The following update regarding the new General Regulation is for informational purposes and aims to present the basic principles of the European Data Protection Regulation.
It is not a legal document, and if you want to fully ensure your business’s compliance, you should seek legal support.
For additional information, click here:
https://www.taxheaven.gr/laws/circular/view/id/28194
https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations_en
++++++++++++++++++++++++++++++++++++
The new General Regulation (EU) 2016/679 of the European Parliament and Council of April 27, 2016, “on the protection of natural persons with regard to the processing of personal data and on the free movement of such data,” will come into effect on May 25, 2018, in all EU Member States.
The new General Regulation does not deviate significantly from the general principles of the existing personal data protection framework but aims to create a stricter institutional framework for the processing of personal data and, consequently, their protection.
“Personal data” is defined as any information relating to an identified or identifiable natural person (“data subject”) – an identifiable natural person is one whose identity can be verified, directly or indirectly, particularly through reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, psychological, economic, cultural, or social identity of that person.
The new regulation affects all businesses that hold and manage data of European citizens (including companies outside the European Union). All businesses need to be informed and start their compliance process with the new regulation.
++++++++++++++++++++++++++++++++++++
WHAT ARE “PERSONAL DATA”?
What is personal data (or personal information)?
Personal data is any information that relates to and describes an individual, such as: identification details (name, age, address, occupation, marital status, etc.), physical characteristics, education, employment (work history, job performance, etc.), financial status (income, assets, financial behavior), interests, activities, habits. The individual to whom the data refers is called the data subject.
What are sensitive personal data?
Sensitive personal data refers to information about an individual’s racial or ethnic origin, political opinions, religious or philosophical beliefs, membership in a trade union, health, social care, sexual life, criminal convictions and offenses, as well as participation in associations related to the aforementioned areas. Sensitive data is protected by law with stricter regulations compared to regular personal data.
WHAT DOES “PROCESSING OF PERSONAL DATA” MEAN?
Processing includes any operation performed on personal data, such as: collection, recording, organization, storage, modification, retrieval, use, transmission, dissemination, alignment or combination, linking, restriction, erasure, destruction.
Any natural or legal person in the public or private sector who maintains and processes personal data is called the data controller.
Any natural or legal person in the public or private sector who processes data on behalf of a data controller is called the data processor.
BASIC RIGHTS OF CITIZENS/USERS
Right of Access: You can request access to your personal data, inquire about how it is used, and by whom it is processed after collection.
Right to Erasure (Right to be Forgotten): You can withdraw your consent for the use of your personal data by an organization or company and even request its deletion.
Right to Data Portability: You can transfer your data from one service provider to another whenever you wish.
Right to Information: Companies collecting data must inform you before storing your information. Your consent should not be assumed but should be given freely.
Right to Rectification: If you find that your data is incomplete or incorrect, you can request its update.
Right to Restriction of Processing: You can ask a company to stop processing your stored data. The information will remain stored, but the company will not have the right to use it.
Right to Object: You can immediately stop the processing of your data for commercial promotion. Once you send the request, any processing should cease immediately.
Right to Notification: In the event of a data breach that jeopardizes your personal data, you must be notified within 72 hours from the moment the breach is identified.