Source: http://www.inhouselawyer.co.uk/wgd_question/are-there-any-registration-or-licensing-requirements-for-entities-covered-by-these-laws-and-if-so-what-are-the-requirements-are-there-any-exemptions/
Timestamp: 2019-05-22 23:25:03
Document Index: 293350161

Matched Legal Cases: ['art. 11', 'art. 11', 'art. 11', 'Art. 11', 'art. 11', 'art. 11', 'art. 3', 'art. 3', 'art. 3', 'art. 3']

Are there any registration or licensing requirements for entities covered by these laws and, if so, what are the requirements? Are there any exemptions? | The In-House Lawyer
Under the Data Protection Law, any database containing personal data must be registered before the Data Protection Authority.
Until recently, the registration procedure consisted of completing a form, submitting proper documentation and paying a fee. The form could be submitted online, but a hard copy still had to be sent to the Data Protection Authority. The registration had to be renewed annually.
However, in 2018 Data Protection Authority Regulation No. 132/2018 established a new procedure for the registration and renewal of public or private databases. The most significant changes were that all proceedings must now be carried out online, are free, and are not subject to annual renewal. Instead, the data controller must inform any supervening modification by means of a sworn declaration to keep the registry updated.
The GDPR removed the general obligation to notify the regulatory authority before processing personal data. No such general notification obligation to notify has been adopted under national law.
According to Article 25b PDPA both controllers and processors are obliged to notify the CPDP with specific details about an appointed data protection officer (DPO), including the DPO's: name, national personal identification number and contact details, if they appoint DPO.
FADP sets out a duty to register data files for the controller of such data files (see art. 11a FADP). Pursuant to art. 11a para. 2 FADP federal bodies must notify and register all their data files with the FDPIC. Private persons must notify their data files only in two constellations (see art. 11a para. 3 FADP):
Art. 11a para. 5 FADP contains a list with exemptions from the notification duty. One of the most important exemptions is set out in art. 11a para. 5 lit. e FADP: Data files must not be registered in the case that the respective controller has appointed an internal data protection officer.
Data file as set out in art. 11a FADP means any set of personal data that is structured in such a way that the data is accessible by data subject (see art. 3 lit. g FADP).
Controller of the data file means private persons or federal bodies that decide on the purpose and content of a data file (art. 3 lit. i FADP).
Sensitive personal data means data on: 1. religious, ideological, political or trade union-related views or activities, 2. health, the intimate sphere or the racial origin, 3. social security measures, and 4. administrative or criminal proceedings and sanctions (see art. 3 lit. c FADP).
Personality profiles means a collection of data that permits an assessment of essential characteristics of the personality of a natural person (art. 3 lit. d FADP).
Yes, under the Data Protection (Charges and Information) Regulations 2018, individuals and organisations that process personal data (known as a 'controller') need to pay a data protection fee to the Information Commissioner's Office (ICO) unless they are exempt. There is a three tier system based on the size of an organisation and how much personal data the organization is processing. The fee ranges from £40 to £2,900 dependent on number of employees or turnover.
The U.S. does not have any privacy-oriented general requirements to register personal information processing activities. However, certain industry-specific self-regulatory programs that touch on privacy may be applicable. For example, the Payment Card Industry Data Security Standard (PCI-DSS) – a standard, not a law – provides security requirements for all entities accepting or processing payment transactions and might apply in this scenario. The digital advertising industry is governed by self-regulatory principles enforced by the Digital Advertising Alliance and the Network Advertising Initiative.