http___www.uredba.com_sluzbenik-za-zastitu-osobnih-podataka-dpo_1.xml
1.1 2.1 2.2 2.3 3.1 3.2 3.3 3.4 4.1 5.1 5.2 5.3 5.4 6.1 7.1 7.2 7.3 7.4 8.1 9.1 9.2 9.3 10.1 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 19.2 20.1 21.1 21.2 22.1 23.1 24.1 24.2 24.3 24.4
Are you an individual who worries about your personal data while transacting online? Are you an organization doing business? Do you think about protecting your customer’s personal data? If not, are you ready to pay fines up to 4% of annual global turnover or more? Users personal data is in danger. Organizations handling data are in danger. Neither of them knows what is the right way to process and protect this personal data. This article is an attempt to educate you about what GDPR is and how it impacts all of us as individuals and organizations. Personal Data Security Given the great technological advancements, globalization and complex flows of personal data, users are increasingly worried about the security of their personal data online. Today, keying in a phone number or email address might reveal users’ personal information at the click of a button, if this data falls in the hands of an irresponsible organization. Are not governments worried? Are there any laws and regulations to protect users? What is GDPR The European Union's new General Data Protection Regulation (GDPR) came into effect on May 25, 2018. The GDPR will apply to organizations processing personal data in the EU and also to organizations outside of the EU who may be targeting, or offering goods and services to individuals within the EU. This regulation gives control to individuals over their data by letting them choose how their data is handled online. GDPR highlights how personal data is captured by organizations and documented, how it is processed and what changes are required to the systems, processing users' personal data to comply with GDPR requirements. What GDPR means to Individuals and Organizations Individuals use many products - be it mobile apps or websites. GDPR expects organizations owning these products to notify users how their personal information is consumed within the products. Products working with third party partners must have a personal data policy and a privacy policy to ensure there is no threat to the data when it changes hands from one entity to another. Basic Definitions Personal Data Any information related to a natural person, that can be used to directly or indirectly to identify the person is Personal Data. It can be anything from a name, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer IP address. Data processor The entity processing on behalf of and in accordance with the instructions of a data controller. Data controller The entity deciding the means and purpose of the processing of personal data. What will change? Under the GDPR, the obligations on data controllers will substantially increase and, importantly, data processors will also now have data protection obligations. For example: - Data controllers and processors alike will now be required to keep records of their processing. - Contracts with processors will need to be updated with new mandatory provisions. Privacy notices will need to be updated. - “Consent” will be more difficult to obtain and may need to be refreshed. - Principles of “privacy by design” mean that organisations must look at their processing and assess whether it is imperative. Privacy rules around the world are tightening. The GDPR is just one example of a regime change which aims to put the rights of the individual first. Many of the principles are similar in privacy regimes around the world, but the GDPR is often stricter. Although compliance with the GDPR will not guarantee compliance with all privacy regimes across the globe, it will help to reduce global risks.
1.1 2.1 2.2 3.1 4.1 5.1 6.1 7.1 8.1 9.1 10.1 11.1 11.2 11.3
Službenik za zaštitu osobnih podataka Službenik za zaštitu osobnih podataka (DPO - Data Protection Officer) mora imati holistički pogled na ukupno poslovanje i biti neovisan od voditelja obrade. Glavni zadatak mu je da potpuno neovisno omogući primjenu odredbi Uredbe u organizaciji/društvu/tijelu javne vlasti. Službenik za zaštitu osobnih podataka mora imati znanje eksperta i praktično iskustvo vezano uz zaštitu osobnih podataka te mora dobro razumjeti Uredbu za zaštitu osobnih podataka. Službenik za zaštitu osobnih podataka ima obvezu: - informirati i savjetovati voditelja obrade/izvršitelja obrade o njihovoj obvezi sukladno novoj Uredbi kao i ostalim odredbama odnosnima na zaštitu osobnih podataka u EU ili državi članici; - nadzirati da postupanje sa osobnim podacima bude u skladu s Uredbom; - dizati razinu svijesti o značaju zaštite osobnih podataka i podučavati osoblje koje je uključeno u obradu osobnih podataka; - pružati savjete vezano uz procjenu rizika na zaštitu osobnih podataka; - nadzirati implementaciju politike upravljanja i upravljanje zbirkama osobnih podataka, - surađivati sa nadzornim tijelom za zaštitu osobnih podataka (Agencijom za zaštitu osobnih podataka). Općom uredbom o zaštiti podataka (GDPR) određeni voditelji obrade i izvršitelji obrade dužni su imenovati službenika za zaštitu podataka. To vrijedi za sva tijela javne vlasti i javna tijela (bez obzira na to koje podatke obrađuju) i za ostale organizacije čija je osnovna djelatnost sustavno i opsežno praćenje pojedinaca ili koje obrađuju posebne kategorije osobnih podataka u velikoj mjeri. Čak i kad se Općom uredbom o zaštiti podataka izričito ne zahtijeva imenovanje službenika za zaštitu podataka, za organizacije može biti korisno dobrovoljno imenovanje službenika za zaštitu podataka.