natgillin/translations-raw huggingface dataset:
Member States shall provide for the processor and any person acting under the authority of the controller or of the processor, who has access to personal data, not to process those data except on instructions from the controller, unless required to do so by Union or Member State law.
Evidenca dejavnosti obdelave
Article 24
Države članice določijo, da upravljavci vodijo evidenco vseh vrst dejavnosti obdelave, za katere so odgovorni.
Records of processing activities
Ta evidenca vsebuje vse naslednje informacije:
Member States shall provide for controllers to maintain a record of all categories of processing activities under their responsibility.
ime in kontaktne podatke upravljavca, in kadar obstajata skupnega upravljavca in pooblaščene osebe za varstvo podatkov;
That record shall contain all of the following information:
namene obdelave;
the name and contact details of the controller and, where applicable, the joint controller and the data protection officer;
kategorije uporabnikov, ki so jim bili ali jim bodo razkriti osebni podatki, vključno z uporabniki v tretjih državah ali mednarodnih organizacijah;
the purposes of the processing;
opis kategorij posameznikov, na katere se nanašajo osebni podatki, in vrst osebnih podatkov;
the categories of recipients to whom the personal data have been or will be disclosed including recipients in third countries or international organisations;
kadar je ustrezno, oblikovanje profilov;
a description of the categories of data subject and of the categories of personal data;
kadar je ustrezno, kategorije prenosov osebnih podatkov v tretjo državo ali mednarodno organizacijo;
where applicable, the use of profiling;
navedbo pravne podlage za dejanja obdelave, vključno s prenosi, za katere so osebni podatki namenjeni;
where applicable, the categories of transfers of personal data to a third country or an international organisation;
kadar je mogoče, predvidene roke za izbris različnih vrst osebnih podatkov;
an indication of the legal basis for the processing operation, including transfers, for which the personal data are intended;
kadar je mogoče, splošni opis tehničnih in organizacijskih varnostnih ukrepov iz člena 29(1).
where possible, the envisaged time limits for erasure of the different categories of personal data;
Države članice določijo, da vsak obdelovalec vodi evidenco vseh vrst dejavnosti obdelave, ki jih izvaja v imenu upravljavca, evidenca pa vsebuje:
where possible, a general description of the technical and organisational security measures referred to in Article 29(1).
ime in kontaktne podatke obdelovalca ali obdelovalcev, posameznih upravljavcev, v imenu katerih deluje obdelovalec, in kadar obstaja pooblaščene osebe za varstvo podatkov;
Member States shall provide for each processor to maintain a record of all categories of processing activities carried out on behalf of a controller, containing:
vrste obdelave, ki se izvaja v imenu posameznega upravljavca;
the name and contact details of the processor or processors, of each controller on behalf of which the processor is acting and, where applicable, the data protection officer;
kadar je ustrezno, prenose osebnih podatkov v tretjo državo ali mednarodno organizacijo in identifikacijo te tretje države ali mednarodne organizacije, kadar to izrecno naroči upravljavec;
the categories of processing carried out on behalf of each controller;
Evidence iz odstavkov 1 in 2 so v pisni, vključno v elektronski obliki.
where applicable, transfers of personal data to a third country or an international organisation where explicitly instructed to do so by the controller, including the identification of that third country or international organisation;
Upravljavec in obdelovalec nadzornemu organu na zahtevo omogočita dostop do evidence.
The records referred to in paragraphs 1 and 2 shall be in writing, including in electronic form.
Člen 25
The controller and the processor shall make those records available to the supervisory authority on request.
Vodenje dnevnikov
Article 25
Države članice določijo, da se vodijo dnevniki vsaj o naslednjih dejanjih obdelave v avtomatiziranih sistemih obdelave: zbiranje, predelava, vpogled, razkritje, vključno s prenosi, kombiniranje in izbris.
Logging
Dnevniki vpogleda in razkritja omogočajo utemeljitev, opredelitev datuma in časa takih dejanj ter, če je to mogoče, identifikacijo osebe, ki je vpogledala v osebne podatke ali jih razkrila, ter identiteto uporabnikov takih osebnih podatkov.
Member States shall provide for logs to be kept for at least the following processing operations in automated processing systems: collection, alteration, consultation, disclosure including transfers, combination and erasure.
Dnevniki se uporabljajo zgolj za preverjanje zakonitosti obdelave, notranje spremljanje, zagotavljanje neoporečnosti in varnosti osebnih podatkov ter v kazenskih postopkih.
The logs of consultation and disclosure shall make it possible to establish the justification, date and time of such operations and, as far as possible, the identification of the person who consulted or disclosed personal data, and the identity of the recipients of such personal data.
Upravljavec in obdelovalec nadzornemu organu na zahtevo omogočita dostop do dnevnikov.
The logs shall be used solely for verification of the lawfulness of processing, self-monitoring, ensuring the integrity and security of the personal data, and for criminal proceedings.
Člen 26
The controller and the processor shall make the logs available to the supervisory authority on request.
Sodelovanje z nadzornim organom
Article 26
Države članice določijo, da upravljavec in obdelovalec na zahtevo sodelujeta z nadzornim organom pri izvajanju njegovih nalog.
Cooperation with the supervisory authority
Člen 27
Member States shall provide for the controller and the processor to cooperate, on request, with the supervisory authority in the performance of its tasks on request.
Ocena učinka v zvezi z varstvom na podatkov
Article 27
Kadar je možno, da bi lahko vrsta obdelave, zlasti z uporabo novih tehnologij, ob upoštevanju narave, obsega, okoliščin in namenov obdelave, povzročila veliko tveganje za pravice in svoboščine posameznikov, države članice določijo, da upravljavec pred obdelavo opravi oceno učinka predvidenih dejanj obdelave na varstvo osebnih podatkov.
Data protection impact assessment
Ocena iz odstavka 1 obsega vsaj splošni opis predvidenih dejanj obdelave, oceno tveganja za pravice in svoboščine posameznikov, na katere se nanašajo osebni podatki, ukrepe, namenjene obvladovanju teh tveganj, zaščitne ukrepe, varnostne ukrepe ter mehanizme za zagotavljanje varstva osebnih podatkov in za dokazovanje skladnosti s to direktivo, pri čemer se upoštevajo pravice in zakoniti interesi posameznikov, na katere se nanašajo osebni podatki, ter drugih zadevnih oseb.
Where a type of processing, in particular, using new technologies, and taking into account the nature, scope, context and purposes of the processing is likely to result in a high risk to the rights and freedoms of natural persons, Member States shall provide for the controller to carry out, prior to the processing, an assessment of the impact of the envisaged processing operations on the protection of personal data.
Člen 28
The assessment referred to in paragraph 1 shall contain at least a general description of the envisaged processing operations, an assessment of the risks to the rights and freedoms of data subjects, the measures envisaged to address those risks, safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Directive, taking into account the rights and legitimate interests of the data subjects and other persons concerned.
Predhodno posvetovanje z nadzornim organom
Article 28
Države članice določijo, da se upravljavec ali obdelovalec pred obdelavo osebnih podatkov, ki bodo del nove zbirke, posvetuje z nadzornim organom, kadar:
Prior consultation of the supervisory authority
ocena učinka na varstvo podatkov iz člena 27 kaže, da bi obdelava povzročila veliko tveganje, če upravljavec ne bi sprejel ukrepov za ublažitev tveganja, ali
Member States shall provide for the controller or processor to consult the supervisory authority prior to processing which will form part of a new filing system to be created, where:
vrsta obdelave, zlasti v primeru uporabe novih tehnologij, mehanizmov ali postopkov, pomeni veliko tveganje za pravice in svoboščine posameznikov, na katere se nanašajo osebni podatki.
a data protection impact assessment as provided for in Article 27 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk; or
Države članice določijo, da se med pripravo predloga zakonodajnega ukrepa, ki ga sprejme nacionalni parlament, ali regulativnega ukrepa, ki temelji na takšnem zakonodajnem ukrepu, ki se nanaša na obdelavo, izvede posvetovanje z nadzornim organom.
the type of processing, in particular, where using new technologies, mechanisms or procedures, involves a high risk to the rights and freedoms of data subjects.
Države članice določijo, da lahko nadzorni organ pripravi seznam dejanj obdelave, za katere je treba v skladu z odstavkom 1 opraviti predhodno posvetovanje.
Member States shall provide for the supervisory authority to be consulted during the preparation of a proposal for a legislative measure to be adopted by a national parliament or of a regulatory measure based on such a legislative measure, which relates to processing.
Države članice določijo, da upravljavec nadzornemu organu predloži oceno učinka na varstvo podatkov v skladu s členom 27, na zahtevo pa tudi vse druge informacije, ki bodo nadzornemu organu omogočile, da oceni skladnost obdelave in zlasti tveganja za varstvo osebnih podatkov posameznika, na katerega se ti podatki nanašajo, ter s tem povezane zaščitne ukrepe.
Member States shall provide that the supervisory authority may establish a list of the processing operations which are subject to prior consultation pursuant to paragraph 1.
Države članice določijo, da nadzorni organ, kadar meni, da bi predvidena obdelava iz odstavka 1 tega člena lahko kršila predpise, sprejete na podlagi te direktive, zlasti kadar upravljavec ni ustrezno opredelil ali ublažil tveganja, pisno svetuje upravljavcu, kadar je to ustrezno, pa tudi obdelovalcu, v roku do šestih tednov po prejemu zahteve za posvetovanje in lahko uporabi katero koli pooblastilo iz člena 47.
Member States shall provide for the controller to provide the supervisory authority with the data protection impact assessment pursuant to Article 27 and, on request, with any other information to allow the supervisory authority to make an assessment of the compliance of the processing and in particular of the risks for the protection of personal data of the data subject and of the related safeguards.
To obdobje se lahko ob upoštevanju kompleksnosti predvidene obdelave podaljša za en mesec.
Member States shall, where the supervisory authority is of the opinion that the intended processing referred to in paragraph 1 of this Article would infringe the provisions adopted pursuant to this Directive, in particular where the controller has insufficiently identified or mitigated the risk, provide for the supervisory authority to provide, within a period of up to six weeks of receipt of the request for consultation, written advice to the controller and, where applicable, to the processor, and may use any of its powers referred to in Article 47.
Nadzorni organ o vsakem takem podaljšanju obvesti upravljavca in kadar je to ustrezno obdelovalca v enem mesecu od prejema zahteve za posvetovanje, skupaj z razlogi za zamudo.
That period may be extended by a month, taking into account the complexity of the intended processing.
Oddelek 2
The supervisory authority shall inform the controller and, where applicable, the processor of any such extension within one month of receipt of the request for consultation, together with the reasons for the delay.
Varnost osebnih podatkov
Section 2
Člen 29
Security of personal data
Varnost obdelave
Article 29
Države članice določijo, da upravljavec in obdelovalec ob upoštevanju tehnološkega razvoja, stroškov izvajanja in narave, obsega, okoliščin in namenov obdelave, pa tudi tveganj za pravice in svoboščine posameznikov, ki se razlikujejo po verjetnosti in resnosti, z ustreznimi tehničnimi in organizacijskimi ukrepi zagotovita ustrezno raven varnosti glede na tveganje, zlasti kar zadeva obdelavo posebnih vrst osebnih podatkov iz člena 10.
Security of processing
V zvezi z avtomatizirano obdelavo osebnih podatkov vsaka država članica določi, da upravljavec ali obdelovalec po oceni tveganj izvede ukrepe, katerih namen je:
Member States shall provide for the controller and the processor, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in particular as regards the processing of special categories of personal data referred to in Article 10.
onemogočiti dostop nepooblaščenih oseb do opreme, ki se uporablja za obdelavo (nadzor dostopa do opreme);
In respect of automated processing, each Member State shall provide for the controller or processor, following an evaluation of the risks, to implement measures designed to:
preprečiti nepooblaščeno branje, prepisovanje, spreminjanje ali odnašanje nosilcev podatkov (nadzor nosilcev podatkov);
deny unauthorised persons access to processing equipment used for processing (‘equipment access control’);
preprečiti nepooblaščeno vnašanje osebnih podatkov v podatkovne zbirke in nepooblaščeno pregledovanje, spreminjanje ali brisanje shranjenih osebnih podatkov (nadzor shranjevanja);
prevent the unauthorised reading, copying, modification or removal of data media (‘data media control’);
nepooblaščenim osebam, ki uporabljajo opremo za prenos podatkov, preprečiti uporabo sistemov za avtomatizirano obdelavo (nadzor uporabnikov);
prevent the unauthorised input of personal data and the unauthorised inspection, modification or deletion of stored personal data (‘storage control’);
zagotoviti, da imajo osebe, pooblaščene za uporabo sistema za avtomatizirano obdelavo, dostop samo do podatkov, ki jih zajema njihovo pooblastilo za dostop (nadzor dostopa do podatkov);
prevent the use of automated processing systems by unauthorised persons using data communication equipment (‘user control’);
zagotoviti, da je mogoče preveriti in ugotoviti, katerim telesom so osebni podatki bili ali bi lahko bili poslani oziroma jim je bil ali bi jim lahko bil omogočen dostop do njih prek opreme za prenos podatkov (nadzor prenosa);
ensure that persons authorised to use an automated processing system have access only to the personal data covered by their access authorisation (‘data access control’);
zagotoviti, da je mogoče naknadno preveriti in ugotoviti, kateri osebni podatki so bili vneseni v sisteme za avtomatizirano obdelavo ter kdaj in kdo jih je vnesel (nadzor vnosa);
ensure that it is possible to verify and establish the bodies to which personal data have been or may be transmitted or made available using data communication equipment (‘communication control’);
preprečiti nepooblaščeno branje, prepisovanje, spreminjanje ali izbris osebnih podatkov med pošiljanjem osebnih podatkov ali med premeščanjem nosilcev podatkov (nadzor premeščanja);
ensure that it is subsequently possible to verify and establish which personal data have been input into automated processing systems and when and by whom the personal data were input (‘input control’);
zagotoviti, da je mogoče nameščene sisteme v primeru prekinitve ponovno vzpostaviti (obnova);
prevent the unauthorised reading, copying, modification or deletion of personal data during transfers of personal data or during transportation of data media (‘transport control’);
zagotoviti, da funkcije sistema delujejo, da se pojavljanje napak v funkcijah sporoči (zanesljivost) in da shranjeni osebni podatki ne morejo postati neuporabni zaradi okvare sistema (neoporečnost).
ensure that installed systems may, in the case of interruption, be restored (‘recovery’);
Člen 30
ensure that the functions of the system perform, that the appearance of faults in the functions is reported (‘reliability’) and that stored personal data cannot be corrupted by means of a malfunctioning of the system (‘integrity’).
Uradno obvestilo nadzornemu organu o kršitvi varstva osebnih podatkov
Article 30
Države članice določijo, da upravljavec v primeru kršitve varstva osebnih podatkov brez nepotrebnega odlašanja in po možnosti najpozneje v 72 urah po seznanitvi s kršitvijo o njej uradno obvesti nadzorni organ, razen če ni verjetno, da bi bilo s kršitvijo varstva osebnih podatkov povzročeno tveganje za pravice in svoboščine posameznikov.
Notification of a personal data breach to the supervisory authority
Kadar uradno obvestilo nadzornemu organu ni podano v 72 urah, se mu priloži razloge za zamudo.
Member States shall, in the case of a personal data breach, provide for the controller to notify without undue delay and, where feasible, not later than 72 hours after having become aware of it, the personal data breach to the supervisory authority, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.
Obdelovalec ob seznanitvi s kršitvijo varstva osebnih podatkov brez nepotrebnega odlašanja uradno obvesti upravljavca.
Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.
Uradno obvestilo iz odstavka 1 vsebuje vsaj:
The processor shall notify the controller without undue delay after becoming aware of a personal data breach.
opis vrste kršitve varstva osebnih podatkov, po možnosti tudi kategorije in približno število zadevnih posameznikov, na katere se nanašajo osebni podatki, ter vrste in približno število zadevnih evidenc osebnih podatkov;
The notification referred to in paragraph 1 shall at least:
sporočilo o imenu in kontaktnih podatkih pooblaščene osebe za varstvo podatkov ali druge kontaktne točke, pri kateri je mogoče pridobiti več informacij;
describe the nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
opis verjetnih posledic kršitve varstva osebnih podatkov;
communicate the name and contact details of the data protection officer or other contact point where more information can be obtained;
opis ukrepov, ki jih upravljavec sprejme ali katerih sprejetje predlaga za obravnavanje kršitve varstva osebnih podatkov, vključno z če je to primerno, ukrepi za ublažitev morebitnih škodljivih učinkov kršitve.
describe the likely consequences of the personal data breach;
Kadar in kolikor informacij ni mogoče zagotoviti istočasno, se informacije lahko zagotovijo postopoma brez nepotrebnega dodatnega odlašanja.
describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
Države članice določijo, da upravljavec dokumentira vsako kršitev varstva osebnih podatkov iz odstavka 1, vključno z dejstvi v zvezi s kršitvijo varstva osebnih podatkov, njene učinke in sprejete popravne ukrepe.
Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay.
Ta dokumentacija nadzornemu organu omogoči, da preveri skladnost s tem členom.
Member States shall provide for the controller to document any personal data breaches referred to in paragraph 1, comprising the facts relating to the personal data breach, its effects and the remedial action taken.
Države članice v primeru, kadar kršitev varstva osebnih podatkov vključuje osebne podatke, ki jih je upravljavec druge države članice poslal ali so mu bili poslani, določijo, da se informacije iz odstavka 3 upravljavcu navedene države članice sporočijo brez nepotrebnega odlašanja.
That documentation shall enable the supervisory authority to verify compliance with this Article.
Člen 31
Member States shall, where the personal data breach involves personal data that have been transmitted by or to the controller of another Member State, provide for the information referred to in paragraph 3 to be communicated to the controller of that Member State without undue delay.
Sporočilo posamezniku, na katerega se nanašajo osebni podatki, o kršitvi varstva osebnih podatkov
Article 31
Države članice določijo, da v primeru, ko je verjetno, da bi kršitev varstva osebnih podatkov povzročila veliko tveganje za pravice in svoboščine posameznikov, upravljavec brez nepotrebnega odlašanja sporoči posamezniku, na katerega se nanašajo osebni podatki, da je prišlo do kršitve varstva osebnih podatkov.
Communication of a personal data breach to the data subject
V sporočilu posamezniku, na katerega se nanašajo osebni podatki, iz odstavka 1 tega člena je v jasnem in preprostem jeziku opisana vrsta kršitve varstva osebnih podatkov ter so vsebovane vsaj informacije in ukrepi iz točk (b), (c) in (d) člena 30(3).
Member States shall, where the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, provide for the controller to communicate the personal data breach to the data subject without undue delay.
Sporočilo posamezniku, na katerega se nanašajo osebni podatki, iz odstavka 1 ni potrebno, če je izpolnjen kateri koli izmed naslednjih pogojev:
The communication to the data subject referred to in paragraph 1 of this Article shall describe in clear and plain language the nature of the personal data breach and shall contain at least the information and measures referred to in points (b), (c) and (d) of Article 30(3).
upravljavec je izvedel ustrezne tehnološke in organizacijske zaščitne ukrepe in so bili ti ukrepi uporabljeni za osebne podatke, v zvezi s katerimi je bila storjena kršitev varstva, zlasti ukrepe, na podlagi katerih postanejo osebni podatki nerazumljivi vsem, ki niso pooblaščeni za dostop do njih, kot je šifriranje,
The communication to the data subject referred to in paragraph 1 shall not be required if any of the following conditions are met:
upravljavec je sprejel naknadne ukrepe za zagotovitev, da se veliko tveganje za pravice in svoboščine posameznikov, na katere se nanašajo osebni podatki, iz odstavka 1 verjetno ne bo več udejanjilo,
the controller has implemented appropriate technological and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption;
bi to zahtevalo nesorazmeren napor.
the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to in paragraph 1 is no longer likely to materialise;
V takšnem primeru se namesto tega objavi javno sporočilo ali izvede podoben ukrep, s katerim so posamezniki, na katere se nanašajo osebni podatki, enako učinkovito obveščeni.
it would involve a disproportionate effort.
Če upravljavec posameznika, na katerega se nanašajo osebni podatki, še ni obvestil o kršitvi varstva osebnih podatkov, lahko nadzorni organ to od njega lahko zahteva po preučitvi verjetnosti, da bi kršitev varstva osebnih podatkov povzročila veliko tveganje, ali pa lahko odloči, da je izpolnjen kateri od pogojev iz odstavka 3.
In such a case, there shall instead be a public communication or a similar measure whereby the data subjects are informed in an equally effective manner.
Sporočilo posamezniku, na katerega se nanašajo osebni podatki, iz odstavka 1 tega člena se lahko pod pogoji in iz razlogov iz člena 13(3) zadrži, omeji ali opusti.