(1) Varstvo posameznikov pri obdelavi osebnih podatkov je temeljna pravica. V členu 8(1) Listine Evropske unije o temeljnih pravicah (v nadaljnjem besedilu: Listina) in členu 16(1) Pogodbe o delovanju Evropske unije (PDEU) je določeno, da ima vsakdo pravico do varstva osebnih podatkov, ki se nanašajo nanj.
(1) The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the ‘Charter’) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of personal data concerning him or her.
(2) Načela in pravila o varstvu posameznikov pri obdelavi njihovih osebnih podatkov bi morala ne glede na njihovo državljanstvo ali prebivališče zagotavljati spoštovanje temeljnih pravic in svoboščin posameznikov, zlasti njihovo pravico do varstva osebnih podatkov. Namen te uredbe je prispevati k dokončnemu oblikovanju območja svobode, varnosti in pravice ter ekonomske unije, gospodarskemu in socialnemu napredku, krepitvi in uskladitvi gospodarstev na notranjem trgu ter blaginji posameznikov.
(2) The principles of, and rules on the protection of natural persons with regard to the processing of their personal data should, whatever their nationality or residence, respect their fundamental rights and freedoms, in particular their right to the protection of personal data. This Regulation is intended to contribute to the accomplishment of an area of freedom, security and justice and of an economic union, to economic and social progress, to the strengthening and the convergence of the economies within the internal market, and to the well-being of natural persons.
(3) Direktiva Evropskega parlamenta in Sveta 95/46/ES (4) je namenjena harmonizaciji varstva temeljnih pravic in svoboščin posameznikov pri dejavnostih obdelave in zagotavljanju prostega pretoka osebnih podatkov med državami članicami.
(3) Directive 95/46/EC of the European Parliament and of the Council [4] seeks to harmonise the protection of fundamental rights and freedoms of natural persons in respect of processing activities and to ensure the free flow of personal data between Member States.
(4) Direktiva Evropskega parlamenta in Sveta 95/46/ES z dne 24. oktobra 1995 o varstvu posameznikov pri obdelavi osebnih podatkov in o prostem pretoku takih podatkov (UL L 281, 23.11.1995, str. 31). https://eur-lex.europa.eu/legal-content/EN/AUTO/?uri=OJ:L:1995:281:TOC
[4] Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31). https://eur-lex.europa.eu/legal-content/EN/AUTO/?uri=OJ:L:1995:281:TOC
(4) Obdelava osebnih podatkov bi morala biti oblikovana tako, da služi ljudem. Pravica do varstva osebnih podatkov ni absolutna pravica; v skladu z načelom sorazmernosti jo je treba obravnavati glede na vlogo, ki jo ima v družbi, in jo uravnotežiti z drugimi temeljnimi pravicami. Ta uredba spoštuje vse temeljne pravice in upošteva svoboščine in načela, priznana z Listino, kakor so zajeta v Pogodbah, zlasti spoštovanje zasebnega in družinskega življenja, stanovanja in komunikacij, varstvo osebnih podatkov, svobodo misli, vesti in vere, svobodo izražanja in obveščanja, svobodo gospodarske pobude, pravico do učinkovitega pravnega sredstva in nepristranskega sodišča ter kulturno, versko in jezikovno raznolikost.
(4) The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity.
(5) Gospodarsko in socialno povezovanje, ki izhaja iz delovanja notranjega trga, je prineslo občutno povečanje čezmejnih prenosov osebnih podatkov. Izmenjava osebnih podatkov med javnimi in zasebnimi akterji v Uniji, vključno s posamezniki, združenji in družbami, se je povečala. S pravom Unije se poziva nacionalne organe držav članic k sodelovanju in izmenjavi osebnih podatkov, da bi lahko opravljali svoje dolžnosti ali izvajali naloge v imenu organa v drugi državi članici.
(5) The economic and social integration resulting from the functioning of the internal market has led to a substantial increase in cross-border flows of personal data. The exchange of personal data between public and private actors, including natural persons, associations and undertakings across the Union has increased. National authorities in the Member States are being called upon by Union law to cooperate and exchange personal data so as to be able to perform their duties or carry out tasks on behalf of an authority in another Member State.
(6) Hiter tehnološki razvoj in globalizacija sta prinesla nove izzive za varstvo osebnih podatkov. Obseg zbiranja in izmenjave osebnih podatkov se je bistveno povečal. Tehnologija zasebnim podjetjem in javnim organom omogoča, da osebne podatke uporabljajo za dosego svojih ciljev v obsegu, kakršnega še ni bilo. Posamezniki vedno bolj dajejo osebne podatke na razpolago tako javno kot globalno. Tehnologija je spremenila tako gospodarstvo kot družbeno življenje ter bi morala še naprej omogočati lažje izvajanje prostega pretoka osebnih podatkov v Uniji ter prenosa v tretje države in mednarodne organizacije, pri čemer je treba zagotoviti visoko raven varstva osebnih podatkov.
(6) Rapid technological developments and globalisation have brought new challenges for the protection of personal data. The scale of the collection and sharing of personal data has increased significantly. Technology allows both private companies and public authorities to make use of personal data on an unprecedented scale in order to pursue their activities. Natural persons increasingly make personal information available publicly and globally. Technology has transformed both the economy and social life, and should further facilitate the free flow of personal data within the Union and the transfer to third countries and international organisations, while ensuring a high level of the protection of personal data.
(7) Zaradi tega razvoja je v Uniji potreben trden in skladnejši okvir varstva podatkov, podprt z doslednim izvrševanjem, saj je nujno vzpostaviti zaupanje, ki bo digitalnemu gospodarstvu omogočilo razvoj na celotnem notranjem trgu. Posamezniki bi morali imeti nadzor nad lastnimi osebnimi podatki. Pravna in praktična varnost posameznikov, gospodarskih subjektov in javnih organov bi morali biti okrepljeni.
(7) Those developments require a strong and more coherent data protection framework in the Union, backed by strong enforcement, given the importance of creating the trust that will allow the digital economy to develop across the internal market. Natural persons should have control of their own personal data. Legal and practical certainty for natural persons, economic operators and public authorities should be enhanced.
(8) Kadar ta uredba določa natančnejše določitve ali omejitve svojih pravil s pravom držav članic, lahko države članice vključijo elemente te uredbe v svoje nacionalno pravo, kolikor je to potrebno zaradi skladnosti in razumljivosti nacionalnih določb za osebe, za katere se uporabljajo.
(8) Where this Regulation provides for specifications or restrictions of its rules by Member State law, Member States may, as far as necessary for coherence and for making the national provisions comprehensible to the persons to whom they apply, incorporate elements of this Regulation into their national law.
(9) Cilji in načela Direktive 95/46/ES še vedno veljajo, vendar to ni preprečilo razdrobljenosti izvajanja varstva osebnih podatkov v Uniji, pravne negotovosti ali razširjenega javnega mnenja, da so precejšnja tveganja za varstvo posameznikov, zlasti glede spletne dejavnosti. Različne ravni varstva pravic in svoboščin posameznikov, zlasti pravice do varstva osebnih podatkov, pri obdelavi osebnih podatkov v državah članicah lahko preprečijo prosti pretok osebnih podatkov po celotni Uniji. Te razlike lahko pomenijo oviro pri izvajanju gospodarskih dejavnosti na ravni Unije, izkrivljajo konkurenco in ovirajo organe pri izpolnjevanju njihovih obveznosti po pravu Unije. Take različne ravni varstva izhajajo iz različnega izvajanja in uporabe Direktive 95/46/ES.
(9) The objectives and principles of Directive 95/46/EC remain sound, but it has not prevented fragmentation in the implementation of data protection across the Union, legal uncertainty or a widespread public perception that there are significant risks to the protection of natural persons, in particular with regard to online activity. Differences in the level of protection of the rights and freedoms of natural persons, in particular the right to the protection of personal data, with regard to the processing of personal data in the Member States may prevent the free flow of personal data throughout the Union. Those differences may therefore constitute an obstacle to the pursuit of economic activities at the level of the Union, distort competition and impede authorities in the discharge of their responsibilities under Union law. Such a difference in levels of protection is due to the existence of differences in the implementation and application of Directive 95/46/EC.
(10) Za zagotovitev dosledne in visoke ravni varstva posameznikov ter odstranitev ovir za prenos osebnih podatkov v Uniji bi morala biti raven varstva pravic in svoboščin posameznikov pri obdelavi osebnih podatkov enaka v vseh državah članicah. V vsej Uniji bi bilo treba zagotoviti dosledno in enotno uporabo pravil za varstvo temeljnih pravic in svoboščin posameznikov pri obdelavi osebnih podatkov. Kar zadeva obdelavo osebnih podatkov z namenom izpolnjevanja pravne obveznosti, za opravljanje naloge, ki se izvaja v javnem interesu, ali pri izvajanju javne oblasti, dodeljene upravljavcu, bi moralo biti državam članicam dovoljeno ohraniti ali uvesti nacionalne določbe za podrobnejšo opredelitev uporabe pravil iz te uredbe. Države članice so v povezavi s splošnim in horizontalnim pravom o varstvu podatkov, s katerim se izvaja Direktiva 95/46/ES, sprejele več področnih zakonov na področjih, kjer so potrebne podrobnejše določbe. Tudi ta uredba državam članicam daje manevrski prostor za podrobnejšo opredelitev njenih pravil, tudi glede obdelave posebnih vrst osebnih podatkov („občutljivi podatki“). V tem obsegu ta uredba ne izključuje prava držav članic, s katerim so opredeljene okoliščine posebnih primerov obdelave, vključno s podrobnejšo določitvijo pogojev, pod katerimi je obdelava osebnih podatkov zakonita.
(10) In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in all Member States. Consistent and homogenous application of the rules for the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data should be ensured throughout the Union. Regarding the processing of personal data for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, Member States should be allowed to maintain or introduce national provisions to further specify the application of the rules of this Regulation. In conjunction with the general and horizontal law on data protection implementing Directive 95/46/EC, Member States have several sector-specific laws in areas that need more specific provisions. This Regulation also provides a margin of manoeuvre for Member States to specify its rules, including for the processing of special categories of personal data (‘sensitive data’). To that extent, this Regulation does not exclude Member State law that sets out the circumstances for specific processing situations, including determining more precisely the conditions under which the processing of personal data is lawful.
(11) Za učinkovito varstvo osebnih podatkov po vsej Uniji je treba okrepiti in podrobneje opredeliti pravice posameznikov, na katere se nanašajo osebni podatki, ter obveznosti tistih, ki obdelujejo osebne podatke in določajo obdelavo osebnih podatkov, pa tudi enakovredna pooblastila za spremljanje in zagotavljanje skladnosti s pravili varstva osebnih podatkov ter enakovredne sankcije za kršitve v državah članicah.
(11) Effective protection of personal data throughout the Union requires the strengthening and setting out in detail of the rights of data subjects and the obligations of those who process and determine the processing of personal data, as well as equivalent powers for monitoring and ensuring compliance with the rules for the protection of personal data and equivalent sanctions for infringements in the Member States.
(12) V členu 16(2) PDEU je navedeno, da Evropski parlament in Svetdoločata pravila o varstvu fizičnih oseb pri obdelavi osebnih podatkov in pravila o prostem pretoku osebnih podatkov.
(12) Article 16(2) TFEU mandates the European Parliament and the Council to lay down the rules relating to the protection of natural persons with regard to the processing of personal data and the rules relating to the free movement of personal data.
(13) Da se zagotovi skladna raven varstva posameznikov v vsej Uniji in prepreči, da bi razlike ovirale prosti pretok osebnih podatkov na notranjem trgu, je potrebna uredba, ki bo gospodarskim subjektom, tudi mikro, malim in srednjim podjetjem, zagotovila pravno varnost in preglednost, posameznikom v vseh državah članicah zagotovila enako raven pravno izvršljivih pravic ter obveznosti in odgovornosti upravljavcev in obdelovalcev, zagotovila dosledno spremljanje obdelave osebnih podatkov, enakovredne sankcije v vseh državah članicah in učinkovito sodelovanje nadzornih organov različnih držav članic. Za pravilno delovanje notranjega trga prosti pretok osebnih podatkov v Uniji ne sme biti niti omejen niti prepovedan iz razlogov, povezanih z varstvom posameznikov pri obdelavi osebnih podatkov. Za upoštevanje posebnega položaja mikro, malih in srednjih podjetij ta uredba vsebuje odstopanja glede vodenja evidenc za organizacije, ki zaposlujejo manj kot 250 oseb. Poleg tega se institucije in organe Unije ter države članice in njihove nadzorne organe spodbuja, da posebne potrebe mikro, malih in srednjih podjetij upoštevajo pri uporabi te uredbe. Pojem mikro, malih in srednjih podjetij bi moral temeljiti na členu 2 Priloge k Priporočilu Komisije 2003/361/ES (5).
(13) In order to ensure a consistent level of protection for natural persons throughout the Union and to prevent divergences hampering the free movement of personal data within the internal market, a Regulation is necessary to provide legal certainty and transparency for economic operators, including micro, small and medium-sized enterprises, and to provide natural persons in all Member States with the same level of legally enforceable rights and obligations and responsibilities for controllers and processors, to ensure consistent monitoring of the processing of personal data, and equivalent sanctions in all Member States as well as effective cooperation between the supervisory authorities of different Member States. The proper functioning of the internal market requires that the free movement of personal data within the Union is not restricted or prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data. To take account of the specific situation of micro, small and medium-sized enterprises, this Regulation includes a derogation for organisations with fewer than 250 employees with regard to record-keeping. In addition, the Union institutions and bodies, and Member States and their supervisory authorities, are encouraged to take account of the specific needs of micro, small and medium-sized enterprises in the application of this Regulation. The notion of micro, small and medium-sized enterprises should draw from Article 2 of the Annex to Commission Recommendation 2003/361/EC [5].
(5) Priporočilo Komisije z dne 6. maja 2003 o opredelitvi mikro, malih in srednje velikih podjetij (C(2003) 1422) (UL L 124, 20.5.2003, str. 36). https://eur-lex.europa.eu/legal-content/EN/AUTO/?uri=OJ:L:2003:124:TOC
[5] Commission Recommendation of 6 May 2003 concerning the definition of micro, small and medium-sized enterprises (C(2003) 1422) (OJ L 124, 20.5.2003, p. 36). https://eur-lex.europa.eu/legal-content/EN/AUTO/?uri=OJ:L:2003:124:TOC