natgillin/translations-raw huggingface dataset:
That documentation shall enable the supervisory authority to verify compliance with this Article.
upravljavec je izvedel ustrezne tehnične in organizacijske zaščitne ukrepe in so bili ti ukrepi uporabljeni za osebne podatke, v zvezi s katerimi je bila storjena kršitev varstva, zlasti ukrepe, na podlagi katerih postanejo osebni podatki nerazumljivi vsem, ki niso pooblaščeni za dostop do njih, kot je šifriranje;
Article 34
upravljavec je sprejel naknadne ukrepe za zagotovitev, da se veliko tveganje za pravice in svoboščine posameznikov, na katere se nanašajo osebni podatki, iz odstavka 1 verjetno ne bo več udejanjilo;
Communication of a personal data breach to the data subject
to bi zahtevalo nesorazmeren napor.
When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.
V takšnem primeru se namesto tega objavi javno sporočilo ali izvede podoben ukrep, s katerim so posamezniki, na katere se nanašajo osebni podatki, enako učinkovito obveščeni.
The communication to the data subject referred to in paragraph 1 of this Article shall describe in clear and plain language the nature of the personal data breach and contain at least the information and measures referred to in points (b), (c) and (d) of Article 33(3).
Če upravljavec posameznika, na katerega se nanašajo osebni podatki, še ni obvestil o kršitvi varstva osebnih podatkov, lahko nadzorni organ to od njega zahteva po preučitvi verjetnosti, da bi kršitev varstva osebnih podatkov povzročila veliko tveganje, ali pa lahko odloči, da je izpolnjen kateri koli od pogojev iz odstavka 3.
The communication to the data subject referred to in paragraph 1 shall not be required if any of the following conditions are met:
Ocena učinka v zvezi z varstvom podatkov in predhodno posvetovanje
the controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption;
Člen 35
the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to in paragraph 1 is no longer likely to materialise;
Ocena učinka v zvezi z varstvom podatkov
it would involve disproportionate effort.
Kadar je možno, da bi lahko vrsta obdelave, zlasti z uporabo novih tehnologij, ob upoštevanju narave, obsega, okoliščin in namenov obdelave povzročila veliko tveganje za pravice in svoboščine posameznikov, upravljavec pred obdelavo opravi oceno učinka predvidenih dejanj obdelave na varstvo osebnih podatkov.
In such a case, there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner.
V eni oceni je lahko obravnavan niz podobnih dejanj obdelave, ki predstavljajo podobna velika tveganja.
If the controller has not already communicated the personal data breach to the data subject, the supervisory authority, having considered the likelihood of the personal data breach resulting in a high risk, may require it to do so or may decide that any of the conditions referred to in paragraph 3 are met.
2 Upravljavec pri izvedbi ocene učinka v zvezi z varstvom podatkov za mnenje zaprosi pooblaščeno osebo za varstvo podatkov, kjer je ta imenovana.
Data protection impact assessment and prior consultation
Ocena učinka v zvezi z varstvom podatkov iz odstavka 1 se zahteva zlasti v primeru:
Article 35
sistematičnega in obsežnega vrednotenja osebnih vidikov v zvezi s posamezniki, ki temelji na avtomatizirani obdelavi, vključno z oblikovanjem profilov, in je osnova za odločitve, ki imajo pravne učinke v zvezi s posameznikom ali nanj na podoben način znatno vplivajo;
Data protection impact assessment
obsežne obdelave posebnih vrst podatkov iz člena 9(1) ali osebnih podatkov v zvezi s kazenskimi obsodbami in prekrški iz člena 10, ali
Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data.
obsežnega sistematičnega spremljanja javno dostopnega območja.
A single assessment may address a set of similar processing operations that present similar high risks.
Nadzorni organ določi in objavi seznam vrst dejanj obdelave, za katere velja zahteva po oceni učinka v zvezi z varstvom podatkov v skladu z odstavkom 1.
The controller shall seek the advice of the data protection officer, where designated, when carrying out a data protection impact assessment.
Nadzorni organ te sezname posreduje odboru iz člena 68.
A data protection impact assessment referred to in paragraph 1 shall in particular be required in the case of:
Nadzorni organ lahko tudi določi in objavi seznam vrst dejanj obdelave, za katere ne velja zahteva po oceni učinka v zvezi z varstvom podatkov.
a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person;
Nadzorni organ te sezname posreduje odboru.
processing on a large scale of special categories of data referred to in Article 9(1), or of personal data relating to criminal convictions and offences referred to in Article 10; or
Pristojni nadzorni organ pred sprejetjem seznamov iz odstavkov 4 in 5 uporabi mehanizem za skladnost iz člena 63, kadar taki seznami vključujejo dejavnosti obdelave, ki so povezane z nudenjem blaga ali storitev posameznikom, na katere se nanašajo osebni podatki, ali s spremljanjem njihovega ravnanja v več državah članicah ali pa lahko znatno vplivajo na prosti pretok osebnih podatkov v Uniji.
a systematic monitoring of a publicly accessible area on a large scale.
Ocena zajema vsaj:
The supervisory authority shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.
sistematičen opis predvidenih dejanj obdelave in namenov obdelave, kadar je ustrezno pa tudi zakonitih interesov, za katere si prizadeva upravljavec;
The supervisory authority shall communicate those lists to the Board referred to in Article 68.
oceno potrebnosti in sorazmernosti dejanj obdelave glede na njihov namen;
The supervisory authority may also establish and make public a list of the kind of processing operations for which no data protection impact assessment is required.
oceno tveganj za pravice in svoboščine posameznikov, na katere se nanašajo osebni podatki, iz odstavka 1, ter
The supervisory authority shall communicate those lists to the Board.
ukrepe za obravnavanje tveganj, vključno z zaščitnimi ukrepi, varnostne ukrepe ter mehanizme za zagotavljanje varstva osebnih podatkov in za dokazovanje skladnosti s to uredbo, ob upoštevanju pravic in zakonitih interesov posameznikov, na katere se nanašajo osebni podatki, ter drugih oseb, ki jih to zadeva.
Prior to the adoption of the lists referred to in paragraphs 4 and 5, the competent supervisory authority shall apply the consistency mechanism referred to in Article 63 where such lists involve processing activities which are related to the offering of goods or services to data subjects or to the monitoring of their behaviour in several Member States, or may substantially affect the free movement of personal data within the Union.
Pri ocenjevanju učinka dejanj obdelave, ki jih izvajajo upravljavci ali obdelovalci, opravljenem zlasti za namene ocene učinka v zvezi z varstvom podatkov, se upošteva, ali zadevni upravljavci ali obdelovalci spoštujejo odobrene kodekse ravnanja iz člena 40.
The assessment shall contain at least:
Po potrebi upravljavec glede predvidene obdelave zaprosi za mnenje posameznikov, na katere se nanašajo osebni podatki, ali njihovih predstavnikov, brez poseganja v zaščito komercialnega ali javnega interesa ali varnost dejanj obdelave.
a systematic description of the envisaged processing operations and the purposes of the processing, including, where applicable, the legitimate interest pursued by the controller;
Kadar je pravna podlaga za obdelavo v skladu s točko (c) ali (e) člena 6(1) pravo Unije ali pravo države članice, ki velja za upravljavca, to pravo ureja zadevno posebno dejanje obdelave ali niz zadevnih dejanj obdelave, in je bila ocena učinka v zvezi z varstvom podatkov že izvedena v okviru splošne ocene učinkov med sprejemanjem te pravne podlage, se odstavki 1 do 7 ne uporabljajo, razen če države članice menijo, da je treba tako oceno opraviti pred dejavnostmi obdelave.
an assessment of the necessity and proportionality of the processing operations in relation to the purposes;
Upravljavec po potrebi opravi pregled, da bi ocenil, ali obdelava poteka v skladu z oceno učinka v zvezi z varstvom podatkov vsaj takrat, ko se spremeni tveganje, ki ga predstavljajo dejanja obdelave.
an assessment of the risks to the rights and freedoms of data subjects referred to in paragraph 1; and
Člen 36
the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation taking into account the rights and legitimate interests of data subjects and other persons concerned.
Predhodno posvetovanje
Compliance with approved codes of conduct referred to in Article 40 by the relevant controllers or processors shall be taken into due account in assessing the impact of the processing operations performed by such controllers or processors, in particular for the purposes of a data protection impact assessment.
Upravljavec se pred obdelavo posvetuje z nadzornim organom, kadar je iz ocene učinka v zvezi z varstvom podatkov iz člena 35 razvidno, da bi obdelava povzročila veliko tveganje, če upravljavec ne bi sprejel ukrepov za ublažitev tveganja.
Where appropriate, the controller shall seek the views of data subjects or their representatives on the intended processing, without prejudice to the protection of commercial or public interests or the security of processing operations.
Kadar nadzorni organ meni, da bi predvidena obdelava iz odstavka 1 kršila to uredbo, zlasti kadar upravljavec ni ustrezno opredelil ali ublažil tveganja, nadzorni organ v roku do osmih tednov po prejemu zahteve za posvetovanje pisno svetuje upravljavcu, kadar je ustrezno, pa tudi obdelovalcu, in lahko uporabi katero koli pooblastilo iz člena 58.
Where processing pursuant to point (c) or (e) of Article 6(1) has a legal basis in Union law or in the law of the Member State to which the controller is subject, that law regulates the specific processing operation or set of operations in question, and a data protection impact assessment has already been carried out as part of a general impact assessment in the context of the adoption of that legal basis, paragraphs 1 to 7 shall not apply unless Member States deem it to be necessary to carry out such an assessment prior to processing activities.
To obdobje se lahko ob upoštevanju kompleksnosti predvidene obdelave podaljša za nadaljnjih šest tednov.
Where necessary, the controller shall carry out a review to assess if processing is performed in accordance with the data protection impact assessment at least when there is a change of the risk represented by processing operations.
Nadzorni organ o vsakem takem podaljšanju obvesti upravljavca in, kadar je potrebno, obdelovalca v enem mesecu od prejema zahteve za posvetovanje, skupaj z razlogi za zamudo.
Article 36
Ta rok se lahko začasno odloži, dokler nadzorni organ ne pridobi informacij, ki jih je zahteval za namene posvetovanja.
Prior consultation
Pri posvetovanju z nadzornim organom v skladu z odstavkom 1 upravljavec nadzornemu organu predloži:
The controller shall consult the supervisory authority prior to processing where a data protection impact assessment under Article 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk.
kadar je ustrezno, dolžnosti upravljavca, skupnih upravljavcev in obdelovalcev, vključenih v obdelavo, zlasti pri obdelavi v povezani družbi;
Where the supervisory authority is of the opinion that the intended processing referred to in paragraph 1 would infringe this Regulation, in particular where the controller has insufficiently identified or mitigated the risk, the supervisory authority shall, within period of up to eight weeks of receipt of the request for consultation, provide written advice to the controller and, where applicable to the processor, and may use any of its powers referred to in Article 58.
namene in sredstva predvidene obdelave;
That period may be extended by six weeks, taking into account the complexity of the intended processing.
ukrepe in zaščitne ukrepe za zaščito pravic in svoboščin posameznikov, na katere se nanašajo osebni podatki, v skladu s to uredbo;
The supervisory authority shall inform the controller and, where applicable, the processor, of any such extension within one month of receipt of the request for consultation together with the reasons for the delay.
kadar je ustrezno, kontaktne podatke pooblaščene osebe za varstvo podatkov;
Those periods may be suspended until the supervisory authority has obtained information it has requested for the purposes of the consultation.
oceno učinka v zvezi z varstvom podatkov iz člena 35 in
When consulting the supervisory authority pursuant to paragraph 1, the controller shall provide the supervisory authority with:
vsakršne druge informacije, ki jih zahteva nadzorni organ.
where applicable, the respective responsibilities of the controller, joint controllers and processors involved in the processing, in particular for processing within a group of undertakings;
Države članice se med pripravo predloga zakonodajnega ukrepa, ki ga sprejme nacionalni parlament, ali regulativnega ukrepa, ki temelji na takšnem zakonodajnem ukrepu, ki se nanaša na obdelavo, posvetujejo z nadzornim organom.
the purposes and means of the intended processing;
Ne glede na odstavek 1 lahko pravo države članice od upravljavcev zahteva, naj se posvetujejo z nadzornim organom in od njega prejmejo predhodno dovoljenje v zvezi z obdelavo s strani upravljavca z namenom izvajanja naloge, ki jo upravljavec izvaja v javnem interesu, vključno z obdelavo v zvezi s socialnim varstvom in javnim zdravjem.
the measures and safeguards provided to protect the rights and freedoms of data subjects pursuant to this Regulation;
Pooblaščena oseba za varstvo podatkov
where applicable, the contact details of the data protection officer;
Člen 37
the data protection impact assessment provided for in Article 35; and
Imenovanje pooblaščene osebe za varstvo podatkov
any other information requested by the supervisory authority.
Upravljavec in obdelovalec imenujeta pooblaščeno osebo za varstvo podatkov vedno, kadar:
Member States shall consult the supervisory authority during the preparation of a proposal for a legislative measure to be adopted by a national parliament, or of a regulatory measure based on such a legislative measure, which relates to processing.
obdelavo opravlja javni organ ali telo, razen sodišč, kadar delujejo kot sodni organ;
Notwithstanding paragraph 1, Member State law may require controllers to consult with, and obtain prior authorisation from, the supervisory authority in relation to processing by a controller for the performance of a task carried out by the controller in the public interest, including processing in relation to social protection and public health.
temeljne dejavnosti upravljavca ali obdelovalca zajemajo dejanja obdelave, pri katerih je treba zaradi njihove narave, obsega in/ali namenov posameznike, na katere se nanašajo osebni podatki, redno in sistematično obsežno spremljati, ali
Data protection officer
temeljne dejavnosti upravljavca ali obdelovalca zajemajo obsežno obdelavo posebnih vrst podatkov v skladu s členom 9 in osebnih podatkov v zvezi s kazenskimi obsodbami in prekrški iz člena 10.
Article 37
Povezana družba lahko imenuje eno pooblaščeno osebo za varstvo podatkov, če je ta pooblaščena oseba za varstvo podatkov lahko dostopna iz vsake enote.
Designation of the data protection officer
Kadar je upravljavec ali obdelovalec javni organ ali telo, se lahko za več takšnih organov ali teles ob upoštevanju njihove organizacijske strukture in velikosti imenuje ena sama pooblaščena oseba za varstvo podatkov.
The controller and the processor shall designate a data protection officer in any case where:
V primerih, ki niso navedeni v odstavku 1, upravljavec ali obdelovalec ali združenja in druga telesa, ki predstavljajo vrste upravljavcev ali obdelovalcev, smejo imenovati ali, kadar tako zahteva pravo Unije ali pravo države članice, imenujejo pooblaščeno osebo za varstvo podatkov.
the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;
Pooblaščena oseba za varstvo podatkov lahko deluje v imenu teh združenj in drugih teles, ki predstavljajo upravljavce ali obdelovalce.
the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or
Pooblaščena oseba za varstvo podatkov se imenuje na podlagi poklicnih odlik in zlasti strokovnega znanja o zakonodaji in praksi na področju varstva podatkov ter zmožnosti za izpolnjevanje nalog iz člena 39.
the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10.
Pooblaščena oseba za varstvo podatkov je lahko član osebja upravljavca ali obdelovalca ali pa naloge opravlja na podlagi pogodbe o storitvah.
A group of undertakings may appoint a single data protection officer provided that a data protection officer is easily accessible from each establishment.
Upravljavec ali obdelovalec objavi kontaktne podatke pooblaščene osebe za varstvo podatkov in jih sporoči nadzornemu organu.
Where the controller or the processor is a public authority or body, a single data protection officer may be designated for several such authorities or bodies, taking account of their organisational structure and size.
Člen 38
In cases other than those referred to in paragraph 1, the controller or processor or associations and other bodies representing categories of controllers or processors may or, where required by Union or Member State law shall, designate a data protection officer.
Položaj pooblaščene osebe za varstvo podatkov
The data protection officer may act for such associations and other bodies representing controllers or processors.
Upravljavec in obdelovalec zagotovita, da je pooblaščena oseba za varstvo podatkov ustrezno in pravočasno vključena v vse zadeve v zvezi z varstvom osebnih podatkov.
The data protection officer shall be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39.
Upravljavec in obdelovalec pooblaščeni osebi za varstvo podatkov pomagata pri opravljanju nalog iz člena 39, tako da zagotovita sredstva, potrebna za opravljanje teh nalog, in dostop do osebnih podatkov in dejanj obdelave, ter ohranjanje njenega strokovnega znanja.
The data protection officer may be a staff member of the controller or processor, or fulfil the tasks on the basis of a service contract.
Upravljavec in obdelovalec zagotovita, da pooblaščena oseba za varstvo podatkov pri opravljanju teh nalog ne prejema nobenih navodil.
The controller or the processor shall publish the contact details of the data protection officer and communicate them to the supervisory authority.
Pooblaščena oseba za varstvo podatkov ne sme biti razrešena ali kaznovana zaradi opravljanja svojih nalog.
Article 38
Pooblaščena oseba za varstvo podatkov neposredno poroča najvišji upravni ravni upravljavca ali obdelovalca.
Position of the data protection officer
Posamezniki, na katere se nanašajo osebni podatki, lahko s pooblaščeno osebo za varstvo podatkov stopijo v stik glede vseh vprašanj, povezanih z obdelavo njihovih osebnih podatkov, in uresničevanjem njihovih pravic na podlagi te uredbe.
The controller and the processor shall ensure that the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of personal data.
Pooblaščena oseba za varstvo podatkov je pri opravljanju svojih nalog zavezana varovati skrivnost ali zaupnost v skladu s pravom Unije ali pravom države članice.
The controller and processor shall support the data protection officer in performing the tasks referred to in Article 39 by providing resources necessary to carry out those tasks and access to personal data and processing operations, and to maintain his or her expert knowledge.
Pooblaščena oseba za varstvo podatkov lahko opravlja druge naloge in dolžnosti.
The controller and processor shall ensure that the data protection officer does not receive any instructions regarding the exercise of those tasks.
Upravljavec ali obdelovalec zagotovi, da zaradi vsakršnih takih nalog in dolžnosti ne pride do nasprotja interesov.
He or she shall not be dismissed or penalised by the controller or the processor for performing his tasks.
Člen 39
The data protection officer shall directly report to the highest management level of the controller or the processor.
Naloge pooblaščene osebe za varstvo podatkov
Data subjects may contact the data protection officer with regard to all issues related to processing of their personal data and to the exercise of their rights under this Regulation.
Pooblaščena oseba za varstvo podatkov ima vsaj naslednje naloge:
The data protection officer shall be bound by secrecy or confidentiality concerning the performance of his or her tasks, in accordance with Union or Member State law.
obveščanje upravljavca ali obdelovalca in zaposlenih, ki izvajajo obdelavo, ter svetovanje navedenim o njihovih obveznostih v skladu s to uredbo in drugimi določbami prava Unije ali prava države članice o varstvu podatkov;
The data protection officer may fulfil other tasks and duties.
spremljanje skladnosti s to uredbo, drugimi določbami prava Unije ali prava države članice o varstvu podatkov in politikami upravljavca ali obdelovalca v zvezi z varstvom osebnih podatkov, vključno z dodeljevanjem nalog, ozaveščanjem in usposabljanjem osebja, vključenega v dejanja obdelave, ter s tem povezanimi revizijami;
The controller or processor shall ensure that any such tasks and duties do not result in a conflict of interests.
svetovanje, kadar je to zahtevano, glede ocene učinka v zvezi z varstvom podatkov in spremljanje njenega izvajanja v skladu s členom 35;
Article 39
sodelovanje z nadzornim organom;
Tasks of the data protection officer
delovanje kot kontaktna točka za nadzorni organ pri vprašanjih v zvezi z obdelavo, vključno s predhodnim posvetovanjem iz člena 36, in, kjer je ustrezno, posvetovanje glede katere koli druge zadeve.
The data protection officer shall have at least the following tasks:
Pooblaščena oseba za varstvo podatkov pri opravljanju svojih nalog upošteva tveganje, povezano z dejanji obdelave, ter naravo, obseg, okoliščine in namene obdelave.
to inform and advise the controller or the processor and the employees who carry out processing of their obligations pursuant to this Regulation and to other Union or Member State data protection provisions;
Kodeksi ravnanja in potrjevanje