natgillin/translations-raw huggingface dataset:
Once an organisation has voluntarily decided to self-certify [26] under the EU-U.S. Privacy Shield, its effective compliance with the Principles is compulsory.
Ko se organizacija prostovoljno odloči za samocertificiranje [26] v okviru zasebnostnega ščita EU-ZDA, je njeno dejansko upoštevanje načel obvezno.
To be allowed to continue to rely on the Privacy Shield to receive personal data from the Union, such organisation must annually re-certify its participation in the framework.
Da bi še naprej lahko uporabljala zasebnostni ščit za prejemanje podatkov iz Unije, mora taka organizacija vsako leto znova potrditi svojo udeležbo v okviru.
Organisations must also take measures to verify [27] that their published privacy policies conform to the Principles and are in fact complied with.
Organizacije morajo sprejeti tudi ukrepe za preverjanje [27], ali so njihove objavljene politike varstva zasebnosti skladne z načeli in ali se dejansko upoštevajo.
This can be done either through a system of self-assessment, which must include internal procedures ensuring that employees receive training on the implementation of the organisation's privacy policies and that compliance is periodically reviewed in an objective manner, or outside compliance reviews, the methods of which may include auditing or random checks.
To se lahko izvede s sistemom samoocenjevanja, ki mora vključevati notranje postopke, ki zagotavljajo, da so zaposleni deležni usposabljanja o izvajanju politik organizacije glede varstva zasebnosti in da se skladnost redno objektivno preverja, ali, pri zunanjih pregledih skladnosti, z metodami, ki lahko vključujejo revizijo in naključne preglede.
In addition, the organisation must put in place an effective redress mechanism to deal with any complaints (see in this respect also recitals 43) and be subject to the investigatory and enforcement powers of the FTC, the Department of Transportation or another U.S. authorised statutory body that will effectively ensure compliance with the Principles.
Poleg tega mora organizacija vzpostaviti učinkovit mehanizem pravnega varstva za obravnavanje morebitnih pritožb (v zvezi s tem glej tudi uvodno izjavo 43), zanjo pa morajo veljati preiskovalna in izvršilna pooblastila FTC, Ministrstva za promet ali drugega ameriškega zakonsko določenega organa, ki učinkovito zagotavlja skladnost z načeli.
Special rules apply for so-called ‘onward transfers’, i.e. transfers of personal data from an organisation to a third party controller or processor, irrespective of whether the latter is located in the United States or a third country outside the United States (and the Union).
Posebna pravila se uporabljajo za tako imenovane „prenose tretjemu“, tj. prenose osebnih podatkov z organizacije na tretjega upravljavca ali obdelovalca, ne glede na to, ali je ta v ZDA ali tretji državi zunaj ZDA (in Unije).
The purpose of these rules is to ensure that the protections guaranteed to the personal data of EU data subjects will not be undermined, and cannot be circumvented, by passing them on to third parties.
Namen teh pravil je zagotoviti, da varstvo osebnih podatkov posameznikov iz EU ni ogroženo in da se mu ni mogoče izogniti z njegovim prenosom na tretje stranke.
This is particularly relevant in more complex processing chains which are typical for today's digital economy.
To je zlasti pomembno v bolj zapletenih verigah obdelave, ki so značilne za sodobno digitalno gospodarstvo.
Under the Accountability for Onward Transfer Principle [28], any onward transfer can only take place (i) for limited and specified purposes, (ii) on the basis of a contract (or comparable arrangement within a corporate group [29]) and (iii) only if that contract provides the same level of protection as the one guaranteed by the Principles, which includes the requirement that the application of the Principles may only be limited to the extent necessary to meet national security, law enforcement and other public interest purposes [30].
V skladu z načelom odgovornosti za prenos tretjemu [28] se lahko kakršen koli prenos tretjemu izvaja samo (i) za omejene in določene namene, (ii) na podlagi pogodbe (ali primerljivega dogovora v skupini podjetij [29]) in (iii) samo, če taka pogodba zagotavlja enako raven varstva, kot ga zagotavljajo načela, kar vključuje zahtevo, da je uporaba načel lahko omejena le toliko, kolikor je potrebno za izpolnitev namenov nacionalne varnosti, kazenskega pregona in drugih javnih interesov [30].
This should be read in conjunction with the Notice and, in the case of an onward transfer to a third party controller [31], with the Choice Principle, according to which data subjects must be informed (among others) about the type/identity of any third party recipient, the purpose of the onward transfer as well as the choice offered and can object (opt out) or, in the case of sensitive data, have to give ‘affirmative express consent’ (opt in) for onward transfers.
To bi bilo treba razlagati v povezavi z načelom obvestila in, v primeru prenosa tretjemu upravljavcu [31], z načelom izbire, v skladu s katerima morajo biti posamezniki, na katere se nanašajo osebni podatki, obveščeni (med drugim) o vrsti/identiteti katerega koli tretjega prejemnika, namenu prenosa tretjemu, pa tudi o možnostih izbire ter lahko nasprotujejo prenosom tretjemu (oziroma jih zavrnejo) ali morajo, v primeru občutljivih podatkov, dati „izrecno pritrdilno soglasje“ (privolitev) za prenose.
In the light of the Data Integrity and Purpose Limitation Principle, the obligation to provide the same level of protection as guaranteed by the Principles presupposes that the third party may only process the personal information transmitted to it for purposes that are not incompatible with the purposes for which it was originally collected or subsequently authorised by the individual.
Ob upoštevanju načela celovitosti podatkov in omejitve namena obveznost zagotavljanja enake ravni varstva, kot jo zagotavljajo načela, predvideva, da lahko tretja stranka obdeluje samo osebne podatke, ki so preneseni nanjo za namene, ki so skladni z nameni, za katere so bili prvotno zbrani ali ki jih je posameznik naknadno odobril.
The obligation to provide the same level of protection as required by the Principles applies to any and all third parties involved in the processing of the data so transferred irrespective of their location (in the U.S. or another third country) as well as when the original third party recipient itself transfers those data to another third party recipient, for example, for sub-processing purposes.
Obveznost zagotavljanja enake ravni varstva, kot jo zahtevajo načela, velja za katero koli in vse tretje stranke, vključene v obdelavo podatkov, ki se prenašajo na tak način, ne glede na njihovo lokacijo (v ZDA ali drugi tretji državi), pa tudi, kadar sam prvotni tretji prejemnik prenaša zadevne podatke drugemu tretjemu prejemniku, na primer za namene podobdelave.
In all cases, the contract with the third party recipient must provide that the latter will notify the Privacy Shield organisation if it makes a determination that it can no longer meet this obligation.
V vseh primerih mora biti v pogodbi s tretjim prejemnikom določeno, da bo ta obvestil organizacijo v zasebnostnem ščitu, če bo ugotovil, da ne more več izpolnjevati te obveznosti.
When such a determination is made, the processing by the third party will cease or other reasonable and appropriate steps have to be taken to remedy the situation [32].
V primeru take ugotovitve se obdelava s strani tretje stranke preneha, ali pa je treba sprejeti druge razumne in ustrezne ukrepe za izboljšanje stanja [32].
Where compliance problems arise in the (sub-) processing chain, the Privacy Shield organisation acting as the controller of the personal data will have to prove that it is not responsible for the event giving rise to the damage, or otherwise face liability, as specified in the Recourse, Enforcement and Liability Principle.
Kadar se v verigi (pod)obdelave pojavijo težave glede skladnosti, mora organizacija v zasebnostnem ščitu, ki deluje kot upravljavec osebnih podatkov, dokazati, da ni odgovorna za dogodek, ki povzroča škodo, ali kako drugače prevzeti odgovornost, kot je navedeno v načelu pritožbenega mehanizma, izvrševanja in odgovornosti.
Additional protections apply in the case of an onward transfer to a third party agent [33].
Dodatno varstvo se uporablja v primeru prenosa tretjemu posredniku [33].
Transparency, Administration and Oversight of the EU-U.S. Privacy Shield
Preglednost, upravljanje in nadzor zasebnostnega ščita EU-ZDA
The EU-U.S. Privacy Shield provides for oversight and enforcement mechanisms in order to verify and ensure that U.S. self-certified companies comply with the Principles and that any failure to comply is addressed.
Zasebnostni ščit EU-ZDA zagotavlja mehanizme nadzora in izvrševanja za preverjanje in zagotavljanje, da samocertificirana podjetja v ZDA spoštujejo načela in da se obravnava vsako nespoštovanje načel.
These mechanisms are set out in the Principles (Annex II) and the commitments undertaken by the Department of Commerce (Annex I), the FTC (Annex IV) and the Department of Transportation (Annex V).
Ti mehanizmi so določeni v načelih (Priloga II) ter zavezah Ministrstva za trgovino (Priloga I), FTC (Priloga IV) in Ministrstva za promet (Priloga V).
To ensure the proper application of the EU-U.S. Privacy Shield, interested parties, such as data subjects, data exporters and the national Data Protection Authorities (DPAs), must be able to identify those organisations adhering to the Principles.
Za zagotovitev pravilne uporabe zasebnostnega ščita EU-ZDA morajo biti zainteresirane strani, kot so posamezniki, na katere se nanašajo osebni podatki, izvozniki podatkov in nacionalni organi za varstvo podatkov, sposobne opredeliti organizacije, ki spoštujejo načela.
To this end, the Department of Commerce has undertaken to maintain and make available to the public a list of organisations that have self-certified their adherence to the Principles and fall within the jurisdiction of at least one of the enforcement authorities referred to in Annexes I and II to this decision (‘Privacy Shield List’) [34].
V ta namen se mora Ministrstvo za trgovino zavezati, da bo vodilo seznam organizacij, ki so samocertificirale zavezanost k načelom in spadajo v pristojnost vsaj enega od organov pregona, navedenih v prilogah I in II k temu sklepu (v nadaljnjem besedilu: seznam zasebnostnega ščita) [34], ter javnosti omogočilo dostop do takega seznama.
The Department of Commerce will update the list on the basis of an organisation's annual re-certification submissions and whenever an organisation withdraws or is removed from the EU-U.S. Privacy Shield.
Ministrstvo za trgovino bo posodabljalo seznam na podlagi letnih izjav organizacij o ponovnem certificiranju ali kadar se organizacija umakne ali je umaknjena s seznama zasebnostnega ščita EU-ZDA.
It will also maintain and make available to the public an authoritative record of organisations that have been removed from the list, in each case identifying the reason for such removal.
Vodilo bo tudi veljavno evidenco organizacij, ki so bile umaknjene s seznama, in javnosti omogočalo dostop do nje, pri čemer bo v vsakem primeru navedlo razloge za tako izključitev.
Finally, it will provide a link to the list of Privacy Shield-related FTC enforcement cases maintained on the FTC website.
Navedlo bo tudi povezavo do seznama zadev FTC v zvezi z izvrševanjem, povezanih z zasebnostnim ščitom, ki se hranijo na spletišču FTC.
In this case, an organisation has to identify a contact point within the organisation for all Privacy Shield-related questions.
Za vsako zavajanje širše javnosti v zvezi z zavezanostjo k načelom v obliki zavajajočih izjav ali praks lahko FTC, Ministrstvo za promet ali drugi ustrezni izvršni organi ZDA ukrepajo proti kršitvi; zavajanje Ministrstva za trgovino se lahko preganja po zakonu o lažnih navedbah (False Statements Act) (člen 1001 naslova 18 zakonodajne zbirke ZDA) [37].
The Department of Commerce will monitor organisations that are no longer members of the EU-U.S. Privacy Shield, either because they have voluntarily withdrawn or because their certification has lapsed, to verify whether they will return, delete or retain [35] the personal data received previously under the framework.
Ministrstvo za trgovino bo po uradni dolžnosti spremljalo kakršne koli lažne navedbe o sodelovanju v zasebnostnem ščitu ali nepravilno uporabo potrditvene oznake zasebnostnega ščita, organi za varstvo podatkov pa lahko napotijo organizacije na pregled na posebno kontaktno točko v okviru Ministrstva.
If they retain these data, organisations are obliged to continue to apply the Principles to them.
Če se je organizacija umaknila iz zasebnostnega ščita EU-ZDA, se ni ponovno certificirala ali je umaknjena s seznama zasebnostnega ščita, bo Ministrstvo za trgovino redno preverjalo, ali je iz objavljene politike varstva zasebnosti izbrisala kakršna koli sklicevanja na zasebnostni ščit, ki kažejo na njeno nadaljnje sodelovanje, in, če še naprej podaja lažne navedbe, predalo zadevo FTC, Ministrstvu za promet ali drugemu pristojnemu organu, da izvedejo morebitne izvršilne ukrepe.
In cases where the Department of Commerce has removed organisations from the framework due to a persistent failure to comply with the Principles, it will ensure that those organisations return or delete the personal data they had received under the framework.
Poslalo bo tudi vprašalnike organizacijam, ki se niso samocertificirale ali ki so se prostovoljno umaknile iz zasebnostnega ščita EU-ZDA, da bi preverilo, ali bo organizacija vrnila, izbrisala ali še naprej uporabljala načela zasebnosti za osebne podatke, ki jih je prejela med sodelovanjem v zasebnostnem ščitu EU-ZDA, in, če namerava osebne podatke zadržati, da bi preverilo, kdo v organizaciji bo stalna kontaktna točka za vprašanja, povezana z zasebnostnim ščitom.
When an organisation leaves the EU-U.S. Privacy Shield for any reason, it must remove all public statements implying that it continues to participate in the EU-U.S. Privacy Shield or is entitled to its benefits, in particular any references to the EU-U.S. Privacy Shield in its published privacy policy.
Ministrstvo za trgovino bo redno izvajalo preglede skladnosti samocertificiranih organizacij po uradni dolžnosti [38], tudi s pošiljanjem podrobnih vprašalnikov.
The Department of Commerce will search for and address false claims of participation in the framework, including by former members [36].
Prav tako bo sistematično izvajalo preglede, kadar koli bo prejelo določeno (neutemeljeno) pritožbo, če organizacija ne zagotovi zadovoljivega odgovora na njegove poizvedbe ali če obstajajo verodostojni dokazi, da organizacija morda ne spoštuje načel.
Any misrepresentation to the general public by an organisation concerning its adherence to the Principles in the form of misleading statements or practices is subject to enforcement action by the FTC, Department of Transportation or other relevant U.S. enforcement authorities; misrepresentations to the Department of Commerce are enforceable under the False Statements Act (18 U.S.C. § 1001) [37].
Po potrebi se bo o takih pregledih skladnosti posvetovalo tudi z organi za varstvo podatkov.
The Department of Commerce will ex officio monitor any false claims of Privacy Shield participation or the improper use of the Privacy Shield certification mark, and DPAs can refer organisations for review to a dedicated contact point at the Department.
Mehanizmi pravnega varstva, reševanje pritožb in izvrševanje
When an organisation has withdrawn from the EU-U.S.
Zasebnostni ščit EU-ZDA v skladu z načelom pritožbenega mehanizma, izvrševanja in odgovornosti zahteva, da organizacije zagotovijo pritožbeni mehanizem za posameznike, na katere vpliva nespoštovanje načel, ter s tem možnost, da posamezniki iz EU, na katere se nanašajo osebni podatki, vložijo pritožbe v zvezi z nespoštovanjem načel s strani samocerticifiranih podjetij v ZDA in da se te pritožbe rešijo, če to zahteva odločitev, ki zagotavlja učinkovita pravna sredstva.
Privacy Shield, fails to re-certify or is removed from the Privacy Shield List, the Department of Commerce will on an on-going basis verify that it has deleted from its published privacy policy any references to the Privacy Shield that imply its continued participation and, if it continues to make false claims, refer the matter to the FTC, Department of Transportation or other competent authority for possible enforcement action.
Organizacije morajo v okviru samocertificiranja izpolnjevati zahteve načela pritožbenega mehanizma, izvrševanja in odgovornosti z zagotavljanjem učinkovitih in zlahka dostopnih neodvisnih pritožbenih mehanizmov, s katerimi se lahko pritožbe in spori vsakega posameznika raziščejo in hitro razrešijo brez stroškov za posameznika.
It will also send questionnaires to organisations whose self-certifications lapse or that have voluntarily withdrawn from the EU-U.S.
Organizacije lahko izberejo neodvisne pritožbene mehanizme v Uniji ali ZDA.
Privacy Shield to verify whether the organisation will return, delete or continue to apply the Privacy Principles to the personal data that they received while participating in the EU-U.S. Privacy Shield and, if personal data are to be retained, verify who within the organisation will serve as an ongoing contact point for Privacy Shield-related questions.
To vključuje možnost prostovoljne zaveza za sodelovanje z organi za varstvo podatkov EU.
On an ongoing basis, the Department of Commerce will conduct ex officio compliance reviews [38] of self-certified organisations, including through sending detailed questionnaires.
Vendar taka možnost ne obstaja, če organizacije obdelujejo podatke o človeških virih, saj je v takem primeru sodelovanje z organi za varstvo podatkov obvezno.
It will also systematically carry out reviews whenever it has received a specific (non-frivolous) complaint, when an organisation does not provide satisfactory responses to its enquiries, or when there is credible evidence suggesting that an organisation may not be complying with the Principles.
Druge možnosti vključujejo neodvisno alternativno reševanje sporov ali v zasebnem sektorju razvite programe za varstvo zasebnosti, ki v svoja pravila vključujejo načela zasebnosti.
Where appropriate, the Department of Commerce will also consult with DPAs about such compliance reviews.
Slednji morajo vključevati učinkovite mehanizme izvrševanja v skladu z zahtevami načela pritožbenega mehanizma, izvrševanja in odgovornosti.
Redress mechanisms, complaint handling and enforcement
Organizacije morajo odpraviti vse težave, povezane z nespoštovanjem načel.
The EU-U.S. Privacy Shield, through the Recourse, Enforcement and Liability Principle, requires organisations to provide recourse for individuals who are affected by non-compliance and thus the possibility for EU data subjects to lodge complaints regarding non-compliance by U.S. self-certified companies and to have these complaints resolved, if necessary by a decision providing an effective remedy.
Navesti morajo tudi, da zanje veljajo preiskovalna in izvršilna pooblastila FTC, Ministrstva za promet ali katerega koli drugega ameriškega zakonsko določenega organa.
As part of their self-certification, organisations must satisfy the requirements of the Recourse, Enforcement and Liability Principle by providing for effective and readily available independent recourse mechanisms by which each individual's complaints and disputes can be investigated and expeditiously resolved at no cost to the individual.
Tako okvir zasebnostnega ščita posameznikom, na katere se nanašajo osebni podatki, zagotavlja številne možnosti, da uveljavljajo svoje pravice, vložijo pritožbe v zvezi z nespoštovanjem načel s strani samocertificiranih podjetij v ZDA in da se te pritožbe rešijo, če to zahteva odločitev, ki zagotavlja učinkovita pravna sredstva.
Organisations may choose independent recourse mechanisms in either the Union or in the United States.
Posamezniki lahko vložijo pritožbo neposredno pri organizaciji, neodvisnem organu za reševanje sporov, ki ga imenuje organizacija, pri nacionalnih organih za varstvo podatkov ali FTC.
This includes the possibility to voluntarily commit to cooperate with the EU DPAs.
Če se njihove pritožbe ne rešijo z nobenim od teh pritožbenih mehanizmov ali mehanizmov izvrševanja, lahko uveljavljajo zavezujočo arbitražo senata zasebnostnega ščita (Priloga 1 Priloge II tega sklepa).
However, no such choice exists where organisations process human resources data as cooperation with the DPAs is then mandatory.
Razen za arbitražni senat, za katerega je treba pred uveljavitvijo izčrpati nekatera pravna sredstva, lahko posamezniki uporabijo kateri koli ali vse mehanizme pravnega varstva po lastni izbiri in jim ni treba izbrati določenega mehanizma ali slediti določenemu zaporedju.
Other alternatives include independent Alternative Dispute Resolution (ADR) or private-sector developed privacy programs that incorporate the Privacy Principles into their rules.
Vendar obstaja določeno logično zaporedje, ki mu je priporočljivo slediti, kot je opisano v nadaljevanju.
The latter must include effective enforcement mechanisms in accordance with the requirements of the Recourse, Enforcement and Liability Principle.
Prvič, posamezniki iz EU, na katere se nanašajo osebni podatki, lahko spremljajo primere nespoštovanja načel z neposrednimi stiki s samocertificiranim podjetjem v ZDA.
Organisations are obliged to remedy any problems of non-compliance.
Za lažje reševanje pritožb mora organizacija vzpostaviti učinkovit mehanizem pravnega varstva za obravnavanje takih pritožb.
They must also specify that they are subject to the investigatory and enforcement powers of the FTC, the Department of Transportation or any other U.S. authorized statutory body.
Zato mora politika organizacije glede varstva zasebnosti jasno obveščati posameznike o kontaktni točki, bodisi v organizaciji ali zunaj nje, ki bo obravnavala pritožbe (vključno s katero koli ustrezno organizacijo v Uniji, ki lahko odgovarja na poizvedbe ali pritožbe), in o neodvisnih mehanizmih za obravnavo pritožb.
Consequently, the Privacy Shield framework provides data subjects with a number of possibilities to enforce their rights, lodge complaints regarding non-compliance by U.S. self-certified companies and to have their complaints resolved, if necessary by a decision providing an effective remedy.
Organizacija mora po prejemu pritožbe, neposredno od posameznika ali prek Ministrstva za trgovino na podlagi napotitve organa za varstvo podatkov, posamezniku v EU, na katerega se nanašajo osebni podatki, odgovoriti v 45 dneh.
Individuals can bring a complaint directly to an organisation, to an independent dispute resolution body designated by the organisation, to national DPAs or to the FTC.
Ta odgovor mora vključevati oceno utemeljenosti pritožbe in, v primeru utemeljenosti pritožbe, informacije o tem, kako bo organizacija rešila težavo.
In cases where their complaints have not been resolved by any of these recourse or enforcement mechanisms, individuals also have a right to invoke binding arbitration under the Privacy Shield Panel (Annex 1 of Annex II of this decision).
Podobno morajo organizacije nemudoma odgovoriti na poizvedbe in druge zahteve za informacije s strani Ministrstva za trgovino ali organa za varstvo [39] (če se je organizacija zavezala, da bo sodelovala z organom za varstvo podatkov), ki se nanašajo na njihovo spoštovanje načel.
Except for the arbitral panel, which requires certain remedies to be exhausted before it can be invoked, individuals are free to pursue any or all of the redress mechanism of their choice, and are not obliged to choose one mechanism over the other or to follow a specific sequence.
Organizacije morajo voditi tudi evidenco o izvajanju politike varstva zasebnosti in jo na zahtevo v okviru preiskave ali pritožbe zaradi nespoštovanja načel dati na voljo neodvisnemu pritožbenemu mehanizmu ali FTC (ali drugemu organu ZDA s pristojnostjo za preiskovanje nepoštenih ali goljufivih dejanj).