+Članak 6. Zakonitost obrade
---+Članak 6. 1.
---+Članak 6. 2.
---+Članak 6. 3.
---+Članak 6. 4.
|
Članak 6. Zakonitost obrade
1. Pregled
| Naslov |
Regulativa |
|
Članak 6. 1.
|
Obrada je zakonita samo ako i u onoj mjeri u kojoj je ispunjeno najmanje jedno od sljedećega:
(a)
ispitanik je dao privolu za obradu svojih osobnih podataka u jednu ili više posebnih svrha;
(b)
obrada je nužna za izvršavanje ugovora u kojem je ispitanik stranka ili kako bi se poduzele radnje na zahtjev ispitanika prije sklapanja ugovora;
(c)
obrada je nužna radi poštovanja pravnih obveza voditelja obrade;
▼C1
(d)
obrada je nužna kako bi se zaštitili životno važni interesi ispitanika ili druge fizičke osobe;
▼B
(e)
obrada je nužna za izvršavanje zadaće od javnog interesa ili pri izvršavanju službene ovlasti voditelja obrade;
(f)
obrada je nužna za potrebe legitimnih interesa voditelja obrade ili treće strane, osim kada su od tih interesa jači interesi ili temeljna prava i slobode ispitanika koji zahtijevaju zaštitu osobnih podataka, osobito ako je ispitanik dijete.
Točka (f) prvog podstavka ne odnosi se na obradu koju provode tijela javne vlasti pri izvršavanju svojih zadaća.
|
|
Članak 6. 2.
|
Države članice mogu zadržati ili uvesti posebne odredbe kako bi se primjena pravila ove Uredbe s obzirom na obradu prilagodila radi usklađivanja sa stavkom 1. točkama (c) i (e) tako da se preciznije odrede posebni zahtjevi za obradu te druge mjere za osiguravanje zakonite i poštene obrade, među ostalim za druge posebne situacije obrade kako je predviđeno u poglavlju IX.
|
|
Članak 6. 3.
|
Pravna osnova za obradu iz stavka 1. točaka (c) i (e) utvrđuje se u:
(b)
pravu države članice kojem voditelj obrade podliježe.
Svrha obrade određuje se tom pravnom osnovom ili, u pogledu obrade iz stavka 1. točke (e), mora biti nužna za izvršavanje zadaće od javnog interesa ili izvršavanje službene ovlasti voditelja obrade. Ta pravna osnova može sadržavati posebne odredbe kako bi se prilagodila primjena pravila ove Uredbe, među ostalim opće uvjete kojima se uređuje zakonitost obrade od strane voditelja obrade, vrste podataka koji su predmet obrade, dotične ispitanike, subjekte kojima se osobni podaci mogu otkriti i svrhe u koje se podaci mogu otkriti, ograničavanje svrhe, razdoblje pohrane te aktivnosti obrade i postupke obrade, uključujući mjere za osiguravanje zakonite i poštene obrade, kao i za druge posebne situacije obrade kako je navedeno u poglavlju IX. Pravom Unije ili pravom države članice mora se ostvariti cilj od javnog interesa te ono mora biti razmjerno zakonitom cilju koji se želi postići.
|
|
Članak 6. 4.
|
Ako se obrada u svrhu koja je različita od svrhe u koju su podaci prikupljeni ne temelji na privoli ispitanika ili na pravu Unije ili pravu države članice koje predstavlja nužnu i razmjernu mjeru u demokratskom društvu za zaštitu ciljeva iz članka 23. stavka 1., voditelj obrade, s ciljem utvrđivanja je li obrada u drugu svrhu u skladu sa svrhom u koju su osobni podaci prvotno prikupljeni, uzima u obzir, među ostalim:
(a)
svaku vezu između svrha prikupljanja osobnih podataka i svrha namjeravanog nastavka obrade;
(b)
kontekst u kojem su prikupljeni osobni podaci, posebno u pogledu odnosa između ispitanikâ i voditelja obrade;
(c)
prirodu osobnih podataka, osobito činjenicu obrađuju li se posebne kategorije osobnih podataka u skladu s člankom 9. ili osobni podaci koji se odnose na kaznene osude i kažnjiva djela u skladu s člankom 10.;
(d)
moguće posljedice namjeravanog nastavka obrade za ispitanike;
(e)
postojanje odgovarajućih zaštitnih mjera, koje mogu uključivati enkripciju ili pseudonimizaciju.
|
,
1.1 Reference
1.2 Utvrđeni zahtjevi
1.3 Povezani standardi
2. Utvrđeni zahtjevi
3. Povezani standardi
Standardi
| Izvor |
Zahtjev |
|
SCF
|
Data Subject Opt-In Consent
Description
Mechanisms exist to obtain consent from data subjects to opt-in for the following Personal Data (PD) actions:
(1) Collecting;
(2) Receiving;
(3) Processing;
(4) Storing;
(5) Transmitting;
(6) Sharing; and/or
(7) Updating.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Obtain opt-in consent before processing personal data
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Opt-in consent policy and procedures
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal opt-in consent program
∙ Consent records management
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Enterprise consent management platform (e.g., OneTrust, Cookiebot)
∙ Consent audit trail
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise consent management platform (e.g., OneTrust, TrustArc)
∙ Granular consent management
∙ Automated consent renewal
∙ Consent audit logs
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 Planned Tracked
Privacy (PRI) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Data privacy management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Data privacy management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ The data privacy program is developed to work with IT and cybersecurity staff to ensure that applicable statutory, regulatory and/or contractual data privacy obligations for Personal Data (PD) are properly identified and implemented.
Level 3 Well Defined
Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.
▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software and customer management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to obtain consent from data subjects to opt-in for the following Personal Data (PD) actions:
(1) Collecting;
(2) Receiving;
(3) Processing;
(4) Storing;
(5) Transmitting:
(6) Sharing; and/or
(7) Updating.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|