Search results

should be verifiable by means of its records. Thus, in order for the keeping of records to be meaningful, it will be necessary for the controller to be able

Principles of Data Processing Any processing of personal data should be lawful and fair. It should be transparent to natural persons that personal data concerning

it should be pointed out that the safeguards mentioned in the provision constitute an alternative system of data transfer and can therefore be additional

health data in order to be able to effectively provide healthcare. In this instance, the processing of data should be considered to be part of a hospital’s

operations are designed. In any case, the DPO shall be involved at a stage when fundamental decisions can still be taken. Among others, the early involvement is

Member State concerned shall be competent. In such cases Article 56 does not apply. 3. Supervisory authorities shall not be competent to supervise processing

risk. The outcome of the assessment should be taken into account when determining the appropriate measures to be taken in order to demonstrate that the processing

principle be ensured by technical means in such a manner that the personal data are not subject to further processing operations and cannot be changed.

public hearing. Under specific conditions the hearing may be secret. For an administrative fine to be issued, a prior invitation of the defendant (or his representative

scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. The legal basis provided

determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked

mentioned above, derogations from Article 49 GDPR may be used. Additionally, Article 44 GDPR must be also be complied with, meaning that any transfer based on

subject be concise, easily accessible and easy to understand, and that clear and plain language and, additionally, where appropriate, visualisation be used

requirements for 85(1) to be fulfilled. While not outlined, the academic commentary agrees that Article 85(1) should not be read as requiring member states

the controller or the processor and may be addressed by any supervisory authority. The representative should be explicitly designated by a written mandate

pursued need to be demonstrated; (iii) the processing has to be subject to independent oversight; and (iv) effective remedies need to be available to the

shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought

as well as any other person which would be adversely affected by the decision, must be afforded the right to be heard in relation to the subject matter

supervisory authority should be brought before the courts of the Member State where the supervisory authority is established and should be conducted in accordance

they may be developed to “calibrate the obligations of controllers and processors” according to Recital 98 GDPR. As such, codes are intended to be an additional