http___www.ipri-zavod.si_hr_gdpr_37-clanak-gdpr__1.xml
1.1 2.1 2.2 3.1 3.2 3.3 3.4 4.1 4.2 4.3 5.1 6.1 7.1 8.1 9.1 10.1 11.1 11.2 11.3 11.4 11.5 12.1 12.2 13.1 14.1 15.1 15.2 15.3 16.1 17.1 18.1 19.1 20.1 20.2 21.1 21.2 22.1 22.2 23.1 23.2 24.1 24.2 25.1 25.2 26.1 26.2 27.1 27.2 28.1 28.2
As mentioned in our previous GDPR update, the fifth update in this series will deal with how an employer processes sensitive personal data which are now known as ‘special categories’ of personal data under the GDPR. For the purposes of the GDPR, sensitive personal data include information in relation to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique id purposes, data concerning health or sex life or sexual orientation. Interestingly for employers, the definition of sensitive personal data includes the processing of employee personal data relating to his or her membership of a trade union. It is important to note that the processing of all personal data (regardless of whether it is sensitive personal data or not) requires a legal basis for processing. There are six legal bases set out in the GDPR. Examples of these legal bases include having the consent of the data subject or where the processing is necessary for the performance of a contract. At least one legal basis is required when processing any kind of personal data. When it comes to processing sensitive personal data however, an employer will need to satisfy at least one additional condition in order to process the data. There are ten of these additional conditions from which to choose. If an employer cannot meet any one of the ten additional conditions, they will be legally prohibited from processing the sensitive personal data. The ten additional conditions for processing sensitive personal data include where: - the employee has given explicit consent to the processing; - the processing is necessary in connection with rights and obligations under employment, social security and social protection law; - the data are manifestly made public by the employee; - the processing is necessary for the establishment, exercise or defense of legal claims; or - the processing is necessary for reasons of substantial public interest, and the employer provides suitable measures to safeguard the employee’s rights. The term ‘explicit’ consent above refers to the way consent is expressed by an employee. It means that the employee must give an express statement of consent. An obvious way to make sure consent is explicit would be to expressly confirm consent in a written statement. European guidance also suggests ‘two stage verification’ as a way to make sure explicit consent is valid, eg a verification link must be clicked to clearly signify consent. Keep in mind however, as discussed in our previous GDPR update, that it is difficult for employers to rely on the consent of employees to process their personal data generally. In light of the GDPR, it is important for employers to examine the basis upon which sensitive personal data are processed. Employers should ask themselves if the processing: - satisfies one of the six legal bases for processing personal data, and - meets at least one of the additional ten conditions required for sensitive personal data. This might be a good time for employers to examine all the sensitive personal data relating to employees that they process. Employers should examine the purpose for which the sensitive personal data are obtained and, importantly, be able to demonstrate that all the requirements of the GDPR for processing sensitive personal data are met. Given the tight restrictions, it is inevitable that over time employers will simply hold less and less sensitive data. Having considered the requirements for sensitive personal data under the GDPR, our next update will examine privacy considerations in the workplace and how far an employer can go to protect their workplace. Matheson Employment Law Podcast series. This update was co-authored by Aisling Parkinson, Senior Associate in the Employment Practice, Finín O'Brien, Associate in the Technology and Innovation Group and Tina O'Sullivan, Solicitor in the Employment Practice. Read further updates in this series: The GDPR Countdown: Employers are you Ready? – Penalties The GDPR Countdown: Employers are you Ready? – Mandatory Breach Notifications to the DPC The GDPR Countdown: Employers are you Ready? – Data Access Requests The GDPR Countdown: Employers are you Ready? – Hiring a Data Protection Officer The GDPR Countdown: Employers are you Ready? – Workplace Privacy The GDPR Countdown: Employers are you Ready? – Consent The GDPR Countdown: Employers are you Ready? – Employment Documentation The GDPR Countdown: Employers are you Ready? - Employee Records and Retention Periods The GDPR Countdown: Employers Are You Ready? - Key Elements of GDPR
1.1 2.1 3.1 4.1 5.1 6.1 7.1 8.1 9.1 10.1 10.2 11.1 12.1 12.2
Tko je obvezan izraditi Službenika za zaštitu podataka trebaju imenovati voditelji i izvršitelji obrade podataka kad: - obradu provodi tijelo javne vlasti ili javno tijelo, - se osnovne djelatnosti voditelja ili izvršitelja obrade sastoje od postupaka obrade koji zbog svoje prirode, opsega ili svrha iziskuju redovito praćenje ispitanika u velikoj mjeri, - se osnovne djelatnosti voditelja ili izvršitelja obrade sastoje od opsežne obrade osjetljivih osobnih podataka (zdravstveni podatki, rasno ili etničko podrijetlo, politička mišljenja, vjerska ili filozofska uvjerenja, članstvo u sindikatu, genetski podatci, biometrijski podatci, podatci o kažnjavanosti i prekršajima itd.) Što uključuje Službenik za zaštitu podataka obavlja najmanje sljedeće zadaće: - informiranje i savjetovanje voditelja obrade ili izvršitelja obrade te zaposlenika koji obavljaju obradu o njihovim obvezama iz GDPR te drugim odredbama Unije ili države članice o zaštiti podataka, - praćenje poštovanja GDPR te drugih odredaba Unije ili države članice o zaštiti podataka i politika voditelja obrade ili izvršitelja obrade u odnosu na zaštitu osobnih podataka, uključujući raspodjelu odgovornosti, podizanje svijesti i osposobljavanje osoblja koje sudjeluje u postupcima obrade te povezane revizije, - pružanje savjeta, kada je to zatraženo, u pogledu procjene učinka na zaštitu podataka i praćenje njezina izvršavanja u skladu s člankom 35. GDPR, - suradnja s nadzornim tijelom, - djelovanje kao kontaktna točka za nadzorno tijelo o pitanjima u pogledu obrade, što uključuje i prethodno savjetovanje iz članka 36. GDPR te savjetovanje, prema potrebi, o svim drugim pitanjima.