http___www.knjiznica-nasice.hr_zastita-osobnih-podataka__1.xml
1.1 1.2 2.1 2.2 2.3 3.1 3.2 4.1 4.2 4.3 4.4 4.5 4.6 4.7 5.1 5.2 6.1 6.2 7.1 7.2 8.1 8.2 8.3 9.1 9.2 9.3 10.1 10.2 11.1 11.2 12.1 12.2 12.3 13.1 13.2 14.1 14.2 15.1 16.1 16.2 16.3 17.1 17.2 18.1 19.1 20.1 21.1 21.2 22.1 22.2 23.1 23.2 24.1 24.2 25.1 26.1 27.1 27.2 27.3 27.4 27.5 27.6 27.7 27.8 27.9 27.10
Law and the regulatory authority, scope, Legitimate processing of PII and other related questions about Data Data Protection & Privacy in Lithuania answered. Below are the first 10 answers from total 42, appeared in the publication of Getting the Deal Through – Data Protection & Privacy 2018, including Update and trends. Summarise the legislative framework for the protection of personally identifiable information (PII). Does your jurisdiction have a dedicated data protection law? Is the data protection law in your jurisdiction based on any international instruments on privacy or data protection (for example, the OECD guidelines, Directive 95/46/EC, the EU General Data Protection Regulation or the European Convention on Human Rights and Fundamental Freedoms)? Data protection in Lithuania is governed by Law on Legal Protection of Personal Data of the Republic of Lithuania (hereinafter referred to as LPPDL). The LPPDL is substantially based on the European Union (hereinafter referred to as EU) Data Privacy Directive 95/46/EC. It is necessary to pay attention to the current changes of data protection regulation. The European Parliament and the Council have released the regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as regulation 2016/679) that come into force from 25 May 2018. The regulation 2016/679 is a direct application document and from mentioned date in all the Member States of the EU will have the same power. In Lithuania, in addition, certain aspects will be discussed in the new version of the LPPDL. At this moment the Ministry of Justice of the Republic of Lithuania has submitted a draft of the LPPDL to the institutions and the public. It is expected that the new version of the LPPDL will come into force from 25 May 2018. Taking into account that it is only a draft of the new version of the LPPDL submitted, the answers bellow are based on the current version of the LPPDL. Which authority is responsible for overseeing the data protection law? Describe the investigative powers of the authority (in particular any powers to require information, or carry out audits or inspections). The Lithuanian data protection authority is the State Data Protection Inspectorate (SDPI). The SDPI shall have the right to: Can breaches of data protection law lead to administrative sanctions or orders, or criminal penalties? How would such breaches be handled? The breaches of rules stipulated by the LPPDL may result in administrative liability. The SDPI shall have the right to draw up records of administrative offences. Breaches may be fined. Also illegal collection of information about the person's private life or disclosure and use of this type of information may result in criminal liability. These breaches are punished by imprisonment for a maximum period of three years, or arrest, or restriction of liberty, or a fine, or community service. Offences such as disclosure and use of information about the person's private life are only prosecuted if a formal complaint is filed by the affected data subject or his legitimate representative or there is a request of the prosecutor. Moreover, according to LPPDL, any person who has sustained damage as a result of unlawful processing of personal data or any other acts (omissions) by the data controller, the data processor or other persons violating the provisions of this Law shall be entitled to claim compensation for pecuniary and non-pecuniary damage caused to him/her. The extent of pecuniary and non-pecuniary damage shall be determined by a court. Does the data protection law cover all sectors and types of organisation or are some areas of activity (such as national security or policing) outside its scope? (Give details.) The LPPDL provides for certain exceptions (there are entities or areas of activity to which it does not apply). The LPPDL shall not apply if personal data are processed by a natural person only for his personal needs not related to business or profession, also shall not apply to the processing of personal data of deceased persons. When personal data are processed for the purposes of state security or defence, the LPPDL shall apply to the extent that other laws do not provide otherwise. Does the data protection law cover interception of communications, electronic marketing or monitoring and surveillance of individuals? If not, list other relevant laws in this regard. The LPPDL do not wholly cover interception of communications, electronic marketing or monitoring and surveillance of individuals. Relevant laws in this regard are: the Law on Electronic Communications of the Republic of Lithuania, the Law on Cybersecurity of the Republic of Lithuania. Identify any further laws or regulations that provide specific data protection rules for related areas (for example, rules on e-health records, the use of social media or credit information)? The Law on Mass Media of the Republic of Lithuania contains rules that apply to protection of personal data which are used for mass media purposes. The Civil Code of the Republic of Lithuania and other health’s care acts contain special rules for protection of information about patient’s health. The Law on Legal Protection of Personal Data Processed in the Framework of Police and Judicial Co-operation in Criminal Matters contains regulation of personal data processing during police and judicial co-operation in criminal matters. What forms of PII are covered by the law? (Does the law cover all PII or is its scope limited by format, for example, electronic records only?) The LPPDL shall regulate relations arising in the course of the processing of personal data by automatic means, and during the processing of personal data by other than automatic means in filing systems: lists, card indexes, files, codes, etc. Is the reach of the law limited to PII owners and processors of PII established or operating in the jurisdiction? The LPPDL is applicable when: Is all processing or use of PII covered? Is a distinction made between those who control or own PII and those who provide PII processing services to owners? Basically all processing or use of PII is covered by the LPPDL, other laws provide for more detailed provisions for specific sectors and types of organisation or some areas of activity (see questions 4 and 5). There is also a distinction between the data controller (a legal or a natural person which alone or jointly with others determines the purposes and means of processing personal data) and data processor (a legal or a natural person other than an employee of the data controller, processing personal data on behalf of the data controller). Does the law require that the holding of PII be legitimised on specific grounds, for example to meet the owner’s legal obligations or if the individual has provided consent? (Give details.) Lithuanian legal regulation requires that the holding of PII has specific legal ground for processing of personal data. According to the LPPDL personal data may be processed if: For special categories of personal data (data concerning racial or ethnic origin of a natural person, his political opinions or religious, philosophical or other beliefs, membership in trade unions, and his health, sexual life and criminal convictions) LPPDL stipulates stricter grounds. Are there any emerging trends or hot topics in international data protection in your jurisdiction? The European Parliament and the Council have released the regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as regulation 2016/679) that come into force from 25 May 2018. The regulation 2016/679 is a direct application document and from mentioned date in all the Member States of the EU will have the same power. In Lithuania, in addition, certain aspects will be discussed in the new version of the LPPDL. At this moment the Ministry of Justice of the Republic of Lithuania has submitted a draft of the LPPDL to the institutions and the public. It is expected that the new version of the LPPDL will come into force from 25 May 2018. The new version of the LPPDL establishes the peculiarities of certain aspects of personal data processing, also the legal basis and activities of the SDPI and other state institutions, which form the state policy in the field of personal data protection and monitor the application of Regulation 2016/679. Moreover, in the new national legal regulation procedure for investigating violations and imposing administrative penalties by the supervisory authority is set. The new version of the LPPDL also establishes stricter personal code management rules. A personal code can not be used as the sole search criteria for searching other personal data. This requirement is considered as one of the data security measures to ensure that personal data is not disclosed to other persons.
1.1 2.1 2.2 3.1 4.1 5.1 6.1 7.1 8.1 8.2 10.1
Zaštita osobnih podataka Općom uredbom (EU) 2016/679 Europskog parlamenta i vijeća o zaštiti pojedinca u vezi s obradom osobnih podataka i o slobodnom kretanju takvih podataka te o stavljanju izvan snage Direktive 95/46/EZ (Opća uredba o zaštiti podataka) uređuje se zaštita osobnih podataka o fizičkim osobama te nadzor nad prikupljanjem, obradom i korištenjem osobnih podataka. Svrha zaštite osobnih podataka je zaštita privatnog života i ostalih ljudskih prava i temeljnih sloboda u prikupljanju, obradi i korištenju osobnih podataka. Zaštita osobnih podataka u Republici Hrvatskoj osigurana je svakoj fizičkoj osobi bez obzira na državljanstvo i prebivalište te neovisno o rasi, boji kože, spolu, jeziku, vjeri, političkom ili drugom uvjerenju, nacionalnom ili socijalnom podrijetlu, imovini, rođenju, naobrazbi, društvenom položaju ili drugim osobinama. Hrvatska narodna knjižnica i čitaonica Našice kao voditelj obrade osobnih podataka, sa osobnim podacima postupa sukladno propisima koji uređuju područje zaštite osobnih podataka uz primjenu odgovarajućih tehničkih i sigurnosnih mjera, zaštite osobnih podataka od neovlaštenog pristupa, zlouporabe, otkrivanja, gubitka ili uništenja. Službenik za zaštitu osobnih podataka Hrvatske narodne knjižnice i čitaonice Našice: Mirta Lulić, dipl.knjižničarka i prof.hrv.jezika i književnosti Trg dr. Franje Tuđmana 5, e-mail: knjiznica.nasice@gmail.com