natgillin/translations-raw huggingface dataset:
Based on evidence gathered by the Commission, including information stemming from the work of the EU-U.S. Privacy Contact Group [8] and the information on U.S. intelligence programs received in the ad hoc EU-U.S. Working Group [9], the Commission formulated 13 recommendations for a review of the Safe Harbour scheme.
Komisija je na podlagi zbranih dokazov, vključno z informacijami o delu kontaktne skupine EU-ZDA za varstvo zasebnosti [8] in informacijami o obveščevalnih programih ZDA, ki jih je prejela priložnostna delovna skupina EU-ZDA [9], oblikovala 13 priporočil za pregled sheme varnega pristana.
These recommendations focused on strengthening the substantive privacy principles, increasing the transparency of U.S. self-certified companies' privacy policies, better supervision, monitoring and enforcement by the U.S. authorities of compliance with those principles, the availability of affordable dispute resolution mechanisms, and the need to ensure that use of the national security exception provided in Decision 2000/520/EC is limited to an extent that is strictly necessary and proportionate.
Ta priporočila se osredotočajo na krepitev vsebinskih načel zasebnosti, povečanje preglednosti politik varstva zasebnosti samocertificiranih družb v ZDA, boljše nadziranje, spremljanje in uveljavljanje skladnosti s temi načeli s strani organov ZDA, dostopnost stroškovno ugodnih mehanizmov reševanja sporov ter potrebo po zagotovitvi, da se izjema v interesu nacionalne varnosti iz Odločbe 2000/520/ES uporablja le v obsegu, ki je nujno potreben ali sorazmeren..
In its judgment of 6 October 2015 in Case C-362/14, Maximillian Schrems v Data Protection Commissioner [10], the Court of Justice of the European Union declared Decision 2000/520/EC invalid.
Sodišče je v sodbi z dne 6. oktobra 2015 v zadevi C-362/14, Maximillian Schrems proti Data Protection Commissioner [10] Odločbo 2000/520/ES razglasilo za neveljavno.
Without examining the content of the Safe Harbour Privacy Principles, the Court considered that the Commission had not stated in that decision that the United States in fact ‘ensured’ an adequate level of protection by reason of its domestic law or its international commitments [11].
Ne da bi proučilo vsebino načel zasebnosti varnega pristana, je Sodišče ugotovilo, da Komisija v zadevni odločbi ni ugotovila, da so ZDA dejansko „zagotavljale“ ustrezno raven varstva zaradi svoje nacionalne zakonodaje ali mednarodnih obveznosti [11].
In this regard, the Court of Justice explained that, while the term ‘adequate level of protection’ in Article 25(6) of Directive 95/46/EC does not mean a level of protection identical to that guaranteed in the EU legal order, it must be understood as requiring the third country to ensure a level of protection of fundamental rights and freedoms ‘essentially equivalent’ to that guaranteed within the Union by virtue of Directive 95/46/EC read in the light of the Charter of Fundamental Rights.
V zvezi s tem je Sodišče pojasnilo, da čeprav izraz „ustrezna raven varstva“ iz člena 25(6) Direktive 95/46/ES ne pomeni ravni varstva, ki je enaka ravni varstva, zagotovljeni v pravnem redu EU, ga je treba razumeti tako, da se z njim zahteva, da tretja država zagotavlja raven varstva temeljnih pravic in svoboščin, ki je „v bistvenem enaka“ ravni, zagotovljeni v Uniji na podlagi Direktive 95/46/ES, kot se razlaga ob upoštevanju Listine o temeljnih pravicah.
Even though the means to which that third country has recourse, in this connection, may differ from the ones employed within the Union, those means must nevertheless prove, in practice, effective [12].
Četudi so sredstva, ki jih zadevna tretja država uporabi za zagotovitev take ravni varstva, lahko drugačna od sredstev, uporabljenih znotraj Unije, se morajo ta sredstva v praksi vseeno izkazati za učinkovita [12].
The Court of Justice criticised the lack of sufficient findings in Decision 2000/520/EC regarding the existence, in the United States, of rules adopted by the State intended to limit any interference with the fundamental rights of the persons whose data is transferred from the Union to the United States, interference which the State entities of that country would be authorised to engage in when they pursue legitimate objectives, such as national security, and the existence of effective legal protection against interference of that kind [13].
Sodišče je kritiziralo odsotnost ugotovitev v Odločbi 2000/520/ES glede obstoja državnih predpisov v ZDA, katerih namen bi bil omejiti morebitne posege v temeljne pravice posameznikov, katerih podatki se prenašajo iz Unije v ZDA, posege, ki naj bi jih državni subjekti v tej državi lahko izvajali, kadar poskušajo doseči legitimne cilje, kot je nacionalna varnost, in glede obstoja učinkovitega sodnega varstva v primeru takih posegov [13].
In 2014 the Commission had entered into talks with the U.S. authorities in order to discuss the strengthening of the Safe Harbour scheme in line with the 13 recommendations contained in Communication COM(2013) 847 final.
Komisija je leta 2014 začela pogovore z organi ZDA, da bi razpravljali o okrepitvi sheme varnega pristana v skladu s 13 priporočili iz Sporočila COM(2013) 847 final.
After the judgment of the Court of Justice of the European Union in the Schrems case, these talks were intensified, with a view to a possible new adequacy decision which would meet the requirements of Article 25 of Directive 95/46/EC as interpreted by the Court of Justice.
Po sodbi Sodišča v zadevi Schrems so se ti pogovori okrepili, da bi se sprejel morebiten nov sklep o ustreznosti varstva, ki bi izpolnjeval zahteve iz člena 25 Direktive 95/46/ES, kakor jih razlaga Sodišče.
The documents which are annexed to this decision and will also be published in the U.S. Federal Register are the result of these discussions.
Dokumenti, ki so priloženi temu sklepu in ki bodo tudi objavljeni v Zveznem registru ZDA, so rezultat teh razprav.
The privacy principles (Annex II), together with the official representations and commitments by various U.S. authorities contained in the documents in Annexes I, III to VII, constitute the ‘EU-U.S. Privacy Shield’.
Načela zasebnosti (Priloga II) skupaj z uradnimi zagotovili in zavezami različnih organov ZDA, vsebovanimi v dokumentih iz prilog I in III–VII, tvorijo „zasebnostni ščit EU-ZDA“.
The Commission has carefully analysed U.S. law and practice, including these official representations and commitments.
Komisija je podrobno proučila zakonodajo in prakso ZDA, vključno s temi uradnimi zagotovili in zavezami.
Based on the findings developed in recitals 136-140, the Commission concludes that the United States ensures an adequate level of protection for personal data transferred under the EU-U.S. Privacy Shield from the Union to self-certified organisations in the United States.
Na podlagi ugotovitev, oblikovanih v uvodnih izjavah 136 do 140, je Komisija sklenila, da ZDA zagotavljajo ustrezno raven varstva osebnih podatkov, ki se v okviru zasebnostnega ščita EU-ZDA prenašajo iz Unije samocertificiranim organizacijam v ZDA.
THE ‘EU-U.S. PRIVACY SHIELD’
„ZASEBNOSTNI ŠČIT EU-ZDA“
The EU-U.S. Privacy Shield is based on a system of self-certification by which U.S. organisations commit to a set of privacy principles — the EU-U.S. Privacy Shield Framework Principles, including the Supplemental Principles (hereinafter together: ‘the Principles’) — issued by the U.S. Department of Commerce and contained in Annex II to this decision.
Zasebnostni ščit EU-ZDA temelji na sistemu samocertificiranja, s katerim se organizacije v ZDA zavežejo sklopu načel zasebnosti, tj. načelom okvira zasebnostnega ščita EU-ZDA, vključno z dopolnilnimi načeli (v nadaljnjem besedilu skupaj: načela), ki jih je izdalo Ministrstvo za trgovino ZDA in so navedena v Prilogi II k temu sklepu.
It applies to both controllers and processors (agents), with the specificity that processors must be contractually bound to act only on instructions from the EU controller and assist the latter in responding to individuals exercising their rights under the Principles [14].
Uporablja se za upravljavce in obdelovalce (posrednike), pri čemer je posebnost to, da morajo biti obdelovalci pogodbeno zavezani, da delujejo samo po navodilih upravljavca EU, kateremu pomagajo pri odgovorih posameznikom, ki uveljavljajo svoje pravice po načelih [14].
Without prejudice to compliance with the national provisions adopted pursuant to Directive 95/46/EC, the present decision has the effect that transfers from a controller or processor in the Union to organisations in the U.S. that have self-certified their adherence to the Principles with the Department of Commerce and have committed to comply with them are allowed.
Ta sklep brez poseganja v skladnost z nacionalnimi določbami, sprejetimi v skladu z Direktivo 95/46/ES, dovoljuje prenose z upravljavca ali obdelovalca v Uniji na organizacije v ZDA, ki so samocertificirale zavezanost k načelom pri Ministrstvu za trgovino in se zavezale, da jih bodo spoštovale.
The Principles apply solely to the processing of personal data by the U.S. organisation in as far as processing by such organisations does not fall within the scope of Union legislation.
Načela se uporabljajo samo za obdelavo osebnih podatkov s strani organizacij ZDA, v kolikor obdelava s strani takih organizacij ne spada na področje uporabe zakonodaje Unije [15].
The Privacy Shield does not affect the application of Union legislation governing the processing of personal data in the Member States [16].
Zasebnostni ščit ne vpliva na uporabo zakonodaje Unije, ki ureja obdelavo osebnih podatkov v državah članicah [16].
The protection afforded to personal data by the Privacy Shield applies to any EU data subject [17] whose personal data have been transferred from the Union to organisations in the U.S. that have self-certified their adherence to the Principles with the Department of Commerce.
Varstvo osebnih podatkov, ki ga zagotavlja zasebnostni ščit, velja za katerega koli posameznika v EU, na katerega se nanašajo osebni podatki [17], ki so bili preneseni iz Unije organizacijam v ZDA, ki so samocertificirale zavezanost k načelom pri Ministrstvu za trgovino.
The Principles apply immediately upon certification.
Načela zasebnosti začnejo veljati takoj po certifikaciji.
One exception relates to the Accountability for Onward Transfer Principle in a case where an organisation self-certifying to the Privacy Shield already has pre-existing commercial relationships with third parties.
Ena izjema se nanaša na načelo odgovornosti za prenos tretjemu v primeru, ko organizacija, ki se je samocertificirala po zasebnostnem ščitu že ima predhodno obstoječa trgovinska razmerja s tretjimi strankami.
Given that it may take some time to bring those commercial relationships into conformity with the rules applicable under the Accountability for Onward Transfer Principle, the organisation will be obliged to do so as soon as possible, and in any event no later than nine months from self-certification (provided that this takes places in the first two months following the day when the Privacy Shield becomes effective).
Glede na to, da lahko traja nekaj časa, da se ta trgovinska razmerja uskladijo s pravili v okviru načela odgovornosti za prenos tretjemu, mora organizacija to storiti čim prej in v vsakem primeru najpozneje devet mesecev po samocertifikaciji (če se to zgodi v prvih dveh mesecih po datumu začetka veljavnosti zasebnostnega ščita).
During this interim period, the organisation must apply the Notice and Choice Principle (thus allowing the EU data subject an opt-out) and, where personal data is transferred to a third party acting as an agent, must ensure that the latter provides at least the same level of protection as is required by the Principles [18].
V tem vmesnem obdobju mora organizacija uporabljati načeli obvestila in možnosti izbire (s čimer posameznikom iz EU, na katere se nanašajo podatki, omogoča zavrnitev) ter mora, če se podatki prenašajo tretji stranki, ki nastopa v vlogi posrednika, zagotoviti, da slednja zagotavlja vsaj enako raven varstva, kot jo zahtevajo načela [18].
This transitional period provides a reasonable and appropriate balance between the respect for the fundamental right to data protection and the legitimate needs of businesses to have sufficient time to adapt to the new framework where this also depends on their commercial relationships with third parties.
To prehodno obdobje zagotavlja razumno in ustrezno ravnovesje med spoštovanjem temeljne pravice do varstva podatkov in zakonitimi potrebami podjetij, da imajo na voljo dovolj časa za prilagoditev novemu okviru, pri čemer je to odvisno tudi od trgovinskih razmerij s tretjimi strankami.
The system will be administered and monitored by the Department of Commerce based on its commitments set out in the representations from the U.S. Secretary of Commerce (Annex I to this decision).
Ta sistem bo upravljalo in nadzorovalo Ministrstvo za trgovino na podlagi svojih zavez, navedenih v zagotovilih Ministra za trgovino ZDA (Priloga I k temu sklepu).
With regard to the enforcement of the Principles, the Federal Trade Commission (FTC) and the Department of Transportation have made representations that are contained in Annex IV and Annex V to this decision.
Kar zadeva uveljavljanje načel, sta Zvezna komisija za trgovino (Federal Trade Commission, v nadaljnjem besedilu: FTC) in Ministrstvo za promet podala zagotovila, navedena v prilogah IV in V k temu sklepu.
Privacy Principles
Načela zasebnosti
As part of their self-certification under the EU-U.S. Privacy Shield, organisations have to commit to comply with the Principles [19].
Organizacije se morajo v okviru samocertificiranja na podlagi zasebnostnega ščita EU-ZDA zavezati, da bodo spoštovale načela [19].
Under the Notice Principle, organisations are obliged to provide information to data subjects on a number of key elements relating to the processing of their personal data (e.g. type of data collected, purpose of processing, right of access and choice, conditions for onward transfers and liability).
V skladu z načelom obvestila morajo organizacije posameznikom, na katere se nanašajo osebni podatki, zagotoviti informacije o številu ključnih elementov, ki se nanašajo na obdelavo njihovih osebnih podatkov (npr. vrsta zbranih podatkov, namen obdelave, pravica do dostopa in izbire, pogoji za prenose tretjemu in odgovornost).
Further safeguards apply, in particular the requirement for organisations to make public their privacy policies (reflecting the Principles) and to provide links to the Department of Commerce's website (with further details on self-certification, the rights of data subjects and available recourse mechanisms), the Privacy Shield List (referred to in recital 30) and the website of an appropriate alternative dispute settlement provider.
Uporabljajo se dodatni zaščitni ukrepi, zlasti zahteva, da organizacije objavijo svoje politike varstva zasebnosti (ki izražajo načela) in navedejo povezave do spletišča Ministrstva za trgovino (s podrobnejšimi informacijami o samocertificiranju, pravicah posameznikov, na katere se nanašajo osebni podatki, in razpoložljivih pritožbenih mehanizmih), seznam zasebnostnega ščita (iz uvodne izjave 30) in spletišče ustreznega organa za alternativno reševanje sporov.
Under the Data Integrity and Purpose Limitation Principle, personal data must be limited to what is relevant for the purpose of the processing, reliable for its intended use, accurate, complete and current.
V skladu z načelom celovitosti podatkov in omejitve namena morajo biti osebni podatki omejeni na tisto, kar je pomembno za obdelavo, zanesljivi za predvideno uporabo, točni, popolni in aktualni.
An organisation may not process personal data in a way that is incompatible with the purpose for which it was originally collected or subsequently authorised by the data subject.
Organizacija ne sme obdelovati osebnih podatkov na način, ki je nezdružljiv z namenom, za katerega so bili podatki prvotno zbrani ali ki ga je posameznik, na katerega se nanašajo osebni podatki, naknadno odobril.
Organisations must ensure that personal data is reliable for its intended use, accurate, complete and current.
Organizacije morajo zagotoviti, da so osebni podatki zanesljivi za predvideno uporabo, točni, popolni in aktualni.
Where a new (changed) purpose is materially different but still compatible with the original purpose, the Choice Principle gives data subjects the right to object (opt out).
Če je nov (spremenjen) namen bistveno drugačen, vendar še vedno združljiv s prvotnim namenom, načelo izbire posameznikom, na katere se nanašajo osebni podatki, daje pravico do ugovora (zavrnitve).
The Choice Principle does not supersede the express prohibition on incompatible processing [20].
Načelo izbire ne nadomešča izrecne prepovedi nezdružljive obdelave [20].
Special rules generally allowing for the opt-out ‘at any time’ from the use of personal data apply for direct marketing [21].
Posebna pravila običajno omogočajo, da se uporaba osebnih podatkov za neposredno trženje „kadar koli“ zavrne [21].
In the case of sensitive data, organisations must normally obtain the data subject's affirmative express consent (opt in).
V primeru občutljivih podatkov morajo organizacije običajno pridobiti izrecno pritrdilno soglasje (privolitev) posameznika, na katerega se nanašajo osebni podatki.
Still under the Data Integrity and Purpose Limitation Principle, personal information may be retained in a form identifying or rendering an individual identifiable (and thus in the form of personal data) only for as long as it serves the purpose(s) for which it was initially collected or subsequently authorised.
Poleg tega se lahko osebni podatki v skladu z načelom celovitosti podatkov in omejitve namena hranijo v obliki, ki omogoča identifikacijo posameznika (in s tem v obliki osebnih podatkov), le dokler služijo namenom, za katere so bili prvotno zbrani ali ki so bili naknadno odobreni.
This obligation does not prevent Privacy Shield organisations to continue processing personal information for longer periods, but only for the time and to the extent such processing reasonably serves one of the following specific purposes: archiving in the public interest, journalism, literature and art, scientific and historical research and statistical analysis.
Ta obveznost organizacijam v zasebnostnem ščitu ne preprečuje nadaljnje obdelave osebnih podatkov za daljša obdobja, ampak le za obdobje in v obsegu, v katerih se taka obdelava razumno uporablja za enega od naslednjih posebnih namenov: arhiviranje v javnem interesu, novinarstvo, literaturo in umetnost, znanstvene in zgodovinske raziskave ter statistično analizo.
Longer retention of personal data for one of these purposes will be subject to the safeguards provided by the Principles.
Daljše hranjenje osebnih podatkov za enega od teh namenov bo predmet zaščitnih ukrepov v skladu z načeli.
Under the Security Principle, organisations creating, maintaining, using or disseminating personal data must take ‘reasonable and appropriate’ security measures, taking into account the risks involved in the processing and the nature of the data.
V skladu z načelom varnosti morajo organizacije, ki ustvarjajo, vzdržujejo, uporabljajo ali razširjajo osebne podatke, izvesti „razumne in ustrezne“ varnostne ukrepe, ob upoštevanju tveganj, povezanih z obdelavo in naravo podatkov.
In the case of sub-processing, organisations must conclude a contract with the sub-processor guaranteeing the same level of protection as provided by the Principles and take steps to ensure its proper implementation.
V primeru podobdelave morajo organizacije skleniti pogodbo s podobdelovalcem, ki zagotavlja enako raven varstva, kot jo zagotavljajo načela, in sprejeti ukrepe za zagotovitev njenega pravilnega izvajanja.
Under the Access Principle [22], data subjects have the right, without need for justification and only against a non-excessive fee, to obtain from an organisation confirmation of whether such organisation is processing personal data related to them and have the data communicated within reasonable time.
V skladu z načelom dostopa [22] imajo posamezniki, na katere se nanašajo osebni podatki, pravico, da brez utemeljitve in samo za nepretirano plačilo od organizacije pridobijo potrditev, da taka organizacija obdeluje osebne podatke, povezane z njimi, in da jim podatke sporoči v razumnem času.
This right may only be restricted in exceptional circumstances; any denial of, or limitation to the right of access has to be necessary and duly justified, with the organisation bearing the burden of demonstrating that these requirements are fulfilled.
To pravico je mogoče omejiti le v izjemnih okoliščinah; vsako zanikanje ali omejitev pravice do dostopa je treba nujno in ustrezno utemeljiti, pri čemer mora organizacija dokazati, da so te zahteve izpolnjene.
Data subjects must be able to correct, amend or delete personal information where it is inaccurate or has been processed in violation of the Principles.
Posamezniki, na katere se nanašajo osebni podatki, morajo imeti možnost, da popravijo, spremenijo ali izbrišejo osebne podatke, če niso točni ali če so bila pri njihovi obdelavi kršena načela.
In areas where companies most likely resort to the automated processing of personal data to take decisions affecting the individual (e.g. credit lending, mortgage offers, employment), U.S. law offers specific protections against adverse decisions [23].
Na področjih, kjer podjetja najverjetneje uporabljajo samodejno obdelavo osebnih podatkov za sprejemanje odločitev, ki vplivajo na posameznika (npr. dajanje posojil, nudenje hipotek, zaposlovanje), zakonodaja ZDA zagotavlja posebno varstvo pred zavrnilnimi odločitvami [23].
These acts typically provide that individuals have the right to be informed of the specific reasons underlying the decision (e.g. the rejection of a credit), to dispute incomplete or inaccurate information (as well as reliance on unlawful factors), and to seek redress.
Ti akti posameznikom običajno zagotavljajo pravico do obveščenosti o posebnih razlogih, na katerih temelji odločitev (npr. zavrnitev odobritve posojila), do oporekanja nepopolnim ali netočnim informacijam (pa tudi uporabi nezakonitih elementov) in uveljavljanja pravnega varstva.
These rules offer protections in the likely rather limited number of cases where automated decisions would be taken by the Privacy Shield organisation itself [24].
Ta pravila zagotavljajo varstvo v verjetno precej omejenem številu primerov, kjer samodejne odločitve sprejema sama organizacija v zasebnostnem ščitu [24].
Nevertheless, given the increasing use of automated processing (including profiling) as a basis for taking decisions affecting individuals in the modern digital economy, this is an area that needs to be closely monitored.
Vendar je glede na vse večjo uporabo samodejne obdelave podatkov (vključno z oblikovanjem profilov) kot podlage za sprejemanje odločitev, ki vplivajo na posameznike v sodobnem gospodarstvu, to področje, ki ga je treba pozorno spremljati.
In order to facilitate this monitoring, it has been agreed with the U.S. authorities that a dialogue on automated decision-making, including an exchange on the similarities and differences in the EU and U.S. approach in this regard, will be part of the first annual review as well as subsequent reviews as appropriate.
Za olajšanje tega spremljanja je bilo z organi ZDA dogovorjeno, da bo dialog o samodejnem sprejemanju odločitev, vključno z izmenjavo informacij o podobnostih in razlikah pristopa EU in ZDA v zvezi s tem, del prvega letnega pregleda, pa tudi naslednjih pregledov, če bo to primerno.
Under the Recourse, Enforcement and Liability Principle [25], participating organisations must provide robust mechanisms to ensure compliance with the other Principles and recourse for EU data subjects whose personal data have been processed in a non-compliant manner, including effective remedies.
V skladu z načelom pritožbenega mehanizma, izvrševanja in odgovornosti [25] morajo sodelujoče organizacije zagotoviti zanesljive mehanizme za zagotavljanje skladnosti z drugimi načeli in pritožbeni mehanizem za posameznike iz EU, katerih podatki so bili neskladno obdelani, vključno z učinkovitimi pravnimi sredstvi.