... 5. Predsednik odbora zadevne nadzorne organe brez nepotrebnega odlašanja uradno obvesti o odločitvi iz odstavka 1. O tem obvesti Komisijo. Odločitev se brez odlašanja objavi na spletnem mestu odbora, potem ko nadzorni organ uradno sporoči končno odločitev iz odstavka 6. ...
... 5. The Chair of the Board shall notify, without undue delay, the decision referred to in paragraph 1 to the supervisory authorities concerned. It shall inform the Commission thereof. The decision shall be published on the website of the Board without delay after the supervisory authority has notified the final decision referred to in paragraph 6. ...
... 8. Komisija v Uradnem listu Evropske unije in na svojem spletnem mestu objavi seznam tretjih držav, ozemelj, določenih sektorjev v tretji državi in mednarodnih organizacij, v zvezi s katerimi je sprejela sklep, da zagotavljajo ustrezno raven varstva oziroma je ne zagotavljajo več. ...
... 8. The Commission shall publish in the Official Journal of the European Union and on its website a list of the third countries, territories and specified sectors within a third country and international organisations for which it has decided that an adequate level of protection is or is no longer ensured. ...
... (58) Načelo preglednosti zahteva, da so vse informacije, ki se nanašajo na javnost ali posameznika, na katerega se nanašajo osebni podatki, jedrnate, lahko dostopne in lahko razumljive ter izražene v jasnem in preprostem jeziku, kjer je ustrezno pa tudi vizualno prikazane. Take informacije bi se lahko predložile v elektronski obliki, na primer na spletni strani, kadar so namenjene javnosti. To je še zlasti pomembno v primerih, kadar posameznik, na katerega se nanašajo osebni podatki, zaradi velikega števila akterjev in tehnološke kompleksnosti težko ve in razume, ali se zbirajo osebni podatki, povezani z njim, kdo jih zbira in v kakšen namen, kot je to v primeru spletnega oglaševanja. Glede na to, da otroci potrebujejo posebno varstvo, bi morale biti vse informacije in vsa komunikacija, pri katerih se obdelava nanaša na otroka, v tako jasnem in preprostem jeziku, da ga lahko otrok zlahka razume. ...
... (58) The principle of transparency requires that any information addressed to the public or to the data subject be concise, easily accessible and easy to understand, and that clear and plain language and, additionally, where appropriate, visualisation be used. Such information could be provided in electronic form, for example, when addressed to the public, through a website. This is of particular relevance in situations where the proliferation of actors and the technological complexity of practice make it difficult for the data subject to know and understand whether, by whom and for what purpose personal data relating to him or her are being collected, such as in the case of online advertising. Given that children merit specific protection, any information and communication, where processing is addressed to a child, should be in such a clear and plain language that the child can easily understand. ...
... (143) Katera koli fizična ali pravna oseba ima pravico, da pred Sodiščem pod pogoji iz člena 263 PDEU vloži ničnostno tožbo zoper odločitve odbora. Zadevni nadzorni organi, ki želijo take odločitve izpodbijati, morajo kot njihovi naslovniki v skladu s členom 263 PDEU tožbo vložiti v dveh mesecih po tem, ko so bili o njih uradno obveščeni. Kadar se odločitve odbora podatkov nanašajo neposredno in posamično na upravljavca, obdelovalca ali pritožnika, lahko ta vloži ničnostno tožbo zoper te odločitve, to pa mora v skladu s členom 263 PDEU storiti v dveh mesecih od objave teh odločitev na spletnem mestu odbora. Brez poseganja v to pravico na podlagi člena 263 PDEU, bi morala imeti vsaka fizična ali pravna oseba na voljo učinkovito pravno sredstvo pred pristojnim nacionalnim sodiščem zoper odločitev nadzornega organa, ki ima pravne učinke za to osebo. Taka odločitev se nanaša zlasti na izvajanje preiskovalnih pooblastil nadzornega organa, popravljalnih pooblastil in pooblastil v zvezi z dovoljenji ali na zavržene ali zavrnjene pritožbe. Vendar pa pravica do učinkovitega pravnega sredstva ne zajema ukrepov nadzornih organov, ki niso pravno zavezujoči, kot so mnenja, ki jih izdajo nadzorni organi, ali njihovi nasveti. Za postopke zoper nadzorni organ bi morala biti pristojna sodišča države članice, v kateri ima nadzorni organ sedež, izvajati pa bi se morali v skladu s postopkovnim pravom te države članice. Ta sodišča bi morala izvajati polno pristojnost, ki bi morala vključevati pristojnost za preučitev vseh vprašanj, ki se nanašajo na dejstva in zakonodajo v zvezi z zadevnim sporom. ...
... (143) Any natural or legal person has the right to bring an action for annulment of decisions of the Board before the Court of Justice under the conditions provided for in Article 263 TFEU. As addressees of such decisions, the supervisory authorities concerned which wish to challenge them have to bring action within two months of being notified of them, in accordance with Article 263 TFEU. Where decisions of the Board are of direct and individual concern to a controller, processor or complainant, the latter may bring an action for annulment against those decisions within two months of their publication on the website of the Board, in accordance with Article 263 TFEU. Without prejudice to this right under Article 263 TFEU, each natural or legal person should have an effective judicial remedy before the competent national court against a decision of a supervisory authority which produces legal effects concerning that person. Such a decision concerns in particular the exercise of investigative, corrective and authorisation powers by the supervisory authority or the dismissal or rejection of complaints. However, the right to an effective judicial remedy does not encompass measures taken by supervisory authorities which are not legally binding, such as opinions issued by or advice provided by the supervisory authority. Proceedings against a supervisory authority should be brought before the courts of the Member State where the supervisory authority is established and should be conducted in accordance with that Member State's procedural law. Those courts should exercise full jurisdiction, which should include jurisdiction to examine all questions of fact and law relevant to the dispute before them. ...
... ...
... Moreover, necessary information should also be provided in the right context, at the appropriate time. Since the controller carries out many processing operations using the data collected on the website, a general privacy policy on the website alone is not sufficient for the controller to meet the requirements of transparency. The controller therefore designs an information flow, presenting the data subject with relevant information within the appropriate contexts using e.g. informational snippets or pop-ups. For example, when asking the data subject to enter personal data, the controller informs the data subject of how the personal data will be processed and why that personal data is necessary for the processing. ...
... 6. Vodilni nadzorni organ oziroma nadzorni organ, pri katerem je bila vložena pritožba, končno odločitev sprejme na podlagi odločitve iz odstavka 1 tega člena, brez nepotrebnega odlašanja in najpozneje en mesec po uradnem posredovanju odločitve odbora. Vodilni nadzorni organ oziroma nadzorni organ, pri katerem je bila vložena pritožba, obvesti odbor o datumu, ko so upravljavec ali obdelovalec in posameznik, na katerega se nanašajo osebni podatki, uradno obveščeni o njegovi končni odločitvi. Končna odločitev zadevnih nadzornih organov se sprejme pod pogoji iz člena 60(7), (8) in (9). Končna odločitev se nanaša na odločitev iz odstavka 1 tega člena, v njej pa je navedeno, da se odločitev iz odstavka 1 objavi na spletnem mestu odbora v skladu z odstavkom 5 tega člena. Končni odločitvi je priložena odločitev iz odstavka 1 tega člena. ...
... 6. The lead supervisory authority or, as the case may be, the supervisory authority with which the complaint has been lodged shall adopt its final decision on the basis of the decision referred to in paragraph 1 of this Article, without undue delay and at the latest by one month after the Board has notified its decision. The lead supervisory authority or, as the case may be, the supervisory authority with which the complaint has been lodged, shall inform the Board of the date when its final decision is notified respectively to the controller or the processor and to the data subject. The final decision of the supervisory authorities concerned shall be adopted under the terms of Article 60(7), (8) and (9). The final decision shall refer to the decision referred to in paragraph 1 of this Article and shall specify that the decision referred to in that paragraph will be published on the website of the Board in accordance with paragraph 5 of this Article. The final decision shall attach the decision referred to in paragraph 1 of this Article. ...
... ...
... It is however important to recall that Recital 23 confirms that the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, the mention on the website of its e-mail or geographical address, or of its telephone number without an international code, does not, of itself, provide sufficient evidence to demonstrate the controller or processor’s intention to offer goods or a services to a data subject located in the Union. In this context, the EDPB recalls that when goods or services are inadvertently or incidentally provided to a person on the territory of the Union, the related processing of personal data would not fall within the territorial scope of the GDPR. ...
... ...
... 18. [Example 2] A local municipality is planning road maintenance works. As the road works may disrupt traffic for a long time, the municipality offers its citizens the opportunity to subscribe to an email list to receive updates on the progress of the works and on expected delays. The municipality makes clear that there is no obligation to participate and asks for consent to use email addresses for this (exclusive) purpose. Citizens that do not consent will not miss out on any core service of the municipality or the exercise of any right, so they are able to give or refuse their consent to this use of data freely. All information on the road works will also be available on the municipality’s website. ...
... ...
... 96. [Example 17] A data controller may also obtain explicit consent from a visitor to its website by offering an explicit consent screen that contains Yes and No check boxes, provided that the text clearly indicates the consent, for instance “I, hereby, consent to the processing of my data”, and not for instance, “It is clear to me that my data will be processed”. It goes without saying that the conditions for informed consent as well as the other conditions for obtaining valid consent should be met. ...
... ...
... Both Articles 13 and 14 refer to the obligation on the data controller to “provide the data subject with all of the following information…” The operative word here is “provide”. This means that the data controller must take active steps to furnish the information in question to the data subject or to actively direct the data subject to the location of it (e.g. by way of a direct link, use of a QR code, etc.). The data subject must not have to actively search for information covered by these articles amongst other information, such as terms and conditions of use of a website or app. The example at paragraph 11 illustrates this point. As noted above at paragraph 17, WP29 recommends that the entirety of the information addressed to data subjects should also be available to them in one single place or one complete document (e.g. whether in a digital form on a website or in paper format) which can be easily accessed should they wish to consult the entirety of the information. ...