Source: https://www.isecure.pl/en/compendium/
Timestamp: 2019-04-20 16:21:11+00:00

Document:
Responsibility for terms of consent supervision lays on data controller. Data controller must be able to prove that data subject, expressed the consent to do so. Data controller must also be able to prove that data subject expressed the consent to process the personal data had been informed about the right to withdraw the consent.
Additionally, in situation when data controller processes the data of person below age of 16, has to implement the procedure to obtain the parental or administrative approval for child’s personal data processing.
It’s worth to remember that in our country, according to the draft of personal data protection directive, this obligation lays on the controller, who processes data of the person below age of 13 (RODO gives a free hand to national authorities to determine the limit of minimal age).
The controller should provide the data subject with any further information necessary to ensure fair and transparent processing taking into account the specific circumstances and context in which the personal data are processed. Furthermore, the data subject should be informed of the existence of profiling and the consequences of such profiling. Where the personal data are collected from the data subject, the data subject should also be informed whether he or she is obliged to provide the personal data and of the consequences, where he or she does not provide such data.
Information about automated decision-making, including profiling, and information regarding principles of making such decisions, as well as about relevance and predicted consequences of such processing for data subject.
When notification is impossible or extremely difficult.
Controller is responsible for informing data subject about profiling and its consequences, as well as possibility of laying a compliant (point 60 and 70 of RODO preamble, art. 13 sec. 2 letter F, art. 14 sec. 2 letter G RODO).
This term defined in art. 4 point 4 of RODO: means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.
Creating profiles means: (1) collecting data from various sources: data transmitted to controller + data transmitted to other controllers (ie. social media) or (2) profiles created in statistic way, when attribute 1 implicates appearance of attribute 2, 3 etc.
Not always RODO will find applicable usage for profiling. Three premises need to be met simultaneously: (a) method of processing – any form of automated data processing and (b) purpose – analysis or prediction of aspects concerning natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.
In fact, RODO constitutes two types of profiling. What distinguish these two types is automated decision-making. When automated decision-making is not present, art. 21 sec. 1 and 2 of RODO are applicable. When automated decision-making is present, regulations 13, 14, 15, 22 and 35 sec. 3 point c of RODO should be applied.
Automated decision-making is allowed when: it is allowed by European or national law, which stipulates appropriate means to protect rights, liberties and legitimate interests of data subjects; when it is necessary to conclusion or fulfillment of contract between controller and data subject as well as in the situation when data subject clearly expressed his or her consent.
RODO enforces the obligation to maintain records of processing activities to ensure compliance with art. 30, however there are some exceptions for particular groups of data controllers.
Regarding the contents of such records, it reminds to a large degree the open personal data records maintained by ABI (Administrator Bezpieczeństwa Informacji – Data Security Administrator), however it is worth to note that RODO requires some additional components, such as necessity to determine the time limit for deletion of particular data categories.
after 72 hours – the notification shall be accompanied by reasons of the delay.
The controller may be released from this obligation unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.
The notification has to contain (art. 33 sec. 3 of RODO): nature of the breach, Data Protection Officer details, consequences of the breach, measure taken to address the personal data breach.
The processor shall also notify the controller without undue delay after becoming aware of a personal data breach.
If the implications above exist, the data controller shall communicate the personal data breach to the data subject without undue delay.
Description of applied or recommended measures to handle the data breach.
The controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects is no longer likely to materialize.
It would involve disproportionate effort. In such a case, there shall be instead a public communication or similar measure whereby the data subjects are informed in an equally effective manner.
The supervisory authority may decide that any of the conditions referred in art. 34 sec 3 of RODO are met.
Data controller bears civil liability. What is worth to know about the right to compensation.
A controller or processor shall be exempt from liability if it proves that it is not in any way responsible for the event giving rise to the damage.
If a controller or processor intentionally or negligently for the same or linked processing operations, infringes several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount specified for the gravest infringement.
Administrative fine up to 10 000 000 EUR or in case of an undertaking, up to 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher.
Member States shall lay down the rules on other penalties applicable to infringements of this Regulation in particular of infringements which are not subject of administrative fines pursuant to art. 83, and shall take all measures necessary to ensure that they are implemented. Such penalties should be effective, proportionate and dissuasive.
Such kind of sanctions will be enforced to the law order by the new personal data protection directive.
The core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to art. 9 sec. 1 and personal data relating to criminal convictions and offences referred to in art. 10.
In cases other than those, IOD designation is facultative.
As new powers/tasks of IOD may be indicated that IOD cooperates with supervisory authority, stands for a contact point for supervisory authority in the issues related to data processing as well as for complainants – in this sense it will act as a customer service office.
The data controller will be obliged to examine the agreements of entrust to verify whether they guarantee the implementation of appropriate technical and organizational measures required by RODO. According to that it will be necessary to review the subject agreements, making revisions and amendments.
It also seems inevitable to create an appropriate procedure which contains indications when a processor may be considered sufficiently reliable to implement proper technical and organizational measures required by RODO.
New regulations also stipulate a data controller’s requirement to be granted with authority to perform audits and/or inspections on processors.
Data protection impact assessment shall be performed if a high risk to the rights and freedoms of natural persons and type of processing, in particular when using new technologies, is likely to result.
In that case data controller is obliged to perform personal data protection impact assessment prior to processing. It is worth to add that if data protection officer was designated, a data controller shall consult with him or her during DPIA. One of the conveniences of RODO is the fact that a single assessment is sufficient for multiple processing operations sharing the similar risk level.
The measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with RODO, taking into account the rights and legitimate interests data subjects and other persons concerned.
The data controller shall analyze (assess) the risk, that is eventuality of an event, which may have impact on fulfillment of presumed purposes. The risk is measured by the impact (consequences) and likelihood of appearance.
Stage 1 – shall define the risk, its source, causes and potential damage.
Stage 2 – the controller defines a likelihood of risk occurrence (including the risk assessment, dealing with the risk, the way of informing about the risk).
Stage 3 – the data controller eliminates or prevents the risk.
where processing involves a large amount of personal data and affects a large number of data subjects.

References: art. 13
 art. 14
 art. 4
 art. 21
 art. 30
 art. 34
 art. 83
 art. 9
 art. 10