http___firstaktiv.bg_bg_post_the-eu-general-data-protection-regulation-gdpr_1.xml
http___profabm.blogspot.com_2010_01_malaysian-data-protection-law-is.html.xml
1.1 2.1 3.1 4.1 4.2 4.3 5.1 6.1 7.1
The EU General Data Protection Regulation (GDPR) Считано то 25.05.2018г. влиза в сила Регламент (ЕС) 2016/679 във връзка със защита на физическите лица при обработката на личните им данни и относно свободното движение на такива данни Защитата на физическите лица във връзка с обработването на лични данни е основно право. Създава се фигурата на – „длъжностно лице по защита на данните“, което има консултативна и надзорна функция при администратора на лични данни, включително и да сътрудничи на надзорния орган в Р. България това Комисия за защита на личните данни. Това лице следи спазването на правните норми на Регламента в предприятието (организацията) на администратора на лични данни и обучението на персонала му, който събира, оперира, обработва, съхранява, опазва и унищожава информация, представляваща лични данни. Регламентът регулира дейността на всички администратори на лични данни, както публични органи и структури, така и търговски дружества, които обработват лични данни било то на техните клиенти или на техните служители. В перспектива ще бъде създаден Национален обучителен център за – лицата изпълняващи функцията „длъжностно лице по защита на данните“ с оглед хармонизиране на стандартите и практиката в сферата на защитата на личните данни. Регламентът създава възможност и гаранции на физическите лица да имат достъп до личните си данни при лицето, което ги обработва; право да коригира и допълва предоставените лични данни; право да ограничи обработването на личните му данни; право на преносимост на данните; право на възражение за обработване на личните данни с оглед защита правата и свободите на физическото лице; право на изтриване на лични данни – „право да бъдеш забравен“.
1.1 1.2 1.3 2.1 2.2 2.3 3.1 3.2 3.3 4.1 4.2 4.3 4.4 4.5 4.6 4.7 5.1 5.2 5.3 5.4 5.5 6.1 6.2 6.3 6.4 6.5 6.6 6.7 6.8 7.1 7.2
The European Union (EU) has adopted its 1995 Data Protection Directive (DPD). Article 25 of the DPD provides that the Member States shall provide that the transfer to a third country of personal data may only take place only if the third country in question ensures an adequate level of protection. In another words, transfer of personal data from any European country to Malaysia may only take place if there is an adequate protection afforded by the PDP Act. The European Commission has the power to make a decision of adequacy upon consultation with the Article 29 Data Protection Working Party. This Working Party has developed the Working Document: Transfers of personal data to third countries: Applying Articles 25 and 26 of the EU data protection directive (WP 12). The WP 12 assessment framework consists of two parts: content principles and procedural/enforcement requirements. Content principles sets out minimum requirements for the content of the law governing collection and processing of personal data. There are six contents principles that Malaysian PDP law should have: the purpose limitation principle, the data quality and proportionality principle, the transparency principle, the security principle, the right of access, rectification and opposition, and restrictions on onward transfers. The Malaysian PDP law does contain all these principles. In assessing the adequacy, the Working Party will also consider the scope or reach of the regime. They are divided into: (1) scope with regard to the data controller, (2) scope with regard to the data subject, (3) scope with regard to the means of processing, (4) scope with regard to the purpose of the processing operations, and (5) territorial scope. The Malaysian PDP law may not be able to satisfy scopes (1) and (4). Under the former, the data protection law of a country must apply to all entities and organizations, all data controllers within the jurisdiction: public or private, corporate and individual, actual and potential. Here lies the problem, the Malaysian PDP Act, in section 3 exempts the Federal and State Government from its application. Under the latter, the law is to be applied to all processing of personal data regardless of purpose. Again, the Malaysian PDP Act in section 2 provides that the Act only applies to the processing of personal data in respect of commercial transactions. Under the procedural and enforcement mechanisms or requirement, the WP 12 states that a system of external supervision in the form of an independent authority is a necessary feature of a data protection compliance system. In another words, there must be an independent supervisory authority to enforce the law. Under the Malaysian PDP Act, the supervisory authority is the Data Protection Commissioner (DPC). He or she will be appointed by and responsible to the Minister. Clearly, the DPC is not an independent authority. The EU is one of the Malaysia’s largest trading partners. The total trade in 2008 alone amounted to USD41.0 billion. Free flow of personal data can further facilitate and stimulate trade and investment. The enactment of the PDP law is the best opportunity for Malaysia to achieve that. This very brief assessment, however, indicates that the PDP Act does not pass the EU’s adequacy requirement test. What is the implication? Transfers of personal data may still take place provided that the originating party takes additional measures to ensure that the data is adequately protected in Malaysia. It is a missed opportunity. As the adviser to the Government of Malaysia on data protection, it is my duty to ensure that the PDP Law is in line with the international norms and standards, including the standards set by the EU DPD. However, I have been advised that the issues mentioned above are policy matters that could not be changed.