) of Directive (EU) 2015/1535 [23] as “any Information Society service, that is to say, any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services”.

_{[23] Directive (EU) 2015/1535 of the European Parliament and of the Council of 9 September 2015 laying down a procedure for the provision of information in the field of technical regulations and of rules on Information Society services.}

Another key element to be assessed in determining whether the Article 3(2)(a) targeting criterion can be met is whether the offer of goods or services is directed at a person in the Union, or in other words, whether the conduct on the part of the controller, which determines the means and purposes of processing, demonstrates its intention to offer goods or a services to a data subject located in the Union. Recital 23 of the GDPR indeed clarifies that “in order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union.”

4. Lai nodrošinātu atbilstību šai regulai, pārzinis vai apstrādātājs pilnvaro pārstāvi, pie kura – jo īpaši – uzraudzības iestādes un datu subjekti papildus vai pārziņa vai apstrādātāja vietā vēršas visos jautājumos saistībā ar apstrādi.

4. The representative shall be mandated by the controller or processor to be addressed in addition to or instead of the controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with this Regulation.

5. Pārziņa vai apstrādātāja pārstāvja iecelšana neskar tiesiskās prasības, ko varētu celt pret pašu pārzini vai apstrādātāju.

5. The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves.

Vispārīgā datu aizsardzības regula (VDAR)

General Data Protection Regulation (EU GDPR)

The latest consolidated version of the Regulation with corrections by Corrigendum, OJ L 127, 23.5.2018, p. 2 ((EU) 2016/679). Source: EUR-lex.

ISO 27701 Apsvērums Atstājiet savu komentāru

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27002, section 6.1.1.

Here is the relevant paragraph to article 27 GDPR:

6.3.1.1 Information security roles and responsibilities

Implementation guidance

The organization should designate a point of contact for use by the customer regarding the processing of PII. When the organization is a PII controller, designate a point of contact for PII principals regarding the processing of their PII (see 7.3.2).

The organization should appoint one or more persons responsible for developing, implementing, maintaining and monitoring an organization-wide governance and privacy program, to ensure compliance with all applicable laws and regulations regarding the processing of PII.

…

Pieslēgties
lai piekļūtu pilnam tekstam

Apsvērums

(80) Ja pārzinis vai apstrādātājs, kas neveic uzņēmējdarbību Savienībā, apstrādā Savienībā esošu datu subjektu personas datus un tā apstrādes darbības ir saistītas ar preču vai pakalpojumu piedāvāšanu šādiem datu subjektiem Savienībā – neatkarīgi no tā, vai no datu subjekta tiek prasīta samaksa – vai ar viņu uzvedības novērošanu, ciktāl viņu uzvedība notiek Savienībā, pārzinim vai apstrādātājam būtu jāieceļ pārstāvis, izņemot, ja apstrāde ir neregulāra, neietver īpašu kategoriju personas datu apstrādi plašā mērogā vai personas datu par sodāmību un pārkāpumiem apstrādi un ja ir maz ticams, ka tā radīs risku fizisku personu tiesībām un brīvībām, ņemot vērā apstrādes raksturu, kontekstu, apmēru un nolūkus, vai ja pārzinis ir publiska iestāde vai struktūra. Pārstāvim būtu jārīkojas pārziņa vai apstrādātāja vārdā, un pie viņa var vērsties jebkura uzraudzības iestāde. Pārzinim vai apstrādātājam ar rakstisku pilnvaru būtu nepārprotami jāieceļ pārstāvis, kas rīkojas pārziņa vai apstrādātāja vārdā saistībā ar tā pienākumiem, kas noteikti šajā regulā. Šāda pārstāvja iecelšana neietekmē pārziņa vai apstrādātāja pienākumus vai atbildību, kas noteikti šajā regulā. Šādam pārstāvim savi uzdevumi būtu jāveic saskaņā ar pārziņa vai apstrādātāja dotajām pilnvarām, tostarp jāsadarbojas ar kompetentajām uzraudzības iestādēm attiecībā uz jebkuru darbību, ko veic, lai nodrošinātu šīs regulas ievērošanu. Pārziņa vai apstrādātāja neatbilstības gadījumā uz iecelto pārstāvi būtu jāattiecina izpildes procedūras.

(80) Where a controller or a processor not established in the Union is processing personal data of data subjects who are in the Union whose processing activities are related to the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union, or to the monitoring of their behaviour as far as their behaviour takes place within the Union, the controller or the processor should designate a representative, unless the processing is occasional, does not include processing, on a large scale, of special categories of personal data or the processing of personal data relating to criminal convictions and offences, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing or if the controller is a public authority or body. The representative should act on behalf of the controller or the processor and may be addressed by any supervisory authority. The representative should be explicitly designated by a written mandate of the controller or of the processor to act on its behalf with regard to its obligations under this Regulation. The designation of such a representative does not affect the responsibility or liability of the controller or of the processor under this Regulation. Such a representative should perform its tasks according to the mandate received from the controller or processor, including cooperating with the competent supervisory authorities with regard to any action taken to ensure compliance with this Regulation. The designated representative should be subject to enforcement proceedings in the event of non-compliance by the controller or processor.

Atstājiet savu komentāru

[js-disqus]