The rules applicable to the 28th of December, 2015, for the collection and processing of personal data and personal data are no longer available in the 2016
The rule is that the processing of your personal data, to draw the operator's obligation to notify the National Supervisory Authority for the Processing of Personal Data (DPA). Explain in what ways it has transformed the requirement for the notification of personal data, the right, the exception in the wake of the Decision of the president of the national data protection authority no. 200 / 2015.
Who's still under the obligation to notify the supervisory authority in 2016?
According to the law indicated, to any entity, such as a society, NGOS, public institutions, self-employed individual, organization, government, etc., which collects and tracks the processing of personal data of those that are detailed below, has the obligation to notify the national data protection authority.
1. The processing of personal data and personal data relating to your racial or ethnic origin, political opinions, religious, philosophical or of a similar nature, membership of a trade union, and the state of your health or your sex life
I mean, the processing of the data, which can generate the discrimination of the data subject. It is a goal that requires operators to notify the national data protection authority for the protection of constitutional rights of citizens, as guaranteed by art. 4 (2) of the Constitution.
This goal is aimed at operators who are carrying out activities in the field of health care, the provision of the services, attempt to market the census bureau, the insurers, the companies in which they have organized trade unions, etc.
2. The processing of your personal data, genetic and biometric
Research and development in the field of health, to entities other than the authorities of the public who manage and keep track of the population, as of 2015, the requirement to notify the national supervisory authority, in so far as the processing of such personal data.
3. All personal data to allow, either directly or indirectly, of the geographic location of individuals by means of electronic communication
Providers of telecommunication services are the main economic operators affected by the introduction of this criterion. In addition to the foregoing, there can also be taken into account, and the service providers of taxi services that are using the means of the location of customers for the business, to the extent that, outside of the location of the persons to be provided shall bear, and the identity (name, name and any other personal information that could lead to the identification).
4. On the commission of the offence by the person concerned, or the conviction of the criminal, security measures, or administrative penalties or fines imposed on the person concerned, be performed by an entity governed by private law
Centralize it into a database of persons who have committed criminal offences and/or who have been convicted or against whom action has been taken for safety as well as the detention, remand in custody, house arrest, or measures, fines, orders, any person, no matter if they are engaged in an economic activity, to notify the national data protection authority.
5. The processing of your personal data, by electronic means,
It brings together two broad categories: those who issue e-invoices in the meaning of the a new tax Code and engaged in e-commerce. In principle, all activities are carried out by using electronic means – by electronic, network, cable, optical fibre, radio, tv, and the like, are used for processing, storage or transmission of information, and which involve the processing of your personal data, they shall require the persons who engage in such activities, the notification to the supervisory authority.
The beach, the people, who have the status of the controller of the personal data is thereby extended to all companies that manage online stores and platforms that are in digital, ending the policy of insurance, by electronic means, using tools, electronic payment, etc.
6. Processing, with the aim of monitoring and/or evaluation of some aspects of your personality, as well as the professional competence, credibility, behavior, and other such
The criterion for the above mentioned aim, apparently agencies, recruitment of the labor force. The skyline is expanding, however, the educational institutions, and employers, regardless of the area in which the activity takes place, and regardless of the methods used for the collection and aggregation of information mentioned above.
7. The processing of your personal data, by electronic means and within the framework of the systems, leading to the adoption of automated decisions in individual, in conjunction with the analysis of the creditworthiness, of the economic and financial situation, the facts of which are likely to entail the responsibility of disciplinary, administrative or criminal liability of the natural persons, by a private entity
Inevitably, the obligation to notify the supervisory authority should be kept in the charge of the offices of the credit and all of the other systems, such as credit bureaus.
8. The processing of the personal data of a child, carried out within the framework of the activities of direct marketing
Both the companies which are the primary activity is advertising the deployment of marketing campaigns and other advertising services, in order to attract and retain customers, having reached the age of 18 years of age, and the recipients of such services, and only to the extent that the databases are provided for the case of the latter, or they will be taken from them at the end of the ad campaign.
9. The processing of personal data of minors is carried out by means of the internet or e-mail
The administrators of the web sites that require user information to determine the age and identity, as well as all of the people who carry out the activities of the e-commerce one of the most mentioned in section 5, and not only, of which the beneficiaries are the persons who have not attained 18 years of age, and for which the information is butter that is collected for the processing of your personal data.
The main economic operators concerned are those who are carrying out activities in the field of gaming and film productions for the adults, both through the online media.
10. The processing of personal data related to racial or ethnic origin, political, religious, philosophical or similar beliefs, trade union membership, as well as data regarding the state of health and sex life of its own members, carried out by associations, foundations or any other organizations without patrimonial purpose exclusively in order to achieve the specifics of the organization's activity, to the extent that the data is disclosed to third parties without the consent of the person concerned
This goal is in sight, associations, foundations, trade unions, employers ' associations, and other organizations, and only to the extent to which they are put at the disposal of the above-mentioned information to third parties without seeking the express consent of the data subject. The consent of the persons concerned shall not be deemed to be valid, obtained as long as the data subject is not provided in advance, with information such as:
(i) the personal data is transmitted to the effective
(ii) the identity of the third parties to which you send your data
(iii) the category of participants within the framework of the third parties to whom the data is transmitted,
(iv) the specific arrangements for the exercise of the right to access, the right of opposition and in relation to third parties and organizations are providing.
If the consent of the data subject is obtained by the achievement of the cumulative conditions are specified, the notification to the supervisory authority regarding the processing of your personal data is no longer required to be made by these entities, however, it is possible that the notification requirement to be fulfilled in your pregnancy to the third parties who receive the data.
When the law obliges certain entities to process the personal data detailed above, notifying ANSPDCP is no longer mandatory.
However, regardless of the processing of your personal data, carried out, or the basis on which the data are collected and processed and the notification to the supervisory authority exists in all cases in which personal data is transferred to countries outside of the European Union, the European Economic Area, as well as to the member states for which the European Commission does not recognize them, by the decision to an adequate level of protection.
Prior to the issuance of the Decision no. 200/2015 by the president of the national supervisory authority, the processing of the personal data, the categories below, we grant the operators of the obligation to notify the supervisory authority of the following conditions:
- when the processing of personal data relating to the complainants, it was carried out by the authorities and the institutions of the state and local governments, decentralized public services of the ministries and other central bodies, national companies and societies, trading companies for the interest of the county or local level, and the state-owned enterprises, in order to meet the requirements of the law;
- when the processing of personal data referring to their own employees, and outside collaborators, and it was carried out by the entities of public law and private law, in order to meet the requirements of the law;
- when the processing of the personal data is related to the owners or tenants of a building used in common, and it is made to homeowner associations or to the tenant in the enjoyment of the rights and obligations laid down by law, for the purpose of the administration of that property;
- when the processing is to have the sole purpose is the keeping of a register intended, by law, to inform the public and open to consultation either by the public in general or by any person who tries out for a legitimate interest, provided that the processing is limited to the data that is strictly necessary for the keeping of the register, said.
The same law also repealed the simplified notification procedure for the processing of your personal data.
