http___www.usluga.hr_o-poduzecu_zastita-osobnih-podataka__1.xml
1.1 1.2 1.3 1.4 2.1 3.1 4.1 5.1 6.1 6.2 7.1 8.1 8.2 9.1 10.1 11.1 12.1 12.2 12.3 12.4 12.5 12.6 12.7
On 01 July 2011 the Business Activity Central Register and Information Record (further called: CEIDG) replaced the Business Activity Register. The regulations based on which the data contained in CEIDG would fall within the scope of the Act on personal data protection were to come into force at the same day, but finally they took effect as from 01 January 2012. Starting from that date the provisions of the Act of 29 August 1997 on personal data protection (further called: PDP Act) should be applied to CEIDG. Please observe that until 01 January 2012 the Act on freedom of business activity excluded the data of sole proprietors from the scope of the PDP Act. In view of the amended regulations and the lack of a transitional period for their implementation, beginning from 01 January 2012 the entities functioning as controllers of sole proprietors’ personal data must comply with all duties arising from the PDP Act. Obligation to keep data secure Among other things, the controller responsible for processing sole proprietors’ personal data has to keep obligatory documentation in accordance with the security policy for data protection and the instructions of IT system management for personal data processing; the controller should also grant authorisations to the persons involved in data processing and keep records of the persons authorised to process such data. Obligation to register personal data filing system The personal data controller is obliged to register the filing system used in respect of sole proprietors’ personal data with the Inspector General of Personal Data Protection. The PDP Act expressly enumerates the exceptions from this rule, e.g. when personal data is to be processed exclusively for the purpose of issuing invoices. Obligation to validate Personal data can be processed only if there are grounds for such processing provided for in the PDP Act. Each controller in possession of sole proprietors’ personal data needs to indicate the legal basis for such data processing. Obligation to notify In the course of obtaining personal data from sole proprietors the controller has an information obligation towards them consisting in provision of information on the name, address of the controller’s seat, purpose and scope of data collection, potential recipients of the data, the right of access to such data, the possibility to modify it and whether data provision is mandatory of voluntary. Tendencies in Europe The changes described above seem to reflect the trends currently observed in EC institutions regarding extension of personal data protection and tightening controls and sanctions for non-compliance. One needs to refer here to the proposal of the Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data which was approved on 25 January 2012. The Regulation intends to introduce certain modifications to the law in order to limit personal data leaks. Although the currently binding provisions of the Polish PDP Act require that the personal data controller should implement technical and organisational measures to protect the personal data being processed, they do not put the controller under an information obligation in the situation of disclosure of personal data to a third party. The new EC regulations that are directly binding in the EC member states will introduce the controller’s duty to inform the supervisory body and the data subject about any data leaks. What is more, the personal data controller will be obliged to maintain documentation describing in detail the circumstances of data breaches and will document the data protection policy. The proposed regulations provide for a fine for non-compliance which will amount up to EUR 500 000 and in the case of enterprises up to 1% of the annual turnover.
1.1 2.1 3.1 4.1 5.1 6.1 7.1 7.2 8.1 9.1 9.2 10.1 11.1 12.1
Sukladno Zakonu o zaštiti osobnih podataka ( Narodne novine broj 103/03, 118/06, 41/08, 130/11 i 106/12 ) društvo Usluga Poreč d.o.o. imenovalo je službenika za zaštitu osobnih podataka. Službenik za zaštitu osobnih podataka vodi brigu o zakonitosti obrade osobnih podataka i ostvarivanju prava na zaštitu osobnih podataka na način da: - vodi brigu o zakonitosti obrade osobnih podataka u smislu poštivanja odredbi Zakona o zaštiti osobnih podataka i ostalih propisa koji uređuju pitanja obrade osobnih podataka; - upozorava voditelja zbirke osobnih podataka na nužnost primjene propisa o zaštiti osobnih podataka u slučajevima planiranja i radnji koje mogu imati utjecaj na pitanje privatnosti i zaštitu osobnih podataka; - upoznaje sve osobe zaposlene u obradi osobnih podataka s njihovim zakonskim obvezama u svrhu zaštite osobnih podataka; - brine o izvrsenju obveza iz clanka 14. i Zakona o zaštiti osobnih podataka; - omogućava ostvarivanje prava ispitanika iz clanka i 20. Zakona o zaštiti osobnih podataka; - surađuje s Agencijom za zastitu osobnih podataka u vezi s provedbom nadzora nad obradom osobnih podataka. Službenik za zaštitu osobnih podataka dužan je čuvati povjerljivost svih informacija i podataka koje sazna u obavljanju svojih dužnosti. Ova obveza traje i nakon prestanka obavljanja dužnosti službenika za zaštitu osobnih podatka. Kontakt podaci službenika za zaštitu osobnih podataka : Usluga Poreč d.o.o., Mlinska 1., Poreč E-mail: lorena.velenik@usluga.hr