http___www.uredba.com_sluzbenik-za-zastitu-osobnih-podataka-dpo_1.xml
1.1 2.1 3.1 3.2 3.3 4.1 4.2 5.1 5.2 6.1 7.1 7.2 7.3 8.1 9.1 9.2 9.3 10.1 11.1 11.2 11.3 12.1 13.1 13.2 14.1 15.1 15.2 16.1 17.1 17.2 17.3 17.4 17.5 18.1 19.1 19.2 20.1 21.1 21.2 21.3 22.1 23.1 23.2 24.1 25.1 26.1 26.2 27.1 28.1 29.1
10 ways financial services organisations are preparing for the GDPR 21 December 2016 The General Data Protection Regulation (GDPR) will put individuals in control of their personal data, empowering them to choose how (and whether) businesses use their data. Where personal data is not treated correctly, individuals will have increased rights to legal recourse and can, in some instances, claim compensation. Regulators across the EU will have unprecedented power to enforce the legislation and impose hefty fines in instances of non-compliance. It is not enough to simply understand the headline requirements of the GDPR. What is more important is understanding what the GDPR is intended to achieve and what the real risk issues are for your organisation. The GDPR will result in widescale data privacy transformation requirements across every organisation. By working with clients across the FS industry to prepare for the GDPR, we have produced a summary of some key considerations in the journey towards readiness. Know where your data is You must have a clear understanding of what data you hold, why you need it, where it is and who has access to it. What are your core sources of data? How are you managing the risk of duplication, inaccuracy and failure to delete expired data? Understand how your third parties use data Most FS organisations share data with third parties. These might be clients, suppliers, regulators or partners. You must understand and manage the risks inherent in the transfer of data to third parties and ensure your data is protected adequately by those you share it with. Empower your customers Data protection is starting to become a market differentiator. Customers expect to be able to trust the organisations they share their personal data with to manage it appropriately. Transparency between you and the customer is key. Understand what privacy means to you It is important to adopt an organisation-wide approach, factoring data protection and privacy management into your overall business strategy. You should understand the inherent risks, opportunities and priorities for your organisation. Modernise your data infrastructure and governance How quickly would you be able to identify all of the data elements pertaining to a particular individual across your organisation? Being able to do this will not only enable you to meet the relevant requirements under the GDPR, but will also allow you to unlock the full value of the data assets held by you. Minimise data Are you using data for the purpose you have committed to and nothing more? Do you need to train your staff on data purpose limitations? How will you monitor this? Organisations must ensure that they only collect and process personal data that they legitimately need for the purposes they have identified. You may find you are able to reduce risk across your organisation by carefully disposing of data which you do not need or for which the purpose has expired. Manage consents and notification Under the GDPR, individuals are entitled to know all of the ways in which you use their personal data, what purpose you require it for and who you intend to share it with. The rules on consent are also getting tougher, and individuals can withdraw their consent at any time. Understand your level of privacy risk and data security What are the risks inherent in your processing of personal data? These could be organisational risks or technical risks. What external forces could act to disrupt your business, and how can your cyber security strategy enable you to react to them? Adopt an agile privacy and data protection strategy You need to maintain awareness of legal developments here and abroad in the ever-changing privacy landscape, and reflect these in your business plans and strategies. These should reflect an end-to-end approach and cover every entity across your entire global organisation that processes personal data originating from the EU. Appoint a Data Protection Officer (DPO) The majority of organisations will need to appoint a DPO to act as a liaison with Regulators, maintain adequate levels of privacy awareness across your organisation, monitor compliance with the GDPR and influence decision-making at a senior level to drive improvement of privacy and data protection management. Despite a two-year grace period for implementation, it is imperative that your organisation reviews its approach to privacy and data protection in preparation for the GDPR coming into force, on 25 May 2018. This is a tight time frame within which to plan and implement the complex changes required in order to comply with the new legislation. Further reading: Stewart Room, Global Head of Data Protection at PwC Legal, discusses the new General Data Protection Regulation and its impacts for entities and citizens. This blog was originally posted on PwC's Financial Services Risk and Regulation blog.
1.1 2.1 2.2 3.1 4.1 5.1 6.1 7.1 8.1 9.1 10.1 11.1 11.2 11.3
Službenik za zaštitu osobnih podataka Službenik za zaštitu osobnih podataka (DPO - Data Protection Officer) mora imati holistički pogled na ukupno poslovanje i biti neovisan od voditelja obrade. Glavni zadatak mu je da potpuno neovisno omogući primjenu odredbi Uredbe u organizaciji/društvu/tijelu javne vlasti. Službenik za zaštitu osobnih podataka mora imati znanje eksperta i praktično iskustvo vezano uz zaštitu osobnih podataka te mora dobro razumjeti Uredbu za zaštitu osobnih podataka. Službenik za zaštitu osobnih podataka ima obvezu: - informirati i savjetovati voditelja obrade/izvršitelja obrade o njihovoj obvezi sukladno novoj Uredbi kao i ostalim odredbama odnosnima na zaštitu osobnih podataka u EU ili državi članici; - nadzirati da postupanje sa osobnim podacima bude u skladu s Uredbom; - dizati razinu svijesti o značaju zaštite osobnih podataka i podučavati osoblje koje je uključeno u obradu osobnih podataka; - pružati savjete vezano uz procjenu rizika na zaštitu osobnih podataka; - nadzirati implementaciju politike upravljanja i upravljanje zbirkama osobnih podataka, - surađivati sa nadzornim tijelom za zaštitu osobnih podataka (Agencijom za zaštitu osobnih podataka). Općom uredbom o zaštiti podataka (GDPR) određeni voditelji obrade i izvršitelji obrade dužni su imenovati službenika za zaštitu podataka. To vrijedi za sva tijela javne vlasti i javna tijela (bez obzira na to koje podatke obrađuju) i za ostale organizacije čija je osnovna djelatnost sustavno i opsežno praćenje pojedinaca ili koje obrađuju posebne kategorije osobnih podataka u velikoj mjeri. Čak i kad se Općom uredbom o zaštiti podataka izričito ne zahtijeva imenovanje službenika za zaštitu podataka, za organizacije može biti korisno dobrovoljno imenovanje službenika za zaštitu podataka.