+Člen 6 Zakonitost obdelave
---+Člen 6 1.
---+Člen 6 2.
---+Člen 6 3.
---+Člen 6 4.

Člen 6 Zakonitost obdelave

-

1. Pregled

,
Naslov Regulativa
Člen 6 1.

Obdelava je zakonita le in kolikor je izpolnjen vsaj eden od naslednjih pogojev:

(a) 

posameznik, na katerega se nanašajo osebni podatki, je privolil v obdelavo njegovih osebnih podatkov v enega ali več določenih namenov;

(b) 

obdelava je potrebna za izvajanje pogodbe, katere pogodbena stranka je posameznik, na katerega se nanašajo osebni podatki, ali za izvajanje ukrepov na zahtevo takega posameznika pred sklenitvijo pogodbe;

(c) 

obdelava je potrebna za izpolnitev zakonske obveznosti, ki velja za upravljavca;

(d) 

obdelava je potrebna za zaščito življenjskih interesov posameznika, na katerega se nanašajo osebni podatki, ali druge fizične osebe;

(e) 

obdelava je potrebna za opravljanje naloge v javnem interesu ali pri izvajanju javne oblasti, dodeljene upravljavcu;

(f) 

obdelava je potrebna zaradi zakonitih interesov, za katere si prizadeva upravljavec ali tretja oseba, razen kadar nad takimi interesi prevladajo interesi ali temeljne pravice in svoboščine posameznika, na katerega se nanašajo osebni podatki, ki zahtevajo varstvo osebnih podatkov, zlasti kadar je posameznik, na katerega se nanašajo osebni podatki, otrok.

Točka (f) prvega pododstavka se ne uporablja za obdelavo s strani javnih organov pri opravljanju njihovih nalog.

Člen 6 2.
Države članice lahko ohranijo ali uvedejo podrobnejše določbe, da bi prilagodile uporabo pravil te uredbe v zvezi z obdelavo osebnih podatkov za zagotovitev skladnosti s točkama (c) in (e) odstavka 1, tako da podrobneje opredelijo posebne zahteve v zvezi z obdelavo ter druge ukrepe za zagotovitev zakonite in poštene obdelave, tudi za druge posebne primere obdelave iz poglavja IX.
Člen 6 3.

Podlaga za obdelavo iz točk (c) in (e) odstavka 1 je določena v skladu s:

(a) 

pravom Unije; ali

(b) 

pravom države članice, ki velja za upravljavca.

►C1  Namen obdelave se določi v navedeni pravni podlagi ali pa je v primeru obdelave iz točke (e) odstavka 1 potreben za opravljanje naloge, ki se izvaja v javnem interesu, ali pri izvajanju javne oblasti, dodeljene upravljavcu. ◄ Navedena pravna podlaga lahko vključuje posebne določbe, s katerimi se prilagodi uporaba pravil iz te uredbe, med drugim: splošne pogoje, ki urejajo zakonitost obdelave podatkov s strani upravljavca; vrste podatkov, ki se obdelujejo; zadevne posameznike, na katere se nanašajo osebni podatki; subjekte, katerim se osebni podatki lahko razkrijejo, in namene, za katere se lahko razkrijejo; omejitve namena; obdobja hrambe; ter dejanja obdelave in postopke obdelave, vključno z ukrepi za zagotovitev zakonite in poštene obdelave, kot tiste za druge posebne primere obdelave iz poglavja IX. Pravo Unije ali pravo države članice izpolnjuje cilj javnega interesa in je sorazmerno z zakonitim ciljem, za katerega si prizadeva.

Člen 6 4.

Kadar obdelava podatkov za drug namen kot za tistega, za katerega so bili osebni podatki zbrani, ne temelji na privolitvi posameznika, na katerega se nanašajo osebni podatki, ali na pravu Unije ali pravu države članice, ki predstavlja potreben in sorazmeren ukrep v demokratični družbi za uresničevanje ciljev iz člena 23(1), upravljavec, da bi ocenil, ali je obdelava za drug namen združljiva z namenom, za katerega so bili osebni podatki prvotno zbrani, med drugim upošteva:

▼B

(a) 

kakršno koli povezavo med nameni, za katere so bili osebni podatki zbrani, in nameni načrtovane nadaljnje obdelave;

(b) 

okoliščine, v katerih so bili osebni podatki zbrani, zlasti kar zadeva razmerje med posamezniki, na katere se nanašajo osebni podatki, in upravljavcem;

(c) 

naravo osebnih podatkov, zlasti ali se obdelujejo posebne vrste osebnih podatkov v skladu s členom 9 ali pa se obdelujejo osebni podatki v zvezi s kazenskimi obsodbami in prekrški v skladu s členom 10;

(d) 

morebitne posledice načrtovane nadaljnje obdelave za posameznike, na katere se nanašajo osebni podatki;

(e) 

obstoj ustreznih zaščitnih ukrepov, ki lahko vključujejo šifriranje ali psevdonimizacijo.

1.1 Sklici

1.2 Ugotovljene zahteve

1.3 Povezani standardi

2. Ugotovljene zahteve

Zahteve
Vir Zahteva

3. Povezani standardi

Standardi
Vir Zahteva
SCF Data Subject Opt-In Consent

Description

Mechanisms exist to obtain consent from data subjects to opt-in for the following Personal Data (PD) actions:
(1) Collecting;
(2) Receiving;
(3) Processing;
(4) Storing;
(5) Transmitting;
(6) Sharing; and/or
(7) Updating.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Obtain opt-in consent before processing personal data

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Opt-in consent policy and procedures

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal opt-in consent program
∙ Consent records management

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Enterprise consent management platform (e.g., OneTrust, Cookiebot)
∙ Consent audit trail

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise consent management platform (e.g., OneTrust, TrustArc)
∙ Granular consent management
∙ Automated consent renewal
∙ Consent audit logs

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Privacy (PRI) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Data privacy management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Data privacy management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ The data privacy program is developed to work with IT and cybersecurity staff to ensure that applicable statutory, regulatory and/or contractual data privacy obligations for Personal Data (PD) are properly identified and implemented.

Level 3 Well Defined

Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.
▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software and customer management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to obtain consent from data subjects to opt-in for the following Personal Data (PD) actions:
(1) Collecting;
(2) Receiving;
(3) Processing;
(4) Storing;
(5) Transmitting:
(6) Sharing; and/or
(7) Updating.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.