Статья 21 📖 GDPR. Право на возражение

第 21 條 GDPR. 拒絕權

Article 21 GDPR. Right to object

1. 資料主體應有權基於與其具體情況有關之理由，隨時拒絕依第 6 條第 1 項第 e 點或第 f 點規定所為有關其個人資料之處理，包括基於該等條款所為之建檔。控管者應不得再處理該個人資料，除非該控管者證明其處理有優先於資料主體權利及自由之法律依據、或為建立、行使或防禦法律上請求所為之者。

1. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Комментарий эксперта Преамбулы Связанные статьи

Комментарий эксперта

Автор

Сергей Воронкевич CIPP/E, CIPM, CIPT, MBA, FIP

Сооснователь и директор DPO LLC. Тренер и ведущий консультант

Задать вопрос

Преамбулы

(69) 然而，於個人資料得被合法處理係因有處理之必要且符合公共利益之執行職務、或委託控管者行使公權力、或基於控管者或第三人之有正當利益之理由時，資料主體仍應有權基於其特殊情形拒絕任何個人資料之處理。此時應由控管者證明其正當利益優先於資料主體之利益或基本權與自由。

(69) Where personal data might lawfully be processed because processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or on grounds of the legitimate interests of a controller or a third party, a data subject should, nevertheless, be entitled to object to the processing of any personal data relating to his or her particular situation. It should be for the controller to demonstrate that its compelling legitimate interest overrides the interests or the fundamental rights and freedoms of the data subject.

Связанные статьи

第 6 條 GDPR. 處理之合法性

Article 6 GDPR. Lawfulness of processing

1. 合法之處理應至少符合下列要件之一：

1. Processing shall be lawful only if and to the extent that at least one of the following applies:

[…]

(e) 處理係為符合公共利益執行職務或委託控管者行使公權力所必須者；

(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(f) 處理係控管者或第三者為追求正當利益之目的所必須者，但該資料保護之資料主體之利益或基本權與自由優先於該等利益，特別是該資料主體為兒童時，不適用之；

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

[…]

2. 為直接行銷目的處理個人資料時，該資料主體有權隨時拒絕為行銷目的所涉及其個人資料之處理，包括與該直接行銷有關範圍內之建檔。

2. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

3. 當資料主體拒絕為直接行銷目的而處理個人資料時，該個人資料不得再基於該目的而為處理。

3. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

Преамбулы

(70) 當個人資料之處理係以直接行銷為目的時，資料主體應有權在任何時間且毋需任何費用拒絕該處理，包括在與直接行銷有關之範圍內建檔，而不問係原始處理或進階處理。應明確提請資料主體注意該權利，且清楚表達並與其他訊息區別。

(70) Where personal data are processed for the purposes of direct marketing, the data subject should have the right to object to such processing, including profiling to the extent that it is related to such direct marketing, whether with regard to initial or further processing, at any time and free of charge. That right should be explicitly brought to the attention of the data subject and presented clearly and separately from any other information.

4. 最遲於與資料主體第一次溝通時，應明確提請資料主體注意第 1 項及第 2 項所定權利，且清楚表達並與其他訊息區別。

4. At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.

ISO 27701

ISO/IEC 27701, принятый в 2019, добавил дополнительное руководство к ISO/IEC 27002 для контролеров персональных данных (ПИИ).

Приводим соответствующий параграф к статье 21(4) GDPR:

7.3.2 Определение информации для субъектов ПИИ

Средство управления

Организация должна определить и документировать информацию, которая должна быть предоставлена субъектам ПИИ, относительно обработки их ПИИ и сроков её предоставления.

Руководство по внедрению

Организация должна определить юридические, нормативные и/или коммерческие требования в отношении того, когда информация должна предоставляться субъекту ПИИ (например, до обработки, в течение определенного времени с момента её запроса и т.д.), а также для типа информации, которую следует предоставить

…

Войти
для доступа к полному тексту

5. 在使用資訊社會服務之過程中，不問第 2002/58/EC 號指令規範為何，資料主體得行使其權利，拒絕使用技術規範之自動化方式。

5. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.

6. 如個人資料之處理係依據第 89條第 1 項規定為科學或歷史研究目的或統計目的所為者，資料主體應有權基於與其具體情況有關之理由，拒絕與其有關之個人資料之處理，除非該處理係基於符合公共利益之職務執行之理由而有必要者。

6. Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

Связанные статьи

第 89 條 GDPR. 為實現公共利益、科學或歷史研究目的或統計目的所為處理之保護措施及例外規定

Article 89 GDPR. Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

1. 為實現公共利益、科學或歷史研究目的或統計目的之處理，應受本規則為資料主體之權利及自由所定適當保護措施之拘束。該等保護措施應確保已備妥技術上及組織上之措施，特別是用以確保資料最少蒐集原則之落實。只要上開目的得以實現，措施得包括假名化。當透過進階處理得實現上開目的，且進階處理不允許或不再允許識別資料 180 主體者，上開目的應以該方式實現。

1. Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.

[…]

Guidelines on consent under Regulation 2016/679

Scientific research

153. Recital 33 seems to bring some flexibility to the degree of specification and granularity of consent in the context of scientific research. Recital 33 states: “It is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. Therefore, data subjects should be allowed to give their consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research. Data subjects should have the opportunity to give their consent only to certain areas of research or parts of research projects to the extent allowed by the intended purpose.”