11u45-12u30: De nieuwe rol van de DPO in de praktijk Deel 1 12 april 2016 Bavo Van den Heuvel Thomas More Mechelen

Transcription

1 11u45-12u30: De nieuwe rol van de DPO in de praktijk Deel 1 12 april 2016 Bavo Van den Heuvel Thomas More Mechelen 1 GDPR 6 april 2016: h3p://eur- lex.europa.eu/legal- content/en/ TXT/?uri=consil:ST_5419_2016_INIT Versus 15 december 2015: h3ps://insideprivacy.com/wp- content/ uploads/sites/6/2016/04/gdpr- comparison- Dec vs- Apr pdf 2 1

2 DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA Source: h3p://eur- lex.europa.eu/legal- content/en/txt/? qid= &uri=consil:st_5418_2016_init 3 Directive vs GDPR Direc[ve Ar#cle 1 Subject- ma1er and objec#ves This Direc[ve lays down the rules rela[ng to the protec[on of natural persons with regard to the processing of personal data by competent authori[es for the purposes of the preven[on, inves[ga[on, detec[on or prosecu[on of criminal offences or the execu[on of criminal penal[es, including the safeguarding against and the preven[on of threats to public security. Ar[cle 9 Specific processing condi#ons Personal data collected by competent authori[es for the purposes set out in Ar[cle 1(1) shall not be processed for purposes other than those set out in Ar[cle 1(1) unless such processing is authorised by Union or Member State law. Where personal data are processed for such other purposes, Regula[on (EU) 2016/... (=GDPR) shall apply unless the processing is carried out in an ac[vity which falls outside the scope of Union law. 4 2

3 Art 37 Designa.on of the data protec.on officer 1. The controller and the processor shall designate a data protec[on officer in any case where: (a) the processing is carried out by a public authority or body, except for courts ac[ng in their judicial capacity; or (b) the core ac[vi[es of the controller or the processor consist of processing opera[ons which, by virtue of their nature, their scope and/or their purposes, require regular and systema[c monitoring of data subjects on a large scale; or (c) the core ac[vi[es of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Ar[cle 9 and personal data rela[ng to criminal convic[ons and offences referred to in Ar[cle Art 37 Designa.on of the data protec.on officer a) Overheid, ruim begrip overheidsinstan[e uit decreet op openbaarheid van bestuur b) Verwerkingen die vanwege hun aard, hun omvang en/of hun doeleinden regelma[ge en stelselma[ge observa[e op grote schaal van betrokkenen vereisen, groo3e is niet vermeld! c) Grootschalige verwerking van bijzondere categorieën van gegevens: persoonsgegevens waaruit ras of etnische alomst, poli[eke opvamngen, religieuze of levensbeschouwelijke overtuigingen, of het lidmaatschap van een vakbond blijken, en verwerking van gene[sche gegevens, biometrische gegevens met het oog op de unieke iden[fica[e van een persoon, of gegevens over gezondheid, of gegevens met betrekking tot iemands seksueel gedrag of seksuele gerichtheid (=vroegere art 6 en 7 WVP) Verwerking van persoonsgegevens betreffende strafrechtelijke veroordelingen en straoare feiten (= ca vroeger art 8) 6 3

4 Art 37 Designa.on of the data protec.on officer 2. A group of undertakings may appoint a single data protec[on officer provided that a data protec[on officer is easily accessible from each establishment. 3. Where the controller or the processor is a public authority or body, a single data protec[on officer may be designated for several such authori[es or bodies, taking account of their organisa[onal structure and size. 4. In cases other than those referred to in paragraph 1, the controller or processor or associa[ons and other bodies represen[ng categories of controllers or processors may or, where required by Union or Member State law shall, designate a data protec[on officer. The data protec[on officer may act for such associa[ons and other bodies represen[ng controllers or processors. 7 Designa.on of the data protec.on officer 5. The data protec[on officer shall be designated on the basis of professional quali[es and, in par[cular, expert knowledge of data protec[on law and prac[ces and the ability to fulfil the tasks referred to in Ar[cle The data protec[on officer may be a staff member of the controller or processor, or fulfil the tasks on the basis of a service contract. 7. The controller or the processor shall publish the contact details of the data protec[on officer and communicate them to the supervisory authority. 8 4

5 5. DPO training kan nodig zijn, cer[fica[e van de DPO is niet verplicht, onze opleiding is impliciet erkend 6. Tip: slecht idee om de DPO bij je processor te gaan huren, dat geep conflict of intrest 7. Contactgegevens is nieuw: op website en gewoon laten weten aan privacycommissie, het kan zijn dat men in Belgie nog een bijkomende goedkeuring van de DPO zal vereisen 9 Art 38 Posi.on of the data protec.on officer 1. The controller and the processor shall ensure that the data protec[on officer is involved properly and in a [mely manner in all issues which relate to the protec[on of personal data. 2. The controller and processor shall support the data protec[on officer in performing the tasks referred to in Ar[cle 39 by providing resources necessary to carry out those tasks and access to personal data and processing opera[ons, and to maintain his or her expert knowledge. 10 5

6 1. Zeer goede zaak: 1. de verantwoordelijkheid wordt daar gelegd 2. vraag ernaar en wijs je verantwoordelijke(n) hierop: degelijk en [jdige info krijgen, 3. plaats het ook in projectmethodologie, 4. geef aan dat er doorloop[jden zijn mochten er mach[gingen nodig zijn of dpia s 2. Resources: [jd en middelen voor je taken, ook toegang tot de persoonsgegevens zelf en bijscholing: bv een studiedag over GDPR J 11 Posi.on of the data protec.on officer 3. The controller and processor shall ensure that the data protec[on officer does not receive any instruc[ons regarding the exercise of those tasks. He or she shall not be dismissed or penalised by the controller or the processor for performing his tasks. The data protec[on officer shall directly report to the highest management level of the controller or the processor. 4. Data subjects may contact the data protec[on officer with regard to all issues related to processing of their personal data and to the exercise of their rights under this Regula[on. 5. The data protec[on officer shall be bound by secrecy or confiden[ality concerning the performance of his or her tasks, in accordance with Union or Member State law. 6. The data protec[on officer may fulfil other tasks and du[es. The controller or processor shall ensure that any such tasks and du[es do not result in a conflict of interests. 12 6

7 Posi.on of the data protec.on officer 3. Autonoom adviezen geven, kan wel taken krijgen van vvdv en verwerker. Geef advies steeds zo hoog mogelijk, zie ook dat je als dpo in organogram als adviseur aan hoogste in rang staat 4. Tip: gebruik generiek adres: denk aan inzage en verbeterrecht (best via portaal zelf te regelen door betrokkene), data portabili[y, 5. Was reeds zo 6. Belangenvermening Voorbeelden: it manager, hr manager, ingehuurd van bij je verwerker, beter: bij legal, bij compliancy, bij interne audit 13 Art 39 Tasks of the data protec.on officer 1. The data protec[on officer shall have at least the following tasks: (a) to inform and advise the controller or the processor and the employees who are carry out processing of their obliga[ons pursuant to this Regula[on and to other Union or Member State data protec[on provisions; (b) to monitor compliance with this Regula[on, with other Union or Member State data protec[on provisions and with the policies of the controller or processor in rela[on to the protec[on of personal data, including the assignment of responsibili[es, awareness- raising and training of staff involved in the processing opera[ons, and the related audits; 14 7

8 (a) to inform and advise the controller or the processor and the employees! (a) Best door formele adviezen via (tov vvdv en verw): wat moet waarom hoe verwerkt worden (b) Tov personeel: , intranet, elearning (b) to monitor compliance with this Regula[on De veiligheidsrichtlijnen, taken en verantwoordelijkheden, sensibiliseren van betrokkenen die verwerken, en ook audit hierop!: controle logs, random bevraging, ids/ips, siem of andere tools. Denk ook aan social engineering en mystery shopping. 15 Tasks of the data protec.on officer (c) to provide advice where requested as regards the data protec[on impact assessment and monitor its performance pursuant to Ar[cle 35; (d) to cooperate with the supervisory authority; (e) to act as the contact point for the supervisory authority on issues rela[ng to processing, including the prior consulta[on referred to in Ar[cle 36, and to consult, where appropriate, with regard to any other ma3er. 2. The data protec[on officer shall in the performance of his or her tasks have due regard to the risk associated with the processing opera[ons, taking into account the nature, scope, context and purposes of the processing. 16 8

9 Tasks of the data protec.on officer (c) DPIA; Zie verder (d) Samenwerking dpa & (e) to act as the contact point for the supervisory authority on issues rela[ng to processing, including the prior consulta[on referred to in Ar[cle 36, and to consult, where appropriate, with regard to any other ma3er. Goede zaak: nu ook al vaak, samenwerken geep een andere posi[e aan de DPO 2. due regard to the risk associated with the processing opera[ons.! Als je de materie niet kent: vraag externe hulp: bv db encryp[e, bv sta[s[ek, bv juridisch, bv IT audit, bv support voor DPO 17 Ar9cle 35 Data protec9on impact assessment 1. Where a type of processing in par[cular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing opera[ons on the protec[on of personal data. A single assessment may address a set of similar processing opera[ons that present similar high risks. 2. The controller shall seek the advice of the data protec[on officer, where designated, when carrying out a data protec[on impact assessment. ( ) Gegevensbeschermingseffectbeoordeling 18 9

10 Ar9cle 36 Prior consulta9on 1. The controller shall consult the supervisory authority prior to processing where a data protec[on impact assessment under Ar[cle 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mi[gate the risk. 2. Where the supervisory authority is of the opinion that the intended processing referred to in paragraph 1 would infringe this Regula[on, in par[cular where the controller has insufficiently iden[fied or mi[gated the risk, the supervisory authority shall within a period of up to eight weeks of receipt of the request for consulta[on provide wri3en advice to the controller, and where applicable to processor, and may use any of its powers referred to in Ar[cle 58. That period may be extended by six weeks, taking into account the complexity of the intended processing. The supervisory authority shall inform the controller, and where applicable the processor of any such extension within one month of receipt of the request for consulta[on together with the reasons for the delay. Those periods may be suspended un[l the supervisory authority has obtained any informa[on it may have requested for the purposes of the consulta[on. 3. When consul[ng the supervisory authority pursuant to paragraph 1, the controller shall provide the supervisory authority with ; (a) where applicable, the respec[ve responsibili[es of the controller, joint controllers and processors involved in the processing, in par[cular for processing within a group of undertakings; (b) the purposes and means of the intended processing; (c) the measures and safeguards provided to protect the rights and freedoms of data subjects pursuant to this Regula[on; (d) where applicable, the contact details of the data protec[on officer; (e) the data protec[on impact assessment provided for in Ar[cle 35; and (f) any other informa[on requested by the supervisory authority. Voorafgaande raadpleging 19 Art 83 General condi.ons for imposing administra.ve fines 4. Infringments of the following provisions shall, in acccordance with paragraph 2, be subject to administra[ve fines up to EUR, or in the case of an undertaking, up to 2% of the total worlwideworldwide annual turnover of the preceding financial year, whichever is higher: (a) the obliga[ons of the controller and the processor pursuant to Ar[cles 8, 10, 23, 24,11, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 42 and 43; 20 10