SUVP (GDPR)
>
Člen 35. Ocena učinka v zvezi z varstvom podatkov
Člen 35 SUVP (GDPR). Ocena učinka v zvezi z varstvom podatkov
Article 35 GDPR. Data protection impact assessment
1. Kadar je možno, da bi lahko vrsta obdelave, zlasti z uporabo novih tehnologij, ob upoštevanju narave, obsega, okoliščin in namenov obdelave povzročila veliko tveganje za pravice in svoboščine posameznikov, upravljavec pred obdelavo opravi oceno učinka predvidenih dejanj obdelave na varstvo osebnih podatkov. V eni oceni je lahko obravnavan niz podobnih dejanj obdelave, ki predstavljajo podobna velika tveganja.
1. Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. A single assessment may address a set of similar processing operations that present similar high risks.
2 Upravljavec pri izvedbi ocene učinka v zvezi z varstvom podatkov za mnenje zaprosi pooblaščeno osebo za varstvo podatkov, kjer je ta imenovana.
2. The controller shall seek the advice of the data protection officer, where designated, when carrying out a data protection impact assessment.
3. Ocena učinka v zvezi z varstvom podatkov iz odstavka 1 se zahteva zlasti v primeru:
3. A data protection impact assessment referred to in paragraph 1 shall in particular be required in the case of:
(a) sistematičnega in obsežnega vrednotenja osebnih vidikov v zvezi s posamezniki, ki temelji na avtomatizirani obdelavi, vključno z oblikovanjem profilov, in je osnova za odločitve, ki imajo pravne učinke v zvezi s posameznikom ali nanj na podoben način znatno vplivajo;
(a) a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person;
(b) obsežne obdelave posebnih vrst podatkov iz člena 9(1) ali osebnih podatkov v zvezi s kazenskimi obsodbami in prekrški iz člena 10, ali
(b) processing on a large scale of special categories of data referred to in Article 9(1), or of personal data relating to criminal convictions and offences referred to in Article 10; or
(c) obsežnega sistematičnega spremljanja javno dostopnega območja.
(c) a systematic monitoring of a publicly accessible area on a large scale.
4. Nadzorni organ določi in objavi seznam vrst dejanj obdelave, za katere velja zahteva po oceni učinka v zvezi z varstvom podatkov v skladu z odstavkom 1. Nadzorni organ te sezname posreduje odboru iz člena 68.
4. The supervisory authority shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1. The supervisory authority shall communicate those lists to the Board referred to in Article 68.
5. Nadzorni organ lahko tudi določi in objavi seznam vrst dejanj obdelave, za katere ne velja zahteva po oceni učinka v zvezi z varstvom podatkov. Nadzorni organ te sezname posreduje odboru.
5. The supervisory authority may also establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. The supervisory authority shall communicate those lists to the Board.
6. Pristojni nadzorni organ pred sprejetjem seznamov iz odstavkov 4 in 5 uporabi mehanizem za skladnost iz člena 63, kadar taki seznami vključujejo dejavnosti obdelave, ki so povezane z nudenjem blaga ali storitev posameznikom, na katere se nanašajo osebni podatki, ali s spremljanjem njihovega ravnanja v več državah članicah ali pa lahko znatno vplivajo na prosti pretok osebnih podatkov v Uniji.
6. Prior to the adoption of the lists referred to in paragraphs 4 and 5, the competent supervisory authority shall apply the consistency mechanism referred to in Article 63 where such lists involve processing activities which are related to the offering of goods or services to data subjects or to the monitoring of their behaviour in several Member States, or may substantially affect the free movement of personal data within the Union.
(a) sistematičen opis predvidenih dejanj obdelave in namenov obdelave, kadar je ustrezno pa tudi zakonitih interesov, za katere si prizadeva upravljavec;
(a) a systematic description of the envisaged processing operations and the purposes of the processing, including, where applicable, the legitimate interest pursued by the controller;
Smernice in sodna praksa
(EN)
Case law
CJEU, Fashion ID GmbH & Co. KG/Verbraucherzentrale NRW eV, C-40/17 (2019).(b) oceno potrebnosti in sorazmernosti dejanj obdelave glede na njihov namen;
(b) an assessment of the necessity and proportionality of the processing operations in relation to the purposes;
(c) oceno tveganj za pravice in svoboščine posameznikov, na katere se nanašajo osebni podatki, iz odstavka 1, ter
(c) an assessment of the risks to the rights and freedoms of data subjects referred to in paragraph 1; and
(d) ukrepe za obravnavanje tveganj, vključno z zaščitnimi ukrepi, varnostne ukrepe ter mehanizme za zagotavljanje varstva osebnih podatkov in za dokazovanje skladnosti s to uredbo, ob upoštevanju pravic in zakonitih interesov posameznikov, na katere se nanašajo osebni podatki, ter drugih oseb, ki jih to zadeva.
(d) the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation taking into account the rights and legitimate interests of data subjects and other persons concerned.
8. Pri ocenjevanju učinka dejanj obdelave, ki jih izvajajo upravljavci ali obdelovalci, opravljenem zlasti za namene ocene učinka v zvezi z varstvom podatkov, se upošteva, ali zadevni upravljavci ali obdelovalci spoštujejo odobrene kodekse ravnanja iz člena 40.
8. Compliance with approved codes of conduct referred to in Article 40 by the relevant controllers or processors shall be taken into due account in assessing the impact of the processing operations performed by such controllers or processors, in particular for the purposes of a data protection impact assessment.
9. Po potrebi upravljavec glede predvidene obdelave zaprosi za mnenje posameznikov, na katere se nanašajo osebni podatki, ali njihovih predstavnikov, brez poseganja v zaščito komercialnega ali javnega interesa ali varnost dejanj obdelave.
9. Where appropriate, the controller shall seek the views of data subjects or their representatives on the intended processing, without prejudice to the protection of commercial or public interests or the security of processing operations.
ISO 27701
(EN) ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27001, section 4.2.
Here is the relevant paragraph to article 35(9) GDPR:
5.2.2 Understanding the needs and expectations of interested parties
The organization shall include among its interested parties (see ISO/IEC 27001:2013, 4.2), those parties having interests or responsibilities associated with the processing of PII, including the PII principals.
(EN) […]
(EN) Sign in
to read the full text
10. Kadar je pravna podlaga za obdelavo v skladu s točko (c) ali (e) člena 6(1) pravo Unije ali pravo države članice, ki velja za upravljavca, to pravo ureja zadevno posebno dejanje obdelave ali niz zadevnih dejanj obdelave, in je bila ocena učinka v zvezi z varstvom podatkov že izvedena v okviru splošne ocene učinkov med sprejemanjem te pravne podlage, se odstavki 1 do 7 ne uporabljajo, razen če države članice menijo, da je treba tako oceno opraviti pred dejavnostmi obdelave.
10. Where processing pursuant to point (c) or (e) of Article 6(1) has a legal basis in Union law or in the law of the Member State to which the controller is subject, that law regulates the specific processing operation or set of operations in question, and a data protection impact assessment has already been carried out as part of a general impact assessment in the context of the adoption of that legal basis, paragraphs 1 to 7 shall not apply unless Member States deem it to be necessary to carry out such an assessment prior to processing activities.
11. Upravljavec po potrebi opravi pregled, da bi ocenil, ali obdelava poteka v skladu z oceno učinka v zvezi z varstvom podatkov vsaj takrat, ko se spremeni tveganje, ki ga predstavljajo dejanja obdelave.
11. Where necessary, the controller shall carry out a review to assess if processing is performed in accordance with the data protection impact assessment at least when there is a change of the risk represented by processing operations.
Splošna uredba o varstvu podatkov (SUVP, GDPR)
General Data Protection Regulation (EU GDPR)
The latest consolidated version of the Regulation with corrections by Corrigendum, OJ L 127, 23.5.2018, p. 2 ((EU) 2016/679). Source: EUR-lex.
ISO 27701
Uvodne izjave
Smernice in sodna praksa
Pustite komentar
(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.
Here is the relevant paragraph to article 35 GDPR:
7.2.5 Privacy impact assessment
Control
The organization should assess the need for, and implement where appropriate, a privacy impact assessment whenever new processing of PII or changes to existing processing of PII is planned.
Implementation guidance
PII processing generates risks for PII principals. These risks should be assessed through a privacy impact assessment.
(EN) […]
(EN) Sign in
to read the full text
(75) Tveganje za pravice in svoboščine posameznika, ki se razlikuje po verjetnosti in resnosti, je lahko posledica obdelave osebnih podatkov, ki bi lahko povzročila fizično, premoženjsko in ali nepremoženjsko škodo, zlasti: kadar obdelava lahko privede do diskriminacije, kraje ali zlorabe identitete, finančne izgube, okrnitve ugleda, izgube zaupnosti osebnih podatkov, zaščitenih s poklicno molčečnostjo, neodobrene reverzije psevdonimizacije ali katere koli druge znatne gospodarske ali socialne škode; kadar bi bile posameznikom, na katere se nanašajo osebni podatki, lahko odvzete pravice in svoboščine ali bi jim bilo preprečeno izvajanje nadzora nad njihovimi osebnimi podatki; kadar se obdelujejo osebni podatki, ki razkrivajo rasno ali etnično poreklo, politična mnenja, veroizpoved ali filozofsko prepričanje ali članstvo v sindikatu, ter obdelovanje genetskih podatkov ali podatkov v zvezi z zdravjem ali podatkov v zvezi s spolnim življenjem ali kazenskimi obsodbami in prekrški ali s tem povezanimi varnostnimi ukrepi, kadar se vrednotijo osebni vidiki, zlasti analiziranje ali predvidevanje vidikov, ki zadevajo uspešnost pri delu, ekonomski položaj, zdravje, osebni okus ali interese, zanesljivost ali vedenje, lokacijo ali gibanje, da bi se ustvarili ali uporabljali osebni profili, kadar se obdelujejo osebni podatki ranljivih posameznikov, zlasti otrok; ali kadar obdelava vključuje veliko število osebnih podatkov in zadeva veliko število posameznikov, na katere se nanašajo osebni podatki.
(75) The risk to the rights and freedoms of natural persons, of varying likelihood and severity, may result from personal data processing which could lead to physical, material or non-material damage, in particular: where the processing may give rise to discrimination, identity theft or fraud, financial loss, damage to the reputation, loss of confidentiality of personal data protected by professional secrecy, unauthorised reversal of pseudonymisation, or any other significant economic or social disadvantage; where data subjects might be deprived of their rights and freedoms or prevented from exercising control over their personal data; where personal data are processed which reveal racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, and the processing of genetic data, data concerning health or data concerning sex life or criminal convictions and offences or related security measures; where personal aspects are evaluated, in particular analysing or predicting aspects concerning performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements, in order to create or use personal profiles; where personal data of vulnerable natural persons, in particular of children, are processed; or where processing involves a large amount of personal data and affects a large number of data subjects.
(84) Za povečanje skladnosti s to uredbo, kadar bodo dejanja obdelave verjetno povzročila veliko tveganje za pravice in svoboščine posameznikov, bi moral biti upravljavec odgovoren za izvedbo ocene učinka v zvezi z varstvom podatkov, da bi ocenili predvsem izvor, naravo, posebnost in resnost tega tveganja. Rezultat ocene bi bilo treba upoštevati pri določitvi ustreznih ukrepov, ki jih je treba sprejeti, da bi dokazali, da je obdelava osebnih podatkov v skladu s to uredbo. Kadar se na podlagi ocene učinka v zvezi z varstvom podatkov ugotovi, da dejanja obdelave predstavljajo veliko tveganje, ki ga upravljavec ne more ublažiti z ustreznimi ukrepi v smislu razpoložljive tehnologije in stroškov izvajanja, bi se bilo treba pred obdelavo posvetovati z nadzornim organom.
(84) In order to enhance compliance with this Regulation where processing operations are likely to result in a high risk to the rights and freedoms of natural persons, the controller should be responsible for the carrying-out of a data protection impact assessment to evaluate, in particular, the origin, nature, particularity and severity of that risk. The outcome of the assessment should be taken into account when determining the appropriate measures to be taken in order to demonstrate that the processing of personal data complies with this Regulation. Where a data-protection impact assessment indicates that processing operations involve a high risk which the controller cannot mitigate by appropriate measures in terms of available technology and costs of implementation, a consultation of the supervisory authority should take place prior to the processing.
(89) Direktiva 95/46/ES je določala splošno obveznost glede obveščanja nadzornih organov o obdelavi osebnih podatkov. Ta obveznost prinaša upravna in finančna bremena, ni pa v vseh primerih pripomogla k izboljšanju varstva osebnih podatkov. Zato bi bilo treba take nerazlikovalne splošne obveznosti obveščanja odpraviti ter nadomestiti z učinkovitimi postopki in mehanizmi, ki se namesto tega osredotočajo na tiste vrste dejanj obdelave, ki zaradi svoje narave, obsega, okoliščin in namenov verjetno povzročajo veliko tveganje za pravice in svoboščine posameznikov. Take vrste dejanj obdelave so lahko tiste, ki zlasti vključujejo uporabo novih tehnologij ali ki so nove in zanje upravljavec še ni izvedel ocene učinka v zvezi z varstvom podatkov ali postanejo potrebne zaradi časa, ki je pretekel od prvotne obdelave.
(89) Directive 95/46/EC provided for a general obligation to notify the processing of personal data to the supervisory authorities. While that obligation produces administrative and financial burdens, it did not in all cases contribute to improving the protection of personal data. Such indiscriminate general notification obligations should therefore be abolished, and replaced by effective procedures and mechanisms which focus instead on those types of processing operations which are likely to result in a high risk to the rights and freedoms of natural persons by virtue of their nature, scope, context and purposes. Such types of processing operations may be those which in, particular, involve using new technologies, or are of a new kind and where no data protection impact assessment has been carried out before by the controller, or where they become necessary in the light of the time that has elapsed since the initial processing.
(90) V takih primerih bi moral upravljavec pred obdelavo izvesti oceno učinka v zvezi z varstvom podatkov, da bi se ocenili posebna verjetnost in resnost velikega tveganja, pri čemer bi upoštevali naravo, obseg, okoliščine in namene obdelave ter izvor tveganja. Ta ocena učinka pa bi morala obsegati zlasti ukrepe, zaščitne ukrepe in mehanizme, ki so načrtovani za ublažitev tega tveganja, zagotavljanje varstva osebnih podatkov in dokazovanje skladnosti s to uredbo.
(90) In such cases, a data protection impact assessment should be carried out by the controller prior to the processing in order to assess the particular likelihood and severity of the high risk, taking into account the nature, scope, context and purposes of the processing and the sources of the risk. That impact assessment should include, in particular, the measures, safeguards and mechanisms envisaged for mitigating that risk, ensuring the protection of personal data and demonstrating compliance with this Regulation.
(91) To bi moralo veljati zlasti za obsežna dejanja obdelave, ki so namenjena obdelavi precejšnje količine osebnih podatkov na regionalni, nacionalni ali nadnacionalni ravni in bi lahko vplivali na veliko število posameznikov, na katere se nanašajo osebni podatki, ter za katere je verjetno, da bodo povzročila veliko tveganje, na primer zaradi njihove občutljivosti, kadar se v skladu z doseženo stopnjo tehnološkega znanja uporablja nova tehnologija v velikem obsegu, ter tudi za druga dejanja obdelave, ki povzročajo veliko tveganje za pravice in svoboščine posameznikov, na katere se nanašajo osebni podatki, zlasti kadar ta dejanja posameznikom, na katere se nanašajo osebni podatki, otežijo uresničevanje njihovih pravic. Oceno učinka v zvezi z varstvom podatkov bi bilo treba izvesti tudi, kadar se osebni podatki obdelujejo za sprejemanje odločitev v zvezi z določenimi posamezniki po kakršnem koli sistematičnem in obsežnem vrednotenju osebnih vidikov v zvezi s posamezniki na podlagi oblikovanja profilov teh podatkov ali po obdelavi posebnih vrst osebnih podatkov, biometričnih podatkov ali podatkov o kazenskih obsodbah in prekrških ali s tem povezanih varnostnih ukrepih. Ocena učinka v zvezi z varstvom podatkov se zahteva tudi za spremljanje javno dostopnih območij v velikem obsegu, zlasti z uporabo optično-elektronskih naprav, ali za katera koli druga dejanja, za katera pristojni nadzorni organ meni, da bo obdelava verjetno povzročila veliko tveganje za pravice in svoboščine posameznikov, na katere se nanašajo osebni podatki, zlasti ker tem posameznikom preprečujejo uresničevanje pravice ali uporabo storitve ali pogodbe ali ker se sistematično izvajajo v velikem obsegu. Obdelava osebnih podatkov se ne bi smela šteti kot obdelava v velikem obsegu, če gre za obdelavo osebnih podatkov pacientov ali strank s strani posameznega zdravnika,drugega zdravstvenega delavca ali odvetnika. V takih primerih ocena učinka v zvezi z varstvom podatkov ne bi smela biti obvezna.
(91) This should in particular apply to large-scale processing operations which aim to process a considerable amount of personal data at regional, national or supranational level and which could affect a large number of data subjects and which are likely to result in a high risk, for example, on account of their sensitivity, where in accordance with the achieved state of technological knowledge a new technology is used on a large scale as well as to other processing operations which result in a high risk to the rights and freedoms of data subjects, in particular where those operations render it more difficult for data subjects to exercise their rights. A data protection impact assessment should also be made where personal data are processed for taking decisions regarding specific natural persons following any systematic and extensive evaluation of personal aspects relating to natural persons based on profiling those data or following the processing of special categories of personal data, biometric data, or data on criminal convictions and offences or related security measures. A data protection impact assessment is equally required for monitoring publicly accessible areas on a large scale, especially when using optic-electronic devices or for any other operations where the competent supervisory authority considers that the processing is likely to result in a high risk to the rights and freedoms of data subjects, in particular because they prevent data subjects from exercising a right or using a service or a contract, or because they are carried out systematically on a large scale. The processing of personal data should not be considered to be on a large scale if the processing concerns personal data from patients or clients by an individual physician, other health care professional or lawyer. In such cases, a data protection impact assessment should not be mandatory.
(92) V nekaterih okoliščinah je razumno in gospodarno, da je predmet ocene učinka v zvezi z varstvom podatkov obširnejši in ne obsega samo enega projekta, na primer kadar nameravajo javni organi ali telesa vzpostaviti skupno platformo za uporabo ali obdelavo ali kadar namerava več upravljavcev uvesti skupno okolje za uporabo ali obdelavo v celotnem industrijskem sektorju ali njegovem delu ali za horizontalno dejavnost v široki rabi.
(92) There are circumstances under which it may be reasonable and economical for the subject of a data protection impact assessment to be broader than a single project, for example where public authorities or bodies intend to establish a common application or processing platform or where several controllers plan to introduce a common application or processing environment across an industry sector or segment or for a widely used horizontal activity.
(93) V okviru sprejetja prava držav članic, na katerem temelji opravljanje nalog javnega organa ali telesa in ki ureja zadevne posebna dejanja obdelave ali nize dejanj, lahko države članice menijo, da je treba tako oceno opraviti pred dejavnostmi obdelave.
(93) In the context of the adoption of the Member State law on which the performance of the tasks of the public authority or public body is based and which regulates the specific processing operation or set of operations in question, Member States may deem it necessary to carry out such assessment prior to the processing activities.
(EN)
Document
Article 29 Working Party, Guidelines on Data Protection Impact Assessment (DPIA) and Determining Whether Processing Is “likely to Result in a High Risk” for the Purposes of Regulation 2016/679 (2017).
CNIL, PIA Tool (2017-2020).
EDPB, Guidelines on the use of location data and contact tracing tools in the context of the COVID-19 outbreak (2020).
EDPB, Guidelines 8/2020 on the targeting of social media users (2020).
WP29, Opinion on data processing at work (2017).
European Commission, Guidance on Apps supporting the fight against COVID 19 pandemic in relation to data protection Brussels (2020).
EDPB, Guidelines 02/2021 on Virtual Voice Assistants (2021).
Case Law
CJEU, Fashion ID GmbH & Co. KG/Verbraucherzentrale NRW eV, C-40/17 (2019).
[js-disqus]
(EN) Url-link to highlighted text was copied to the clipboard!
(EN) Preparing download...
(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII processors.
Here is the relevant paragraph to articles 35(1) GDPR:
8.2.1 Customer agreement
Control
The organization should ensure, where relevant, that the contract to process PII addresses the organization’s role in providing assistance with the customer’s obligations (taking into account the nature of processing and the information available to the organization).
Implementation guidance
The contract between the organization and the customer should include the following wherever relevant, and depending on the customer’s role (PII controller or PII processor) (this list is neither definitive nor exhaustive):
(EN) […]
(EN) Sign in
to read the full text