http___www.iusinfo.hr_DailyContent_Topical.aspx_id_36153_1.xml
1.1 1.2 2.1 3.1 4.1 5.1 6.1 7.1 8.1 9.1 9.2 9.3 9.4 9.5 10.1 10.2 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 19.2 20.1 20.2 21.1 21.2
Azraoui, M. Önen, R. Molva, “Framework for Searchable Encryption with SQL Databases”, Conference CLOSER 2018, 19-21 March 2018, Medeira, Portugal. [Conference website http://closer.scitevents.org/] Legal Guidelines - Glossary of Terms Definitions Means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. "Special categories of data" or "sensitive data" is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation. Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Data quality principles Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. The data protection regime provides an exhaustive list of six legal grounds based on which personal data may be processed. The most common one is consent. Consent must be unambiguous (leaving no doubt to data subject as to the content of his or her consent), freely given (the data subject is able to exercise a real choice without risk of deception, intimidation, coercion or significant negative consequences if he or she does not consent), specific (intelligible and referring precisely to a well-defined, concrete situation of data processing) and informed (consent made by the data subject based upon an appreciation and understanding of the facts and implications of an action). For the processing of special categories of data, the conditions are stricter. Personal data must be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes. Further processing is exceptionally allowed for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes. The processing of personal data should be limited to data that are adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed - data collection is strictly limited to the information that is directly relevant for the specific purposes of the processing. Personal data must be accurate and kept up to date: personal data that are inaccurate, having regard to the purposes for which they are processed, must be erased or rectified without delay. Personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. Personal data must be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures. Data subject’s rights Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with information on the controller and information on the processing of the personal data itself. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and information on the processing. The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her and the controller shall have the obligation to erase the personal data without undue delay. The right to erasure is subject to specific conditions, such as where the data are no longer necessary for the purpose, consent is withdrawn or there is a legal obligation and it does not apply where the processing if necessary for specific situations such as for exercising the right of freedom of expression and information. The data subject shall have the right to obtain from the controller the restriction of processing under specific conditions, such as when the accuracy of the personal data is contested by the data subject. In other words, the controller shall refrain from processing the personal data until the ground of restriction is resolved. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format. Furthermore, he or she shall have the right to transmit those data to another controller without hindrance from the initial controller to which the personal data have been provided where the processing is based on consent or contract.
1.1 1.2 2.1 3.1 3.2 3.3 3.4 3.5 4.1 5.1 5.2 6.1 7.1 7.2 8.1 9.1 9.2 9.3 10.1 11.1 11.2 12.1 13.1 13.2 13.3 14.1 15.1 15.2 15.3 16.1 17.1 17.2 17.3 17.4 18.1
S obzirom na društvo brzog tehnološkog razvoja, opseg prikupljanja i razmjene osobnih podataka značajno se povećava. Kako bi pojedinci imali mogućnost što kvalitetnijeg nadzora nad vlastitim osobnim podacima, Opća uredba o zaštiti podataka u svom trećem poglavlju detaljno određuje prava ispitanka u cilju ostvarenja djelotvorne zaštite vlastitih osobnih podataka. Pravo na informiranje U člancima 12. do 14. Uredbe određeno je da ispitanik ima pravo saznati sve informacije od voditelja obrade u vezi prikupljanja njegovih osobnih podataka. To znači da voditelji obrade osobnih podataka informacije o navedenom pravu mogu pružiti ispitanicima putem javnih dokumenata o zaštiti privatnosti u kojima su im dužni dostaviti sve podatke iz članka 13. stavka 1. Uredbe, a koji se odnose na prava ispitanika i načine na koje ih mogu ostvarivati. (recital 58 Uredbe) Pravo na pristup Prema članku 15. Uredbe, ispitanik ima pravo dobiti od voditelja obrade potvrdu obrađuju li se osobni podaci koji se odnose na njega te ako se takvi osobni podaci obrađuju, ima pravo na pristup osobnim podacima i informacije, među ostalim, o obrađenim osobnim podacima, o svrsi obrade, roku pohrane, iznošenju u treće zemlje itd. Pravo na ispravak U članku 16., Uredba ispitaniku pruža pravo zahtijevati ispravak netočnih osobnih podataka koji se na njega odnose. Uzimajući u obzir svrhe obrade, ispitanik ima pravo dopuniti nepotpune osobne podatke, uz ostale načine, i davanjem dodatne izjave. Pravo na zaborav Ispitanik ima pravo od voditelja obrade zahtjevati brisanje osobnih podataka koji se na njega odnose te voditelj obrade ima obvezu obrisati osobne podatke bez nepotrebnog odgađanja ako osobni podaci više nisu nužni u odnosu na svrhu obrade, ispitanik je povukao privolu za obradu, osobni podaci su nezakonito obrađeni itd. (članak 17. Uredbe) Pravo na ograničavanje obrade U pojedinim situacijama ispitanik ima pravo od voditelja obrade zahtijevati da se obrada njegovih osobnih podataka ograniči, i to kada su ispunjeni Uredbom propisani uvjeti (članak 18. Uredbe) Pravo na prijenos Ispitanik ima pravo zaprimiti svoje osobne podatke koje je prethodno pružio voditelju obrade, u strukturiranom obliku te u uobičajeno upotrebljavanom i strojno čitljivom formatu. Također ima pravo prenijeti te podatke drugom voditelju obrade bez ometanja od strane voditelja obrade kojem su osobni podaci pruženi, ako se obrada provodi automatiziranim putem i temelji na privoli ili ugovoru (članak 20. Uredbe) Pravo na prigovor Ispitanik ima pravo na temelju svoje posebne situacije uložiti prigovor na obradu osobnih podataka ako je ona nužna za izvršavanje zadaće od javnog interesa, za izvršavanje službenih ovlasti voditelja obrade ili za potrebe legitimnih interesa voditelja obrade (uključujući i profiliranje). Tada voditelj obrade ne smije više obrađivati osobne podatke ispitanika (osim ako dokaže da njegovi legitimni razlozi za obradu nadilaze interese ispitanika) te radi zaštite pravnih zahtjeva. Također, ako se ispitanik protivi obradi za potrebe izravnog marketinga, osobni podaci više se ne smiju obrađivati (članak 21 Uredbe). Zahtjev za zaštitu prava Početkom primjene GDPR-a, a sukladno članku 34. Zakona o provedbi Opće uredbe o zaštiti podataka (NN 42/18), svatko tko smatra da mu je povrijeđeno neko pravo zajamčeno tim Zakonom i Općom uredbom o zaštiti podataka može nadzornom tijelu (Agenciji za zaštitu osobnih podataka) podnijeti zahtjev za utvrđivanje povrede navedenih prava. Zahtjev za zaštitu prava ispitanik može podnijeti osobno ili pisanim putem te je u njemu dužan navesti osobne podatke potrebne radi provođenja postupka i objašnjenje u čemu se sastoji povreda prava ispitanika. Agencija će o zahtjevu odlučiti rješenjem koje je upravni akt i protiv kojega žalba nije dopuštena, ali se može pokrenuti upravni spor pred nadležnim upravnim sudom. Ana Paštrović, mag.iur.