interactive GDPR 2016/0679 EN
BG CS DA DE EL EN ES ET FI FR GA HR HU IT LV LT MT NL PL PT RO SK SL SV print pdf
- 1 Article 13 Information to be provided where personal data are collected from the data subject
- 1 Article 14 Information to be provided where personal data have not been obtained from the data subject
- 2 Article 30 Records of processing activities
- 2 Article 49 Derogations for specific situations
- 8 Article 62 Joint operations of supervisory authorities
- 1 Article 65 Dispute resolution by the Board
- personal data
- processing
- restriction of processing
- profiling
- pseudonymisation
- filing system
- controller
- processor
- recipient
- third party
- consent
- personal data breach
- genetic data
- biometric data
- data concerning health
- main establishment
- representative
- enterprise
- group of undertakings
- binding corporate rules
- supervisory authority
- supervisory authority concerned
- cross-border processing
- relevant and reasoned objection
- information society service
- international organisation
- shall 51
- data 46
- controller 42
- subject 39
- personal_data 39
- referred 38
- supervisory_authority 30
- processing 30
- decision 28
- article 27
- which 22
- information 19
- transfer 19
- article 17
- paragraph 17
- board 16
- applicable 16
- member state 14
- from 13
- including 13
- the 12
- categories 12
- third 11
- case 11
- member 11
- authorities 10
- paragraph 10
- subparagraph 10
- such 10
- processor 10
- provide 10
- international_organisation 9
- right 9
- supervisory 9
- safeguards 9
- necessary 9
- joint 9
- country 9
- been 9
- further 8
- point 8
- legitimate 8
- transfers 8
- members 8
- second 8
- staff 8
- concerned 8
- following 8
- well 8
- interests 8
Article 13
Information to be provided where personal_data are collected from the data subject
1. Where personal_data relating to a data subject are collected from the data subject, the controller shall, at the time when personal_data are obtained, provide the data subject with all of the following information:
| (a) | the identity and the contact details of the controller and, where applicable, of the controller's representative; |
| (b) | the contact details of the data protection officer, where applicable; |
| (c) | the purposes of the processing for which the personal_data are intended as well as the legal basis for the processing; |
| (d) | where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third_party; |
| (e) | the recipients or categories of recipients of the personal_data, if any; |
| (f) | where applicable, the fact that the controller intends to transfer personal_data to a third country or international_organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available. |
2. In addition to the information referred to in paragraph 1, the controller shall, at the time when personal_data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing:
| (a) | the period for which the personal_data will be stored, or if that is not possible, the criteria used to determine that period; |
| (b) | the existence of the right to request from the controller access to and rectification or erasure of personal_data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability; |
| (c) | where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; |
| (d) | the right to lodge a complaint with a supervisory_authority; |
| (e) | whether the provision of personal_data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal_data and of the possible consequences of failure to provide such data; |
| (f) | the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. |
3. Where the controller intends to further process the personal_data for a purpose other than that for which the personal_data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2.
4. Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information.
Article 14
Information to be provided where personal_data have not been obtained from the data subject
1. Where personal_data have not been obtained from the data subject, the controller shall provide the data subject with the following information:
| (a) | the identity and the contact details of the controller and, where applicable, of the controller's representative; |
| (b) | the contact details of the data protection officer, where applicable; |
| (c) | the purposes of the processing for which the personal_data are intended as well as the legal basis for the processing; |
| (d) | the categories of personal_data concerned; |
| (e) | the recipients or categories of recipients of the personal_data, if any; |
| (f) | where applicable, that the controller intends to transfer personal_data to a recipient in a third country or international_organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means to obtain a copy of them or where they have been made available. |
2. In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject:
| (a) | the period for which the personal_data will be stored, or if that is not possible, the criteria used to determine that period; |
| (b) | where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third_party; |
| (c) | the existence of the right to request from the controller access to and rectification or erasure of personal_data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability; |
| (d) | where processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; |
| (e) | the right to lodge a complaint with a supervisory_authority; |
| (f) | from which source the personal_data originate, and if applicable, whether it came from publicly accessible sources; |
| (g) | the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. |
3. The controller shall provide the information referred to in paragraphs 1 and 2:
| (a) | within a reasonable period after obtaining the personal_data, but at the latest within one month, having regard to the specific circumstances in which the personal_data are processed; |
| (b) | if the personal_data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject; or |
| (c) | if a disclosure to another recipient is envisaged, at the latest when the personal_data are first disclosed. |
4. Where the controller intends to further process the personal_data for a purpose other than that for which the personal_data were obtained, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2.
5. Paragraphs 1 to 4 shall not apply where and insofar as:
| (a) | the data subject already has the information; |
| (b) | the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available; |
| (c) | obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject's legitimate interests; or |
| (d) | where the personal_data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy. |
Article 30
Records of processing activities
1. Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility. That record shall contain all of the following information:
| (a) | the name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer; |
| (b) | the purposes of the processing; |
| (c) | a description of the categories of data subjects and of the categories of personal_data; |
| (d) | the categories of recipients to whom the personal_data have been or will be disclosed including recipients in third countries or international_organisations; |
| (e) | where applicable, transfers of personal_data to a third country or an international_organisation, including the identification of that third country or international_organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards; |
| (f) | where possible, the envisaged time limits for erasure of the different categories of data; |
| (g) | where possible, a general description of the technical and organisational security measures referred to in Article 32(1). |
2. Each processor and, where applicable, the processor's representative shall maintain a record of all categories of processing activities carried out on behalf of a controller, containing:
| (a) | the name and contact details of the processor or processors and of each controller on behalf of which the processor is acting, and, where applicable, of the controller's or the processor's representative, and the data protection officer; |
| (b) | the categories of processing carried out on behalf of each controller; |
| (c) | where applicable, transfers of personal_data to a third country or an international_organisation, including the identification of that third country or international_organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards; |
| (d) | where possible, a general description of the technical and organisational security measures referred to in Article 32(1). |
3. The records referred to in paragraphs 1 and 2 shall be in writing, including in electronic form.
4. The controller or the processor and, where applicable, the controller's or the processor's representative, shall make the record available to the supervisory_authority on request.
5. The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal_data relating to criminal convictions and offences referred to in Article 10.
Article 49
Derogations for specific situations
1. In the absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, including binding_corporate_rules, a transfer or a set of transfers of personal_data to a third country or an international_organisation shall take place only on one of the following conditions:
| (a) | the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards; |
| (b) | the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject's request; |
| (c) | the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person; |
| (d) | the transfer is necessary for important reasons of public interest; |
| (e) | the transfer is necessary for the establishment, exercise or defence of legal claims; |
| (f) | the transfer is necessary in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent; |
| (g) | the transfer is made from a register which according to Union or Member State law is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest, but only to the extent that the conditions laid down by Union or Member State law for consultation are fulfilled in the particular case. |
Where a transfer could not be based on a provision in Article 45 or 46, including the provisions on binding_corporate_rules, and none of the derogations for a specific situation referred to in the first subparagraph of this paragraph is applicable, a transfer to a third country or an international_organisation may take place only if the transfer is not repetitive, concerns only a limited number of data subjects, is necessary for the purposes of compelling legitimate interests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject, and the controller has assessed all the circumstances surrounding the data transfer and has on the basis of that assessment provided suitable safeguards with regard to the protection of personal_data. The controller shall inform the supervisory_authority of the transfer. The controller shall, in addition to providing the information referred to in Articles 13 and 14, inform the data subject of the transfer and on the compelling legitimate interests pursued.
2. A transfer pursuant to point (g) of the first subparagraph of paragraph 1 shall not involve the entirety of the personal_data or entire categories of the personal_data contained in the register. Where the register is intended for consultation by persons having a legitimate interest, the transfer shall be made only at the request of those persons or if they are to be the recipients.
3. Points (a), (b) and (c) of the first subparagraph of paragraph 1 and the second subparagraph thereof shall not apply to activities carried out by public authorities in the exercise of their public powers.
4. The public interest referred to in point (d) of the first subparagraph of paragraph 1 shall be recognised in Union law or in the law of the Member State to which the controller is subject.
5. In the absence of an adequacy decision, Union or Member State law may, for important reasons of public interest, expressly set limits to the transfer of specific categories of personal_data to a third country or an international_organisation. Member States shall notify such provisions to the Commission.
6. The controller or processor shall document the assessment as well as the suitable safeguards referred to in the second subparagraph of paragraph 1 of this Article in the records referred to in Article 30.
Article 62
Joint operations of supervisory authorities
1. The supervisory authorities shall, where appropriate, conduct joint operations including joint investigations and joint enforcement measures in which members or staff of the supervisory authorities of other Member States are involved.
2. Where the controller or processor has establishments in several Member States or where a significant number of data subjects in more than one Member State are likely to be substantially affected by processing operations, a supervisory_authority of each of those Member States shall have the right to participate in joint operations. The supervisory_authority which is competent pursuant to Article 56(1) or (4) shall invite the supervisory_authority of each of those Member States to take part in the joint operations and shall respond without delay to the request of a supervisory_authority to participate.
3. A supervisory_authority may, in accordance with Member State law, and with the seconding supervisory_authority's authorisation, confer powers, including investigative powers on the seconding supervisory_authority's members or staff involved in joint operations or, in so far as the law of the Member State of the host supervisory_authority permits, allow the seconding supervisory_authority's members or staff to exercise their investigative powers in accordance with the law of the Member State of the seconding supervisory_authority. Such investigative powers may be exercised only under the guidance and in the presence of members or staff of the host supervisory_authority. The seconding supervisory_authority's members or staff shall be subject to the Member State law of the host supervisory_authority.
4. Where, in accordance with paragraph 1, staff of a seconding supervisory_authority operate in another Member State, the Member State of the host supervisory_authority shall assume responsibility for their actions, including liability, for any damage caused by them during their operations, in accordance with the law of the Member State in whose territory they are operating.
5. The Member State in whose territory the damage was caused shall make good such damage under the conditions applicable to damage caused by its own staff. The Member State of the seconding supervisory_authority whose staff has caused damage to any person in the territory of another Member State shall reimburse that other Member State in full any sums it has paid to the persons entitled on their behalf.
6. Without prejudice to the exercise of its rights vis-à-vis third parties and with the exception of paragraph 5, each Member State shall refrain, in the case provided for in paragraph 1, from requesting reimbursement from another Member State in relation to damage referred to in paragraph 4.
7. Where a joint operation is intended and a supervisory_authority does not, within one month, comply with the obligation laid down in the second sentence of paragraph 2 of this Article, the other supervisory authorities may adopt a provisional measure on the territory of its Member State in accordance with Article 55. In that case, the urgent need to act under Article 66(1) shall be presumed to be met and require an opinion or an urgent binding decision from the Board pursuant to Article 66(2).
Article 65
Dispute resolution by the Board
1. In order to ensure the correct and consistent application of this Regulation in individual cases, the Board shall adopt a binding decision in the following cases:
| (a) | where, in a case referred to in Article 60(4), a supervisory_authority concerned has raised a relevant_and_reasoned_objection to a draft decision of the lead authority or the lead authority has rejected such an objection as being not relevant or reasoned. The binding decision shall concern all the matters which are the subject of the relevant_and_reasoned_objection, in particular whether there is an infringement of this Regulation; |
| (b) | where there are conflicting views on which of the supervisory authorities concerned is competent for the main_establishment; |
| (c) | where a competent supervisory_authority does not request the opinion of the Board in the cases referred to in Article 64(1), or does not follow the opinion of the Board issued under Article 64. In that case, any supervisory_authority concerned or the Commission may communicate the matter to the Board. |
2. The decision referred to in paragraph 1 shall be adopted within one month from the referral of the subject-matter by a two-thirds majority of the members of the Board. That period may be extended by a further month on account of the complexity of the subject-matter. The decision referred to in paragraph 1 shall be reasoned and addressed to the lead supervisory_authority and all the supervisory authorities concerned and binding on them.
3. Where the Board has been unable to adopt a decision within the periods referred to in paragraph 2, it shall adopt its decision within two weeks following the expiration of the second month referred to in paragraph 2 by a simple majority of the members of the Board. Where the members of the Board are split, the decision shall by adopted by the vote of its Chair.
4. The supervisory authorities concerned shall not adopt a decision on the subject matter submitted to the Board under paragraph 1 during the periods referred to in paragraphs 2 and 3.
5. The Chair of the Board shall notify, without undue delay, the decision referred to in paragraph 1 to the supervisory authorities concerned. It shall inform the Commission thereof. The decision shall be published on the website of the Board without delay after the supervisory_authority has notified the final decision referred to in paragraph 6.
6. The lead supervisory_authority or, as the case may be, the supervisory_authority with which the complaint has been lodged shall adopt its final decision on the basis of the decision referred to in paragraph 1 of this Article, without undue delay and at the latest by one month after the Board has notified its decision. The lead supervisory_authority or, as the case may be, the supervisory_authority with which the complaint has been lodged, shall inform the Board of the date when its final decision is notified respectively to the controller or the processor and to the data subject. The final decision of the supervisory authorities concerned shall be adopted under the terms of Article 60(7), (8) and (9). The final decision shall refer to the decision referred to in paragraph 1 of this Article and shall specify that the decision referred to in that paragraph will be published on the website of the Board in accordance with paragraph 5 of this Article. The final decision shall attach the decision referred to in paragraph 1 of this Article.
whereas
dal 2004 diritto e informatica