Search results

doctor. Lisa tells him all the details about a rash in an intimate area. The next day a friend of Lisa asks her about her rash. It turns out that the doctor

Article 8(2) CFR. A data subject may just want to get information about the data processed about him or her - independent of the exercise of any other right

must be informed about it. More particularly, the controller is under the duty to provide the data subject with "meaningful information about the logic involved"

guiding questions: Where are decisions about the purposes and means of the finally signed off’? Where are decisions about business activities that involve data

reduce that age limit to below 13. There is currently no rule in the GDPR about the age for consent if no "information society service" is involved, including

subject about the "action taken" following receipt of a request under Articles 15 to 22 GDPR. The wording of the law only requires an information about the

Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences

7(2) applies when data subjects and controllers communicate in written form about “other matters”, such as a longer contract, sign-up form and alike. In such

In both cases, it is argued, the information reveals something sensitive about the individual (either their political views, or a health condition) and

life. Results may vary from case to case, but when the data is about a public figure or about the professional life of a well-know individual, the argument

establishment: Where are decisions about the purposes and means of the processing given final “sign off”? Where are decisions about business activities that involve

responsibilities on a long-term and strategic basis. Further information about the ICO's decision making structure can be found here. When the General Data

Paragraph 4 reiterates the obligation on the data controller to inform about the existence of the right to object at the time of the first communication

accordance with Article 58(1)(d) GDPR, a SA can inform a controller or processor about an alleged – i.e. possible, but not yet determined – infringement of the

authority. Paragraph 4 grants controllers the possibility of sharing details about the breach in different phases when all the information cannot be provided

employee decided on behalf of the head of the DSB. There is no information about individual sections within the DSB. The DSB followed the previous "Datenschutzkommission"

individuals and society when state, social or economic power obtains knowledge about people in an uncontrolled and asymmetrical manner. At the same time, only

lead to the rejection of a required loan. In many cases false information about a data subject can also lead to severe emotional distress. Example: A pregnant

provisions is not mandatory, as the data subject may be not knowledgeable about the law and its technicalities. In theory, the controller could also be omitted

entities to gather unthinkable amounts of information about other people and entities. Information about a person usually allows to manipulate individual decision

processing; providing information about the storage of personal data; having malware detection systems; training employees about basic "cyber hygiene"; establishing

freedoms of data subjects; and (h) the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction

weeks, allowing for 14 weeks in total. The Chair of the EDPB makes decisions about the extension either on its own initiative or at the request of at least

happens, the controller is not obliged to process additional information about the data subject for the sole purpose of GDPR compliance. Article 11(2) GDPR

belonging to companies, public bodies or other legal entities. However, if data about a legal entity contains or relates to a natural person or a natural person

evidence or there is a dispute between the controller and the data subject about the accuracy of personal data. To avoid potentially deletion, sharing or

47(2)(h) GDPR). The format and procedures for the exchange of information about BCRs between the controllers, processors and DPAs shall be specified by the

obligation for the DPO to inform the controller, processor, and their staff about the obligations arising from the GDPR and other applicable data protection

authority (DPA) about the transfer and all relevant aspects are duly recorded. Lastly, the controller should inform the data subject about the transfer and

institution of updating courses to keep the DPO and their team informed about data protection developments and related disciplines. Alternatively, the

include: The name of the controller A description of what the complaint is about Their contact information (name, phone number and postal address only) Copies

consult the supervisory authority not only to seek advice about informing data subjects about a breach in accordance with Article 34, but also on the appropriate

term. The authority has an office in Rome with a staff currently numbering about 125 people. The Panel of the Italian DPA is currently composed of Pasquale

transfer personal data. In such cases, the processor must inform the controller about such requirements before commencing the processing. This provision emphasizes

applicable. The fifth section contains the provisions about the rights of data subjects. The sixth section is about the Hamburg Commissioner for Data Protection

certain about the fact that the processing entails high risks that cannot be mitigated by measures they are willing to adopt, or they have doubts about it.

The annual reports of NAIH are accessible in English (https://www.naih.hu/about-the-authority/annual-reports) and in Hungarian (https://www.naih.hu/eves-beszamolok)

Information about the law governing the DPA's activity can be found here. Complaints are governed by the Administrative Procedure Code. Information about investigations

"Procedural Information" for details on why we only get access to press releases about decisions. You can help us by filling in this section! You can help us by

involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it. Recital 62: Exceptions

to three separate incidents in which personal data including information about children was disclosed to unauthorised individuals. The second fine, in June

and marks; (d) established procedures and structures to handle complaints about infringements of the certification or the manner in which the certification

or processor, as the case may be, and inform the other CSAs and the EDPB about the decision, including a summary of the relevant facts and grounds. The

compliance with the GDPR, then it must have a "firm and reasoned notion about the legal basis of processing before it starts any operation, and this notion

months for complex cases, provided that the data subject has been informed about the reasons for such delay within one month of the original request. EDPB:

is usually also processed. Example: A company is processing information about customers in a digital spread sheet. While the entering of personal data

not a party to a complaints procedure. It only informs the data subject about the status of its complaint ("waiting", "in process" or "closed") althrough

According to Article 88(3) GDPR, Member States must notify the Commission about any laws they adopt pursuant to this Article. Currently Austria, Bulgaria

payment for services received from another controller); You make decisions about the individuals concerned as part of or as a result of the processing (e

the Slovakian Freedom of Information Act. You can find more information about it on the website https://dataprotection.gov.sk/uoou/en/content/access-information