+Artikolu 30 Notifika ta' ksur ta'datapersonali lill-awtorità superviżorja
---+Article 30 1.
---+Article 30 2.
---+Article 30 3.
---+Article 30 4.
---+Article 30 5.
---+Article 30 6.

Artikolu 30 Notifika ta' ksur ta'datapersonali lill-awtorità superviżorja

Artikolu 30

Notifika ta' ksur ta' data personali lill-awtorità superviżorja

1.  L-Istati Membri għandhom, f'każ ta' ksur tad-data personali, jipprevedu li l-kontrollur jinnotifika mingħajr dewmien bla bżonn u, fejn fattibbli, mhux aktar tard minn 72 siegħa wara li jkun sar jaf bih, il-ksur tad-data personali lill-awtorità superviżorja, sakemm il-ksur ta' data personali x'aktarx ma jirriżultax f'riskju għad-drittijiet u l-libertajiet tal-persuni fiżiċi. Fejn in-notifika lill-awtorità superviżorja ma ssirx xi żmien 72 siegħa, din għandha tkun akkumpanjata minn raġunijiet għad-dewmien.

2.  Il-proċessur għandu jinnotifika lill-kontrollur mingħajr dewmien bla bżonn wara li jsir jaf bi ksur ta' data personali.

3.  In-notifika msemmija fil-paragrafu 1 għandha mill-anqas:

(a) tiddeskrivi n-natura tal-ksur tad-data personali inklużi, fejn hu possibbli, il-kategoriji u l-għadd approssimattiv tas-suġġetti tad-data kkonċernati u l-kategoriji u l-għadd approssimattiv ta' reġistri tad-data personali kkonċernati;

(b) tikkomunika l-isem u d-dettalji ta' kuntatt tal-uffiċjal tal-protezzjoni tad-data jew ta' punt ta' kuntatt ieħor fejn tista' tinkiseb aktar informazzjoni;

(c) tiddeskrivi l-konsegwenzi probabbli tal-ksur ta' data personali;

(d) tiddeskrivi l-miżuri li ttieħdu jew proposti biex jittieħdu mill-kontrollur sabiex jindirizza l-ksur ta' data personali, inklużi, fejn xieraq, miżuri biex jiġu mitigati l-effetti negattivi possibbli tiegħu.

4.  Meta, u sa fejn, mhuwiex possibbli li tiġi pprovduta l-informazzjoni fl-istess ħin, l-informazzjoni tista' tiġi pprovduta f'fażijiet mingħajr aktar dewmien indebitu.

5.  L-Istati Membri għandhom jipprevedu li l-kontrollur jiddokumenta kwalunkwe ksur ta' data personali msemmi fil-paragrafu 1, fosthom il-fatti relatati mal-ksur tad-data personali, l-effetti tiegħu u l-azzjoni ta' rimedju meħuda. Dik id-dokumentazzjoni għandha tippermetti lill-awtorità superviżorja li tivverifika l-konformità ma' dan l-Artikolu.

6.  L-Istati Membri għandhom, fejn il-ksur tad-data personali jinvolvi data personali li ġiet trażmessa minn jew lill-kontrollur ta' Stat Membru ieħor, jipprevedu li l-informazzjoni msemmija fil-paragrafu 3 tiġi kkomunikata lill-kontrollur ta' dak l-Istat Membru mingħajr dewmien żejjed.

1. Ħarsa ġenerali

,
Article 30 1.
Member States shall, in the case of a personal data breach, provide for the controller to notify without undue delay and, where feasible, not later than 72 hours after having become aware of it, the personal data breach to the supervisory authority, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.
Article 30 2.
The processor shall notify the controller without undue delay after becoming aware of a personal data breach.
Article 30 3.

The notification referred to in paragraph 1 shall at least:

(a) 

describe the nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

(b) 

communicate the name and contact details of the data protection officer or other contact point where more information can be obtained;

(c) 

describe the likely consequences of the personal data breach;

(d) 

describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
Article 30 4.
Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay.
Article 30 5.
Member States shall provide for the controller to document any personal data breaches referred to in paragraph 1, comprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation shall enable the supervisory authority to verify compliance with this Article.
Article 30 6.
Member States shall, where the personal data breach involves personal data that have been transmitted by or to the controller of another Member State, provide for the information referred to in paragraph 3 to be communicated to the controller of that Member State without undue delay.

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Standards relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Standards relatati

Standards
  • Builddate: 04.05.2016 00:00:00 -Doknr: CELEX:32016L0680
  • EULAW -

    EN: Legal acts of the European Union from EUR-Lex, https://eur-lex.europa.eu/. © European Union. Re-use is authorised by Decision 2011/833/EU, provided the source is acknowledged; the consolidated texts are licensed under CC BY 4.0 (EUR-Lex legal notice). Divided into sections and converted into the GRCA format, the wording unchanged. Only the legislation published in the Official Journal of the European Union is deemed authentic.

    DE: Rechtsakte der Europäischen Union aus EUR-Lex, https://eur-lex.europa.eu/. © Europäische Union. Weiterverwendung nach Beschluss 2011/833/EU mit Quellenangabe gestattet; die konsolidierten Fassungen stehen unter CC BY 4.0 (Rechtlicher Hinweis von EUR-Lex). In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Verbindlich sind allein die im Amtsblatt der Europäischen Union veröffentlichten Rechtsakte.