# data[].attributes.attachment_link.title
Guidelines 01/2022 on data subject rights - Right of access

# data[].attributes.attachment_link.description
Guidelines 01/2022 on data subject rights - Right of access

# data[].attributes.attachment_link.readable_text
Date of decision: 12 June 2023

Cross-border case or national case: Cross-border case

LSA: Swedish Authority for Privacy Protection (IMY)

CSAs: All other SAs

Controller: Spotify

Legal references: Article 15 (Right to access by the data subject), Article 12.1, Article 12.3, Article 58, Article 83 (General conditions for imposing administrative fines)

Decision: Administrative fine, Reprimand, Order to comply with the complainants request for access

Key words: Exercise of data subject rights, Transparency, Administrative fine

Summary of the Decision

Origin of the case

The General Data Protection Regulation, GDPR, entered into force in 2018 and means, among other things, that the rights of individuals are strengthened. One such right is the right of access, which means a right for individuals to find out what personal data a business handles about the person in question and to receive information about how this data is used.

Due to complaints that the Swedish Authority for Privacy Protection (IMY) received against Spotify AB regarding the right of access IMY has audited how Spotify handles the right for individuals to access their personal data.

Key Findings

IMY finds that Spotify provides to individuals the personal data the company processes when individuals request it. However, Spotify shall also provide information to the person requesting access about how Spotify uses this data and this information must be easy to understand. In addition, personal data that is difficult to understand, such as those of a technical nature, may need to be explained not only in English but in the individual's own, native language. In these parts, IMY has seen certain shortcomings in the audit of Spotify.

The deficiencies that have been discovered are considered overall to be of a low level of seriousness. In light of that and, among other things, the number of registered users and Spotify's turnover, IMY issues an administrative fine of almost EUR 5 million (SEK 58 million) against Spotify for not having provided sufficiently clear information to individuals.

Decision

IMY has found shortcomings related to the information pursuant to article 15.1 a-h and 15.2 of the GDPR that should be provided to the individual making the request and to the description of the data in the technical logfiles provided by Spotify. IMY has issued an administrative fine of SEK 58 million against Spotify for not providing sufficiently clear information to individuals in this regard. The decision in this part includes violations of articles 12.1, 15.1 a-d, g and 15.2 of the GDPR.

IMY has further found that Spotify had failed in its handling of requests for access related to two out of three of the complaints examined. The decision in this part includes violation of articles 12.1, 12.3, 15.3 and 15.1 a-h and 15.2 of the GDPR. In relation to these infringements IMY issues a reprimand and an order to comply with one complainant`s request of access.
For further information:

# data[].attributes.attachment_link.title
IMY issues an administrative fine against Spotify for shortcomings regarding transparency

# data[].attributes.attachment_link.description
Date of decision: 12 June 2023 Cross-border case or national case: Cross-border case LSA: Swedish Authority for Privacy Protection (IMY) CSAs: All other SAs Controller: Spotify Legal references: Article 15 (Right to access by the data subject), Article 12.1, Article 12.3, Article 58, Article 83 (General conditions for imposing administrative fines) Decision: Administrative fine, Reprimand, Order to comply with the complainants request for access Key words: Exercise of data subject rights, Transparency, Administrative fine The General Data Protection Regulation, GDPR, entered into force in 2018 and means, among other things, that the rights of individuals are strengthened.

# data[].attributes.attachment_link.provider_name
Data Subject Access Requests - FAQ | Data Protection Commission

# data[].attributes.attachment_link.readable_text
The majority of the complaints and queries the Data Protection Commission (DPC) receives concern individuals seeking to exercise their 'right of access'. The General Data Protection Regulation (GDPR), under Article 15, gives individuals the right to request a copy of any of their personal data which are being 'processed' (i.e. used in any way) by 'controllers' (i.e. those who decide how and why data are processed), as well as other relevant information (as detailed below). These requests are often referred to as 'data subject access requests', or 'access requests'.

These requests must be responded to free of charge and in an accessible form, and controllers should seek to facilitate access requests being both made and responded to easily, including electronically where appropriate and where the individual wishes.

The following guidance should answer some of the most frequently asked questions by both individuals who are seeking copies of their personal data, as well as controllers who are struggling to deal with the access requests they are receiving.
Data Subject Access Requests FAQ - Full Guidance Note Subject Access Requests: A Data Controller's Guide
Further reading:
Covid 19 and Subject Access Requests

# data[].attributes.attachment_link.title
Data Subject Access Requests - FAQ | Data Protection Commission

# data[].attributes.attachment_link.description
The majority of the complaints and queries the Data Protection Commission (DPC) receives concern

# data[].attributes.headline
Carta drepturilor fundamentale a Uniunii Europene

# data[].attributes.subject
Carta drepturilor fundamentale a Uniunii Europene

# data[].attributes.attachment_link.description
CARTA DREPTURILOR FUNDAMENTALE A UNIUNII EUROPENE (2016/C 202/02) CARTA DREPTURILOR FUNDAMENTALE A UNIUNII EUROPENE Parlamentul European, Consiliul și Comisia proclamă în mod solemn textul următor ca fiind Carta drepturilor fundamentale a Uniunii Europene. CARTA DREPTURILOR FUNDAMENTALE A UNIUNII EUROPENE Popoarele Europei, stabilind între ele o uniune tot mai strânsă, au hotărât să împărtășească un viitor pașnic întemeiat pe valori comune.

# data[].attributes.attachment_link.readable_text
02016R0679 - RO - 04.05.2016 - 000.002

Acest document are doar scop informativ și nu produce efecte juridice. Instituțiile Uniunii nu își asumă răspunderea pentru conținutul său. Versiunile autentice ale actelor relevante, inclusiv preambulul acestora, sunt cele publicate în Jurnalul Oficial al Uniunii Europene și disponibile pe site-ul EUR-Lex. Aceste texte oficiale pot fi consultate accesând linkurile integrate în prezentul document.

REGULAMENTUL (UE) 2016/679 AL PARLAMENTULUI EUROPEAN ȘI AL CONSILIULUI

din 27 aprilie 2016

privind protecția persoanelor fizice în ceea ce privește prelucrarea datelor cu caracter personal și privind libera circulație a acestor date și de abrogare a Directivei 95/46/CE (Regulamentul general privind protecția datelor)

(Text cu relevanță pentru SEE)

(JO L 119 4.5.2016, p. 1)

Rectificat prin:

REGULAMENTUL (UE) 2016/679 AL PARLAMENTULUI EUROPEAN ȘI AL CONSILIULUI

din 27 aprilie 2016

privind protecția persoanelor fizice în ceea ce privește prelucrarea datelor cu caracter personal și privind libera circulație a acestor date și de abrogare a Directivei 95/46/CE (Regulamentul general privind protecția datelor)

(Text cu relevanță pentru SEE)

CAPITOLUL I

Articolul 1

Obiect și obiective

(1) Prezentul regulament stabilește normele referitoare la protecția persoanelor fizice în ceea ce privește prelucrarea datelor cu caracter personal, precum și normele referitoare la libera circulație a datelor cu caracter personal.

(2) Prezentul regulament asigură protecția drepturilor și libertăților fundamentale ale persoanelor fizice și în special a dreptului acestora la protecția datelor cu caracter personal.

(3) Libera circulație a datelor cu caracter personal în interiorul Uniunii nu poate fi restricționată sau interzisă din motive legate de protecția persoanelor fizice în ceea ce privește prelucrarea datelor cu caracter personal.

Articolul 2

Domeniul de aplicare material

(1) Prezentul regulament se aplică prelucrării datelor cu caracter personal, efectuată total sau parțial prin mijloace automatizate, precum și prelucrării prin alte mijloace decât cele automatizate a datelor cu caracter personal care fac parte dintr-un sistem de evidență a datelor sau care sunt destinate să facă parte dintr-un sistem de evidență a datelor.

(2) Prezentul regulament nu se aplică prelucrării datelor cu caracter personal:

(a)în cadrul unei activități care nu intră sub incidența dreptului Uniunii;

(b)de către statele membre atunci când desfășoară activități care intră sub incidența capitolului 2 al titlului V din Tratatul UE;

(c)de către o persoană fizică în cadrul unei activități exclusiv personale sau domestice;

(d)de către autoritățile competente în scopul prevenirii, investigării, depistării sau urmăririi penale a infracțiunilor, sau al executării sancțiunilor penale, inclusiv al protejării împotriva amenințărilor la adresa siguranței publice și al prevenirii acestora.

(3) Pentru prelucrarea datelor cu caracter personal de către instituțiile, organele, oficiile și agențiile Uniunii, se aplică Regulamentul (CE) nr. 45/2001. Regulamentul (CE) nr. 45/2001 și alte acte juridice ale Uniunii aplicabile unei asemenea prelucrări a datelor cu caracter personal se adaptează la principiile și normele din prezentul regulament în conformitate cu articolul 98.

(4) Prezentul regulament nu aduce atingere aplicării Directivei 2000/31/CE, în special normelor privind răspunderea furnizorilor de servicii intermediari, prevăzute la articolele 12-15 din directiva menționată.

Articolul 3

Domeniul de aplicare teritorial

(1) Prezentul regulament se aplică prelucrării datelor cu caracter personal în cadrul activităților unui sediu al unui operator sau al unei persoane împuternicite de operator pe teritoriul Uniunii, indiferent dacă prelucrarea are loc sau nu pe teritoriul Uniunii.

(2) Prezentul regulament se aplică prelucrării datelor cu caracter personal ale unor persoane vizate care se află în Uniune de către un operator sau o persoană împuternicită de operator care nu este stabilit(ă) în Uniune, atunci când activitățile de prelucrare sunt legate de:

(a)oferirea de bunuri sau servicii unor astfel de persoane vizate în Uniune, indiferent dacă se solicită sau nu efectuarea unei plăți de către persoana vizată; sau

(b)monitorizarea comportamentului lor dacă acesta se manifestă în cadrul Uniunii.

(3) Prezentul regulament se aplică prelucrării datelor cu caracter personal de către un operator care nu este stabilit în Uniune, ci într-un loc în care dreptul intern se aplică în temeiul dreptului internațional public.

Articolul 4

Definiții

În sensul prezentului regulament:

1.„date cu caracter personal" înseamnă orice informații privind o persoană fizică identificată sau identificabilă („persoana vizată"); o persoană fizică identificabilă este o persoană care poate fi identificată, direct sau indirect, în special prin referire la un element de identificare, cum ar fi un nume, un număr de identificare, date de localizare, un identificator online, sau la unul sau mai multe elemente specifice, proprii identității sale fizice, fiziologice, genetice, psihice, economice, culturale sau sociale;

2.„prelucrare" înseamnă orice operațiune sau set de operațiuni efectuate asupra datelor cu caracter personal sau asupra seturilor de date cu caracter personal, cu sau fără utilizarea de mijloace automatizate, cum ar fi colectarea, înregistrarea, organizarea, structurarea, stocarea, adaptarea sau modificarea, extragerea, consultarea, utilizarea, divulgarea prin transmitere, diseminarea sau punerea la dispoziție în orice alt mod, alinierea sau combinarea, restricționarea, ștergerea sau distrugerea;

3.„restricționarea prelucrării" înseamnă marcarea datelor cu caracter personal stocate cu scopul de a limita prelucrarea viitoare a acestora;

4.„creare de profiluri" înseamnă orice formă de prelucrare automată a datelor cu caracter personal care constă în utilizarea datelor cu caracter personal pentru a evalua anumite aspecte personale referitoare la o persoană fizică, în special pentru a analiza sau prevedea aspecte privind performanța la locul de muncă, situația economică, sănătatea, preferințele personale, interesele, fiabilitatea, comportamentul, locul în care se află persoana fizică respectivă sau deplasările acesteia;

5.„pseudonimizare" înseamnă prelucrarea datelor cu caracter personal într-un asemenea mod încât acestea să nu mai poată fi atribuite unei anume persoane vizate fără a se utiliza informații suplimentare, cu condiția ca aceste informații suplimentare să fie stocate separat și să facă obiectul unor măsuri de natură tehnică și organizatorică care să asigure neatribuirea respectivelor date cu caracter personal unei persoane fizice identificate sau identificabile;

6.„sistem de evidență a datelor" înseamnă orice set structurat de date cu caracter personal accesibile conform unor criterii specifice, fie ele centralizate, descentralizate sau repartizate după criterii funcționale sau geografice;

7.„operator" înseamnă persoana fizică sau juridică, autoritatea publică, agenția sau alt organism care, singur sau împreună cu altele, stabilește scopurile și mijloacele de prelucrare a datelor cu caracter personal; atunci când scopurile și mijloacele prelucrării sunt stabilite prin dreptul Uniunii sau dreptul intern, operatorul sau criteriile specifice pentru desemnarea acestuia pot fi prevăzute în dreptul Uniunii sau în dreptul intern;

8.„persoană împuternicită de operator" înseamnă persoana fizică sau juridică, autoritatea publică, agenția sau alt organism care prelucrează datele cu caracter personal în numele operatorului;

9.„destinatar" înseamnă persoana fizică sau juridică, autoritatea publică, agenția sau alt organism căreia (căruia) îi sunt divulgate datele cu caracter personal, indiferent dacă este sau nu o parte terță. Cu toate acestea, autoritățile publice cărora li se pot comunica date cu caracter personal în cadrul unei anumite anchete în conformitate cu dreptul Uniunii sau cu dreptul intern nu sunt considerate destinatari; prelucrarea acestor date de către autoritățile publice respective respectă normele aplicabile în materie de protecție a datelor, în conformitate cu scopurile prelucrării;

10.„parte terță" înseamnă o persoană fizică sau juridică, autoritate publică, agenție sau organism altul decât persoana vizată, operatorul, persoana împuternicită de operator și persoanele care, sub directa autoritate a operatorului sau a persoanei împuternicite de operator, sunt autorizate să prelucreze date cu caracter personal;

11.„consimțământ" al persoanei vizate înseamnă orice manifestare de voință liberă, specifică, informată și lipsită de ambiguitate a persoanei vizate prin care aceasta acceptă, printr-o declarație sau printr-o acțiune fără echivoc, ca datele cu caracter personal care o privesc să fie prelucrate;

12.„încălcarea securității datelor cu caracter personal" înseamnă o încălcare a securității care duce, în mod accidental sau ilegal, la distrugerea, pierderea, modificarea, sau divulgarea neautorizată a datelor cu caracter personal transmise, stocate sau prelucrate într-un alt mod, sau la accesul neautorizat la acestea;

13.„date genetice" înseamnă datele cu caracter personal referitoare la caracteristicile genetice moștenite sau dobândite ale unei persoane fizice, care oferă informații unice privind fiziologia sau sănătatea persoanei respective și care rezultă în special în urma unei analize a unei mostre de material biologic recoltate de la persoana în cauză;

14.„date biometrice" înseamnă o date cu caracter personal care rezultă în urma unor tehnici de prelucrare specifice referitoare la caracteristicile fizice, fiziologice sau comportamentale ale unei persoane fizice care permit sau confirmă identificarea unică a respectivei persoane, cum ar fi imaginile faciale sau datele dactiloscopice;

15.„date privind sănătatea" înseamnă date cu caracter personal legate de sănătatea fizică sau mentală a unei persoane fizice, inclusiv prestarea de servicii de asistență medicală, care dezvăluie informații despre starea de sănătate a acesteia;

16.„sediu principal" înseamnă:

(a)în cazul unui operator cu sedii în cel puțin două state membre, locul în care se află administrația centrală a acestuia în Uniune, cu excepția cazului în care deciziile privind scopurile și mijloacele de prelucrare a datelor cu caracter personal se iau într-un alt sediu al operatorului din Uniune, sediu care are competența de a dispune punerea în aplicare a acestor decizii, caz în care sediul care a luat deciziile respective este considerat a fi sediul principal;

(b)în cazul unei persoane împuternicite de operator cu sedii în cel puțin două state membre, locul în care se află administrația centrală a acesteia în Uniune, sau, în cazul în care persoana împuternicită de operator nu are o administrație centrală în Uniune, sediul din Uniune al persoanei împuternicite de operator în care au loc activitățile principale de prelucrare, în contextul activităților unui sediu al persoanei împuternicite de operator, în măsura în care aceasta este supusă unor obligații specifice în temeiul prezentului regulament;

17.„reprezentant" înseamnă o persoană fizică sau juridică stabilită în Uniune, desemnată în scris de către operator sau persoana împuternicită de operator în temeiul articolului 27, care reprezintă operatorul sau persoana împuternicită în ceea ce privește obligațiile lor respective care le revin în temeiul prezentului regulament;

18.„întreprindere" înseamnă o persoană fizică sau juridică ce desfășoară o activitate economică, indiferent de forma juridică a acesteia, inclusiv parteneriate sau asociații care desfășoară în mod regulat o activitate economică;

19.„grup de întreprinderi" înseamnă o întreprindere care exercită controlul și întreprinderile controlate de aceasta;

20.„reguli corporatiste obligatorii" înseamnă politicile în materie de protecție a datelor cu caracter personal care trebuie respectate de un operator sau de o persoană împuternicită de operator stabilită pe teritoriul unui stat membru, în ceea ce privește transferurile sau seturile de transferuri de date cu caracter personal către un operator sau o persoană împuternicită de operator în una sau mai multe țări terțe în cadrul unui grup de întreprinderi sau al unui grup de întreprinderi implicate într-o activitate economică comună;

21.„autoritate de supraveghere" înseamnă o autoritate publică independentă instituită de un stat membru în temeiul articolului 51;

22.„autoritate de supraveghere vizată" înseamnă o autoritate de supraveghere care este vizată de procesul de prelucrare a datelor cu caracter personal deoarece:

(a)operatorul sau persoana împuternicită de operator este stabilită pe teritoriul statului membru al autorității de supraveghere respective;

(b)persoanele vizate care își au reședința în statul membru în care se află autoritatea de supraveghere respectivă sunt afectate în mod semnificativ sau sunt susceptibile de a fi afectate în mod semnificativ de prelucrare; sau

(c)la autoritatea de supraveghere respectivă a fost depusă o plângere;

23.„prelucrare transfrontalieră" înseamnă:

(a)fie prelucrarea datelor cu caracter personal care are loc în contextul activităților sediilor din mai multe state membre ale unui operator sau ale unei persoane împuternicite de operator pe teritoriul Uniunii, dacă operatorul sau persoana împuternicită de operator are sedii în cel puțin două state membre; sau

(b)fie prelucrarea datelor cu caracter personal care are loc în contextul activităților unui singur sediu al unui operator sau al unei persoane împuternicite de operator pe teritoriul Uniunii, dar care afectează în mod semnificativ sau este susceptibilă de a afecta în mod semnificativ persoane vizate din cel puțin două state membre;

24.„obiecție relevantă și motivată" înseamnă o obiecție la un proiect de decizie în scopul de a stabili dacă există o încălcare a prezentului regulament sau dacă măsurile preconizate în ceea ce privește operatorul sau persoana împuternicită de operator respectă prezentul regulament, care demonstrează în mod clar importanța riscurilor pe care le prezintă proiectul de decizie în ceea ce privește drepturile și libertățile fundamentale ale persoanelor vizate și, după caz, libera circulație a datelor cu caracter personal în cadrul Uniunii;

25.„serviciile societății informaționale" înseamnă un serviciu astfel cum este definit la articolul 1 alineatul (1) litera (b) din Directiva 2015/1535/CE a Parlamentului European și a Consiliului ();

26.„organizație internațională" înseamnă o organizație și organismele sale subordonate reglementate de dreptul internațional public sau orice alt organism care este instituit printr-un acord încheiat între două sau mai multe țări sau în temeiul unui astfel de acord.

CAPITOLUL II

Articolul 5

Principii legate de prelucrarea datelor cu caracter personal

(1) Datele cu caracter personal sunt:

(a)prelucrate în mod legal, echitabil și transparent față de persoana vizată („legalitate, echitate și transparență");

(b)colectate în scopuri determinate, explicite și legitime și nu sunt prelucrate ulterior într-un mod incompatibil cu aceste scopuri; prelucrarea ulterioară în scopuri de arhivare în interes public, în scopuri de cercetare științifică sau istorică ori în scopuri statistice nu este considerată incompatibilă cu scopurile inițiale, în conformitate cu articolul 89 alineatul (1) („limitări legate de scop");

(c)adecvate, relevante și limitate la ceea ce este necesar în raport cu scopurile în care sunt prelucrate („reducerea la minimum a datelor");

(d)exacte și, în cazul în care este necesar, să fie actualizate; trebuie să se ia toate măsurile necesare pentru a se asigura că datele cu caracter personal care sunt inexacte, având în vedere scopurile pentru care sunt prelucrate, sunt șterse sau rectificate fără întârziere („exactitate");

(e)păstrate într-o formă care permite identificarea persoanelor vizate pe o perioadă care nu depășește perioada necesară îndeplinirii scopurilor în care sunt prelucrate datele; datele cu caracter personal pot fi stocate pe perioade mai lungi în măsura în care acestea vor fi prelucrate exclusiv în scopuri de arhivare în interes public, în scopuri de cercetare științifică sau istorică ori în scopuri statistice, în conformitate cu articolul 89 alineatul (1), sub rezerva punerii în aplicare a măsurilor de ordin tehnic și organizatoric adecvate prevăzute în prezentul regulament în vederea garantării drepturilor și libertăților persoanei vizate („limitări legate de stocare");

(f)prelucrate într-un mod care asigură securitatea adecvată a datelor cu caracter personal, inclusiv protecția împotriva prelucrării neautorizate sau ilegale și împotriva pierderii, a distrugerii sau a deteriorării accidentale, prin luarea de măsuri tehnice sau organizatorice corespunzătoare („integritate și confidențialitate").

(2) Operatorul este responsabil de respectarea alineatului (1) și poate demonstra această respectare („responsabilitate").

Articolul 6

Legalitatea prelucrării

(1) Prelucrarea este legală numai dacă și în măsura în care se aplică cel puțin una dintre următoarele condiții:

(a)persoana vizată și-a dat consimțământul pentru prelucrarea datelor sale cu caracter personal pentru unul sau mai multe scopuri specifice;

(b)prelucrarea este necesară pentru executarea unui contract la care persoana vizată este parte sau pentru a face demersuri la cererea persoanei vizate înainte de încheierea unui contract;

(c)prelucrarea este necesară în vederea îndeplinirii unei obligații legale care îi revine operatorului;

(d)prelucrarea este necesară pentru a proteja interesele vitale ale persoanei vizate sau ale altei persoane fizice;

(e)prelucrarea este necesară pentru îndeplinirea unei sarcini care servește unui interes public sau care rezultă din exercitarea autorității publice cu care este învestit operatorul;

(f)prelucrarea este necesară în scopul intereselor legitime urmărite de operator sau de o parte terță, cu excepția cazului în care prevalează interesele sau drepturile și libertățile fundamentale ale persoanei vizate, care necesită protejarea datelor cu caracter personal, în special atunci când persoana vizată este un copil.

Litera (f) din primul paragraf nu se aplică în cazul prelucrării efectuate de autorități publice în îndeplinirea atribuțiilor lor.

(2) Statele membre pot menține sau introduce dispoziții mai specifice de adaptare a aplicării normelor prezentului regulament în ceea ce privește prelucrarea în vederea respectării alineatului (1) literele (c) și (e) prin definirea unor cerințe specifice mai precise cu privire la prelucrare și a altor măsuri de asigurare a unei prelucrări legale și echitabile, inclusiv pentru alte situații concrete de prelucrare, astfel cum este prevăzut în capitolul IX.

(3) Temeiul pentru prelucrarea menționată la alineatul (1) literele (c) și (e) trebuie să fie prevăzut în:

(b)dreptul intern care se aplică operatorului.

Scopul prelucrării este stabilit pe baza respectivului temei juridic sau, în ceea ce privește prelucrarea menționată la alineatul (1) litera (e), este necesar pentru îndeplinirea unei sarcini efectuate în interes public sau în cadrul exercitării unei funcții publice atribuite operatorului. Respectivul temei juridic poate conține dispoziții specifice privind adaptarea aplicării normelor prezentului regulament, printre altele: condițiile generale care reglementează legalitatea prelucrării de către operator; tipurile de date care fac obiectul prelucrării; persoanele vizate; entitățile cărora le pot fi divulgate datele și scopul pentru care respectivele date cu caracter personal pot fi divulgate; limitările legate de scop; perioadele de stocare; și operațiunile și procedurile de prelucrare, inclusiv măsurile de asigurare a unei prelucrări legale și echitabile cum sunt cele pentru alte situații concrete de prelucrare astfel cum sunt prevăzute în capitolul IX. Dreptul Uniunii sau dreptul intern urmărește un obiectiv de interes public și este proporțional cu obiectivul legitim urmărit.

(4) În cazul în care prelucrarea în alt scop decât cel pentru care datele cu caracter personal au fost colectate nu se bazează pe consimțământul persoanei vizate sau pe dreptul Uniunii sau dreptul intern, care constituie o măsură necesară și proporțională într-o societate democratică pentru a proteja obiectivele menționate la articolul 23 alineatul (1), operatorul, pentru a stabili dacă prelucrarea în alt scop este compatibilă cu scopul pentru care datele cu caracter personal au fost colectate inițial, ia în considerare, printre altele:

(a)orice legătură dintre scopurile în care datele cu caracter personal au fost colectate și scopurile prelucrării ulterioare preconizate;

(b)contextul în care datele cu caracter personal au fost colectate, în special în ceea ce privește relația dintre persoanele vizate și operator;

(c)natura datelor cu caracter personal, în special în cazul prelucrării unor categorii speciale de date cu caracter personal, în conformitate cu articolul 9, sau în cazul în care sunt prelucrate date cu caracter personal referitoare la condamnări penale și infracțiuni, în conformitate cu articolul 10;

(d)posibilele consecințe asupra persoanelor vizate ale prelucrării ulterioare preconizate;

(e)existența unor garanții adecvate, care pot include criptarea sau pseudonimizarea.

Articolul 7

Condiții privind consimțământul

(1) În cazul în care prelucrarea se bazează pe consimțământ, operatorul trebuie să fie în măsură să demonstreze că persoana vizată și-a dat consimțământul pentru prelucrarea datelor sale cu caracter personal.

(2) În cazul în care consimțământul persoanei vizate este dat în contextul unei declarații scrise care se referă și la alte aspecte, cererea privind consimțământul trebuie să fie prezentată într-o formă care o diferențiază în mod clar de celelalte aspecte, într-o formă inteligibilă și ușor accesibilă, utilizând un limbaj clar și simplu. Nicio parte a respectivei declarații care constituie o încălcare a prezentului regulament nu este obligatorie.

(3) Persoana vizată are dreptul să își retragă în orice moment consimțământul. Retragerea consimțământului nu afectează legalitatea prelucrării efectuate pe baza consimțământului înainte de retragerea acestuia. Înainte de acordarea consimțământului, persoana vizată este informată cu privire la acest lucru. Retragerea consimțământului se face la fel de simplu ca acordarea acestuia.

(4) Atunci când se evaluează dacă consimțământul este dat în mod liber, se ține seama cât mai mult de faptul că, printre altele, executarea unui contract, inclusiv prestarea unui serviciu, este condiționată sau nu de consimțământul cu privire la prelucrarea datelor cu caracter personal care nu este necesară pentru executarea acestui contract.

Articolul 8

Condiții aplicabile în ceea ce privește consimțământul copiilor în legătură cu serviciile societății informaționale

(1) În cazul în care se aplică articolul 6 alineatul (1) litera (a), în ceea ce privește oferirea de servicii ale societății informaționale în mod direct unui copil, prelucrarea datelor cu caracter personal ale unui copil este legală dacă copilul are cel puțin vârsta de 16 ani. Dacă copilul are sub vârsta de 16 ani, respectiva prelucrare este legală numai dacă și în măsura în care consimțământul respectiv este acordat sau autorizat de titularul răspunderii părintești asupra copilului.

Statele membre pot prevedea prin lege o vârstă inferioară în aceste scopuri, cu condiția ca acea vârstă inferioară să nu fie mai mică de 13 ani.

(2) Operatorul depune toate eforturile rezonabile pentru a verifica în astfel de cazuri că titularul răspunderii părintești a acordat sau a autorizat consimțământul, ținând seama de tehnologiile disponibile.

(3) Alineatul (1) nu afectează dreptul general al contractelor aplicabil în statele membre, cum ar fi normele privind valabilitatea, încheierea sau efectele unui contract în legătură cu un copil.

Articolul 9

Prelucrarea de categorii speciale de date cu caracter personal

(1) Se interzice prelucrarea de date cu caracter personal care dezvăluie originea rasială sau etnică, opiniile politice, confesiunea religioasă sau convingerile filozofice sau apartenența la sindicate și prelucrarea de date genetice, de date biometrice pentru identificarea unică a unei persoane fizice, de date privind sănătatea sau de date privind viața sexuală sau orientarea sexuală ale unei persoane fizice.

(2) Alineatul (1) nu se aplică în următoarele situații:

(a)persoana vizată și-a dat consimțământul explicit pentru prelucrarea acestor date cu caracter personal pentru unul sau mai multe scopuri specifice, cu excepția cazului în care dreptul Uniunii sau dreptul intern prevede ca interdicția prevăzută la alineatul (1) să nu poată fi ridicată prin consimțământul persoanei vizate;

(b)prelucrarea este necesară în scopul îndeplinirii obligațiilor și al exercitării unor drepturi specifice ale operatorului sau ale persoanei vizate în domeniul ocupării forței de muncă și al securității sociale și protecției sociale, în măsura în care acest lucru este autorizat de dreptul Uniunii sau de dreptul intern ori de un acord colectiv de muncă încheiat în temeiul dreptului intern care prevede garanții adecvate pentru drepturile fundamentale și interesele persoanei vizate;

(c)prelucrarea este necesară pentru protejarea intereselor vitale ale persoanei vizate sau ale unei alte persoane fizice, atunci când persoana vizată se află în incapacitate fizică sau juridică de a-și da consimțământul;

(d)prelucrarea este efectuată în cadrul activităților lor legitime și cu garanții adecvate de către o fundație, o asociație sau orice alt organism fără scop lucrativ și cu specific politic, filozofic, religios sau sindical, cu condiția ca prelucrarea să se refere numai la membrii sau la foștii membri ai organismului respectiv sau la persoane cu care acesta are contacte permanente în legătură cu scopurile sale și ca datele cu caracter personal să nu fie comunicate terților fără consimțământul persoanelor vizate;

(e)prelucrarea se referă la date cu caracter personal care sunt făcute publice în mod manifest de către persoana vizată;

(f)prelucrarea este necesară pentru constatarea, exercitarea sau apărarea unui drept în instanță sau ori de câte ori instanțele acționează în exercițiul funcției lor judiciare;

(g)prelucrarea este necesară din motive de interes public major, în baza dreptului Uniunii sau a dreptului intern, care este proporțional cu obiectivul urmărit, respectă esența dreptului la protecția datelor și prevede măsuri corespunzătoare și specifice pentru protejarea drepturilor fundamentale și a intereselor persoanei vizate;

(h)prelucrarea este necesară în scopuri legate de medicina preventivă sau a muncii, de evaluarea capacității de muncă a angajatului, de stabilirea unui diagnostic medical, de furnizarea de asistență medicală sau socială sau a unui tratament medical sau de gestionarea sistemelor și serviciilor de sănătate sau de asistență socială, în temeiul dreptului Uniunii sau al dreptului intern sau în temeiul unui contract încheiat cu un cadru medical și sub rezerva respectării condițiilor și garanțiilor prevăzute la alineatul (3);

(i)prelucrarea este necesară din motive de interes public în domeniul sănătății publice, cum ar fi protecția împotriva amenințărilor transfrontaliere grave la adresa sănătății sau asigurarea de standarde ridicate de calitate și siguranță a asistenței medicale și a medicamentelor sau a dispozitivelor medicale, în temeiul dreptului Uniunii sau al dreptului intern, care prevede măsuri adecvate și specifice pentru protejarea drepturilor și libertăților persoanei vizate, în special a secretului profesional; sau

(j)prelucrarea este necesară în scopuri de arhivare în interes public, în scopuri de cercetare științifică sau istorică ori în scopuri statistice, în conformitate cu articolul 89 alineatul (1), în baza dreptului Uniunii sau a dreptului intern, care este proporțional cu obiectivul urmărit, respectă esența dreptului la protecția datelor și prevede măsuri corespunzătoare și specifice pentru protejarea drepturilor fundamentale și a intereselor persoanei vizate.

(3) Datele cu caracter personal menționate la alineatul (1) pot fi prelucrate în scopurile menționate la alineatul (2) litera (h) în cazul în care datele respective sunt prelucrate de către un profesionist supus obligației de păstrare a secretului profesional sau sub responsabilitatea acestuia, în temeiul dreptului Uniunii sau al dreptului intern sau în temeiul normelor stabilite de organisme naționale competente sau de o altă persoană supusă, de asemenea, unei obligații de confidențialitate în temeiul dreptului Uniunii sau al dreptului intern ori al normelor stabilite de organisme naționale competente.

(4) Statele membre pot menține sau introduce condiții suplimentare, inclusiv restricții, în ceea ce privește prelucrarea de date genetice, date biometrice sau date privind sănătatea.

Articolul 10

Prelucrarea de date cu caracter personal referitoare la condamnări penale și infracțiuni

Prelucrarea de date cu caracter personal referitoare la condamnări penale și infracțiuni sau la măsuri de securitate conexe în temeiul articolului 6 alineatul (1) se efectuează numai sub controlul unei autorități de stat sau atunci când prelucrarea este autorizată de dreptul Uniunii sau de dreptul intern care prevede garanții adecvate pentru drepturile și libertățile persoanelor vizate. Orice registru cuprinzător al condamnărilor penale se ține numai sub controlul unei autorități de stat.

Articolul 11

Prelucrarea care nu necesită identificare

(1) În cazul în care scopurile pentru care un operator prelucrează date cu caracter personal nu necesită sau nu mai necesită identificarea unei persoane vizate de către operator, operatorul nu are obligația de a păstra, obține sau prelucra informații suplimentare pentru a identifica persoana vizată în scopul unic al respectării prezentului regulament.

(2) Dacă, în cazurile menționate la alineatul (1) din prezentul articol, operatorul poate demonstra că nu este în măsură să identifice persoana vizată, operatorul informează persoana vizată în mod corespunzător, în cazul în care este posibil. În astfel de cazuri, articolele 15-20 nu se aplică, cu excepția cazului în care persoana vizată, în scopul exercitării drepturilor sale în temeiul respectivelor articole, oferă informații suplimentare care permit identificarea sa.

CAPITOLUL III

Drepturile persoanei vizate

Secțiunea 1

Transparență și modalități

Articolul 12

Transparența informațiilor, a comunicărilor și a modalităților de exercitare a drepturilor persoanei vizate

(1) Operatorul ia măsuri adecvate pentru a furniza persoanei vizate orice informații menționate la articolele 13 și 14 și orice comunicări în temeiul articolelor 15-22 și 34 referitoare la prelucrare, într-o formă concisă, transparentă, inteligibilă și ușor accesibilă, utilizând un limbaj clar și simplu, în special pentru orice informații adresate în mod specific unui copil. Informațiile se furnizează în scris sau prin alte mijloace, inclusiv, atunci când este oportun, în format electronic. La solicitarea persoanei vizate, informațiile pot fi furnizate verbal, cu condiția ca identitatea persoanei vizate să fie dovedită prin alte mijloace.

(2) Operatorul facilitează exercitarea drepturilor persoanei vizate în temeiul articolelor 15-22. În cazurile menționate la articolul 11 alineatul (2), operatorul nu refuză să dea curs cererii persoanei vizate de a-și exercita drepturile în conformitate cu articolele 15-22, cu excepția cazului în care operatorul demonstrează că nu este în măsură să identifice persoana vizată.

(3) Operatorul furnizează persoanei vizate informații privind acțiunile întreprinse în urma unei cereri în temeiul articolelor 15-22, fără întârzieri nejustificate și în orice caz în cel mult o lună de la primirea cererii. Această perioadă poate fi prelungită cu două luni atunci când este necesar, ținându-se seama de complexitatea și numărul cererilor. Operatorul informează persoana vizată cu privire la orice astfel de prelungire, în termen de o lună de la primirea cererii, prezentând și motivele întârzierii. În cazul în care persoana vizată introduce o cerere în format electronic, informațiile sunt furnizate în format electronic acolo unde este posibil, cu excepția cazului în care persoana vizată solicită un alt format.

(4) Dacă nu ia măsuri cu privire la cererea persoanei vizate, operatorul informează persoana vizată, fără întârziere și în termen de cel mult o lună de la primirea cererii, cu privire la motivele pentru care nu ia măsuri și la posibilitatea de a depune o plângere în fața unei autorități de supraveghere și de a introduce o cale de atac judiciară.

(5) Informațiile furnizate în temeiul articolelor 13 și 14 și orice comunicare și orice măsuri luate în temeiul articolelor 15-22 și 34 sunt oferite gratuit. În cazul în care cererile din partea unei persoane vizate sunt în mod vădit nefondate sau excesive, în special din cauza caracterului lor repetitiv, operatorul poate:

(a)fie să perceapă o taxă rezonabilă ținând cont de costurile administrative pentru furnizarea informațiilor sau a comunicării sau pentru luarea măsurilor solicitate;

(b)fie să refuze să dea curs cererii.

În aceste cazuri, operatorului îi revine sarcina de a demonstra caracterul vădit nefondat sau excesiv al cererii.

(6) Fără a aduce atingere articolului 11, în cazul în care are îndoieli întemeiate cu privire la identitatea persoanei fizice care înaintează cererea menționată la articolele 15-21, operatorul poate solicita furnizarea de informații suplimentare necesare pentru a confirma identitatea persoanei vizate.

(7) Informațiile care urmează să fie furnizate persoanelor vizate în temeiul articolelor 13 și 14 pot fi furnizate în combinație cu pictograme standardizate pentru a oferi într-un mod ușor vizibil, inteligibil și clar lizibil o imagine de ansamblu semnificativă asupra prelucrării avute în vedere. În cazul în care pictogramele sunt prezentate în format electronic, acestea trebuie să poată fi citite automat.

(8) Comisia este împuternicită să adopte acte delegate în conformitate cu articolul 92 în vederea determinării informațiilor care urmează să fie prezentate de pictograme și a procedurilor pentru furnizarea de pictograme standardizate.

Secțiunea 2

Informare și acces la date cu caracter personal

Articolul 13

Informații care se furnizează în cazul în care datele cu caracter personal sunt colectate de la persoana vizată

(1) În cazul în care datele cu caracter personal referitoare la o persoană vizată sunt colectate de la aceasta, operatorul, în momentul obținerii acestor date cu caracter personal, furnizează persoanei vizate toate informațiile următoare:

(a)identitatea și datele de contact ale operatorului și, după caz, ale reprezentantului acestuia;

(b)datele de contact ale responsabilului cu protecția datelor, după caz;

(c)scopurile în care sunt prelucrate datele cu caracter personal, precum și temeiul juridic al prelucrării;

(d)în cazul în care prelucrarea se face în temeiul articolului 6 alineatul (1) litera (f), interesele legitime urmărite de operator sau de o parte terță;

(e)destinatarii sau categoriile de destinatari ai datelor cu caracter personal;

(f)dacă este cazul, intenția operatorului de a transfera date cu caracter personal către o țară terță sau o organizație internațională și existența sau absența unei decizii a Comisiei privind caracterul adecvat sau, în cazul transferurilor menționate la articolul 46 sau 47 sau la articolul 49 alineatul (1) al doilea paragraf, o trimitere la garanțiile adecvate sau corespunzătoare și la mijloacele de a obține o copie a acestora, în cazul în care acestea au fost puse la dispoziție.

(2) În plus față de informațiile menționate la alineatul (1), în momentul în care datele cu caracter personal sunt obținute, operatorul furnizează persoanei vizate următoarele informații suplimentare necesare pentru a asigura o prelucrare echitabilă și transparentă:

(a)perioada pentru care vor fi stocate datele cu caracter personal sau, dacă acest lucru nu este posibil, criteriile utilizate pentru a stabili această perioadă;

(b)existența dreptului de a solicita operatorului, în ceea ce privește datele cu caracter personal referitoare la persoana vizată, accesul la acestea, rectificarea sau ștergerea acestora sau restricționarea prelucrării sau a dreptului de a se opune prelucrării, precum și a dreptului la portabilitatea datelor;

(c)atunci când prelucrarea se bazează pe articolul 6 alineatul (1) litera (a) sau pe articolul 9 alineatul (2) litera (a), existența dreptului de a retrage consimțământul în orice moment, fără a afecta legalitatea prelucrării efectuate pe baza consimțământului înainte de retragerea acestuia;

(d)dreptul de a depune o plângere în fața unei autorități de supraveghere;

(e)dacă furnizarea de date cu caracter personal reprezintă o obligație legală sau contractuală sau o obligație necesară pentru încheierea unui contract, precum și dacă persoana vizată este obligată să furnizeze aceste date cu caracter personal și care sunt eventualele consecințe ale nerespectării acestei obligații;

(f)existența unui proces decizional automatizat incluzând crearea de profiluri, menționat la articolul 22 alineatele (1) și (4), precum și, cel puțin în cazurile respective, informații pertinente privind logica utilizată și privind importanța și consecințele preconizate ale unei astfel de prelucrări pentru persoana vizată.

(3) În cazul în care operatorul intenționează să prelucreze ulterior datele cu caracter personal într-un alt scop decât cel pentru care acestea au fost colectate, operatorul furnizează persoanei vizate, înainte de această prelucrare ulterioară, informații privind scopul secundar respectiv și orice informații suplimentare relevante, în conformitate cu alineatul (2).

(4) Alineatele (1), (2) și (3) nu se aplică dacă și în măsura în care persoana vizată deține deja informațiile respective.

Articolul 14

Informații care se furnizează în cazul în care datele cu caracter personal nu au fost obținute de la persoana vizată

(1) În cazul în care datele cu caracter personal nu au fost obținute de la persoana vizată, operatorul furnizează persoanei vizate următoarele informații:

(a)identitatea și datele de contact ale operatorului și, după caz, ale reprezentantului acestuia;

(b)datele de contact ale responsabilului cu protecția datelor, după caz;

(c)scopurile în care sunt prelucrate datele cu caracter personal, precum și temeiul juridic al prelucrării;

(d)categoriile de date cu caracter personal vizate;

(e)destinatarii sau categoriile de destinatari ai datelor cu caracter personal, după caz;

(f)dacă este cazul, intenția operatorului de a transfera date cu caracter personal către un destinatar dintr-o țară terță sau o organizație internațională și existența sau absența unei decizii a Comisiei privind caracterul adecvat sau, în cazul transferurilor menționate la articolul 46 sau 47 sau la articolul 49 alineatul (1) al doilea paragraf, o trimitere la garanțiile adecvate sau corespunzătoare și la mijloacele de a obține o copie a acestora, în cazul în care acestea au fost puse la dispoziție.

(2) Pe lângă informațiile menționate la alineatul (1), operatorul furnizează persoanei vizate următoarele informații necesare pentru a asigura o prelucrare echitabilă și transparentă în ceea ce privește persoana vizată:

(a)perioada pentru care vor fi stocate datele cu caracter personal sau, dacă acest lucru nu este posibil, criteriile utilizate pentru a stabili această perioadă;

(b)în cazul în care prelucrarea se face în temeiul articolului 6 alineatul (1) litera (f), interesele legitime urmărite de operator sau de o parte terță;

(c)existența dreptului de a solicita operatorului, în ceea ce privește datele cu caracter personal referitoare la persoana vizată, accesul la acestea, rectificarea sau ștergerea acestora sau restricționarea prelucrării și a dreptului de a se opune prelucrării, precum și a dreptului la portabilitatea datelor;

(d)atunci când prelucrarea se bazează pe articolul 6 alineatul (1) litera (a) sau pe articolul 9 alineatul (2) litera (a), existența dreptului de a retrage consimțământul în orice moment, fără a afecta legalitatea prelucrării efectuate pe baza consimțământului înainte de retragerea acestuia;

(e)dreptul de a depune o plângere în fața unei autorități de supraveghere;

(f)sursa din care provin datele cu caracter personal și, dacă este cazul, dacă acestea provin din surse disponibile public;

(g)existența unui proces decizional automatizat incluzând crearea de profiluri, menționat la articolul 22 alineatele (1) și (4), precum și, cel puțin în cazurile respective, informații pertinente privind logica utilizată și privind importanța și consecințele preconizate ale unei astfel de prelucrări pentru persoana vizată.

(3) Operatorul furnizează informațiile menționate la alineatele (1) și (2):

(a)într-un termen rezonabil după obținerea datelor cu caracter personal, dar nu mai mare de o lună, ținându-se seama de circumstanțele specifice în care sunt prelucrate datele cu caracter personal;

(b)dacă datele cu caracter personal urmează să fie utilizate pentru comunicarea cu persoana vizată, cel târziu în momentul primei comunicări către persoana vizată respectivă; sau

(c)dacă se intenționează divulgarea datelor cu caracter personal către un alt destinatar, cel mai târziu la data la care acestea sunt divulgate pentru prima oară.

(4) În cazul în care operatorul intenționează să prelucreze ulterior datele cu caracter personal într-un alt scop decât cel pentru care acestea au fost obținute, operatorul furnizează persoanei vizate, înainte de această prelucrare ulterioară, informații privind scopul secundar respectiv și orice informații suplimentare relevante, în conformitate cu alineatul (2).

(5) Alineatele (1)-(4) nu se aplică dacă și în măsura în care:

(a)persoana vizată deține deja informațiile;

(b)furnizarea acestor informații se dovedește a fi imposibilă sau ar implica eforturi disproporționate, în special în cazul prelucrării în scopuri de arhivare în interes public, în scopuri de cercetare științifică sau istorică ori în scopuri statistice, sub rezerva condițiilor și a garanțiilor prevăzute la articolul 89 alineatul (1), sau în măsura în care obligația menționată la alineatul (1) din prezentul articol este susceptibil să facă imposibilă sau să afecteze în mod grav realizarea obiectivelor prelucrării respective In astfel de cazuri, operatorul ia măsuri adecvate pentru a proteja drepturile, libertățile și interesele legitime ale persoanei vizate, inclusiv punerea informațiilor la dispoziția publicului;

(c)obținerea sau divulgarea datelor este prevăzută în mod expres de dreptul Uniunii sau de dreptul intern sub incidența căruia intră operatorul și care prevede măsuri adecvate pentru a proteja interesele legitime ale persoanei vizate; sau

(d)în cazul în care datele cu caracter personal trebuie să rămână confidențiale în temeiul unei obligații statutare de secret profesional reglementate de dreptul Uniunii sau de dreptul intern, inclusiv al unei obligații legale de a păstra secretul.

Articolul 15

Dreptul de acces al persoanei vizate

(1) Persoana vizată are dreptul de a obține din partea operatorului o confirmare că se prelucrează sau nu date cu caracter personal care o privesc și, în caz afirmativ, acces la datele respective și la următoarele informații:

(a)scopurile prelucrării;

(b)categoriile de date cu caracter personal vizate;

(c)destinatarii sau categoriile de destinatari cărora datele cu caracter personal le-au fost sau urmează să le fie divulgate, în special destinatari din țări terțe sau organizații internaționale;

(d)acolo unde este posibil, perioada pentru care se preconizează că vor fi stocate datele cu caracter personal sau, dacă acest lucru nu este posibil, criteriile utilizate pentru a stabili această perioadă;

(e)existența dreptului de a solicita operatorului rectificarea sau ștergerea datelor cu caracter personal ori restricționarea prelucrării datelor cu caracter personal referitoare la persoana vizată sau a dreptului de a se opune prelucrării;

(f)dreptul de a depune o plângere în fața unei autorități de supraveghere;

(g)în cazul în care datele cu caracter personal nu sunt colectate de la persoana vizată, orice informații disponibile privind sursa acestora;

(h)existența unui proces decizional automatizat incluzând crearea de profiluri, menționat la articolul 22 alineatele (1) și (4), precum și, cel puțin în cazurile respective, informații pertinente privind logica utilizată și privind importanța și consecințele preconizate ale unei astfel de prelucrări pentru persoana vizată.

(2) În cazul în care datele cu caracter personal sunt transferate către o țară terță sau o organizație internațională, persoana vizată are dreptul să fie informată cu privire la garanțiile adecvate în temeiul articolului 46 referitoare la transfer.

(3) Operatorul furnizează o copie a datelor cu caracter personal care fac obiectul prelucrării. Pentru orice alte copii solicitate de persoana vizată, operatorul poate percepe o taxă rezonabilă, bazată pe costurile administrative. În cazul în care persoana vizată introduce cererea în format electronic și cu excepția cazului în care persoana vizată solicită un alt format, informațiile sunt furnizate într-un format electronic utilizat în mod curent.

(4) Dreptul de a obține o copie menționată la alineatul (3) nu aduce atingere drepturilor și libertăților altora.

Secțiunea 3

Rectificare și ștergere

Articolul 16

Dreptul la rectificare

Persoana vizată are dreptul de a obține de la operator, fără întârzieri nejustificate, rectificarea datelor cu caracter personal inexacte care o privesc. Ținându-se seama de scopurile în care au fost prelucrate datele, persoana vizată are dreptul de a obține completarea datelor cu caracter personal care sunt incomplete, inclusiv prin furnizarea unei declarații suplimentare.

Articolul 17

Dreptul la ștergerea datelor („dreptul de a fi uitat")

(1) Persoana vizată are dreptul de a obține din partea operatorului ștergerea datelor cu caracter personal care o privesc, fără întârzieri nejustificate, iar operatorul are obligația de a șterge datele cu caracter personal fără întârzieri nejustificate în cazul în care se aplică unul dintre următoarele motive:

(a)datele cu caracter personal nu mai sunt necesare pentru îndeplinirea scopurilor pentru care au fost colectate sau prelucrate;

(b)persoana vizată își retrage consimțământul pe baza căruia are loc prelucrarea, în conformitate cu articolul 6 alineatul (1) litera (a) sau cu articolul 9 alineatul (2) litera (a), și nu există niciun alt temei juridic pentru prelucrarea;

(c)persoana vizată se opune prelucrării în temeiul articolului 21 alineatul (1) și nu există motive legitime care să prevaleze în ceea ce privește prelucrarea sau persoana vizată se opune prelucrării în temeiul articolului 21 alineatul (2);

(d)datele cu caracter personal au fost prelucrate ilegal;

(e)datele cu caracter personal trebuie șterse pentru respectarea unei obligații legale care revine operatorului în temeiul dreptului Uniunii sau al dreptului intern sub incidența căruia se află operatorul;

(f)datele cu caracter personal au fost colectate în legătură cu oferirea de servicii ale societății informaționale menționate la articolul 8 alineatul (1).

(2) În cazul în care operatorul a făcut publice datele cu caracter personal și este obligat, în temeiul alineatului (1), să le șteargă, operatorul, ținând seama de tehnologia disponibilă și de costul implementării, ia măsuri rezonabile, inclusiv măsuri tehnice, pentru a informa operatorii care prelucrează datele cu caracter personal că persoana vizată a solicitat ștergerea de către acești operatori a oricăror linkuri către datele respective sau a oricăror copii sau reproduceri ale acestor date cu caracter personal.

(3) Alineatele (1) și (2) nu se aplică în măsura în care prelucrarea este necesară:

(a)pentru exercitarea dreptului la liberă exprimare și la informare;

(b)pentru respectarea unei obligații legale care prevede prelucrarea în temeiul dreptului Uniunii sau al dreptului intern care se aplică operatorului sau pentru îndeplinirea unei sarcini executate în interes public sau în cadrul exercitării unei autorități oficiale cu care este învestit operatorul;

(c)din motive de interes public în domeniul sănătății publice, în conformitate cu articolul 9 alineatul (2) literele (h) și (i) și cu articolul 9 alineatul (3);

(d)în scopuri de arhivare în interes public, în scopuri de cercetare științifică sau istorică ori în scopuri statistice, în conformitate cu articolul 89 alineatul (1), în măsura în care dreptul menționat la alineatul (1) este susceptibil să facă imposibilă sau să afecteze în mod grav realizarea obiectivelor prelucrării respective; sau

(e)pentru constatarea, exercitarea sau apărarea unui drept în instanță.

Articolul 18

Dreptul la restricționarea prelucrării

(1) Persoana vizată are dreptul de a obține din partea operatorului restricționarea prelucrării în cazul în care se aplică unul din următoarele cazuri:

(a)persoana vizată contestă exactitatea datelor, pentru o perioadă care îi permite operatorului să verifice exactitatea datelor;

(b)prelucrarea este ilegală, iar persoana vizată se opune ștergerii datelor cu caracter personal, solicitând în schimb restricționarea utilizării lor;

(c)operatorul nu mai are nevoie de datele cu caracter personal în scopul prelucrării, dar persoana vizată i le solicită pentru constatarea, exercitarea sau apărarea unui drept în instanță; sau

(d)persoana vizată s-a opus prelucrării în conformitate cu articolul 21 alineatul (1), pentru intervalul de timp în care se verifică dacă drepturile legitime ale operatorului prevalează asupra celor ale persoanei vizate.

(2) În cazul în care prelucrarea a fost restricționată în temeiul alineatului (1), astfel de date cu caracter personal pot, cu excepția stocării, să fie prelucrate numai cu consimțământul persoanei vizate sau pentru constatarea, exercitarea sau apărarea unui drept în instanță sau pentru protecția drepturilor unei alte persoane fizice sau juridice sau din motive de interes public important al Uniunii sau al unui stat membru.

(3) O persoană vizată care a obținut restricționarea prelucrării în temeiul alineatului (1) este informată de către operator înainte de ridicarea restricției de prelucrare.

Articolul 19

Obligația de notificare privind rectificarea sau ștergerea datelor cu caracter personal sau restricționarea prelucrării

Operatorul comunică fiecărui destinatar căruia i-au fost divulgate datele cu caracter personal orice rectificare sau ștergere a datelor cu caracter personal sau restricționare a prelucrării efectuate în conformitate cu articolul 16, articolul 17 alineatul (1) și articolul 18, cu excepția cazului în care acest lucru se dovedește imposibil sau presupune eforturi disproporționate. Operatorul informează persoana vizată cu privire la destinatarii respectivi dacă persoana vizată solicită acest lucru.

Articolul 20

Dreptul la portabilitatea datelor

(1) Persoana vizată are dreptul de a primi datele cu caracter personal care o privesc și pe care le-a furnizat operatorului într-un format structurat, utilizat în mod curent și care poate fi citit automat și are dreptul de a transmite aceste date altui operator, fără obstacole din partea operatorului căruia i-au fost furnizate datele cu caracter personal, în cazul în care:

(a)prelucrarea se bazează pe consimțământ în temeiul articolului 6 alineatul (1) litera (a) sau al articolului 9 alineatul (2) litera (a) sau pe un contract în temeiul articolului 6 alineatul (1) litera (b); și

(b)prelucrarea este efectuată prin mijloace automate.

(2) În exercitarea dreptului său la portabilitatea datelor în temeiul alineatului (1), persoana vizată are dreptul ca datele cu caracter personal să fie transmise direct de la un operator la altul acolo unde acest lucru este fezabil din punct de vedere tehnic.

(3) Exercitarea dreptului menționat la alineatul (1) din prezentul articol nu aduce atingere articolului 17. Respectivul drept nu se aplică prelucrării necesare pentru îndeplinirea unei sarcini executate în interes public sau în cadrul exercitării unei autorități oficiale cu care este învestit operatorul.

(4) Dreptul menționat la alineatul (1) nu aduce atingere drepturilor și libertăților altora.

Secțiunea 4

Dreptul la opoziție și procesul decizional individual automatizat

Articolul 21

Dreptul la opoziție

(1) În orice moment, persoana vizată are dreptul să se opună, din motive legate de situația particulară în care se află, prelucrării în temeiul articolului 6 alineatul (1) litera (e) sau (f), a datelor cu caracter personal care o privesc, inclusiv creării de profiluri pe baza respectivelor dispoziții. Operatorul nu mai prelucrează datele cu caracter personal, cu excepția cazului în care operatorul demonstrează că are motive legitime și imperioase care justifică prelucrarea și care prevalează asupra intereselor, drepturilor și libertăților persoanei vizate sau că scopul este constatarea, exercitarea sau apărarea unui drept în instanță.

(2) Atunci când prelucrarea datelor cu caracter personal are drept scop marketingul direct, persoana vizată are dreptul de a se opune în orice moment prelucrării în acest scop a datelor cu caracter personal care o privesc, inclusiv creării de profiluri, în măsura în care este legată de marketingul direct respectiv.

(3) În cazul în care persoana vizată se opune prelucrării în scopul marketingului direct, datele cu caracter personal nu mai sunt prelucrate în acest scop.

(4) Cel târziu în momentul primei comunicări cu persoana vizată, dreptul menționat la alineatele (1) și (2) este adus în mod explicit în atenția persoanei vizate și este prezentat în mod clar și separat de orice alte informații.

(5) În contextual utilizării serviciilor societății informaționale și în pofida Directivei 2002/58/CE, persoana vizată își poate exercita dreptul de a se opune prin mijloace automate care utilizează specificații tehnice.

(6) În cazul în care datele cu caracter personal sunt prelucrate în scopuri de cercetare științifică sau istorică sau în scopuri statistice în conformitate cu articolul 89 alineatul (1), persoana vizată, din motive legate de situația sa particulară, are dreptul de a se opune prelucrării datelor cu caracter personal care o privesc, cu excepția cazului în care prelucrarea este necesară pentru îndeplinirea unei sarcini din motive de interes public.

Articolul 22

Procesul decizional individual automatizat, inclusiv crearea de profiluri

(1) Persoana vizată are dreptul de a nu face obiectul unei decizii bazate exclusiv pe prelucrarea automată, inclusiv crearea de profiluri, care produce efecte juridice care privesc persoana vizată sau o afectează în mod similar într-o măsură semnificativă.

(2) Alineatul (1) nu se aplică în cazul în care decizia:

(a)este necesară pentru încheierea sau executarea unui contract între persoana vizată și un operator de date;

(b)este autorizată prin dreptul Uniunii sau dreptul intern care se aplică operatorului și care prevede, de asemenea, măsuri corespunzătoare pentru protejarea drepturilor, libertăților și intereselor legitime ale persoanei vizate; sau

(c)are la bază consimțământul explicit al persoanei vizate.

(3) În cazurile menționate la alineatul (2) literele (a) și (c), operatorul de date pune în aplicare măsuri corespunzătoare pentru protejarea drepturilor, libertăților și intereselor legitime ale persoanei vizate, cel puțin dreptul acesteia de a obține intervenție umană din partea operatorului, de a-și exprima punctul de vedere și de a contesta decizia.

(4) Deciziile menționate la alineatul (2) nu au la bază categoriile speciale de date cu caracter personal menționate la articolul 9 alineatul (1), cu excepția cazului în care se aplică articolul 9 alineatul (2) litera (a) sau (g) și în care au fost instituite măsuri corespunzătoare pentru protejarea drepturilor, libertăților și intereselor legitime ale persoanei vizate.

Secțiunea 5

Articolul 23

Restricții

(1) Dreptul Uniunii sau dreptul intern care se aplică operatorului de date sau persoanei împuternicite de operator poate restricționa printr-o măsură legislativă domeniul de aplicare al obligațiilor și al drepturilor prevăzute la articolele 12-22 și 34, precum și la articolul 5 în măsura în care dispozițiile acestuia corespund drepturilor și obligațiilor prevăzute la articolele 12-22, atunci când o astfel de restricție respectă esența drepturilor și libertăților fundamentale și constituie o măsură necesară și proporțională într-o societate democratică, pentru a asigura:

(a)securitatea națională;

(d)prevenirea, investigarea, depistarea sau urmărirea penală a infracțiunilor sau executarea sancțiunilor penale, inclusiv protejarea împotriva amenințărilor la adresa securității publice și prevenirea acestora;

(e)alte obiective importante de interes public general ale Uniunii sau ale unui stat membru, în special un interes economic sau financiar important al Uniunii sau al unui stat membru, inclusiv în domeniile monetar, bugetar și fiscal și în domeniul sănătății publice și al securității sociale;

(f)protejarea independenței judiciare și a procedurilor judiciare;

(g)prevenirea, investigarea, depistarea și urmărirea penală a încălcării eticii în cazul profesiilor reglementate;

(h)funcția de monitorizare, inspectare sau reglementare legată, chiar și ocazional, de exercitarea autorității oficiale în cazurile menționate la literele (a)-(e) și (g);

(i)protecția persoanei vizate sau a drepturilor și libertăților altora;

(j)punerea în aplicare a pretențiilor de drept civil.

(2) În special, orice măsură legislativă menționată la alineatul (1) conține dispoziții specifice cel puțin, dacă este cazul, în ceea ce privește:

(a)scopurile prelucrării sau ale categoriilor de prelucrare;

(b)categoriile de date cu caracter personal;

(c)domeniul de aplicare al restricțiilor introduse;

(d)garanțiile pentru a preveni abuzurile sau accesul sau transferul ilegal;

(e)menționarea operatorului sau a categoriilor de operatori;

(f)perioadele de stocare și garanțiile aplicabile având în vedere natura, domeniul de aplicare și scopurile prelucrării sau ale categoriilor de prelucrare;

(g)riscurile pentru drepturile și libertăților persoanelor vizate; și

(h)dreptul persoanelor vizate de a fi informate cu privire la restricție, cu excepția cazului în care acest lucru poate aduce atingere scopului restricției.

CAPITOLUL IV

Operatorul și persoana împuternicită de operator

Secțiunea 1

Articolul 24

Responsabilitatea operatorului

(1) Ținând seama de natura, domeniul de aplicare, contextul și scopurile prelucrării, precum și de riscurile cu grade diferite de probabilitate și gravitate pentru drepturile și libertățile persoanelor fizice, operatorul pune în aplicare măsuri tehnice și organizatorice adecvate pentru a garanta și a fi în măsură să demonstreze că prelucrarea se efectuează în conformitate cu prezentul regulament. Respectivele măsuri se revizuiesc și se actualizează dacă este necesar.

(2) Atunci când sunt proporționale în raport cu operațiunile de prelucrare, măsurile menționate la alineatul (1) includ punerea în aplicare de către operator a unor politici adecvate de protecție a datelor.

(3) Aderarea la coduri de conduită aprobate, menționate la articolul 40, sau la un mecanism de certificare aprobat, menționat la articolul 42, poate fi utilizată ca element care să demonstreze respectarea obligațiilor de către operator.

Articolul 25

Asigurarea protecției datelor începând cu momentul conceperii și în mod implicit

(1) Având în vedere stadiul actual al tehnologiei, costurile implementării, și natura, domeniul de aplicare, contextul și scopurile prelucrării, precum și riscurile cu grade diferite de probabilitate și gravitate pentru drepturile și libertățile persoanelor fizice pe care le prezintă prelucrarea, operatorul, atât în momentul stabilirii mijloacelor de prelucrare, cât și în cel al prelucrării în sine, pune în aplicare măsuri tehnice și organizatorice adecvate, cum ar fi pseudonimizarea, care sunt destinate să pună în aplicare în mod eficient principiile de protecție a datelor, precum reducerea la minimum a datelor, și să integreze garanțiile necesare în cadrul prelucrării, pentru a îndeplini cerințele prezentului regulament și a proteja drepturile persoanelor vizate.

(2) Operatorul pune în aplicare măsuri tehnice și organizatorice adecvate pentru a asigura că, în mod implicit, sunt prelucrate numai date cu caracter personal care sunt necesare pentru fiecare scop specific al prelucrării. Respectiva obligație se aplică volumului de date colectate, gradului de prelucrare a acestora, perioadei lor de stocare și accesibilității lor. În special, astfel de măsuri asigură că, în mod implicit, datele cu caracter personal nu pot fi accesate, fără intervenția persoanei, de un număr nelimitat de persoane.

(3) Un mecanism de certificare aprobat în conformitate cu articolul 42 poate fi utilizat drept element care să demonstreze îndeplinirea cerințelor prevăzute la alineatele (1) și (2) ale prezentului articol.

Articolul 26

Operatori asociați

(1) În cazul în care doi sau mai mulți operatori stabilesc în comun scopurile și mijloacele de prelucrare, aceștia sunt operatori asociați. Ei stabilesc într-un mod transparent responsabilitățile fiecăruia în ceea ce privește îndeplinirea obligațiilor care le revin în temeiul prezentului regulament, în special în ceea ce privește exercitarea drepturilor persoanelor vizate și îndatoririle fiecăruia de furnizare a informațiilor prevăzute la articolele 13 și 14, prin intermediul unui acord între ei, cu excepția cazului și în măsura în care responsabilitățile operatorilor sunt stabilite în dreptul Uniunii sau în dreptul intern care se aplică acestora. Acordul poate să desemneze un punct de contact pentru persoanele vizate.

(2) Acordul menționat la alineatul (1) reflectă în mod adecvat rolurile și raporturile respective ale operatorilor asociați față de persoanele vizate. Esența acestui acord este făcută cunoscută persoanei vizate.

(3) Indiferent de clauzele acordului menționat la alineatul (1), persoana vizată își poate exercita drepturile în temeiul prezentului regulament cu privire la și în raport cu fiecare dintre operatori.

Articolul 27

Reprezentanții operatorilor sau ai persoanelor împuternicite de operatori care nu își au sediul în Uniune

(1) În cazul în care se aplică articolul 3 alineatul (2), operatorul sau persoana împuternicită de operator desemnează în scris un reprezentant în Uniune.

(2) Obligația prevăzută la alineatul (1) din prezentul articol nu se aplică:

(a)prelucrării care are un caracter ocazional, care nu include, pe scară largă, prelucrarea unor categorii speciale de date, astfel cum se prevede la articolul 9 alineatul (1), sau prelucrarea unor date cu caracter personal referitoare la condamnări penale și infracțiuni menționată la articolul 10, și care este puțin susceptibilă de a genera un risc pentru drepturile și libertățile persoanelor, ținând cont de natura, contextul, domeniul de aplicare și scopurile prelucrării; sau

(b)unei autorități sau unui organism public.

(3) Reprezentantul își are sediul în unul dintre statele membre în care se află persoanele vizate ale căror date cu caracter personal sunt prelucrate în legătură cu furnizarea de bunuri și servicii sau al căror comportament este monitorizat.

(4) Reprezentantul primește din partea operatorului sau a persoanei împuternicite de operator un mandat prin care autoritățile de supraveghere și persoanele vizate, în special, se pot adresa reprezentantului, în plus față de operator sau persoana împuternicită de operator sau în locul acestora, cu privire la toate chestiunile legate de prelucrarea, în scopul asigurării respectării prezentului regulament.

(5) Desemnarea unui reprezentant de către operator sau persoana împuternicită de operator nu aduce atingere acțiunilor în justiție care ar putea fi introduse împotriva operatorului sau persoanei împuternicite de operator înseși.

Articolul 28

Persoana împuternicită de operator

(1) În cazul în care prelucrarea urmează să fie realizată în numele unui operator, operatorul recurge doar la persoane împuternicite care oferă garanții suficiente pentru punerea în aplicare a unor măsuri tehnice și organizatorice adecvate, astfel încât prelucrarea să respecte cerințele prevăzute în prezentul regulament și să asigure protecția drepturilor persoanei vizate.

(2) Persoana împuternicită de operator nu recrutează o altă persoană împuternicită de operator fără a primi în prealabil o autorizație scrisă, specifică sau generală, din partea operatorului. În cazul unei autorizații generale scrise, persoana împuternicită de operator informează operatorul cu privire la orice modificări preconizate privind adăugarea sau înlocuirea altor persoane împuternicite de operator, oferind astfel posibilitatea operatorului de a formula obiecții față de aceste modificări.

(3) Prelucrarea de către o persoană împuternicită de un operator este reglementată printr-un contract sau alt act juridic în temeiul dreptului Uniunii sau al dreptului intern care are caracter obligatoriu pentru persoana împuternicită de operator în raport cu operatorul și care stabilește obiectul și durata prelucrării, natura și scopul prelucrării, tipul de date cu caracter personal și categoriile de persoane vizate și obligațiile și drepturile operatorului. Respectivul contract sau act juridic prevede în special că persoană împuternicită de operator:

(a)prelucrează datele cu caracter personal numai pe baza unor instrucțiuni documentate din partea operatorului, inclusiv în ceea ce privește transferurile de date cu caracter personal către o țară terță sau o organizație internațională, cu excepția cazului în care această obligație îi revine persoanei împuternicite în temeiul dreptului Uniunii sau al dreptului intern care i se aplică; în acest caz, notifică această obligație juridică operatorului înainte de prelucrare, cu excepția cazului în care dreptul respectiv interzice o astfel de notificare din motive importante legate de interesul public;

(b)se asigură că persoanele autorizate să prelucreze datele cu caracter personal s-au angajat să respecte confidențialitatea sau au o obligație statutară adecvată de confidențialitate;

(c)adoptă toate măsurile necesare în conformitate cu articolul 32;

(d)respectă condițiile menționate la alineatele (2) și (4) privind recrutarea unei alte persoane împuternicite de operator;

(e)ținând seama de natura prelucrării, oferă asistență operatorului prin măsuri tehnice și organizatorice adecvate, în măsura în care acest lucru este posibil, pentru îndeplinirea obligației operatorului de a răspunde cererilor privind exercitarea de către persoana vizată a drepturilor prevăzute în capitolul III;

(f)ajută operatorul să asigure respectarea obligațiilor prevăzute la articolele 32-36, ținând seama de caracterul prelucrării și informațiile aflate la dispoziția persoanei împuternicite de operator;

(g)la alegerea operatorului, șterge sau returnează operatorului toate datele cu caracter personal după încetarea furnizării serviciilor legate de prelucrare și elimină copiile existente, cu excepția cazului în care dreptul Uniunii sau dreptul intern impune stocarea datelor cu caracter personal;

(h)pune la dispoziția operatorului toate informațiile necesare pentru a demonstra respectarea obligațiilor prevăzute la prezentul articol, permite desfășurarea auditurilor, inclusiv a inspecțiilor, efectuate de operator sau alt auditor mandatat și contribuie la acestea.

În ceea ce privește primul paragraf litera (h), persoana împuternicită de operator informează imediat operatorul în cazul în care, în opinia sa, o instrucțiune încalcă prezentul regulament sau alte dispoziții din dreptul intern sau din dreptul Uniunii referitoare la protecția datelor.

(4) În cazul în care o persoană împuternicită de un operator recrutează o altă persoană împuternicită pentru efectuarea de activități de prelucrare specifice în numele operatorului, aceleași obligații privind protecția datelor prevăzute în contractul sau în alt act juridic încheiat între operator și persoana împuternicită de operator, astfel cum se prevede la alineatul (3), revin celei de a doua persoane împuternicite, prin intermediul unui contract sau al unui alt act juridic, în temeiul dreptului Uniunii sau al dreptului intern, în special furnizarea de garanții suficiente pentru punerea în aplicare a unor măsuri tehnice și organizatorice adecvate, astfel încât prelucrarea să îndeplinească cerințele prezentului regulament. În cazul în care această a doua persoană împuternicită nu își respectă obligațiile privind protecția datelor, persoana împuternicită inițială rămâne pe deplin răspunzătoare față de operator în ceea ce privește îndeplinirea obligațiilor acestei a doua persoane împuternicite.

(5) Aderarea persoanei împuternicite de operator la un cod de conduită aprobat, menționat la articolul 40, sau la un mecanism de certificare aprobat, menționat la articolul 42, poate fi utilizată ca element prin care să se demonstreze existența garanțiilor suficiente menționate la alineatele (1) și (4) din prezentul articol.

(6) Fără a aduce atingere unui contract individual încheiat între operator și persoana împuternicită de operator, contractul sau celălalt act juridic menționat la alineatele (3) și (4) din prezentul articol se poate baza, integral sau parțial, pe clauze contractuale standard menționate la alineatele (7) și (8) din prezentul articol, inclusiv atunci când fac parte dintr-o certificare acordată operatorului sau persoanei împuternicite de operator în temeiul articolelor 42 și 43.

(7) Comisia poate să prevadă clauze contractuale standard pentru aspectele menționate la alineatele (3) și (4) din prezentul articol și în conformitate cu procedura de examinare menționată la articolul 93 alineatul (2).

(8) O autoritate de supraveghere poate să adopte clauze contractuale standard pentru aspectele menționate la alineatele (3) și (4) din prezentul articol și în conformitate cu mecanismul pentru asigurarea coerenței menționat la articolul 63.

(9) Contractul sau celălalt act juridic menționat la alineatele (3) și (4) se formulează în scris, inclusiv în format electronic.

(10) Fără a aduce atingere articolelor 82, 83 și 84, în cazul în care o persoană împuternicită de operator încălcă prezentul regulament, prin stabilirea scopurilor și mijloacelor de prelucrare a datelor cu caracter personal, persoana împuternicită de operator este considerată a fi un operator în ceea ce privește prelucrarea respectivă.

Articolul 29

Desfășurarea activității de prelucrare sub autoritatea operatorului sau a persoanei împuternicite de operator

Persoana împuternicită de operator și orice persoană care acționează sub autoritatea operatorului sau a persoanei împuternicite de operator care are acces la date cu caracter personal nu le prelucrează decât la cererea operatorului, cu excepția cazului în care dreptul Uniunii sau dreptul intern îl obligă să facă acest lucru.

Articolul 30

Evidențele activităților de prelucrare

(1) Fiecare operator și, după caz, reprezentantul acestuia păstrează o evidență a activităților de prelucrare desfășurate sub responsabilitatea lor. Respectiva evidență cuprinde toate următoarele informații:

(a)numele și datele de contact ale operatorului și, după caz, ale operatorului asociat, ale reprezentantului operatorului și ale responsabilului cu protecția datelor;

(b)scopurile prelucrării;

(c)o descriere a categoriilor de persoane vizate și a categoriilor de date cu caracter personal;

(d)categoriile de destinatari cărora le-au fost sau le vor fi divulgate datele cu caracter personal, inclusiv destinatarii din țări terțe sau organizații internaționale;

(e)dacă este cazul, transferurile de date cu caracter personal către o țară terță sau o organizație internațională, inclusiv identificarea țării terțe sau a organizației internaționale respective și, în cazul transferurilor menționate la articolul 49 alineatul (1) al doilea paragraf, documentația care dovedește existența unor garanții adecvate;

(f)acolo unde este posibil, termenele-limită preconizate pentru ștergerea diferitelor categorii de date;

(g)acolo unde este posibil, o descriere generală a măsurilor tehnice și organizatorice de securitate menționate la articolul 32 alineatul (1).

(2) Fiecare persoană împuternicită de operator și, după caz, reprezentantul persoanei împuternicite de operator păstrează o evidență a tuturor categoriilor de activități de prelucrare desfășurate în numele operatorului, care cuprind:

(a)numele și datele de contact ale persoanei sau persoanelor împuternicite de operator și ale fiecărui operator în numele căruia acționează această persoană (aceste persoane), precum și, după caz, ale reprezentantului operatorului sau ale reprezentantului persoanei împuternicite de operator, și ale responsabilului cu protecția datelor;

(b)categoriile de activități de prelucrare desfășurate în numele fiecărui operator;

(c)dacă este cazul, transferurile de date cu caracter personal către o țară terță sau o organizație internațională, inclusiv identificarea țării terțe sau a organizației internaționale respective și, în cazul transferurilor prevăzute la articolul 49 alineatul (1) al doilea paragraf, documentația care dovedește existența unor garanții adecvate;

(d)acolo unde este posibil, o descriere generală a măsurilor tehnice și organizatorice de securitate menționate la articolul 32 alineatul (1).

(3) Evidențele menționate la alineatele (1) și (2) se formulează în scris, inclusiv în format electronic.

(4) Operatorul sau persoana împuternicită de acesta, precum și, după caz, reprezentantul operatorului sau al persoanei împuternicite de operator pun evidențele la dispoziția autorității de supraveghere, la cererea acesteia.

(5) Obligațiile menționate la alineatele 1 și 2 nu se aplică unei întreprinderi sau organizații cu mai puțin de 250 de angajați, cu excepția cazului în care prelucrarea pe care o efectuează este susceptibilă să genereze un risc pentru drepturile și libertățile persoanelor vizate, prelucrarea nu este ocazională sau prelucrarea include categorii speciale de date, astfel cum se prevede la articolul 9 alineatul (1), sau date cu caracter personal referitoare la condamnări penale și infracțiuni, astfel cum se menționează la articolul 10.

Articolul 31

Cooperarea cu autoritatea de supraveghere

Operatorul și persoana împuternicită de operator și, după caz, reprezentantul acestora cooperează, la cerere, cu autoritatea de supraveghere în îndeplinirea sarcinilor acesteia.

Secțiunea 2

Securitatea datelor cu caracter personal

Articolul 32

Securitatea prelucrării

(1) Având în vedere stadiul actual al dezvoltării, costurile implementării și natura, domeniul de aplicare, contextul și scopurile prelucrării, precum și riscul cu diferite grade de probabilitate și gravitate pentru drepturile și libertățile persoanelor fizice, operatorul și persoana împuternicită de acesta implementează măsuri tehnice și organizatorice adecvate în vederea asigurării unui nivel de securitate corespunzător acestui risc, incluzând printre altele, după caz:

(a)pseudonimizarea și criptarea datelor cu caracter personal;

(b)capacitatea de a asigura confidențialitatea, integritatea, disponibilitatea și rezistența continue ale sistemelor și serviciilor de prelucrare;

(c)capacitatea de a restabili disponibilitatea datelor cu caracter personal și accesul la acestea în timp util în cazul în care are loc un incident de natură fizică sau tehnică;

(d)un proces pentru testarea, evaluarea și aprecierea periodice ale eficacității măsurilor tehnice și organizatorice pentru a garanta securitatea prelucrării.

(2) La evaluarea nivelului adecvat de securitate, se ține seama în special de riscurile prezentate de prelucrare, generate în special, în mod accidental sau ilegal, de distrugerea, pierderea, modificarea, divulgarea neautorizată sau accesul neautorizat la datele cu caracter personal transmise, stocate sau prelucrate într-un alt mod.

(3) Aderarea la un cod de conduită aprobat, menționat la articolul 40, sau la un mecanism de certificare aprobat, menționat la articolul 42, poate fi utilizată ca element prin care să se demonstreze îndeplinirea cerințelor prevăzute la alineatul (1) din prezentul articol.

(4) Operatorul și persoana împuternicită de acesta iau măsuri pentru a asigura faptul că orice persoană fizică care acționează sub autoritatea operatorului sau a persoanei împuternicite de operator și care are acces la date cu caracter personal nu le prelucrează decât la cererea operatorului, cu excepția cazului în care această obligație îi revine în temeiul dreptului Uniunii sau al dreptului intern.

Articolul 33

Notificarea autorității de supraveghere în cazul încălcării securității datelor cu caracter personal

(1) În cazul în care are loc o încălcare a securității datelor cu caracter personal, operatorul notifică acest lucru autorității de supraveghere competente în temeiul articolului 55, fără întârzieri nejustificate și, dacă este posibil, în termen de cel mult 72 de ore de la data la care a luat cunoștință de aceasta, cu excepția cazului în care este puțin probabil să genereze un risc pentru drepturile și libertățile persoanelor fizice. În cazul în care notificarea către autoritatea de supraveghere nu are loc în termen de 72 de ore, aceasta este însoțită de o explicație motivată pentru întârziere.

(2) Persoana împuternicită de operator înștiințează operatorul fără întârzieri nejustificate după ce ia cunoștință de o încălcare a securității datelor cu caracter personal.

(3) Notificarea menționată la alineatul (1) cel puțin:

(a)descrie caracterul încălcării securității datelor cu caracter personal, inclusiv, acolo unde este posibil, categoriile și numărul aproximativ al persoanelor vizate în cauză, precum și categoriile și numărul aproximativ al înregistrărilor de date cu caracter personal în cauză;

(b)comunică numele și datele de contact ale responsabilului cu protecția datelor sau un alt punct de contact de unde se pot obține mai multe informații;

(c)descrie consecințele probabile ale încălcării securității datelor cu caracter personal;

(d)descrie măsurile luate sau propuse spre a fi luate de operator pentru a remedia problema încălcării securității datelor cu caracter personal, inclusiv, după caz, măsurile pentru atenuarea eventualelor sale efecte negative.

(4) Atunci când și în măsura în care nu este posibil să se furnizeze informațiile în același timp, acestea pot fi furnizate în mai multe etape, fără întârzieri nejustificate.

(5) Operatorul păstrează documente referitoare la toate cazurile de încălcare a securității datelor cu caracter personal, care cuprind o descriere a situației de fapt în care a avut loc încălcarea securității datelor cu caracter personal, a efectelor acesteia și a măsurilor de remediere întreprinse. Această documentație permite autorității de supraveghere să verifice conformitatea cu prezentul articol.

Articolul 34

Informarea persoanei vizate cu privire la încălcarea securității datelor cu caracter personal

(1) În cazul în care încălcarea securității datelor cu caracter personal este susceptibilă să genereze un risc ridicat pentru drepturile și libertățile persoanelor fizice, operatorul informează persoana vizată fără întârzieri nejustificate cu privire la această încălcare.

(2) În informarea transmisă persoanei vizate prevăzută la alineatul (1) din prezentul articol se include o descriere într-un limbaj clar și simplu a caracterului încălcării securității datelor cu caracter personal, precum și cel puțin informațiile și măsurile menționate la articolul 33 alineatul (3) literele (b), (c) și (d).

(3) Informarea persoanei vizate menționată la alineatul (1) nu este necesară în cazul în care oricare dintre următoarele condiții este îndeplinită:

(a)operatorul a implementat măsuri de protecție tehnice și organizatorice adecvate, iar aceste măsuri au fost aplicate în cazul datelor cu caracter personal afectate de încălcarea securității datelor cu caracter personal, în special măsuri prin care se asigură că datele cu caracter personal devin neinteligibile oricărei persoane care nu este autorizată să le acceseze, cum ar fi criptarea;

(b)operatorul a luat măsuri ulterioare prin care se asigură că riscul ridicat pentru drepturile și libertățile persoanelor vizate menționat la alineatul (1) nu mai este susceptibil să se materializeze;

(c)ar necesita un efort disproporționat. În această situație, se efectuează în loc o informare publică sau se ia o măsură similară prin care persoanele vizate sunt informate într-un mod la fel de eficace.

(4) În cazul în care operatorul nu a comunicat deja încălcarea securității datelor cu caracter personal către persoana vizată, autoritatea de supraveghere, după ce a luat în considerare probabilitatea ca încălcarea securității datelor cu caracter personal să genereze un risc ridicat, poate să îi solicite acestuia să facă acest lucru sau poate decide că oricare dintre condițiile menționate la alineatul (3) sunt îndeplinite.

Secțiunea 3

Evaluarea impactului asupra protecției datelor și consultarea prealabilă

Articolul 35

Evaluarea impactului asupra protecției datelor

(1) Având în vedere natura, domeniul de aplicare, contextul și scopurile prelucrării, în cazul în care un tip de prelucrare, în special cel bazat pe utilizarea noilor tehnologii, este susceptibil să genereze un risc ridicat pentru drepturile și libertățile persoanelor fizice, operatorul efectuează, înaintea prelucrării, o evaluare a impactului operațiunilor de prelucrare prevăzute asupra protecției datelor cu caracter personal. O evaluare unică poate aborda un set de operațiuni de prelucrare similare care prezintă riscuri ridicate similare.

(2) La realizarea unei evaluări a impactului asupra protecției datelor, operatorul solicită avizul responsabilului cu protecția datelor, dacă acesta a fost desemnat.

(3) Evaluarea impactului asupra protecției datelor menționată la alineatul (1) se impune mai ales în cazul:

(a)unei evaluări sistematice și cuprinzătoare a aspectelor personale referitoare la persoane fizice, care se bazează pe prelucrarea automată, inclusiv crearea de profiluri, și care stă la baza unor decizii care produc efecte juridice privind persoana fizică sau care o afectează în mod similar într-o măsură semnificativă;

(b)prelucrării pe scară largă a unor categorii speciale de date, menționată la articolul 9 alineatul (1), sau a unor date cu caracter personal privind condamnări penale și infracțiuni, menționată la articolul 10; sau

(c)unei monitorizări sistematice pe scară largă a unei zone accesibile publicului.

(4) Autoritatea de supraveghere întocmește și publică o listă a tipurilor de operațiuni de prelucrare care fac obiectul cerinței de efectuare a unei evaluări a impactului asupra protecției datelor, în conformitate cu alineatul (1). Autoritatea de supraveghere comunică aceste liste comitetului menționat la articolul 68.

(5) Autoritatea de supraveghere poate, de asemenea, să stabilească și să pună la dispoziția publicului o listă a tipurilor de operațiuni de prelucrare pentru care nu este necesară o evaluare a impactului asupra protecției datelor. Autoritatea de supraveghere comunică aceste liste comitetului.

(6) Înainte de adoptarea listelor menționate la alineatele (4) și (5), autoritatea de supraveghere competentă aplică mecanismul pentru asigurarea coerenței menționat la articolul 63 în cazul în care aceste liste implică activități de prelucrare care presupun furnizarea de bunuri sau prestarea de servicii către persoane vizate sau monitorizarea comportamentului acestora în mai multe state membre ori care pot afecta în mod substanțial libera circulație a datelor cu caracter personal în cadrul Uniunii.

(7) Evaluarea conține cel puțin:

(a)o descriere sistematică a operațiunilor de prelucrare preconizate și a scopurilor prelucrării, inclusiv, după caz, interesul legitim urmărit de operator;

(b)o evaluare a necesității și proporționalității operațiunilor de prelucrare în legătură cu aceste scopuri;

(c)o evaluare a riscurilor pentru drepturile și libertățile persoanelor vizate menționate la alineatul (1); și

(d)măsurile preconizate în vederea abordării riscurilor, inclusiv garanțiile, măsurile de securitate și mecanismele menite să asigure protecția datelor cu caracter personal și să demonstreze conformitatea cu dispozițiile prezentului regulament, luând în considerare drepturile și interesele legitime ale persoanelor vizate și ale altor persoane interesate.

(8) La evaluarea impactului operațiunilor de prelucrare efectuate de operatorii sau de persoanele împuternicite de operatori relevante, se are în vedere în mod corespunzător respectarea de către operatorii sau persoanele împuternicite respective a codurilor de conduită aprobate menționate la articolul 40, în special în vederea unei evaluări a impactului asupra protecției datelor.

(9) Operatorul solicită, acolo unde este cazul, avizul persoanelor vizate sau al reprezentanților acestora privind prelucrarea prevăzută, fără a aduce atingere protecției intereselor comerciale sau publice ori securității operațiunilor de prelucrare.

(10) Atunci când prelucrarea în temeiul articolului 6 alineatul (1) litera (c) sau (e) are un temei juridic în dreptul Uniunii sau al unui stat membru sub incidența căruia intră operatorul, iar dreptul respectiv reglementează operațiunea de prelucrare specifică sau setul de operațiuni specifice în cauză și deja s-a efectuat o evaluare a impactului asupra protecției datelor ca parte a unei evaluări a impactului generale în contextul adoptării respectivului temei juridic, alineatele (1)-(7) nu se aplică, cu excepția cazului în care statele membre consideră că este necesară efectuarea unei astfel de evaluări înaintea desfășurării activităților de prelucrare.

(11) Acolo unde este necesar, operatorul efectuează o analiză pentru a evalua dacă prelucrarea are loc în conformitate cu evaluarea impactului asupra protecției datelor, cel puțin atunci când are loc o modificare a riscului reprezentat de operațiunile de prelucrare.

Articolul 36

Consultarea prealabilă

(1) Operatorul consultă autoritatea de supraveghere înainte de prelucrarea atunci când evaluarea impactului asupra protecției datelor prevăzută la articolul 35 indică faptul că prelucrarea ar genera un risc ridicat în absența unor măsuri luate de operator pentru atenuarea riscului.

(2) Atunci când consideră că prelucrarea prevăzută menționată la alineatul (1) ar încălca prezentul regulament, în special atunci când riscul nu a fost identificat sau atenuat într-o măsură suficientă de către operator, autoritatea de supraveghere oferă consiliere în scris operatorului și, după caz, persoanei împuternicite de operator, în cel mult opt săptămâni de la primirea cererii de consultare, și își poate utiliza oricare dintre competențele menționate la articolul 58. Această perioadă poate fi prelungită cu șase săptămâni, ținându-se seama de complexitatea prelucrării prevăzute. Autoritatea de supraveghere informează operatorul și, după caz, persoana împuternicită de operator, în termen de o lună de la primirea cererii, cu privire la orice astfel de prelungire, prezentând motivele întârzierii. Aceste perioade pot fi suspendate până când autoritatea de supraveghere a obținut informațiile pe care le-a solicitat în scopul consultării.

(3) Atunci când consultă autoritatea de supraveghere în conformitate cu alineatul (1), operatorul îi furnizează acesteia:

(a)dacă este cazul, responsabilitățile respective ale operatorului, ale operatorilor asociați și ale persoanelor împuternicite de operator implicate în activitățile de prelucrare, în special pentru prelucrarea în cadrul unui grup de întreprinderi;

(b)scopurile și mijloacele prelucrării preconizate;

(c)măsurile și garanțiile prevăzute pentru protecția drepturilor și libertăților persoanelor vizate, în conformitate cu prezentul regulament;

(d)dacă este cazul, datele de contact ale responsabilului cu protecția datelor;

(e)evaluarea impactului asupra protecției datelor prevăzută la articolul 35; și

(f)orice alte informații solicitate de autoritatea de supraveghere.

(4) Statele membre consultă autoritatea de supraveghere în cadrul procesului de pregătire a unei propuneri de măsură legislativă care urmează să fie adoptată de un parlament național sau a unei măsuri de reglementare întemeiate pe o astfel de măsură legislativă, care se referă la prelucrarea.

(5) În pofida alineatului (1), dreptul intern poate impune operatorilor să se consulte cu autoritatea de supraveghere și să obțină în prealabil autorizarea din partea acesteia în legătură cu prelucrarea de către un operator în vederea îndeplinirii unei sarcini exercitate de acesta în interes public, inclusiv prelucrarea în legătură cu protecția socială și sănătatea publică.

Secțiunea 4

Responsabilul cu protecția datelor

Articolul 37

Desemnarea responsabilului cu protecția datelor

(1) Operatorul și persoana împuternicită de operator desemnează un responsabil cu protecția datelor ori de câte ori:

(a)prelucrarea este efectuată de o autoritate sau un organism public, cu excepția instanțelor care acționează în exercițiul funcției lor jurisdicționale;

(b)activitățile principale ale operatorului sau ale persoanei împuternicite de operator constau în operațiuni de prelucrare care, prin natura, domeniul de aplicare și/sau scopurile lor, necesită o monitorizare periodică și sistematică a persoanelor vizate pe scară largă; sau

(c)activitățile principale ale operatorului sau ale persoanei împuternicite de operator constau în prelucrarea pe scară largă a unor categorii speciale de date în temeiul articolului 9 sau a unor date cu caracter personal referitoare la condamnări penale și infracțiuni, menționată la articolul 10.

(2) Un grup de întreprinderi poate numi un responsabil cu protecția datelor unic, cu condiția ca responsabilul cu protecția datelor să fie ușor accesibil din fiecare întreprindere.

(3) În cazul în care operatorul sau persoana împuternicită de operator este o autoritate publică sau un organism public, poate fi desemnat un responsabil cu protecția datelor unic pentru mai multe dintre aceste autorități sau organisme, luând în considerare structura organizatorică și dimensiunea acestora.

(4) În alte cazuri decât cele menționate la alineatul (1), operatorul sau persoana împuternicită de operator ori asociațiile și alte organisme care reprezintă categorii de operatori sau de persoane împuternicite de operatori pot desemna sau, acolo unde dreptul Uniunii sau dreptul intern solicită acest lucru, desemnează un responsabil cu protecția datelor. Responsabilul cu protecția datelor poate să acționeze în favoarea unor astfel de asociații și alte organisme care reprezintă operatori sau persoane împuternicite de operatori.

(5) Responsabilul cu protecția datelor este desemnat pe baza calităților profesionale și, în special, a cunoștințelor de specialitate în dreptul și practicile din domeniul protecției datelor, precum și pe baza capacității de a îndeplini sarcinile prevăzute la articolul 39.

(6) Responsabilul cu protecția datelor poate fi un membru al personalului operatorului sau persoanei împuternicite de operator sau poate să își îndeplinească sarcinile în baza unui contract de servicii.

(7) Operatorul sau persoana împuternicită de operator publică datele de contact ale responsabilului cu protecția datelor și le comunică autorității de supraveghere.

Articolul 38

Funcția responsabilului cu protecția datelor

(1) Operatorul și persoana împuternicită de operator se asigură că responsabilul cu protecția datelor este implicat în mod corespunzător și în timp util în toate aspectele legate de protecția datelor cu caracter personal.

(2) Operatorul și persoana împuternicită de operator sprijină responsabilul cu protecția datelor în îndeplinirea sarcinilor menționate la articolul 39, asigurându-i resursele necesare pentru executarea acestor sarcini, precum și accesarea datelor cu caracter personal și a operațiunilor de prelucrare, și pentru menținerea cunoștințelor sale de specialitate.

(3) Operatorul și persoana împuternicită de operator se asigură că responsabilul cu protecția datelor nu primește niciun fel de instrucțiuni în ceea ce privește îndeplinirea acestor sarcini. Acesta nu este demis sau sancționat de către operator sau de persoana împuternicită de operator pentru îndeplinirea sarcinilor sale. Responsabilul cu protecția datelor răspunde direct în fața celui mai înalt nivel al conducerii operatorului sau persoanei împuternicite de operator.

(4) Persoanele vizate pot contacta responsabilul cu protecția datelor cu privire la toate chestiunile legate de prelucrarea datelor lor și la exercitarea drepturilor lor în temeiul prezentului regulament.

(5) Responsabilul cu protecția datelor are obligația de a respecta secretul sau confidențialitatea în ceea ce privește îndeplinirea sarcinilor sale, în conformitate cu dreptul Uniunii sau cu dreptul intern.

(6) Responsabilul cu protecția datelor poate îndeplini și alte sarcini și atribuții. Operatorul sau persoana împuternicită de operator se asigură că niciuna dintre aceste sarcini și atribuții nu generează un conflict de interese.

Articolul 39

Sarcinile responsabilului cu protecția datelor

(1) Responsabilul cu protecția datelor are cel puțin următoarele sarcini:

(a)informarea și consilierea operatorului, sau a persoanei împuternicite de operator, precum și a angajaților care se ocupă de prelucrare cu privire la obligațiile care le revin în temeiul prezentului regulament și al altor dispoziții de drept al Uniunii sau drept intern referitoare la protecția datelor;

(b)monitorizarea respectării prezentului regulament, a altor dispoziții de drept al Uniunii sau de drept intern referitoare la protecția datelor și a politicilor operatorului sau ale persoanei împuternicite de operator în ceea ce privește protecția datelor cu caracter personal, inclusiv alocarea responsabilităților și acțiunile de sensibilizare și de formare a personalului implicat în operațiunile de prelucrare, precum și auditurile aferente;

(c)furnizarea de consiliere la cerere în ceea ce privește evaluarea impactului asupra protecției datelor și monitorizarea funcționării acesteia, în conformitate cu articolul 35;

(d)cooperarea cu autoritatea de supraveghere;

(e)asumarea rolului de punct de contact pentru autoritatea de supraveghere privind aspectele legate de prelucrare, inclusiv consultarea prealabilă menționată la articolul 36, precum și, dacă este cazul, consultarea cu privire la orice altă chestiune.

(2) În îndeplinirea sarcinilor sale, responsabilul cu protecția datelor ține seama în mod corespunzător de riscul asociat operațiunilor de prelucrare, luând în considerare natura, domeniul de aplicare, contextul și scopurile prelucrării.

Secțiunea 5

Coduri de conduită și certificare

Articolul 40

Coduri de conduită

(1) Statele membre, autoritățile de supraveghere, comitetul și Comisia încurajează elaborarea de coduri de conduită menite să contribuie la buna aplicare a prezentului regulament, ținând seama de caracteristicile specifice ale diverselor sectoare de prelucrare și de nevoile specifice ale microîntreprinderilor și ale întreprinderilor mici și mijlocii.

(2) Asociațiile și alte organisme care reprezintă categorii de operatori sau de persoane împuternicite de operatori pot pregăti coduri de conduită sau le pot modifica sau extinde pe cele existente, în scopul de a specifica modul de aplicare a prezentului regulament, cum ar fi în ceea ce privește:

(a)prelucrarea în mod echitabil și transparent;

(b)interesele legitime urmărite de operatori în contexte specifice;

(c)colectarea datelor cu caracter personal;

(d)pseudonimizarea datelor cu caracter personal;

(e)informarea publicului și a persoanelor vizate;

(f)exercitarea drepturilor persoanelor vizate;

(g)informarea și protejarea copiilor și modalitatea în care trebuie obținut consimțământul titularilor răspunderii părintești asupra copiilor;

(h)măsurile și procedurile menționate la articolele 24 și 25 și măsurile de asigurare a securității prelucrării, menționate la articolul 32;

(i)notificarea autorităților de supraveghere cu privire la încălcările securității datelor cu caracter personal și informarea persoanelor vizate cu privire la aceste încălcări;

(j)transferul de date cu caracter personal către țări terțe sau organizații internaționale; sau

(k)proceduri extrajudiciare și alte proceduri de soluționare a litigiilor pentru soluționarea litigiilor între operatori și persoanele vizate în ceea ce privește prelucrarea, fără a aduce atingere drepturilor persoanelor vizate, în temeiul articolelor 77 și 79.

(3) La codurile de conduită aprobate în temeiul alineatului (5) din prezentul articol și care au o valabilitate generală în temeiul alineatului (9) din prezentul articol pot adera nu numai operatorii sau persoanele împuternicite de operatori care fac obiectul prezentului regulament, ci și operatorii sau persoanele împuternicite de operatori care nu fac obiectul prezentului regulament în temeiul articolului 3, în scopul de a oferi garanții adecvate în cadrul transferurilor de date cu caracter personal către țări terțe sau organizații internaționale în condițiile menționate la articolul 46 alineatul (2) litera (e). Acești operatori sau persoane împuternicite de operatori își asumă angajamente cu caracter obligatoriu și executoriu, prin intermediul unor instrumente contractuale sau al altor instrumente obligatorii din punct de vedere juridic, în scopul aplicării garanțiilor adecvate respective, inclusiv cu privire la drepturile persoanelor vizate.

(4) Codul de conduită prevăzut la alineatul (2) din prezentul articol cuprinde mecanisme care permit organismului menționat la articolul 41 alineatul (1) să efectueze monitorizarea obligatorie a respectării dispozițiilor acestuia de către operatorii sau persoanele împuternicite de operatori care se angajează să îl aplice, fără a aduce atingere sarcinilor și competențelor autorităților de supraveghere care sunt competente în temeiul articolului 55 sau 56.

(5) Asociațiile și alte organisme menționate la alineatul (2) din prezentul articol care intenționează să pregătească un cod de conduită sau să modifice sau să extindă un cod existent transmit proiectul de cod, de modificare sau de extindere autorității de supraveghere care este competentă în temeiul articolului 55. Autoritatea de supraveghere emite un aviz cu privire la conformitatea cu prezentul regulament a proiectului de cod, de modificare sau de extindere și îl aprobă în cazul în care se constată că acesta oferă garanții adecvate suficiente.

(6) În cazul în care proiectul de cod, de modificare sau de extindere este aprobat în conformitate cu alineatul (5), iar codul de conduită în cauză nu are legătură cu activitățile de prelucrare din mai multe state membre, autoritatea de supraveghere înregistrează și publică codul.

(7) În cazul în care un proiect de cod de conduită, de modificare sau de extindere are legătură cu activitățile de prelucrare din mai multe state membre, înainte de aprobare, autoritatea de supraveghere competentă în temeiul articolului 55 îl transmite, prin procedura menționată la articolul 63, comitetului, care emite un aviz cu privire la conformitatea cu prezentul regulament a proiectului respectiv, sau, în situația menționată la alineatul (3) din prezentul articol, oferă garanții adecvate.

(8) În cazul în care avizul menționat la alineatul (7) confirmă conformitatea cu prezentul regulament a proiectului de cod, de modificare sau de extindere sau în cazul în care, în situația menționată la alineatul (3), oferă garanții adecvate, comitetul transmite avizul său Comisiei.

(9) Comisia poate adopta acte de punere în aplicare pentru a decide că codul de conduită, modificarea sau extinderea aprobate care i-au fost prezentate în temeiul alineatului (8) din prezentul articol au valabilitate generală în Uniune. Actele de punere în aplicare respective se adoptă în conformitate cu procedura de examinare prevăzută la articolul 93 alineatul (2).

(10) Comisia asigură publicitatea adecvată pentru codurile aprobate asupra cărora s-a decis că au valabilitate generală în conformitate cu alineatul (9).

(11) Comitetul regrupează toate codurile de conduită, modificările și extinderile aprobate într-un registru și le pune la dispoziția publicului prin mijloace corespunzătoare.

Articolul 41

Monitorizarea codurilor de conduită aprobate

(1) Fără a aduce atingere sarcinilor și competențelor autorității de supraveghere competente în temeiul articolelor 57 și 58, monitorizarea respectării unui cod de conduită în temeiul articolului 40 poate fi realizată de un organism care dispune de un nivel adecvat de expertiză în legătură cu obiectul codului și care este acreditat în acest scop de autoritatea de supraveghere competentă.

(2) Un organism menționat la alineatul (1) poate fi acreditat pentru monitorizarea respectării unui cod de conduită dacă:

(a)a demonstrat autorității de supraveghere competente, într-un mod satisfăcător, independența și expertiza sa în legătură cu obiectul codului;

(b)a instituit proceduri care îi permit să evalueze eligibilitatea operatorilor și a persoanelor împuternicite de operatori în vederea aplicării codului, să monitorizeze respectarea de către aceștia a dispozițiilor codului și să revizuiască periodic funcționarea acestuia;

(c)a instituit proceduri și structuri pentru tratarea plângerilor privind încălcări ale codului sau privind modul în care codul a fost sau este pus în aplicare de un operator sau o persoană împuternicită de operator, precum și pentru asigurarea transparenței acestor proceduri și structuri pentru persoanele vizate și pentru public; și

(d)a demonstrat autorității de supraveghere competente, într-un mod satisfăcător, că sarcinile și atribuțiile sale nu creează conflicte de interese.

(3) Autoritatea de supraveghere competentă transmite proiectul de cerințe pentru acreditarea unui organism menționat la alineatul (1) din prezentul articol comitetului, în conformitate cu mecanismul pentru asigurarea coerenței menționat la articolul 63.

(4) Fără a aduce atingere sarcinilor și competențelor autorității de supraveghere competente și dispozițiilor capitolului VIII, un organism menționat la alineatul (1) din prezentul articol ia măsuri corespunzătoare, sub rezerva unor garanții adecvate, în cazul încălcării codului de către un operator sau o persoană împuternicită de operator, inclusiv prin suspendarea sau excluderea respectivului operator sau a respectivei persoane din cadrul codului. Organismul în cauză informează autoritatea de supraveghere competentă cu privire la aceste măsuri și la motivele care le-au determinat.

(5) Autoritatea de supraveghere competentă revocă acreditarea unui organism menționat la alineatul (1) în cazul în care nu mai sunt îndeplinite cerințele pentru acreditare sau măsurile luate de organismul în cauză încalcă prezentul regulament.

(6) Prezentul articol nu se aplică prelucrării efectuate de autorități și organisme publice.

Articolul 42

Certificare

(1) Statele membre, autoritățile de supraveghere, comitetul și Comisia încurajează, în special la nivelul Uniunii, instituirea de mecanisme de certificare în domeniul protecției datelor, precum și de sigilii și mărci în acest domeniu, care să permită demonstrarea faptului că operațiunile de prelucrare efectuate de operatori și de persoanele împuternicite de operatori respectă prezentul regulament. Sunt luate în considerare necesitățile specifice ale microîntreprinderilor și ale întreprinderilor mici și mijlocii.

(2) Mecanismele de certificare din domeniul protecției datelor, sigiliile sau mărcile aprobate în temeiul alineatului (5) din prezentul articol sunt instituite nu numai pentru a fi respectate de operatorii sau de persoanele împuternicite de operatori care fac obiectul prezentului regulament, ci și pentru a demonstra existența unor garanții adecvate oferite de operatorii sau de persoanele împuternicite de operatori care nu fac obiectul prezentului regulament, în temeiul articolului 3, în cadrul transferurilor de date cu caracter personal către țări terțe sau organizații internaționale în condițiile menționate la articolul 46 alineatul (2) litera (f). Acești operatori sau persoane împuternicite de operatori își asumă angajamente cu caracter obligatoriu și executoriu, prin intermediul unor instrumente contractuale sau al altor instrumente obligatorii din punct de vedere juridic, în scopul aplicării garanțiilor adecvate respective, inclusiv cu privire la drepturile persoanelor vizate.

(3) Certificarea este voluntară și disponibilă prin intermediul unui proces transparent.

(4) Certificarea în conformitate cu prezentul articol nu reduce responsabilitatea operatorului sau a persoanei împuternicite de operator de a respecta prezentul regulament și nu aduce atingere sarcinilor și competențelor autorităților de supraveghere care sunt competente în temeiul articolului 55 sau 56.

(5) Organismele de certificare menționate la articolul 43 sau autoritatea de supraveghere competentă emit o certificare în temeiul prezentului articol, pe baza criteriilor aprobate de către autoritatea de supraveghere competentă respectivă în temeiul articolului 58 alineatul (3), sau de către comitet în temeiul articolului 63. În cazul în care criteriile sunt aprobate de comitet, aceasta poate duce la o certificare comună, și anume sigiliul european privind protecția datelor.

(6) Operatorul sau persoana împuternicită de operator care supune activitățile sale de prelucrare mecanismului de certificare oferă organismului de certificare menționat la articolul 43 sau, după caz, autorității de supraveghere competente, toate informațiile necesare pentru desfășurarea procedurii de certificare, precum și accesul la activitățile de prelucrare respective.

(7) Certificarea este eliberată unui operator sau unei persoane împuternicite de operator pentru o perioadă maximă de trei ani și poate fi reînnoită în aceleași condiții, cu condiția ca criteriile relevante să fie îndeplinite în continuare. Certificarea este retrasă, după caz, de către organismele de certificare menționate la articolul 43 sau de către autoritatea de supraveghere competentă în cazul în care nu mai sunt îndeplinite criteriile pentru certificare.

(8) Comitetul regrupează toate mecanismele de certificare și sigiliile și mărcile de protecție a datelor într-un registru și le pune la dispoziția publicului prin orice mijloc corespunzător.

Articolul 43

Organisme de certificare

(1) Fără a aduce atingere sarcinilor și competențelor autorității de supraveghere competente, prevăzute la articolele 57 și 58, organismele de certificare care dispun de un nivel adecvat de competență în domeniul protecției datelor, după ce informează autoritatea de supraveghere pentru a-i permite să își exercite competențele în temeiul articolului 58 alineatul (2) litera (h), emit și reînnoiesc certificarea. Statele membre se asigură că aceste organisme de certificare sunt acreditate de către una sau amândouă dintre următoarele entități:

(a)autoritatea de supraveghere care este competentă în temeiul articolului 55 sau 56;

(b)organismul național de acreditare desemnat în conformitate cu Regulamentul (CE) nr. 765/2008 al Parlamentului European și al Consiliului () în conformitate cu standardul EN-ISO/IEC 17065/2012 și cu cerințele suplimentare stabilite de autoritatea de supraveghere care este competentă în temeiul articolului 55 sau 56.

(2) Un organism de certificare menționat la alineatul (1) este acreditat în conformitate cu alineatul respectiv numai dacă:

(a)a demonstrat autorității de supraveghere competente, într-un mod satisfăcător, independența și expertiza sa în legătură cu obiectul certificării;

(b)s-a angajat să respecte criteriile menționate la articolul 42 alineatul (5) și aprobate de autoritatea de supraveghere care este competentă în temeiul articolului 55 sau 56, sau de către comitet în temeiul articolului 63;

(c)a instituit proceduri pentru emiterea, revizuirea periodică și retragerea certificării, a sigiliilor și mărcilor din domeniul protecției datelor;

(d)a instituit proceduri și structuri pentru tratarea plângerilor privind încălcări ale certificării sau privind modul în care certificarea a fost sau este pusă în aplicare de un operator sau o persoană împuternicită de operator, precum și pentru asigurarea transparenței acestor proceduri și structuri pentru persoanele vizate și pentru public; și

(e)a demonstrat autorității de supraveghere competente, într-un mod satisfăcător, că sarcinile și atribuțiile sale nu creează conflicte de interese.

(3) Acreditarea organismelor de certificare menționate la alineatele (1) și (2) din prezentul articol se realizează pe baza cerințelor aprobate de către autoritatea de supraveghere care este competentă în temeiul articolului 55 sau 56, sau de către comitet în temeiul articolului 63. În cazul unei acreditări în temeiul alineatului (1) litera (b) din prezentul articol, aceste cerințe le completează pe cele prevăzute în Regulamentul (CE) nr. 765/2008 și normele tehnice care descriu metodele și procedurile organismelor de certificare.

(4) Organismele de certificare menționate la alineatul (1) sunt responsabile cu realizarea unei evaluări adecvate în vederea certificării sau retragerii acestei certificări, fără a aduce atingere responsabilității operatorului sau a persoanei împuternicite de operator de a respecta prezentul regulament. Acreditarea se eliberează pentru o perioadă maximă de cinci ani și poate fi reînnoită în aceleași condiții, cu condiția ca organismul de certificare să îndeplinească cerințele prevăzute în prezentul articol.

(5) Organismele de certificare menționate la alineatul (1) transmite autorităților de supraveghere competente motivele acordării sau retragerii certificării solicitate.

(6) Cerințele menționate la alineatul (3) din prezentul articol și criteriile menționate la articolul 42 alineatul (5) se publică de către autoritatea de supraveghere într-o formă ușor de accesat. Autoritățile de supraveghere transmit, de asemenea, aceste cerințe și criterii comitetului.

(7) Fără a aduce atingere dispozițiilor capitolului VIII, autoritatea de supraveghere competentă sau organismul național de acreditare revocă acreditarea acordată unui organism de certificare în temeiul alineatului (1) din prezentul articol în cazul în care nu sunt sau nu mai sunt îndeplinite condițiile pentru acreditare sau măsurile luate de organismul de acreditare încalcă prezentul regulament.

(8) Comisia este împuternicită să adopte acte delegate în conformitate cu articolul 92, în scopul specificării cerințelor care trebuie luate în considerare pentru mecanismele de certificare din domeniul protecției datelor, menționate la articolul 42 alineatul (1).

(9) Comisia poate adopta acte de punere în aplicare pentru a stabili standarde tehnice pentru mecanismele de certificare și pentru sigiliile și mărcile din domeniul protecției datelor, precum și mecanisme de promovare și recunoaștere a acelor mecanisme de certificare, sigilii și mărci. Actele de punere în aplicare respective se adoptă în conformitate cu procedura de examinare menționată la articolul 93 alineatul (2).

CAPITOLUL V

Transferurile de date cu caracter personal către țări terțe sau organizații internaționale

Articolul 44

Principiul general al transferurilor

Orice date cu caracter personal care fac obiectul prelucrării sau care urmează a fi prelucrate după ce sunt transferate într-o țară terță sau către o organizație internațională pot fi transferate doar dacă, sub rezerva celorlalte dispoziții ale prezentului regulament, condițiile prevăzute în prezentul capitol sunt respectate de operator și de persoana împuternicită de operator, inclusiv în ceea ce privește transferurile ulterioare de date cu caracter personal din țara terță sau de la organizația internațională către o altă țară terță sau către o altă organizație internațională. Toate dispozițiile din prezentul capitol se aplică pentru a se asigura că nivelul de protecție a persoanelor fizice garantat prin prezentul regulament nu este subminat.

Articolul 45

Transferuri în temeiul unei decizii privind caracterul adecvat al nivelului de protecție

(1) Transferul de date cu caracter personal către o țară terță sau o organizație internațională se poate realiza atunci când Comisia a decis că țara terță, un teritoriu ori unul sau mai multe sectoare specificate din acea țară terță sau organizația internațională în cauză asigură un nivel de protecție adecvat. Transferurile realizate în aceste condiții nu necesită autorizări speciale.

(2) Atunci când evaluează caracterul adecvat al nivelului de protecție, Comisia ține seama, în special, de următoarele elemente:

(a)statul de drept, respectarea drepturilor omului și a libertăților fundamentale, legislația relevantă, atât generală, cât și sectorială, inclusiv privind securitatea publică, apărarea, securitatea națională și dreptul penal, precum și accesul autorităților publice la datele cu caracter personal, precum și punerea în aplicare a acestei legislații, normele de protecție a datelor, normele profesionale și măsurile de securitate, inclusiv normele privind transferul ulterior de date cu caracter personal către o altă țară terță sau organizație internațională, care sunt respectate în țara terță respectivă sau în organizația internațională respectivă, jurisprudența, precum și existența unor drepturi efective și opozabile ale persoanelor vizate și a unor reparații efective pe cale administrativă și judiciară pentru persoanele vizate ale căror date cu caracter personal sunt transferate;

(b)existența și funcționarea eficientă a uneia sau mai multor autorități de supraveghere independente în țara terță sau sub jurisdicția cărora intră o organizație internațională, cu responsabilitate pentru asigurarea și impunerea respectării normelor de protecție a datelor, incluzând competențe adecvate de asigurare a respectării aplicării, pentru acordarea de asistență și consiliere persoanelor vizate cu privire la exercitarea drepturilor acestora și pentru cooperarea cu autoritățile de supraveghere din statele membre; și

(c)angajamentele internaționale la care a aderat țara terță sau organizația internațională în cauză sau alte obligații care decurg din convenții sau instrumente obligatorii din punct de vedere juridic, precum și din participarea acesteia la sisteme multilaterale sau regionale, mai ales în domeniul protecției datelor cu caracter personal.

(3) Comisia, după ce evaluează caracterul adecvat al nivelului de protecție, poate decide, printr-un act de punere în aplicare, că o țară terță, un teritoriu sau unul sau mai multe sectoare specificate dintr-o țară terță sau o organizație internațională asigură un nivel de protecție adecvat în sensul alineatului (2) din prezentul articol. Actul de punere în aplicare prevede un mecanism de revizuire periodică, cel puțin o dată la patru ani, care ia în considerare toate evoluțiile relevante din țara terță sau organizația internațională. Actul de punere în aplicare menționează aplicarea geografică și sectorială, și, după caz, identifică autoritatea sau autoritățile de supraveghere menționate la alineatul (2) litera (b) din prezentul articol. Actul de punere în aplicare se adoptă în conformitate cu procedura de examinare menționată la articolul 93 alineatul (2).

(4) Comisia monitorizează continuu evoluțiile din țările terțe și de la nivelul organizațiilor internaționale care ar putea afecta funcționarea deciziilor adoptate în temeiul alineatului (3) din prezentul articol și a deciziilor adoptate în temeiul articolului 25 alineatul (6) din Directiva 95/46/CE.

(5) În cazul în care informațiile disponibile dezvăluie, în special în urma revizuirii menționate la alineatul (3) din prezentul articol, că o țară terță, un teritoriu sau un sector specificat din acea țară terță sau o organizație internațională nu mai asigură un nivel de protecție adecvat în sensul alineatului (2) din prezentul articol, Comisia, dacă este necesar, abrogă, modifică sau suspendă, prin intermediul unui act de punere în aplicare, decizia menționată la alineatul (3) din prezentul articol fără efect retroactiv. Actele de punere în aplicare respective se adoptă în conformitate cu procedura de examinare menționată la articolul 93 alineatul (2).

Din motive imperioase de urgență, Comisia adoptă acte de punere în aplicare imediat aplicabile în conformitate cu procedura menționată la articolul 93 alineatul (3).

(6) Comisia inițiază consultări cu țara terță sau organizația internațională în vederea remedierii situației care a stat la baza deciziei luate în conformitate cu alineatul (5).

(7) O decizie luată în temeiul alineatului (5) din prezentul articol nu aduce atingere transferurilor de date cu caracter personal către țara terță, un teritoriu sau unul sau mai multe sectoare specificate din acea țară terță sau către organizația internațională în cauză în conformitate cu articolele 46-49.

(8) Comisia publică în Jurnalul Oficial al Uniunii Europene și pe site-ul său o listă a țărilor terțe, a teritoriilor și sectoarelor specificate dintr-o țară terță și a organizațiilor internaționale în cazul cărora a decis că nivelul de protecție adecvat este asigurat sau nu mai este asigurat.

(9) Deciziile adoptate de Comisie în temeiul articolului 25 alineatul (6) din Directiva 95/46/CE rămân în vigoare până când sunt modificate, înlocuite sau abrogate de o decizie a Comisiei adoptată în conformitate cu alineatul (3) sau (5) din prezentul articol.

Articolul 46

Transferuri în baza unor garanții adecvate

(1) În absența unei decizii în temeiul articolului 45 alineatul (3), operatorul sau persoana împuternicită de operator poate transfera date cu caracter personal către o țară terță sau o organizație internațională numai dacă operatorul sau persoana împuternicită de operator a oferit garanții adecvate și cu condiția să existe drepturi opozabile și căi de atac eficiente pentru persoanele vizate.

(2) Garanțiile adecvate menționate la alineatul 1 pot fi furnizate fără să fie nevoie de nicio autorizație specifică din partea unei autorități de supraveghere, prin:

(a)un instrument obligatoriu din punct de vedere juridic și executoriu între autoritățile sau organismele publice;

(b)reguli corporatiste obligatorii în conformitate cu articolul 47;

(c)clauze standard de protecție a datelor adoptate de Comisie în conformitate cu procedura de examinare menționată la articolul 93 alineatul (2);

(d)clauze standard de protecție a datelor adoptate de o autoritate de supraveghere și aprobate de Comisie în conformitate cu procedura de examinare menționată la articolul 93 alineatul (2);

(e)un cod de conduită aprobat în conformitate cu articolul 40, însoțit de un angajament obligatoriu și executoriu din partea operatorului sau a persoanei împuternicite de operator din țara terță de a aplica garanții adecvate, inclusiv cu privire la drepturile persoanelor vizate; sau

(f)un mecanism de certificare aprobat în conformitate cu articolul 42, însoțit de un angajament obligatoriu și executoriu din partea operatorului sau a persoanei împuternicite de operator din țara terță de a aplica garanții adecvate, inclusiv cu privire la drepturile persoanelor vizate.

(3) Sub rezerva autorizării din partea autorității de supraveghere competente, garanțiile adecvate menționate la alineatul (1) pot fi furnizate de asemenea, în special, prin:

(a)clauze contractuale între operator sau persoana împuternicită de operator și operatorul, persoana împuternicită de operator sau destinatarul datelor cu caracter personal din țara terță sau organizația internațională; sau

(b)dispoziții care urmează să fie incluse în acordurile administrative dintre autoritățile sau organismele publice, care includ drepturi opozabile și efective pentru persoanele vizate.

(4) Autoritatea de supraveghere aplică mecanismul pentru asigurarea coerenței menționat la articolul 63, în cazurile menționate la alineatul (3) din prezentul articol.

(5) Autorizațiile acordate de un stat membru sau de o autoritate de supraveghere în temeiul articolului 26 alineatul (2) din Directiva 95/46/CE sunt valabile până la data la care sunt modificate, înlocuite sau abrogate, dacă este necesar, de respectiva autoritate de supraveghere. Deciziile adoptate de Comisie în temeiul articolului 26 alineatul (4) din Directiva 95/46/CE rămân în vigoare până când sunt modificate, înlocuite sau abrogate, dacă este necesar, de o decizie a Comisiei adoptată în conformitate cu alineatul (2) din prezentul articol.

Articolul 47

Reguli corporatiste obligatorii

(1) În conformitate cu mecanismul pentru asigurarea coerenței prevăzut la articolul 63, autoritatea de supraveghere competentă aprobă reguli corporatiste obligatorii, cu condiția ca acestea:

(a)să fie obligatorii din punct de vedere juridic și să se aplice fiecărui membru vizat al grupului de întreprinderi sau al grupului de întreprinderi implicate într-o activitate economică comună, inclusiv angajaților acestuia, precum și să fie puse în aplicare de membrii în cauză;

(b)să confere, în mod expres, drepturi opozabile persoanelor vizate în ceea ce privește prelucrarea datelor lor cu caracter personal; și

(c)să îndeplinească cerințele prevăzute la alineatul (2).

(2) Regulile corporatiste obligatorii menționate la alineatul (1) precizează cel puțin:

(a)structura și datele de contact ale grupului de întreprinderi sau ale grupului de întreprinderi implicate într-o activitate economică comună și ale fiecăruia dintre membrii săi;

(b)transferurile de date sau setul de transferuri, inclusiv categoriile de date cu caracter personal, tipul prelucrării și scopurile prelucrării, tipurile de persoane vizate afectate și identificarea țării terțe sau a țărilor terțe în cauză;

(c)caracterul lor juridic obligatoriu, atât pe plan intern, cât și extern;

(d)aplicarea principiilor generale în materie de protecție a datelor, în special limitarea scopului, reducerea la minimum a datelor, perioadele de stocare limitate, calitatea datelor, protecția datelor începând cu momentul conceperii și protecția implicită, temeiul juridic pentru prelucrare, prelucrarea categoriilor speciale de date cu caracter personal, măsurile de asigurare a securității datelor, precum și cerințele referitoare la transferurile ulterioare către organisme care nu fac obiectul regulilor corporatiste obligatorii;

(e)drepturile persoanelor vizate în ceea ce privește prelucrarea și mijloacele de exercitare a acestor drepturi, inclusiv dreptul de a nu face obiectul unor decizii bazate exclusiv pe prelucrarea automată, inclusiv crearea de profiluri, în conformitate cu articolul 22, dreptul de a depune o plângere în fața autorității de supraveghere competente și în fața instanțelor competente ale statelor membre, în conformitate cu articolul 79, precum și dreptul de a obține reparații și, după caz, despăgubiri pentru încălcarea regulilor corporatiste obligatorii;

(f)acceptarea de către operator sau de persoana împuternicită de operator, care își are sediul pe teritoriul unui stat membru, a răspunderii pentru orice încălcare a regulilor corporatiste obligatorii de către orice membru în cauză care nu își are sediul în Uniune; operatorul sau persoana împuternicită de operator este exonerat(ă) de această răspundere, integral sau parțial, numai dacă dovedește că membrul respectiv nu a fost răspunzător de evenimentul care a cauzat prejudiciul;

(g)modul în care informațiile privind regulile corporatiste obligatorii, în special privind dispozițiile menționate la literele (d), (e) și (f) de la prezentul alineat, sunt furnizate persoanelor vizate în completarea informațiilor menționate la articolele 13 și 14;

(h)sarcinile oricărui responsabil cu protecția datelor desemnat în conformitate cu articolul 37 sau ale oricărei alte persoane sau entități însărcinate cu monitorizarea respectării regulilor corporatiste obligatorii în cadrul grupului de întreprinderi sau al grupului de întreprinderi implicate într-o activitate economică comună, a activităților de formare și a gestionării plângerilor;

(i)procedurile de formulare a plângerilor;

(j)mecanismele din cadrul grupului de întreprinderi sau al grupului de întreprinderi implicate într-o activitate economică comună, menite să asigure verificarea conformității cu regulile corporatiste obligatorii. Aceste mecanisme includ auditurile privind protecția datelor și metodele de asigurare a acțiunilor corective menite să protejeze drepturile persoanei vizate. Rezultatele acestor verificări ar trebui să fie comunicate persoanei sau entității menționate la litera (h) și consiliului de administrație al întreprinderii care exercită controlul grupului de întreprinderi sau al grupului de întreprinderi implicate într-o activitate economică comună și ar trebui să fie puse la dispoziția autorității de supraveghere competente, la cerere;

(k)mecanismele de raportare și înregistrare a modificărilor aduse regulilor și de raportare a acestor modificări autorității de supraveghere;

(l)mecanismul de cooperare cu autoritatea de supraveghere în vederea asigurării respectării regulilor de către orice membru al grupului de întreprinderi sau al grupului de întreprinderi implicate într-o activitate economică comună, în special prin punerea la dispoziția autorității de supraveghere a rezultatelor verificărilor cu privire la măsurile menționate la punctul (j);

(m)mecanismele de raportare către autoritatea de supraveghere competentă a oricăror cerințe legale impuse unui membru al grupului de întreprinderi sau al grupului de întreprinderi implicate într-o activitate economică comună într-o țară terță care pot avea un efect advers considerabil asupra garanțiilor furnizate prin regulile corporatiste obligatorii; și

(n)formarea corespunzătoare în domeniul protecției datelor a personalului care are un acces permanent sau periodic la date cu caracter personal.

(3) Comisia poate preciza formatul și procedurile pentru schimbul de informații între operatori, persoanele împuternicite de operatori și autoritățile de supraveghere pentru regulile corporatiste obligatorii în sensul prezentului articol. Actele de punere în aplicare respective se adoptă în conformitate cu procedura de examinare prevăzută la articolul 93 alineatul (2).

Articolul 48

Transferurile sau divulgările de informații neautorizate de dreptul Uniunii

Orice hotărâre a unei instanțe sau a unui tribunal și orice decizie a unei autorități administrative a unei țări terțe care impun unui operator sau persoanei împuternicite de operator să transfere sau să divulge date cu caracter personal poate fi recunoscută sau executată în orice fel numai dacă se bazează pe un acord internațional, cum ar fi un tratat de asistență judiciară reciprocă în vigoare între țara terță solicitantă și Uniune sau un stat membru, fără a se aduce atingere altor motive de transfer în temeiul prezentului capitol.

Articolul 49

Derogări pentru situații specifice

(1) În absența unei decizii privind caracterul adecvat al nivelului de protecție în conformitate cu articolul 45 alineatul (3) sau a unor garanții adecvate în conformitate cu articolul 46, inclusiv a regulilor corporatiste obligatorii, un transfer sau un set de transferuri de date cu caracter personal către o țară terță sau o organizație internațională poate avea loc numai în una dintre condițiile următoare:

(a)persoana vizată și-a exprimat în mod explicit acordul cu privire la transferul propus, după ce a fost informată asupra posibilelor riscuri pe care astfel de transferuri le pot implica pentru persoana vizată ca urmare a lipsei unei decizii privind caracterul adecvat al nivelului de protecție și a unor garanții adecvate;

(b)transferul este necesar pentru executarea unui contract între persoana vizată și operator sau pentru aplicarea unor măsuri precontractuale adoptate la cererea persoanei vizate;

(c)transferul este necesar pentru încheierea unui contract sau pentru executarea unui contract încheiat în interesul persoanei vizate între operator și o altă persoană fizică sau juridică;

(d)transferul este necesar din considerente importante de interes public;

(e)transferul este necesar pentru stabilirea, exercitarea sau apărarea unui drept în instanță;

(f)transferul este necesar pentru protejarea intereselor vitale ale persoanei vizate sau ale altor persoane, atunci când persoana vizată nu are capacitatea fizică sau juridică de a-și exprima acordul;

(g)transferul se realizează dintr-un registru care, potrivit dreptului Uniunii sau al dreptului intern, are scopul de a furniza informații publicului și care poate fi consultat fie de public în general, fie de orice persoană care poate face dovada unui interes legitim, dar numai în măsura în care sunt îndeplinite condițiile cu privire la consultare prevăzute de dreptul Uniunii sau de dreptul intern în acel caz specific.

În cazul în care un transfer nu ar putea să se întemeieze pe o dispoziție prevăzută la articolul 45 sau 46, inclusiv dispoziții privind reguli corporatiste obligatorii, și nu este aplicabilă niciuna dintre derogările pentru situații specifice prevăzute la primul paragraf din prezentul alineat, un transfer către o țară terță sau o organizație internațională poate avea loc numai în cazul în care transferul nu este repetitiv, se referă doar la un număr limitat de persoane vizate, este necesar în scopul realizării intereselor legitime majore urmărite de operator asupra căruia nu prevalează interesele sau drepturile și libertățile persoanei vizate și operatorul a evaluat toate circumstanțele aferente transferului de date și, pe baza acestei evaluări, a prezentat garanții corespunzătoare în ceea ce privește protecția datelor cu caracter personal. Operatorul informează autoritatea de supraveghere cu privire la transfer. Operatorul, în plus față de furnizarea informațiilor menționate la articolele 13 și 14, informează persoana vizată cu privire la transfer și la interesele legitime majore pe care le urmărește.

(2) Transferul în temeiul alineatului (1) primul paragraf litera (g) nu implică totalitatea datelor cu caracter personal sau ansamblul categoriilor de date cu caracter personal cuprinse în registru. Atunci când registrul urmează a fi consultat de către persoane care au un interes legitim, transferul se efectuează numai la cererea persoanelor respective sau în cazul în care acestea vor fi destinatarii.

(3) Alineatul (1) primul paragraf literele (a), (b) și (c) și paragraful al doilea nu se aplică în cazul activităților desfășurate de autoritățile publice în exercitarea competențelor lor publice.

(4) Interesul public prevăzut la alineatul (1) primul paragraf litera (d) este recunoscut în dreptul Uniunii sau în dreptul statului membru sub incidența căruia intră operatorul.

(5) În absența unei decizii privind caracterul adecvat al nivelului de protecție, dreptul Uniunii sau dreptul intern poate, din considerente importante de interes public, să stabilească în mod expres limite asupra transferului unor categorii specifice de date cu caracter personal către o țară terță sau o organizație internațională. Statele membre notifică aceste dispoziții Comisiei.

(6) Operatorul sau persoana împuternicită de operator consemnează evaluarea, precum și garanțiile adecvate prevăzute la paragraful al doilea al alineatului (1) din prezentul articol, în evidențele menționate la articolul 30.

Articolul 50

Cooperarea internațională în domeniul protecției datelor cu caracter personal

În ceea ce privește țările terțe și organizațiile internaționale, Comisia și autoritățile de supraveghere iau măsurile corespunzătoare pentru:

(a)elaborarea de mecanisme de cooperare internațională pentru a facilita asigurarea aplicării efective a legislației privind protecția datelor cu caracter personal;

(b)acordarea de asistență internațională reciprocă în asigurarea aplicării legislației din domeniul protecției datelor cu caracter personal, inclusiv prin notificare, transferul plângerilor, asistență în investigații și schimb de informații, sub rezerva unor garanții adecvate pentru protecția datelor cu caracter personal și a altor drepturi și libertăți fundamentale;

(c)implicarea părților interesate relevante în discuțiile și activitățile care au ca scop intensificarea cooperării internaționale în domeniul aplicării legislației privind protecția datelor cu caracter personal;

(d)promovarea schimbului reciproc și a documentației cu privire la legislația și practicile în materie de protecție a datelor cu caracter personal, inclusiv în ceea ce privește conflictele jurisdicționale cu țările terțe.

CAPITOLUL VI

Autorități de supraveghere independente

Secțiunea 1

Articolul 51

Autoritatea de supraveghere

(1) Fiecare stat membru se asigură că una sau mai multe autorități publice independente sunt responsabile de monitorizarea aplicării prezentului regulament, în vederea protejării drepturilor și libertăților fundamentale ale persoanelor fizice în ceea ce privește prelucrarea și în vederea facilitării liberei circulații a datelor cu caracter personal în cadrul Uniunii („autoritatea de supraveghere").

(2) Fiecare autoritate de supraveghere contribuie la aplicarea coerentă a prezentului regulament în întreaga Uniune. În acest scop, autoritățile de supraveghere cooperează atât între ele, cât și cu Comisia, în conformitate cu capitolul VII.

(3) În cazul în care mai multe autorități de supraveghere sunt instituite într-un stat membru, acesta desemnează autoritatea de supraveghere care reprezintă autoritățile respective în cadrul comitetului și instituie un mecanism prin care să asigure respectarea de către celelalte autorități a normelor privind mecanismul pentru asigurarea coerenței prevăzut la articolul 63.

(4) Fiecare stat membru notifică Comisiei dispozițiile de drept pe care le adoptă în temeiul prezentului capitol până la 25 mai 2018 și, fără întârziere, orice modificare ulterioară pe care o aduce acestor dispoziții.

Articolul 52

Independență

(1) Fiecare autoritate de supraveghere beneficiază de independență deplină în îndeplinirea sarcinilor sale și exercitarea competențelor sale în conformitate cu prezentul regulament.

(2) Membrul sau membrii fiecărei autorități de supraveghere, în cadrul îndeplinirii sarcinilor și al exercitării competențelor sale (lor) în conformitate cu prezentul regulament, rămâne (rămân) independent (independenți) de orice influență externă directă sau indirectă și nici nu solicită, nici nu acceptă instrucțiuni de la o parte externă.

(3) Membrul sau membrii fiecărei autorități de supraveghere se abțin de la a întreprinde acțiuni incompatibile cu atribuțiile lor, iar pe durata mandatului, nu desfășoară activități incompatibile, remunerate sau nu.

(4) Fiecare stat membru se asigură că fiecare autoritate de supraveghere beneficiază de resurse umane, tehnice și financiare, de un sediu și de infrastructura necesară pentru îndeplinirea sarcinilor și exercitarea efectivă a competențelor sale, inclusiv a celor care urmează să fie aplicate în contextul asistenței reciproce, al cooperării și al participării în cadrul comitetului.

(5) Fiecare stat membru se asigură că fiecare autoritate de supraveghere își selectează personalul propriu și deține personal propriu aflat sub conducerea exclusivă a membrului sau membrilor autorității de supraveghere respective.

(6) Fiecare stat membru se asigură că fiecare autoritate de supraveghere face obiectul unui control financiar care nu aduce atingere independenței sale și că dispune de bugete anuale distincte, publice, care pot face parte din bugetul general de stat sau național.

Articolul 53

Condiții generale aplicabile membrilor autorității de supraveghere

(1) Statele membre se asigură că fiecare membru al autorității lor de supraveghere este numit prin intermediul unei proceduri transparente:

-de un organism independent împuternicit să facă numiri în temeiul dreptului intern.

(2) Fiecare membru în cauză are calificările, experiența și competențele necesare, în special în domeniul protecției datelor cu caracter personal, pentru a-și putea îndeplini atribuțiile și exercita competențele.

(3) Atribuțiile unui membru încetează în cazul expirării mandatului, în cazul demisiei sau pensionării din oficiu în conformitate cu dreptul intern relevant.

(4) Un membru poate fi demis doar în cazuri de abateri grave sau dacă nu mai îndeplinește condițiile necesare pentru îndeplinirea atribuțiilor sale.

Articolul 54

Norme privind instituirea autorității de supraveghere

(1) Fiecare stat membru prevede, pe cale legislativă, următoarele:

(a)instituirea fiecărei autorități de supraveghere;

(b)calificările și condițiile de eligibilitate necesare pentru a fi numit în calitate de membru al fiecărei autorități de supraveghere;

(c)normele și procedurile pentru numirea membrului sau a membrilor fiecărei autorități de supraveghere;

(d)durata mandatului membrului sau membrilor fiecărei autorități de supraveghere, de minimum patru ani, cu excepția primei numiri după 24 mai 2016, din care o parte poate fi pe o perioadă mai scurtă în cazul în care acest lucru este necesar pentru a proteja independența autorității de supraveghere printr-o procedură de numiri eșalonate;

(e)dacă și de câte ori este eligibil pentru reînnoire mandatul membrului sau membrilor fiecărei autorități de supraveghere;

(f)condițiile care reglementează obligațiile membrului sau membrilor și ale personalului fiecărei autorități de supraveghere, interdicții privind acțiunile, ocupațiile și beneficiile incompatibile cu acestea în cursul mandatului și după încetarea acestuia, precum și normele care reglementează încetarea contractului de angajare.

(2) Membrul sau membrii și personalul fiecărei autorități de supraveghere au obligația, în conformitate cu dreptul Uniunii sau cu dreptul intern, de a respecta atât pe parcursul mandatului, cât și după încetarea acestuia, secretul profesional în ceea ce privește informațiile confidențiale de care au luat cunoștință în cursul îndeplinirii sarcinilor sau al exercitării competențelor lor. Pe durata mandatului lor, această obligație de păstrare a secretului profesional se aplică în special în ceea ce privește raportarea de către persoane fizice a încălcărilor prezentului regulament.

Secțiunea 2

Abilitări, sarcini și competențe

Articolul 55

Competența

(1) Fiecare autoritate de supraveghere are competența să îndeplinească sarcinile și să exercite competențele care îi sunt conferite în conformitate cu prezentul regulament pe teritoriul statului membru de care aparține.

(2) În cazul în care prelucrarea este efectuată de autorități publice sau de organisme private care acționează pe baza articolului 6 alineatul (1) litera (c) sau (e), autoritatea de supraveghere din statul membru respectiv are competență. În astfel de cazuri, articolul 56 nu se aplică. ◄

(3) Autoritățile de supraveghere nu sunt competente să supravegheze operațiunile de prelucrare ale instanțelor care acționează în exercițiul funcției lor judiciare.

Articolul 56

Competența autorității de supraveghere principale

(1) Fără a aduce atingere articolului 55, autoritatea de supraveghere a sediului principal sau a sediului unic al operatorului sau al persoanei împuternicite de operator este competentă să acționeze în calitate de autoritate de supraveghere principală pentru prelucrarea transfrontalieră efectuată de respectivul operator sau respectiva persoană împuternicită în cauză în conformitate cu procedura prevăzută la articolul 60.

(2) Prin derogare de la alineatul (1), fiecare autoritate de supraveghere este competentă să trateze o plângere depusă în atenția sa sau o eventuală încălcare a prezentului regulament, în cazul în care obiectul acesteia se referă numai la un sediu aflat în statul său membru sau afectează în mod semnificativ persoane vizate numai în statul său membru.

(3) În cazurile menționate la alineatul (2) din prezentul articol, autoritatea de supraveghere informează fără întârziere autoritatea de supraveghere principală cu privire la această chestiune. În termen de trei săptămâni de la momentul informării, autoritatea de supraveghere principală decide dacă tratează sau nu cazul respectiv în conformitate cu procedura prevăzută la articolul 60, luând în considerare dacă există sau nu un sediu al operatorului sau al persoanei împuternicite de operator pe teritoriul statului membru a cărui autoritate de supraveghere a informat-o.

(4) În cazul în care autoritatea de supraveghere principală decide să trateze cazul, se aplică procedura prevăzută la articolul 60. Autoritatea de supraveghere care a informat autoritatea de supraveghere principală poate înainta un proiect de decizie acesteia din urmă. Autoritatea de supraveghere principală ține seama în cea mai mare măsură posibilă de proiectul respectiv atunci când pregătește proiectul de decizie prevăzut la articolul 60 alineatul (3).

(5) În cazul în care autoritatea de supraveghere principală decide să nu trateze cazul, autoritatea de supraveghere care a informat autoritatea de supraveghere principală tratează cazul în conformitate cu articolele 61 și 62.

(6) Autoritatea de supraveghere principală este singurul interlocutor al operatorului sau al persoanei împuternicite de operator în ceea ce privește prelucrarea transfrontalieră efectuată de respectivul operator sau de respectiva persoană împuternicită de operator.

Articolul 57

Sarcini

(1) Fără a aduce atingere altor sarcini stabilite în temeiul prezentului regulament, fiecare autoritate de supraveghere, pe teritoriul său:

(a)monitorizează și asigură aplicarea prezentului regulament;

(b)promovează acțiuni de sensibilizare și de înțelegere în rândul publicului a riscurilor, normelor, garanțiilor și drepturilor în materie de prelucrare. Se acordă atenție specială activităților care se adresează în mod specific copiilor;

(c)oferă consiliere, în conformitate cu dreptul intern, parlamentului național, guvernului și altor instituții și organisme cu privire la măsurile legislative și administrative referitoare la protecția drepturilor și libertăților persoanelor fizice în ceea ce privește prelucrarea;

(d)promovează acțiuni de sensibilizare a operatorilor și a persoanelor împuternicite de aceștia cu privire la obligațiile care le revin în temeiul prezentului regulament;

(e)la cerere, furnizează informații oricărei persoane vizate în legătură cu exercitarea drepturilor sale în conformitate cu prezentul regulament și, dacă este cazul, cooperează cu autoritățile de supraveghere din alte state membre în acest scop;

(f)tratează plângerile depuse de o persoană vizată, un organism, o organizație sau o asociație în conformitate cu articolul 80 și investighează într-o măsură adecvată obiectul plângerii și informează reclamantul cu privire la evoluția și rezultatul investigației, într-un termen rezonabil, în special dacă este necesară efectuarea unei investigații mai amănunțite sau coordonarea cu o altă autoritate de supraveghere;

(g)cooperează, inclusiv prin schimb de informații, cu alte autorități de supraveghere și își oferă asistență reciprocă pentru a asigura coerența aplicării și respectării prezentului regulament;

(h)desfășoară investigații privind aplicarea prezentului regulament, inclusiv pe baza unor informații primite de la o altă autoritate de supraveghere sau de la o altă autoritate publică;

(i)monitorizează evoluțiile relevante, în măsura în care acestea au impact asupra protecției datelor cu caracter personal, în special evoluția tehnologiilor informației și comunicațiilor și a practicilor comerciale;

(j)adoptă clauze contractuale standard menționate la articolul 28 alineatul (8) și la articolul 46 alineatul (2) litera (d);

(k)întocmește și menține la zi o listă în legătură cu cerința privind evaluarea impactului asupra protecției datelor, în conformitate cu articolul 35 alineatul (4);

(l)oferă consiliere cu privire la operațiunile de prelucrare menționate la articolul 36 alineatul (2);

(m)încurajează elaborarea de coduri de conduită în conformitate cu articolul 40 alineatul (1), își dă avizul cu privire la acestea și le aprobă pe cele care oferă suficiente garanții, în conformitate cu articolul 40 alineatul (5);

(n)încurajează stabilirea unor mecanisme de certificare, precum și a unor sigilii și mărci în domeniul protecției datelor în conformitate cu articolul 42 alineatul (1) și aprobă criteriile de certificare în conformitate cu articolul 42 alineatul (5);

(o)acolo unde este cazul, efectuează o revizuire periodică a certificărilor acordate, în conformitate cu articolul 42 alineatul (7);

(p)elaborează și publică cerințele de acreditare a unui organism de monitorizare a codurilor de conduită în conformitate cu articolul 41 și a unui organism de certificare în conformitate cu articolul 43;

(q)coordonează procedura de acreditare a unui organism de monitorizare a codurilor de conduită în conformitate cu articolul 41 și a unui organism de certificare în conformitate cu articolul 43;

(r)autorizează clauzele și dispozițiile contractuale menționate la articolul 46 alineatul (3);

(s)aprobă regulile corporatiste obligatorii în conformitate cu articolul 47;

(t)contribuie la activitățile comitetului;

(u)menține la zi evidențe interne privind încălcările prezentului regulament și măsurile luate, în special avertismentele emise și sancțiunile impuse în conformitate cu articolul 58 alineatul (2); și

(v)îndeplinește orice alte sarcini legate de protecția datelor cu caracter personal.

(2) Fiecare autoritate de supraveghere facilitează depunerea plângerilor menționate la alineatul (1) litera (f) prin măsuri precum punerea la dispoziție a unui formular de depunere a plângerii care să poată fi completat inclusiv în format electronic, fără a exclude alte mijloace de comunicare.

(3) Îndeplinirea sarcinilor fiecărei autorități de supraveghere este gratuită pentru persoana vizată și, după caz, pentru responsabilul cu protecția datelor.

(4) În cazul în care cererile sunt în mod vădit nefondate sau excesive, în special din cauza caracterului lor repetitiv, autoritatea de supraveghere poate percepe o taxă rezonabilă, bazată pe costurile administrative, sau poate refuza să le trateze. Sarcina de a demonstra caracterul evident nefondat sau excesiv al cererii revine autorității de supraveghere.

Articolul 58

Competențe

(1) Fiecare autoritate de supraveghere are toate următoarele competențe de investigare:

(a)de a da dispoziții operatorului și persoanei împuternicite de operator și, după caz, reprezentantului operatorului sau al persoanei împuternicite de operator să furnizeze orice informații pe care autoritatea de supraveghere le solicită în vederea îndeplinirii sarcinilor sale;

(b)de a efectua investigații sub formă de audituri privind protecția datelor;

(c)de a efectua o revizuire a certificărilor acordate în temeiul articolului 42 alineatul (7);

(d)de a notifica operatorul sau persoana împuternicită de operator cu privire la presupusa încălcare a prezentului regulament;

(e)de a obține, din partea operatorului și a persoanei împuternicite de operator, accesul la toate datele cu caracter personal și la toate informațiile necesare pentru îndeplinirea sarcinilor sale;

(f)de a obține accesul la oricare dintre incintele operatorului și ale persoanei împuternicite de operator, inclusiv la orice echipamente și mijloace de prelucrare a datelor, în conformitate cu dreptul Uniunii sau cu dreptul procesual intern.

(2) Fiecare autoritate de supraveghere are toate următoarele competențe corective:

(a)de a emite avertizări în atenția unui operator sau a unei persoane împuternicite de operator cu privire la posibilitatea ca operațiunile de prelucrare prevăzute să încalce dispozițiile prezentului regulament;

(b)de a emite avertismente adresate unui operator sau unei persoane împuternicite de operator în cazul în care operațiunile de prelucrare au încălcat dispozițiile prezentului regulament;

(c)de a da dispoziții operatorului sau persoanei împuternicite de operator să respecte cererile persoanei vizate de a-și exercita drepturile în temeiul prezentului regulament;

(d)de a da dispoziții operatorului sau persoanei împuternicite de operator să asigure conformitatea operațiunilor de prelucrare cu dispozițiile prezentului regulament, specificând, după caz, modalitatea și termenul-limită pentru aceasta;

(e)de a obliga operatorul să informeze persoana vizată cu privire la o încălcare a protecției datelor cu caracter personal;

(f)de a impune o limitare temporară sau definitivă, inclusiv o interdicție asupra prelucrării;

(g)de a dispune rectificarea sau ștergerea datelor cu caracter personal sau restricționarea prelucrării, în temeiul articolelor 16, 17 și 18, precum și notificarea acestor acțiuni destinatarilor cărora le-au fost divulgate datele cu caracter personal, în conformitate cu articolul 17 alineatul (2) și cu articolul 19;

(h)de a retrage o certificare sau de a obliga organismul de certificare să retragă o certificare eliberată în temeiul articolul 42 și 43 sau de a obliga organismul de certificare să nu elibereze o certificare în cazul în care cerințele de certificare nu sunt sau nu mai sunt îndeplinite;

(i)de a impune amenzi administrative în conformitate cu articolul 83, în completarea sau în locul măsurilor menționate la prezentul alineat, în funcție de circumstanțele fiecărui caz în parte;

(j)de a dispune suspendarea fluxurilor de date către un destinatar dintr-o țară terță sau către o organizație internațională.

(3) Fiecare autoritate de supraveghere are toate următoarele competențe de autorizare și de consiliere:

(a)de a oferi consiliere operatorului în conformitate cu procedura de consultare prealabilă menționată la articolul 36;

(b)de a emite avize, din proprie inițiativă sau la cerere, parlamentului național, guvernului statului membru sau, în conformitate cu dreptul intern, altor instituții și organisme, precum și publicului, cu privire la orice aspect legat de protecția datelor cu caracter personal;

(c)de a autoriza prelucrarea menționată la articolul 36 alineatul (5), în cazul în care dreptul statului membru prevede o astfel de autorizare prealabilă;

(d)de a emite un aviz și de a aproba proiectele de coduri de conduită, în conformitate cu articolul 40 alineatul (5);

(e)de a acredita organismele de certificare în conformitate cu articolul 43;

(f)de a emite certificări și de a aproba criterii de certificare în conformitate cu articolul 42 alineatul (5);

(g)de a adopta clauzele standard în materie de protecție a datelor menționate la articolul 28 alineatul (8) și la articolul 46 alineatul (2) litera (d);

(h)de a autoriza clauzele contractuale menționate la articolul 46 alineatul (3) litera (a);

(i)de a autoriza acordurile administrative menționate la articolul 46 alineatul (3) litera (b); și

(j)de a aproba reguli corporatiste obligatorii în conformitate cu articolul 47.

(4) Exercitarea competențelor conferite autorității de supraveghere în temeiul prezentului articol face obiectul unor garanții adecvate, inclusiv căi de atac judiciare eficiente și procese echitabile, prevăzute în dreptul Uniunii și în dreptul intern în conformitate cu carta.

(5) Fiecare stat membru prevede, pe cale legislativă, faptul că autoritatea sa de supraveghere are competența de a aduce în fața autorităților judiciare cazurile de încălcare a prezentului regulament și, după caz, de a iniția sau de a se implica într-un alt mod în proceduri judiciare, în scopul de a asigura aplicarea dispozițiilor prezentului regulament.

(6) Fiecare stat membru poate să prevadă în dreptul său faptul că autoritatea sa de supraveghere are competențe suplimentare, în afara celor menționate la alineatele (1), (2) și (3). Exercitarea acestor competențe nu afectează modul de operare eficientă a capitolului VII.

Articolul 59

Rapoarte de activitate

Fiecare autoritate de supraveghere întocmește un raport anual cu privire la activitățile sale, care poate include o listă a tipurilor de încălcări notificate și a tipurilor de măsuri luate în conformitate cu articolul 58 alineatul (2). Rapoartele se transmit parlamentului național, guvernului și altor autorități desemnate prin dreptul intern. Acestea se pun la dispoziția publicului, a Comisiei și a comitetului.

CAPITOLUL VII

Secțiunea 1

Articolul 60

Cooperarea dintre autoritatea de supraveghere principală și celelalte autorități de supraveghere vizate

(1) Autoritatea de supraveghere principală cooperează cu celelalte autorități de supraveghere vizate, în conformitate cu prezentul articol, în încercarea de a ajunge la un consens. Autoritatea de supraveghere principală și autoritățile de supraveghere vizate își comunică reciproc toate informațiile relevante.

(2) Autoritatea de supraveghere principală poate solicita în orice moment altor autorități de supraveghere vizate să ofere asistență reciprocă în temeiul articolului 61 și poate desfășura operațiuni comune în temeiul articolului 62, în special în vederea efectuării de investigații sau a monitorizării punerii în aplicare a unei măsuri referitoare la un operator sau o persoană împuternicită de operator, stabilit(ă) în alt stat membru.

(3) Autoritatea de supraveghere principală comunică fără întârziere informațiile relevante referitoare la această chestiune celorlalte autorități de supraveghere vizate. Autoritatea de supraveghere principală transmite fără întârziere un proiect de decizie celorlalte autorități de supraveghere vizate, pentru a obține avizul lor, și ține seama în mod corespunzător de opiniile acestora.

(4) În cazul în care oricare dintre celelalte autorități de supraveghere vizate exprimă, în termen de patru săptămâni după ce a fost consultată în conformitate cu alineatul (3) din prezentul articol, o obiecție relevantă și motivată la proiectul de decizie, autoritatea de supraveghere principală, în cazul în care nu dă curs obiecției relevante și motivate sau consideră că obiecția nu este relevantă sau motivată, sesizează mecanismul pentru asigurarea coerenței menționat la articolul 63.

(5) În cazul în care intenționează să dea curs obiecției relevante și motivate formulate, autoritatea de supraveghere principală transmite celorlalte autorități de supraveghere vizate un proiect revizuit de decizie pentru a obține avizul acestora. Acest proiect revizuit de decizie face obiectul procedurii menționate la alineatul (4) pe parcursul unei perioade de două săptămâni.

(6) În cazul în care niciuna dintre celelalte autorități de supraveghere vizate nu a formulat obiecții la proiectul de decizie transmis de autoritatea de supraveghere principală în termenul menționat la alineatele (4) și (5), se consideră că autoritatea de supraveghere principală și autoritățile de supraveghere vizate sunt de acord cu proiectul de decizie respectiv, care devine obligatoriu pentru acestea.

(7) Autoritatea de supraveghere principală adoptă decizia și o notifică sediului principal sau sediului unic al operatorului sau al persoanei împuternicite de operator, după caz, și informează celelalte autorități de supraveghere vizate și comitetul cu privire la decizia în cauză, incluzând un rezumat al elementelor și motivelor relevante. Autoritatea de supraveghere la care a fost depusă plângerea informează reclamantul cu privire la decizie.

(8) Prin derogare de la alineatul (7), în cazul în care o plângere este refuzată sau respinsă, autoritatea de supraveghere la care s-a depus plângerea adoptă decizia, o notifică reclamantului și informează operatorul cu privire la acest lucru.

(9) În cazul în care autoritatea de supraveghere principală și autoritățile de supraveghere vizate sunt de acord să refuze sau să respingă anumite părți ale unei plângeri și să dea curs altor părți ale plângerii respective, se adoptă o decizie separată pentru fiecare dintre aceste părți. Autoritatea de supraveghere principală adoptă decizia pentru partea care vizează acțiunile referitoare la operator, o notifică sediului principal sau sediului unic al operatorului sau al persoanei împuternicite de operator de pe teritoriul statului membru în cauză și informează reclamantul cu privire la acest lucru, în timp ce autoritatea de supraveghere a reclamantului adoptă decizia pentru partea care vizează refuzarea sau respingerea plângerii respective, o notifică reclamantului și informează operatorul sau persoana împuternicită de operator cu privire la acest lucru.

(10) În urma notificării deciziei autorității de supraveghere principale în temeiul alineatelor (7) și (9), operatorul sau persoana împuternicită de operator ia măsurile necesare pentru a se asigura că activitățile de prelucrare sunt în conformitate cu decizia în toate sediile sale din Uniune. Operatorul sau persoana împuternicită de operator notifică măsurile luate în vederea respectării deciziei autorității de supraveghere principale, care informează celelalte autorități de supraveghere vizate.

(11) În cazul în care, în circumstanțe excepționale, o autoritate de supraveghere vizată are motive să considere că există o nevoie urgentă de a acționa în vederea protejării intereselor persoanelor vizate, se aplică procedura de urgență prevăzută la articolul 66.

(12) Autoritatea de supraveghere principală și celelalte autorități de supraveghere vizate își furnizează reciproc informațiile solicitate în temeiul prezentului articol, pe cale electronică, utilizând un formular standard.

Articolul 61

Asistență reciprocă

(1) Autoritățile de supraveghere își furnizează reciproc informații relevante și asistență pentru a pune în aplicare prezentul regulament în mod coerent și instituie măsuri de cooperare eficace între ele. Asistența reciprocă se referă, în special, la cereri de informații și măsuri de supraveghere, cum ar fi cereri privind autorizări și consultări prealabile, inspecții și investigații.

(2) Fiecare autoritate de supraveghere ia toate măsurile corespunzătoare necesare pentru a răspunde unei cererii a unei alte autorități de supraveghere, fără întârzieri nejustificate și cel târziu în termen de o lună de la data primirii cererii. Aceste măsuri pot include, în special, transmiterea informațiilor relevante privind desfășurarea unei investigații.

(3) Cererile de asistență cuprind toate informațiile necesare, inclusiv scopul cererii și motivele care stau la baza acesteia. Informațiile care fac obiectul schimbului se utilizează numai în scopul în care au fost solicitate.

(4) Autoritatea de supraveghere solicitată nu poate refuza să dea curs cererii, cu excepția cazului în care:

(a)nu are competență privind obiectul cererii sau măsurile pe care este solicitată să le execute; sau

(b)a da curs cererii ar încălca prezentul regulament sau dreptul Uniunii sau dreptului intern sub incidența căruia intră autoritatea de supraveghere care a primit cererea.

(5) Autoritatea de supraveghere căreia i s-a adresat cererea informează autoritatea de supraveghere care a transmis cererea cu privire la rezultate sau, după caz, la progresele înregistrate ori măsurile întreprinse pentru a răspunde cererii. Autoritatea de supraveghere solicitată își motivează fiecare refuz de a da curs cererii în temeiul alineatului (4).

(6) Ca regulă, autoritățile de supraveghere solicitate furnizează informațiile solicitate de alte autorități de supraveghere pe cale electronică, utilizând un formular standard.

(7) Autoritățile de supraveghere solicitate nu percep nicio taxă pentru acțiunile întreprinse de acestea în temeiul unei cereri de asistență reciprocă. Autoritățile de supraveghere pot conveni asupra unor norme privind retribuțiile reciproce în cazul unor cheltuieli specifice rezultate în urma acordării de asistență reciprocă în situații excepționale.

(8) În cazul în care o autoritate de supraveghere nu furnizează informațiile menționate la alineatul (5) din prezentul articol în termen de o lună de la primirea cererii din partea altei autorități de supraveghere, aceasta din urmă poate adopta o măsură provizorie pe teritoriul propriului stat membru, în conformitate cu articolul 55 alineatul (1). În acest caz, necesitatea urgentă de a acționa în temeiul articolului 66 alineatul (1) este considerată a fi îndeplinită și necesită o decizie obligatorie urgentă din partea comitetului, în conformitate cu articolul 66 alineatul (2).

(9) Comisia, printr-un act de punere în aplicare, poate specifica forma și procedurile pentru asistența reciprocă menționată în prezentul articol, precum și modalitățile de schimb de informații pe cale electronică între autoritățile de supraveghere și între autoritățile de supraveghere și comitet, în special formularul standard menționat la alineatul (6) din prezentul articol. Actele de punere în aplicare respective sunt adoptate în conformitate cu procedura de examinare menționată la articolul 93 alineatul (2).

Articolul 62

Operațiuni comune ale autorităților de supraveghere

(1) După caz, autoritățile de supraveghere desfășoară operațiuni comune, inclusiv investigații comune și măsuri comune de aplicare a legii, în care sunt implicați membri sau personal din autoritățile de supraveghere ale altor state membre.

(2) În cazul în care operatorul sau persoana împuternicită de operator deține sedii în mai multe state membre sau dacă un număr semnificativ de persoane vizate din mai multe state membre sunt susceptibile de a fi afectate în mod semnificativ de operațiuni de prelucrare, o autoritate de supraveghere din fiecare dintre statele membre respective are dreptul de a participa la operațiunile comune. Autoritatea de supraveghere care este competentă în conformitate cu articolul 56 alineatul (1) sau alineatul (4) invită autoritățile de supraveghere din fiecare dintre aceste state membre să ia parte la operațiunile comune respective și răspunde fără întârziere la cererea de participare a unei autorități de supraveghere.

(3) O autoritate de supraveghere poate, în conformitate cu dreptul intern și cu acordul autorității de supraveghere din statul membru de origine, să acorde competențe, inclusiv competențe de investigare, membrilor sau personalului autorității de supraveghere din statul membru de origine implicați în operațiuni comune sau, în măsura în care dreptul statului membru al autorității de supraveghere din statul membru de primire permite acest lucru, poate autoriza membrii sau personalul autorității de supraveghere din statul membru de origine să își exercite competențele de investigare în conformitate cu dreptul statului membru al acestei din urmă autorități. Astfel de competențe de investigare pot fi exercitate doar sub coordonarea și în prezența membrilor sau personalului autorității de supraveghere din statul membru de primire. Membrii sau personalul autorității de supraveghere din statul membru de origine sunt supuși dreptului intern sub incidența căruia intră autoritatea de supraveghere din statul membru de primire.

(4) În cazul în care, în conformitate cu alineatul (1), personalul unei autorități de supraveghere din statul membru de origine își desfășoară activitatea într-un alt stat membru, statul membru de primire își asumă responsabilitatea pentru acțiunile personalului respectiv, inclusiv răspunderea pentru eventualele prejudicii cauzate de membrii personalului respectiv în cursul operațiunilor acestora, în conformitate cu dreptul statului membru pe teritoriul căruia își desfășoară operațiunile.

(5) Statul membru pe teritoriul căruia s-au produs prejudiciile repară aceste prejudicii în condițiile aplicabile prejudiciilor cauzate de propriul său personal. Statul membru de origine al autorității de supraveghere al cărei personal a cauzat prejudicii unei persoane de pe teritoriul unui alt stat membru rambursează acestui alt stat membru totalitatea sumelor pe care le-a plătit persoanelor îndreptățite în numele acestora.

(6) Fără a aduce atingere exercitării drepturilor sale față de terțe părți și cu excepția alineatului (5), fiecare stat membru se abține, în cazul prevăzut la alineatul (1), de la a pretinde de la un alt stat membru rambursarea despăgubirilor pentru prejudiciile menționate la alineatul (4).

(7) În cazul în care este planificată o operațiune comună, iar o autoritate de supraveghere nu se conformează, în termen de o lună, obligației prevăzute în a doua teză a alineatului (2) din prezentul articol, celelalte autorități de supraveghere pot adopta o măsură provizorie pe teritoriul statului membru al respectivei autorități, în conformitate cu articolul 55. În acest caz, necesitatea urgentă de a acționa în temeiul articolului 66 alineatul (1) este considerată a fi îndeplinită și necesită un aviz de urgență sau o decizie obligatorie urgentă din partea comitetului, în conformitate cu articolul 66 alineatul (2).

Secțiunea 2

Articolul 63

Mecanismul pentru asigurarea coerenței

Pentru a contribui la aplicarea coerentă a prezentului regulament în întreaga Uniune, autoritățile de supraveghere cooperează între ele și, după caz, cu Comisia prin mecanismul pentru asigurarea coerenței, astfel cum se prevede în prezenta secțiune.

Articolul 64

Avizul comitetului

(1) Comitetul emite un aviz de fiecare dată când o autoritate de supraveghere competentă intenționează să adopte oricare dintre măsurile de mai jos. În acest scop, autoritatea de supraveghere competentă comunică proiectul de decizie comitetului, atunci când:

(a)vizează adoptarea unei liste de operațiuni de prelucrare care fac obiectul cerinței de efectuare a unei evaluări a impactului asupra protecției datelor, în conformitate cu articolul 35 alineatul (4);

(b)în conformitate cu articolul 40 alineatul (7), se referă la conformitatea cu prezentul regulament a unui proiect de cod de conduită sau a unei modificări sau extinderi a unui cod de conduită;

(c)vizează aprobarea cerințelor pentru acreditarea unui organism în conformitate cu articolul 41 alineatul (3), a unui organism de certificare în conformitate cu articolul 43 alineatul (3) sau a criteriilor de certificare menționate la articolul 42 alineatul (5);

(d)vizează determinarea clauzelor standard în materie de protecție a datelor menționate la articolul 46 alineatul (2) litera (d) sau la articolul 28 alineatul (8);

(e)vizează autorizarea clauzelor contractuale menționate la articolul 46 alineatul (3) litera (a); sau

(f)vizează aprobarea regulilor corporatiste obligatorii în sensul articolului 47.

(2) Orice autoritate de supraveghere, președintele comitetului sau Comisia poate solicita ca orice chestiune de aplicare generală sau care produce efecte în mai mult de un stat membru să fie examinată de comitet în vederea obținerii unui aviz, în special în cazul în care o autoritate de supraveghere competentă nu respectă obligațiile privind asistența reciprocă în conformitate cu articolul 61 sau privind operațiunile comune în conformitate cu articolul 62.

(3) În cazurile menționate la alineatele (1) și (2), comitetul emite un aviz cu privire la chestiunea care îi este prezentată, cu condiția să nu fi emis deja un aviz cu privire la aceeași chestiune. Avizul respectiv este adoptat în termen de opt săptămâni cu majoritatea simplă a membrilor comitetului. Această perioadă poate fi prelungită cu șase săptămâni, ținându-se seama de complexitatea chestiunii. În ceea ce privește proiectul de decizie menționat la alineatul (1) transmis membrilor comitetului în conformitate cu alineatul (5), un membru care nu a emis obiecții într-un termen rezonabil indicat de președinte se consideră a fi de acord cu proiectul de decizie.

(4) Autoritățile de supraveghere și Comisia comunică pe cale electronică comitetului, fără întârzieri nejustificate, printr-un formular standard, orice informație relevantă, inclusiv, după caz, o sinteză a faptelor, proiectul de decizie, motivele care fac necesară adoptarea unei astfel de măsuri, precum și opiniile altor autorități de supraveghere vizate.

(5) Președintele comitetului informează pe cale electronică, fără întârzieri nejustificate:

(a)membrii comitetului și Comisia cu privire la orice informație relevantă care i-a fost comunicată, utilizând un formular standard. Secretariatul comitetului furnizează traduceri ale informațiilor relevante, acolo unde este necesar; și

(b)autoritatea de supraveghere menționată, după caz, la alineatele (1) și (2), și Comisia cu privire la aviz și îl publică.

(6) Autoritatea de supraveghere competentă menționată la alineatul (1) nu își adoptă proiectul de decizie menționat la alineatul (1) în termenul menționat la alineatul (3).

(7) Autoritatea de supraveghere competentă menționată la alineatul (1) ține seama pe deplin de avizul comitetului și comunică pe cale electronică președintelui comitetului, în termen de două săptămâni de la primirea avizului, dacă își va păstra sau își va modifica proiectul de decizie și, dacă este cazul, transmite proiectul de decizie modificat, utilizând un formular standard.

(8) În cazul în care autoritatea de supraveghere competentă menționată la alineatul (1) informează președintele comitetului, în termenul menționat la alineatul (7) din prezentul articol, că intenționează să nu se conformeze avizului comitetului, integral sau parțial, oferind motivele relevante, se aplică articolul 65 alineatul (1).

Articolul 65

Soluționarea litigiilor de către comitet

(1) Pentru a asigura aplicarea corectă și coerentă a prezentului regulament în cazuri individuale, comitetul adoptă o decizie obligatorie în următoarele cazuri:

(a) atunci când, în unul dintre cazurile menționate la articolul 60 alineatul (4), o autoritate de supraveghere vizată a formulat o obiecție relevantă și motivată la un proiect de decizie a autorității de supraveghere principale și autoritatea de supraveghere principală nu a dat curs obiecției sau a respins o astfel de obiecție ca nefiind relevantă sau motivată. ◄ Decizia obligatorie se referă la toate chestiunile vizate de obiecția relevantă și motivată, în special la chestiunea dacă prezentul regulament a fost încălcat;

(b)în cazul în care există opinii divergente cu privire la care dintre autoritățile de supraveghere vizate deține competența pentru sediul principal;

(c)în cazul în care o autoritate de supraveghere competentă nu solicită avizul comitetului în cazurile menționate la articolul 64 alineatul (1) sau nu ține seama de avizul comitetului emis în temeiul articolului 64. În acest caz, orice autoritate de supraveghere vizată sau Comisia poate comunica chestiunea comitetului.

(2) Decizia menționată la alineatul (1) se adoptă în termen de o lună de la prezentarea chestiunii, cu o majoritate de două treimi a membrilor comitetului. Acest termen poate fi prelungit cu o lună, ținându-se seama de complexitatea chestiunii. Decizia menționată la alineatul (1) se motivează și se adresează autorității de supraveghere principale și tuturor autorităților de supraveghere vizate, fiind obligatorie pentru acestea.

(3) În cazul în care comitetul nu a fost în măsură să adopte o decizie în termenele menționate la alineatul (2), acesta își adoptă decizia în termen de două săptămâni de la data expirării celei de a doua luni menționate la alineatul (2), cu o majoritate simplă a membrilor săi. În cazul în care membrii comitetului au opinii divergente în proporții egale, decizia se adoptă prin votul președintelui.

(4) Autoritățile de supraveghere vizate nu adoptă o decizie asupra chestiunii prezentate comitetului în conformitate cu alineatul (1) în termenele menționate la alineatele (2) și (3).

(5) Președintele comitetului notifică, fără întârzieri nejustificate, decizia menționată la alineatul (1) autorităților de supraveghere vizate. Comitetul informează Comisia cu privire la acest lucru. Decizia se publică pe site-ul comitetului, fără întârziere, după notificarea de către autoritatea de supraveghere a deciziei finale menționate la alineatul (6).

(6) Autoritatea de supraveghere principală sau, dacă este cazul, autoritatea de supraveghere la care s-a depus plângerea își adoptă decizia finală pe baza deciziei menționate la alineatul (1) din prezentul articol, fără întârziere nejustificată și în termen de cel mult o lună de la notificarea de către comitet a deciziei sale. Autoritatea de supraveghere principală sau, dacă este cazul, autoritatea de supraveghere la care s-a depus plângerea informează comitetul cu privire la data la care decizia sa finală este notificată operatorului sau persoanei împuternicite de operator și, respectiv, persoanei vizate. Decizia finală a autorităților de supraveghere vizate se adoptă în conformitate cu condițiile prevăzute la articolul 60 alineatele (7), (8) și (9). Decizia finală se referă la decizia menționată la alineatul (1) din prezentul articol și precizează faptul că decizia menționată la respectivul alineat va fi publicată pe site-ul al comitetului, în conformitate cu alineatul (5). La decizia finală se anexează decizia menționată la alineatul (1) din prezentul articol.

Articolul 66

Procedura de urgență

(1) În circumstanțe excepționale, atunci când o autoritate de supraveghere vizată consideră că există o necesitate urgentă de a acționa în scopul protejării drepturilor și libertăților persoanelor vizate, aceasta poate, prin derogare de la mecanismul pentru asigurarea coerenței menționat la articolele 63, 64 și 65 sau de la procedura menționată la articolul 60, să adopte de îndată măsuri provizorii menite să producă efecte juridice pe propriul său teritoriu, cu o perioadă de valabilitate determinată, care să nu depășească trei luni. Autoritatea de supraveghere comunică fără întârziere aceste măsuri și motivele adoptării lor celorlalte autorități de supraveghere vizate, comitetului și Comisiei.

(2) În cazul în care o autoritate de supraveghere a adoptat o măsură în temeiul alineatului (1) și consideră că este necesară adoptarea de urgență a unor măsuri definitive, aceasta poate solicita un aviz de urgență sau o decizie obligatorie urgentă din partea comitetului, indicând motivele pentru această solicitare.

(3) Orice autoritate de supraveghere poate solicita un aviz de urgență sau o decizie obligatorie urgentă, după caz, din partea comitetului în cazul în care o autoritate de supraveghere competentă nu a luat o măsură adecvată într-o situație în care există o necesitate urgentă de a acționa pentru a proteja drepturile și libertățile persoanelor vizate, indicând motivele pentru solicitarea unui astfel de aviz sau a unei astfel de decizii, inclusiv pentru necesitatea urgentă de a acționa.

(4) Prin derogare de la articolul 64 alineatul (3) și de la articolul 65 alineatul (2), un aviz de urgență sau o decizie obligatorie urgentă menționat(ă) la alineatele (2) și (3) de la prezentul articol este adoptat(ă) în termen de două săptămâni cu majoritate simplă a membrilor comitetului.

Articolul 67

Schimb de informații

Comisia poate adopta acte de punere în aplicare cu un domeniu de aplicare general pentru a defini modalitățile de realizare a schimbului electronic de informații între autoritățile de supraveghere, precum și între autoritățile de supraveghere și comitet, în special formularul standard menționat la articolul 64.

Actele de punere în aplicare respective sunt adoptate în conformitate cu procedura de examinare menționată la articolul 93 alineatul (2).

Secțiunea 3

Comitetul european pentru protecția datelor

Articolul 68

Comitetul european pentru protecția datelor

(1) Comitetul european pentru protecția datelor („comitetul") este instituit ca organ al Uniunii și are personalitate juridică.

(2) Comitetul este reprezentat de președintele său.

(3) Comitetul este alcătuit din șeful unei autorități de supraveghere din fiecare stat membru și din Autoritatea Europeană pentru Protecția Datelor sau reprezentanții respectivi ai acestora.

(4) În cazul în care într-un stat membru mai multe autorități de supraveghere sunt responsabile de monitorizarea aplicării dispozițiilor adoptate în temeiul prezentului regulament, se numește un reprezentant comun în conformitate cu dreptul intern al statului membru respectiv.

(5) Comisia are dreptul de a participa la activitățile și reuniunile comitetului fără a avea drept de vot. Comisia numește un reprezentant. Președintele comitetului comunică Comisiei activitățile comitetului.

(6) În cazurile menționate la articolul 65, Autoritatea Europeană pentru Protecția Datelor deține drept de vot numai cu privire la deciziile care privesc principiile și normele aplicabile în ceea ce privește instituțiile, organismele, oficiile și agențiile Uniunii care corespund pe fond cu cele din prezentul regulament.

Articolul 69

Independență

(1) Comitetul acționează independent în îndeplinirea sarcinilor sale sau în exercitarea competențelor sale în conformitate cu articolele 70 și 71.

(2) Fără a aduce atingere solicitărilor din partea Comisiei menționate la articolul 70 alineatele (1) și (2), comitetul, în îndeplinirea sarcinilor sale sau în exercitarea competențelor sale, nu solicită și nu acceptă instrucțiuni de la nicio parte externă.

Articolul 70

Sarcinile comitetului

(1) Comitetul asigură aplicarea coerentă a prezentului regulament. În acest scop, din proprie inițiativă sau, după caz, la solicitarea Comisiei, comitetul are, în special, următoarele sarcini:

(a)să monitorizeze și să asigure aplicarea corectă a prezentului regulament, în cazurile prevăzute la articolele 64 și 65, fără a aduce atingere sarcinilor autorităților naționale de supraveghere;

(b)să ofere consiliere Comisiei cu privire la orice aspect legat de protecția datelor cu caracter personal în cadrul Uniunii, inclusiv cu privire la orice propunere de modificare a prezentului regulament;

(c)să ofere consiliere Comisiei cu privire la formatul și procedurile pentru schimbul de informații între operatori, persoanele împuternicite de operatori și autoritățile de supraveghere pentru regulile corporatiste obligatorii;

(d)să emită orientări, recomandări și bune practici privind procedurile de ștergere a linkurilor către datele cu caracter personal, a copiilor sau a reproducerilor acestora de care dispun serviciile de comunicații accesibile publicului, astfel cum se menționează la articolul 17 alineatul (2);

(e)să examineze, din proprie inițiativă, la cererea unuia dintre membrii săi sau la cererea Comisiei, orice chestiune referitoare la aplicarea prezentului regulament și să emită orientări, recomandări și bune practici pentru a încuraja aplicarea coerentă a prezentului regulament;

(f)să emită orientări, recomandări și bune practici în conformitate cu prezentul alineat litera (e) în vederea detalierii criteriilor și condițiilor pentru deciziile bazate pe crearea de profiluri menționate la articolul 22 alineatul (2);

(g)să emită orientări, recomandări și bune practici în conformitate cu litera (e) din prezentul alineat pentru stabilirea încălcării securității datelor cu caracter personal și stabilirii întârzierilor nejustificate menționate la articolul 33 alineatele (1) și (2), precum și pentru circumstanțele speciale în care un operator sau o persoană împuternicită de către operator are obligația de a notifica încălcarea securității datelor cu caracter personal;

(h)să emită orientări, recomandări și bune practici în conformitate cu litera (e) din prezentul alineat în ceea ce privește circumstanțele în care o încălcare a securității datelor cu caracter personal este susceptibilă să genereze un risc ridicat pentru drepturile și libertățile persoanelor fizice, menționate la articolul 34 alineatul (1);

(i)să emită orientări, recomandări și bune practici în conformitate cu litera (e) din prezentul alineat în scopul detalierii criteriilor și cerințelor aplicabile transferurilor de date cu caracter personal bazate pe regulile corporatiste obligatorii care trebuie respectate de operatori și cele care trebuie respectate de persoanele împuternicite de operatori, precum și cu privire la cerințe suplimentare necesare pentru a asigura protecția datelor cu caracter personal ale persoanelor vizate menționate la articolul 47;

(j)să emită orientări, recomandări și bune practici în conformitate cu litera (e) din prezentul alineat în vederea detalierii criteriilor și cerințelor pentru transferurile de date cu caracter personal menționate la articolul 49 alineatul (1);

(k)să elaboreze orientări destinate autorităților de supraveghere, referitoare la aplicarea măsurilor menționate la articolul 58 alineatele (1), (2) și (3) și să stabilească amenzile administrative în conformitate cu articolul 83;

(l)să revizuiască aplicarea practică a orientărilor, recomandărilor și bunelor practici;

(m)să emită orientări, recomandări și bune practici în conformitate cu litera (e) din prezentul alineat în vederea stabilirii procedurilor comune de raportare de către persoanele fizice a încălcărilor prezentului regulament în conformitate cu articolul 54 alineatul (2);

(n)să încurajeze elaborarea de coduri de conduită și stabilirea unor mecanisme de certificare, precum și a unor sigilii și mărci în domeniul protecției datelor, în conformitate cu articolele 40 și 42;

(o)să aprobe criteriile de certificare în temeiul articolului 42 alineatul (5) și să țină un registru public al mecanismelor de certificare și al sigiliilor și mărcilor în materie de protecție a datelor, în temeiul articolului 42 alineatul (8), și al operatorilor certificați sau al persoanelor împuternicite de operatori certificate, stabiliți (stabilite) în țări terțe, în temeiul articolului 42 alineatul (7);

(p)să aprobe cerințele menționate la articolul 43 alineatul (3), în vederea acreditării organismelor de certificare menționate la articolul 43;

(q)să prezinte Comisiei un aviz privind cerințele de certificare menționate la articolul 43 alineatul (8);

(r)să prezinte Comisiei un aviz privind pictogramele menționate la articolul 12 alineatul (7);

(s)să prezinte Comisiei un aviz pentru evaluarea caracterului adecvat al nivelului de protecție într-o țară terță sau o organizație internațională, inclusiv pentru a determina dacă o țară terță, un teritoriu, sau unul sau mai multe sectoare specificate din acea țară terță, sau o organizație internațională nu mai asigură un nivel de protecție adecvat. În acest scop, Comisia pune la dispoziția comitetului toată documentația necesară, inclusiv corespondența purtată cu autoritățile publice ale țării terțe, în ceea ce privește acea țară terță, acel teritoriu sau acel sector, sau cu organizația internațională;

(t)să emită avize privind proiectele de decizii ale autorităților de supraveghere în conformitate cu mecanismul pentru asigurarea coerenței menționat la articolul 64 alineatul (1) privind chestiunile prezentate în conformitate cu articolul 64 alineatul (2) și să emită decizii obligatorii în temeiul articolului 65, inclusiv în cazurile menționate la articolul 66;

(u)să promoveze cooperarea și schimbul eficient bilateral și multilateral de informații și bune practici între autoritățile de supraveghere;

(v)să promoveze programe comune de formare și să faciliteze schimburile de personal între autoritățile de supraveghere, precum și, după caz, cu autoritățile de supraveghere ale țărilor terțe sau organizațiilor internaționale;

(w)să promoveze schimbul de cunoștințe și de documente privind legislația și practicile în materie de protecție a datelor cu autoritățile de supraveghere a protecției datelor la nivel mondial;

(x)să emită avize privind codurile de conduită elaborate la nivelul Uniunii în temeiul articolului 40 alineatul (9); și

(y)să țină un registru electronic accesibil publicului cu deciziile luate de autoritățile de supraveghere și de instanțe cu privire la chestiuni tratate în cadrul mecanismului pentru asigurarea coerenței.

(2) În cazul în care Comisia consultă comitetul, aceasta poate indica un termen limită, ținând seama de caracterul urgent al chestiunii.

(3) Comitetul își transmite avizele, orientările, recomandările și bunele practici Comisiei și comitetului menționat la articolul 93 și le face publice.

(4) Dacă este cazul, comitetul consultă părțile interesate și le oferă posibilitatea de a face observații într-un termen rezonabil. Fără a aduce atingere dispozițiilor articolului 76, comitetul publică rezultatele procedurii de consultare.

Articolul 71

Rapoarte

(1) Comitetul întocmește un raport anual privind protecția persoanelor fizice cu privire la prelucrare în Uniune și, dacă este relevant, în țări terțe și organizații internaționale. Raportul este pus la dispoziția publicului și transmis Parlamentului European, Consiliului și Comisiei.

(2) Raportul anual include o revizuire a aplicării practice a orientărilor, recomandărilor și bunelor practici menționate la articolul 70 alineatul (1) litera (l), precum și a deciziilor obligatorii menționate la articolul 65.

Articolul 72

Procedura

(1) Comitetul adoptă decizii prin majoritate simplă a membrilor săi, cu excepția cazului când se prevede altfel în prezentul regulament.

(2) Comitetul își adoptă propriul regulament de procedură cu o majoritate de două treimi a membrilor săi și își organizează propriile mecanisme de funcționare.

Articolul 73

Președintele

(1) Comitetul alege un președinte și doi vicepreședinți din rândul membrilor săi, cu majoritate simplă.

(2) Mandatul președintelui și al vicepreședinților este de cinci ani și poate fi reînnoit o singură dată.

Articolul 74

Sarcinile președintelui

(1) Președintele are următoarele sarcini:

(a)să convoace reuniunile comitetului și să stabilească ordinea de zi;

(b)să notifice deciziile adoptate de comitet, în conformitate cu articolul 65, autorității de supraveghere principale și autorităților de supraveghere vizate;

(c)să asigure îndeplinirea la timp a sarcinilor comitetului, în special în ceea ce privește mecanismul pentru asigurarea coerenței menționat la articolul 63.

(2) Comitetul stabilește în regulamentul său de procedură repartizarea sarcinilor între președinte și vicepreședinți.

Articolul 75

Secretariatul

(1) Comitetul dispune de un secretariat, care este asigurat de Autoritatea Europeană pentru Protecția Datelor.

(2) Secretariatul își îndeplinește sarcinile exclusiv pe baza instrucțiunilor președintelui comitetului.

(3) Personalul Autorității Europene pentru Protecția Datelor implicat în îndeplinirea sarcinilor conferite comitetului în temeiul prezentului regulament face obiectul unor linii de raportare separate în raport cu personalul implicat în îndeplinirea sarcinilor conferite Autorității Europene pentru Protecția Datelor.

(4) Dacă este oportun, comitetul și Autoritatea Europeană pentru Protecția Datelor elaborează și publică un memorandum de înțelegere pentru punerea în aplicare a prezentului articol, care să stabilească condițiile cooperării și să se aplice personalului Autorității Europene pentru Protecția Datelor implicat în îndeplinirea sarcinilor conferite comitetului în temeiul prezentului regulament.

(5) Secretariatul oferă sprijin analitic, administrativ și logistic comitetului.

(6) Secretariatul este responsabil în special de următoarele:

(a)gestionarea curentă a activității comitetului;

(b)comunicarea dintre membrii comitetului, președintele acestuia și Comisie;

(c)comunicarea cu alte instituții și cu publicul;

(d)utilizarea mijloacelor electronice pentru comunicarea internă și externă;

(e)traducerea informațiilor relevante;

(f)pregătirea și monitorizarea acțiunilor ulterioare reuniunilor comitetului;

(g)pregătirea, redactarea și publicarea avizelor, deciziilor privind soluționarea litigiilor dintre autoritățile de supraveghere și a altor texte adoptate de comitet.

Articolul 76

Confidențialitate

(1) Discuțiile din cadrul comitetului sunt confidențiale în cazul în care comitetul consideră că acest lucru este necesar în conformitate cu regulamentul său de procedură.

(2) Accesul la documentele prezentate membrilor comitetului, experților și reprezentanților părților terțe este reglementat prin Regulamentul (CE) nr. 1049/2001 al Parlamentului European și al Consiliului ().

CAPITOLUL VIII

Căi de atac, răspundere și sancțiuni

Articolul 77

Dreptul de a depune o plângere la o autoritate de supraveghere

(1) Fără a aduce atingere oricăror alte căi de atac administrative sau judiciare, orice persoană vizată are dreptul de a depune o plângere la o autoritate de supraveghere, în special în statul membru în care își are reședința obișnuită, în care se află locul său de muncă sau în care a avut loc presupusa încălcare, în cazul în care consideră că prelucrarea datelor cu caracter personal care o vizează încalcă prezentul regulament.

(2) Autoritatea de supraveghere la care s-a depus plângerea informează reclamantul cu privire la evoluția și rezultatul plângerii, inclusiv posibilitatea de a exercita o cale de atac judiciară în temeiul articolului 78.

Articolul 78

Dreptul la o cale de atac judiciară eficientă împotriva unei autorități de supraveghere

(1) Fără a aduce atingere oricăror alte căi de atac administrative sau nejudiciare, fiecare persoană fizică sau juridică are dreptul de a exercita o cale de atac judiciară eficientă împotriva unei decizii obligatorii din punct de vedere juridic a unei autorități de supraveghere care o vizează.

(2) Fără a aduce atingere oricăror alte căi de atac administrative sau nejudiciare, fiecare persoană vizată are dreptul de a exercita o cale de atac judiciară eficientă în cazul în care autoritatea de supraveghere care este competentă în temeiul articolelor 55 și 56 nu tratează o plângere sau nu informează persoana vizată în termen de trei luni cu privire la progresele sau la soluționarea plângerii depuse în temeiul articolului 77.

(3) Acțiunile introduse împotriva unei autorități de supraveghere sunt aduse în fața instanțelor din statul membru în care este stabilită autoritatea de supraveghere.

(4) În cazul în care acțiunile sunt introduse împotriva unei decizii a unei autorități de supraveghere care a fost precedată de un aviz sau o decizie a comitetului în cadrul mecanismului pentru asigurarea coerenței, autoritatea de supraveghere transmite curții avizul respectiv sau decizia respectivă.

Articolul 79

Dreptul la o cale de atac judiciară eficientă împotriva unui operator sau unei persoane împuternicite de operator

(1) Fără a aduce atingere vreunei căi de atac administrative sau nejudiciare disponibile, inclusiv dreptului de a depune o plângere la o autoritate de supraveghere în temeiul articolului 77, fiecare persoană vizată are dreptul de a exercita o cale de atac judiciară eficientă în cazul în care consideră că drepturile de care beneficiază în temeiul prezentului regulament au fost încălcate ca urmare a prelucrării datelor sale cu caracter personal fără a se respecta prezentul regulament.

(2) Acțiunile introduse împotriva unui operator sau unei persoane împuternicite de operator sunt prezentate în fața instanțelor din statul membru unde operatorul sau persoana împuternicită de operator își are un sediu. Alternativ, o astfel de acțiune poate fi prezentată în fața instanțelor din statul membru în care persoana vizată își are reședința obișnuită, cu excepția cazului în care operatorul sau persoana împuternicită de operator este o autoritate publică a unui stat membru ce acționează în exercitarea competențelor sale publice.

Articolul 80

Reprezentarea persoanelor vizate

(1) Persoana vizată are dreptul de a mandata un organism, o organizație sau o asociație fără scop lucrativ, care au fost constituite în mod corespunzător în conformitate cu dreptul intern, ale căror obiective statutare sunt de interes public, care sunt active în domeniul protecției drepturilor și libertăților persoanelor vizate în ceea ce privește protecția datelor lor cu caracter personal, să depună plângerea în numele său, să exercite în numele său drepturile menționate la articolele 77, 78 și 79, precum și să exercite dreptul de a primi despăgubiri menționat la articolul 82 în numele persoanei vizate, dacă acest lucru este prevăzut în dreptul intern.

(2) Statele membre pot prevedea că orice organism, organizație sau asociație menționată la alineatul (1) din prezentul articol, independent de mandatul unei persoanei vizate, are dreptul de a depune în statul membru respectiv o plângere la autoritatea de supraveghere care este competentă în temeiul articolului 77 și de a exercita drepturile menționate la articolele 78 și 79, în cazul în care consideră că drepturile unei persoane vizate în temeiul prezentului regulament au fost încălcate ca urmare a prelucrării.

Articolul 81

Suspendarea procedurilor

(1) În cazul în care o instanță competentă a unui stat membru are informații că pe rolul unei instanțe dintr-un alt stat membru se află o acțiune având același obiect în ceea ce privește activitățile de prelucrare ale aceluiași operator sau ale aceleași persoane împuternicite de operator, instanța respectivă contactează instanța din celălalt stat membru pentru a confirma existența unor astfel de acțiuni.

(2) Atunci când pe rolul unei instanțe dintr-un alt stat membru se află o acțiune având același obiect în ceea ce privește activitățile de prelucrare ale aceluiași operator sau ale aceleași persoane împuternicite de operator, orice altă instanță competentă decât instanța sesizată inițial poate suspenda acțiunea aflată la ea pe rol.

(3) În cazul în care o astfel de acțiune se judecă în primă instanță, orice instanță sesizată ulterior poate, de asemenea, la cererea uneia dintre părți, să-și decline competența, cu condiția ca respectiva acțiune să fie de competența primei instanțe sesizate și ca dreptul aplicabil acesteia să permită conexarea acțiunilor.

Articolul 82

Dreptul la despăgubiri și răspunderea

(1) Orice persoană care a suferit un prejudiciu materialesau moral ca urmare a unei încălcări a prezentului regulament are dreptul să obțină despăgubiri de la operator sau de la persoana împuternicită de operator pentru prejudiciul suferit.

(2) Orice operator implicat în operațiunile de prelucrare este răspunzător pentru prejudiciul cauzat de operațiunile sale de prelucrare care încalcă prezentul regulament. Persoana împuternicită de operator este răspunzătoare pentru prejudiciul cauzat de prelucrare numai în cazul în care nu a respectat obligațiile din prezentul regulament care revin în mod specific persoanelor împuternicite de operator sau a acționat în afara sau în contradicție cu instrucțiunile legale ale operatorului.

(3) Operatorul sau persoana împuternicită de operator este exonerat(ă) de răspundere în temeiul alineatului (2) dacă dovedește că nu este răspunzător (răspunzătoare) în niciun fel pentru evenimentul care a cauzat prejudiciul.

(4) În cazul în care mai mulți operatori sau mai multe persoane împuternicite de operator, sau un operator și o persoană împuternicită de operator sunt implicați (implicate) în aceeași operațiune de prelucrare și răspund, în temeiul alineatelor (2) și (3), pentru orice prejudiciu cauzat de prelucrare, fiecare operator sau persoană împuternicită de operator este răspunzător (răspunzătoare) pentru întregul prejudiciu pentru a asigura despăgubirea efectivă a persoanei vizate.

(5) În cazul în care un operator sau o persoană împuternicită de operator a plătit, în conformitate cu alineatul (4), în totalitate despăgubirile pentru prejudiciul ocazionat, respectivul operator sau respectiva persoană împuternicită de operator are dreptul să solicite de la ceilalți operatori sau celelalte persoane împuternicite de operator implicate în aceeași operațiune de prelucrare recuperarea acelei părți din despăgubiri care corespunde părții lor de răspundere pentru prejudiciu, în conformitate cu condițiile stabilite la alineatul (2).

(6) Acțiunile în exercitarea dreptului de recuperare a despăgubirilor plătite se introduc la instanțele competente în temeiul dreptului statului membru menționat la articolul 79 alineatul (2).

Articolul 83

Condiții generale pentru impunerea amenzilor administrative

(1) Fiecare autoritate de supraveghere asigură faptul că impunerea unor amenzi administrative în conformitate cu prezentul articol pentru încălcările prezentului regulament menționate la alineatele (4), (5) și, (6) este, în fiecare caz, eficace, proporțională și disuasivă.

(2) În funcție de circumstanțele fiecărui caz în parte, amenzile administrative sunt impuse în completarea sau în locul măsurilor menționate la articolul 58 alineatul (2) literele (a)-(h) și (j). Atunci când se ia decizia dacă să se impună o amendă administrativă și decizia cu privire la valoarea amenzii administrative în fiecare caz în parte, se acordă atenția cuvenită următoarelor aspecte:

(a)natura, gravitatea și durata încălcării, ținându-se seama de natura, domeniul de aplicare sau scopul prelucrării în cauză, precum și de numărul persoanelor vizate afectate și de nivelul prejudiciilor suferite de acestea;

(b)dacă încălcarea a fost comisă intenționat sau din neglijență;

(c)orice acțiuni întreprinse de operator sau de persoana împuternicită de operator pentru a reduce prejudiciul suferit de persoana vizată;

(d)gradul de responsabilitate al operatorului sau al persoanei împuternicite de operator ținându-se seama de măsurile tehnice și organizatorice implementate de aceștia în temeiul articolelor 25 și 32;

(e)eventualele încălcări anterioare relevante comise de operator sau de persoana împuternicită de operator;

(f)gradul de cooperare cu autoritatea de supraveghere pentru a remedia încălcarea și a atenua posibilele efecte negative ale încălcării;

(g)categoriile de date cu caracter personal afectate de încălcare;

(h)modul în care încălcarea a fost adusă la cunoștința autorității de supraveghere, în special dacă și în ce măsură operatorul sau persoana împuternicită de operator a notificat încălcarea;

(i)în cazul în care măsurile menționate la articolul 58 alineatul (2) au fost dispuse anterior împotriva operatorului sau persoanei împuternicite de operator în cauză cu privire la același obiect, respectarea respectivelor măsuri;

(j)aderarea la coduri de conduită aprobate, în conformitate cu articolul 40, sau la mecanisme de certificare aprobate, în conformitate cu articolul 42; și

(k)orice alt factor agravant sau atenuant aplicabil circumstanțelor cazului, cum ar fi beneficiile financiare dobândite sau pierderile evitate în mod direct sau indirect de pe urma încălcării.

(3) În cazul în care un operator sau o persoană împuternicită de operator încalcă în mod intenționat sau din neglijență, pentru aceeași operațiune de prelucrare sau pentru operațiuni de prelucrare conexe, mai multe dispoziții din prezentul regulament, cuantumul total al amenzii administrative nu poate depăși suma prevăzută pentru cea mai gravă încălcare.

(4) Pentru încălcările dispozițiilor următoare, în conformitate cu alineatul (2), se aplică amenzi administrative de până la 10 000 000 EUR sau, în cazul unei întreprinderi, de până la 2 % din cifra de afaceri mondială totală anuală corespunzătoare exercițiului financiar anterior, luându-se în calcul cea mai mare valoare:

(a)obligațiile operatorului și ale persoanei împuternicite de operator în conformitate cu articolele 8, 11, 25-39, 42 și 43;

(b)obligațiile organismului de certificare în conformitate cu articolele 42 și 43;

(c)obligațiile organismului de monitorizare în conformitate cu articolul 41 alineatul (4).

(5) Pentru încălcările dispozițiilor următoare, în conformitate cu alineatul (2), se aplică amenzi administrative de până la 20 000 000 EUR sau, în cazul unei întreprinderi, de până la 4 % din cifra de afaceri mondială totală anuală corespunzătoare exercițiului financiar anterior, luându-se în calcul cea mai mare valoare:

(a)principiile de bază pentru prelucrare, inclusiv condițiile privind consimțământul, în conformitate cu articolele 5, 6, 7 și 9;

(b)drepturile persoanelor vizate în conformitate cu articolele 12-22;

(c)transferurile de date cu caracter personal către un destinatar dintr-o țară terță sau o organizație internațională, în conformitate cu articolele 44-49;

(d)orice obligații în temeiul legislației naționale adoptate în temeiul capitolului IX;

(e)nerespectarea unui ordin sau a unei limitări temporare sau definitive asupra prelucrării, sau a suspendării fluxurilor de date, emisă de către autoritatea de supraveghere în temeiul articolului 58 alineatul (2), sau neacordarea accesului, încălcând articolul 58 alineatul (1).

(6) Pentru încălcarea unui ordin emis de autoritatea de supraveghere în conformitate cu articolul 58 alineatul (2) se aplică, în conformitate cu alineatul (2) din prezentul articol, amenzi administrative de până la 20 000 000 EUR sau, în cazul unei întreprinderi, de până la 4 % din cifra de afaceri mondială totală anuală corespunzătoare exercițiului financiar anterior, luându-se în calcul cea mai mare valoare.

(7) Fără a aduce atingere competențelor corective ale autorităților de supraveghere menționate la articolul 58 alineatul (2), fiecare stat membru poate prevedea norme prin care să se stabilească dacă și în ce măsură pot fi impuse amenzi administrative autorităților publice și organismelor publice stabilite în statul membru respectiv.

(8) Exercitarea de către autoritatea de supraveghere a competențelor sale în temeiul prezentului articol are loc cu condiția existenței unor garanții procedurale adecvate în conformitate cu dreptul Uniunii și cu dreptul intern, inclusiv căi de atac judiciare eficiente și dreptul la un proces echitabil.

(9) În cazul în care sistemul juridic al statului membru nu prevede amenzi administrative, prezentul articol poate fi aplicat astfel încât amenda să fie inițiată de autoritatea de supraveghere competentă și impusă de instanțele naționale competente, garantându-se, în același timp, faptul că aceste căi de atac sunt eficiente și au un efect echivalent cu cel al amenzilor administrative impuse de autoritățile de supraveghere. În orice caz, amenzile impuse trebuie să fie eficace, proporționale și disuasive. Respectivele state membre informează Comisia cu privire la dispozițiile de drept intern pe care le adoptă în temeiul prezentului alineat până la 25 mai 2018, precum și, fără întârziere, cu privire la orice act legislativ de modificare sau orice modificare ulterioară a acestora.

Articolul 84

Sancțiuni

(1) Statele membre stabilesc normele privind alte sancțiunile aplicabile în caz de încălcare a prezentului regulament, în special pentru încălcări care nu fac obiectul unor amenzi administrative în temeiul articolului 83, și iau toate măsurile necesare pentru a garanta faptul că acestea sunt puse în aplicare. Sancțiunile respective sunt eficace, proporționale și disuasive.

(2) Fiecare stat membru informează Comisia cu privire la dispozițiile de drept intern pe care le adoptă în temeiul alineatului (1) până la 25 mai 2018, precum și, fără întârziere, cu privire la orice modificare ulterioară a acestora.

CAPITOLUL IX

Dispoziții referitoare la situații specifice de prelucrare

Articolul 85

Prelucrarea și libertatea de exprimare și de informare

(1) Prin intermediul dreptului intern, statele membre asigură un echilibru între dreptul la protecția datelor cu caracter personal în temeiul prezentului regulament și dreptul la libertatea de exprimare și de informare, inclusiv prelucrarea în scopuri jurnalistice sau în scopul exprimării academice, artistice sau literare.

(2) Pentru prelucrarea efectuată în scopuri jurnalistice sau în scopul exprimării academice, artistice sau literare, statele membre prevăd exonerări sau derogări de la dispozițiile capitolului II (principii), ale capitolului III (drepturile persoanei vizate), ale capitolului IV (operatorul și persoana împuternicită de operator), ale capitolului V (transferul datelor cu caracter personal către țări terțe sau organizații internaționale), ale capitolului VI (autorități de supraveghere independente), ale capitolului VII (cooperare și coerență) și ale capitolului IX (situații specifice de prelucrare a datelor) în cazul în care acestea sunt necesare pentru a asigura un echilibru între dreptul la protecția datelor cu caracter personal și libertatea de exprimare și de informare.

(3) Fiecare stat membru informează Comisia cu privire la dispozițiile de drept intern pe care le-a adoptat în temeiul alineatului (2) precum și, fără întârziere, cu privire la orice act legislativ de modificare sau orice modificare ulterioară a acestora.

Articolul 86

Prelucrarea și accesul public la documente oficiale

Datele cu caracter personal din documentele oficiale deținute de o autoritate publică sau de un organism public sau privat pentru îndeplinirea unei sarcini care servește interesului public pot fi divulgate de autoritatea sau organismul respectiv în conformitate cu dreptul Uniunii sau cu dreptul intern sub incidența căruia intră autoritatea sau organismul, pentru a stabili un echilibru între accesul public la documente oficiale și dreptul la protecția datelor cu caracter personal în temeiul prezentului regulament.

Articolul 87

Prelucrarea unui număr de identificare național

Statele membre pot detalia în continuare condițiile specifice de prelucrare a unui număr de identificare național sau a oricărui alt identificator cu aplicabilitate generală. În acest caz, numărul de identificare național sau orice alt identificator cu aplicabilitate generală este folosit numai în temeiul unor garanții corespunzătoare pentru drepturile și libertățile persoanei vizate în temeiul prezentului regulament.

Articolul 88

Prelucrarea în contextul ocupării unui loc de muncă

(1) Prin lege sau prin acorduri colective, statele membre pot prevedea norme mai detaliate pentru a asigura protecția drepturilor și a libertăților cu privire la prelucrarea datelor cu caracter personal ale angajaților în contextul ocupării unui loc de muncă, în special în scopul recrutării, al îndeplinirii clauzelor contractului de muncă, inclusiv descărcarea de obligațiile stabilite prin lege sau prin acorduri colective, al gestionării, planificării și organizării muncii, al egalității și diversității la locul de muncă, al asigurării sănătății și securității la locul de muncă, al protejării proprietății angajatorului sau a clientului, precum și în scopul exercitării și beneficierii, în mod individual sau colectiv, de drepturile și beneficiile legate de ocuparea unui loc de muncă, precum și pentru încetarea raporturilor de muncă.

(2) Aceste norme includ măsuri corespunzătoare și specifice pentru garantarea demnității umane, a intereselor legitime și a drepturilor fundamentale ale persoanelor vizate, în special în ceea ce privește transparența prelucrării, transferul de date cu caracter personal în cadrul unui grup de întreprinderi sau al unui grup de întreprinderi implicate într-o activitate economică comună și sistemele de monitorizare la locul de muncă.

(3) Fiecare stat membru informează Comisia cu privire la dispozițiile de drept intern pe care le adoptă în temeiul alineatului (1) până la 25 mai 2018, precum și, fără întârziere, cu privire la orice modificare ulterioară a acestora.

Articolul 89

Garanții și derogări privind prelucrarea în scopuri de arhivare în interes public, în scopuri de cercetare științifică sau istorică ori în scopuri statistice

(1) Prelucrarea în scopuri de arhivare în interes public, în scopuri de cercetare științifică sau istorică ori în scopuri statistice are loc cu condiția existenței unor garanții corespunzătoare, în conformitate cu prezentul regulament, pentru drepturile și libertățile persoanelor vizate. Respectivele garanții asigură faptul că au fost instituite măsuri tehnice și organizatorice necesare pentru a se asigura, în special, respectarea principiului reducerii la minimum a datelor. Respectivele măsuri pot include pseudonimizarea, cu condiția ca respectivele scopuri să fie îndeplinite în acest mod. Atunci când respectivele scopuri pot fi îndeplinite printr-o prelucrare ulterioară care nu permite sau nu mai permite identificarea persoanelor vizate, scopurile respective sunt îndeplinite în acest mod.

(2) În cazul în care datele cu caracter personal sunt prelucrate în scopuri de cercetare științifică sau istorică ori în scopuri statistice, dreptul Uniunii sau dreptul intern poate să prevadă derogări de la drepturile menționate la articolele 15, 16, 18 și 21, sub rezerva condițiilor și a garanțiilor prevăzute la alineatul (1) din prezentul articol, în măsura în care drepturile respective sunt de natură să facă imposibilă sau să afecteze în mod grav realizarea scopurilor specifice, iar derogările respective sunt necesare pentru îndeplinirea acestor scopuri.

(3) În cazul în care datele cu caracter personal sunt prelucrate în scopuri de arhivare în interes public, dreptul Uniunii sau dreptul intern poate să prevadă derogări de la drepturile menționate la articolele 15, 16, 18, 19, 20 și 21, sub rezerva condițiilor și a garanțiilor prevăzute la alineatul (1) din prezentul articol, în măsura în care drepturile respective sunt de natură să facă imposibilă sau să afecteze în mod grav realizarea scopurilor specifice, iar derogările respective sunt necesare pentru îndeplinirea acestor scopuri.

(4) În cazul în care prelucrarea menționată la alineatele (2) și (3) servește în același timp și altui scop, derogările se aplică numai prelucrării în scopurile menționate la alineatele respective.

Articolul 90

Obligații privind păstrarea confidențialității

(1) Statele membre pot adopta norme specifice pentru a stabili competențele autorităților de supraveghere, prevăzute la articolul 58 alineatul (1) literele (e) și (f), în legătură cu operatori sau cu persoane împuternicite de operatori care, în temeiul dreptului Uniunii sau al dreptului internsau în temeiul normelor stabilite de organismele naționale competente, au obligația de a păstra secretul profesional sau alte obligații echivalente de confidențialitate, în cazul în care acest lucru este necesar și proporțional pentru a stabili un echilibru între dreptul la protecția datelor cu caracter personal și obligația păstrării confidențialității. Respectivele norme se aplică doar în ceea ce privește datele cu caracter personal pe care operatorul sau persoana împuternicită de operator le-a primit în urma sau în contextul unei activități care intră sub incidența acestei obligații de păstrare a confidențialității.

(2) Fiecare stat membru notifică Comisiei normele adoptate în temeiul alineatului (1) până la 25 mai 2018, precum și, fără întârziere, orice modificare ulterioară a acestora.

Articolul 91

Normele existente în domeniul protecției datelor pentru biserici și asociații religioase

(1) În cazul în care, într-un stat membru, bisericile și asociațiile sau comunitățile religioase aplică, la data intrării în vigoare a prezentului regulament, un set cuprinzător de norme de protecție a persoanelor fizice cu privire la prelucrare, aceste norme pot continua să se aplice, cu condiția să fie aliniate la prezentul regulament.

(2) Bisericile și asociațiile religioase care aplică un set cuprinzător de norme în conformitate cu alineatul (1) din prezentul articol sunt supuse supravegherii unei autorități de supraveghere independente care poate fi specifică, cu condiția să îndeplinească condițiile stabilite în capitolul VI din prezentul regulament.

CAPITOLUL X

Acte delegate și acte de punere în aplicare

Articolul 92

Exercitarea delegării

(1) Competența de a adopta acte delegate este conferită Comisiei în condițiile prevăzute de prezentul articol.

(2) Delegarea de competențe prevăzută la articolul 12 alineatul (8) și la articolul 43 alineatul (8) se conferă Comisiei pe o perioadă nedeterminată de la 24 mai 2016.

(3) Delegarea de competențe menționată la articolul 12 alineatul (8) și la articolul 43 alineatul (8) poate fi revocată în orice moment de Parlamentul European sau de Consiliu. O decizie de revocare pune capăt delegării de competențe specificată în decizia respectivă. Decizia produce efecte din ziua următoare datei publicării acesteia în Jurnalul Oficial al Uniunii Europene sau de la o dată ulterioară menționată în decizie. Decizia nu aduce atingere validității actelor delegate care sunt deja în vigoare.

(4) De îndată ce adoptă un act delegat, Comisia îl notifică simultan Parlamentului European și Consiliului.

(5) Un act delegat adoptat în conformitate cu articolul 12 alineatul (8) și cu articolul 43 alineatul (8) intră în vigoare numai în cazul în care nici Parlamentul European și nici Consiliul nu au formulat obiecțiuni în termen de trei luni de la notificarea acestuia Parlamentului European și Consiliului, sau în cazul în care, înainte de expirarea termenului respectiv, Parlamentul European și Consiliul au informat Comisia că nu vor formula obiecțiuni. Respectivul termen se prelungește cu trei luni la inițiativa Parlamentului European sau a Consiliului.

Articolul 93

Procedura comitetului

(1) Comisia este asistată de un comitet. Comitetul respectiv este un comitet în înțelesul Regulamentului (UE) nr. 182/2011.

(2) În cazul în care se face trimitere la prezentul alineat, se aplică articolul 5 din Regulamentul (UE) nr. 182/2011.

(3) În cazul în care se face trimitere la prezentul alineat, se aplică articolul 8 din Regulamentul (UE) nr. 182/2011 coroborat cu articolul 5 din respectivul regulament.

CAPITOLUL XI

Articolul 94

Abrogarea Directivei 95/46/CE

(1) Decizia 95/46/CE se abrogă cu efect de la 25 mai 2018.

(2) Trimiterile la directiva abrogată se interpretează ca trimiteri la prezentul regulament. Trimiterile la Grupul de lucru pentru protecția persoanelor în ceea ce privește prelucrarea datelor cu caracter personal instituit prin articolul 29 din Directiva 95/46/CE se interpretează ca trimiteri la Comitetul european pentru protecția datelor instituit prin prezentul regulament.

Articolul 95

Relația cu Directiva 2002/58/CE

Prezentul regulament nu impune obligații suplimentare pentru persoanele fizice sau juridice în ceea ce privește prelucrarea în legătură cu furnizarea de servicii de comunicații electronice destinate publicului în rețelele de comunicații publice din Uniune, cu privire la aspectele pentru care acestora le revin obligații specifice cu același obiectiv prevăzut în Directiva 2002/58/CE.

Articolul 96

Relația cu acordurile încheiate anterior

Acordurile internaționale care implică transferul de date cu caracter personal către țări terțe sau organizații internaționale, care au fost încheiate de statele membre înainte de 24 mai 2016 și care sunt în conformitate cu dreptul Uniunii aplicabil înainte de data respectivă, rămân în vigoare până când vor fi modificate, înlocuite sau revocate.

Articolul 97

Rapoartele Comisiei

(1) Până la 25 mai 2020 și, ulterior, la fiecare patru ani, Comisia transmite Parlamentului European și Consiliului un raport privind evaluarea și revizuirea prezentului regulament. Rapoartele sunt făcute publice.

(2) În contextul evaluărilor și revizuirilor menționate la alineatul (1), Comisia examinează în special aplicarea și funcționarea:

(a)capitolului V privind transferul datelor cu caracter personal către țări terțe sau organizații internaționale, având în vedere în special deciziile adoptate în temeiul articolului 45 alineatul (3) din prezentul regulament și deciziile adoptate în temeiul articolului 25 alineatul (6) din Directiva 95/46/CE;

(b)capitolul VII privind cooperarea și coerența.

(3) În scopul alineatului (1), Comisia poate solicita informații de la statele membre și de la autoritățile de supraveghere.

(4) La efectuarea evaluărilor și a revizuirilor menționate la alineatele (1) și (2), Comisia ia în considerare pozițiile și constatările Parlamentului European, ale Consiliului, precum și ale altor organisme sau surse relevante.

(5) Comisia transmite, dacă este necesar, propuneri corespunzătoare de modificare a prezentului regulament, în special ținând seama de evoluțiile din domeniul tehnologiei informației și având în vedere progresele societății informaționale.

Articolul 98

Revizuirea altor acte juridice ale Uniunii în materie de protecție a datelor

Dacă este cazul, Comisia prezintă propuneri legislative în vederea modificării altor acte juridice ale Uniunii privind protecția datelor cu caracter personal, în vederea asigurării unei protecții uniforme și consecvente a persoanelor fizice în ceea ce privește prelucrarea. Acest lucru privește în special normele referitoare la protecția persoanelor fizice în ceea ce privește prelucrarea de către instituțiile, organismele, oficiile și agențiile Uniunii, precum și normele referitoare la libera circulație a acestor date.

Articolul 99

Intrare în vigoare și aplicare

(1) Prezentul regulament intră în vigoare în a douăzecea zi de la data publicării în Jurnalul Oficial al Uniunii Europene.

(2) Prezentul regulament se aplică de la 25 mai 2018.

Prezentul regulament este obligatoriu în toate elementele sale și se aplică direct în toate statele membre.

# data[].attributes.attachment_link.description
02016R0679 - RO - 04.05.2016 - 000.002 Acest document are doar scop informativ și nu produce efecte juridice. Instituțiile Uniunii nu își asumă răspunderea pentru conținutul său. Versiunile autentice ale actelor relevante, inclusiv preambulul acestora, sunt cele publicate în Jurnalul Oficial al Uniunii Europene și disponibile pe site-ul EUR-Lex.

# data[].attributes.attachment_link.readable_text
You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Create an Account

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Already have an account? Log in

# data[].attributes.attachment_link.title
France: CNIL publishes guidance on employees' right of access

# data[].attributes.attachment_link.description
The French data protection authority ('CNIL') published, on 5 January 2022, guidance on the right of employees to access their data and professional emails. In particular, the guidance outlines the right of access more generally, noting that the principles relating to data protection apply to all personal data collected by an organisation and that, even in a professional context, an employee can therefore exercise his right of access to his employer.

# data[].attributes.attachment_link.title
Guidelines on the right to "data portability" (wp242rev.01)

# data[].attributes.body
https://curia.europa.eu/juris/liste.jsf?num=C-434/16

# data[].attributes.body
https://curia.europa.eu/juris/liste.jsf?language=en&td=ALL&num=C-154/21

# data[].attributes.headline
C-487/21 - Österreichische Datenschutzbehörde 

# data[].attributes.subject
C-487/21 - Österreichische Datenschutzbehörde 

# data[].attributes.headline
C-307/22 - FT (Copies du dossier médical) 

# data[].attributes.subject
C-307/22 - FT (Copies du dossier médical) 

# data[].attributes.body
https://curia.europa.eu/juris/documents.jsf?nat=or&mat=or&pcs=Oor&jur=C%2CT%2CF&num=C-307%252F22&for=&jge=&dates=&language=en&pro=&cit=none%252CC%252CCJ%252CR%252C2008E%252C%252C%252C%252C%252C%252C%252C%252C%252C%252Ctrue%252Cfalse%252Cfalse&oqp=&td=%3BALL&avg=&lgrec=en&page=1&lg=&cid=3354972

# data[].attributes.attachment_link.description
In a rare case of enforcement of Article 22(3) GDPR, a German DPA (Berlin) fined a bank €300,000 for not having provided the data subject with a meaningful explanation about the logic involved in an automated decision affecting them and all the elements necessary to challenge it.

# data[].attributes.attachment_link.readable_text
AEPD - PS/00281/2022

Authority:

AEPD (Spain)

Jurisdiction:

Spain

Relevant Law:

Article 4(1) GDPR
Article 58(2)(c) GDPR
Article 15 GDPR

Type:

Complaint

Outcome:

Upheld

Started:

24.03.2021

Decided:

21.04.2023

Published:

21.04.2023

Fine:

50000 EUR

Parties:

Securitas Direc España, S.A.

National Case Number/Name:

PS/00281/2022

European Case Law Identifier:

n/a

Appeal:

Unknown

Original Language(s):

Spanish

Original Source:

AEPD (in ES)

Initial Contributor:

isabela.maria.rosal

After acknowledging that technical log generated by a security device installed in the data subject's house is personal data, the Spanish DPA fined a security company for failing to comply with an order to provide this information to the data subject and imposed a fine of €50,000.

The data subject had contracted the controller to install a security device in their house. This device was equipped with motion detectors/camera that allowed monitoring of the location through a mobile application, along with other features such as remote control, sirens, key reader, smart keys, etc.

During a burglary, the security device was destroyed. The data subject did not receive any notification. For this reason, the data subject made an access request to the controller, asking for their personal data. However, the controller denied the request. The data subject filed a complaint with the Spanish DPA, which confirmed that the controller had to facilitate their access to the data and ordered it to to comply with the request pursuant to Article 58(2)(c).

After this decision, the controller provided a file with some of the requested data, but the data subject considered that the information was incomplete and incomprehensible and filed a new complaint. According to the data subject, the data did not include, for instance, the images captured by the device on the date of the invasion of their house. On the other hand, the controller claimed claimed that it just failed to provide technical activity logs used to control the performance of the device, since they are not personal data.

The DPA highlighted that the definition of personal data provided for by Article 4(1) GDPR should not be interpreted in a restrictive manner. In the present case, it considered that all technical logs generated by the device, including those exclusively operated by employees of the controller to monitor its performance, constitute data related to the data subject. According to the DPA, the device was installed at the data subject's house, based on a contract signed by them, and contained a unique numerical identifier, which allowed the identification of the data subject. As a result, the DPA stated that all data generated by the device is personal and is covered by the right of access provided for by Article 15 GDPR. Given that the controller failed to comply with the previous order to grant the data subject full access to their data, the DPA found a violation of Article 58(2)(c) GDPR and issued a fine of €50,000.

Share your comments here!

Share blogs or news articles here!

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/102







     File No.: PS/00281/2022

             RESOLUTION OF SANCTIONING PROCEDURE


Of the procedure instructed by the Spanish Agency for Data Protection and in
based on the following

                               BACKGROUND


FIRST: On 03/23 and 24/2021, a claim from A.A.A. is received, hereinafter,
the claimant) against SECURITAS DIREC ESPAÑA, S.A. with NIF A26106013
(hereinafter, the claimed party).

In it, it indicates that in procedure TD/01593/2017, the Agency issued a

resolution as follows: "Securitas must provide access to the appellant the
information on the servers (...) related to the records and signals sent
by the alarm equipment (...), as well as the existing copies of the records
contained in the internal memory of the alarm between 11/26 and 12/13 of the year
2015". This resolution was appealed by Securitas Direct S.A. and confirmed by the
National audience.


This procedure for the exercise of rights occurs as a consequence of the fact that the
claimant had previously exercised his right of access to the respondent on
04/07/2017: "regarding all the information on the Securitas servers
Direct relative to the records and signals sent by the alarm equipment installed in"
their property, "as well as existing copies of the records contained in the

internal memory of the alarm between November 26 and December 18 of the
year 2015 (before and after the robbery there were other security incidents that should be
also clarify)", "given that they have the unequivocal classification of data
personal". The information to which access is requested makes direct or
indirectly to events and occurrences (entries, exits, movements, jumps of
alarm, activation and deactivation of the alarm by certain user, etc.)

occurred inside my home, from which it can be inferred, directly or
indirectly, acts or behaviors related to myself, other people
of my family or even third parties authorized to access the home".

In relation to this right of access, the defendant responded on 05/11/2017 that
"the records contained in the alarm do not fall into the data category

personal", according to a copy of document 5 that he provides.

Not agreeing with the answer given by the security company, the claimant
mante files a claim with the Agency on 06/28/2017, in which, among other
issues, indicates that on the afternoon of 12/4/2015, he discovered, upon accessing his home,
who had suffered a robbery and found "the alarm center" destroyed, without having been
warned, receiving only a call from the security company of that same morning.

morning in which they indicated that there were connection problems. In the text of the re-
complaint filed with the Agency, the claimant states that the claimant "is
has refused to clarify the circumstances of the intrusion into our home or to
reveal the cause of the malfunctioning alarm system, ensure
checking that the system worked correctly", being the clients the ones who had to


C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/102







telephone the security company to inform them that the alarm center that
had installed had been destroyed by thieves.



The aforementioned claim was resolved on 01/2/2018 in the appeal for replacement of the

procedure for the exercise of rights TD/01593/2017, estimating the appeal and
requiring within a period that the right be met.

The defendant appealed the resolution before the National Court (AN), which in the
Judgment of the Administrative Litigation Chamber, first section, of 07/23/2019,

appeal 146/2018, dismissed his claim.
The judgment of the National Court was appealed before the Supreme Court in
appeal, admitted for processing on 05/29/2020, appeal 78/2020, however, the

claimed withdrew from it.
The claimant alludes in his new claim, that he has once again requested access on

02/2/2021 and received a response from the defendant of 02/23/2021, which highlights:


1) Responds: "in compliance, first of the resolution of the appeal for reversal
RR 779/2017 of the AEPD and the judgment of the National Court.", "attaching as

document 1, a list of "logs associated with said alarm system that are data
of a personal nature".

Document 1 starts:

"In order to understand the configuration of the table that we have prepared with the logs

which are personal data...", and explains the meanings of the three columns.

The provided Excel table of logs contains in the first column the date/s and time/
s in which the log, or logs, is generated. They are not arranged chronologically.
beginning by 5/12/2015. Only one log appears chronologically defined between two

dates, 5/12/2015 18:38:10 and 20:15:17. It comprises a total of 94 lines of
logs, plus that of the period, so it is unknown how many there would be in total.

The generation date or dates of the logs are correlated or grouped with the
"log name/nomenclature", and with a basic description such as "Signal

information", "CRA Action" (alarm receiving center), "tests and verifications
mandatory as part of the maintenance of the installation".

In the last column, with "extended description of the log", which according to the defendant
contains a description of the meaning of the log, in some cases the key N/A appears,
associated with a nomenclature, for example "CRA action Skip voicemail",

"operator gets to talk to contact", or "the contacts the operator gets to
Securitas tries to locate, they don't answer".

In others, it is not specified either by indicating: "a message is left on voice mail".


In some log it refers to "contact", without identifying or specifying which contact
refers, as "contact does not remember the password to prove the identity and
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/102







close the incident", or "the contacts that the Securitas operator tries to
locate no answer", "operator manages to speak with contact".

It is observed that there are logs that include: "automatically generated code and
randomly by the system for the security guard to deactivate the alarm"-,

name: "High priority central", or another name of the log: "tests and
obligatory verifications as part of the maintenance of the installation" connected
with "extended name: "the technician performs regulatory checks to
ensure the proper functioning of the system. At the request of the client you can modify
some parameter of the system itself.


The defendant points out that: "To simplify the information there are different dates and
hours associated with a log, and this is because we have grouped the dates and
hours in which they were generated in Mr.'s system."

The claimant considers that it has not been answered satisfactorily, because:


-Access to the information on the servers has been filtered/reduced by
Securitas to the logs that they consider personal data, an issue that does not
corresponds to do.

-"The table provided with schematic information does not satisfy the right of

exercised access. For example, on page one, in the nomenclature column
"CRA Action", it is stated "different generic actions of the operator
Securitas human resources in the event of a specific incident (e.g. authorization of the
speak/listen; call to the different listed contacts; internal comments on
relation to the information transmitted to you by contacts)" but without any indication of
What kind of action/information has been registered regarding the incidents

listed, which prevents the applicant for the right of access, understand and analyze said
logs, which is the ultimate goal of this access request."

-"Finally, the response from Securitas is non-existent regarding the second part of the
access request contained in the resolution: "existing copies of the records
contained in the internal memory of the alarm", "not having indicated in any

moment if those copies do not exist or access is not given because they do not consider that
they are not "personal data logs".

With the presentation of the claim by the claimant, he states that he has not
correctly attended to his right and with the elapsed time he is caused
helplessness


SECOND: The claim gave rise to the AEPD resolving on 09/17/2021 a
procedure for lack of attention to the exercise of rights (arts. 15 to 22 of the GDPR),
TD/00167/2021, in which in the process of transferring the claim for
Resolution (E/4382/2021), the defendant, stated on 05/19/2021:

-"The claimant of the right of access did not request at any time after the firmness

of the sentence its execution or that the

resolution of the Agency that was appealed in the same".

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/102







Confirms receipt of the claimant's letter requesting the exercise of the right of
access, to which he "responded with receipt of 03/03/2021."


-Consider that not all the logs that record the signals of the alarm equipment,
as well as the contents in the internal memory of the same can be considered that
contain personal data, and that was inferred from the verbatim of the sentence:
"Among the information on the servers..., if there are data of a
personnel of the owner of such contracted alarm". For this reason, it commissioned a report in 2020 to
a legal office that established it so, to differentiate them, which does not contribute, but

"makes available to the AEPD".

It indicates that, as a result of this exercise and this report, it currently has
a "management protocol".


It explains its position based on said Report, which is summarized below.

Based on the legal concept of personal data, in order to determine if the
information has the status of personal data because it relates to a natural person
identified or identifiable, it will be necessary to analyze the affectation that the information
produces in it.


"Regarding its content, the information must assume an attribute of any kind
predicable directly from the interested party in question, there being a direct relationship between-
three attribute and person.

Regarding its purpose, the processing of information must have as its purpose the co-
knowledge of the mentioned attribute of that person.

As for its effects. the information must refer to aspects that affect the interest
resed as a consequence of the aforementioned attribute."

In the explanatory term of what personal data is, it is defined by "all information

information about a natural person", it starts from when it refers to her, "and as con-
sequence, at the moment in which the information provided is not derived or linked
directly to the physical person, but to objects that belong to him or are under his control.
creep, only indirectly can the information be considered to refer to that
person and provided that it allows inferring data referring to that natural person and

not to the object itself. Therefore, information about an object will only have the
consideration of personal data when a connection or link is established between the
object and the affected party in order to generate information about said person".

The defendant has differentiated two categories in which the
different logs.

In the first category would be the logs that they consider do not imply

processing of personal data, which may include:

"- those in which information about an interested party is not collected through
said logs that individualize it from the rest of the population,


-The knowledge of said information is not intended in order to carry out a
analyzing or influencing behavior, and
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/102








- your rights and freedoms are not affected."


List the categories of logs that would be found in this scenario:

1) "Emission of signals of a purely technical nature for communication between the dis-
positive as part of the verification protocol of its correct functioning or
to register a technical failure.


2) Registration of informative signals in relation to, among others, the version of the system,
model or category of the installed device.

3) Descriptive record of internal and technical procedures before a specific event.


4) Recording of technical signals in relation to device configurations
that do not provide information about the interested party or their habits but simply
reflected in calibrations of the Securitas systems for their correct functioning.
I lie.

5) Statistical information about the devices."



It also alludes that "said logs" could contain information on technical processes.
Internal data of the defendant whose disclosure to third parties could imply dissemination of sec-
trade creds. For this purpose, it mentions recital 63 of the GDPR, as legitimate
maker of "discriminating the information that can be provided to the person who exercises
the access."

In a second category would be the logs that do consider that they imply treatment.
processing of personal data, to the extent that:

- "They collect information about an interested party and their intrinsic characteristics,

-Knowledge of said information is sought to analyze it or influence its behavior.

treatment,
-Your rights and freedoms are affected."

Adding or specifying that "not all logs in this category would imply the processing of

data processing of the contract holders", but rather "could imply the processing
processing of personal data of third parties". In this category would be included
the following logs."

1) "Processes carried out by Securitas operators or technicians, who occasionally
These may be considered personal data of a third party other than the client of Securi-
tas"


2) "The active interactions of the user himself -or third parties- with the physical systems
or through the mobile application.

3) "Passive interactions of the user or of third parties that may provide information
tion in relation to their way of acting at a given moment or their availability

in front of an event.
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/102








4) Records of identifiers of the interested parties that are contained in the logs, such
such as first and last name or email addresses."


5) Images or data in connection with an intrusion or sabotage. In this sense, it is pre-
ciso indicate that if the intruder is captured by the security camera, to the extent that
that said person is identifiable as a result of the image obtained, we would find ourselves
before a personal data of the same."


6) Pulsations entering codes that determine a particular situation of the in-
teresado.

7) Configurations of the user himself that determine a knowledge of his tastes
or behavior patterns.



It states that the access response provided to the claimant contained the logs
which are personal data that affect the client, being "excluded the

technical or that affect third parties".

-They add that they have sent an email to the claimant on 05/18/2021, provide a copy of do-
document 4 in which they refer to what was already sent on 02/26/2021, received by the claimant
keep on 03/03/2021.

-State that the causes that have motivated the original incidence of the claim
are due to the fact that "not all the logs generated by an alarm system are data from
personal character".

-On 06/07/2021, the Director of the AEPD agreed to "the agreement of admi-
processing, and the initiation of a procedure for the exercise of rights of the articles

15 to 22 GDPR", procedure TD/00167/2021.
-At the heart of said procedure, the defendant, (...), states:



a) In relation to the content of the "internal memory of the alarm installed in the
address of the claimant", this generated logs until 11/27/2021, 20:09, time and date
in which the intrusion into the home occurred - as you already know - during which
said alarm system was completely disabled. As of that date, no
could generate more logs of any kind. Therefore, in the time frame between 11/26 and

12/18/2015, the internal memory could only generate logs on 11/26 and 27/2015, and after
the analysis of the logs generated in the internal memory of the alarm, only consisted of a
log generated in that time frame, which was included in the response given to the claim
kept on 02/23/2021. They provide document 1, which is the table with columns of the access
so that the claimant was given on that date, in which it appears marked in green
fluorescent that log, and in which you can read:



"11/27/2015 20:09:47/HIGH PRIORITY CENTRAL CENTER/Automatically generated code and

randomly by the system for the security guard to deactivate the alarm".
They consider that they have complied with the right of access.

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/102









Already within the processing of TD/00167/2021, on 06/23/2021, the claimant was sent
Keep the copy of the response given by the defendant, and dated 07/16/2021, the re-
plaintiff stated:

-On the one hand, the information must be provided in a transparent and
intelligible. "The incomplete list of logs provided by Securitas Direct does not allow

to this party to understand in a transparent and intelligible manner the information contained in
your servers regarding the operation of the existing alarm system in my
home".

On the other hand, it indicates that what the defendant has done has been to prepare a list
of logs filtered by the contracted law firm, differentiating those that

may be considered to contain personal data of those that do not. Add
that this differentiation does not correspond to the one claimed and states that "the Hearing
Nacional considered that all the logs are personal data and from this it deduces
that access has been incomplete."


-Considers that giving access to the log is not fulfilled, but to "the information contained
in the servers relative to the registers and signals of the alarm equipment installed in
his property". It would consider that the resolution is fulfilled when "it has been given
access to all existing information on the servers in relation to the operation
of the alarm installed in my home". "The information operating on the servers in

relation to the operation of the alarm installed in my home goes much further
of these logs to which the Securitas Direct access right is intended, and
includes any information in the form of text, images, alphanumeric etc. existing
on its servers that is related to the records and signals of the
alarm installed in my home.


-Considers that the refusal of the defendant to provide access to the information
operating on its servers may be due to the fact that it intends to evade its responsibilities
individuals in relation to the damages caused in this robbery and "delay and
make it as difficult as possible to properly investigate the reasons for
poor functioning of the alarm system installed in my home".


-About the response provided to the log of the internal memory of the alarm,
considers implausible the assertion that the alarm center generated logs up to
20:09 on 11/27/2015, when the intrusion occurred and said system was disabled,
since that supposed intrusion actually refers to a jump of the alarm of the

perimeter detector of the garage door, room that is physically located
separated from the home and that it was not affected by the theft and estimates that the
intrusion into the home occurred on a date after 11/27, since "if the central
alarm was" destroyed, Securitas could hardly have disconnected
remotely the same.


It emphasizes that the request for access to the records contained in the memory is
They refer to both "the destroyed alarm center and the one that was installed in my home
on 12/5/2015 and that it continued generating signals and records".



C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 8/102







On 09/17/2021, the procedure for exercising rights was resolved,
agreeing to estimate the claim and granting a term to address the right. The
resolution was appealed for replacement on 10/18/2021, resolving on 10/27/2021 its

dismissal, and the defendant was notified electronically on 10/28/2021.


It is interesting to highlight from it, that the defendant, appellant, stated:

-The resolution of the procedure for the exercise of rights considers addressing the right,
but it does not determine the information that should be considered personal data, it does not

Give reasons for your conclusion. Nor does it establish "that the
All the logs generated by the installed alarm system have
effectively the consideration of personal data". It only details what the
claimed, that "it does not meet all of what was requested, specifying the reason", "without
determine if that totality will incorporate information that has nothing to do with the
data protection regulations".


"Nor is the claimant's claim that the SAN of 07/23/2019
will indicate that all the information or all the logs generated by the alarm system
have to be considered personal data.", since the sentence on its grounds
of the fourth right, indicates that "within the logs there are personal data", which

which allows us to conclude that "not all of them should be considered as such". Esteem
that "it is not possible to exercise the right of access to personal data with respect to
information that at no time can be considered personal data", and adds
that the AEPD in the different resolutions relapsed in this case has not defined that
information contains data that must be subject to the regulations for the protection of

data, "it is evident that" the defendant can define what information the
mentioned character".

"Neither the judgment of the AN nor the resolution have defined what information it contains
data that should be considered subject to the data protection regulations", therefore
that they will be the ones who have to delimit it.


Reproduces part of opinion 4/2017 on the concept of personal data adopted
on 06/20, WP 136:

"Sometimes, the information provided by the data refers not so much to

people as objects. These objects usually belong to someone, or may be
under the influence of or exert influence over a person or may have
a certain physical or geographical proximity to people or other objects. In those
cases, only indirectly can the information be considered to refer to those
people or objects.


A similar analysis can be applied when the data refer in the first instance to
processes or events, such as the operation of a machine when it is
human intervention is necessary. Under certain circumstances, this information
it can also be considered information "about" a person."


It shows its disagreement with the content of the resolution, which indicates "since the
claimant is the holder of the alarm contract, the regulations are applicable
on Data Protection regarding the right to access the logs on the
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 9/102







operation of the alarm installed on your property".

"In addition to recitals 26 to 28 for the conceptualization of the data

personal, not only have this condition the information that allows the identification
of the interested party, but also that which allows their identification.

For these purposes, the explanatory report of convention 223 of the Council of Europe on
10/10/2018 tries to clarify the content of individualization or singularization in
these terms:


"This individualization could be done, for example, by referring to him or her
specifically, or to a device or a combination of devices (computer,
mobile phone, camera, game devices etc.) on the basis of a number
identification, a pseudonym, biometric or genetic data, location data,

an IP address or other identifier. The use of a pseudonym or any
digital identifier/digital identity does not give rise to the anonymization of the data, since
that the interested party can still be identifiable or individualized. Therefore, the data
pseudonyms should be considered personal data and are covered by the
provisions of the agreement."


"The defendant considers that the information included in the alarm system may not
refer to an interested party, nor to its characteristics, attributes or behaviors, nor even
least affect it in any other way or allow the inference of information regarding
the same. Indeed, in general, these logs would consist of information that
They only refer to the communication between data systems merely

operational and technical that have nothing to do with an interested party or are linked to that of
no way, and only some of these logs could allow obtaining
information about the physical person who owns the alarm". Give three examples
related in the five cases in which in his report he considered "no data
personal", specifically:


In 1), "the battery level of the device, disconnection from the network, inhibition, etc."
It was about the "Issuance of signals of a purely technical communication nature
between the devices as part of the verification protocol of their correct
operation or to record a technical failure".


In 3), "waiting times processed before an event, collection and description
of the event, capture process and making available to the operators of the
images or sounds, modification of internal parameters, transfer of the event to a
operator etc. It referred to "Descriptive record of internal procedures and
technicians before a specific event".


In 5) "number of photos captured, activated devices, quality of responses
of the devices, number of disconnections, etc.). He meant "Information
statistics about devices.


He also gives examples of what he has previously classified as "data from
personal character", such as:



C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 10/102







In 1), "Securitas Direct personnel whose activity is registered in the
own logs". It referred to: "Processes carried out by operators or technicians of
Securitas, which can sometimes be considered personal data of a third party

different from the Securitas client"


In 3), "the Securitas Direct operator initiates a call and it is answered, or not
by the user, the security code is requested and the user includes it
correctly or not, no movements are recorded for a period of time
determined in the monitored area, etc. He was referring to: "Passive interactions of the

user or third parties who may provide information in relation to their form
to act at a certain moment or their availability in the face of an event.

In 6) "panic button or inclusion of the alarm deactivation code under
duress", referred to: Images or data in connection with an intrusion or sabotage. In
In this sense, it is necessary to indicate that if the intruder is captured by the security camera,

security, to the extent that said person is identifiable from the image
obtained, we would find ourselves before a personal data of the same."


In point 76 "the different (...)s that he uses, times of said (...)s, configurations
Personal information about device volume, language, selected parameters

on air quality or designation of names of users and zones, etc.", which
relates to: "Settings of the user himself that determine a knowledge of
their tastes or behavior patterns.

If all generated logs were given access, anyone would have the right to
said type of access due to the fact of having contracted the installation of a

alarm, with internal technical operations being "publicly accessible"
unrelated to a person and that reveal substantial information about the effectiveness and
operation of the commercialized systems, being able to violate the law of secrets
business 1/2019 of 02/20 and relates it to recital 63 of the GDPR."


Regarding the claimant's expression that it is not possible to understand the logs (action
CRA...) points out that the format to satisfy the right of access was to comply with
with the provisions of article 12 of the GDPR "in a concise, transparent,
intelligible and easily accessible, with clear and simple language" and that "the information is
is listed in the table attached to the brief of 02/23/2021", and that "even those

data is registered in a technical way and little intelligible for any person not
well-versed in the terminology of alarm systems, and even in the terminology itself
internal Securitas, so that its reading would not reveal the information that if
incorporated into the form sent to the interested party". He states that he "carried out a
adaptation of the logs to a clear and simple language to attend to the law". indicates
They have no objection to delivering the information in "lines of code formats",

although compliance with the requirements would satisfy the right to a lesser extent
required by the GDPR.

THIRD: On 11/4/2021, the claimant submits a document in which
states that the provisions of resolution TD/00167/2021 are still not being complied with.

On 12/2/2021, the AEPD sent a letter to the defendant, reiterating the request of the

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 11/102







compliance with the resolution, granting a term and warning of the consequences of its
breach.


On 12/21/2021, the defendant submits a document in which she states "satisfying
compliance with the resolution" and provide a copy of the letter of 12/14/2021 and documents
letter sent to the claimant. It states: "A job has been carried out again
exhaustive to provide D.xxx with any records and signals sent by the
alarm equipment that could be linked to the performance, behavior or
its characteristics, excluding information that is not considered

tion of personal data as it is exclusively technical information that also
affects the legitimate interest of Securitas Direct in the confidentiality of its secrets
business."


In relation to the records contained in the internal memory of the alarm between the
days November 26 and December 18, 2015, the (micro card or chip) of the
Securitas Direct alarm systems record and store information
from events with a technical origin and from events originating in the
interaction of devices installed in customers' homes. In the case of

equipment installed to D. xxx the records of the internal memory reach up to the moment
in which it was rendered useless and all records collected prior to that
At the moment, they are events of a technical nature, so it is not personal information."

It accompanies the records in "excel" sheets with the chronological ordering of logs by date.

date and time and more informative columns such as event", "event (...)", "Zone", "***COLUM-
NA.3", "***COLUMN.4". "***COLUMN.1""area", "time of (...)" to name only va-
laughs.

The description column contains short descriptive terms that are not common.
understandable, for example, EVENT: word whose specific meaning is not understandable
, the same as in "event (...)", and in general in all columns.


According to the defendant, it is the "literal transcription, in the format in which it is included in the
SD systems from the records and signals sent by the alarm equipment."

FOURTH: On 05/07/2022, the claimant submits a document in which he states
that the response of the defendant persists in classifying the logs that are data
personal of those who do not, when it does not correspond, reiterating that the matter has already been

ruled by the AN. He points out that the right continues to be ignored for years, returning
to the origins of the judgment of the AN. The picture is unintelligible, the expression of the
description is imprecise, the print is very small, most of the logs correspond to
the technical intervention to replace the destroyed alarm the day after the theft:
12/5/2015, therefore "completely useless and irrelevant". "They continue without

provide the information that motivates the exercise of the right of access, which is not
other than clarifying the circumstances of the robbery in my home and settling possible
responsibilities", and that "you need to know what happened with the alarm".

It requests, "the forced execution of its resolution be agreed...", without prejudice to the
"opening of a disciplinary procedure".


FIFTH: On 06/8/2022, the Director of the AEPD agreed:

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 12/102







"INITIATE SANCTION PROCEDURE against SECURITAS DIRECT ESPAÑA, S.A.,
with NIF A26106013, for the violation of article 58.2 c) of the GDPR, typified in art.
83.6 of the aforementioned GDPR and 72.1.m) of the LOPDGDD."


"For the purposes specified in the art. 64.2 b) of Law 39/2015, of 1/10, on Procedure
Common Administrative System of Public Administrations (LPACAP, hereinafter), the
sanction that could correspond would be 50,000 euros, without prejudice to what
results from the instruction."


Said initiation agreement was duly notified, granting the defendant a term
to make allegations

SIXTH: On 07/06/2022, the defendant made the following allegations:

1) He reiterates that during the year 2020, they commissioned a law firm to

report, of which they provide a copy in DOCUMENT 1 (signature date 01/29/2021) (already
mentions the same before in the response to the transfer of the claim of 05/19/2021,
content supra regarding TD/00167/2021), on the "application of the concept of
personal data to the signals or logs generated by the alarm systems", with the
object of whether all or part of them have the status of personal data to the

effects of the application of substantive regulations, and secondarily as


2) Document that for the future allows to attend the requests of exercise of
rights.


The report has on the cover: "confidential", unaware if it would reach all of its
content.

The report based on the historical definitions in the personal data legislation,
considers that the GDPR introduces an extensive concept, considering that "not only

The information that allows the identification of the interested party will have this condition, but
also the one that allows its "singularization", even when it was not possible to know
directly or indirectly to the person to whom the data refers.

It alludes to Convention 108 of the Council of Europe, of 01/28/1981, on the protection of

people in relation to the automated processing of their personal data, in
the wording resulting from the reform operated by Agreement 223, of the Council of
Europe, of October 10, 2018 (hereinafter, by the name commonly
accepted "108+ Agreement") establishes in its article 2 a) that for the purposes of the
Convention, personal data means "any information about a natural person

identified or identifiable" and in relation to the concept of identifiable person,
following the same line established in recital 26 of the GDPR, indicates the
paragraph §18 of its explanatory report: "The notion of "identifiable" refers not only to
the civil or legal identity of the individual as such, but also to what he can allow
"individualize" or single out (and therefore allow to treat differently) a
person from others. This "individualization" could be done, for example,

referring to him or her specifically, or to a device or a combination of
devices (computer, mobile phone, camera, gaming devices, etc.) on the
basis of an identification number, a pseudonym, biometric or genetic data,

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 13/102







location data, an IP address or other identifier. The use of a pseudonym or
any digital identifier / digital identity does not give rise to the anonymization of the
data, since the data subject can still be identifiable or individualized. Therefore, the

pseudonymous data should be considered personal data and is covered by the
provisions of the Convention. The quality of the applied pseudonymization techniques
should be duly taken into account when assessing the adequacy of safeguards
implemented to mitigate risks to stakeholders."

It follows that said concept is characterized by the necessary concurrence of

four essential elements:

-Personal data is, in any case, information.

-This information must refer to a certain person since it must be about the

same.

-The person to whom the information refers must be a natural person, remaining
excluded from the concept of personal data are legal persons or entities without
legal personality.


-The person must be identified or identifiable in the broad sense established by the
recital 26 of the GDPR and paragraph 18 of the agreement 108 + that identify the
concepts "that identifies" and identifiability, singularization and individualization."

He mentions various jurisprudence of the most noteworthy cases on the concept of

personal data from the European Union.

It considers that in order to determine, in accordance with the jurisprudence of the CJEU, whether a
information has the status of personal data because it refers to (or deals with) a
natural person identified or identifiable, it will be necessary to analyze the affectation that the

information produces in it:

 Regarding its content, that is, the information must assume an attribute, so
any kind, predicable directly from the interested party in question, there being a
direct relationship between said attribute and said person. In this way, the information
must appear linked to the interested party, excluding the concept of personal data

that information that is not linked to a characteristic or activity of the former.

 Regarding its purpose, that is, the processing of information must have as its
object the knowledge of the mentioned attribute predicable directly from that
person, the purpose of the treatment being linked to the analysis of said attribute.


 Regarding its effects, that is, the information must refer to aspects that
affect the interested party precisely as a consequence of the aforementioned attribute. Are
measures may vary in their intensity (e.g. from the mere fact of
contact him until a profiling is carried out and decisions are made that

significantly affect)."

It also analyzes several sentences handed down in Spain on the concept and scope
of personal data and the analysis of the concept of personal data of Opinion 4/2007

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 14/102







on the concept of personal data, adopted by GT29 (document WP136, from
06/20/2007).


It is indicated in the Opinion: "a piece of information refers to a person if it refers to his
identity, characteristics or behavior or if that information is used to
determine or influence the way in which it is treated or evaluated".

"A consequence of the foregoing will be that at the moment in which the information
provided does not derive or is directly linked to the physical person but to objects

that belong to him or are under his influence, can only indirectly be considered
that the information refers to that person and provided that it allows inferring
data referring to that natural person and not to the object itself.", cites example 5 "value of
a house" that refers to the application of the data protection regulations according to the
use of that information.


"The value of a home is information about an object. Clearly, the rules
on data protection will not apply when that information is used
solely to illustrate the level of housing prices in a certain area.
However, under certain circumstances, that information must also be
considered as personal data. In effect, the home is an asset of your

owner and, as such, will be taken into account, for example, when calculating the
taxes to be paid by that person. In this context, it is unquestionable that such
information should be considered as personal data".

"The Working Group has previously addressed the question of when it can

information is considered to be "about" a person. Within the framework of his
discussions on data protection issues raised by labels
RFID, the Working Group noted that a "data refers to a person if it does
reference to his identity, his characteristics or his behavior or if that
information is used to determine or influence the way in which it is treated or

evaluates". Taking into account the cases mentioned above, and following the
same line of reasoning, it could be affirmed that in order to consider that the data
are "about" a person there must be an element "contained" or an element
"purpose", or a "result" element.

The "content" element is present in those cases where - in accordance with the

that a society tends to generally and vulgarly understand by the word "on" - is
provides information about a specific person, regardless of
any purpose that may be harbored by the data controller or
a third party, or the repercussion of that information on the interested party. Information
is "about" a person when it "refers" to that person, which should be

evaluated taking into account all the circumstances surrounding the case. By
For example, the results of a medical analysis clearly refer to the patient, or the
information contained in the file of a company under the name of
certain client clearly refers to him: In the same way, the information
contained in an RFID tag or a barcode embedded in the document

identity of a certain person refers to that person, as in the
future passports that will incorporate an RFID microprocessor.



C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 15/102







The presence of an element "purpose" may also be what determines that the
information to be "about" a certain person. It can be considered that
element "purpose" exists when the data is used or is likely to be used,

taking into account all the circumstances surrounding the specific case, with the
purpose of evaluating, treating in a certain way or influencing the situation or the
behavior of a person."

Based on this, the defendant considers that "in order to consider that" information
is "about" a person must be found in at least one of the following three

assumptions or circumstances:

1. "Content": that is, that the information refers directly to a person
concrete physics. If this circumstance occurs, it will be irrelevant what the purpose is.
of the person in charge of the treatment or of a third party recipient of the information or that

repercussion will have the treatment of this information in the interested party.

2. "Purpose": the information collected, although it does not refer directly to a
natural person, is used or is likely to be used for the purpose of evaluating, treating
in a certain way or influence a person's situation or behaviour.


 3. "Result": even assuming that none of the situations occur
above, information will be "about" a person when its use has repercussions on
the rights and interests of the same, being able to be treated differently from
other people as a result of the processing of such information."


The defendant states that:

- "Therefore, information about an object will only be considered as
personal data when a connection or link is established between the object and the
affected (particularly, but not necessarily, its owner) in order to

generate information about said person or promote an action on his part.

The defendant states that: "Once the concept of personal data has been analyzed from
legal, doctrinal and jurisprudential perspectives, it is now necessary to analyze the application
of the mentioned concept to the logs generated by the alarm systems of
Securitas Direct, in order to determine which of them will have the status of "data

personal", with the consequent application in relation to them of the regulations
of data protection."

"To carry out the analysis and qualification of the logs provided by Securitas Direct
As personal data, the following aspects have been taken into consideration:


to. It must be information, in any known format or form that
effectively imply the actual existence of data.

b. Said information must refer to a specific natural person, so the

The information contained in the logs must, at least, be found in one of the
following situations:



C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 16/102







- Is directly linked to a specific individual, in such a way that
provide direct information about their way of acting, their mental characteristics
or physical, your preferences, your abilities or any other pattern of behavior that

can be directly attributed to it; either

  - Can be used to evaluate or influence an individual in any way
determined or in his conduct; either

- Can directly affect the rights and interests of an individual

certain.

-"The information included in an alarm system may not refer to an interested party
nor to its characteristics, attributes or behaviors, nor even less affect it in any way.
any other way or allow the inference of information related to it. In

effect, in general, the aforementioned logs will consist of information that
They only refer to the communication between data systems merely
operational and technical that have nothing to do with an interested party, nor are they linked to it in any way.
no way and only some of these logs could allow information to be obtained
on the physical person who owns the alarm."


Based on these elements, two fundamental categories have been differentiated in
where the various logs provided by Securitas Direct could be found,

to. "Logs that do not imply processing of personal data". Reiterate the reasons and the
categories that he exhibited on 05/19/2021.


-Provides the differentiation in the same document 1:

An Annex I, which includes the specific "study" of the different logs that the security systems
Securitas generated in connection with the provision of its services to the claimant. Gave-
Cho Annex I contains, in turn, two different tables, grouping those lines of log
belonging to the claimant not considered as personal data (table I) (p. 23 to
30/105) and those that would have that consideration, in view of the analysis carried out

carried out throughout the Report (table II), (p. 30/105).

In Annex II, the "general analysis and without specific application to an interested party" is attached
specifically, of the consideration as personal data of the generic log lines that
can normally be used in Securitas Direct systems during the de-
development of its activity."

-Regarding Annex I, "given the amount of information provided, in relation to
with the logs", we have proceeded to identify them (both for table I and table II) by means of
you three columns:

1. In the first one, "date of the log line", the "dates and times

concrete appearance". It is appreciated that various dates and times can be grouped

2. In the second, the "name of the information" is included.
3. The following is: "extended description", "made up of both the information provided

by Securitas Direct during the various meetings held, as well as the
documents and tables received and the rest of the explanatory columns that are contained
in the log itself."
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 17/102







The defendant continues that: "Next, the" assessment of the
character of personal data of each of the logs" by including two co-
additional columns:

b. "In the fourth column, we proceed to assess whether the information contained in the line
particular log file allows Securitas Direct to collect information about the Claimant or

a third party, or analyze and cause an impact on their behavior", under the denomination
tion of: "linking, directly or through inference, to conduct or information
insult of a natural person".

It is observed that they contain terms, such as operator, client, authorized user, con-

tacts designated by this, interested applicant of the right.

c. The last column specifies whether the log line can be considered, starting from
everything indicated, as personal data or not, with the literal Is it considered personal data?
No, in all those of table I, while table II, in "Is it considered personal data"?
nal?" figure "Yes", and a column is added: "It is likely to be provided

in response to the exercise of the right of access of the interested party?, appearing in some
In our cases: yes, and in other different annotations, since "lines of
log that could be considered personal data but refer to third parties
interested parties other than the Complainant himself and, it should be remembered, the request for access
exclusively allows the Claimant to have access to the personal data that

on his person deals with Securitas and not those on other natural persons."

In table I, "Information not considered personal data in relation to the request for
analyzed access" (23 to 30), highlight:


- In three descriptors figure - "Linking directly or through inference, to
conduct or information of a natural person": "There is no direct link
with information of the interested party to the extent that these are personal communications
periodic machine-machine device status checks", all with:
"extended description: Signals sent by the alarm that correspond to the state
of operation of the devices", which can respond in: "name of

information:
In one case: "Superv Photo PIR RADIO, RADIO REPEATER, RADIO VOLUMETRIC",
other: "radio repeater superv" and "radio volumetric superv"

-- - "Link directly or through inference, to a behavior or information

of a natural person": "There is no direct link with information of the inter-
resed to the extent that this log line does not collect information about the data subject.
nor is it intended to analyze or impact your behavior, it simply
allows an internal Securitas Direct process in relation to an initial alarm signal.
ma", and in "extended description": "Before the initial alarm signal, a time is given

type of margin in case it is a mistake or forgetfulness on the part of the user when not
deactivate the alarm.", "name of the information: trust wait 35 seconds
for a possible disconnection".

--- "Linking directly or through inference, to a behavior or information
of a natural person": "Information of a technical nature from Securitas Direct. In the me-

extent in which direct information about an attribute of the interested party is not transferred nor
Securitas Direct intends to analyze a pattern of conduct or to influence it in an al-
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 18/102







none, the information provided by the analyzed log line should not be considered
as personal data", "extended description: Detection of lack of electrical current
in the device", "name of the information: electric current-auto".


--- "Linking directly or through inference, to a behavior or information
of a natural person": "It is a change of internal priority of the incidence
motivated by a non-disconnected alarm signal" and in "extended description":
"Change the priority because the incident is sent to a manual queue.", "name
of information" "PRIO 25---20."



--"Linking directly or through inference, to a behavior or information of
a natural person": "There is no direct link to customer information
to the extent that they are informative signals of a technical nature". and in "des-

extended encryption: panel coverage level", "name of the information: se-
informative signal".

--"Linking directly or through inference, to a behavior or information of
a natural person": "This log line, although it provides information about a jump
alarm in the sensors, to the extent that direct information is not transferred

on an attribute of the data subject nor does Securitas Direct intend to analyze a pattern of
conduct or influence him in any way, the information provided by the log line
analyzed should not be considered as personal data. In this sense, it would be
of a description of the technical and internal process of Securitas Direct", and in "description
extended": "These log lines describe the process of the system and sensors in

detection of an intrusion. "Denomination of the information:-"INTRUSION VOLU-
METRIC RADIO, 27 11 2015, 20:09:47

--"Linking directly or through inference, to a behavior or information of
a physical person": "The signal, given its relevance, is transmitted to a machine operator

machine or human to start the management process. However, it is a process
internal data from which no personal data of the user can be inferred", "external description
tended": "Indicative that the incident is transmitted to a human or machine operator
na", "name information (...): 0".

-The only one that includes periods of days and dates indicates: -"Linking in a di-

directly or through inference, to a conduct or information of a natural person": "Without
detriment to the fact that as a result of any of these signals some type of action may be initiated.
situation that does involve the processing of personal data, the procedures and procedures
internal verification processes are essentially technical and it is not possible to infer any
some personal data about them", "extended description": "They describe periods in

where there is a loss of connection between the Securitas Direct servers and
the device installed in the address of the interested party. In this way, the devices
emit a periodic technical signal to confirm that it is indeed in
connection and ready to carry out their activity. Also, the logs describe the
internal and technical actions carried out as a result of this disconnection", "deno-

information mining: (...) TRANSFER".

--"Linking directly or through inference, to a behavior or information of
a natural person": "There is no link with the user to the extent that

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 19/102







This is an internal procedure that must be followed to provide the service
correct", and in "extended description": Technical information that the incident is
transferred to a human operator for management.", "name: GTI: incident

cancelled, client already exists in manual queue 14".

- -"Linking directly or through inference, to a behavior or information
of a natural person": "Information of a procedural and internal nature of Securitas
Direct", without extended description, "name of the information: GTI: incident
cancelled, pending maintenance".


--"Linking directly or through inference, to a behavior or information of
a natural person": "This log line, although it provides information about a jump
alarm in the sensors, to the extent that direct information is not transferred
on an attribute of the data subject nor does Securitas Direct intend to analyze a pattern of

conduct or influence him in any way, the information provided by the log line
analyzed should not be considered as personal data. In this sense, it would be
of a descriptive of the technical and internal process for the disposition of the images of
the detectors", and in "extended description: These log lines describe the
different processes of the systems and sensors since the actual intrusion is detected:
detection zone, image capture, availability of the same for the operator

ador, etc.", "name: PIR Radio photo intrusion", is considered personal data
is added: "NO (notwithstanding the foregoing, the captured images, in case there are
have captured a subject, they would be considered personal data and
should be provided to the interested party in the event that they had recruited him and not a
third).


--"Linking directly or through inference, to a behavior or information of
a natural person": "Information of a technical nature of Securitas Direct in relation to
with the movement detections through the different sensors of the system", and
in "extended description: System information in relation to a request for fo-

tography or image", "name of the information: Informative signal". Indicates no
is considered personal data, "Notwithstanding if these detections could imply the re-
collection of some type of information from an interested party, they could consider
tion of personal data and should be provided to the interested party in the event that they
they would have captured him and not a third party."


--"Linking directly or through inference, to a behavior or information of
a natural person": "no information is provided in relation to any character-
characteristic behavior pattern or other user information", without extended description,
"name of the information: no reason."



--"Linking directly or through inference, to a behavior or information of
a natural person": "information of a technical nature from Securitas Direct", without description
extended mention, "name of the information: power cuts: incidence with
restoration."


In table II, "information considered personal data in relation to the request for

analyzed access" (p. 31 to 48/105). In the column "Is it likely to be pro-
portioned in response to the exercise of the right of access of the interested party?, usually
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 20/102







figure Yes, but in some there are observations with caveats and in one figure,
NO.

The defendant informs that "certain records in the tables of this Annex ca-
They are of a specific date because they are general comments, independent of
tes of a specific line and with transversal affectation to the entire document."

-They appear without date:

-"Linking directly or through inference, to a behavior or information of

a natural person: "Of the joint information provided by: (i) alarm mode
selected by the user; (ii) date of the specific log and (iii) information derived from the
"time of (...)", the knowledge of certain behavior patterns of
a user (e.g. from a certain hour in the afternoon on weekdays the interested party
applies a (...) determined with what it is possible that you are not at home)",
"extended description: "alarm connection mode and time the alarm takes

connected in said mode", "name of the information: (...) and time of (...)."

- "Link directly or through inference, to a behavior or information of
a natural person: The highest priorities are directly related to the user
while low priorities correspond to logs of control and technical verification.
co from which user information cannot be inferred", "extended description:
The different figures included in the column "***COLUMNA.3" of the log are priorities
assigned according to the type of signal being received. The lower the numerical value, the higher the priority.

ty (generally with the interested party's own actions such as SOS calls); to ma-
higher numerical value, lower priority (generally related to incidents of
technical character). There is an added annotation of: "Is it likely to be proportionate?"
nothing in response to the exercise of the right of access of the interested party?": "Only
Select those priorities qualified as high and connected with an action or situation.

particular decision of the interested party (e.g. priorities linked to situations of panic or distress)
rro)."

--"Linking directly or through inference, to a behavior or information of
a natural person: these denominations of the areas, insofar as they are areas of the
property of the user defined by the same and carry information about the choices of the user.
interested, would imply personal data", "extended description: throughout the log
find denominations, decided by the interested party, to name certain areas

of the property, perimeter example, garage door, etc.", "name of the information
mation: user defined area names on all blogs"

-Already with the log date, they appear, in all of them, that they are considered personal data, and
among others:

-"Linking directly or through inference, to a behavior or information of
a natural person: insofar as they are configurations carried out
by the interested party would imply knowledge of characteristics and preferences of the same
so they would be considered personal data", in "extended description

the device informs about different characteristics related to its configuration and pro-
programming, for example, in entry and exit times, siren volume, among others",
"name of the information signal information".

-"Linking directly or through inference, to a behavior or information of
a natural person": There is no direct link to information from a client

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 21/102







to the extent that they are informative signals of a technical nature and are not provided
provides information regarding any characteristic, behavior pattern, or other
information of a natural person.", "extended description: Automatically generated code

automatically and randomly by the system for the security guard to deactivate the alarm", "referred to as
information mining: central high priority". "It is likely to be proportionate
Is it in response to the exercise of the right of access of the interested party?" ": No.
11/27/2015

It is unknown why it is not classified in Table I.

- "Link directly or through inference, to a behavior or information of
a natural person: Direct action of an operator". "Extended Description": "The
operator begins incident management and makes verification calls
to the user and other persons indicated by the same in case of incident." "name-

information actuation Central Receiver Alarms-call to H/E"- "Is it sus-
capable of being provided in response to the exercise of the right of access by the
interested?" "In this sense, without prejudice to the fact that it is personal data, it is
of the operator and not of the interested party who exercises his right of access, since he does not
It is information about said interested party."

- "Link directly or through inference, to a behavior or information of

a natural person: The actions of an operator, which includes interaction with the
user or the contacts designated by the latter, involve obtaining information about
about said interested parties", extended description: "Different generic actions of the
Securitas Direct human operator in the event of a specific incident (e.g. authorization
from speaking/listening calls to the different listed contacts; internal comments on
regarding the information transmitted by contacts, etc.)." denomination of the

CRA performance training" "Is it likely to be provided in response to the
exercise of the right of access of the interested party? "They should only be provided as
part of the right of access to the records of actions directly related
with the applicant for the right and not the rest of the communications with other
authorized users or contacts provided by it. Also, you should not

provide the applicant with any information or analysis on the performance of the operator
provider, to the extent that it is a third party other than the interested party who
had exercised the right of access"

- Linking directly or through inference, to a behavior or information of
a natural person: The actions of an operator, which includes interaction with the
user or the contacts designated by the latter, involve obtaining information about
about said interested parties.", "extended description. The contacts that the operator

of Securitas Direct tries to locate they do not answer", "name of the information
"CRA-communicating performance. Is it likely to be provided as an answer
to the exercise of the right of access of the interested party? However, they should only
be provided as part of the right of access to the records of communications related to
related to the applicant for the right and not the rest of the communications with

other authorized users.

- Linking directly or through inference, to a behavior or information of
a natural person": The actions of an operator, which includes interaction with the
user or the contacts designated by the latter, involve obtaining information about
about said interested parties.", name of the information, "action CRA-salta mailbox
of voice" It is likely to be provided as a response to the exercise of the right

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 22/102







of access of the interested party? However, they should only be provided as part of the
right of access to records of communications related to the applicant
of the right and not the rest of the communications with other authorized users."

-Linking directly or through inference, to a behavior or information of
a natural person": The actions of an operator, which includes interaction with the
tacts designated by the user, involve obtaining information about said

interested parties, denomination of the information "CRA-operator performance gets ha-
speak with contact" or "CRA action-incorrect keyword", and CRA-LO action-
CSIN-localized without keyword with "extended description: contact does not remember
the keyword to prove the identity and close the incident ""Is it susceptible to
be provided in response to the exercise of the data subject's right of access?":
"However, only the data must be provided as part of the right of access.

records of communications related to the applicant of the right and not the
other communications with other authorized users."

- Linking directly or through inference, to a behavior or information of
a natural person": These logs provide information regarding the actions
tasks of an operator, that is, the verification that he actually follows the processes
internal Securitas Direct for these purposes", "extended description: Display of
keywords by the operator in case there is a contact with the

user for identification purposes.", name of the information "operator viewed
codewords on demand", It is likely to be provided as a response to the exercise
exercise of the right of access of the interested party? "Without prejudice to the fact that it is a data
personal, should not be provided to the data subject to the extent that it affects a
third person other than the exerciser of the right of access."

- Linking directly or through inference, to a behavior or information of
a natural person": "The actions of an operator, which includes interaction with the
user, involve obtaining information about the interested party", extended description

given: "the user is contacted", name of the information: "Service Req.:
***NUMBER.1", Is it likely to be provided as a response to the exercise of the
right of access of the interested party?

- Linking, directly or through inference, to a behavior or information.
tion of a natural person": Information relating to an operator of a procedural nature
mental and internal Securitas Direct, "extended description" Internal registration of the operator
that a specific incident is taking place", name of the information:

REGISTERED ACCESS: The user ***USER.1 accessed the client file, In
your case could be considered a personal data of the operator itself and, therefore, not
would be capable of being transferred to the interested party exercising the right of access."

- Linking directly or through inference, to a behavior or information of
a physical person": In principle, the routine tests and verifications that must be carried out
The Securitas Direct technician does not provide any information about the user.
unless they are specifically requested by said user, extended description

given: "The technician carries out the regulatory checks to ensure the
proper functioning of the systems. At the customer's request, you can modify some parameters.
system itself (e.g. sound, time, sensors, etc.), name of the information
mation: Compulsory tests and verifications as part of the maintenance of the ins-
felling". Is it likely to be provided as a response to the exercise of the right?
cho of access? If the technician introduces modifications or specific configurations

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 23/102







in the device at the request of the user, these parameters would be considered
as personal data that must be delivered to the interested party."

-" Linking directly or through inference, to a behavior or information of
a physical person": The registration of user actions supposes the obtaining of information
personal training on it", "extended description alarm cancellation

for the user codes to be entered", "name of the information: code-
user charges", "It is likely to be provided as a response to the exercise of the
right of access of the interested party?, YES."

- "Link directly or through inference, to a behavior or information of
a natural person": The record of actions related to a real intrusion, in case
of having captured an image of the intrusion provides personal information",
extended description: log line that refers to the image captured by the

systems when detecting a real intrusion. Name of the information "VIDEO-VID"
Is it likely to be provided as a response to the exercise of the right of action?
termination of the interested party? should not be provided to the requester of the right of access in-
formation relative to the images captured to the extent that it showers information
deals with an interested party other than the exercise of the right of access"

- "Link directly or through inference, to a behavior or information of

a natural person": the record of user actions supposes the obtaining of information
personal training on it", extended description: service injected event
from the application by the user- remote connections and disconnections. Diver-
many requests made from the user's mobile terminal", "name of the in-
central formation security low priority"

- "Link directly or through inference, to a behavior or information of
a natural person": the record of situations that may affect the user such as the

communication of a power outage involves obtaining information
staff about the same", "extended description: in this case the client is informed
by means of an email from a (...) due to a power outage of your alarm", "
denomination of the information electric current car".

-Linking directly or through inference, to a behavior or information of
a natural person": the record of user actions supposes the obtaining of information
personal training on it", "extended description: des(...) by app client

remote web", "name of user code information".

-Linking directly or through inference, to a behavior or information of
a natural person": the record of user actions supposes the obtaining of information
personal training on it", "extended description: confirmation of (...) ex-
total external, "name of the central information safety priority low

In ANNEX II, entitled "GENERAL STUDY ON THE CONSIDERATION OF DATA
PERSONNEL OF EACH LOG", (p. 53 at the end) we proceed to carry out the analysis,
"generally", and "without specific application to a specific interested party", of the consi-

deration as personal data from the generic log lines that can normally be
be used in the Securitas Direct systems during the development of its activity.



"Those log lines not derived directly from the ser-
security system defects provided by Securitas (i.e. logs with denomination
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 24/102







tion: FR0 to FSZ; ROF and ROI). Likewise, they have not been the object of study
The log lines that, according to the information provided by Securitas, do not
have practical application at the date of writing this report: IAC, ICA, PID,

PDD, TLL and TWC"
The table contains the identification of the logs based on three columns.

-The first column includes the "(...) of the signal", in alphabetical order, which usually includes

learn a code of three capital letters, which is "described" in the second column.
na with a general description, usually in English, some keys like FG ,SK
masking", OPDI Shutter, Sent when CP detects RX failure in FG, which they then refer to
in the third column: "extended description provided by SD"

It is observed that keys that appear in the document delivered to the claimant on
12/14/2021, in the "Signal classification" field, such as RPT, IGC do not appear in those classes.
see Annex II. In addition, there are codes such as the TAC that appears delivered to the

claimant as data and in annex II it is indicated that it is not personal data.

There are also keys (TTR or TTS) that appear NO in Is it considered personal data?
nal?, which indicates "This log line, although it conveys information about a possible sabotage,
The sensors do not provide information directly about the interested party or,
neither, on a pattern of behavior or an analysis of his personality. Therefore
to the extent that direct information about an attribute of interest is not conveyed
sado nor Securitas Direct intends to analyze or influence a pattern of conduct in

In any way, the information provided by the analyzed log line should not be con-
considered as personal data. In this sense, it is a description of the process
Securitas Direct technician and intern"

Some keys are related to "extended description provided by Securitas:
carrying out Securitas tests to verify the status of the FOG system", or in another
"verification under the Securitas Direct action protocol of the status of the system

ma FOG", or "information coverage level (...) of panel".
-The fourth column is titled: "Linking directly or through inference, to

conduct or information of a physical person", in which it is introduced in some lines
lines the reasoning on this question, and that as a consequence, gives rise to the in-
formation of the last column, called "Is it considered personal data?" with if, or
No. In the no, it can be associated with: "There is no direct link with information
of a client insofar as they are informative signals of a technical nature

and no information is provided in relation to any characteristic, pattern of con-
conduct or other information of a natural person."


2) Summarizes its actions over time, after obtaining the aforementioned report, in order to
to assess their performance in the exercise of the claimant's right.

a) -02/26/2021, response to the burofax received on 02/9/2021, in "in which we are required to

the "logs" generated by the alarm system for the requested period. In this writing
To provide the "logs" that we consider to be personal data, as they are
registered in our systems, and due to its configuration a description is included.
tion of it in order to make them intelligible, something that exceeds what we could do.
be done. This letter was received by the claimant on 03/03/2021. See pgs. 26 to 31

of the documentation in the file. "
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 25/102







-18/05/2021, as a consequence of the receipt of file E/04382/2021 (transfer-
of the claim in the procedure for the exercise of rights of the then: TD/
00167/2021), "the claimant is sent again, by email, the same response

provided on 02/26/2021, that is, the "logs" that have been considered to be da-
personal coughs. in accordance with the report made.

-12/14/2021, it is sent to the claimant again, as a consequence of the resolution of the
Appeal for Reversal No. RR/00658/2021 against TD/00167/2021, the same information
mation provided in the writings dated 02/26 and 05/18/2021. "This time in a
different format, per event, rather than aggregated, to make it easier to understand
these. See pgs. 153 to 160 of the documentation in the file."

"They have been sent in two different formats, grouped by event and individualized,
as they are registered in the systems by event date", "including information

information that would allow the claimant to understand it". It includes a des-
description of the meaning of the event. "The records generated by the systems have been
contributed as they are generated in them, and even so, efforts have been made to in-
They even exceeded the obligation of my client, so that the receiver could find
tend the event they reflect."

3) "SECURITAS DIRECT in writing submitted to the Agency on 06/18/2021, pages

106 and 107 of the file (within the TD/00167/2021) showed that it generates
ro logs until 8:09 p.m. on 11/27/2015, time and date on which the in-
burglary of the claimant's residence and during which said alarm system was
completely disabled from that date could not generate more logs."

In relation to the internal memory of the device, the one claimed also demonstrated

I state in its letter of 06/18/2021 that "after the analysis of the internal memory of the
alarm installed only had a log generated for that time frame which
It was recorded in our burofax of 02/26/2021 ".


He considers that "in December 2021 he had executed the exercise of the right of
access to data made by the claimant repeatedly"" in two formats

different, grouped by event and individualized, as recorded in the
systems by event date. A description of the significance of the event is included.

4) "The Agency considers in the initiation agreement that, without prejudice to having sent
to the claimant the records and signals requested and generated that are data
personal, "it would be possible to have provided all the "logs" to the
Agency, down to the smallest detail and mark them as confidential in the event that they are

opposed any eventual diffusion".

It calls into question the possibility of addressing in this way the right of access, to
not be reflected in any standard, considering it an indirect access to information through
through the AEPD, even when these are not personal data. Indicates that

has sent the claimant the personal data contained in the requested information
after its conclusion of its legal analysis report on logs, "within the period
requested", "in two different ways", and on three occasions.

5) Those that do not consider personal data are "logs of a technical nature, signals
information, descriptive records of internal and technical processes, configurations

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 26/102







of devices or statistical information, information containing technical processes
SD internals whose disclosure to third parties would imply in many cases the
communication of our know how".



"Wanting to comply with what was stated by the Agency in the written agreement
start", attached:

DOCUMENT 2, Excel table, which "contains all the records issued by the
alarm system on which the request falls "ordered chronologically", of

so that they appear sequentially, as they are produced: "In green color are data
personal according to the report.", and those of "red color, those that are not,
because they are technical and confidential, being subject to the regulations of secrets
industrial, and can be used only by the Agency".

"Of the total logs collected from the claimant's alarm system for the period

requested- 412 records- a total of 412 records have already been made available to the claimant.
273 records."

The Excel sheets provided are similar to the format provided to the claimant on
12/14/2021, and "reflect the records as they are, and appear recorded in the

systems."

Sometimes logs of the same date and time appear that are seen to be
considered personal data and another that is not, appearing with different keys of the "(...) of the
event", distinguished in red those considered not personal data, example

11/27/2016 20:09:47. There are even two logs in red, not personal data, at the same
Date and Time.

DOCUMENTS 3 and 4, Excel tables, somehow related to 2. They gather in
separately, those that are personal data logs (3), and those that are not (4), also in
the same colors as document 2. Document 3 contains, according to the

claimed, "the records issued by the alarm system on which the
petition. This document was provided to the claimant by burofax dated 12/14/2021
and reflects the records as they are, and appear registered in the systems." Appears
ordered chronologically, the first date being 11/27/2015, 8:09 p.m., and the same
day there are several records, the last one at 20:17:07, and the next one goes to 12/4/2015,

11:05:04

Document 4, with the technical logs that are not considered by the defendant of
personal character, begin in the record on 11/26/2015, and the following date is
11/27/2015, being the first of 9:39:43, and the last of 20:11:34. Despite the

statement of the defendant that the alarm was destroyed on 11/27/2015 at
20:09, there are logs (technical only) between 11/28 and 12/4/2015, except for 11/29. Each
day, four logs are reflected, with the common term "GTI MISSING TEST", (Log that
reports loss of communication with the device) up to 4, one per day. The day
12/4/2015 figure GTI: canceled incident, customer already exists in manual queue 14, without
any key in description or signal classification.


It summarizes that the logs associated with the claimant's alarm system that "does not
we consider data of a personal nature", are of a technical nature, signals
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 27/102







information, descriptive records of internal and technical processes, configurations
of devices with statistical information, information that contains processes
internal Securitas Direct technicians whose disclosure to third parties would imply in many

cases of communication of our "know now" with the damage that could be caused by
directly and with respect to the safety of all its customers indirectly".

6) -About the amount of the sanction of the initiation agreement:

a) Regarding 83.2.a) of the GDPR, consider that 2017 cannot be taken as

temporary start date as an aggravating circumstance since the first guardianship that year was
inadmissible by the Agency on the grounds that the logs were not considered data of a character
staff.

"Regarding the time elapsed in connection with the damage caused and the safety of

the facilities, the claimant has not gone to court, always through
administrative data protection, having used the claimed the "levers
laws" that agreed to their right and were offered within their reach, which cannot be
penalized." A response was given to the requested access before the start of the
disciplinary proceedings up to three times.


b) Regarding article 83.2.b) of the GDPR, "negligent action", based on the fact that the
claimant considered in October 2021, subjectively, that it had not yet been
complied with his request, he considers that it is not an entirely true approximation, since
that he had complied with the exercise of the right of access on two occasions, in
February and May 2021."


"What happened in December 2021, because this part, said without intention of
offend, he no longer knew how to comply again with the exercise of law, he proceeded to
submit to the claimant the same information already submitted in February and May of
2021 but with a different format (if both documents are collated, you can

check that the information of both is the same). Furthermore, in none of the
resolutions issued by the Agency, the possibility of contributing to it the
all the logs, marking the confidential ones, "as if it has been done in
this initiation agreement, without determining which article of the current regulatory framework
I contemplated such a possibility". The mere and repeated disagreement of the claimant, not
must be, by itself, the cause that motivates the infringement or, failing that, the imposition

of a fine"

7) Regarding the statement that there is a link between the offender's activity and the
data processing within the framework of the provision of its services, considers that
precisely, what is at issue in this case is whether the logs generated by the

alarm are personal data or not, something, that after the report that has been provided as
Document 1 allows us to differentiate that some are, that they have been delivered in various
occasions to the claimant and others that are not.

8) It considers that there are proven a series of mitigating factors that would allow the application of

"a degree less than that proposed in the initiation agreement". These mitigations would be:

a) It cannot be described as not having responded to the requests for the exercise of the right
as a serious infringement of article 72.1.k) of the GDPR, given that access was given in

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 28/102







February and May 2021, in part, but not in full, the right if it had been attended,
"It would be a mitigation to apply to the aforementioned article and consider it as a
minor offense that would fit into article 74.c of the LOPDGDD.", which indicates:


"The remaining infractions of a legal nature are considered minor and will prescribe after a year.

merely formal of the articles mentioned in sections 4 and 5 of article 83
of Regulation (EU) 2016/679 and, in particular, the following:

  c) Failure to respond to requests to exercise the rights established in the
Articles 15 to 22 of Regulation (EU) 2016/679, unless it is applicable

provided in article 72.1.k) of this organic law."


-There is due diligence, "for the sole purpose of complying with the claimant's request and

of the scope of the right of access to your personal data, making
an effort, including economic, was placed in the hands of a third party independent of
recognized prestige, for the purpose of disaggregating, among all its logs, which are
those considered as personal data (according to the definition of "data of
personal character") and which are not, and which are trade secrets"


-There is good faith, as demonstrated by the fact that "the right has been complied with
up to three times", "once he was clear about the criteria that logs are data
personal and which are not", always giving the same information. Depending on the criteria
of the AEPD, based on the initial agreement, all the logs have been provided.


-Considers that the action of the claimant expressing his dissatisfaction "with what
subjectively, it considers what the logs are and how they should be represented
on paper, it cannot be an additional condition for him to propose to impose
a fine that they understand to be disproportionate, but the opposite, should be grounds for
that the penalty is less than the proposal."


Request that the exercise of the right be considered fulfilled with all the logs now
contributed.


SEVENTH: On 11/23/2022, it was agreed to start a test practice period.



1-The claim filed by the
claimant and its documentation, the documents obtained and generated during the
phase of admission to processing of the claim, and the report of previous actions of

investigation that are part of procedure TD/00167/2021.

Likewise, it is considered reproduced for evidentiary purposes, the allegations to the
initiation of the referenced disciplinary procedure, presented by the defendant, and the
accompanying documentation.


2-Because they are related to the original petition, they are incorporated as evidence into the
procedure:

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 29/102







a) The documentation provided by the claimant and that obtained and collected from the
claimed regarding the protection of rights 1564/2016, resolved on 09/08/2016, as well
as documentation of both parties produced in its processing.


b) The documentation provided by the claimant and that obtained and collected from the
claimed regarding the protection of rights 1593/2017, as well as documentation of
both parties produced in the appeal for reversal resolved on 01/2/2018,
RR/779/2017, and the documents that are part of said files.


c) The documentation provided by the claimant and that obtained and collected from the
claimed regarding the protection of rights resolved by Agency TD/00167/2021,
the procedures related to it, including the transfer of the same to the defendant
E/4382/2021, and the admission for processing and management and processing thereof, as well as the
subsequent reversal appeal resolved RR 658/2021 of 10/27/2021.


d) The Judgment of the National Court (AN), Chamber of Administrative Litigation
first section, of 07/23/2019, resource 146/2018, and by relation, the order of the TS room
of Administrative Litigation first section, of 05/29/2020 number of
procedure 378/2020 for admission to processing of the appeal of the
claimed, from which he later withdrew, appearing as such, in the order of the TS, appeal

378/2020 of 09/15/2020 in which it is indicated that the representative of Securitas
"presented a brief on 07/24/2020, withdrawing from the appeal prepared", declaring
"terminated the appeal for withdrawal", and communicated to the AEPD in writing of the
Lawyer of the Admin. of Justice of 10/29/2020, appearing as an associated object of the
file: PS 2181 22 san and ts.


3. The defendant is requested to provide or report within fifteen days:

3.1-Provide a copy of the terms contained in the exercise of the right of access
Formulated by the claimant on 02/02/2021.


Response received on 12/30/2022.

In the first place, it stresses that the procedure followed is for infringement of the
Article 58.2.c) of the GDPR:


 "order the person in charge or person in charge of the treatment to attend to the requests for
exercise of the rights of the interested party under this Regulation".

For this, it considers relevant the distinction between the logs that have the condition of
personal data or those that refer to "aspects simply related to the

operation of commercialized alarm systems, the disclosure of which could
generate a violation of their right to trade secret, and the risk of
its future operation, by informing third parties unrelated to the
organization".


He believes that some of the questions that are raised in tests by the instructor,
"They are not related to the object of the procedure, but rather to the appropriate
operation of the contracted alarm system". The information you will provide
will be circumscribed "to the object of the procedure", on whether it gave "adequate compliance to

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 30/102







what was agreed by the AEPD", as well as "if the information that was not provided to the claimant,
in application of what has already been invoked in the allegations, they did or did not contain personal data
of that, without understanding that it is appropriate to provide information related to the

behavior in relation to the events that occurred at the claimant's home."


Provides burofax of the claimant on the exercise of law signed on 02/02/2021, with
shipping 02/9/2021, handwritten: received 02/10/2021.


The brief is based on the fact that "on December 4, 2015, the house suffered a
assault and robbery without the indicated alarm system being activated, which
detected, issued and received the proper alarm signal, being seriously damaged
the switchboard and resulting in the first news that Securitas Direct Spain had was the
Call from my represented, reporting on it. The alarm system came

suffering certain incidents with certain connectivity problems", to pass
to assess the demandability of the claimant by Securitas for the replacement costs of the
switchboard, after the incident, the suspension of the service from 12/23/2016, apparently
by cut due to non-payment of replacement costs, indicating the holders who gave
for terminated the contract and in turn requires a series of refunds of amounts in
various concepts.


Immediately afterwards, it reiterates the request for the information on servers regarding
the records and signals sent by the alarm equipment between 11/26 and
12/18/2015. He mentions the sentence of the AN, its firmness and requires his
compliance.


3.2-Copy of the contract signed with the claimant in which the conditions appear
general and specific information on the service and the exercise of rights,
including clause 14 of the privacy policy to which it alludes in its exercise of
rights from 04/07/2017.


Copy of the instructions delivered to the user, in writing, of the operation of the
service, informing you of the technical and functional characteristics of the system and the
responsibilities that come with joining it.

It is provided, as DOCUMENT NUMBER 3 contract number *** NUMBER.2

entered into on 07/30/2014 with the claimant (hereinafter, the "Agreement"), including, in
pages 9 and 10 of the document, clause 14, referring to data protection
personal.
From the "security service" contract, it is worth mentioning:


Particular conditions:

-Personal data is collected: e-mail, name, surname, address and telephone.
-The service includes the installation, maintenance and operation of
alarms.


General conditions



C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 31/102







-"2. description and scope of the services object of the contract, A) service of
installation and maintenance", states that the installation will include the elements and
components contemplated in the particular conditions of this contract and

Securitas Direct will provide a basic maintenance service that includes for the
client: remote verification services of the operation of all
components (technical check according to current regulations).

It also refers to the definition and distinction of fault, "the damage that prevents the
proper functioning of a security system to fulfill the purpose for which it is

is intended" and "technical problem" "that incident that implies the necessary
intervention by SECURITAS DIRECT for verification, whether or not in person, and that,
In no case prevent the full operation of the security system of the vehicle.
CUSTOMER."


Point B) refers to the connection service to the alarm receiving center.

-in 6: "customer obligations", it is established among others:


a) "You must, in any case, connect the alarm system every time you intend to avoid

the access of unauthorized persons to the place and, especially, each time the place
left abandoned and unguarded. Accreditation of the alarm connection
corresponds, in any case, to the CLIENT. Therefore, the contracting of the service of all
the controlled codes will be a requirement to reliably prove the
alarm connection status. If the CLIENT has not contracted the service

that allows you to prove that the alarm is connected, it corresponds to him to prove the
connection because the connection is an act that derives from the actions of the contracting party
the service and not SECURITAS DIRECT."

o) Notify at all times possible changes in contact persons or

telephone numbers in case it is necessary to locate him."


"10. RIGHTS OVER THE INSTALLATION Due to the rapid evolution
technology makes control and communication systems obsolete,
SECURITAS DIRECT will retain ownership of the installed security system for

be able to update the software and its components, for the sole purpose of providing
the most advanced security services.

- 14. PRIVACY POLICY


A) INFORMATION REGARDING CUSTOMER DATA PROTECTION: The
personal data provided by the CLIENT to SECURITAS DIRECT, as well as
any other data that could be provided throughout the contractual relationship, will be
included in a file, whose responsibility is SECURITAS DIRECT ESPAÑA, SAU...,
sole recipient of the data, with the main purpose of carrying out the relationship

contractual, own management of the activity, maintenance, development and control of
the contractual relationship. "



C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 32/102







"C) TREATMENT OF IMAGES AND/OR SOUNDS OBTAINED THROUGH THE
SECURITY SYSTEM WHEN THE EQUIPMENT INCORPORATES SYSTEMS
PHOTODETECTION. - When verifying an alarm jump by SECURITAS DIRECT


"SECURITAS DIRECT through its Alarm Receiving Center will capture and record
images and/or sounds through the security devices installed in the
places subject to protection of the CLIENT, in accordance with article 48 of the
Private Security Regulations, that is, verifying through all means
technicians within their reach the alarms received and once said verification is exhausted if

If appropriate, it will transmit said images and/or sounds obtained as a result of the
alarm jump treated to the competent police or judicial authority.

SECURITAS DIRECT acquires the status of Responsible for the management file of
video surveillance systems with access to the CLIENT's images, due to their

natural person and that the security system with access to images is
made at your private home. It will not be considered illegitimate interference
in the right to honor, to personal privacy and to one's own image, recruitment,
reproduction and processing of images and sounds due to a jump in
alarm generated by the image protection element installed and treated at
through the SECURITAS DIRECT Alarm Receiving Center.


The CLIENT may only have access to information on any incident or
recording made due to an alarm jump, sending a written request to
through the means that allow it, indicated in clause 20 of the
general conditions, in which the identity of the contract holder must be stated

accompanying a photocopy of your DNI, CIF, NIE or valid passport, as well as the date,
time and place where the recording presumably took place. SECURITAS DIRECT,
will guard the recordings obtained as a result of alarm jumps
generated by the security system installed, and will comply with its obligations of
conservation, uselessness and destruction."


The aforementioned contract includes in its Annex I, "the installation project", with the
characteristics of the study of location and risks, with the proposal of the design of
security and with the elements configured in the installation plan, as well as the
elements and risk areas protected through verification of alarm signals
by audio, image-video, and face-to-face.


Annex II refers to the: "ACTION PLAN", which includes, among others:


-"contact list", four people identified by first and last name, ordered

by increasing number, all with "keys". The first, the claimant, as a "client", the
person "who signs the contract, owner of the alarm system" associated with two
phones. The other three: "relationship with the subscriber": "relatives" with a telephone.
The four people are listed in the "standard action plan" in the chart, ordered
as "contact" from 1, the claimant, to 4.


-the password or "master" of the client, the duress password and the SECURITAS password.



C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 33/102







 Within the Action Plan, the "CONDITIONS OF THE SERVICE OF
OPERATION OF THE ALARM RECEIVER CENTER" highlighting among others:



-"CLIENT: Natural/legal person who signs the CONTRACT, who is the owner of the
alarm system described in the aforementioned CONTRACT and that is the holder of the word
master key. The CLIENT may in any case have the status of user "

"USER: Natural person to whom the CLIENT authorizes access to the property and the

use of the alarm system, making available the means of connection and/or
disconnection from it.

"CONTACT PERSONS: Natural person who may or may not coincide with the
CLIENT of the contract and who owns the master keyword."


2. KEYWORD It constitutes a necessary data for the provision of the service
hired. Its holder is obliged to maintain its confidentiality,
should not transmit it to third parties.

Keyword Types:


- SECURITAS code: Identifies SECURITAS DIRECT and must be provided by the same
in any telephone communication with any of the persons described in
section 1 of this document.


 - CLIENT MASTER Password: Identifies the CLIENT and the main contacts.
It must be provided by them when they contact SECURITAS DIRECT
by phone. Allows and gives access to all kinds of procedures and modifications,
whether administrative (contract, action plan, etc.), or operational (verification of
alarm jumps).


 - COACTION code: In the verification call before an alarm jump, you must
provided to SECURITAS DIRECT, by whoever is in the property before a
situation of real danger to their physical and/or patrimonial integrity

3. VERIFICATION PROCEDURE BEFORE ALARM TRIPS


 The SECURITAS DIRECT Alarm Center will execute the pertinent process of
verification of alarm jumps registered by the installed security system,
through the means at its disposal contracted or arranged by the CLIENT, such
such as, speaking, listening, image and/or call to the fixed telephone of the property, calling the

contact telephone numbers provided by the CLIENT in this document and, in its
case, sending the Go Service accompaniment to the Police or the Go Service to
Full Service verification, in the event that the CLIENT had contracted the latter
service.


SECURITAS DIRECT will issue the corresponding notice to the Security Forces and Bodies
Security (hereinafter, "F.C.S.") only in the event that reality is proven
of the event generating the alarm jump, once the verification has been carried out


C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 34/102







valid, through existing means, in accordance with current regulations in
private security matter.


For the purposes of initiating the action protocol, the alarm signals are considered to be
received at the Alarm Receiving Center from the capture of the
intrusion detection elements, the SOS button, the anti-robbery button, and the
coercion.

-In the contract there is a section that includes the protocol in cases of jumps in

alarm, "from pressing the SOS button, anti-robbery button, code of
duress and when the duress keyword is provided.", in case of "without
user disconnection": verifying "by accessing the speech-listening module of the
system and/or call to the fixed telephone number of the property, as long as this is available
last. If through these means:


 - An answer is obtained: the person will be identified with the keyword
teacher or contact If the keyword is correct, the user will be provided with the
precise technical instructions for you to disconnect the system.

 - If the keyword is not correct or no response is obtained: SECURITAS

DIRECT will proceed to comply with the verification procedures provided
in the current Private Security regulations as well as to use the means
complementary verification procedures such as proceeding to the verification call to
the MAIN and/or OPERATIONAL CONTACTS established, and/or the Warden of
Security and/or F.C.S. if it were a confirmed real alarm. In any case, the

The decision to issue the notice will correspond exclusively to SECURITAS DIRECT.

In the event that "user disconnection" occurs, it is the case in which the
alarm, and in less than 20 seconds (from the alarm jump), it receives
disconnection signal in the CRA. In this case, "an automatic

locution recorded through the speech listening module of the system, in which
will inform the client of the signal received as well as of the execution of the disconnection
by the user or authorized person and the cancellation of the incident"

"In the event that the disconnection signal is received in a time greater than the
indicated in the previous paragraph, SECURITAS DIRECT will proceed to verify the jump of

alarm by accessing the system's speech-listening module and/or calling the
Landline telephone of the property, provided that it is available, to carry out the
verifications that it deems appropriate according to its diligence as a Company of
Security and that are adjusted to the applicable Private Security regulations."


In document ANNEX III "certificate of installation and connection", it is indicated that "the
security elements and devices installed to the client correspond to the
security level 2, established in article 2 of order INT/316/11 of 1/02 and
have the corresponding approval according to the characteristics
established in UNE-EN 50130, 50131, 50132, 50133, 50136 and in the UNE Standard

CLC/TS 50398




C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 35/102







- In a table, the type of device of the elements that make up the system appears
installed.


 As DOCUMENT NUMBER 4, it provides the user manual of the
alarm (hereinafter, the "Manual") in its existing version at the time of the
contract with the claimant. Highlights of it:

-Control panel with GPRS transmission: GPRS communications (...), SMS, card
Securitas Direct SIM included. Supports image transmission. Talk/listen loud

sensitivity. The only one with a personal portable intercom to ask for help.
SOS button. Indoor siren. Supports up to 32 home automation control user interfaces

-Key reader/smart keys: allows you to easily activate and deactivate your alarm
without having to memorize complicated codes. Different modes can be activated: day,

perimeter...

-Motion detector with color camera and flash from our central station
we can see what happens in your home or business in case of alarm
take sequences of images built-in flash for night vision and deterrence


-Communications: "supervision of communications through a periodic test."

-For activation, it has various modes, how fully activated when leaving your home
so that all the detection zones of the security system are protected.
security, or partial modes: that can be activated day mode or activated mode

night or perimeter mode activated.

In description and use of the control panel with keyboard, the different
functions of the buttons listed, from the SOS function, in case of emergency that
can be sent to Securitas Direct with a light indicator indicating that it has been

correctly received the coverage light signal from the control panel, "(...)",
"hands-free" function to receive incoming calls and to answer,
calls to 112, and another series of functions.


3.3-Description of the operation of the contracted alarm system that was installed in

the claimant's property, composition of elements (switchboard of the
alarm located in the home, its components, control panel, sensors or
alarm detectors included in the system, alarm kit or other
system accessories and connection to the Alarm Receiving Center).


They are also asked to report the system or communication channel used by the
device installed in the claimant's home.

Point out that the manual describes on pages two and three the basic elements of
alarm system


The contract also included in terms of additional elements contracted:

A remote control, to connect-disconnect the alarm.

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 36/102







An external siren flash, which is located inside the installation and sounds when,
for example, the alarm is activated.


Two magnetic detectors, two seismic detectors (although the contract includes
Separately, they are the same devices, known as "shocksensors", that detect
opening, closing and vibration, do not collect images.")

An element of verification by audio speaks listens, "(It is located inside the
control panel and is to perform audio and listening checks in case of jump

alarm, it is also used to talk to the customer through the switchboard)."

Three verification elements by video sensor photodetector image, (Detectors with
camera that react to temperature changes detected by movement,
in such a way that, if they detect movement while connected, they trigger the alarm and

collect images.)

An external perimeter detector with image (Same description as the photodetectors
but from outside)

A smart key reader (tag reader) which is the device used to

arm/disarm the alarm. Which is related to 6 tags (intelligent keys that are
are used to disconnect the alarm by passing them in front of the key reader
smart.

"The only modification with respect to the initial state was the change of the two

magnetic/seismic by three volumetric devices, which are cameraless detectors
that react to changes in temperature detected by movement, so
that if they detect movement while connected, they trigger the alarm". It indicates then that
after discharge from service, at the time of the intrusion there were three photodetectors, and
three volumetric, in addition to the rest of the elements already mentioned.


Refers to the information included in the manual to complete the operation of the
system.

"Regarding the connection system with the Alarm Receiving Center (hereinafter,
"CRA"), this is carried out by means of a SIM card integrated into the control panel.

control."

3.4-a) Way in which the logs of the operation of the system are generated and stored
alarm system. If in addition to the operation or generation by the machine, is
Can Securitas operators create logs? Under what circumstances?


It states that "the system generates and stores records derived from:

-Customer interactions with the alarm system, for example: connection,
disconnection.


-Internal verifications of the system: example coverage (...), and



C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 37/102







-Activities of the alarm system in the performance of its function, for example jump
alarm."


"Regarding the possible generation of new logs by SECURITAS operators
DIRECT, it is necessary to indicate that the catalog of logs that can be generated by the
interaction of the installed system and the CRA is closed, that is, it is not possible to
creation of new logs other than those that the system allows to generate. For other
part, obviously, some of these previously configured logs will be generated
as a consequence of the interaction of the system with an activity carried out by

an operator or user authorized by SECURITAS DIRECT, as well as by the
owner of the system or the persons authorized by it. However, as has been
indicated, they would be found in the catalog of those that can be generated in
the system and would not present any type of novelty with respect to the existing ones,
be it impossible."


b) Report if the alarm system control unit itself is capable of storing
records or only originates and sends signals, and which signals or records originate and which
it would be fate.

He replied that: "The switchboard (control panel) of the alarm system is capable of

store records, in fact, holds ***NUMBER.3 events which are
deleting cyclically, depending on the records that are generated and
recording continuously. As new records are generated and recorded,
they delete the oldest ones maintaining a temporary order of recording and deletion
always within the ***NUMBER.3 records that it can hold."


Within these recorded events, a distinction must be made between:

(i) those that generate a log, a copy of which has been provided in the
Document No. 2 of those provided together with the pleadings to the Agreement of

Start (they collect mixed technical logs together with those considered data logs of
personal character, in sequential order of date and time, with keys of: "classification
signal", key that is specified in ANNEX II of allegations to the initiation agreement together
whether or not it is considered personal data and why), the description, the most
wide (called in column "(...)"), comment, event, event extension,
priority, zone.


(ii) and other merely technical events related to the interconnection
produced for the submission of the logs to the CRA of SECURITAS DIRECT (e.g. channel
by which the log is sent, successful connection, acknowledgment, etc.). Since the
mentioned in point ii only refer to the referral and not to any type of

specific action, not generating a log, would not be part of what was requested by the
claimant.

"The destination of these records is the CRA, although the information mentioned in the
point (ii) as well as the logs that do not reflect a relevant event related to the

alarm operation are not communicated and remain in the internal memory of
the switchboard and are only accessible by SECURITAS DIRECT personnel in case of
an event occurs that requires forensic analysis. Throughout
case, the logs that remained in the internal memory of the switchboard disabled by the

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 38/102







action occurred on November 27, 2015 have been incorporated into the information
provided in the aforementioned Document No. 2 of the pleadings to the Agreement of
Start."


c) When talking about the internal memory of the device, where is that internal memory located?
What events does it record, differences with the signals that it can send to the control center?
alarms the control panel? .

It responds that it is housed in the motherboard of the switchboard-control panel-.


As for the events it reflects, you have already detailed them.

d) Inform if it is possible and under what circumstances, activate or deactivate the alarm
from the CRA, and if the operation can be recorded in logs and if, in this case, it has been

any event of this type occurred in the requested access period.

Answer that "From the CRA, operators have the ability to activate or
deactivate the alarm only at the customer's request, within the framework of an interaction
phone with him. This petition is duly registered, through its
corresponding log."


"In the case analyzed in this file, said functionality was used
within the requested period, and proof of this are the records detailed below.
below, which are part of the information sent to the Agency:


* (...):

o 12/18/2015 at 20:08:57 - Order sent (...) Total per user: B.B.B.. o
12/18/2015 at 20:09:08 - (...) external Total.
o 12/18/2015 at 20:19:59 - Order sent (...) Total per user: B.B.B.. o

12/18/2015 at 20:19:59 - (...) external Total.
Or 12/18/2015 at 20:20:07 - Order sent (...) Perimeter by user: B.B.B..

o 12/18/2015 at 20:20:19 - (...) external Perimeter

 * (...):


o 12/18/2015 at 20:18:56 - Order sent Disarm by user: B.B.B..

o 12/18/2015 at 20:19:11 - De(...) external: ***NUMBER.4.
3.5-Verification mode/s of the applicable alarm/s in this case, and which logs are

generate and indicate those that with this description appear in the period requested by the
claimant.

It responds that "the logs that are generated to verify the operation of the
alarm can be classified as follows:


(i) those that are generated as a consequence of an interaction of the holder of the
contract or an authorized by the same with the alarm system;


C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 39/102







(i) those derived from a human interaction produced from the CRA; and


(ii) those that are generated automatically, without human intervention of any

guy.

In this sense, and taking into account that only the logs listed in the
points (i) and (ii) imply a processing of personal data, and of these only the
listed in point (i) involves the processing of the Claimant's data or the

persons authorized by it, in Document No. 1 provided by the defendant
along with his pleadings, it was clarified that the right of access by the
interested in their own data, only affected the contents in the aforementioned
point (i) and not to those listed in points (ii) and (iii), which do not include data
Claimant's personal


Specifically, and with regard to all the logs provided to the Agency, they would fit
In what is described in this answer, the following logs that represent verifications of
alarm:

 * Logs from 11/27/2015 from 20:09:47 to 20:17:07,

moment in which an action plan is contacted.

* Logs from 12/06/2015 from 01:15:04 to 01:17:40.

3.6-a) Report on the aspects of configuration operation and types of

configuration of the device in the security system contracted by the claimant,
and by the different types of users that were contemplated and had access in the
device settings, if any. The way in which they are identified in the logs
the various actions of potential users in their various roles that may
assume: holder, authorized, contacts in the different elements of the system. In one
of the log names appears "user ***USER.1 accessed the client's file",

who is this user, given that in other cases they refer to the staff of the
entity as "technician", "operator".


a) Regarding the term used in logs, "designated contact", description of who

they refer to, and their relationship, where appropriate, with those authorized to access the system, and in
In this case, if the designated contact is only the holder of the alarm contract? Relationship
of actions carried out by the owner or authorized persons regarding situations
techniques in which the system can be found, (...)/(...), and if they can be
identifiable such actions relating them to the person who interacts.


b) Report the number of authorized Users in the contracted alarm system
per claimant, number of designated contacts, and if only the designated contact was the
holder of the contract, roles that differentiate in their actions and their limits to the user
authorized in front of the designated contact. For what type of actions each one? and
What type of actions can only be carried out by the holder?


c) Document in which the holder of the service has given the data of the users
authorized, designated contacts.

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 40/102








He answers that "to clarify the way of interaction of the alarm systems with the
CRA, is answered jointly. The authorized contacts are understood to be, for the

owner who contracted the system, the claimant, while the users with access to the
system would correspond to SD staff.

Authorized or designated contacts may interact, in any case or under
certain circumstances with the CRA, making a communication to it in which
modification of certain characteristics of the action plan may be requested

established in the contract (e.g. delay time in the activation/deactivation of the
system, update of contact telephone numbers, etc.). In any case, that
interaction must be preceded by the keyword also established in the contract.
Likewise, the authorized contacts, in their order, will be the recipients of the
calls that SECURITAS DIRECT can make in the event of any kind of

impact on the operation of the system. In this specific case, how can
verified, the Claimant designated four authorized contacts in the Contract,
also establishing their order in the event that it was
interaction with them is necessary (see the last two tables on page 16
of the contract). Together with the authorized contacts and the contract holder, the other
natural persons operating in the system are the users, identified as the

SECURITAS DIRECT agents who can receive a specific incident
as a consequence of an interaction with the owner or those designated contacts and
where appropriate, they carry out the operations requested by them. This would give rise to the
generation of the consequent log that in the valuation attached to the document of
allegations to the Initiation Agreement were considered as personal data of the

Claimant, when proceeding from an action urged by him or his authorized.

So that authorized users of SECURITAS DIRECT are not
directly identifiable or accessible by third parties, each of them has
with a unique name or "registration" made up of alphanumeric characters

that exclusively allows its internal identification by the company. such is the code
"***USER.1" that appears in one of the logs and about the one that has been raised by the
AEPD the question of users. In this case, the registration of the interested party is recorded and not
its generic name given that the access occurred as a consequence of the
interaction carried out by the contract holder, thus guaranteeing traceability
of what was requested and the determination by SECURITAS DIRECT of who attended said

application.

Finally, within the users of the system, reference should be made to the remaining
technicians or operators, (...). In this case, the log generated by your activity does not generate
a license plate, since the aforementioned guarantee of traceability is not necessary.


For the purposes of the logs provided in this case, those that generate an interaction
between the owner or a contact designated by the latter and SECURITAS DIRECT are the
between 12/05/2015 at 14:19:04 and 14:45:45, where ***USER.1
access the customer file to manage and agree on maintenance with the customer

associated with the event that occurred on 11/26/2015.

Subsequently, also at 18:38:10 on 12/05/2015, the log shows the
registration ***MATRICULA.1, which is the technician who physically travels to the

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 41/102







address of the claimant to carry out the corresponding maintenance, and connects
to the system to do it.


Finally, on 12/18/2015 at 20:08:18 the SECURITAS employee logged in
DIRECT B.B.B., as a result of a customer call to SECURITAS
DIRECT where it consults the connection status of the alarm at that moment. For
For this, the employee must access through an internal tool, which requires the
logged in from your professional email and password, through which you
You can check the connection status of the system and interact with the system under

what the client requests. Although this interaction is recorded in the logs, the
how it should be executed is implying that in registration instead of registration
the email appears (without @securitasdirect.es). In this case, the claimant
contacted the SECURITAS DIRECT operator that is identified in these
logs and that at the moment of initiating the connection it had to be previously identified

before the Claimant, therefore the latter already had the identifying information of this
used at the time the connection was made."

3.7 a) Operation of the programming of the device when entering the home with the
security system active, to deactivate, or vice versa, to leave it configured
when the house is abandoned, also considering that there may be different

users, and how it has to operate when accessed by another user other than the one that left
programmed to output the alarm.

He replied that "the Manual incorporates the activation and deactivation procedure
of the alarm system as a consequence of the interaction of a user, not being

These effects require that activation and deactivation be carried out by a
same user."

a) Indicate if the contracted service included the control of the application with a device or
mobile telephone terminal and how it interacted with the logs stored in the

server in the requested period.

It indicates that "the contracted system allowed its activation and deactivation from the
application (hereinafter, the "App") that the user could install on his device
mobile (this application exists in iOS and Android version). Taking into account what
above, when there is an interaction between the owner or an authorized contact that

involves the connection or disconnection of the alarm system, said incident is recorded
in the internal memory of the device, although it is only transmitted to the CRA in case of
that the action responds to the existence of a security incident. In that
of course, that is, when a security incident occurs (e.g. disconnection
as a consequence of an alarm jump) and later the

system, the log is registered in the CRA identifying the user (key, command or
code) that performed the action. Similarly, if the disconnection or connection is
performed from the App, the log is transmitted to the CRA, reflecting that a
action through an Iphone or Android device, but the number of
phone from which this action is performed.


In the present case these records would be the following:



C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 42/102







 * 12/06/2015 at 1:15:27 - Disconnection. KF 00 - User: 07 Disconnection by jump of
alarm at 1:15:04 (...). This log records a deactivation of the alarm system
by means of a remote control following an alarm jump.


.Regarding logs associated with interactions with the alarm system through the
APP installed on the claimant's mobile", refers to requests from IPhones from different
type: status request, of (...), of image on various dates from 12/06/2015.



In any case, the internal memory of the control unit (Control Panel) to which it has been able to
access my client, that is, the one initially installed and destroyed in the facts
occurred on 11/27/2015, does not incorporate, within the time period with respect to the
that the right of access was exercised, no log referred to (...) or from (...) of the system
alarm, this being, and no other, the reason why the information provided to the

Claimant does not incorporate any record of this nature in relation to the
disabled device. Regarding the logs that appear in the internal memory of the
installed on December 5, 2015, as will be analyzed when responding to
the question formulated in point 4.14 of the letter of that AEPD", (3.14 of this
proposal) "my principal was not able at any time to access the information, so
that it was not possible for him to provide it to the interested party."


3.8-a) If in accordance with the specific regulations of the sector of the operation of
alarms, periodic reviews are carried out, what would these be, and if they are done
appear in the logs, determining which are the specific logs that respond to
such reviews. If the so-called record of incidents, which is discussed in the OM

316/2011 of 1/02 on the operation of alarm systems saves any
relation to the logs generated by the system.

It responds that: "periodic reviews are provided for in article 43 of the RD
2364/1994 approving the Private Security Regulations and article 5

of Order INT/316/2011. These reviews would include at least the obligation to
carry out only one face-to-face annual review. The SECURITAS DIRECT CRA has
ability to perform these checks remotely, typically every
three months. In addition, it indicates that daily tests of communication and correct
Transmission of the alarm system with the CRA automatically."


Examples of the aforementioned verifications are attached:

12/06/2015 18:45:42 Panel use: Tot 00, Parc 00, Per 00, Anx 00
12/05/2015 18:38:10 INSTALLATION IN TESTS
12/05/2015 18:38:10 INSTALLATION UNDER TESTS FOR MAINTENANCE -

***NUMBER.1 BY TECHN
05/12/2015 18:38:10 000:08:00 ALL ZONES
12/05/2015 18:38:10 TECHNICIAN: ***REGISTRATION.1-C.C.C.

"On-site reviews are recorded in the log of the management system of

CRA alarms, since the technician must check a series of
system parameters and carrying out the various functional checks.
Likewise, as contemplated in the regulations, if revisions were made
remote, these would be reflected in the event memory of the alarm system

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 43/102







(art 5.2 OM and annex III quarterly face-to-face maintenance with a possible alternative to
automated self-test and bidirectional."


b) Difference between inspections and maintenance operations of the installation
in operational state, where the latter are regulated, and through which modality they are
carry out these maintenance operations.

He indicated that "The review is a mandatory, preventive and periodic task described in the
aforementioned Private Security Regulation and Ministerial Order 316/2011, and the

Maintenance is a corrective task aimed at solving specific incidents
that do not allow the correct functioning of the alarm system, and that have as
purpose of correcting these incidents. The review is carried out, as
has been revealed in section a), while maintenance will depend
of the need and nature of the incidence, and can be carried out in a

face-to-face or remote.

3.9- If there is any relationship between the revision record books, revision record books,
alarms, incident record, OM 316/2011 of 1/02 of operation of the
alarm systems, and the logs generated by the device installed in the residence of the
claimant, if data from the logs are transferred to said books, and their relationship with the

consideration of personal data of the owner.

He replied that "Security companies, depending on the activity for which they are
are authorized by the Ministry of the Interior, are obliged to carry
certain books. In the case of SECURITAS DIRECT, you must bring the following

Books, the models of which have been officially approved by the Ministry of the Interior:

* Alarm Record Book. Completed and custody by SECURITAS
DIRECT It is intended to record the confirmed alarm messages that are
notify the Security Forces and Bodies. "In the present case, there was no

no confirmed alarm, so they would not be included in this book"" Provides
printing of part of the book in which there is no inscription.

 * Company Review Record Book. Completed and guarded by Securitas
Direct, is intended to record all periodic face-to-face reviews
that are made to the alarm systems of its operational clients.


* Record Book of Communications with the Security Forces and Corps, whose
object is the record of the collaborations and aids that are carried out during the year
with the Security Forces and Bodies.


"In none of the aforementioned books are logs or signals of the
alarm systems as recorded by the system itself, but rather the
information of that event communicated to the Security Forces and Corps
providing the data requested in the book".



3.10-To verify the way in which the raw record or log appears in the system, it is necessary to
requests that they provide a copy of the raw log:


C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 44/102







a) From 12/15/2015, 4:50:24-Informative signal- which was the first to appear in
the right of access delivered to the claimant in his brief of 02/23/2021.


a) One of the logs of 11/27/2015, which appear grouped in "CRA Action",
and in "extended description" there is "different generic actions of the operator
human..."


Indicates that all the logs generated in the system appear collected in its
completeness in the document provided as document two, together with the brief of

allegations to the initiation agreement.

They provide document 5 with the extract of the specific logs requested

The logs of 11/27 occupy 8 lines, central alarm receiving action.



b) Indicate how the information referred to in "extended log description" comes out before
the elaboration, or where one goes so that in some cases it is so generic or
description open. If these generic descriptions cannot be detailed
further.


He replied that "As can be verified in the information contained in the
previous answer, the "extended description of the log", which was incorporated in the first
of the responses given to the Claimant by my client, is not contained in the logs
generated by the system, which were reproduced as they are shown in the second
of the answers. This description was introduced in the first reply to the
Claimant with the sole and exclusive purpose of clarifying the scope and meaning of

the same. In this sense, SECURITAS DIRECT considered that the information
provided to the Claimant in the rough (document number 2 of those provided together with the
allegations to the Commencement Agreement) and without a minimal description of the meaning of the
logs may be of no use to the Claimant."


3.11-In their allegations, they indicated that:

"... the records considered as personal data have been provided in three
occasions and in two different formats and including complementary information that
enable the claimant to understand it. It should be remembered that the records

generated by the systems of my represented have been provided as indicated
generated in them, and even so efforts have been made that even exceeded the
obligation of my represented, so that the recipient could understand the event that
reflect".

It is requested that they provide or inform about the complementary information that

It helps to understand it and where it comes from.

It responds that "the supplementary information referred to in this
question is the one referred to the "extended log description", already mentioned in the
previous section that my client incorporated into the responses provided to the interested party

at the time of responding on all occasions together with each of the
logs, trying to expose, even through a brief description, the actions
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 45/102







to which each of them responded. In this sense, my client did all the
efforts reasonably required to address as clearly as possible what
requested by the Claimant, not limiting himself to providing the logs in the format in which they were

generated in the SECURITAS DIRECT systems, but by briefly clarifying the
scope of each of the Code lines provided."

3.12 Regarding the "active interactions of the user himself with the systems in
physical or through the mobile application.", "passive interactions of the user or of
third parties that can provide information with their way of acting", point out

examples, and if in all cases they could be personal data or not, and logs
that can be found within these categories.

He responded that "The user's own active interactions with the system remain
reflected in the corresponding log. In particular, reference should be made to the

connections and disconnections of the alarm system, which are only registered in
in case of having produced a previous alarm trip, as indicated in the
response to the question raised in point 4.4 of the letter of that AEPD", (in this
proposal 3.4).

Along with these physical interactions, the client may have other complementary or

extras like e.g. press the "112" button that generates a direct call through
from the switchboard to 112. Also, as a physical interaction, you can press the "SOS" from
the switchboard and from the key reader (tag reader). Similarly, you can click
a "duress code" through the numbers indicated on the switchboard or you can
intentionally generate a tamper/sabotage or tamper signal, consistent

to remove a device for a certain reason (e.g. because the
house) or without it (e.g. because you hit it accidentally).

Finally, through the mobile application, connections can be made and
alarm disconnections, query system status, review invoices or perform

a request for images.

Examples related to physical interactions of the system are defined in the column
"***COLUMN.2 (...)".

Regarding the "passive interactions", they do not imply the performance of an activity

of the owner or his contacts, but rather contain information that, in the event of
be analyzed, something that SECURITAS DIRECT does not carry out, could reveal habits
behavior of those (e.g. reiteration of periods in which the system is (...), which
would denote absence of the dwelling object of the security system), for which reason
considered personal data and were provided to the Claimant. Consequently,

this information is not derived from a specific log but from a more detailed analysis
of the logs that, as indicated, is not carried out by my represented."

3.13- They stated that "we inform you that (...) the Securitas alarm systems
Direct register and store the information coming from the events with origin

technician and events originating from the interaction of the devices installed in
the domicile of clients. Specify about this internal memory in which device
exists, what is its function, and what events does it record, where do they come from, how long


C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 46/102







are stored and when they are collected, as well as what devices you interact with. AND
How is the saving produced and with what periodicity, and its destination?

He replied that "the internal memory of the device is located on the motherboard of the
alarm switchboard (Control Panel), its function being to record the events in the

system that are generated and storing only the last ***NUMBER.3
carried out, as indicated in question 4.4.b) (in this proposal 3.4.b).
These records are deleted, cyclically, depending on the new records
that are generated and recorded, so that the generation of a new record
implies the deletion of the oldest of those ***NUMBER.3. Such events can
respond to panel interactions with:


(i) the owners and contacts authorized by it;

(i) the remaining devices of the system (e.g. volumetric sensors or
photodetectors); either


(iii) the backend of SECURITAS DIRECT."

The defendant stated that "After accessing the records contained in the memory
of the alarm it has been verified that it was connected from the day
11/22/2015 at 11:56 and that there was no anomaly, likewise, the

alarm recorded and sent movement detection signals at 8:09 p.m.
11/27/2015, not registering any event afterwards."


3-14 The claimant stated in the procedure for the exercise of rights
TD/00167/2021, that "the request for access to the records contained in the memory

They refer to both "the destroyed alarm center and the one that was installed in my
housing on 12/5/2015 and that continued to generate signals and records". For this purpose, it
requests that they report on the one that the claimant says was installed on 12/5/2015, if it was
within the same contract?, reason why it is installed and what impact does it have on the
logs of the destroyed one?, and why weren't the internal memory logs given from
said date to 12/13/2015.?


He replied that "First of all, it is necessary to indicate that my client did facilitate that
information referring to the logs generated during the period of time indicated in your
application, as it appears in the file, in which the two answers are incorporated
provided to the Claimant by SECURITAS DIRECT (the first one incorporating
a detailed description of the logs and the second by providing the logs as they are

collected in the systems of my represented).

In this sense, both the logs
stored in the CRA, such as those coming from the internal memory contained in the
switchboard (Control Panel) destroyed on 11/27/2015. Regarding the generated logs

from the installation of a new switchboard, the CRA, and therefore my principal,
can only access the logs that are transmitted to it from the
internal memory of the device, but not those of a merely technical nature that are
generated in said internal memory, given that SECURITAS DIRECT only
You can access the content of that device in the event that it had occurred

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 47/102







an incident that requires your forensic analysis. In this case, given that said incident did not
took place, the device remained in Claimant's home until the
termination of the Contract, without at any time SECURITAS DIRECT being able to

access said internal memory nor was it necessary to carry out any analysis
forensic analysis of its content, as there has not been an incident that required it. As
It can be verified that these answers do contain information referring to the
period mentioned in the question raised. However, it is clarified that said
events are incorporated into the document provided by my client as No.
2 to the pleadings to the Commencement Agreement, and generated from the aforementioned day 5

December 2015.

On the other hand, in case of destruction of the switchboard (Control Panel), and always
Within the scope of the contracted services, the former is replaced by
a different one, being said installation, and the logs generated from the moment of the

Installation part of the development of the aforementioned contract. In the case at hand,
the reason for the replacement of the switchboard (Control Panel) on December 5,
2015, was due to the damage suffered as a result of the intrusion that occurred on the date
11/27/2015. As already indicated in the answer to a previous question, the logs do not
are modified by the fact that this substitution occurs in the device,
being those derived from the interaction of the alarm system with the CRA."


3.15 For what reason do you indicate in the appeal for reversal against the
exercise of law TD/167/2021 that "in lines of code format" would satisfy in
to a lesser extent, compliance with the requirements demanded by the GDPR so that the
right of access can be considered adequately addressed"? and what is the

format "lines of code", if it is the one of the logs chronologically, without grouping? Input
copy of a format lines of code as an example, the one of the fifth access point
delivered to the claimant on 02-23-2021 "CRA performance" and indicate what it refers to in
the reversal appeal against the TD/00 167/2021 with which the information "was
is listed in the table attached to the letter of 02/23/2021", if it is the

general explanation of what each column contains or what other information, and where
Was it listed?, forwarding a copy of it and whether it was sent to the claimant.


It responds that "Given that in accordance with the requirements of article 12.1 GDPR the
information provided to the interested party requesting the right of access must be provided

in a "concise, transparent, intelligible and easily accessible" manner, and as has already been
repeatedly stated in this letter, SECURITAS DIRECT considered that the mere
reproduction of the lines of code corresponding to the logs generated by the
system, in the format in which they are visible to my principal, I would not allow the
Claimant to know the scope, sense and significance of each of the logs

sent in response to your request to exercise your right of access.

For this reason, the information was sent indicating the corresponding log, the
date and time of its generation and the description of the meaning of said log.


Notwithstanding this, and given that the interested party did not agree with the information
provided, the raw information was also delivered and as
generated in the SECURITAS DIRECT systems, said information being the one that is


C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 48/102







collected, shaded in green, in Document Number 2 provided by this
part together with its brief of allegations to the Commencement Agreement."


3.16 The defendant is requested to report how they are similar, and what differences
exist among the accesses delivered to the claimant in writings of 02/23/2021,
05/18/2021 and those of 12/14/2021, in terms of quantity and content of logs, and why
In the latter and in May, no keys or clear indication of various
expressions used in that table.


He replied that: "As has been indicated on various occasions throughout the
present writing, the differences between the two responses provided to the
interested is only in their format, containing in both
Assuming the same logs. Thus, in the one provided on February 23, 2021, it stated
each of the logs collected in the SECURITAS DIRECT systems that

contained personal data, including in the first column the times when
had been generated and in the third of them a summary description of the meaning
of the corresponding log. For its part, in the information provided on May 18, 2021, and
subsequently reproduced on December 14, 2021, before consideration
of the Claimant that the information provided had not been delivered to him in the
format in which it is collected in the systems of my client, the aforementioned was reproduced

information, not including the explanatory description of the logs. In this way, each line
of the document (those marked in green in Document Number 2 attached to the
allegations to the Initiation Agreement) reference was made to an individualized log, being
the lines in which said log was repeated were logically similar.
Apart from the aforementioned differences, referring only to the way of presentation of the

information, but not to its content, there is no difference of any kind
additional."

3-17 a) Indicate for the service contracted by the claimant, which logs would be generated
when the alarm has gone off, according to the different circumstances that may occur, and

what action or actions would be carried out. Indicate the logs that are related
with any type of jump alarm that exist in the boxes, and the differences
between them, and characteristics taken into account for them to be considered as
contain personal data of the claimant or not.

It responded that "the logs generated with the alarm jump suffered by the Claimant on

dated 11/27/2015 appear in the document provided by SECURITAS DIRECT together with
the brief of allegations to the Initiation Agreement, being understood between the first of
those generated on November 27, 2015 at 20:09:47 and the one generated the same day
at 8:17:07 p.m. Likewise, the aforementioned document includes the remaining
assumptions in which an alarm jump occurred and the logs generated, differentiating

those that do or do not contain personal data, depending on whether they are shaded in color
green or red and based on the information included in the report that was attached
as Document No. 1 together with the allegations to the Commencement Agreement of this
procedure. As can be seen, these logs are started by the
detection of a volumetric alarm alert at 20:09:47, generating a code

random (1155) that is generated with any alarm jump) so that, if it is sent to
a guard, he can disconnect it (in this case, it was not used to send to
no guard, since it was determined that it was not necessary). From that moment,
the system verification logs are recorded for the transfer of information to a

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 49/102







operator, who from that moment makes the pertinent calls to those who
they appear as designated contacts in the Agreement entered into by the Claimant.
As can be seen, these attempts are unsuccessful with respect to the three

first contacts, when the voicemail is sent, communication can be made
with the room of contacts which, however, does not provide the word that allows
establish communication and that is also previously established by the
Claimant in the Contract, concluding the processing of the alert on November 27
of 2015 at 20:17:07 hours.


As can also be verified, all the actions related to the jump of
alarm and contact attempts have been considered personal data and provided
to the Claimant, not having such consideration the logs exclusively related to
with the way in which the SECURITAS DIRECT systems manage and channel the
actions to be carried out in these cases or those that refer exclusively to the operator

intervener. The justifying explanation of the consideration or not of the information
as personal data is contained in the report provided by my client as
Document No. 1 together with the allegations to the Initiation Agreement. Also, you can
check the existence of different logs related to alarm jumps
subsequently deactivated on December 5, 2015 from 18:56:37,
all of them having been provided to the Claimant because they are considered to incorporate

personal data related to it, given that these are actions aimed at
test the operation of the system installed in your home, carrying out different
alarm tests (volumetric, seismic, duress or magnetic). I also know
produces an alarm jump on December 6, 2015 at 01:15:04 hours,
being able to check the logs generated by the system, and which concludes with the

communication with the owner indicating at 01:17:22 hours that the alarm jump
it may have been generated by the chimney."

a) In the requested access, inform if, as a result of any alarm jump, it was
communicated to the Police the possible access to the property, and if it is registered in

logs, indicating which one it would be.

He responds that "communication with the police generates the corresponding log, which in
this case was not generated because that contact did not take place."

b) Likewise, report if the logs contain any "unconfirmed alarm" event,

indicating what they would be and if personal data has been considered.

"In the response given to the first of the questions contained in this section, it is
they have indicated the alarm jumps produced and their vicissitudes. The explanation about
whether or not the generated logs contain personal data is included in the document

No. 1 attached to the allegations to the Commencement Agreement."


3-18-If when an alarm jump occurs, all the actions related to
with the device remain in the logs and if additionally, they can be generated or created

others by the operators themselves, and what they would be, indicating if they would all be data
personal, or not, and the logs of each one of them (if personal data of the claimant,
No).


C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 50/102







He answered that: "in the answer to the previous question, the jumps of
alarm produced in the Claimant's system with the generated logs, being able to
differentiate between those that do or do not contain personal data. Likewise, as already

has indicated, the logs generated by the system are not left to the discretion of the users
of the same or of SECURITAS DIRECT personnel, being those previously
constituted in the system, although logically the actions of said personnel give rise to
to the generation of the corresponding previously configured logs."



3-19 a) Regarding the protocols that Securitas must carry out voluntarily - checks and
technical verifications, and related to system maintenance, specify the
articles and the specific norm that regulates them, periodicity or motu proprio, the protocol
internal summary of actions carried out by them, and if the regulations of
application provides for monthly activity reports for each alarm

for the owners, if these reports are fed from logs extracted from the registry of the
device.

He answers that: "First of all, one must start from the difference between a revision and a
maintenance to which reference has already been made in the answer given to the question
included in point 4.8 "(in this proposal 3.8) of the writing of that AEPD. Starting off

of said base, revisions and maintenance are regulated in articles 43 to 45 of the
Private Security Regulations and in article 5 of Order INT/316/2011. In
They refer to the periodicity of the reviews, as well as the way in which
face-to-face and remote reviews must be carried out, both in accordance with the
Annexes II and III of the aforementioned Order. The verification tests of the correct

communication and transmission of the alarm, is a test that must be carried out depending on the
the characteristics of the property, based on its different risk of robbery or
intrusion (so, for example, in a jewelry store there is a greater risk, so the systems
alarm must have periodic communication tests with a periodicity
less, than in a system installed in a private residence). This aspect is

It is also related to the degrees of security and the certification of the
systems in accordance with the UNE or UNE-EN standards that are applicable. In addition,
Article 45 of the Private Security Regulation regulates the delivery to the holders of
the installations of a manual of use and preventive and corrective maintenance that the
The user himself must carry out, including actions such as changing the
stacks of devices, control over object placement that prevents uptake

detectors, etc. The regulations do not regulate the obligation to send reports of
alarm activity, so that each company determines if the alarm is carried out.
periodic sending of this information. In addition, the client can consult in the App the
connections and disconnections that you have made with the different keys placed at your
provision. The only case in which the submission of a report to the holder of the

contract as well as to the Security Forces and Corps, occurs in the event that
a confirmed alarm jump has occurred and it has not been transmitted to the
Security Forces and Corps, in which the reasons for the
that this transmission did not take place."


b) In their allegations they indicate: "Securitas generated logs until 20:09 on the day
11/27/2015, time and date on which the intrusion into the residence of the
claimant and during which said alarm system was completely
disabled from that date could not generate more logs". However, in the annex

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 51/102







I, which includes the logs, contains logs after 11/27/2015, 8:09 PM. How I know
explain this fact? And what is the origin and purpose of these logs, and why not them?
considered personal data of the claimant.


It responds that: "The logs generated from the moment the jump of
alarm, and once those related to attempts to communicate with the
the contacts designated by the Complainant, refer to successive attempts to
communication between SECURITAS DIRECT and the system installed in the domicile of the
Complainant, which were unsuccessful and being machine-to-machine interactions

of a technical nature."


3.20 Explanation of why there are logs with different signs, according to what was provided,
considered personal data or not, and within these more than one, which coincide in

the exact recording of the time, example in the Excel tables provided in allegations
appears as non-personal data, 11/27/2015, 20:09:47, volumetric alarm. Intrusion
volumetric, seismic-according to panel version. Devices that do not need restoration
V8.8 to 9.5)- volumetric intrusion radius Volume, and the log of the day 12/5/2015,
18:56:37/ALARM/URGEN/XPO09 RP-Perimeter alarm SER Volumetric-photo.
Volumetric intrusion, seismic-according to panel version. Devices that don't need

restore V8.8 to 9.5)-


Answer: "As already indicated in the answer to the question raised in the
section 4.17" (in this proposal 3.17) "of the letter of that AEPD, the two logs

mentioned therein differ in terms of their content, given that in the first
of the assumptions a volumetric alarm jump of unknown origin occurs,
that does not provide information about the interested party, Claimant, while the
The second is due to the performance by the former of various tests in the
alarm reinstalled by SECURITAS DIRECT, deducing from it the existence

of personal data of the interested party, which generates the jump of the alarm system
in order to verify its proper functioning.


3.21 In the table that was given to the claimant on 12/14/2021, as well as in document 3,
green table that you provided in allegations, and which are personal data, there are

various codes in the columns, numerical, or letters, without which it is not clear
information. You are asked if the creation or collection of the meaning would be possible
of these keys, which appear in almost all the columns.

He replied that: "Regarding the alphanumeric codes that appear on the

"SIGNAL" column, it is the message generated in the system's own language
alarm that is translated into the information that appears in the rest of the columns and
essentially in the column of "***COLUMN.2 (...)".

Therefore, to understand the meaning of the code, one must go to the field of

column "***COLUMN.2 (...)". The system sends messages that incorporate codes
alphanumeric codes that are later translated into the different columns of the Log
presented. The "SIGNAL" column collects the part of the "raw" message from the system,


C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 52/102







in their own language (machine language) which is then translated into the rest of the
columns.

For this purpose:


* The column "***COLUMN.2 (...) is the translation of the system language event
to technical language, so that the agent/operator understands what the message is about.
This information is complemented by the columns "***COLUMN.1" and
"***COLUMN.2" that contain complementary information so that the
agent/operator can understand the event that is received at the CRA.


* The "ZONE" column identifies the alarm device in which the alarm occurs.
event (eg (...), identifies a recording photosensor in programming position 2) and
the "AREA" column describes the zone of the installation that corresponds (eg, Home
living room)


* The column "***COLUMN.3" indicates the priority of the signal, being the values
lower priority ones.

* The column "***COLUMNA.4", contains the type of signal that represents the event
(e.g. INF is the code that is associated with "information", which appears in the
***COLUMN.2 (...), SS is associated with "supervision", as also included in the

***COLUMN.2 (...), CC is associated with "coercion", SO is associated with "SOS", AAC is associated
to "power outage", etc...). In this way, these codes are directly linked
with the information contained in the column ***COLUMN.2 (...)."

3.22 In the report of 01/29/2021, provided by the defendant in allegations,
document I, table II, containing personal data, provided in their allegations,

the entry is recorded: 12/05/2015 14:19:04/REGISTERED ACCESS: The user
***USER.1 accessed the file of the client/Internal registration of the operator who is
acting on a specific incident/ Information related to a character operator
procedural and internal Securitas Direct / personal data is considered: YES / If applicable
would be considered personal data of the operator itself and therefore would not be
capable of being provided to the interested party requesting the right of access.


You are asked to answer who the mentioned user is, and if you access the file of the
client, is related to their data, or accesses from the time the alarm is
working, why shouldn't they be provided? In fact, in the access
has provided you.


Answer that: "As already indicated in the answer to the question raised in the
section 4.6 of the document of that AEPD, "(in this proposal 3.6)" the reference
alphanumeric to the user refers to the registration of the same in its condition of
employee of SECURITAS DIRECT, maintaining this information pseudonymized to
so that its disclosure to the Claimant does not imply a transfer of the data of said

user, since access to the Claimant's customer file does not imply the
processing of personal data of the latter, but only of the employee who accesses
said information. The data has been provided to the Claimant in order to deliver to the Claimant
all the information that could be possible to provide without, therefore, harming the
ordinary activity of SECURITAS DIRECT nor the information that would be found

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 53/102







protected by trade secret. However, it is reiterated that the aforementioned log does not
releases any personal data referred to him. In this sense, it is reiterated
doctrine of the AEPD by virtue of which the right of access does not include access to the
information referring to the specific users of the data controller who have
accessed the personal data of the applicant."


3.23 In the same report and same table of the previous case, there is the log of 12/18/2015,
20:08:18 ***COLUMN.1 Logged: B.B.B., explain that "The record of actions of
a user supposes the obtaining of personal information about it. If it's about
of a personal data of a third user other than the exerciser of the right of access
and, therefore, it would not be possible to provide the interested party requesting the right of

access", as they know that under this log it is not the owner who exercises the right,
reason then for which it appeared in the table delivered to the claimant on 02-23-2021
(There are others with the same reference).

Answer that: "As a prior consideration, it must be ruled out that the person to whom

referred to in the aforementioned log is the applicant for access, not corresponding to the
Claimant, nor with any of the persons authorized by the claimant as contacts
in his contract, as can be seen from the identification made in the matter
raised. Having made this consideration, we refer to what is indicated in the answer
given to the question raised in point 4.6 of the letter of that AEPD." (in this
proposal 3.6).


3.24 In document 2 presented in the registry named in allegations
"confidential client total logs", which contains the logs in red and green, you are prompted
to clarify, because:

The notice appears as no personal data in red:


  11/27/2015 20:09:47/comment volumetric alarm/intrusion description
volumetric-seismic according to panel version devices that do not need restoration v
8, 8 to 9.5 volumetric intrusion radius.

In table I (report of 01/29/2021, provided by the defendant in allegations)

the log is also contained.

It is requested that they report if the alarm was activated by the owner and the following occurs
that appears in the information "radio volumetric intrusion", why don't they consider it
personal data, by being related to information, last configuration made,
or that it could have been by the owner or another user?, and what relationship does it have with the

next one that appears in green, as personal data, is the same date and time, with
different codes, and with another in red, same date and time "description level of
panel coverage"

In addition, it is observed that the same description appears in green as data

personnel on different dates from the same chart, example 12/5/2015 18:59:08, 18:59:
27, 18:59:48 18:59:57.

Answer that: "As described in the answer to the question
incorporated into section 4.17 of the AEPD document" (in this proposal 3.17) "the

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 54/102







information marked in red responds to a technical event in which there is no data
any personnel of the Claimant (in this case the detection of an alarm jump) and
Therefore, it is not part of the information that must be delivered in the

case of attention to a request to exercise the right of access made
by the aforementioned Claimant, in accordance with article 15 of the GDPR. This is indicated in the
report provided by my client as Document No. 1 attached to the writ of
allegations to the Commencement Agreement (page 25) the following: This log line, although
provides information about an alarm jump in the sensors, insofar as the
that direct information on an attribute of the interested party is not transferred, nor is Securitas

Direct is intended to analyze a pattern of behavior or influence it in any way, the
information provided by the analyzed log line should not be considered as
personal data. In this sense, it would be a description of the technical and
internal Securitas Direct." The remaining logs generated on that date and time have
been provided to the Claimant when they include personal data that could

refer to it, not being provided in the event that they are events
merely technical, following the content of the aforementioned report (see pages 23 to
26 and 36 to 38 thereof). The logs generated on 12/5/2015 to which this
question do not derive from an exclusively technical event, but from the interaction of the
user with the system, triggering the alarm to check its operation,
for which they effectively reveal personal data of that person and for this reason they have

been delivered to the interested party when exercising their right of access, as well as
described in the response to the question raised in section 4.17 of the letter of
that AEPD." (in this proposal 3.17).

3-25 a) Clarify document 1, table I, logs of non-personal data, from the

01/29/2021, provided by the defendant in allegations, what does it mean or to what
reply:

"Logs, 12/06/2015 1:17:12, 12/06/2015 1:17:26/ NO REASON N/A Not provided
information regarding any characteristic, pattern of behavior, or other

user information. NO"(p. 26/105)."

Answer that: "As indicated in the answer to question 4.17" (in this
proposal 3.17) "the cited logs respond to a technical incident, which gives rise to
an interaction with the owner from which it can be deduced that said incident may have
be caused by the chimney and that there is no anomalous situation. Are

interactions have been communicated to the interested party in the response provided to their
Exercise of the right of access."

Despite the response, it can be seen that the logs appear in red in document 2
of allegations to the initiation agreement.


-Table I, after the previous one: all grouped in (...): 0 "27/11/2015
20:11:34 ,12/04/2015 11:04:50, 12/05/2015 9:30:10, 12/05/2015 10:48:31, 12/05/2015
13:14:21, 12/05/2015 14:17:44, 12/06/2015 1:15:22, 12/06/2015 16:33:51, 12/09/2015
8:54:14, 12/15/2015 2:38:08 12/15/2015 4:54:57"- Indicative that the incident was

transmitted to a human or machine operator. The signal, given its relevance, is
transmitted to a machine or human operator to start the management process. No
However, it is an internal procedure from which no personal data can be inferred.
of the user. NO". It is requested to clarify the key meaning (...):0, what would be the incidence?,

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 55/102







Does the signal come from the home alarm switchboard? And why doesn't it say that
incidence is treated and does not clarify defining who is transmitted.?


It responds that "The callsign (...):0 is limited solely to recording in the system,
as indicated, that a (...) is produced, either to an employee so that
carry out the actions that are established based on the event that has caused it
generated, either to the system itself, to carry out the verifications
coming. In this way, (...), but exclusively the internal procedure
followed by SECURITAS DIRECT in the event of an incident that appears in a previous log, with

the one that can coincide in the generation time, given the automaticity with which
Opera."


3-26 -in table I, of non-personal data, Logs existing between the dates:


 a) 11/28/201 22:21:18 and 12/04/2015 9:04:26
 b) 12/04/2015 11:08:02 and 12/05/2015 13:16:56
 c) 12/06/2015 16:33:51 and 12/06/2015 16:33:57
 d) 12/15/2015 2:38:08 and 12/15/2015 2:38:12
 e) 12/15/2015 4:50:38

 f) 12/15/2015 23:24:51 and 12/16/2015 12:20:34 / (...) transfer, "Also, the logs
describe the internal and technical actions carried out as a result of this
disconnection"

Report how and by whom this procedure is initiated, and before what event is usually

produce

Answer that: "As also indicated in the answer to question 4.17" (in
this proposal 3.17) "of the writing of that AEPD, these records are derived from the signal
that the system performs automatically to verify that it is

finds operational. As there is no response from the system installed at the home of the
holder, the logs to which reference is being made are generated, being able, from
that log automatically open a maintenance procedure, so that a
technician proceed to repair the device if necessary. In this sense, as
appears in the information already provided, on December 4, 2015 at 11:25:04 mi
principal communicates with the authorized contact number 2 of those designated by the

Claimant in his contract that indicates, as stated in the documentation, that my
principal contacts them the next day to carry out
tests according to COM LOG that we call the next day for tests. for this
reason, the aforementioned communications of December 4, 2015 do contain data
personal and have been delivered to the interested party as a result of the exercise

of your right of access" It is appreciated that the log in which you contact no. 2, the
4/12/2015, could be the one at 11:06:07

3-27 Since the log can indicate that an intrusion is detected and gives information about
alarm jumps, which is why the log of 12/6/2015 1:15:04 and those grouped in

PHOTO PIR RADIO intrusion in table I of document 1, it is considered not to be data
personal, it is not indicating that they give the data of the image, but the information of
that there has been an intrusion, and why it would not be personal data said
information.

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 56/102








It is also observed that a log with the same date and time appears as personal data,
in green in document 2 of allegations agreement start, although with another description:

"code to disarm the alarm" "Central high priority" In other instant logs
later figure "everything is fine", "indicates that it could be the chimney" interspersed with other
red logs, no personal data, about "panel coverage, images so that
CRA downloads them or "images already in CR".

Answer that: "As indicated in the answer to question 4.17", (in this

proposal 3.17) "the cited log responds to a technical incident produced in a
photodetector which, in the claimant's judgment, had been generated by the
home chimney. This incident gives rise to a volumetric alarm jump, that is,
that is, an intrusion or anomalous event is identified, and the contract holder may
access the generated photograph through its App."


3.28 a) same table and document mentioned above, logs from 12/15/2015
2:42:11 and 12/15/2015 4:50:19 ELECTRICAL CURRENT (AUTO) Detection of lack of
electrical current in the device. Securitas technical information
direct. To the extent that direct information about an attribute of the
data subject nor does Securitas Direct intend to analyze a pattern of conduct or influence

him in any way, the information provided by the parsed log line should not
be considered as personal data. Indicate what the denomination implies, and if the
device was (...) by the owner, because this log would not be considered information
of its owner since it could affect his right.


Answer that: "The log to which this question refers has an exclusively
technical and is limited to detecting the existence of a cut in the electrical supply that
affects the device. SECURITAS DIRECT cannot know the reasons why
which the power failure has occurred. However, the system remains
operation, since it is equipped with an auxiliary battery that allows its

supply when the alarm is armed in order to identify the
incidents that could occur during the cut produced. For this purpose, it is
irrelevant who and under what circumstances proceeded to (...) the alarm system, given
that the only thing that the log reflects is the existence of the absence of electric current in
the device, so that no natural person can be identified by the
occurrence of this event nor does it provide any information about a person

identified or identifiable. This incident generates the remission of a communication to the
owner, indicating that the (...) system has been modified as a consequence
of the aforementioned cut, as can be verified in the documentation provided
by my client The log generated by said communication does contain data
personal data, and this is reflected in the document sent to the interested party (logs generated on

day 12/15/15 at 4:50:24 that appear in the document sent to him)."

It is observed that in the logs of that day they begin with annotations of no data, in red
at 2:38:07, four logs, and the next one at 2:38:23 if it is a personal data log, with
information (...) and at 4:50: an email sent to the claimant's address,

continuing to include several logs of non-personal data with references to "failure
supervision", "incident cancelled, maintenance pending".



C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 57/102







-b) because in several of these logs in Are they considered to be personal data?, they indicate
As a general rule, no, but images are collected when they are detected
movements through the sensors, in case they had captured the interested party,

would be personal data and should be provided to him, and how do they know that the person
who accesses is the owner, an authorized person, another user?, and if, should not inform the owner
from the fact that images have been collected, if anything.

He answers that: "In relation to these logs, not all the sensors installed in the
Complainant's home include photographs (e.g. at that point reference was made to

volumetric sensors).

In any case, SECURITAS DIRECT can know if the image, if it is
collected if an alarm jump implies the development of the corresponding protocol (see,
for example, the response given to point 4.17 of the letter of that AEPD)" (in this

proposal 3.17) "which involves communication with the person or contacts
designated. In this way, if from said communication it is derived that the image is
refers to the interested party, a copy of the same would be provided, which would also be
accessible by him from the App."

3.29 What does the extended description that appears in a table consist of as

"Internal registration of the operator that is acting on an incident".
Answer: "It has already been indicated in the answer to the question contained in point 4.6"
(3.6 in this proposal) "the internal registration of the operator that is acting in a
incidence" is the internal alphanumeric code that uniquely identifies the
SECURITAS DIRECT employee who is working on the device to

solve or manage a technical incident that occurred in it."

3.30 What are they referring to when they state that the system performs
"Autonomous system checks that are performed without user or intervention
nor the service provider", and object, between which equipment is produced and if it appears

regulated in private security regulations or in its own protocol and that can
assume its non-performance.

It responds that: "For "Autonomous verifications of the system that are carried out without
intervention neither of the user nor of the service provider", and following what is stated in
question 4.8" (in this proposal 3.8) "we were referring to the tests

periodic communication and correct transmission of the alarm system with the CRA."

3.31 a In annex II, information, they indicated that:



- "Those log lines not derived directly from the results have not been analyzed.
security system services provided by Securitas (i.e. logs with
designation: FR0 to FSZ; ROF and ROI). Likewise, they have not been subject to
I study those log lines that, according to the information provided by
Securitas, have no practical application as of the date of writing this report:

IAC, ICA, PID, PDD, TLL and TWC". Explanation of the meaning of this is requested
annotation.



C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 58/102







Answer that: "The meaning of these expressions refers, as the content of the
own report can be deduced, to logs that no longer operate in the
SECURITAS DIRECT or that are not related to the operation of the

Claimant's alarm, so they do not fit what was requested by the Claimant."


b) There is a log that indicates: "VCA/ Available Photo/Video Alarm in CRA Images already
in CRA./ ...Notwithstanding the foregoing, the captured images, in case they
had captured a subject, it would be personal data and should be provided

to the interested party provided that the applicant for the right of access coincides with the person
captured in the images./ Personal data is considered: Yes. Explain why if the
images captured by the owner himself when the alarm was detected, said images will not
They can be transferred to the owner of the device, including if they are their own."


He replied that: "In relation to the delivery to the interested party of images captured
will have to differentiate:

(i) the situation in which the person appearing in the images is solely the
applicant for the right of access, in which case they must be granted together with the
the rest of the relevant personal data and,


(i) the situation where the device captures images from a third party, in which case
could not be granted with the right of access as it would imply a communication of
personal information. In this sense, the criterion supported by SECURITAS DIRECT
would coincide with that established by the AEPD itself in relation to the exercise of

rights in relation to video surveillance systems. Thus, in section 2.3.10 of
its Guide on the use of video cameras for security and other purposes indicates that
this right "has unique characteristics, since it requires contributing as
complementary documentation an updated image that allows the person in charge
verify and verify the presence of the affected party in their records. It turns out practically

impossible to access images without compromising the image of a
third. For this reason, access can be facilitated by certified writing in which, with
as accurately as possible and without affecting the rights of third parties, specify the
data that have been processed". In any case, the holders of the
SECURITAS DIRECT alarm systems have access, through the App, to the
images captured by the devices at the time an incident occurs

by jump alarm by means of a device capable of capturing images.
Likewise, these images are made available to the Corps and Forces of
State Security if necessary. In any case, the possible access by the owner
of an alarm system to the images, without prejudice to its legality as a transfer of
data, would not form part of the right of access of the interested party, as

It follows from the doctrine of that AEPD that has just been reproduced, by not referring to
your own data

b) Explain the meaning of this log: "SID Inactivity time Periodic verification of
movement within the home. From the joint information provided by: (i) the

time without motion detection; and (ii) date of the specific log in the case of a
analysis of a real log, knowledge of certain patterns of
behavior of a user, so this log line could be considered as data
staff. YEAH.

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 59/102








It responds that: "The report provided as Document No. 1 attached to the allegations
to the Initiation Agreement, not only analyzed the specific logs generated in relation to the

alarm system contracted and located in the Claimant's home, but the
all the logs that an alarm system could produce, including those
which in no case occurred in the controversial case, since my principal
wanted to know the scope of the application of the concept of personal data in the
operation of said alarm systems. For this reason, the report
differentiated in three tables the logs generated in the specific relation of the Complainant

with SECURITAS DIRECT, distinguishing those that would be considered data
personnel (table 1 of annex I) and those who do not (table 2 of annex I), as well as the rest
logs that could be generated by any alarm system, analyzing whether they
whether or not they fit into the concept of personal data (Annex II). The log to which this refers
question is not among those generated in the case of the alarm system of the

complainant, so it can be considered that the question raised is irrelevant
for the purposes of this file."


3.32 If it is possible that the logs overlap, existing for example the one that is
registered the (...) alarm by the owner and subsequently others have been registered

events.

He responded that: "Each log line is a unique record with date and time, and even
there can be several in the same minute and second as they are "machines" but this
It does not suppose an "overlay", but the generation of several simultaneous logs."


3.33 a) It is requested that they inform if the table can be provided to the claimant
ANNEX II containing the (...) of the signal and the descriptors, (report of 01/29/2021,
provided by the defendant in allegations) and reason in case it was negative.


It responds that: "Annex II refers to logs that have never been generated
in the claimant's alarm system, so that said information in no way
case would be related to your Contract, regardless of whether or not it had
the character of personal data. At the same time, as has also been shown
manifest in the allegations to the Initiation Agreement, the operation of the systems
of alarm of my represented and the logs that they generate constitutes an asset of

SECURITAS DIRECT protected by the rules that regulate trade secrets. Of
this way, the information being irrelevant to the interested party and being, for
On the contrary, my principal, protected by trade secret, considers that neither the
regulations for the protection of personal data, nor any other authorize that
have access to that information.


It is appreciated that Annex II, called "general analysis on the consideration of data
staff" found in document 1 provided in allegations to the agreement,
contains a letter key called "(...) of the signal" which also appears in the box
of document 2, signs in green, data of the claimant, and that it coincides with the

format delivered to the claimant on 12/14/2021. By way of example, it appears in both
annex II as in the table delivered to the claimant: IDE, the description of the signal
"External disarm", as well as the extended description provided by SD and a
explanation of linkage directly or through inference to behavior or

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 60/102







information of a natural person, and YES in personal data, so it would be
explanations that have to do with the content of what has been provided to you


b)-Reason why annex I, tables I and II, does not contain the key (...) of the signal and
its description that is contained in the table of ANNEX II

He replied that: "Reference must be made again to the scope of the report to which
this question refers to, in which it was possible to differentiate the logs actually generated in
the Claimant's system of those that had not been generated, so that while

the first could be differentiated according to the moment in which they were produced, the
seconds could only be referenced by a specific denomination. that and
no other is the reason why the tables of both annexes differ, in the same way
that the tables contained in annex I indicate whether or not to include the
corresponding log in the response provided to the request to exercise the right of

access, which for obvious reasons does not appear in the table in annex II."

3.34 In the event of an alarm at home, to whom would the
information?, to the last user that appears logged in in the alarm connection?, to the
headline? Under what assumptions? And how do you identify them in the logs? -Detail in this
case, some log that considers personal data and that motivated by the alarm jump, is

have given information to that person.

Respond that: "The action protocol in the event of an alarm jump, and
that was followed in the case of the Claimant in the alarm jump dated 11/27/2015, it is
the next:


* Call to speak/listen to the alarm center. (Audio Verification).

* Call to the landline telephone of the home where the system is located, if
have that data.


 * Call the designated contacts in the order established by the holder of the
contract in the action plan that appears in the Contract and verification of the word
clue.

 * Contact information in case of communication with it and the

keyword verification.

 * Notification to the Security Forces and Bodies in the event of indications
evidence of the possible existence of a crime (in the case of November 27,
2015 was not executed because it was not considered a confirmed alarm).


"In relation to the specific assumption analyzed, as described in various
previous answers, the interested party designates in the Contract up to four contacts,
also establishing an order of priority in the communication to them of
a certain incident. Once you get in touch with one of the contacts

designated, you are prompted for the password, without which you are not provided with the
information about the identified incident. This is how it happened in the alarm jump
produced on November 27, 2015, in whose logs it can be seen how
attempted contact successively with the persons designated first, second, and

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 61/102







third place, being unsuccessful, and since the contactee in fourth place did not facilitate the
keyword."


3.35 In their allegations to the initiation agreement, they indicated that:

"After presenting the information, the Agency also mentions the" time jump
between 11/27/2015 at 8:17 p.m. and 12/4/2015 at 11:05 a.m., without explaining the reason for
that absence of "logs" in that time interval". On this statement you cannot
this part but to state, said without the intention of offending the Agency, that it is not

corresponds to reality and it is enough to refer to the document presented by this party to the
Agency on 06/18/2021 (pages 106 and 107 of the file) where my
represented shows (we quote verbatim what was stated by
SECURITAS DIRECT) "it generated "logs" until 8:09 p.m. on 11/27/2015,
time and date on which the intrusion into the claimant's home occurred and during

which, said alarm system was completely disabled. from that
date, it could not generate more logs". In addition, and in relation to the internal memory of the
device, this party also revealed in its letter of 06/18/2021
(pages 106 and 107 of the file) "(...) after analyzing the internal memory of the
installed alarm only had a "log" generated for that time frame, which
It was recorded in our burofax dated 02/26/2021".


a) Note that there are logs in that period that are considered non-data
personal. In this regard, you are requested to indicate how such logs are started and how
end.


They respond that: "As has already been indicated on several occasions, the logs to which
the question refers to correspond to those generated directly from a
SECURITAS DIRECT operator at the CRA, and basically consist of the
successive attempts to communicate with the interested parties to report the incident
and check the alarm status. It is not about the communications from the switchboard

located in the claimant's home, which, when rendered useless, could not generate
no type of log or signal, as evidenced by the logs that the system generated
between 22:21:18 on November 28, 2015 and 11:04:50 on the 4th
December 2015, to which reference has been made earlier in this
written."


a) Also explain how the interruption is linked to the first log of
resumption, (cataloged in green) 12-4-2015, 11:05:04, what event produces it and what
personal information would provide this.

Answer that: "The aforementioned log is the result of technical verifications through

an automatic system called GTI (as it appears in the log itself) that is
is in charge of carrying out various checks to know the technical state of the
system, proceeding to the opening of a maintenance when necessary. In
In this case, an operator is in charge of calling the client to make a review with the
customer online and if this is not possible, arrange a visit by a technician to verify the

system state".

It can be seen that on 12/4/2015, as in previous days, the logs appear in red,
while as of 11/28/2015 they are all in red.

C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 62/102








   3.36 a) In document 2 of allegations, -total logs- Excel table of all logs,
   differentiated in red-no data-, green, yes, figure:


   With different keys of the "(...) of the event" distinguished in red those considered not
   personal data, example, there are two in red, from 11/27/2016 20:09:47, and another one
   date and time, in green. How are they similar and how are they different in terms of the
   references of its contents in terms of information on personal data that
   can contain.


   b) In this case, for example, detail the difference of these two logs (of no data
   personal) in terms of origin and because at the same time, in this case, one does
   considered personal data and the other not.


   Likewise, if you wish, comment on other logs -not personal data- that coincide with the date and
   hour.

   Answer that: "As stated in the response to the question contained in the
   point 4.17" (3.17 in this proposal)" the logs refer to different events: the
   first involves the detection of an alarm jump detected by a sensor

   volumetric; the second involves the generation of a deactivation code in case
   that it is necessary to go to the house once the verifications have been carried out
   corresponding, which also appear in the logs table; and the third refers to
   the coverage (...)."


   c) Explain if it seems possible that as it happens with the marks of the non-data logs
   personal that there may be more than one on the same date and time, if you could also
   there should be two of the same date and time so that logs of those considered
   personal data, some example, and if in those of the claimant it occurs in any case.


   Answer that: "The answer to this question would be that it is possible and an example of
   These are the following logs marked in green that refer to maintenance
   alarm change presence. There are several logs that occur at the same time
   temporary. 12/05/2015 18:38:10:", indicating four movements of the same date and
   hour.



EIGHTH: On 02/2/2023, a proposal for a resolution of the literal is issued:


"That the Director of the Spanish Agency for Data Protection sanctions

SECURITAS DIRECT ESPAÑA, S.A., with NIF A26106013, for a violation of article
58.2 c) of the GDPR, in accordance with article 83.6 of the GDPR, classified as very
serious in article 72.1.m) of the LOPDGDD, with a fine of 50,000 euros.

In accordance with article 58.2.c) of the GDPR, it is proposed that compliance with the
right of full and understandable access, as specified in the last foundation of
law and follows from the meaning of this proposal."



NINTH: On 02/20/2023, the defendant made the following allegations:
   C/ Jorge Juan, 6 www.aepd.es
   28001 - Madrid sedeagpd.gob.es 63/102







A) About the technical logs and their assimilation with personal data, states:

1-The device will at no time be under the influence of the claimant, nor would it have
ability to exert influence over the claimant since he does not have the ability to

configure or modify the technical parameters that affect the mode of operation and
the configuration established by SD for its interaction with the receiving center of
alarms.

2-"Although the number that identifies the device in relation to the contract entered into with
a certain client must be considered personal data when linking with the party in
said contract", the interpretation carried out by the AEPD in its proposal distorts the

concept of personal data, and, consequently, the application of the GDPR, understanding that
each technical action on that device is a personal data of the claimant, it is
that is, that it constitutes information "about" him, and that, therefore, must have been provided in
the right of access.


- The information in the technical logs has no impact on or on the interested party, nor if-
want indirectly, as they are signals and communications carried out between machines that,
in any case, they are unrelated to the owner of the home on which the system is installed and
They do not affect it, directly or indirectly.

3- Reiterates the meaning of Opinion 4/20007, on the requirements that should be met in

the information to understand that it can be considered personal data, when it
"be seen on an identified or identifiable person". In the framework of their discussions on
data protection issues raised by RFID tags, the Group of
work pointed out that a "data refers to a person if it refers to his identity, and
their characteristics or behavior or if that information is used to determine or

influence the way she is treated or evaluated."

To consider that the information referring to a specific object, the alarm device,
installed in the claimant's home may be considered personal data, as it relates to
about a person, there must be an element of content, or purpose, or result.

In the report provided in the initiation agreement it was already indicated:

 The information must refer to a specific natural person, so the information
in the logs must, at least, be in one of the following situations:


a.1 Be directly linked to a specific individual, in such a way that
provide direct information about their way of acting, their mental characteristics or
physical features, preferences, abilities, or any other pattern of behavior that may
be directly attributed to it, or


a.2 Can be used to evaluate or influence in any way a particular individual
or in his conduct, or



a.3 Can have a direct impact on the rights and interests of an individual
certain.



   C/ Jorge Juan, 6 www.aepd.es
   28001 - Madrid sedeagpd.gob.es 64/102







From this conclusion, it was inferred that the technical logs could not be considered personal data.
personal because it refers only to an object and is not found in any of the sub-
mentioned positions.


The evaluation of the proposal only alludes to the fact that technical logs are personal data
due to the fact that they are linked to the alarm system identifier, and this, via contract
to the claimant. It considers that the "content" requirements do not meet: It does not provide
information directly about the interested party, of the "purpose": the objective of the
technical logs is not to evaluate, treat in a certain way or influence the situation or

behavior of a person, nor of "result": that "would occur if the use of the
information affects or could affect the rights and interests of the
claimant" , "since there is no possibility that through the information obtained from
technical logs may in any way affect the rights and interests of the
interested party that is not related in any way to the operations that constitute said

logs". The "use of this information could imply differential or discriminatory treatment
of the interested party or an affectation in his personal sphere".

4- The consideration as personal data of the information contained in the technical logs
is not affected because it refers to the ARC-alarm device interconnection
installed in the domicile of the claimant, since the purpose of this, in nothing can
determine the nature of the personal data or not of the signals that it emits. Whether

follows this reasoning any information related to an object could lead
to consider it as personal data, when its usefulness or purpose is affected
for which it has been acquired or is derived from a service contracted by the
interested,

In addition, it considers that information related to machines or systems has no
necessarily the condition of personal data in case they do not reveal information

about an identified person.

  He gives as an example the mixed data (personal and non-personal) that can
be inextricably linked or not, being able to enter the scope of the right of access, or
No, which means that only the personal data in the group is accessible to the user.
interested party, as stated in the EDPB guidelines 1/2022 on the right to
access. It ends by indicating that these circumstances can be extrapolated to the present case,

in which the internal operation of the device and its interaction with the CRA, without incorporating
more information than is relevant to verify and analyze the operation of the
contracted alarm systems.

 Regarding compliance and its manner, regarding the claimant's request for access,
states:

1- Regardless of the consideration that one has about the nature of personal data of the

technical logs, which is not the object of this allegation, the excluded information does not have the
character of personal data, having been given access only to what refers to the
personal data processed by the person in charge receiving the request.



2-Has tried to respond to the claimant in the terms that the claimant has requested, and
even facilitate the understanding of the information provided. It was the claimant who,

once information was provided that was intended to clarify the scope of each of the logs
   C/ Jorge Juan, 6 www.aepd.es
   28001 - Madrid sedeagpd.gob.es 65/102







provided considered that what should be provided were the "raw" logs, without the
grouping and clarification previously carried out, to later consider that this
The information did not satisfy him either, as it was, in his opinion, not very understandable. Which

pursued by the claimant is the information generated by the alarm system, given that
understands that there was a failure in its operation that led to the theft in its
property



   B) Regarding the disclosure of "know how", he states:

1-Law 1/2019 of 02/20/2019, on business secrets, aims to guarantee and
protect undisclosed know-how and business information from

its illegal obtaining, use and disclosure. In this case, it has lace as
information being referenced, which reveals internal processes and the
mode of operation of the installed alarm systems and in consideration of the
article 1.1 of said Law

2-The information of its systems and processes constitute an asset. The security that
can communicate with the technical logs must be adequately protected to avoid

access by third parties that could circumvent or circumvent the operation of said
systems.

The information that is provided in the logs contains an informative activity and
recorded through their own information systems (i.e. current status of
programs, security, access, network connectivity, etc.), and therefore, said

information results generate a standardized work methodology that is
owned by SECURITAS DIRECT.

Links the disclosure of this information to the safety of users of your systems
alarm, as a guarantee of the general interest and the preservation of security that
It affects all the generated logs. It considers that the individual right of the
claimant cannot prevail over the guarantee of the integrity and security of all

Your clients.

3-Employees have access to the information due to their employment relationship, and it lacks
relevance what is indicated in the proposal, as it is left out of the application of the
regulation of business secrets, whose effectiveness is external to the company. "The logs
used in the devices owned by him, provided to the Claimant, contain
non-personal information that, used automatically and in aggregate,

provides a series of signals that, studied in aggregate form, provide
SECURITAS DIRECT relevant and proper information for the improvement of services
security that provides, in addition to describing, in its sequential reproduction, the
internal procedures followed by the systems of my client, whose disclosure to
third parties could produce an impairment of their rights."



4-The "trade secret" to be protected does not come from the study of a single log (remember
than without data processing), but said "commercial secret" comes from the study
set of all logs, which allows SECURITAS DIRECT to be able to
anticipate events that may occur and affect the safety of its customers,


   C/ Jorge Juan, 6 www.aepd.es
   28001 - Madrid sedeagpd.gob.es 66/102







being able to adopt the measures and guarantees that derive from the study and analysis of those
logs.

5-Of the technical logs, only common technical and algorithmic measurements are observed
to all devices, used together to provide users with a

high level of security in the service provided. He considers that "it is not appropriate
the disclosure of your know how, by providing logs that are used in a manner
exclusively to provide the service it offers to all its clients, since
to do so, you would not only be placing yourself at a disadvantage with the rest of your competitors, but
that, what is much more serious, the right to personal integrity of

its clients and those who reside with them, although we consider at least
similar protection to the right to the protection of personal data."

6-In addition, on the legal basis X of the proposal, it is deemed necessary
provide the description of the processes through the keys that allow to clarify the
mentioned table and its sections that make the tables of the data understandable in
line or raw format, as obtained by the defendant, which considers that

multiplies the risk of harm for all its customers. He believes that in order to "guarantee the
integrity and proper functioning of its services, considers that it cannot
provide the claimant with all the logs, since doing so would be
jeopardizing the safety of more than a million and a half customers who hire
its services".

7-Consider that the trade secret of your rights is much more relevant, for

general interest and the preservation of security.



C) By virtue of the aforementioned, he requests the file of the imputation. Besides,
Regarding the graduation of the sanction, it states:


1-On the application of article 83.2.a) of the GDPR, based on the fact that it is confused

what is an element of the sanctioning type with an aggravating circumstance and the
indicated circumstances are taken into account to delimit the alleged infringement, as well as
as if to aggravate it, "which violates all proportionality."

2-Considers that the information provided is neither incomplete nor a mere
"summary with sparse information", and which was provided in two different ways and
complementary.


He requests that, as mitigating circumstances, it be taken into account that he attended the
request of the interested party granting it in various formats, denying good faith in the
proposal.

TENTH: Of the actions carried out in this procedure and of the
documentation in the file, the following have been accredited:



                                PROVEN FACTS



   C/ Jorge Juan, 6 www.aepd.es
   28001 - Madrid sedeagpd.gob.es 67/102







1) The claimant has a holiday residence on which since 07/30/2014,
had signed a security service contract with the defendant that included installation,
maintenance and operation of an alarm center.



2) The claimant states that when accessing his home, on 12/4/2015 in the afternoon, he discovered
brio, who had suffered a robbery found "the alarm center" destroyed without having been
notified, receiving a call from the Company that same morning indicating the existence
ence of connection problems.


3) The claimant exercised his right of access before the respondent on 04/07/2017 "regarding
all the information on the Securitas Direct servers related to the records and
signals sent by the alarm equipment installed on your property, as well as the copies
of the records contained in the internal memory of the alarm between the days

11/26 and 12/18/2015". The defendant replied that the records contained in the alarm did not
fall within the category of personal data, the claimant going to the AEPD that
resolved in an appeal for reversal on 01/2/2018, to estimate the claimant's claim and indicate
when the right was provided. The defendant challenged the agreement in the contentious
civil-administrative, resolving the National Court, first section, on 07/23/2019, in
his appeal 146/2018, dismissing his claim and confirming the resolution.


4) On 03/23 and 24/2021, the claimant submits a new document to the AEPD, according to
noting that he exercised the same right before the defendant on 02/02/2021, receiving a
02/23/2021, with an Excel table that the claimant estimates that he does not meet the demand.
right.


The Excel table containing the access provided to the claimant comprises a
total of 94 log lines, plus one from a time period of 12/5/2015,
related, according to the defendant, with tests on the alarm system as part of the

facility maintenance.

The table is an elaboration of the one claimed, of what it indicates, "are data
personal". It starts by date, not chronologically ordered and is grouped by name,
"nomenclature of the generated log" together with a description made by the defendant,
"extended description of the log" that aims to inform or define what it consists of. That

definition or "extended description of the log" is generic in the detail of the incident. The
"generated log nomenclature" also has a general name like: "Signal
informative""***COLUMN.1" or within it there are several, such as "action
CRA", which includes "communicating", "voicemail skip", LOCSIN. To mention
Some examples:


a) "(...) external perimeter" "nomenclature of the generated log":" "Central Security priority
low."

b) "Different generic actions of the Securitas human operator in the event of an incident

concrete, example speech/listening enablement, call to the different listed contacts,
internal comments in relation to information transmitted by contacts
etcetera"- "nomenclature of the generated log":" "CRA action".

In some logs, it refers to "contact", without identifying or specifying which contact it refers to.

   C/ Jorge Juan, 6 www.aepd.es
   28001 - Madrid sedeagpd.gob.es 68/102







refers, as "contact does not remember the password to prove the identity and close the
incidence", or "the contacts that the Securitas operator tries to locate are not
answer", "operator gets to talk to contact".


5) The claim gave rise to the AEPD processing the procedure for exercising the right
TD/00167/2021 in which the claimed before its admission to processing and initiation, the
05/19/2021 stated that not all the logs that record the signals of the
alarms, as well as the contents in its internal memory can be considered
containing personal data. He states that he has prepared a report through

a law firm, signed on 01/29/2021 entitled "application of the concept of data
personnel to the signals or logs generated by the alarm systems" that indicated the logs
which it considers "do not imply processing of personal data, and lists the categories of
the logs that it considers would be found in this assumption:


          1) "Issuance of signals of a purely technical nature for communication between the
devices as part of the verification protocol of their correct operation or to
the record of a technical failure". He puts as examples in his writ of appeal against the
TD/00167/2021: "device battery level, network disconnection, inhibition, etc.
tera". It was about the "Issuance of signals of a purely technical communication nature"
between the devices as part of the verification protocol of their correct functioning.

performance or for the recording of a technical failure".

          2) Registration of informative signals in relation to, among others, the version of the
system, model or category of installed device.


          3) Descriptive record of internal and technical procedures before a con-
creto". He gives as examples in his writ of appeal against the TD/00167/2021: "times
waiting procedures before an event, collection and description of the event, process of
capturing and making available to the operators the images or sounds, modification
of internal parameters, transfer of the event to an operator, etc. He was referring to "Record

description of internal and technical procedures before a specific event".


          4) Registration of technical signals in relation to the configurations of the devices.
sites that do not provide information about the interested party or their habits but simply
This is reflected in the calibrations of the Securitas systems for their correct operation.
to.


          5) Statistical information about the devices." He gives as examples in
his writ of appeal against TD/00167/2021: "number of photos captured, devices
activated, quality of device responses, number of disconnections, etc.).
It was referring to "Statistical information about the devices".


In addition, it indicates:

-"these logs" could contain information on internal technical processes of the claim-
information whose disclosure to third parties could imply diffusion of trade secrets. Mencio-
For this purpose, recital 63 of the GDPR.


-The access to logs provided to the claimant excluded technical ones or those that affect third parties-
ros.
   C/ Jorge Juan, 6 www.aepd.es
   28001 - Madrid sedeagpd.gob.es 69/102







A copy of the aforementioned report was provided on 07/06/2022 in allegations to the initiation agreement
as document 1.


1) On 06/07/2021, the Director agreed to admit the procedure for processing
of "exercise of rights arts. 15 to 22", TD/00167/2021 in which the defendant states
on 06/18/2021:

"In relation to the content of the" internal memory of the alarm installed in the home
of the claimant, it generated logs until 11/27/2021, 8:09 p.m., the time and date on which the

the intrusion into the home occurred during which said alarm system was completely
totally unused. According to the defendant, the system registered and sent capture signals
movement at 20:09 on 11/27/2015. As of that date, he could not generate more
logs of any kind. Therefore, in the time frame between 11/26 and 12/18/2015, the memorandum
Internal management could only generate logs on 11/26 and 27/2015, and there was only one generated log

within that time frame which was stated in the response given to the claimant the
02/23/2021. They provide document 1, which is the table with columns of the access that was
gave to the claimant on that date, which is marked in fluorescent green that
log:

"11/27/2015 20:09:47/HIGH PRIORITY CENTRAL/Code generated automatically and randomly
through the system for the security guard to deactivate the alarm".

The claimant stated that he has not been given the data of the records contained
in memory from the new installation of 12/5/2015 that is included in the request

tion.
On 09/17/2021 the guardianship was resolved, agreeing to uphold the claim and

grants a term to address the right, the decision being appealed by the defendant
in replacement on 10/18/2021, resolving its dismissal on 10/27/2021, appearing
electronically notified to the defendant on 10/28/2021.

2) On 12/21/2021, the defendant submitted a document in which she stated that she had
sent a copy of access to the claimant, providing a written referral of 12/14/2021, in

which contains a copy of the documentation that has been sent to the claimant by burofax. He
The document includes the submission of the logs in "lines of code" format, which is
collects in the SD systems the records and signals sent by the
alarm. According to the defendant, it is the "literal transcription, in the format in which the
in the SD systems of the records and signals sent by the alarm equipment."



The claimant submitted a document on 05/07/2022 in which he considers that compliance is still not being met
with what has been resolved since the defendant classifies the logs that are personal data of which
they are not, it is an unintelligible picture, the expression of imprecise descriptions, the letter
very small.




The table with "excel" sheets provided to the claimant, on 12/14/2021, contains
the logs in chronological order of date and time and there are a total of 19 informative columns
capable of containing definitions such as: "(...) of the signal", which would correspond to
the tables in annex II provided by the defendant in allegations to the initiation agreement,
where its meaning is described in an extended way, not provided to the claimant, .

   C/ Jorge Juan, 6 www.aepd.es
   28001 - Madrid sedeagpd.gob.es 70/102







Fields such as description and a
more extensive description in "description (...)", "event", "event (...)" "Zone",
"***COLUMN.3", "***COLUMN.4". "***COLUMN.1", "time of (...)", to name only
several with meanings and keys that were not given to the claimant.

In evidence, the defendant explained, for example, that the alphanumeric codes that

appear in the "SIGNAL" column, it is the message generated in the language itself
of the alarm system (machine language) that is translated into the information that appears
in the rest of the columns and essentially in the column of "***COLUMN.2 (...)".
To understand the meaning of the code, you have to go to the field of this column. The system
sends messages that incorporate alphanumeric codes that are later translated
in the different columns of the log presented. The "SIGNAL" column collects the part

of the "raw" message from the system that is then translated into the rest of the columns.

To this end, the defendant explains that:

* The column "***COLUMN.2 (...)" is the translation of the system language event
so that the agent/operator understands what the message is about. This information is

complemented with the columns "***COLUMNA.1" and "***COLUMNA.2", which contain
complementary information so that the agent/operator can understand the event that
is received at the CRA.

It also appears in the personal logs provided to the claimant.


* The "ZONE" column identifies the alarm device in which the event occurs.
(eg (...), identifies a recording photosensor in programming position 2) and the
"AREA" column describes the corresponding area of the facility (eg, Home Salon)

* The column "***COLUMN.3" indicates the priority of the signal, being the values

lower priority ones.

* The column "***COLUMN.4", contains the type of signal that represents the event (e.g.
INF is the code associated with "information", which appears in ***COLUMN.2 (...),
SS is associated with "supervision", as is also included in ***COLUMN.2 (...), CC is
associated with "coercion", SO is associated with "SOS", AAC is associated with "power outage", etc...).

In this way, these codes are directly linked to the information contained in the
column ***COLUMN.2 (...)."

In document 1 (REPORT of 01/29/2021, provided by the defendant in allegations),
ANNEX II offers a general analysis of the consideration as personal data of the
generic log lines that can be used in SD systems during the

development of its activity, without specific application to any interested party. The painting relates
the different "signal classes" to which the different types of logs are associated,
completed with "description", "extended description" explained by SD, "link with
the physical person" and "whether it is considered personal data or not,

However, there are 19 columns that contain keys and even descriptions.

unspecific as "information signal" that are not understandable without a
explanatory correlation.


   C/ Jorge Juan, 6 www.aepd.es
   28001 - Madrid sedeagpd.gob.es 71/102







3) In the security contract signed between the claimant and the respondent, it was stated that the
The alarm system contracted by the claimant had, among other things, photodetectors,
device that has an infrared movement sensor, a microcamera and

a flash, in case of intrusion, bypass the alarm triggered by the camera and send the notice and
the images captured to the Alarm Receiving Center (CRA), verification element
by audio, talk-listen, which is located inside the control panel and serves to
carry out audio and listening checks in the event of an alarm jump, it also serves to
talk to the customer through the switchboard or control panel


4) The basic maintenance included for the client: the remote checking services
the operation of all components (technical check according to current regulations),
updating the software and its components, with the sole purpose of providing the services
security trades.


10) In the contract, the defendant indicates that it has an image management file
and sounds that you can capture through your video surveillance systems when it occurs
an alarm jump in the homes of customers. It is added that "The CLIENT may only
have access to information on any incident or recording made as a result of
an alarm jump, sending a written request through the means that allow it in-

indicated in clause 20 of the general conditions, in which the identity of the
of the contract holder, accompanying a photocopy of their DNI, CIF, NIE or valid passport.
gor, as well as the date, time and place where the recording presumably took place".

11) As part of the contract there is the "action plan" in which the definitions appear:


 -"CLIENT: Natural/legal person who signs the CONTRACT, who is the owner of the
 alarm system described in the aforementioned CONTRACT and that is the holder of the word
 master key. The CLIENT may in any case have the status of user "


 USER: Natural person to whom the CLIENT authorizes access to the property and the use of the
 alarm system, making available the means of connection and/or disconnection
 of the same.

 "CONTACT PERSONS: Natural person who may or may not coincide with the CLIENT
 of the contract and that it owns the master keyword."


 - CLIENT MASTER Password: Identifies the CLIENT and the main contacts. Has to
 be provided by them when they contact SECURITAS DIRECT
 by phone. It allows and gives access to all kinds of procedures and modifications, whether
 administrative (contract, action plan, etc.), or operational (verification of jumps in

 alarm). So that you identifies itself to Securitas")

 - COACTION code: In the verification call before an alarm jump, it must be provided
 to SECURITAS DIRECT, by whoever is in the property in a situation of
 real danger to their physical and/or patrimonial integrity.


 There is also a "SECURITAS PASSWORD", "for Securitas to identify itself to you."

 They include:


   C/ Jorge Juan, 6 www.aepd.es
   28001 - Madrid sedeagpd.gob.es 72/102







 -"contact list", four people identified by name and first surname,
 numbered, the claimant, client, with two telephones, the rest with one, all with keys.


 All four are listed in another "standard action plan" listing in the chart, ordered
 as "contact" from 1, the claimant, to 4.

 In the particular conditions, the claimant adds his email.

12) Asked the defendant in evidence about the way in which they identify themselves in the

logs, the different actions of possible users in their different roles that they can assume
mir: owner, authorized, contacts and in the different elements of the system, stated that
They are identified by the reproduction in the log of the interaction that may occur with
each of them, clarifying that the "users with access to the system" correspond to
with SD personnel who may receive a specific incident with the owner or those

designated contacts and, where appropriate, carry out the operations requested by them,
that give rise to logs that were considered as personal data of the claimant, to the
Proceed from an action urged by him or his authorized. There are other logs that respond
given to this premise as those between 12/05/2015 at 14:19:04 and
14:45:45, provided to the claimant, where ***USER.1 accesses the customer file
to manage and agree on maintenance with the client associated with the event that occurred on

11/26/2015.

If the Excel table of access provided to the claimant between 05/12/2015 is examined
at 14:19:04 and 14:45:45, it only shows "the operator views the low code words
demand", "event (...)" and that accesses the client's file, without indicating which owner or contact

causes the request.

On 12/18/2015 at 20:08:18, as a result of a customer call to
SECURITAS DIRECT in the same sense, without mentioning which owner or contact causes the
petition. Appreciating that on that same day, there are logs provided to the claimant,

that respond to "APP service injected event, remote disconnection connections", without
that the cause of the request be correlated, outside the owner or one of the contacts
authorized.

13) In addition, through an application installed on the mobile phone, users or per-
Authorized contact persons can interact with the alarm system, being the telephone

mobile phone a means of communication for security personnel with the claimant to whom
They send SMS or emails. The defendant in evidence stated that "with the mobile device
can connect or disconnect the alarm system, and that said incident is recorded in
the internal memory of the device, although it is only transmitted to the CRA in case the ac-
situation responds to the existence of a security incident. In that case, it is

that is, when a security incident occurs (e.g. disconnection as a consequence of
of an alarm jump) and later the system is disconnected, the log is recorded
in the CRA identifying the user (key, command or code) that has carried out the action. Equal-
Mindfully, if the connection or disconnection is made from the App, the log is transmitted to the
CRA, reflecting that an action has taken place through an Iphone or An-

droid, but the phone number from which this action is performed is not reflected. Add
In this case, the records would be the following:



   C/ Jorge Juan, 6 www.aepd.es
   28001 - Madrid sedeagpd.gob.es 73/102







 * 12/06/2015 at 1:15:27 - Disconnection. (...) 00 - User: 07 Disconnection due to jump of
alarm at 1:15:04 (...). This log records a deactivation of the alarm system by
by means of a remote control following an alarm jump.


Regarding logs associated with interactions with the alarm system through the APP,
installed on the claimant's mobile, these would be the following:

Indicates the logs started on 12/06/2015 14:06:47 Status Request from iPhone to
21:06:08 with different requests from iPhone. In the access boxes

provided to the claimant, on said date and time it is not contained or inferred that the
request is correlated with the claimant or may be through any of the contacts
authorized. In such a way that in view of the Excel table -provided access-
does not know who the person is: owner or authorized contact who requests and arms the system or
the images.


14) The control panel, also called the alarm control console, is usually located
inside the house, is the one that receives the signals from the sensors, and where
activates (arms) or deactivates (disarms), so if it is not activated (armed), it does not recognize
It will generate the signals from the sensors. The home alarm device is connected
7/365 with the CRA. The defendant reported that the connection system and the CRA are carried out

carried out using a SIM card integrated into the control panel.

The defendant stated that the control panel of the alarm system stores records
others. In fact, it can store up to ***NUMBER.3 events, which are deleted over time.
cyclically, depending on the records that are generated and recorded

continually. As new records are generated and recorded, they are deleted automatically.
cyclically the oldest ones maintaining a temporal order of recording and deleting
always within the ***NUMBER.3 records it can hold.

15) The defendant stated in evidence on the question of the way in which they are generated and

store the logs of the operation of the alarm system, which the system generates and al-
stores in the control panel records derived from:

 -Customer interactions with the alarm system, for example: connection, disconnection.

 -Internal verifications of the system: example coverage (...), and


 -Activities of the alarm system in the performance of its function, for example, jump
alarm.

In addition, the defendant pointed out that the catalog of logs that can be generated by the

interaction of the installed system and the CRA is closed, not being possible the creation of
new logs different from those that the system generates. Some of these logs previously
configured, they will be generated as a consequence of the interaction of the system with a
activity carried out by an operator or authorized user of SECURITAS DIRECT, as well as
as well as by the owner of the system or the persons authorized by it.


The internal memory of the device is located on the motherboard of the control panel.
control. According to the defendant, said internal memory records events, among which are
distinguish:

 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 74/102








(i) those that generate a log, a copy of which has been provided in the document.
Item No. 2 of those provided together with the pleadings to the Commencement agreement.

(logs as they leave the SD system, together, those that contain data and those that do not, for
chronological order).

(ii) and other merely technical events related to the interconnection produced
for sending the logs to the CRA of SECURITAS DIRECT (e.g. channel through which
sends the log, successful connection, acknowledgment, etc.). Since they only refer to

the referral and not to any type of specific action, they consider that they would not be part of what
requested by the claimant.

According to the defendant, in both cases, the destination of said records is the CRA, "although the
information mentioned in point (ii) as well as the logs that do not reflect a relevant event

related to the operation of the alarm do not communicate and remain in
the internal memory of the switchboard and are only accessible by SECURITAS personnel
DIRECT in the event of an event that requires the performance of a fo-
laugh.

In evidence, the defendant indicated that from the CRA, the operators have the capacity

to activate or deactivate the alarm only at the customer's request, within the framework of a
telephone interaction with him. This request is duly registered, through
its corresponding log. The assumption was given in the records provided to the claimant
on the day 12/18/2015.


16) The defendant maintains that the claimant's alarm device generated logs (re-
event records) until 20:09 on 11/27/2015, time and date on which the
the intrusion into the home and during which said alarm system was completely
useless mind. As of that date, that device could not generate any more logs.


17) In the records, there is a time jump in logs considered personal data that are
They gave the claimant between 11/27/2015 at 20:17 and 12/4/2015 at 11:05.

18) The first resumption log after 11/27/2015, (cataloged in green when considered
that contains personal data and delivered to the claimant is that of 12-4-2015, 11:05:04,
that the defendant explains that it is produced as a result of technical verifications

through an automatic system called GTI (it appears in the log itself) that is
in charge of carrying out various checks to know the technical state of the system,
proceeding to the opening of a maintenance when necessary. In this case,
an operator is in charge of calling the client to do a review with the client online
and if this is not possible, arrange a visit from a technician to verify the state of the system.


19) It can be seen that until this resumption, as well as in previous days, there are logs in
red color, no personal data, as of 11/28/2015.

20) On 12/05/2015, a new alarm device was placed at the claimant's home.

te, which replaced the destroyed one, being discharged from service on 12/23/2016.

21) Regarding whether it is possible that the logs overlap, the defendant indicated in
proves that "each log line is a unique time-stamped record, and can even

  C/ Jorge Juan, 6 www.aepd.es
  28001 - Madrid sedeagpd.gob.es 75/102







there may be several in the same minute and second, as they are "machines" but this does not
it supposes an "overlay", but rather the generation of several simultaneous logs."


22) With the alarm on 11/27/2015, the defendant proceeded to the pertinent verification
confirmation of the same by attempting to access the system's speech/listening module. To the
not be possible, and disconnection was not received by the user, the mechanism was activated
of contact with the people and telephone numbers established in the document "PLAN OF
ACTION", informing "contact four" of what has happened up to that moment. Of is-
These facts are reflected in the logs with personal data provided to the claimant.



23) The defendant also has logs that it does not consider personal data generated
on 11/27/2015 at 20:09:47, as well as all those of the previous day, 26. The first log that was
generates the claimant as personal data is that of 11/27/2015 20:09:47. At the same time,
Two logs appear as non-personal data, in red, with different codes that
that appear in the claimant's log with a note: "intrusion seismic volumetric garage door-
panel coverage level and coverage, volumetric intrusion description radius, and the second "se-

informative signal". There are also different red logs of the same 27 and all of the
28 to 12/4/2015, 1104:50. Between 28 and 12/4, except for 29, se-
according to the comment that appears test of Logs that report the loss of communication
with the device) up to 4, one per day.


The defendant stated that the logs of 11/27/2015, 20:09:47, begin by means of the
detection of a volumetric alarm alert at 20:09:47, generating a code
random (1155) that is generated with any alarm jump, so that if it is sent to a
watchman, he can disconnect it (in this case, it was not used to send any
vigilante, since it was determined that it was not necessary). From that moment on, there are

system verification logs for the transfer of information to an operator, who
From that moment, make the relevant calls to those who appear as contacts
designated in the contract by the claimant. These attempts are unsuccessful with respect to
the first three contacts, when the voicemail is sent, being able to carry out the
communication with the room of contacts which, however, does not provide the word that
allows establishing communication, concluding the processing of the alert on 11/27/2015

at 20:17:07 hours, last log of personal data that is recorded and
delivered to the claimant.

The defendant stated that "all actions related to the alarm and
contact attempts have been considered personal data and provided to the

claimant, not having such consideration the logs exclusively related to the
the way in which the SECURITAS DIRECT systems manage and channel the
actions to be carried out in these cases or those that refer exclusively to the operator
intervener. The justifying explanation of the consideration or not of the information as
personal data is contained in the report provided as Document No. 1 in the

allegations to the Commencement Agreement."

The defendant indicated that the logs generated from the moment the jump occurred
alarm of 11/27/2015, 8:09 p.m., and once those related to the
attempts to communicate with the contacts designated by the Complainant, refer to
successive communication attempts between SECURITAS DIRECT and the system installed in

the Claimant's address, which were unsuccessful and being machine interactions to
technical machine.
 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 76/102








Likewise, there are different logs related to alarm jumps later
deactivated on 12/5/2015 from 18:56:37, provided to the claimant by

considered to incorporate personal data related to it, given that it is
actions aimed at different tests on the operation of the installed system
in your home, carrying out different alarm tests (volumetric, seismic, for
duress or magnetic). There is also an alarm jump on 12/6/2015 at
01:15:04 hours, being able to check the logs generated by the system, and that concludes
with the communication with the owner that indicates at 01:17:22 hours that the jump of the

alarm may have been generated by the fireplace.

24) For the purpose of initiating the action protocol, the alarm signals are considered to be
received at the Alarm Receiving Center from the capture of the elements
intrusion detection, SOS button, anti-robbery button, and duress code

tion. In the contract there is a protocol in this regard that distinguishes if it jumps, "without disconnecting"
user connection", in which case SD verifies "by accessing the speech-listening module"
system tab and/or call to the landline of the property, provided that there is
the latter. If through these means:

 - An answer is obtained: the person will be identified with the keyword

teacher or contact If the keyword is correct, the user will be provided with the
precise technical instructions for you to disconnect the system.

 - If the keyword is not correct or no response is obtained: SECURITAS DIRECT
proceed to comply with the verification procedures provided for in the

current Private Security regulations as well as to use the complementary means
verification such as proceeding to the verification call to the CONTACTS
PRINCIPAL and/or OPERATORS established, and/or the Security Guard and/or F.C.S. Yeah
it was a confirmed real alarm. In any case, the decision to issue the notice
will correspond exclusively to SECURITAS DIRECT.


In the event that "user disconnection" occurs, it is the case in which the alarm goes off,
and in less than 20 seconds (since the alarm jump), an alarm signal is received.
disconnection in the CRA. In this case, "an announcement will be automatically issued
recorded through the speech listening module of the system, in which the client will be informed
of the signal received as well as the execution of the disconnection by the user or person

authorized and the cancellation of the incident"
"In the event that the disconnection signal is received in a time greater than the
indicated in the previous paragraph, SECURITAS DIRECT will proceed to verify the jump of
alarm by accessing the system's speech-listening module and/or calling the telephone
of the property, provided that the latter is available, to carry out the

verifications that it deems appropriate according to its diligence as a Company of
Security and that are adjusted to the applicable Private Security regulations."

The one claimed in tests, to the question of Verification mode/s of the applicable alarm/
s in this case, and which logs are generated and indicate those with this description that appear in the

period requested by the claimant, responded that they can be classified as:

(i) those that are generated as a consequence of an interaction of the holder of the contra-
to or an authorized by the same with the alarm system;

 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 77/102








(ii) those derived from a human interaction produced from the CRA; and


(iii) those that are generated automatically, without human intervention of any kind.


It considers that "only the logs listed in points (i) and (ii) imply a
processing of personal data, and of these, only the one listed in point (i) supposes the
data processing of the claimant or the persons authorized by the claimant, in the
Document No. 1 (report of 01/29/2021, provided by the defendant in allegations)

provided by the defendant together with her pleadings, it was clarified that the
right of access by the interested party to their own data, only affected the
contained in the aforementioned point (i) and not to those related in points (ii) and (iii), which do not
incorporate personal data of the Claimant. "

Specifically, and with regard to all the logs contributed to the Agency, they would fit into

As described in this answer the following logs that represent verifications of
alarm:

 * Logs from 11/27/2015 from 20:09:47 to 20:17:07,
moment in which an action plan is contacted. These are 21 logs in which

description they are all related to the action of the CRA, with additions such as call,
communicating, skips voicemail, leaves message on voicemail, operator gets
talk to contact 4, wrong word, or other mentions to contact 1, 2, 3, call to
H/E, H/E audio is not sent to FCS and other keys in the various frames, which as already
mentioned are not understandable without an understandable key and explanation and

Brief of its meaning.

* Logs from 12/06/2015 from 01:15:04 to 01:17:40. In the
that several logs appear, "indicates that it may be the chimney", and in the same sense with
keys in the different tables, which are not understandable without a key and explanation
understandable and brief of its meaning.


The defendant reported in evidence that, in the case of the data period requested by the
complainant, there was no confirmed alarm notification record that was
notify the Police.


25) The defendant states that "the internal memory of the switchboard (Control Panel)
initially installed and destroyed in the events that occurred on 11/27/2015, not
incorporates, within the time period for which the right of access was exercised,
no log referring to (...) or des(...) of the alarm system, this being, and no other, the reason
for which the information provided to the Claimant does not incorporate any record of this

nature in relation to the disabled device.

Regarding the logs that were recorded in the internal memory of the system installed on the date
12/5/2015, the defendant indicates that she could not access the information at any time,
Therefore, it was not possible for him to provide it to the interested party. As for the reason, he points out that
the CRA, can only access the logs that are transmitted to it from the

internal memory of the device, but not those of a merely technical nature that are
generated in said internal memory, since SECURITAS DIRECT can only
access the content of said device in the event of a
 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 78/102







incident requiring forensic analysis. In this case, given that said incident had no
Instead, the device remained in the Claimant's home until the end of the
Contract, without at any time SECURITAS DIRECT being able to access said

internal memory nor was it necessary to carry out any forensic analysis of its
content, in the absence of an incident that required it. how can
verified, these answers do contain information referring to the period
mentioned in the question posed.

26) The defendant stated in evidence that after accessing the records contained in

the memory of the alarm, it has been verified that it was connected from the
day 11/22/2015 at 11:56 and that it did not present any anomaly.

27) Regarding access to personal data contained in the internal memory of the panel
of control, after the placement of the new one on 5/12/2015, do not appear in the access

provided from 12/14/2021 nor in the precedent of 02/23/2021.

28) In document 2 of allegations, -total logs- Excel table of all logs,
differentiated in red-considered as non-personal data by the defendant-, and
in green, considered as personal data by the defendant, figure yes:


With different keys of the "(...) of the event" distinguished in red those considered non-data
personal, example, there are two in red, from 11/27/2016 20:09:47, and another with the same date and
time, in green. The defendant stated that the logs refer to different events: the
first it involves the detection of an alarm jump detected by a volumetric sensor;
the second involves the generation of a deactivation code in case it is

necessary to go to the house once the corresponding verifications have been carried out, which
they also appear in the log table; and the third refers to coverage (...)." Add
that dates and times can also coincide in the logs that have personal data,
providing the example of 12/5/2015 18:38:10 in which there are five different, related
with on-site maintenance of alarm change.


29) The defendant reported in evidence that the periodic reviews of the fund system
operation of alarms provided for in article 43 of RD 2364/1994 approving
under the Private Security Regulations and article 5 of Order INT/316/2011, are
carried out from your CRA remotely, normally every three months. In addition, rea-
Conducts daily communication tests and correct transmission of the alarm system with the CRA

automatically. Give some examples from 5/12/2015 that are included in the
logs provided to the claimant and from 12/6/2015, 18:45:42, which is not considered a log of
Personal data of the claimant, appearing in red.

On-site reviews are recorded in the log of the management system of the

CRA alarms, since the technician must check a series of parameters of the
system and carrying out the various functional checks.

If remote reviews were carried out, these would be reflected in the event memory
of the alarm system.



On the other hand, maintenance tasks are corrective, aimed at resolving
specific incidents that do not allow the proper functioning of the system of the

 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 79/102







alarm, and are intended to rectify said incidents, and can be carried out
according to the nature or need, in person or remotely.


                          FUNDAMENTALS OF LAW

                                          Yo

In accordance with the powers that article 58.2 of Regulation (EU) 2016/679
(General Data Protection Regulation, hereinafter GDPR) recognizes each
Control Authority, and as established in articles 47, 48.1, 64.2 and 68.1 of the

LOPDGDD, is competent to initiate and resolve this procedure the Director of the
Spanish Data Protection Agency.

Likewise, article 63.2 of the LOPDGDD determines that: "The procedures
processed by the Spanish Data Protection Agency will be governed by the provisions
in Regulation (EU) 2016/679, in this organic law, by the provisions

regulations dictated in its development and, insofar as they do not contradict them, with character
subsidiary, by the general rules on administrative procedures."

                                         II

Article 4 of the GDPR, under the heading "Definitions", provides the following:


1) "personal data: any information about an identified natural person or
identifiable ("the data subject"); An identifiable natural person shall be considered any person
whose identity can be determined, directly or indirectly, in particular by means of a

identifier, such as a name, an identification number, data of
location, an online identifier or one or more elements of identity
physical, physiological, genetic, mental, economic, cultural or social of said person;"

"7) "responsible for the treatment" or "responsible": the natural or legal person, authority

public authority, service or other body that, alone or jointly with others, determines the purposes and
means of treatment; if the law of the Union or of the Member States determines
the purposes and means of the treatment, the person in charge of the treatment or the criteria
for their appointment may be established by the Law of the Union or of the
Member states"



In the present case, in accordance with the provisions of article 4.1 of the GDPR, the
processing of personal data, since SECURITAS DIRECT
carries out, among other treatments, the collection, conservation, consultation, use, access
of the personal data of the clients-users, such as: name, surname, email
electronics, credentials..., etc.

SECURITAS DIRECT carries out this activity in its capacity as the person responsible for the

treatment, since it is who determines the purposes and means of such activity, by virtue of the
article 4.7 of the GDPR.

This disciplinary procedure is initiated because the complaining party considers
that their right of access derived from TD/00167/2021 has not been met, alleging
that not all your personal data (logs) have been provided and that those that have been

 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 80/102







sent are unintelligible to you, in the terms established in the background of this
resolution proposal.

Thus, in this sanctioning procedure, it is a question of elucidating, through the instruction of the
itself and taking into account the allegations and documentation provided by the claimed party,

whether the right of access has been fully met, and how it has been carried out
carried out, in the terms established in the GDPR, and, therefore, if there has been an infringement
of the data protection regulations.


                                         II


As highlighted in the Statement of Motives of Law 5/2014, of 4/04, on Private Security
vada, security is one of the fundamental pillars of society, it is found in the
basis of freedom and equality and contributes to the full development of individuals. Bliss

law considers private security as an activity with its own entity, but at the same time
as an integral part of public security.

The activity of operating a security system through a CRA is that
exclusive, complementary service or activity of a commercial nature and prevention of
crime, subordinated to public security, developed and provided by companies of

Security approved by the Ministry of the Interior, subject to the regulations of
Private security, which use means, technical measures, protection elements,
regulated and approved, through electronic security systems against
risks of theft or intrusion with the functional characteristics described in the Standards
UNE for its commercialization, sale, installation in a private area demanding
Private security. This is materialized through the signing of a contract of

leasing of maintenance services and connection of said system to a Center
Control integrated in the Alarm Center also authorized, for the reception,
treatment, verification of alarm signals emitted by said security systems
installed, through the technical and human procedures provided for in the Order
316/2011 of 1/02 on the operation of alarm systems in the field of

private security, in such a way that its reality can be determined or not, and its
communication in case of being confirmed as real to the Police.
The purpose of this contract is the provision or material delivery by the Company of

Security of a Security System and its installation with a service purpose of
Alarm Receiving Center, and later the maintenance of the system in
proper functioning for the provision of contracted services at home
(home) of the contracting user.

Upon finding the installation of the device and security elements linked to the
maintenance of the same as a system or product that is linked to a service of

exploitation through an alarm receiving center, it is a contract of
service linked to the maintenance service of the installed system, dedicated
exclusively for reception of alarm signals emitted by the security system
installed and to the treatment of said signals for the determination of their real origin or
false by complying with established regulatory procedures.


The mentioned order of operation of the alarm systems establishes that the CRA
I carried out verifications through rules contained in technical procedures described
and complementarily human. After completing these formal requirements and
 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 81/102







materials required, said alarm signal confirmed by the CRA can be communicated
as real to the Police.

The judgment of the Provincial Court of Madrid, section 11, 98/2014, of 03/11/2014,
analyzes the nature of the security contract in its mode of provision of

central alarm services by a company dedicated to it, indicating in its
second legal basis:

"As this same Chamber already stated in its Judgment of June 30, 2011,

which refers to the one of April 29, 2010, which in turn refers to the one issued on
June 2007, citing the Judgment of the A.P. of Barcelona of December 30, 2004,
"...the contract signed by the parties is a service lease contract and not a
work, and this based on doctrinal criteria accepted in the jurisprudence of the Court
Supreme Court (S. 4.2.1950, among others), which are supported to establish the difference, in the

immediate object of the lease obligation, so that if the lease agrees to the
provision of a service or work of an activity itself, not the result that
that provision produces, which is the case at hand, the lease is of
service. And on the other hand, if the provision of a result is obligated, without considering the
work that creates it, the lease is work. Well, the obligation of the

defendant, appealed today, is an obligation of activity, and not of results.

It is evident that the purpose of the contract was to provide the commercial premises with
security measures aimed at preventing the commission of criminal acts and the
Defendant's fundamental obligation was to provide the services necessary for the
the installed security mechanisms work correctly.


Pursuant to the security services lease contract, the entity
defendant, undertook, not to avoid the possible commission of robberies in the farm, nor to
ensure in any case the restitution (in kind or in cash equivalent) of what
third parties could steal, but exclusively to respond as normal
operation of a security system, consisting of a burglar alarm with

telephone connection with the alarm center, making the detection by
sensors located at various points throughout the offices, so that the system
had to transmit -via telephone- a signal to the Alarm Center, which in turn had to
give notice of the possible crime to the security forces, so that they prevent their
consummation, therefore, had an essentially preventive and protective purpose, therefore,

as has been exposed, the object is in the activity, and in these terms, they are the only
possible to demand responsibility".

The sending and receiving of signals by the device and the CRA occurs in a home
particular, understanding as such, a suitable space to develop private life in it,
on which its inviolable nature will affect, as provided for by the EC in its article 18.2
infringement that can occur regardless of whether, at the time of the
entry, whether the holder of the right is inside or outside his domicile. In addition, there is
a close relationship between the inviolability of the home and the right to privacy

enshrined in art. 18.1, as STC 22/1984 rightly pointed out, "the inviolable domicile is
a space in which the individual lives without necessarily being subject to the uses and
social conventions and exercises his most intimate freedom".

The inviolability of the home therefore guarantees that intimate sphere of personal privacy and
family (within the limited space that the person himself chooses), in front of all kinds of

 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 82/102







invasions or attacks by other people or public authorities not consented to by
the right holder. The constitutional protection of the domicile thus has an institutional character.
instrumental.


                                          IV.


The defendant provided some details about the operation and components of a
alarm system.

Basically, a control panel is installed at home, which is usually accompanied by
an alarm kit (additional items such as motion detectors/camera and that
may allow viewing via a mobile device connected via a

installed application, together with other means such as remote control, sirens, reader of
keys, smart keys that allow the alarm to be disconnected simply by bringing the
key to reader, magnetic detectors etc.)

The control panel that is usually installed inside the home, in a place that is not
be very visible, it is connected to the CRA, where notifications and warnings arrive

like alarm jumps.

In turn, the CRA must carry out operations to verify and analyze the anomalies that
can occur, control of power outages, alarm triggering for different
Reasons to give some examples. At the same time, in remote mode, the ARC can
activate, configure and verify the functions of the alarm system, perform diagnostics of
connection, and control the alarm detectors.


The control panel allows to activate the system, arm, disarm the alarm, connects with the
additional elements such as sensors and receives signals from detectors
installed peripherals. For example:

-if a door contact or a movement sensor is activated, the panel will give the signal, if
the alarm is not deactivated with a valid user code, the system assumes that there is a
intrusion and will give an audible or light signal, at the same time as communicating with the CRA.


-If the panic, SOS or anti-robbery button is activated, it directly communicates with the CRA
It also allows bidirectional communication with the CRA via microphone and speaker.
integrated (listening speech module).

The CRA is in charge of analyzing and interpreting the alarm jumps, it is the headquarters of control of
alarm systems.

When the alarm jump is attended, the CRA has to analyze the information

thoroughly to determine what type of emergency it is or if it is a
false alarm.

In any case, the CRA will contact the owner or contacts
designated to inform you of what happened.

The communication between the control panel and the CRA can occur by various means and
method. In general, the communication between the alarm systems and the CRA, is

given through two different communication paths to allow communication
is continuous, even if one of the ways fails or is sabotaged.
 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 83/102







Bidirectional communication with the alarm system is allowed from the CRA,
being able to access the system through the software for remote control of the system, this
also regardless of whether the system has lost mains power

installation.

Systems in general, record the activity of authorized users (customer and
contact persons designated by him), as well as operators of the claimed,
including machine-to-machine operations generating access traces: -log in-,
origin, uptime, actions, and connections.

The information in these records is essential for preparing management reports and for

monitoring. Among the events that the different systems record, are for example
the start, end of session, access, modification of files and directories, change in the
main configurations, program launches, etc.

The activity records of the different systems and equipment are the data from the
which it is possible not only to detect performance failures or malfunctions, but
also detect errors and intrusions. With them, systems of

monitoring that properly configured can generate alerts in time
real. On the other hand, they facilitate forensic analysis for the diagnosis of the causes that
cause the incidents. Finally, they are necessary to verify compliance with
certain legal or contractual requirements during audits.

                                         V


Putting things this way, the claimed party considers that the "technical" or
"internal", are not personal data of the complaining party, not having, for
therefore, obligation to provide said data as part of the right of access
exercised by the latter.

The question excepted by the claimed regarding the data of
personal nature of those named by the defendant: "technical" or "internal" logs, which

are characterized, as he defends, by not referring to any person, specifically or
even the claimant and for not containing information about any person, or
even the claimant. Adding also that it considers them confidential, worthy
of the protection of business secrets.

It must be based on article 1 of the RGPD in which it is established as an object


"1. This Regulation establishes the rules relating to the protection of
natural persons with regard to the processing of personal data and the rules

relating to the free movement of such data.

2. This Regulation protects the fundamental rights and freedoms of
natural persons and, in particular, their right to the protection of personal data.

The exercise of the right of access is carried out both within the framework of the legislation in

data protection, in accordance with the objectives of the legislation in
data protection, such as, more specifically, in the framework of the "rights
and fundamental freedoms of natural persons" and, in particular, their right to "the
protection of personal data", as established in article 1, paragraph 2, of the

 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 84/102







GDPR.

It is essential to understand that it is about determining how to apply the
provisions to certain situations in which individual rights are at stake

game for the processing of your personal data.
Article 8.1 of the Charter of Fundamental Rights of the European Union states: "1.
Everyone has the right to the protection of personal data that

concern.

Recital (26) indicates: "The principles of data protection must be applied to
all information relating to an identified or identifiable natural person. The data
pseudonymous personal data, which could be attributed to a natural person through the
use of additional information, should be considered information about a person

identifiable physics. In order to determine if a natural person is identifiable, the
into account all means, such as singling out, that you can reasonably use
the data controller or any other person to directly or
indirectly to the natural person. To determine whether there is a reasonable probability
that means are used to identify a natural person, must be taken into account

all objective factors, such as costs and time required for identification,
taking into account both the technology available at the time of treatment and the
technological advances. Therefore the principles of data protection should not
apply to anonymous information, that is, information that is not related to a
identified or identifiable natural person, nor to the data converted into anonymous of

so that the interested party is not identifiable, or ceases to be. Consequently, the
This Regulation does not affect the treatment of said anonymous information, including
for statistical or research purposes."


Opinion 4/2007 of the Article 29 Working Group on the concept of data
personal, indicates that it is: all information about an identified physical person or
identifiable.



The definition reflects the intention of the legislator to maintain a broad concept of "data
personal", which requires a broad interpretation that includes all information that
can be linked to a person, or refer to an identifiable person, in order to
to protect the freedoms and fundamental rights of natural persons, among others,
particularly your right to privacy in regards to data processing
personal.


This breadth in terms of the extension of the term "personal data", such as the
diversity of fields in which it can be manifested, is confirmed in various
judgments of the CJUE, by way of example in that of 12/20/2017, case C-434/16, paragraphs
33 to 35:


"33. As the Court of Justice has already pointed out, the scope of application of the Directive
95/46 is very broad, and the personal data to which it refers are
heterogeneous (judgment of May 7, 2009, Rijkeboer, C-553/07, EU:C:2009:293,
paragraph 59 and cited jurisprudence).



 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 85/102







34 Indeed, the use of the expression "all information" in the definition of the
concept of "personal data", which appears in Article 2(a) of the Directive
95/46, evidences the objective of the Union legislator to attribute to this concept a
very broad meaning, which is not limited to confidential data or data related to the
privacy, but can cover all kinds of information, both objective and

subjective, in the form of opinions or appreciations, as long as they are "about" the person
in question.

35 This last requirement is met when, due to its content, purpose or effects,
the information is related to a specific person..." (The underlining is ours).


The doctrine elaborated by the CJEU regarding the breadth with which the
concept of personal data has been adapted, taking into account the various advances
technological. Thus, in the judgment of 11/24/2011, case C-70/10, in its
paragraph 51 considered that IP addresses are protected data of a personal nature, since
that make it possible to specifically identify such users. This criterion is maintained and

extends to the cases in which it is even dynamic IP addresses,
those temporarily assigned by network access providers to their
clients, considering that they continued to constitute personal data when the person in charge
to store them, in this case the owner of a website, did not have the data
necessary for the identification of the specific user, but that they were in
possession of a third party, picking up this criterion, again favorable to an interpretation

of the concept of personal data, in the STJUE of 10/19/2016, in case C-
582/14, Patrick Breyer and Bundesrepublik Deutschland, when asserting that IP is data
of a personal nature for the service provider: "article 2, letter a), of the
Directive 95/46 must be interpreted in the sense that a dynamic IP address
recorded by an online media service provider on the occasion of the query
by a person from an Internet site that that provider makes accessible to the public

constitutes personal data with respect to said provider, within the meaning of the aforementioned
provision, when he has the legal means that allow him to identify the
person concerned thanks to the additional information available to the service provider
Internet access of said person" (paragraph 49).

More recently, in its judgment of 06/17/2021 (Case C-597/19), analyzing a

load assumption, from the terminal equipment of a user of a network between peers (peer-
to-peer) and towards the equipment of other users of said network, of parts, previously
downloaded by the aforementioned user, from a multimedia file that contains a work
protected, even if those parts are only usable by themselves from a
certain download volume and in which it is the software itself that
automatically gives rise to the aforementioned charge, in its paragraph 97 it recalls that "With

preliminary nature, it is necessary to point out that in the main matter there are two
different personal data processing; namely, one that you already initially performed
Media Protector on behalf of Mircom, in the context of peer-to-peer networks.
peer ), consisting of registering the IP addresses of users whose peer connections
The Internet was supposedly used, at one point, to upload works

protected in the aforementioned networks, and another that, according to Mircom, should be carried out by Telenet
in a later phase, consisting, on the one hand, of identifying those users by comparing
the aforementioned IP addresses with which, at that very moment, Telenet had assigned
to the aforementioned users to carry out said charge and, on the other hand, to notify
Mircom the names and addresses of those same users".

 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 86/102








In light of the broad scope of the definition of personal data, a restrictive assessment
of such a definition by the data controller would lead to a

misdetermination of what is personal data and, ultimately, to a
violation of the contents by the RGPD to the interested parties, among which is the
Right of access.


The AEPD, as part of its function of supervising the application of the legislation on
data protection, must interpret the exceptions to the application of the concept of
personal data such as the one defended by the defendant, since if her theory were validated

on a part the logs of the alarm system, perhaps they would be outside the scope of
application of the GDPR.

The aforementioned breadth in the definition of personal data is defined by:

-"all information", including all data that provides information,

whatever the class of this that is to have a broad interpretation, encompassing
subjective or objective information, including evaluations, diagnoses or opinions.

-"about" a natural person, thus relating any type of information about a
Physical person. Here it is essential to connect the purpose of the information with the

"on" whom it is treated and the effects it may have for that person.

-"identified" or "identifiable". Refers to any person whose identity can be determined,

directly or indirectly, in the sense that, to qualify data information
personal, it is not necessary that such information by itself allow the identification of the
interested. In this case, the information that makes it identifiable are the logs, which both
the so-called technicians by the defendant, such as those considered to be personal data
claimant's staff, appear in relation to a device, structured in a single and
unitary compact block set chronologically ordered to reflect the

events from the device referred to said claimant that is identifiable.

Opinion 4/2007 adds: "In cases where, at first sight, the identifiers
available do not make it possible to single out a specific person, this person can still be
"identifiable", because that information combined with other data (whether the

responsible for their treatment is aware of them as if not) will allow to distinguish
to that person from others". In this case, not everyone can identify you, but the
Securitas personnel yes, and if there is someone who can do it, it would be enough,


-regardless of the content or nature of the origin of the information.


-As the defendant has already reproduced in his report of 01/29/2021, provided by the
claimed in allegations, regarding information "about" a person, the Opinion
4/2007, exemplifies its meaning with: "the data included in the personal file of a
person saved in the personnel department of your company, who are

clearly related to your status as an employee of said company. But not
It is always so obvious to establish that the information is "about" a person
concrete. On some occasions, the information provided by the data refers not to

 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 87/102







both people and objects. These objects usually belong to someone, or can
be under the influence of a person or their authorized, or exert an influence on
it or may have a certain physical or geographical proximity to persons or other

objects. In such cases, the information can only be considered indirectly
refers to those people or objects. A similar analysis can be applied when the data
refer in the first instance to processes or facts, such as the
operation of a machine when human intervention is necessary. Low
In certain circumstances, this information may also be considered information
"about" a person.


- "We are before a third category of "envelope" when there is an element of
"result". Despite the absence of an element of "content" or "purpose"

data can be considered to be "about" a particular person because,
taking into account all the circumstances surrounding the specific case, it is likely
that its use affects the rights and interests of a certain person. Enough with
that the person may be treated differently by other people as
consequence of the processing of such data."



It should be noted that the scope of the concept of personal data and, therefore, the
differentiation between personal data and other data, would form an integral part of the
evaluation carried out by the data controller to determine the scope of the
data to which the interested party has the right to obtain access, elements that would be

to include in the "privacy by design" configuration. In this case, the
The defendant indicates that it was not until 2020, when it began to analyze the treatment of
the logs, of the alarm devices connected to the CRA, serving the report of
01/29/2021 also as a management tool, of the requests to exercise
rights.


In this case, it is the installation of an alarm, a device that controls
24 hours a day, every day of the year, the security of the
housing in a private address, which is implemented through a security contract and
that has a device installed in the claimant's home connected with elements
additional verification, and that, for its correct functioning, it also requires

maintenance and monitoring, and must be connected. From system settings
It is correlated that, from its use, interactions and alarm jumps, logs are generated that are
correspond unequivocally with personal data of identified persons,
identifiable and information about each other, those identified and those who
may be identifiable.


Focusing on the refusal of the defendant to classify as logs that are data from
of a personal nature, to the so-called technical logs, that is, because they do not collect information

about an interested party, nor does it pretend to know information, and their
rights and freedoms, it must be remembered that these logs that are discarded from the scope of
application of the GDPR, the claimed party classifies them into categories, which would consist of
briefly, in:

-technical communication signals between devices in order to verify the correct

operation or failure records.

 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 88/102







-gather information through informative signs,

-Internal records before a specific event.



It is observed in the report of 01/29/2021, provided by the defendant in allegations, in the
Table I, which appear as descriptions of this type of technical logs, and which are
would therefore find in one of the three categories explained above, assumptions
such as: "information on alarm jumps", "alarm jump on sensors", or

"periods in which there is a loss of connection between SD servers and the
device installed in the home of the interested party", the "cancellation of the incident",
"relevant signal that is transmitted to an operator to start the management process",
"issuance of periodic technical signals to confirm that it is indeed
connection and willingness to carry out the activity". All of them, according to the defendant, respond to

internal communication-verification protocols, without explaining how it considers that these
logs, both for their content and for their effects, does not estimate that they can affect the
rights and interests of the interested party or how he considers that they are not referred to him, if,
In addition, when extracting them from the system they appear grouped and related to the person in the
claimant and his home to use them for the purposes of security control of events and
correct functioning of the system, and that would constitute information that concerns you.



The consideration of personal data that "concerns" you should not be interpreted
way too restrictive. This is how Directives 1/2022 interpret it, on the

rights of the interested parties, right of access, version 1.0, adopted on 01/18/2022,
by the European Committee for Data Protection and that appears on its website, although in consultation
public from 01/28 to 03/11/2022. In its numeral 103, it indicates that "the classification of the
data such as personal data relating to the data subject does not depend on the fact that such
personal data also refer to another person. Therefore, it is possible that the
personal data refers to more than one person at the same time and in its numeral

104, that "The words "personal data concerning you" should not be interpreted
in an "overly restrictive" manner by data controllers, as already
declared the Working Group of Article 29 in relation to the right to portability of
the data. Transposed to the right of access, the CEPD considers, for example, that the
recordings of telephone conversations (and their transcription) between the interested party

included in the right of access, provided that the latter are data
personal".

The aforementioned Directive 4/2007 establishes, as already mentioned, that: "in some
Sometimes, the information provided by the data refers not so much to people
like objects. These objects usually belong to someone or are under the influence of
a person or exert an influence on it", and that in those cases, there is the

possibility that the information refers to those people, albeit indirectly.


Well, in the case that we are examining, all the logs, including those
generated and stored in which the owner-users do not intervene, is operated by
SD employees in processes in which the owner does not interact, be it in operations
internal techniques that reveal information about the effectiveness and operation, by
be the alarm installed in your home, linked to the contract for the provision of
subscribed services, establish a connection between the object (the alarm) and the affected,

 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 89/102







since the alarm is identified with a unique identifier (a numbering
specific for each alarm device) for that service that inevitably links
the interested party with the device and everything that is generated and recorded in relation to the

same. If we take any of the submitted logs in isolation, they would identify the
that person.

According to SAN 3091/2019, of July 23, 2019, "On the one hand, it is a
natural person, and therefore fully identifiable, who signs an installation contract and
maintenance of an alarm for the protection of your home with the company

actor security. Signature of the contract from which a series of
rights regarding custody and security of said home. On the other hand, and this
It is important to highlight it, the right of access is exercised with respect to records and
signals captured and sent by the alarm equipment installed in a private home,
being exercised precisely by the person who owns said domicile."


Thus, in this case, with this link between the alarm and the interested party, through the
unique identifier that links the alarm to the contract and to the interested party, alarm system that
put into operation or programmed, generates information about that person, so
that all the logs discussed are considered personal data.


Apart from the fact that the information may relate directly to the claimant, for
be identified or be able to be identifiable as it is in active interactions or
passive, it is also identified indirectly because the information of the
logs, all, including the technicians, associated with the object or device, which would indicate that the
information will be about the claimant because they are affected by their right to

security of your own home and in your own home, affecting those logs.

Both the technical logs named after the defendant, as well as the rest, remain
stored and guarded by the defendant, document and contain information
directly or indirectly on the safe operation of your contracted system, is its object,

as regards the claimant or concerns him, at least. His interpretation does not
would be complete if it is considered to separate this information that the defendant calls
"technical logs" that he considers should not remain but stored in his possession, without
that have to be used as an instrument provided to the claimant for his knowledge.

In addition, all logs and event records, both the so-called

technical by the claimed party as well as those that are not, are included in the same
"raw" or "online" format, because they appear interrelated and conditioned, so
chronologically, with the difficulty of its understanding if not completely, and
advising their protection in terms of integrity in their security jointly.
It should not be forgotten that one of the functions of the logs can be to avoid the

modifications or their follow-up to know the events. On the other hand, for
For example, an access due to a security breach would obtain full information by
appear ordered according to a single purpose. On the other hand, that the software
used or its options configure the logs as "technical" cannot be used to
extend the total and automatic exclusion of the entire log, but exclusive and

exceptionally, of the data that, based on the descriptive or key qualities that
hold, have a substantial impact on the trade secret.

Consider, for example, the technical logs collected on the day of the intrusion and the

 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 90/102







subsequent days, which relate to internal operations for which the defendant can
deduce what happened, and the consequences drawn from the connection of the days
later, days of lack of connection, all of them affect the right of the claimant

because they are related to the right to security of their goods and property that the
tries to protect by permanent operation of the device and warranty
by signing a contract with obligations and rights for both parties.
In this way, only the defendant could understand what happened to the system
contracted by the claimant, when the technical logs, which are linked to the
person of the claimant, are also considered to affect directly or not the

claimant's rights. In addition, it must be added that in the face of the same events,
events that occurred at the same moments, such as alarm jumps, or
power cuts, that other type of logs are generated that the defendant considers must be
have a differentiated treatment for being technical.


In short, the processing of log data is for the purpose of executing the
security contract, resulting in one of its objects being the log record,
which are all related to home security. The relationship between the
system, signals and owner of the alarm system given the purpose of the treatment
of the logs and the object on which it falls is evident, since the technical logs that
identify the claimant also concern his right that he holds as owner and

responsible for the correct use of the contracted system, in front of which said
registration of events, fundamental means for the affected right of the claimant.

These log record data, which in this case the defendant denies are of a
personnel, defining them as technicians, grouped by responding to internal protocols of

communication-verification, registration of signals or internal procedures, can
actually be used for example also for forensic purposes in a case of
responsibility for the operation of the system of which the owner is the claimant.

Undoubtedly, the system with all its records is identified with the claimant,

affecting their rights and interests. It cannot be deduced that these data are not
information about an identified or identifiable person and also part of their
rights affected, such as the theft suffered, are related to the logs,
including those that the defendant considers technical and that actually identify the
claimant and directly affect their rights.


In conclusion:

1. The GDPR determines what personal data is in its article 4: "data
personal: any information about an identified or identifiable natural person ("the
interested"); An identifiable natural person shall be considered any person whose identity

can be determined, directly or indirectly, in particular by means of an identifier,
such as a name, an identification number, location data, a
online identifier or one or several elements of physical, physiological,
genetic, psychological, economic, cultural or social of said person;"


2. The complaining party has entered into a security contract with the complaining party. For
For this, an alarm device is installed at the home of the claimant.

3. The alarm device located in the claimant's home is identified with a

 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 91/102







unique and permanent identifier (a specific numbering for each device of
alarm) for that specific contract for the provision of services.


4. Through the alarm system, logs linked to the alarm device are generated
installed in the domicile of the complaining party, attached in turn to the contract signed by
the latter with Securitas Direct. The SAN 3091/2019, of July 23, 2019, defines the
logs as "records and signals captured and sent by the alarm equipment installed in
a private residence."


5. Each one of the logs without distinction inevitably links, therefore, the interested party with
the device, with everything that is generated and recorded in relation to it, and with the
signed contract. Each of the logs uniquely identifies the interested party.

6. In addition, all logs concern the interested party in relation to his rights, since

that the logs are connected to the security of the home, affecting the
claimant regarding his right to the safety of his home and security in his
own home.

7. The logs identify the claimant, as it is information about a natural person
identified.



Therefore, in this specific case and considering the context, and having examined all the
concurrent circumstances, the access content must include all logs
generated by the alarm system, including what the claimed party calls

as "technical" logs, as they are considered personal data under the terms of the
Article 4 of the GDPR, including those that have not been delivered because they are classified as
technicians for the claimant.


It is concluded, in this specific case, that all the logs are personal data,

including those called technicians by the defendant, who identify the claimant and
affect the claimant in one way or another, so they would enter into the right of access
that should be provided.

                                          SAW

Regarding the statement by the defendant that the "logs that do not imply treatment-
data processing", that is, the "technical" logs, could contain information about procedures
internal technical data, whose disclosure to third parties would imply the assignment to third parties of your
"know how" or trade secrets, recital 63 of the GDPR states:


Interested parties must have the right to access the personal data collected that
concerned and to exercise that right with ease and at reasonable intervals, in order to

know and verify the legality of the treatment. This includes the right of data subjects to
access data related to health, for example the data of your medical records that
contain information such as diagnoses, test results, evaluations of
physicians and any treatments or interventions performed. all interested
must, therefore, have the right to know and to be communicated, in particular, the
purposes for which the personal data is processed, its processing period, its

recipients, the implicit logic in any automatic processing of personal data and, therefore,
 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 92/102







at least when it is based on profiling, the consequences of said
treatment. If possible, the data controller should be empowered to
provide remote access to a secure system that offers the interested party direct access to

your personal information. This right must not adversely affect the rights and
liberties of third parties, including trade secrets or intellectual property and, in
In particular, intellectual property rights that protect computer programs. No
However, these considerations must not result in a refusal to provide all
the information to the interested party. If you process a large amount of information relating to the
data subject, the data controller should be empowered to request that, before

If the information is provided, the interested party specifies the information or activities of
treatment referred to in the request." (The underlining is ours).

Reference is made to the limits in terms of the modality of obtaining the right of access that
It is contained in article 15.3 and 4 of the GDPR, which indicates:


"3. The person responsible for the treatment will provide a copy of the personal data object of
treatment...

4. The right to obtain a copy mentioned in section 3 will not negatively affect
the rights and liberties of others."

Thus, the right to obtain a copy regarding the right of access "must not infringe
the rights or freedoms of third parties, including business or proprietary secrecy
intellectual property, including copyright protection software. However, it
reiterates, these considerations should not lead to the denial of all information

to the interested party

Directive (EU) 2016/943 of the European Parliament and of the Council of 06/08/2016 on
to the protection of undisclosed know-how and business information
(trade secrets) against their unlawful collection, use and disclosure, which has been
transposed into our legal system by the Business Secrets Law 1/2019 of
02/20, indicates in its recitals 34 and 35:

"(34) This Directive respects fundamental rights and observes the principles
recognized, in particular, in the Charter, especially the right to respect for private life.

da and familiar, the right to the protection of personal data, the freedom of
expression and information, professional freedom and the right to work, freedom of
company, the right to property, the right to good administration, in particular
access to the files, while respecting the commercial secret, the de-
right to effective judicial protection and an impartial judge and the right to defense.

 (35) It is important that the right to respect for private and family life and to
the protection of personal data of any person whose personal data may

be processed by the holder of a trade secret when steps are taken for the
protection of trade secrets, or of any person involved in a legal proceeding related to
against the unlawful acquisition, use or disclosure of trade secrets, in accordance with
this Directive, and whose personal data are processed. Directive
95/46/CE of the European Parliament and of the Council regulates the processing of personal data

procedures carried out in the Member States in the context of this Directive and under
the supervision of the competent authorities of the Member States, in particular the
independent public authorities designated by them. Therefore, this Directive
should not affect the rights and obligations provided for in Directive 95/46/EC, in

 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 93/102







particular the rights of the interested party to access those of their personal data that
are subject to treatment and to obtain the rectification, deletion or blocking of the data
due to its incomplete or inaccurate nature and, where appropriate, the obligation to process the data

of a sensitive nature in accordance with article 8, paragraph 5, of the same Directive
goes."

A similar limitation to that provided for in article 15.4 of the GDPR applies to the right to

portability that is developed in article 20 of the GDPR, establishing its number 4 that
"The right mentioned in paragraph 1 shall not adversely affect the rights and
freedoms of others". Bearing in mind that the right of access to the copy, such as the
right to data portability are among the components
fundamentals of the GDPR, the reasoning that for this
limitation indicated by Working Group 29 in the guidelines on the right to

data portability, adopted on 12/13/2016 determine that: "It can be understood,
although they are not directly related to portability, that mention includes
also "commercial secrets or intellectual property and, in particular, the rights
intellectual property rights that protect computer programs. However, although
These rights must be taken into consideration before responding to a request for

data portability, "these considerations should not result in the refusal
to provide all the information to the interested party".
As a conclusion to the allegations of the defendant, considering the right of access

of the interested party and the rights of the claimed party, attention must be paid to the conciliation of
rights of both parties in accordance with paragraph 4 of article 15 of the GDPR in the
execution the execution of part of the content of the copy of the logs that make up the de-
right of access

In this way, the condition provided for in article 15.4 of the GDPR would be restricted not to the copy
of the logs, which are all the logs as it has been motivated, but to the part of the copy of
log data that may denote information affected by the trade secret in the terms

Minos that in the following foundation of law we will explain.

                                         VII


Any person enjoys, by virtue of article 15 of the GDPR, the right of access
to the personal data that concern you and are subject to treatment, which establishes:



"1. The interested party shall have the right to obtain confirmation from the data controller
of whether or not personal data concerning you are being processed and, in such a case, right
of access to personal data..."


"3. The person responsible for the treatment will provide a copy of the personal data object of
treatment. The person in charge may receive for any other copy requested by the
interested party a reasonable fee based on administrative costs. when the
The interested party submits the application by electronic means, and unless he requests that

otherwise provided, the information will be provided in a user-friendly electronic format.
common.

4. The right to obtain a copy mentioned in section 3 will not negatively affect

 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 94/102







the rights and liberties of others."

The right of access called habeas data or "habeas scriptum" constitutes the core
essential of the right regulated in art.18.4 of the Constitution -STC 292/2000 and consists
in which the affected party can demand that the person in charge make a provision. The scope of the
right of access is determined by the scope of the concept of personal data
defined in article 4, paragraph 1, of the GDPR.

The right of access should not be considered in isolation, as it is closely

related to other provisions of the GDPR, in particular the principles of
data protection, including fairness and lawfulness of processing, the obligation to
transparency of the data controller and other rights of the interested parties
provided for in chapter III of the GDPR. Special importance in this procedure
Articles 5.1 b) to d), which recall:

1. Personal data will be:


b) collected for specific, explicit and legitimate purposes, and will not be processed
subsequently in a manner incompatible with said purposes; according to article 89,
section 1, the further processing of personal data for archiving purposes in the interest
public, scientific and historical research purposes or statistical purposes shall not be considered
incompatible with the initial purposes ("purpose limitation");

c) adequate, pertinent and limited to what is necessary in relation to the purposes for which

are processed ("data minimization");

d) accurate and, if necessary, up-to-date; all measures will be taken
Reasonable reasons to delete or rectify without delay the personal data that is
inaccurate with respect to the purposes for which they are processed ("accuracy");

The protection of the fundamental right to the respect of Data Protection of character
This implies, in particular, that any natural person can ensure that the data

information about you are accurate and used lawfully. The aforementioned right
of access may be essential, in particular, to enable the data subject to obtain, in
where appropriate, of the data controller, a rectification, deletion or the
blocking of such data and, consequently, exercise other rights that are related to
the purposes for which they were collected.

In this sense, although alluding to the then current Directive 95/46 of Parliament

European Union and of the Council, of 24/10/1995, regarding the protection of natural persons in
with regard to the processing of personal data and the free movement of such data,
The Court of Justice of the European Union ruled in the "Rijkeboer" case,
C/553/07, of 05/07/2009:

51"The aforementioned right of access is essential for the interested party to be able to exercise

the rights provided for in Article 12(b) and (c) of the Directive, namely,
In your case, when the treatment does not conform to the provisions of the same, obtain
of the data controller, rectification, deletion or blocking
of the data [letter b)], or that proceeds to notify the third parties to whom
communicated the data, any rectification, deletion or blocking carried out, if it is not
impossible or involves a disproportionate effort [letter c)].



 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 95/102







52 The right of access is also a necessary condition for the exercise by the
interested party of the right to oppose the processing of their personal data, contemplated
in Article 14 of the Directive, as it is for the right to appeal for damages

suffered, provided for in articles 22 and 23 of this."

The general objective of the right of access is to provide individuals with information
sufficient, transparent and easily accessible information about the processing of your data
personal so that they can know and verify the legality of the treatment and the accuracy
of the processed data.

Unless expressly indicated otherwise, the request must be understood in the

sense that it refers to all personal data relating to the interested party.

"Thus, if full access is not given, the data subject must be informed of the reasons and

specific circumstances that allow knowing the reasons in case the claimant wishes to
take measures against that consideration", as indicated in point 172 of the
aforementioned Directives 1/2022. The data controller must search for personal data
in all computer systems and in non-computer files on the basis of
search criteria that reflect the way the information is structured.


In the event that the person in charge is going to apply exceptions or restrictions to the right of
access should carefully check which parts of the information the information refers to.
exception and provide all information that is not excluded by the exception. This

forecast would be part of the data processing from the design, having established
previously said aspect sufficiently developed, explicit and documented.

The communication of data and other complementary information about the treatment must
be provided in a concise, transparent, intelligible and easily accessible form, using a
clear and simple language. The more precise requirements in this regard depend on the
circumstances of data processing, as well as the ability of the interested party to

understand communication.

In this sense, in addition, the access provided on 02/23/2021 is not adequate, for
incomplete, it is not the original format, but a summary, with little information and
chronologically disordered in the content of the account of the events that appear
registered, limiting itself in an unordered way to the grouping of dates and

naming of logs, adding an own explanation that given the diversity and the
The nature of the situations that may arise does not even minimally satisfy the
content of the right of access.

Differs from the one provided on 12/14/2021 in that the latter is the original format
and containing all the features of the log. However, the claimed party has not included
all the logs, since what he calls "technical" logs are missing, also resulting in

that are incomprehensible in attention to the keys and abbreviations that appear in
document whose meaning is unknown.

Thus, and notwithstanding the foregoing, if the data consists of "codes" as in this
case, or other "raw data" from the service, must be explained to make sense to
the interested. No such explanation has been supplied in the disclosure provided on
12/14/2021.


 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 96/102







Access to personal data means access to actual personal data, not
only a general description of the data nor a mere reference to the categories of
personal data processed by the data controller.

Raw data could be explained as unanalyzed data underlying a

treatment. Raw data can exist at different levels, where the highest level is
data base can only be machine readable (as "bits"). It should be noted that the
Information provided to the interested party must always be in a format readable by the user.
human.

Because all the logs appear in a single block referring to the claiming device,

both the so-called technical logs and those that were considered personal data
by the claimed party, have for their complete understanding various columns with
various descriptors that need to be deciphered, the translation of the keys to
all logs.

When providing data in a raw format, it is important that the data controller
adopt the necessary measures to ensure that the data subject understands the data,
for example, by providing an explanatory document that translates the raw format into a format

easy to use slider. In addition, it could be explained in such a document what the
abbreviations and other acronyms.

Regarding the application of article 15.4 of the GDPR, reference is made to the condition as
to the modality of care of the right of access in order to reconcile the rights in
conflicts with the claimed party, given that it should not affect the right of access itself
as we have indicated previously.

It should be taken into account that the GDPR has established that the right of access includes
provide complete information.

The condition provided for in article 15.4 of the GDPR, would be restricted only to the delivery of a copy
to the party claiming the data that may be affected by the trade secret,

that is to say to part of its content. Thus, the claimant can receive the response of the exercise
use of the right of access in another modality that is not the copy, or even combining
several modalities if the circumstances require it, as in this case of rights that
They can converge in divergences of interests.

It follows that since the content of all the logs is completed with the keys,
table descriptions, comments, events, etc., the secret can be revealed

all the logs according to the thesis of the defendant. Security-sensitive content to the
When dealing with the circumstances that arise with the devices can affect both
log types.

There is a key for "(...) of the signal", a description, and another somewhat broader one in the field.
type "***COLUMN.2 (...)", "***COLUMN.1", "event" etc common elements with the data
personal data, but it is not appreciated what would be such a trade secret, or "know how" in
awareness of the performance of events that could jeopardize safety.

of the measures of the claimed. In any case, this must be subject to interpretation.
restrictive. Thus, the risk to trade secrets, or more specifically, the risk that
log the way of acting of the complaining party is revealed, it must be sufficiently
shown case by case that it affects, or can affect. There may be times when a
only indicative of indications of such knowledge or it may be that even with several keys they do not

any secret is revealed.
 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 97/102







As a way of respecting the "know how" of the defendant, you can, exceptionally, if
If applicable, justify the reason why additional joint information complementary to
each log that forms the access table, or the joint keys of the same must not

be provided in copy mode. This is in relation to considering that if
certify that a specific way of acting in the face of an event that could
repercussions that the "know how" could be known unjustifiably.



In conclusion,

1. The complaining party has the right to access all the logs, which are their data
personal.


2. Two combined and complementary access modalities are established. and it in
attention to the consideration of the rights and interests concerned, taking into account
Consider also the right of the claimed party to trade secret.

3. A modality of access is the copy.

Taking into account the right of the claimed party to trade secret, in
virtue of art. 15.4 of the GDPR, the content of the copy containing all the

logs.

The limitation to the modality of the right of access to the copy, implies, in this case, not
provide the claimant with data on the content of the logs in those cases in which
may be affected by trade secret. The claimed party must justify such
affectation.

4. In the other modality, and complementary, to the previous one, the claimed party will have to

enable a form of access to all the personal data of the claimant, affected or
not for commercial secret, without prejudice to what is established for copying.

5. In both modes of access, personal data must be provided in
original format, understandable and intelligible, with complementary information for its
comprehension.

                                        VIII


From the analysis of the specific case examined and taking into account the circumstances
specific facts revealed throughout the administrative file, of what is
delivered to the claimant, of its content and scope, Securitas has provided under
of what was previously resolved by the AEPD, the "logs" raw, untreated, but having
previously filtering the "logs" and excluding the information that it considers to be not

personal data "since it is exclusively technical information" and abiding by
trade secret.

Likewise, of the logs that it considers contain personal data of the claimant
did not provide the indicatives and keys that would make it possible to fully know their
meaning.

It is considered that the claimed party has breached the resolution of the Spanish Agency

of Data Protection in relation to the measures imposed on it.
 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 98/102







The facts are considered to constitute an infringement, attributable to the claimed party,
for violation of article 58.2.c) of the GDPR, which provides the following:

"2. Each control authority will have all the following corrective powers
indicated below:


"c) order the person in charge or person in charge of the treatment to attend to the requests for
exercise of the rights of the interested party under this Regulation

This infringement is typified in article 83.6 of the GDPR, which stipulates the following:

"Failure to comply with the resolutions of the control authority under article 58,
section 2, will be penalized in accordance with section 2 of this article with fines
administrative costs of a maximum of EUR 20,000,000 or, in the case of a company, a

amount equivalent to a maximum of 4% of the total global annual turnover of the
previous financial year, opting for the one with the highest amount."

That empowers the AEPD to proceed in accordance with the power granted by article 58.2

"i) impose an administrative fine in accordance with article 83, in addition to or instead of the
measures mentioned in this section, according to the circumstances of each case
particular;"

In this case, it proceeds due to the lack of attention to comply with its terms, scope and

content the essential content of the right of access, and for the impediment that
deprive of the data that is the object of treatment, an administrative fine.

Article 71 of the LOPDGDD indicates:

"Infractions are the acts and conducts referred to in sections 4, 5 and
6 of article 83 of Regulation (EU) 2016/679, as well as those that are contrary to
the present organic law."


For the purposes of the limitation period for infringements, the alleged infringement prescribes
three years, in accordance with article 72.1 of the LOPDGDD, states:

"1. Based on what is established in article 83.5 of Regulation (EU) 2016/679,
are considered very serious and will prescribe after three years the infractions that suppose a
substantial violation of the articles mentioned therein and, in particular, the
following:"


"m) Failure to comply with the resolutions issued by the authority for the protection of
competent data in exercise of the powers conferred by article 58.2 of the
Regulation (EU) 2016/679."

                                          IX

The fine imposed must be, in each individual case, effective, proportionate and

dissuasive, in accordance with the provisions of article 83.1 of the GDPR. Consequently, it
must graduate the sanction to be imposed in accordance with the criteria established by the
Article 83.2 of the GDPR, and with the provisions of Article 76 of the LOPDGDD, regarding the
section k) of the aforementioned article 83.2 of the GDPR.


 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 99/102







The following circumstances are taken into consideration:

-Article 83.2.a) "the nature, seriousness and duration of the infringement, taking into account
the nature, scope or purpose of the processing operation in question
such as the number of interested parties affected and the level of damages that have

suffered;"

On the occasions that access was provided, the first two with the same content,
and a third after the resolution of the procedure for the exercise of rights was
incomplete, not partial, since neither all of its content is reflected nor is its content provided.
comprehension. These are data processing operations, in a matter such as

related to home security. Such elements would operate as
aggravating factors. Failure to comply with the obligation to attend to the right cannot have the
same consequences depending on the duration, persistence of the negative reasons or
repeated responses, accrediting in this case a greater seriousness that qualifies the
sanctioning response.

-Article 83.2.b) of the GDPR, "intentionality or negligence in the infringement" that is

states that on 09/17/2021 the procedure on the exercise of rights was resolved,
TD/00167/2021, although appealed in replacement, on 10/27/2021 confirms the resolution of the
TD, notified the day after the claim. There is no record that he complied with the attention of the
right within the term granted in the resolution, which exceeds widely, and which
only after the claimant makes the mandatory declaration of not having received anything at the
In this regard, the AEPD had to contact the defendant who, only then, agreed to

send you the last letter of 12/14/2021, which continues without satisfying the content of the
right. The action denotes a clear negligence in the fulfillment of the duty that
corresponds.

The defendant states that she acts diligently when hiring an entity to study
the logs in their relationship with personal data in order to meet the request of the

claimant

Regarding this statement, it seems to contradict another that the defendant pointed out in
allegations to the same initiation agreement, that the contracting of the legal service that was
embodied in the report of document 1, it was done mainly for the purpose of compliance
normative that foresees assessing what data is being processed. Being the logs common data
to all products derived from an alarm, which manages the claimed, from the

entry into force of the GDPR should have implemented the treatment from the design
that has been mentioned in the resolution, in order for the person in charge to put into
technical and organizational measures to implement the principles and
safeguards of individual rights. In essence, this means that you must integrate the
data protection in its processing activities and commercial practices, from the

design stage and throughout the life cycle. Helps make sure you meet
fundamental principles and requirements of the GDPR, and is part of the approach of
responsibility. This supposed diligence is neither more nor less than the fulfillment that
the regulations establish.

-Article 76.2 b) of the LOPDGDD: "The link between the offender's activity and the
processing of personal data". The defendant has products

What offer for those who are essential their usual management of data processing that
they appear listed in contracts next to their devices.

 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 100/102







Regarding the allegations with which the defendant intends to mitigate the penalty for
state that he attended, although partially the right, on three occasions, it must be
indicate that the access of 02/23/2021, reproduced on 05/18/2021 are mere accesses

repeated formals, own elaborations with a log description with explanation
generic, attention that is incomplete, not partial. Not only is it not from the original, it's a
elaboration of the claimed, it lacks the keys for its understanding and the description of
the events, but also does not include the logs that the defendant calls
improperly "technical". In addition, deducing that it has been a partial compliance,
tries to tie the consequence that access is a minor non-compliance to the

effects of the prescription of article 74.c) of the LOPDGD. On the contrary, the offense
in such a way, both as a result of accesses with the same content, as the one that has
place with the one provided on 12/14/2021, it must be qualified as substantial, ruling out its
even formal character, at least "merely formal", having an impact on the fact that it had no
nor has he had access to all the information and the repercussions it has for the affected party.

Regarding the alleged good faith, "it has been complied with up to three times", it is considered

that it is not important the times in which compliance is given, because with one it would be
sufficient, estimating that the occasions in which it has been provided have been with
incomplete content, not partial as claimed. On the other hand, good faith does not
certifies the absence of guilt and illegality.

It is considered that based on the aforementioned factors, due to the infringement of article

58.2 of the GDPR, it is agreed to impose a fine of 50,000 euros.

                                          x


As corrective power, it corresponds to this AEPD: "order the person in charge or in charge
of the treatment that meet the requests for the exercise of the rights of the interested party in
under this Regulation". (Article 58.2.c) of the GDPR)

The defendant must complete the requested access, providing all the logs it has
excepted to date, including all the logs contained by
chronological order in document 2 of the table provided in the allegations to the agreement
beginning, which were marked in red, in which they complement each other and succeed each other.
logically the device registers.


The information must contain the keys that allow clarifying the aforementioned table and its
sections that make the data tables understandable in line format or in
gross as obtained by the defendant.

The specificities of the foundation of law VI and VII will be taken into account as
mode of compliance with the measure imposed.

The imposition of this measure is compatible with the sanction consisting of a fine

administration, according to the provisions of art. 83.2 of the GDPR.

It is noted that not meeting the requirements of this body may be
considered as an administrative offense in accordance with the provisions of the GDPR,
classified as an infraction in its article 83.5 and 83.6, being able to motivate such conduct the
opening of a subsequent administrative sanctioning procedure.



 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 101/102







Therefore, in accordance with the applicable legislation and assessed the criteria of
graduation of sanctions whose existence has been accredited,


the Director of the Spanish Data Protection Agency RESOLVES:

FIRST: IMPOSE SECURITAS DIRECT ESPAÑA, S.A., with NIF A26106013, for
an infringement of article 58.2 c) of the GDPR, typified in article 83.6 of the aforementioned
GDPR, and qualified, for the purposes of prescription as serious in article 72.m) of the
LOPDGDD, an administrative sanction of 50,000 euros.


SECOND: Pursuant to article 58.2.c) of the GDPR, which authorizes to "order the
person in charge or person in charge of the treatment that attends to the requests for the exercise of the
rights of the interested party under this Regulation;" you are required to in the
within fifteen days attends to the right that is the subject of this claim in the manner indicated.


Failure to comply with the provisions could lead to the exercise of the power
sanctioning in accordance with the provisions of article 83.6 of the GDPR.

THIRD: NOTIFY this resolution to SECURITAS DIRECT ESPAÑA, S.A.


FOURTH: Warn the penalized person that they must make the imposed sanction effective once
that this resolution be enforceable, in accordance with the provisions of art.
98.1.b) of the LPACAP within the voluntary payment period established in art. 68 of the
General Collection Regulations, approved by Royal Decree 939/2005, of 07/29, in
relation to art. 62 of Law 58/2003, of 12/17, by entering it, indicating the NIF

of the sanctioned party and the number of the procedure that appears in the heading of this
document, in the restricted account IBAN number: ES00-0000-0000-0000-0000-0000, open
in the name of the Spanish Data Protection Agency in the bank
CAIXABANK, S.A. Otherwise, it will be collected in the period
executive.


Once the notification has been received and once executed, if the execution date is between
on the 1st and 15th of each month, both inclusive, the period for making the voluntary payment
It will be until the 20th day of the following or immediately following business month, and if it is between
on the 16th and last day of each month, both inclusive, the payment period will be until the 5th of
second following or immediately following business month.


Against this resolution, which puts an end to the administrative process in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may optionally file an appeal for replacement before the Director
of the Spanish Agency for Data Protection within a period of one month from the

day following the notification of this resolution or directly contentious appeal
before the Contentious-Administrative Chamber of the National Court,
in accordance with the provisions of article 25 and section 5 of the additional provision
fourth of Law 29/1998, of 13707, regulating the Contentious Jurisdiction-
administration, within a period of two months from the day following the notification

of this act, as provided in article 46.1 of the aforementioned Law.

Finally, it is noted that in accordance with the provisions of art. 90.3 a) of the LPACAP,
may provisionally suspend the firm resolution in administrative proceedings if the interested party

 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es 102/102








expresses its intention to file a contentious-administrative appeal. If this is the one
case, the interested party must formally communicate this fact by writing to
the Spanish Data Protection Agency, presenting it through the Registry

Email from the Agency [https://sedeagpd.gob.es/sede-electronica-web/], or through
any of the other records provided for in art. 16.4 of the aforementioned LPCAP. Also
must transfer to the Agency the documentation that proves the effective filing of the
Sponsored links. If the Agency were not aware of the

filing of the contentious-administrative appeal within a period of two months from the
day following the notification of this resolution, would terminate the suspension
precautionary



                                                                                938-181022
Mar Spain Marti
Director of the Spanish Data Protection Agency

 C/ Jorge Juan, 6 www.aepd.es
 28001 - Madrid sedeagpd.gob.es

# data[].attributes.attachment_link.description
After acknowledging that technical log generated by a security device installed in the data subject's house is personal data, the Spanish DPA fined a security company for failing to comply with an order to provide this information to the data subject and imposed a fine of €50,000.

# data[].attributes.headline
Dutch Court of Appeal - Uber - automated decision making

# data[].attributes.subject
Dutch Court of Appeal - Uber - automated decision making

# data[].attributes.attachment_link.readable_text
A Dutch Court of Appeal ordered Uber to provide drivers with access to their personal data and information about automated decision-making. The Court subjected the controller to a penalty of €4,000 per day until compliance.

This decision is the result of an appeal (and incidental appeals) filed against a decision from the District Court of Amsterdam (available on GDPRhub). The District Court ordered Uber to provide its drivers with information regarding the their rating by passengers but rejected several other requests for information under Article 15.

The different drivers had different requests in appeal. This included information about device data, driver's profile (i.e. an internal note Uber employees use to transfer customer service requests from drivers to other Uber employees), tags (labels in the custumer service system), reports per journey (reports based on passengers' feedback), individual ratings per passenger, upfront pricing (automated system that calculates the price for a ride in advance based on various factors) and batched matching system (automated system which links drivers to passengers).

Under Article 15, they also requested information about the recipients, the processing purposes, categories of personal data and existence of automated decision-making referred to in Article 22. Some drivers also requested portability within the meaning of Article 20.

Uber argued among other things that the qualification as personal data depended on whether the information in question was or not intended for internal consultation and deliberation.

The Court assessed each request to determine if they fell into the scope of Article 15(1). Its assessment can be summarized as follows.

For the access to the driver's profile, the Court considered that it contains a representation of the driver's specific request. The driver's profile constituted personal data and therefore falls within the scope of Article 15(1).

Concerning access to the tags, the Court stated that it contained information about the relevant driver and therefore also falled within the scope of Article 15(1).

Regarding the reports per journey and the individual ratings, they are both based on feedback by passengers about the relevant driver. Uber had already provided excel documents with anonymized passenger feedback about drivers, taking into account the right of the passengers to not be traced back from their rating or comments. The Court held that the drivers did not have a sufficient interest to access to all reports without restrictions.

For the information about recipients, the Court referred to the CJEU Österreichische Post case in which the CJEU ruled that the information provided to the data subject under the right of access under Article 15(1)(c) should be as accurate as possible.

Concerning information about automated decision making, the Court firstly analysed the scope of Article 15(1)(h) and noted that the Dutch version of that article is not entirely clear. After comparing it with other language versions, it stated that the right of access contained in Article 15(1)(h) only relates to the form of automated decision making referred to in Article 22(1) to (4). This implied that under Article 15(1)(h), there is a right to information insofar as the controller subjects the data subject to a decision based solely on automated processing, including profiling, which produces legal effects or significantly affects them. In this cases, 5 categories of automated decision making were distinguished and assessed :

The batched matching system determines the amount of work of the drivers and therefore their income and therefore produces legal effects on the drivers.

The upfront pricing system has financial consequences and determines the income of the drivers. It therefore also produces legal effects.

The average rating of drivers can form grounds to deactivate drivers and therefore have significant effects on them.

Concerning the cancellation costs and deactivation of driver's account, the Court considered that the drivers failed to explain their arguments.

For the batched matching system, upfront pricing system and average rating, the Court considered that these decisions are made solely on automated processing. It considered that Uber could not rely on an exception in that regard. Uber therefore wrongly rejected the requests for information regarding these three types of automated decisions. It should have provided the drivers with general information and in particular information on factors that influence the decision-making process.

Concerning the right to portability referred to in Article 20, the Court concluded that the requests based on Article 20 concerned data that were not eligible for allocation and rejected that request.

The Court decided to order Uber, within two months, to grant the requests to access information under Article 15(1), including driver's profiles, information about upfront pricing, batched matching system and average ratings. This order is subject to a penalty payment of €4,000 for each day Uber fails to comply.

Share your comments here!

Share blogs or news articles here!

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

for the provision of copies of documents pursuant to Section 843a of the Code of Legal Procedure
(hereinafter: Rv), received at the registry of the court of appeal on 10 June 2021, lodging ten grievances,
appealed against a decision made by the District Court of Amsterdam (hereinafter: the District Court) on 11
March 2021 under the above-mentioned case/appeal number (hereinafter: the contested decision) in a
dispute between, among others, [appellant sub 1] et al. as applicants and Uber as respondent.
The notice of appeal strengthens, with amendment of the application, that the court should set aside the
contested order and, in summary, still make it provisionally enforceable:
- Uber will order, on pain of a periodic penalty payment, that the requests made by [appellant sub 1] et
al. under Articles 15 and 20 of the General Data Protection Regulation (hereinafter: AVG)1 still be granted.
- order Uber to disclose to [appellant sub 1] et al. in a commonly used electronic form, on pain of a periodic
penalty payment, (i) the categories of personal data referred to in subparagraph (d) of the operative part of
the order, (ii) information on the recipients or categories of recipients to whom personal data of [appellant
sub 1] et al. have been disclosed for 'legal reasons or in the event of a dispute' as well as the processing
purposes and categories of personal data concerned referred to in Article 15(1)(a), (b) and (c) AVG as well as
(iii) in the existence of automated decision making, including profiling referred to in Article 22(1) and (4), and
at least in those cases, useful information on the underlying logic, as well as the significance and expected
consequences of such processing for [appellant sub 1] et al.
- Uber will order, on pain of a periodic penalty, Uber to provide the personal data provided by
[appellant sub 1] et al to Uber in a structured, common and machine-readable form to [appellant sub 1]
et al and to forward such personal data directly to Platform Info Exchanges in accordance with Article
20(2) AVG.
- will rule that provision of data in pdf format cannot be regarded as provision in a 'structured, common and
machine-readable form' within the meaning of Article 20(1) AVG, or at least order Uber to provide the data in
question in a file format other than pdf format.
all this with a decision on the costs of proceedings.
In the (conditional) incident, [appellant sub 1] et al. requested the court to order Uber, pursuant to
Section 843a of the Dutch Code of Civil Procedure, to produce inspection, copies or extracts of the
documents and data held by Uber and recorded on a data carrier
- in which Uber has recorded in respect of which categories of personal data as mentioned in the
Guidance Notes Uber has granted or refused the access request of [appellant sub 1] et al. as
referred to in Article 15 (1) AVG and
- establishing whether Uber applied automated decision-making, including profiling referred to in Article 22(1)
and (4) AVG, in respect of [appellant sub 1] et al,
all this with a decision on the costs of proceedings.
On 13 October 2021, a statement of defence in conditional incident, also a statement of defence in the main
action and also a statement of appeal in cross-appeal was received at the registry of the court of appeal, on
the part of Uber. The statement of defence in the main case seeks to confirm the contested decision and to
reject the requests of [appellant sub 1] et al. In the cross-appeal, Uber, putting forward one ground of
appeal, requested that the court of appeal set aside the contested decision in part and still reject the
requests of [appellant sub 1] , [appellant sub 2] , [appellant sub 4] , [appellant sub 5] and [appellant sub 6],
with confirmation in all other respects. In the conditional incident, Uber sought its dismissal. In the principal
and
incidental appeal, as well as in the conditional incident, Uber finally requested that [appellant sub 1] et al. be
ordered to pay the costs of the appeal and incident proceedings, respectively, with post-judgment costs and
interest.
On 23 December 2021, a statement of defence in cross-appeal by [appellant sub 1] et al. was received at
the Registry seeking the dismissal of Uber's grievance, with a decision on costs.
The oral hearing of the appeal took place on 18 May 2022, at which [appellant sub 3] , [appellant sub 4]
and [appellant sub 5] (the latter represented by [A] ) and Uber (represented by [B] ) appeared and were
assisted by their aforementioned lawyers. On that occasion, the lawyers spoke on the basis of notes
submitted to the court. Both parties submitted further documents. The submission of exhibits 20 to 25 by
Uber was objected to by [appellant sub 1] et al. The court rejected these productions. The parties
answered questions put by the court.
Both parties have offered evidence on appeal.
The hearing of the case was then closed and judgment determined.
2 Facts
In the contested final decision, the court stated the facts it took as a starting point under 2 (2.1 to 2.9). The
court takes those facts as its starting point, supplemented by other facts that have been established as, on
the one hand, alleged and, on the other, not or insufficiently disputed.
The case involves the following.
2.1 Uber is part of an international group that provides online services in the transport sector through a
digital platform. Uber links passengers to drivers via applications. Passengers use the Uber Rider app,
drivers the Uber Driver app.
2.2 [appellant sub 1] et al are (have been) employed as 'private hire drivers' (hereinafter: drivers) in the
United Kingdom using or having used the services of Uber. At the time of filing the appeal grievances, at
least [appellant sub 3] was still working as a driver for Uber.
2.3 [appellant sub 1] et al are members of the App Drivers & Couriers Union (hereinafter ADCU). ADCU is a
trade union representing the interests of 'private hire drivers' and 'couriers' in the UK. ADCU is affiliated to
the International Alliance of App Transport Workers (hereinafter: IAATW). Both organisations advocate for
the digital rights of platform workers.
2.4 ADCU is supported by Workers Info Exchange (hereafter WIE). WIE is a non-profit organisation
that aims, in part, to help workers and self-employed people in the information
economy to give access to personal data collected about them in the course of their work. Founder
and director of WIE is [appellant sub 5] [A] .
2.5 ADCU and IAATW intend to establish a database, which will be maintained by WIE. This
database will contain personal data of drivers.
2.6 Uber has issued a 'Privacy Notice' (hereinafter, the Privacy Notice) in which it has included general
information about processing personal data. This privacy notice (in the version dated 29 July 2020)
states about automated decision-making:
2. Safety and security. We use personal data to help maintain the safety, security and integrity of our
services and users. This includes:
(...) Using device, location, profile, usage, an other data to prevent, detect, and combat fraud or unsafe
activities
Using user ratings and feedback to encourage compliance with our Community Guidelines and as
grounds for deactivating drivers and delivery partners with low ratings or who otherwise violated such
guidelines in certain countries.
(...)
9. Automated decision-making
We use personal data to make automated decisions relating to use of our services. This includes: (...)
Deactivating users who are identified as having engaged in fraud or activities that may otherwise harm
Uber, its users, and others. In some cases, such as when a user is determined to be abusing Uber's referral
programme, such behaviour may result in automatic deactivation.
2.7 Furthermore, Uber applies so-called 'Community Guidelines'. These read, in so far as relevant here,
as follows:
Fraud
Deception can weaken trust and also be dangerous. Intentionally falsifying information or assuming
someone else's identity (or allowing someone else to assume your identity), for example when signing
in or undergoing a security check, is not allowed. It is important to provide accurate information when
reporting incidents, creating and accessing your Uber accounts, disputing charges or fees, and
requesting credits. Only request fees, charges or refunds that you're entitled to, and use offers and
promotions only as intended. Don't knowingly complete invalid transactions. (...)
How Uber enforces our guidelines
Losing access to the Uber apps may be disruptive to your life or to your business. That's why we
believe it is important to have clear standards that explain the circumstances in which you may lose
access to the Uber apps. If you violate any applicable terms of use, terms of the contractual
agreement you agreed to when signing up for an account with Uber or any of these Community
Guidelines, you can lose access to the Uber apps. (...)
2.8 [appellant sub 1] et al. each separately made at different times in June/July 2020 by e- mail or via the
Rider app and/or Driver app (i) requests for access as referred to in Article 15(1) chapeau AVG to their
personal data processed by Uber as well as (ii) requests for information as referred to in Article 15,
paragraph 1(a), (b) and (c) AVG, (iii) requests for information as referred to in Article 15 paragraph 1(h)
AVG read in conjunction with Article 22 AVG and (iv) a request for data portability within the meaning of
Article 20 AVG. With regard to the latter request, they specified their requests in more or less similar
terms as follows:
Copies of my personal data Article 20
For data falling within the right to data portability (GDPR, art 20), which includes all data I have
provided
and which have been indirectly observed about me and where lawful bases for processing include
consent or contract, I wish to have that data sent to me in commonly used, structured, machine-
readable format, such as a CSV file. A PDF file is not a machine- readable format. accompanied with an
intelligible description of all variables.
2.9 Uber provided several digital files to [appellant sub 1] et al in response to these requests. Uber
provided with the responses to [appellant sub 1] et al an explanatory note entitled 'Guidance Notes',
which provided an overview of 26 categories of personal data processing with a general description of
the personal data involved.
3 Review
Legal framework
3.1 The articles of the AVG relevant to this dispute are as follows:
Article 4 Definitions
(...)
1. "personal data" means any information relating to an identified or identifiable natural person ("the
data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in
particular by reference to an identifier such as a name, an identification number, location data, an
online identifier or to one or more elements characterising the physical, physiological, genetic,
psychological, economic, cultural or social identity of that natural person.
(...)
4) "profiling" means any form of automated processing of personal data in which certain personal aspects
of a natural person are evaluated on the basis of personal data, in particular with a view to analysing or
predicting that person's occupational performance, economic situation, health, personal preferences,
interests, reliability, behaviour, location or movements; (...)
Article 15 Data subject's right of inspection
1. The data subject shall have the right to obtain from the controller a confirmation as to whether or not
personal data concerning him or her are being processed and, if so, to obtain access to that personal data
and to the following information:
a. a) The processing purposes.
b) the categories of personal data concerned.
c) the recipients or categories of recipients to whom the personal data have been or will be
disclosed, in particular recipients in third countries or international organisations.
(...)
(h) the existence of automated decision-making, including those referred to in Article 22(1) and
4, referred to profiling, and, at least in those cases, useful information on the underlying logic, as well as
the significance and expected consequences of such processing for the data subject.
2. Where personal data are transferred to a third country or an international organisation, the data
subject has the right to be informed of the appropriate safeguards in accordance with Article 46 on the
transfer.
3. The controller shall provide the data subject with a copy of the personal data being processed. If the
data subject requests additional copies, the controller may charge a reasonable fee based on
administrative costs. Where the data subject submits its request electronically, and does not request any
other arrangement, the information shall be provided in a commonly used electronic form.
4. The right to obtain a copy referred to in paragraph 3 is without prejudice to the rights and
freedoms of others.
Article 20 Right to data portability
1. The data subject has the right to obtain the personal data concerning him that he has provided
to a controller in a structured, common and machine-readable form, and he has the right to
transfer that data to another controller, without being impeded by the controller to whom the
personal data had been provided, if:
a. the processing is based on consent under Article 6(1)(a) or Article 9(2)(a) or on an agreement
under Article 6(1)(b); and
the processing is carried out through automated processes.
2. When exercising his right to data portability under paragraph 1, the data subject shall have the right
to have the personal data transferred, if technically possible, directly from one controller to another.
3. The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to
Article 17. That right shall not apply to processing which is necessary for the performance of a task
carried out in the public interest or in the exercise of official authority vested in the controller.
4. The right referred to in paragraph 1 is without prejudice to the rights and freedoms of others.
Article 22 Automated individual decision-making, including profiling
1. The data subject shall have the right not to be subject to a decision based solely on automated
processing, including profiling, which produces legal effects concerning him or her or significantly
affects him or her in any other way.
2. Paragraph 1 does not apply if the decision:
a. necessary for the establishment or performance of a contract between the data subject and a controller.
is permitted by a provision of Union or Member State law applicable to the controller which also provides
for appropriate measures to protect the rights and freedoms and legitimate interests of the data subject; or
relies on the explicit consent of the data subject.
3. In the cases referred to in points (a) and (c) of paragraph 2, the controller shall implement appropriate
measures to protect the data subject's rights and freedoms and legitimate interests, including at least the
right to human intervention by the controller, the right to express his or her point of view and the right to
challenge the decision.
4. The decisions referred to in paragraph 2 shall not be based on the special categories of personal
data referred to in Article 9(1), unless Article 9(2)(a) or (g) applies and appropriate measures have
been taken to protect the data subject's legitimate interests.
3.2 Recital 63 from the preamble of the AVG reads, in so far as relevant here, as follows:
(63) A data subject should have the right to access personal data collected about them, and to exercise
that right easily and at reasonable intervals, in order to be informed of the processing and to verify its
lawfulness. (...) Every data subject should therefore have the right to know and be informed of the
purposes for which the personal data are processed, if possible how long they are kept, who receives the
personal data, the logic underlying any automatic processing of the personal data and, at least when the
processing is based on profiling, the consequences of such processing. If possible, the controller should be
able to provide remote access to a secure system on which the data subject can directly access their
personal data. That right should not interfere with the rights or freedoms of others, including business
secrecy or intellectual property and, in particular, the copyright that protects software. However, those
considerations should not result in the data subject being deprived of all information. Where the
controller processes a large amount of data relating to the data subject, it should be able to request the
data subject, prior to the provision of information, to specify which information or which processing
activities the request relates to.
3.3 The provisions of the General Data Protection Regulation Implementing Act ("UAVG"),
relevant to this dispute, are as follows:
Article 34
A written decision on an application referred to in Articles 15 to 22 of the Regulation shall be made
within the time limits specified in Article 12(3) of the Regulation (...)
Article 35
1. If the decision on a request referred to in Article 34 was taken by a body other than an
administrative authority, the interested party may apply to the court with a written request to order
the controller to still grant or reject the request referred to in Articles 15 to 22 of the Regulation.
2. The petition shall be filed within six weeks of receiving the response from the controller. If the
controller has not responded within the time limits set out in Article 12(3) of the Regulation, the
submission of the petition shall not be subject to a time limit.
3. The court grants the application, insofar as it finds it well-founded. Before the court
decide, it shall, where appropriate, give interested parties the opportunity to submit their views.
(...)
5. The third section of the fifth title of the Second Book of the Code of Civil Procedure shall apply
mutatis mutandis. [court: third section: Of dwangsom; Art. 611a to 611 i Rv.].
(...)
Article 41 Exceptions to data subject rights and obligations of controller
1. The controller may disapply the obligations and rights referred to in Articles 12 to 21 and Article 34 of
the Regulation to the extent that this is necessary and proportionate to ensure:
a. (...)
i. the protection of the data subject or the rights and freedoms of others; (...)
3.4 The Article 29 Data Protection Working Party (now: the European Data Protection Board,
abbreviated as: EDPB) adopted in 2017 guidelines on automated individual decision-making and
profiling for the purposes of Regulation (EU) 2016/679. Chapter IV, paragraph A, of these
guidelines, as adopted on 3 October 2017 and last amended and adopted on 6 February 2018,
WP251rev.01 (hereinafter: the EDPB guidelines) read, in so far as relevant here, as follows:
A. "Decision based solely on automated processing"
Article 22(1) concerns decisions that are "solely" based on automated processing. This means that there
is no human intervention in the decision-making process.
Example
An automated process produces something that is in fact a recommendation concerning a data subject.
If a human evaluates the process and takes other factors into account when making the final decision,
that decision would not be "solely on automated processing".
The controller cannot circumvent the provisions of Article 22 by p r e e m p t i n g human intervention.
For example, if someone routinely applies automatically generated profiles to individuals without actually
influencing the outcome, this is still a decision based solely on automated processing.
To achieve actual human intervention, the controller must ensure that all monitoring of decision-making
is meaningful, and not just a token act. This intervention must be carried out by someone who is
competent and capable of changing the decision. He must include all relevant data in his analysis.
As part of its data protection impact assessment, the controller must identify and record the degree of
human intervention in the decision-making process and the stage at which it took place.
Chapter IV(B) of the EDPB Guidelines, so far as relevant here, reads as follows:
B. Decision having 'legal effect' or which 'otherwise significantly affects' the person concerned
The AVG recognises that automated decision-making, including profiling, can cause serious
may affect individuals. The AVG does not define a decision with "legal effects" or one that "otherwise
significantly affects" the data subject, but it is clear from the wording that Article 22 only refers to
serious, significant effects.
"Decision having legal effect"
A legal effect means that the decision, based solely on automatic processing, affects someone's legal
rights, such as freedom of association, the right to vote and the right to seek legal redress. A legal effect
can also be something that affects someone's legal status or their rights under a contract.
Examples of such a consequence are automated decisions about an individual that lead to:
* termination of an agreement.
* The right to or refusal of a particular social benefit granted by law, such as child benefit or housing
benefit.
* refusal of admission to a country or the granting of a nationality.
"Otherwise affects him to a substantial degree"
Even if a decision-making process does not affect a person's legal rights, it may still fall within the scope
of Article 22 if it has a consequence that otherwise significantly affects him.
In other words, even if nothing changes about his legal rights or obligations, the data subject may still
be affected to such an extent that protection under this provision is required. The AVG added the
word "otherwise" (not present in Article 15 of Directive 95/46/EC) to the wording "significantly affects
him". Thus, the threshold for substantial degree should be similar to the degree to which the data
subject is affected by a decision which has a legal effect.
Recital 71 mentions the following typical examples: 'automatic refusal of a credit application
submitted online' or 'processing of job applications via the internet without human intervention'.
Data processing affects someone significantly when the effects of the processing are large or important
enough to merit attention. In other words, the decision must have the potential to:
* significantly affect the circumstances, behaviour or choices of the persons concerned.
* have a long-term or lasting effect on the individual; or
* in extreme cases, lead to the exclusion of or discrimination against individuals.
It is difficult to define precisely what is considered serious enough to meet the threshold of significant
degree. However, the following decisions could fall into this category:
* decisions affecting a person's financial situation, such as their ability to qualify for a loan.
* decisions affecting a person's access to healthcare services.
* decisions that deny someone access to an employment opportunity or put them at a serious
disadvantage in the process.
* decisions affecting a person's access to education, for example admission to a university (...).

order that the order be served on [appellant sub 1] et al. in a commonly used electronic form within one
month,
I. give access to:
(i) any personal data relating to them that it processes, including personal data as listed in the
Guidance Notes, the 'Driver's Profile', including Uber employee notes, 'Tags' and 'Reports',
(ii) the processing purposes, the categories of personal data concerned, the recipients or categories of
recipients to whom the personal data have been or will be disclosed, and the retention period for these
data,
(iii) the appropriate safeguards implemented by Uber in accordance with Article 46 AVG regarding
transfer to a third country or an international organisation,
(iv) the existence of automated decision-making, including the profiling referred to in Article 22(1) and
(4) AVG, and at least in those cases, useful information on the underlying logic, as well as the
significance and expected consequences of that processing for [appellant sub 1] et al,
II. provide the personal data in a structured, common and machine-readable form, namely as a CSV file,
or by means of an Application Programming Interface (hereinafter: API), in such a way that such data can
be directly forwarded to another controller.
3.6 By the contested order, which is provisionally enforceable, the district court, insofar as relevant in this
appeal, ordered Uber to provide [appellant sub 1] et al. with copies of or access to the personal data
referred to in paragraph 4.52 of the contested order (the 'ratings' given by individual passengers) in
the manner stated therein (anonymised) and dismissed the more or less requested. The court
balanced the procedural costs between the parties in that each party would bear its own costs. The
court otherwise rejected the request of [appellant sub 1] et al.
The amended appeal request
3.7 On appeal, [appellant sub 1] et al. amended their application as set out at margin 1 of this judgment. At
the hearing, they also reduced their request in the main action. They now apply in the main action for a
decision to be declared provisionally enforceable:
I. order Uber to grant the requests of [appellant sub 1] et al. for access to the personal data and
information listed below or to provide access in a commonly used electronic form within one
month of service of the order, on pain of a penalty:
a) to [appellant sub 1] et al. in the personal data hereinafter referred to:
- from the 'Guidance Notes: the remaining missing personal data as specified in production 2 in category
'12 Driver detailed device data',
- From the Driver's Profile category,
- From the 'Tags' category,
- from the 'Reports per trip' category
- from the 'Individual ratings per passenger' category
b) to [appellant sub 3] in the personal data processed under 'upfront pricing',
c) to [appellant sub 1] et al. about the recipients or categories of recipients to whom personal data of
[appellant sub 1] et al. were disclosed for 'legal reasons or in the event of a dispute', as well as the
processing purposes and categories of
personal data, as referred to in Article 15(1)(a), (b) and (c), AVG,
d) to [appellant sub 1] et al as regards the existence of automated decision-making, including profiling
referred to in Article 22(1) and (4) AVG, and at least in those cases, useful information on the underlying
logic, as well as the significance and expected consequences of such processing for [appellant sub 1] et
al,
e) to [appellant sub 1] et al in any other personal data relating to [appellant sub 1] et al that
it processes.
II. Order Uber, on pain of a periodic penalty payment, to disclose to [appellant sub 1] et al. the
personal data provided by [appellant sub 1] et al. to Uber, including the data referred to in the
petition, in a structured, common and machine-readable form to [appellant sub 1] et al. and to
transmit such personal data directly to Platform Info Exchanges in accordance with Article 20(2) AVG.
III. rule that provision of data in PDF format cannot be regarded as provision in a 'structured,
common and machine-readable form' within the meaning of Article 20(1) AVG, or at least order Uber
to provide the data in question in a file format other than PDF format.
The incidental appeal
Admissibility of [appellant sub 1] , [appellant sub 2] , [appellant sub 4] , [appellant sub 5] and
[appellant sub 6]
3.8 Uber addresses its grievance on incidental appeal against paragraphs 4.4-4.23 of the contested order,
in which the court, in brief, ruled that [appellant sub 1] , [appellant sub 2] , [appellant sub 4] ,
[appellant sub 5] and [appellant sub 6] were admissible in their requests. Uber argues that these
drivers filed their (revised) petition too early, namely before Uber had answered their requests.
According to Uber, under Article 35(2), first sentence, UAVG, [appellant sub 1] could not file a petition
until 5 September 2020, [appellant sub 2] and [appellant sub 4] on 1 November 2020,
[appellant sub 5] on 21 July 2020 and [appellant sub 6] on 10 October 2020. Indeed, Uber first
requested further details of their requests from them (on 1 July 2020, 22 July 2020, 7 August 2020, 16
August 2020 and 21 July 2020 respectively). This was necessary in view of [appellant sub 1] et al's
generally worded requests for inspection and the large amount of data. This is also in line with what
was considered in paragraph 63 of the preamble to the AVG. In paragraphs 4.9 and 4.10, the court
erred in ruling that the time limit to file the petition already started to run immediately after this
request for clarification. Indeed, that request cannot be seen as a dismissive response within the
meaning of Article 35 (2) UAVG read in conjunction with Article 12 (3) AVG, Uber argued. Uber added
that as far as [appellant sub 5] was concerned, it was entirely clear that he was too early with his
petition: Uber only responded to his request on 19 and 20 July 2020, while he submitted his petition
on 20 July 2020.
3.9 [appellant sub 1] et al. put forward the defence that Uber relied on incorrect data, namely dates on
which Uber sent messages to [appellant sub 1] et al. entirely on its own initiative, in response to the
petition submitted by them. A response in response to the petition cannot count as a response to
the preceding access request. Moreover, the original access requests were already clear and
complete and no further explanation was necessary. With the responses Uber subsequently sent to
[appellant sub 1] et al, the request for inspection had been fully answered.
3.10 This defence of [appellant sub 1] et al. succeeds. The following is conclusive in this respect. It can be
seen from the productions that [appellant sub 1] et al submitted their initial requests to Uber on the
following dates:
[appellant sub 1] : 15 July 2020 (production 2A to petition) [appellant
sub 2] : 23 June 2020 (production 3A to petition) [appellant sub 4] : 10
July 2020 (production 6A to petition) [appellant sub 5] : 20 June 2020
(production 8A to petition) [appellant sub 6] : 23 June 2020 (production
9A to petition)
3.11 [appellant sub 1] et al. have substantiated their claim (namely with reference to productions 2A, 3A
and 6A to the application, respectively production 6 to the statement of defence at first instance,
respectively production 9A to the application) that [appellant sub 1] , [appellant sub 2] , [appellant
sub 4] , [appellant sub 5] and [appellant sub 6] on 7 August 2020 and 22
July 2020, 7 August 2020, 19 July 2020 and 21 July 2020 received decisions on the access requests.
Uber did not sufficiently substantiate the dates it relied on and did not sufficiently dispute the dates
cited by [appellant sub 1] et al. with reasons. Exhibits 12A, 13A, 15A, 16A and 17A submitted by Uber
on appeal do not support its contentions. For example, Uber's reply of 30 October 2020 to [appellant
sub 4] (production 15a), submitted by Uber on appeal, shows that this is a spontaneous (and
supplementary) reply by Uber to [appellant sub 4]'s initial request, to which Uber had already replied
on 7 August 2020. [appellant sub 4] was therefore entitled to assume that his request had been
decided on when he submitted the (supplementary) petition on 21 August. In view of this, the court
assumes the dates mentioned by [appellant sub 1] et al. With regard to [appellant sub 5] in particular,
in view of production 6 to the defence at first instance, it is sufficiently established that he received a
decision from Uber on his initial application on 19 July 2020. The incidental appeal is therefore
unsuccessful.
The principal appeal
3.12 Grounds 2 to 7 in the main appeal relate to the requests for access by [appellant sub 1] et al. to
specific categories of personal data. The court will first discuss these grievances, after which the court
will address grievance 9 in the main appeal, which concerns the information request of [appellant sub
1] et al. within the meaning of Article 15 (1) (a), (b) and (c) of the AVG. Ground 1, which relates to
access to all other personal data, will be dealt with next.
Finally, grievance 8 (on the information request under Article 15(1)(h) AVG) and grievance 10 (on the
portability request under Article 20 AVG) will be dealt with.
Beforehand, the court notes that it is established between the parties that [appellant sub 1] et al are to be
regarded as data subjects within the meaning of Article 4(1) AVG and that in this context Uber acts as a
data controller within the meaning of Article 4(7) AVG.
Requesting access to a particular category from the Guidance Notes
3.13 Ground 2 is directed against paragraph 4.38 of the contested decision, in which the court held that
the request of [appellant sub 1] et al. regarding access to the personal data mentioned in the
Guidance Notes was rejected. At the hearing, [appellant sub 1] c.s. reduced their request and limited
it to the personal data still missing in category 12, Driver detailed device data, as described in
production 2 to the notice of appeal.
3.14 Uber disputes [appellant sub 1] c.s.'s assertion that the categories of data from the Guidance Notes
specified by [appellant sub 1] c. s . have not yet been fully accessed. However, Uber fails to provide a
sufficiently concrete explanation of this dispute with regard to the category of personal data
mentioned by [appellant sub 1] e t a l . The mere reference by Uber to sections 2.4.1 to 2.4.6 of the
statement of defence on appeal does not provide any conclusive information in this respect. For this
reason, the court of appeal assumes [appellant sub 1] c.s.'s assertion that Uber has not yet complied
with [appellant sub 1] c.s.'s requests on this point and deems
court allowed the request of [appellant sub 1] et al. to that extent. The grievance therefore succeeds.
The request for access to the Driver's profile
3.15 By ground 3 [appellant sub 1] c.s. challenge paragraph 4 .41 of the order under appeal in which the court
rejected the request to inspect the Drivers Profile. This ground of appeal is successful. In this respect the
Court of Appeal considers as follows. Uber has explained that the driver's profile is a note or a kind of
summary or transfer message by which Uber employees transfer requests from drivers to customer
service to other U b e r employees. In light of the judgment of the Court of Justice of the EU ("CJEU") in
the Nowak case2, the court held that such a note or handover notification must be regarded as personal data
within the meaning of Article 4(1) AVG. After all, this note or transfer notification contains information
about the driver who approached customer service, namely a reflection of the driver's specific request and
possibly already a (preliminary) assessment thereof, or at least, in Uber's words, a certain streamlining
thereof, which may have e f f e c t s for the driver. Not qualifying it as 'personal data' would deprive such
information entirely of the protection of the principles and safeguards on personal data, including the
rights of access, rectification and opposition of the data subject provided for in the AVG, and of the
supervision provided for in the AVG. Contrary to Uber's argument, the AVG does not make the
qualification of the term 'personal data' depend on whether the information in question is intended for
internal consultation and deliberation. The access requested by [appellant sub 1] et al. concerning the
Driver's Profile therefore falls within the scope of Article 15 (1) chapeau AVG. Uber has not substantiated
on what ground from the AVG the drivers' right to access it, as contained in Article 15 (1) AVG, can be
restricted. The request by [appellant sub 1] et al. therefore qualifies for grant to that extent.
Requesting access to the 'tags' (labels in the customer service system)
3.16 With ground 4, [appellant sub 1] c.s. challenge paragraph 4.44 of the contested order in which the court
rejected the request concerning access to the 'tags'. This ground of appeal succeeds. As considered by the
court and not disputed by the parties, a tag is an indication by an Uber employee of a notification. Uber
has not disputed that these tags contain information
about the relevant driver who made a request or notification. With regard to this category of data,
therefore, the same reasoning applies as set out above (in 3.15), with reference to the Nowak judgment,
with regard to the Driver's Profile. The request of [appellant sub 1] et al. therefore qualifies for grant to
that extent.
Requesting access to 'reports' per trip and 'individual ratings' per passenger.
3.17 Grievance 5 is directed against paragraph 4.46 of the contested order, in which the court concluded
that Uber need not provide further access to the 'reports' than it has already done. 'Reports', it is
established between the parties, are based on feedback reports that passengers have given about the
driver in question regarding, among other things, 'navigation' and 'professionalism'. In response to the
inspection requests, Uber provided Excel statements in which passengers' feedback about drivers was
anonymised.
With grievance 6, [appellant sub 1] turn against paragraph 4.52 of the contested decision, in which
the court ruled that Uber is obliged towards [appellant sub 1] et al. to provide limited access to the
individual ratings concerning them.
[appellant sub 1] c.s. argued with regard to both the reports and the ratings that Uber could not
refuse the request for access to this personal data in part with a general reliance on the rights and
freedoms of others. According to [appellant sub 1] c.s., Uber should have assessed in respect of each
data subject separately whether the obligations and rights in the UAVG should be disapplied and
whether this is necessary and proportionate to safeguard the interests referred to in Article 41 (1)
UAVG. Moreover, the
drivers does matter, because of the potential major consequences of the reports and ratings, to know
who made the statement. [appellant sub 1] et al. also have an interest in inspection in order to be able
to exercise their right to rectify incorrect personal data concerning them.
3.18 Grounds 5 and 6 are unsuccessful. In the opinion of the Court of Appeal, the District Court was right to
consider that Uber, when providing information that includes the personal data of [appellant sub 1] et al,
is obliged, pursuant to Article 15 (4) of the AVG, to respect the rights and freedoms of others and is
therefore entitled to anonymise the reports and ratings in the sense that, in order to protect those rights
of third parties, it ensures that the statements about the drivers cannot be traced back to the person who
made the statements. It may be true that in a specific, concrete case the conflicting legitimate interests of
the various data subjects must be weighed against each other in order to determine whether there is an
overriding interest that justifies a refusal to grant the data subject access to the personal data of a third
party, but in this case [appellant subsection 1] et al. have requested access to all the reports and ratings
concerning them without any restriction. This involves very large numbers of reports and ratings. In the
opinion of the Court of Appeal, in the event of such a broad request for access to personal data that also
concern third parties, the controller cannot be required to ascertain for each report and rating which
interest prevails. [appellant subpara 1] et al. did not mention any concrete report or concrete individual
rating and therefore did not give any concrete reasons as to why their interest in obtaining full access to
these (i.e. including the personal data of a third party) outweighs the third party's right to protection of its
personal data. The court therefore correctly held that Uber must respect passengers' rights when
providing the requested data and that Uber was able to do so by providing this data in such a way that it is
not traceable to the passenger who gave the rating and/or made the comments.
3.19 [appellant sub 1] et al. have also argued that they are entitled to inspection as independent controllers
by virtue of their own contractual relationship with the customer but this argument does not stand up.
After all, the subject of these proceedings is the request by [appellant sub 1] e t a l . as data subjects to
Uber as the data controller processing their personal data based on Article 15 of the AVG. The AVG does
not provide for a right to access personal data of others. The court therefore rejects this argument.
The request for access to the 'upfront pricing system'
3.20 By ground of appeal 7, [appellant sub 1] c.s. challenge paragraph 4 .59 of the contested decision in so
far as the district court rejected [appellant sub 3]'s request for access to personal data concerning him in
the 'upfront pricing system'. This is the automated system by which Uber calculates the price for a ride in
advance on the basis of objective factors such as the length and expected duration of the requested ride,
the ratio of supply and demand at that time, expected traffic patterns and the date.
3.21 This grievance succeeds. Contrary to the court's consideration, it is irrelevant whether [appellant sub
3] wishes to inspect this personal data in order to verify the correctness and lawfulness of its
processing, as the right of inspection contained in Article 15(1) chapeau of the AVG does not impose
such a condition. Uber has not submitted any valid ground that could justify a refusal of this access
request. The request by [appellant sub 1] et al. is therefore admissible in so far as it concerns the
initial request for inspection submitted by [appellant sub 3].
The request for information on recipients or categories of recipients
3.22 By ground 9, [appellant sub 1] et al. challenge paragraph 4.70 of the contested decision, in which
the court assumed, given the further information provided by Uber in its defence and the
information contained in the relevant sections of the privacy statement, that this part of the
inspection request had been adequately answered. [appellant sub 1]
et al argue that Uber has not provided any information on how it has disclosed personal data
concerning [appellant sub 1] et al to 'recipients or categories of recipients' within the meaning of
Article 15(1)(c) AVG 'for legal reasons or in the event of a dispute'. That Uber processes data for this
purpose is apparent from the Privacy Policy under point 7, they argue.
3.23 The grievance succeeds. Uber argued, without any further explanation, that under Article 23(1)(c), (d)
and (h) AVG it is not obliged to provide information about the recipients in question. Without further
explanation, it is not clear why the interests referred to in these provisions (in brief: public security,
prevention and detection of criminal offences, and the exercise of official authority) could be relevant in
this context, apart from the fact that Article 23 AVG(1) requires for the invocability of these interests that
their safeguarding is laid down in Union law or national provisions. It is not clear which Union law or
Dutch provision Uber is referring to. To the extent that Uber intended to invoke Article 41 opening words
(i) UAVG in this context, it did not explain. The request by [appellant sub 1] et al. for access to information
about the recipients or categories of recipients to whom personal data of [appellant sub 1] et al. were
disclosed for 'legal reasons or in the event of a dispute', as well as the processing purposes and categories
of personal data concerned, as referred to in Article 15 (1) (a), (b) and (c) of the UAVG, is therefore
admissible. In this regard, the court also refers to the Österreichische Post judgment,3 in which the CJEU
held that the information provided to the data subject under the right of access laid down in Article
15(1)(c) AVG must be as accurate as possible.
Requesting access to all other personal data
3.24 Ground 1 is directed against paragraph 4.35 of the contested order. In it, the court held that the
request for access to all personal data that Uber processes about the applicants is too general and so
lacking in specificity that it is rejected as insufficiently determined. [appellant sub 1] et al argue, first
of all, that the right of inspection under the AVG is unqualified and that further requirements may
only be imposed on it under special circumstances. Secondly, the court's opinion is based on an
incorrect interpretation of recital 63 of the AVG. Indeed, Uber did not request further clarification
prior to the provision. Thirdly, they argue, Uber failed to
when responding to the requests, to communicate in an orderly manner which parts of their request were
granted and rejected, respectively. This allowed [appellant sub 1]
c.s. also fail to specify their request. Fourth, [appellant sub 1] c.s. put forward that they do not know
what data Uber has. Fifth, the court wrongly took into account that [appellant sub 1] c . s. had already
received a large number of personal data, and sixth, [appellant sub 1] c.s. have only submitted a
request for inspection once, and not several times, [appellant sub 1] c.s. For all these reasons, their
general request should still be granted, they argue.
3.25 It has been established between the parties that Uber processes a particularly large number of
personal data of [appellant sub 1] et al. It has also been established that [appellant sub 1] et al. had
already specified a considerable number of categories of personal data in their initial request for
inspection, with the comment that this was not an exhaustive list. The court agrees with the district
court that it should have been up to [appellant sub 1] c . s. to further specify or expand their initial
inspection request (by means of a new or additional initial inspection request). The argument of
[appellant sub 1] et al. that it was factually impossible for them to specify their inspection request
does not stand. The court points out that [appellant sub 1] c.s. could have asked Uber, under Article
15 (1) (b) AVG, for information about the categories of personal data concerned that are processed by
Uber. Based on that answer, they could have submitted a new or additional request for access to
Uber. At
this way, Uber as data controller would have had the opportunity to decide on it, before this further
specification or, as the case may be, extension of the access request became the subject of legal
proceedings. [appellant sub 1] et al have not claimed that they submitted an information request (on the
categories of personal data concerned) to Uber within the meaning of Article 15(1)(b) AVG. In this respect,
[appellant sub 1] e t al have wrongly placed the initiative with Uber. That the data controller, such as Uber,
must first have had the opportunity to decide on an access or information or portability request before that
request becomes the subject of a judicial
procedure, also stems, in the opinion of the court of appeal, from the legal procedure prescribed by
Article 35 UAVG. That article provides that the interested party (in this case: [appellant sub 1] et al.) may
apply to the court with a written request to order the data controller (in this case: Uber) to still grant or
refuse the request as referred to in Articles 15 to 22 of the regulation. In these application proceedings,
therefore, the court must rule on the initial (access or information or portability) request of [appellant
sub 1] et al. as they submitted it to Uber in 2020. Should the interested party be allowed to amend or
extend this initial (access c . q . information c . q . p o r t a b i l i t y ) request in the (judicial) proceedings,
this would deprive the data controller of the opportunity to make an out-of-court decision on the
admissibility of that amended request. In the opinion of the court of appeal, both Article 35 UAVG and
due process oppose this. Ground 1 is therefore unsuccessful.
The request for information on automated decision-making
3.26 The court also rejected the request of [appellant sub 1] et al. insofar as their request was based on
Article 15(1)(h) AVG (right to information about the existence of automated decision-making). To this
end, the court considered, inter alia, in para.
4.67 of the contested decision, that [appellant sub 1] et al. have not sufficiently explained to what
extent Uber has made decisions about them on the basis of automated decision-making as referred to
in Article 22 AVG. This requires that there must also be legal consequences or that the data subject is
otherwise significantly affected. The court added that, where the request relates to anti-fraud
processes, [appellant sub 1] et al have not explained that Uber has concluded with regard to them
that they are guilty of fraud.
3.27 This part of the rejection and the grounds on which it was based are challenged by [appellant sub 1] et
al. in ground 8. First, they argue that Uber itself should have checked whether it had applied automated
decision-making against [appellant sub 1] et al. For [appellant sub 1] et al, it is factually impossible to
prove this. Therefore, [appellant sub 1] e t al cannot be required to specify their request on this point.
Second, they point to paragraph 9 of the privacy statement in which various forms of automated decision-
making as referred to in Article 22 AVG are mentioned. All these forms of automated decision-making,
according to [appellant sub 1] c.s., affect their rights and affect them significantly, for example with regard
to the amount of work they can do through Uber and thus for their income.
Uber raises a defence, which will be discussed below.
a) The scope of Article 15(1)(h) AVG
3.28 The Court will first address the scope and conditions of application of Article 15 (1) (h) AVG, as this
provision forms the basis of the request made by [appellant sub 1] et al. In this respect, the Court notes
that the Dutch version of Article 15 (1) (h) AVG is not entirely clear with respect to the reference therein
to Article 22 AVG. This is important, because the debate between the parties focuses on the question
whether Article 22 AVG is of
applies to the decisions mentioned by [appellant sub 1] et al. that Uber has taken in relation to them.
[appellant sub 1] et al believe it does and Uber believes it does not.
3.29 Read to the (Dutch) letter, the right to information contained in Article 15(1)(h) AVG covers any form of
automated decision-making, 'including profiling as referred to in Article 22(1) and (4)', and thus also, for
example, decision-making that is not exclusively but only partly based on automated decision-making.
However, in the English and French versions of this provision respectively, the right to information is
limited to 'the existence of automated decision-making, including profiling, referred to in Article 22(1) and
(4)' and 'l'existence d'une prise de décision auomatisée, y compris un profilage, visée a l'article 22,
paragraphes 1 et 4' respectively. Judging from these texts, the court assumes that the right to information
contained in Article 15(1)(h) refers only to that form of automated decision-making referred to in Article
22(1) and (4) of the AVG. Such an interpretation (which thus deviates from the letter of the Dutch text)
also argues that the reference, in the Dutch version of Article 15(1)(h) AVG, to the profiling referred to in
Article 22(4) cannot be correct, as that fourth paragraph does not contain the concept of profiling. Finally,
for this interpretation
find support in the EDPB Guidelines. Chapter IV, paragraph E, subparagraph 2 of those guidelines also states
in so many words that the right to information contained in Article 15(1)(h) of the AVG refers to information
about 'exclusively automated decision-making'.
3.30 The foregoing means that a right to information exists under Article 15(1)(h) AVG to the extent that the
controller 'subjects' the data subject to 'a decision based solely on automated processing, including
profiling, which produces legal effects concerning him or her or significantly affects him or her in any other
way'.
3.31 In the EDPB Guidelines (see above under 3.4), Chapter IV, Section B, discusses, among other things,
what is to be understood by a decision that 'otherwise significantly affects' the data subject. Herein, it
is noted that the wording shows that Article 22 AVG 'only refers to serious, significant effects' and
further that the threshold for 'significantly affected' should be 'comparable to the extent to which the
data subject is affected by a decision which has a legal effect'.
b) Does the request for information concern decisions which have legal consequences for [appellant sub
1] et al. or otherwise affect them significantly?
3.32 [appellant sub 1] et al focused their grievance against the rejection of their information request on five
categories of decision-making, which will be discussed successively below.
3.33 First, [appellant sub 1] c.s. want information about the so-called 'batched matching system': this is the
automated system by which Uber matches drivers to passengers. This system first groups the nearest
Uber drivers and passengers into a batch (group) and then determines the optimal match (pairing) within
this group. The aim of this is to minimise waiting times for the entire group of drivers and passengers.
Uber has uncontested that a driver can enter personal preferences in the Driver app, which are taken
into account by Uber in the pairing process. At the same time, Uber has acknowledged that this system
also takes into account a low rating by a passenger, which prevents that particular passenger from being
paired with that driver.
In the opinion of the court of appeal, the automated ride distribution by means of the batched matching
system affects the drivers, on the whole, to a considerable extent. After all, this distribution leads to the
matching of supply and demand and can also lead, as [appellant sub 1] et al. have argued and Uber has
not disputed, to a driver not receiving an offer or receiving it less often. This automated decision-making
thus determines the amount of work that drivers can perform through Uber and thus for their income.
3.34 Secondly, [appellant sub 1] c.s. request information on the so-called 'upfront pricing system': this is the
automated system by which Uber calculates the price for a ride in advance based on objective factors
such as the length and expected duration of the requested ride, the ratio of supply and demand at that
time, expected traffic patterns and the date. In addition or thereby, Uber also uses dynamic fares when
determining the fare. In the opinion of the court of appeal, [appellant sub 1] et al. have sufficiently
substantiated their claim and Uber has not sufficiently substantiated their dispute that the outcome of
these decisions, taken as a whole, affects the drivers to a considerable extent. This system is applied to
every passenger they carry. These are therefore successive decisions, each with financial consequences
that determine the income they can earn.
3.35 Thirdly, [appellant sub 1] c.s. want information on the determination of (average) ratings of drivers:
Uber has explained that ratings are given by passengers, not by Uber, and that Uber only combines those
ratings to arrive at an average rating of the driver. The privacy statement (see above, 2.6) shows that the
combined ratings may constitute grounds for deactivating drivers. As such, these combined ratings, albeit
indirectly, may, in the court's view, produce significant effects for the drivers. The determination of those
average ratings therefore affects the drivers to a significant extent.
3.36 Fourth, [appellant sub 1] et al. requested information about charging cancellation fees to the driver
and, fifth, deactivating the drivers' accounts. Uber explained that it may decide not to charge the
cancellation fee that a passenger would normally have to pay if they have requested and then cancelled
a ride anyway, and therefore not pay it to the driver. This decision is made, according to Uber, if some
form of cancellation fraud occurs.
However, the Court of Appeal notes that [appellant sub 1] et al. failed to explain their grievance on this
point in their notice of appeal, even though it would have been in their power to do so. For instance, they
did not make it concrete that cancellation fees had been charged in their regard, nor did they explain
when and how the accounts of [appellant sub 1] , [appellant sub 2] , [appellant sub 4] and [appellant sub
6] were deactivated. Thus, they have failed to adequately explain on appeal their assertions regarding
these two categories. Of importance here is that the district court also considered that [appellant sub 1]
et al. had failed to explain that Uber had concluded with regard to them that they were guilty of fraud
and that no grievance was directed against that consideration. In this case, unlike in case 200.295.742/01,
in which the court is also ruling today, the court of appeal therefore does not get to the other questions
that need to be answered in order to be able to conclude whether decision-making within the meaning of
Article 22 (1) of the AVG has taken place with regard to these two categories (charging cancellation fees
and deactivating accounts).
c) Are the decisions cited by [appellant sub 1] et al based solely on automated
processing?
3.37 Since it was concluded above (in paragraphs 3.33-3.35) that the decision-making by means of the
'batched matching system' and the 'upfront pricing system' respectively, whether or not in combination
with the use of dynamic fares as well as the determination of average ratings, significantly affects the
drivers, the question to be answered is whether this decision-making is based solely on automated
processing. In respect of all three of these categories, Uber has not contested, or has not sufficiently
substantiated, that this is the
case. These are therefore decisions that fall within the scope of Article 22(1) AVG, and therefore within
the scope of Article 15(1)(h) AVG.
d) Can Uber rely on an exception to the right to information contained in Article 15(1)(h) AVG?
3.38 In its defence at first instance (paragraphs 90-91), Uber put forward the defence that the
information requested by [appellant sub 1] et al contains trade secrets concerning its anti-fraud
processes. If it were to provide [appellant sub 1] et al with information about this, it could lead to
circumvention of those processes and competitors could take advantage of it. Effective fraud
prevention is of great importance to Uber, partly because TfL can impose sanctions if Uber fails to do
so. Uber believes that under Article 15(4) AVG and Article 41(1)(i) UAVG, it is entitled to refuse the
information requested by [appellant sub 1] et al.
3.39 The court first notes that Article 15(4) AVG only contains an exception to the data subject's right to
receive a copy of personal data contained in Article 15(3) AVG. The exception does not concern the right
to information about the existence of automated decision-making contained in Article 15(1) introductory
sentence and subparagraph (h) of the AVG. In contrast, Article 23(1)(i) AVG provides that the scope of the
obligations and rights set out in, inter alia, Article 15 AVG may, under certain conditions, be limited by
Member States if such limitation is necessary and proportionate to safeguard the protection of the rights
and freedoms of others. In Dutch law, such a restriction is laid down in Article 41(1)(i) UAVG. In the
opinion of the court of appeal, however, this provision does not provide sufficient grounds for the opinion
that Uber is entitled to reject the information requests of [appellant sub 1] et al. in their entirety. This is
because a complete rejection of those requests is not in accordance with the proportionality and necessity
required by Article 41(1)(i) UAVG, or at least Uber has not sufficiently argued for the opinion that a
complete rejection would be proportionate and necessary with a view to protecting its trade secrets. For
the sake of completeness, the court refers to paragraph 63 in the preamble to the AVG, which considers
that considerations relating to the rights or freedoms of others should not result in the data subject being
deprived of all information. This defence by Uber in defence of its rejection of the information requests is
therefore rejected by the court.
e) How should an information request referred to in Article 15 1(1)(h) AVG be acted upon?
3.40 The conclusion is that Uber wrongfully rejected the requests for information from [appellant sub 1]
et al. concerning the 'batched matching system' and the 'upfront pricing system' respectively,
whether or not in combination with the use of dynamic rates as well as the determination of
(average) ratings. The grievance succeeds to that extent.
3.41 To the extent that Uber believes that a reference to its website is sufficient to explain this category of
decision-making, the court notes that such a reference cannot suffice. After all, Article 15(1)(h) AVG
requires that the data subject has the right to information about the existence of automated decision-
making (as referred to in Article 22 AVG), including profiling, and, if so, 'useful information on the
underlying logic, as well as the significance and expected consequences of that processing for the data
subject. Of relevance here is that the information should be 'useful information', i.e. such information as to
enable the data subject to make an informed decision as to whether or not he or she wishes to exercise his
or her rights guaranteed by the AVG, such as the right to rectification or access or the right to seek judicial
remedy.4 As required by the EDPB guidelines, under Article 15(1)(h) AVG, the controller must provide the
data subject with general information useful for challenging the decision, in particular information on
factors considered in the decision-making process, and their respective 'weighting' at an aggregate level.5
The information provided should be complete enough for the data subject to understand the reasons for
the decision. However, it also follows from that guidance that it need not necessarily be a complex
explanation of the algorithms used or an exposition of the full algorithm. This latter limitation, in the
opinion of the court, adequately takes into account the interests of, in this case Uber, as regards the
trade secrets it has mentioned. Uber has failed to show that the website it mentions complies with the
requirements arising from Article 15(1)(h) AVG, read in light of the EDPB guidelines. What matters is that
Uber at least explains on the basis of what factors and what weighting of those
factors Uber arrives at the ride-sharing decisions, fare decisions and average ratings, respectively, and
also provides [appellant sub 1] et al with other information necessary to understand the reasons for
those decisions.
The right to portability of certain data as referred to in Article 20 AVG
3.42 Article 20(1) AVG contains the data subject's right to obtain, under certain conditions, personal data
concerning him that he has provided to a controller in a structured, common and machine-readable form.
When exercising this right, Article 20(2) AVG provides that the data subject has the right to have the
personal data transferred directly from one controller to another, if this is technically possible. The
rationale behind this is that the data subject can take their data with them to, for example, another
service provider and, in principle, enforce cooperation from the original data controller to do so.
3.43 In their requests, [appellant sub 1] et al requested Uber, relying on Article 20 AVG, to provide the
personal data covered by this provision. In responding to [appellant sub 1] c . s.'s requests, Uber
provided most of the requested information in CSV or similar form, or at least [appellant sub 1] c.s.
did not dispute this assertion by Uber (paragraph 141 of the appeal defence). For some of the
requested information, Uber has done so in other format, such as PDF. That concerns the categories
'zendesk tickets', 'invoices', 'driver safety complaints' and 'driver documents'.
3.44 With ground 10, [appellant sub 1] c.s. challenge paragraph 4.81 of the contested decision. In it, the
district court ruled that there was no reason to order Uber to still provide the categories provided in PDF
format in a CSV format (or comparable format) to [appellant sub 1] et al. In the absence of a dispute by
[appellant sub 1] et al. the court of appeal concurs with the court's opinion that the categories 'zendesk
tickets', 'driver complaints' and 'invoices' do not fall within the scope of Article 20 AVG because these data
were not provided to Uber by the applicants themselves, either actively and knowingly or through the use
of the Uber Driver app. With regard to the 'driver documents', Uber reasoned that it can only provide
these documents provided by the drivers themselves, such as a copy of a driving licence, in the format in
which the driver himself provided the document. [appellant sub 1] et al have not disputed that. Also in
light of the
wording 'if technically possible', as contained in Article 20(2) AVG, which admittedly refer to transmission
from one controller to another, the court assumes that the right contained in Article 20(1) AVG does not
require the controller to do the technically impossible. A starting point for this can also be found in recital
68 of the preamble to the AVG, which considers, with regard to the right contained in Article 20 AVG: 'The
data subject's right to transmit or receive personal data concerning him should not create an obligation
for the controller to set up or maintain technically compatible data processing systems.' All this leads the
court to the conclusion that the request of [appellant sub 1] et al. based on Article 20 AVG, which on
appeal still only concerns the
'send desk tickets', 'driver complaints', 'invoices', and 'driver documents', does not qualify for adjudication.
The grievance is unsuccessful.
3.45 On appeal, [appellant sub 1] et al. sought a further declaration of law in connection with their
application based on Article 20 AVG, to the effect that provision of data in PDF format does not
qualify as provision within the meaning of Article 20 (1) AVG.
In this regard, the court points to the
The judgment of the Supreme Court of 31 March 2000, ECLI:NL:HR: 2000:AA5319, paragraph 3.2.2. It may
be deduced from this that the court may, on an application made for that purpose, make a declaration of
law concerning a statutory provision, provided that it remains within the limits of the said statutory
provision and is limited to determining the legal relationship in dispute between the applicant and the
defendant. Since, in the present legal relationship between [appellant sub 1] et al. and Uber, the request
based on Article 20 AVG does not qualify for granting, the conditions set by the Supreme Court are not
met and the request for a declaration of law should be rejected.
The penalty payment requested
3.46 [appellant sub 1] et al, citing Article 35(5) UAVG, request the imposition of a penalty payment in
the amount of €6,000.00 for each day or part thereof that Uber fails to comply with the order to be
issued.
The court will award it up to €4,000.00 per day or part of a day, in line with the penalty payment as
awarded in the aforementioned case 200.295.742/01 (brought by other drivers against Uber), also to be
decided today.
Executable by stock?
3.47 Uber has requested that, if the request of [appellant sub 1] et al. is granted, the order should not be
declared provisionally enforceable. In this regard, the court of appeal refers to the basic principle to be
observed that a judgment to be pronounced must be enforceable and can be enforced. Deviation from this
principle can be justified by circumstances that mean that the interest of the convicted person in
maintaining the existing situation as long as no decision has been made on an appeal lodged by him
outweighs the interest of the person who obtained the conviction in the judgment to be declared
provisionally enforceable. What Uber has put forward in support of its request for the declaration of
provisional enforceability not to be granted, namely that the inspection would essentially give access to its
anti-fraud processes, is irrelevant as the parts of the request that have been granted do not relate to this.
The request by [appellant sub 1] et al to declare the decision provisionally enforceable will therefore be
granted.
The incidental requests
3.48 In the (conditional) incident, [appellant sub 1] et al. requested the court to order Uber, pursuant to
Section 843a of the Dutch Code of Civil Procedure, to produce inspection, copies or extracts of the
documents and data held by Uber and placed on a data carrier
- in which Uber has recorded in respect of which categories of personal data as mentioned in the
Guidance Notes Uber has granted or refused the access request of [appellant sub 1] et al. as
referred to in Article 15 (1) AVG and
- establishing whether Uber applied automated decision-making, including profiling referred to in
Article 22(1) and (4) AVG, in respect of [appellant sub 1] et al.
These incidental applications were filed conditionally. Since grievance 2, concerning the
Guidance notes, and grievance 8, regarding automated decision-making, succeed, the condition under
which the incidental applications were filed is not met and the court does not get to assess them.
Final sum
3.49 Uber's grievance on incidental appeal and [appellant sub 1]'s grievances 1, 5, 6 and 10
c.s. in the main appeal fails. Grounds 2, 3, 4, 7, 8 and 9 of the principal appeal are wholly or largely
successful. The Court will grant the related requests in the manner as yet to be stated. The incidental
request will be dismissed, as will Uber's request that the order not be declared provisionally enforceable.
Uber shall be ordered to pay the costs of the incidental and principal appeal proceedings and the
proceedings at first instance as the party largely unsuccessful. [appellant sub 1] et al. shall be ordered to
pay the costs of the incidental proceedings.
4 Decision
The court:
Annuls the contested decision insofar as it rejected the request of [appellant sub 1] et al. concerning:
a. a) the initial request by [appellant sub 1] et al, based on Article 15(1) chapeau of the AVG, for access
to the personal data relating to them (i) as described in production 2 to the notice of appeal and
belonging to category 12 of the Guidance Notes, entitled 'Driver detailed device data', (ii) as contained
in the Driver's profile and (iii) as contained in the 'tags'.
b) [appellant sub 3]'s initial request, based on Article 15(1) chapeau AVG, for access to personal data
concerning him in the 'upfront pricing' category.
c) the initial request by [appellant subsection 1] c.s., based on Article 15(1)(a), (b) and (c) of the AVG, for
access to information on the recipients or categories of recipients to whom personal data of [appellant
subsection 1] c.s. have been disclosed for 'legal reasons or in the event of a dispute', as well as the
processing purposes and categories of personal data concerned.
d) the initial request by [appellant sub 1] et al. based on Article 15(1)(h) AVG for information on the existence
of automated decision-making within the meaning of that provision insofar as that request relates to the
'batched matching system', the 'upfront pricing system' whether or not in combination with the system of
dynamic fares used by Uber as well as the determination of (average) ratings.
and to that extent re-adjudicated:
orders Uber, within two months of service of this order, to grant the requests referred to above under (a) to
(c) as well as the request referred to above under (d) in the manner described in paragraph 3.41, on pain of
forfeiture of a penalty payment in the amount of €4,000.00 for each day or part thereof that Uber fails to
comply with this order.
otherwise upholds the order under appeal in so far as the judgment of the court of appeal
subjected.
order Uber to pay the costs of the main appeal and the incidental appeal and of the proceedings at first
instance and, in so far as they have fallen to date on the side of [appellant subsection 1] et al, set the amount
of those costs at EUR 338 in disbursements and EUR 3,342 in wages on appeal and at EUR 304 in
disbursements and EUR 1,126 in wages at first instance.
order [appellant subsection 1] et al. to pay the costs of the incident and estimate these costs, in so far as Uber
has been ordered to pay them to date, at € 0 in disbursements and € 1,114 in salary and at € 163 for additional
salary, to be increased by € 85 for additional salary and by the costs of the writ of summons, in the event that
the order(s) pronounced by this order have not been complied with within fourteen days and service of this
order has not been effected, and to be increased by statutory interest.
declares this order provisionally enforceable.
Dismisses the more or otherwise requested.

# data[].attributes.attachment_link.description
A Dutch Court of Appeal ordered Uber to provide drivers with access to their personal data and information about automated decision-making. The Court subjected the controller to a penalty of €4,000 per day until compliance.

# data[].attributes.attachment_link.readable_text
LEGE nr. 190 din 18 iulie 2018 privind măsuri de punere în aplicare a Regulamentului (UE) 2016/679 al Parlamentului European și al Consiliului din 27 aprilie 2016 privind protecția persoanelor fizice în ceea ce privește prelucrarea datelor cu caracter personal și privind libera circulație a acestor date și de abrogare a Directivei 95/46/CE (Regulamentul general privind protecția datelor)

Publicat în MONITORUL OFICIAL nr. 651 din 26 iulie 2018 Parlamentul României adoptă prezenta lege. + Capitolul IV Responsabilul cu protecția datelor + Capitolul V Organisme de certificare Acreditarea organismelor de certificare + Articolul 11 (1) Acreditarea organismelor de certificare prevăzute la (2) Organismele de certificare vor fi acreditate potrivit reglementărilor legale aplicabile, în conformitate cu standardul EN-ISO/IEC 17065 și cu cerințele suplimentare stabilite de Autoritatea națională de supraveghere, precum și cu respectarea prevederilor Această lege a fost adoptată de Parlamentul României, cu respectarea prevederilor art. 43 din Regulamentul general privind protecția datelor se realizează de Asociația de Acreditare din România - RENAR, în calitate de organism național de acreditare, în conformitate cu Regulamentul (CE) nr. 765/2008 al Parlamentului European și al Consiliului din 9 iulie 2008 de stabilire a cerințelor de acreditare și de supraveghere a pieței în ceea ce privește comercializarea produselor și de abrogare a Regulamentului (CEE) nr. 339/93, publicat în Jurnalul Oficial al Uniunii Europene, seria L, nr. 218 din 13 august 2008, precum și în conformitate cu art. 43 din Regulamentul general privind protecția datelor. art. 75 și ale art. 76 alin. (1) din Constituția României, republicată.
p. PREȘEDINTELE CAMEREI DEPUTAȚILOR,
PETRU-GABRIEL VLASE
p. PREȘEDINTELE SENATULUI,
IULIAN-CLAUDIU MANDA Ordonanța Guvernului nr. 23/2009 privind activitatea de acreditare a organismelor de evaluare a conformității, aprobată cu modificări prin Legea nr. 256/2011 București, 18 iulie 2018. Nr. 190. -----

# data[].attributes.attachment_link.readable_text
Background information

Date of final decision: 13 December 2022

National case

Controller: Alektum Oy

Legal Reference: Right of access (Article 15), Transparency, Providing information on action taken on a request under Article 15 (Article 12(3))

Decision: administrative fine, reprimand

Key words: access request

Summary of the Decision

Origin of the case

The Finnish SA began an investigation on the collection agency Alektum Oy after having received three complaints from private individuals. Two of the complaints said that the company had not replied to requests to access the data subjects' data. One of the complainants had received a reply from Alektum but had still not been given the requested copy of their personal data.

Key Findings

The Finnish SA's investigation revealed that Alektum Oy had regularly failed to reply to requests concerning the data protection rights of the data subject. The Finnish SA finds that the company was not sufficiently familiar with the requirements of data protection legislation and its operations indicated indifference regarding the law.

The company also obstructed and delayed the investigation by avoiding the supervisory authority. The SA made a variety of attempts to hear Alektum Oy during the investigation. The SA finds that the company was unwilling to explain its conduct or cooperate with the SA.

Decision

The Finnish SA imposed an administrative fine of EUR 750,000 on Alektum Oy for serious data protection violations. The company was also reprimanded.
For further information:

# data[].attributes.attachment_link.title
Finnish SA imposed an administrative fine on collection agency for not responding to requests to exercise the data subjects rights

# data[].attributes.attachment_link.description
Date of final decision: 13 December 2022 National case Controller: Alektum Oy Legal Reference: Right of access (Article 15), Transparency, Providing information on action taken on a request under Article 15 (Article 12(3)) Decision: administrative fine, reprimand Key words: access request The Finnish SA began an investigation on the collection agency Alektum Oy after having received three complaints from private individuals.

# data[].attributes.attachment_link.title
The Lithuanian SA adopted a decision on the right to access data exercised by the financial institution | European Data Protection Board

# data[].attributes.attachment_link.description
The Data Controller has refused to provide the data subject (client) with a copy of the requested records of telephone conversations (that took place between the client and the employee), indicating that it provides records of the conversation only to the extent that the data subject’s right to rece…

# data[].attributes.attachment_link.readable_text
Background information

Date of final decision: 30 November 2022

Cross-border case or national case: National case

Controller: FREE

Legal Reference: right of access (article 15 of the GDPR), right to erasure (articles 12 and 21 of the GDPR), obligation to secure personal data (Article 32 of the GDPR), obligation to document a personal data breach (Article 33 of the GDPR)

Decision: infringement of the GDPR, Administrative fine, order to comply with periodic penalty payments

Key words: rights of individuals, passwords, data breach, security

Summary of the Decision

Origin of the case

The CNIL, French Supervisory Authority (SA), received several complaints concerning the difficulties encountered by individuals in having their requests for access to and deletion of their personal data taken into account by the French phone operator FREE.

Key Findings

Failure to respect the right of access of individuals (Article 15 of the GDPR)

Failure to respect individual's rights of erasure (Article 12 and 21 of the GDPR)

Failure to ensure the security of personal data (Article 32 of the GDPR)

Failure to comply with the obligation to document a personal data breach (Article 33 of the GDPR)

Decision

As a result, the restricted committee - the CNIL's body in charge of issuing sanctions - imposed a fine of 300,000 euros on FREE and decided to make its decision public. It also ordered the company to comply with the management of requests for access by individuals and to justify its compliance within three months of the notification of the decision, subject to a penalty payment of 500 euros for each day overdue.

Further information: link to decision in national language

# data[].attributes.attachment_link.title
The CNIL, French Supervisory Authority fines FREE EUR 300,000

# data[].attributes.attachment_link.description
Date of final decision: 30 November 2022 Cross-border case or national case: National case Controller: FREE Legal Reference: right of access (article 15 of the GDPR), right to erasure (articles 12 and 21 of the GDPR), obligation to secure personal data (Article 32 of the GDPR), obligation to document a

# data[].attributes.attachment_link.readable_text
Background information

Date of final decision: 16 June 2022

Controller: Unicredit S.p.A

Legal Reference: transparency and fairness of processing (Article 5.1(a)), transparency in and arrangements for exercise of DSR (Art.12), right of access (Art.15)

Decision: the Italian SA imposed an EUR 70,000 administrative fine and ordered the controller to grant the access request by the data subject

Key words: processing of data in the employment sector, right of access to one's personal data, transparency and fairness of processing

Summary of the Decision

Origin of the case

The case followed a complaint against the failure by the controller (the complainant's employer) to reply to an access request.

Key Findings

The Italian SA found that the reply provided by Unicredit S.p.A. to the access request prior to the complaint was devoid of any substance as the company made any reply conditional upon the filling out of a pre-set form. The form itself was found to be incomplete and misleading as to the actual scope of the right at issue. The company considered it was free to discard access requests that were submitted without using the given form and replied to the data subject only after the latter lodged his complaint. In that respect, the Italian SA clarified that an access request could not be dealt with by delivering the information notice as per Articles 13 and 14 GDPR; the right of access to one's personal data and the right to be informed, though mutually related, are different rights which are set forth in separate provisions of the GDPR and are intended to afford safeguards and protection in ways that are not fully superimposable. The Italian SA recalled the EDPB Guidelines 1/2022 on data subject rights (right of access) in this connection.

Decision

An EUR 70,000 administrative fine was imposed on the controller which was ordered to grant the access request by the data subject.

For further information: decision in national language "Ordinanza ingiunzione nei confronti di Unicredit S.p.A. - 16 giugno 2022"

# data[].attributes.attachment_link.title
Employees' right of access: Italian SA fines Unicredit S.p.A. and orders corrective measures

# data[].attributes.attachment_link.description
Date of final decision: 16 June 2022 Controller: Unicredit S.p.A Legal Reference: transparency and fairness of processing (Article 5.1(a)), transparency in and arrangements for exercise of DSR (Art.12), right of access (Art.15) Decision: the Italian SA imposed an EUR 70,000 administrative fine and ordered the controller to grant the access request by the data subject Key words: processing of data in the employment sector, right of access to one's personal data, transparency and fairness of processing The case followed a complaint against the failure by the controller (the complainant's employer) to reply to an access request.

# data[].attributes.attachment_link.readable_text
Background information

Date of final decision: 2 December 2021 (inspection) and 13 September 2022 (offence)

Controller: Public penal institution (prison)

Legal Reference: National Law (Act on the Protection of Personal Data in the Area of Treatment of Criminal Offences)

Decision: Rejection of the appeal

Key words: Right of access by the data subject

Summary of the Decision

Origin of the case

The applicant requested a copy of video recordings of his movement in block 1 of a prison for a certain date and period of time. The controller rejected his request on the grounds of Article 25 of the Act on the Protection of Personal Data in the Area of Treatment of Criminal Offences, providing that the law can partially or completely restrict the right of access by a data subject, inter alia, when it could prevent the obstruction or interference with official procedures and for the protection or exercise of human rights and fundamental freedoms of third parties.

The controller also argued that his internal video surveillance rules provide that video recordings are marked as classified. According to the national Classified Information Act, only persons who have a permission and have to be informed for the performance of their duties, can access classified data.

Key Findings

Slovenian Supervisory Authority, SA determined that the video recordings in question do not exist. According to controller's internal rules the data must be kept at least 20 days and maximum one year. Video recordings were actually stored for a period of one month, after one month they were automatically deleted. Slovenian SA could not assess the controller's claims on possible grounds for restriction of the right to access, because for full examination the video recordings should have been submitted to the SA.

Decision

Slovenian SA rejected the appeal of the individual, but started an offence proceeding against the controller. Slovenian SA found that the director of the prison is responsible for not implementing technical and organisational measures appropriate to ensure the video recordings, after receiving an access request, would not be deleted. The director as person responsible was aware of the request of the individual and taking into account the fact that the recordings were still existing on the day when the request was submitted, he allowed the recordings to be automatically deleted. Taking all circumstances of the offence into account, Slovenian SA issued the director a warning.

# data[].attributes.attachment_link.title
Video recordings, in relation to which the individual is exercising his right of access, must be appropriately protected against erasure

# data[].attributes.attachment_link.description
Date of final decision: 2 December 2021 (inspection) and 13 September 2022 (offence) Controller: Public penal institution (prison) Legal Reference: National Law (Act on the Protection of Personal Data in the Area of Treatment of Criminal Offences) Decision: Rejection of the appeal Key words: Right of access by the data subject The applicant requested a copy of video recordings of his movement in block 1 of a prison for a certain date and period of time.

# data[].attributes.attachment_link.readable_text
Background information

Date of final decision: 9 May 2022

Cross-border case or national case: National case

Controller: Otavamedia Oy

Legal Reference: Data minimisation (Article 5(1)(c)), transparent information, communication and modalities for the exercise of the rights of the data subject (Article 12), right of access (Article 15), right to erasure (Article 17), data protection by design and by default (Article 25)

Decision: Administrative fine, reprimand and order to comply

Key words: rights of the data subject, identification

Summary of the Decision

Origin of the case:

From 2018 to 2021, eleven cases concerning Otavamedia were brought to the Finnish SA. Among other things, the complainants had not received a response to their requests or enquiries concerning data protection rights.

According to the report by Otavamedia, some of the data protection requests had not been implemented due to a technical issue in the e-mail redirect when service providers were changed. During the error situation, the messages that arrived in the e-mail inbox reserved for data protection issues had not been directed to the customer service. The situation was only discovered due to the request for information by the Finnish SA. At that time, the situation had lasted for seven months.

Key Findings:

The Finnish SA finds that Otavamedia should have taken care of the testing of the e-mail inbox, because it was the main electronic contact channel of data subjects in data protection matters.

Data subjects were also able to submit requests concerning their own data with a printable form. The form required the person's signature for identification purposes. The Finnish SA finds that through this method, Otavamedia gathered an excessive amount of information for identification. The Finnish SA notes that the controller may not hinder data subjects in exercising their rights.

Decision:

The Finnish SA imposed an administrative fine of EUR 85,000 on the controller for deficiencies in the implementation of the rights of the data subject via the e-mail channel. The Finnish SA ordered the controller to correct its procedures in order to comply with the data protection regulations and stop using the signed form. In addition, the company was issued a reprimand for neglecting the rights of the data subject.

For further information: decision in national language

Press release: Administrative fine on Otavamedia for deficiencies in the implementation of data protection rights

# data[].attributes.attachment_link.title
Finnish SA: Administrative fine on Otavamedia for deficiencies in the implementation of data protection rights

# data[].attributes.attachment_link.description
Date of final decision: 9 May 2022 Cross-border case or national case: National case Controller: Otavamedia Oy Legal Reference: Data minimisation (Article 5(1)(c)), transparent information, communication and modalities for the exercise of the rights of the data subject (Article 12), right of access (Article 15), right to erasure (Article 17), data protection by design and by default (Article 25) Decision: Administrative fine, reprimand and order to comply Key words: rights of the data subject, identification Origin of the case: From 2018 to 2021, eleven cases concerning Otavamedia were brought to the Finnish SA.

# data[].attributes.headline
The EDPB selected the topic for its third coordinated enforcement action, which will concern the implementation of the right of access by controllers.

# data[].attributes.subject
The EDPB selected the topic for its third coordinated enforcement action, which will concern the implementation of the right of access by controllers.

# data[].attributes.attachment_link.readable_text
During its October plenary, the EDPB selected the topic for its third coordinated enforcement action, which will concern the implementation of the right of access by controllers. Further work will now be carried out to specify the details in the upcoming months and the action itself will be launched in 2024.

In a coordinated action, the EDPB prioritises a certain topic for data protection authorities (DPAs) to work on at the national level. The results of these national actions are then bundled and analysed, generating deeper insight into the topic and allowing for targeted follow-up on both the national and the EU level. Last year, the EDPB selected the designation and position of data protection officers (DPOs). The report on the outcome of the 2023 coordinated action will be adopted in the coming months.

Earlier this year, the EDPB published the report on the outcome of its first coordinated action on the use of cloud-based services by the public sector.

This new coordinated action follows the EDPB's decision to set up a Coordinated Enforcement Framework (CEF) in October 2020. The CEF is a key action of the EDPB under its 2021-2023 Strategy, together with the creation of a Support Pool of Experts (SPE). The two initiatives aim to streamline enforcement and cooperation among DPAs.

# data[].attributes.attachment_link.title
EDPB picks topic for 2024 Coordinated Action

# data[].attributes.attachment_link.description
During its October plenary, the EDPB selected the topic for its third coordinated enforcement action, which will concern the implementation of the right of access by controllers. Further work will now be carried out to specify the details in the upcoming months and the action itself will be launched in 2024.