19 05 27 GDPR Guide 2019
19 05 27 GDPR Guide 2019
Local Implementation
in Central, Eastern &
Southeastern Europe
2019 Edition
GDPR
Local Implementation
in Central, Eastern &
Southeastern Europe
This 2019 Wolf Theiss Guide, GDPR: Local Implementation in Central, Eastern & Southeastern Europe is intended
as a practical guide to the general principles and features of the basic legislation and procedures in countries included
in the publication.
While every effort has been made to ensure that the content is accurate when finalised, it should be used only as a
general reference guide and should not be relied upon as definitive for planning or making definitive legal decisions. In
these rapidly changing legal markets, the laws and regulations are frequently revised, either by amended legislation
or by administrative interpretation.
© 2019 WOLF THEISS Rechtsanwälte GmbH & Co KG. All Rights Reserved.
GDPR: Local Implementation in Central, Eastern & Southeastern Europe CONTENT
TABLE OF CONTENTS
FOREWORD 04
GDPR AFTER(MATH) 05
COUNTRY CHAPTERS 08
AUSTRIA 08
BULGARIA 16
CROATIA 24
CZECH REPUBLIC 30
HUNGARY 37
POLAND 43
ROMANIA 49
SLOVAK REPUBLIC 56
SLOVENIA 62
OUR OFFICES 65
3
FOREWORD
FOREWORD
We are pleased to present you with the first edition of the Wolf Theiss Guide, GDPR: Local Implementation in
Central, Eastern and Southeastern Europe.
From the viewpoint of public awareness and practical enforcement, the EU General Data Protection Regulation
(GDPR) has been the most important reform of European data protection laws in the last 25 years. At the same
time, it sets international standards that go beyond the borders of the European Union and has led to similar
initiatives in other countries around the world. Supplementing the GDPR, the member states still have to or
may regulate certain aspects left to their local legal discretion. A year later, we take a look at what duties this
law actually entails for companies and how member states and other countries have adapted their local data
protection laws.
Wolf Theiss’ strength has always been regional coverage. Our team of data protection experts are spread across
the entire CEE/SEE region, giving our clients the advantage of seamless and efficient service across borders
and specialised industry sectors to meet their business needs. This guide is intended to be a useful resource tool
providing you with a brief overview of the differences between local laws in the CEE/ SEE region and the GDPR,
and to answer some of the most frequently raised questions.
We hope that you will find the guide helpful. If you have any questions regarding the content or need more
information, please do not hesitate to contact us or any of our regional team members listed in the guide.
May 2019
4
GDPR: Local Implementation in Central, Eastern & Southeastern Europe GDPR AFTER(MATH)
Since coming into force a year ago, the GDPR has seen a lot of activity under its provisions – here is a brief
overview:
95,180
90,000
60,000
30,000
41,502
40,000
30,000
20,000
10,000
* Source: The European Commission (europa.eu/dataprotection) and the International Association of Privacy
Professionals (GDPR One Year Anniversary)
5
GDPR AFTER(MATH)
300
255
200
100
For failure to comply with the information duty under Art. 14 GDPR: EUR 220,000
* Source: The European Commission (europa.eu/dataprotection) and the International Association of Privacy
Professionals (GDPR One Year Anniversary)
6
GDPR: Local Implementation in Central, Eastern & Southeastern Europe WOLF THEISS REGION
Warsaw
POLAND
Kyiv
Prague
UKRAINE
CZECH
REPUBLIC
SLOVAK
REPUBLIC
Vienna Bratislava
AUSTRIA Budapest
HUNGARY
Ljubljana ROMANIA
SLOVENIA Zagreb
CROATIA
Tirana
ALBANIA
EUROPE
Kyiv
Prague
CZECH UKRAINE
REPUBLIC
SLOVAK
REPUBLIC
Bratislava
Vienna
AUSTRIA Budapest
HUNGARY
Ljubljana ROMANIA
SLOVENIA Zagreb
CROATIA
Bucharest
BOSNIA & Belgrade
HERZEGOVINA
Sarajevo
SERBIA
BULGARIA
Sofia
Tirana
ALBANIA
AUSTRIA
9
The prior Austrian Data Protection Act 2000 has been aligned with the GDPR through the Data Protection
Amendment Act 2018 (Datenschutz-Anpassungsgesetz 2018) and the Data Protection Deregulation Act 2018
(Datenschutz-Deregulierungsgesetz 2018) (together, Austrian DPA, österreichisches Datenschutzgesetz). These
changes include certain deviations from the GDPR which must be taken into account by companies, both, within
their organisation (e.g. vis-à-vis employees) and externally (e.g. vis-à-vis customers) together with the GDPR.
Here, we highlight some of the most important provisions of the Austrian DPA that differ from the GDPR (e.g. data
secrecy obligations, processing criminal data, age of child consent, etc)1.
Black-List (Datenschutz-Folgenabschätzung-Verordnung)
Abb.: DSFA-V
White-List (Datenschutz-Folgenabschätzung-Ausnahmenverordnung)
Abb.: DSFA-AV
1 The additional laws adopted to implement provisions of the GDPR in other legal areas fall outside the scope of
this guide. Some of these are:
The General Data Protection Adjustment Act (Materien-Datenschutz-Anpassungsgesetz 2018)
The research-sector-specific Data Protection Adjustment Act – Science and Research (Datenschutz-
Anpassungsgesetz 2018 – Wissenschaft und Forschung (WFDSAG 2018))
Second General Data Protection Adjustment Act (2. Materien-Datenschutz-Anpassungsgesetz 2018)
The DPIA Ordinance (DSFA-V), establishing the categories of processing operations that require a data
protection impact assessment (so called “Black-List”)
The DPIA Exemptions Ordinance (DSFA-AV), determining the exemptions from the duty to carry out a data
privacy impact assessment (so called “White-List”)
10
GDPR: Local Implementation in Central, Eastern & Southeastern Europe AUSTRIA
Art. 23 Under the Austrian DPA, the data subjects’ access rights under GDPR Art. 15 do not
apply if either:
Art. 89(2)
Providing the information to the data subject jeopardizes the fulfillment of legally
Art. 89(3)
assigned tasks by a data controller exercising its powers as a public authority.
Complying with the access request endangers trade or business secrets.
ii. Rectification and Erasure Rights
The Austrian DPA also limits the data controller’s obligation to rectify or erase personal
data when the data controller uses automated data processing and can only carry out the
rectification or erasure at certain times due to financial or technical constraints. In these
cases, the data controller must restrict the personal data processing until the relevant
time in compliance with GDPR Art. 18(2).
When the data controller restricts personal data processing, it can only store the data or
process it:
with the data subject’s consent
to establish, exercise, or defend legal claims
to protect the rights of another individual or legal entity
for important public interest reasons
11
Are there any additional obligations when to appoint a data protection officer?
Art. 37(4) N/A No
Are there additional obligations, conditions, or exemptions in connection with the transfer of data to a third country or
an international organisation?
Art. 49(1) N/A No
Art. 49(5)
Are there additional limits on the transfer of specific categories of personal data to a third country or an international
organisation?
Art. 49(5) N/A No
In a nutshell, what are the local regulations in connection with the supervisory authority’s powers, due process and
remedies against actions and decisions of the local supervisory authority?
Art. 58 § 30 The principles of Austrian administrative law generally only allow fines to be imposed
Art. 83(8) § 11 on natural persons, for example, the managing director or other representatives of the
legal entity. However, to accommodate the high fines under the GDPR, the Austrian DPA
§ 22
also allows the Austrian Authority to impose administrative fines on legal persons under
certain circumstances. For example, when a person acting individually or as part of an
executive body infringes the GDPR or Austrian DPA, the Austrian Authority may fine the
legal person when the acting individual has the authority to:
represent the legal person
make decisions on behalf of the legal person
exercise control within the legal person
The Austrian Authority may also hold legal persons responsible when the infringements
were facilitated by a lack of supervision or control by persons in a position of authority
within the legal person, unless the act is a criminal violation, punishable by the courts.
12
GDPR: Local Implementation in Central, Eastern & Southeastern Europe AUSTRIA
Art. 84 § 62 i.) The Austrian DPA provides for further administrative offences punishable by fines of
§ 63 up to EUR 50,000. A punishable administrative offence is committed by anyone that:
Intentionally and illegally gains access to data processing or maintains an
obviously illegal means of access.
Intentionally transmits data in violation of the rules on confidentiality (found in
Section 6, Austrian DPA).
Intentionally and falsely pretending that certain facts are true in order to obtain
personal data under Section 10 of the Austrian DPA that permits certain processing
if a disaster occurs.
Processes images in violation of the provisions regulating closed circuit television
use under Section 12 of the Austrian DPA.
Refuses inspection by the Austrian Authority.
ii.) Further, the use of data with the intention to make a profit or to cause harm constitutes
a criminal offence punishable by a court with imprisonment of up to one year or a
monetary penalty of up to 720 daily rates, unless the offence is subject to a more
severe punishment under another provision.
Are there provisions to balance the protection of personal data with the rights to freedom of expression and information,
including processing for journalistic, academic, artistic, or literary purposes?
Art. 85 §9 i.) The Austrian DPA and several GDPR provisions do not apply to data processing by
media owners, publishers, copy editors, or employees of media enterprises or media
services within the meaning of the Austrian Media Act. The following Chapters of the
GDPR do not apply to this type of processing:
Chapter II (Principles)
Chapter III (Rights of the data subject)
Chapter IV (Controller and processor)
Chapter V (Transfer of personal data to third countries or international organisations).
Chapter VI (Independent supervisory authorities)
Chapter VII (Cooperation and consistency)
Chapter IX (Provisions relating to specific processing situations)
ii.) Under the Austrian DPA, certain provisions of the GDPR do not apply to data
processing for purposes of academic, artistic, or literary expression, if necessary to
balance the data protection right with the freedom of expression and information.
13
14
GDPR: Local Implementation in Central, Eastern & Southeastern Europe AUSTRIA
15
16
BULGARIA
17
On 26 February 2019, the law amending and supplementing the Bulgarian Personal Data Protection Act (in
Bulgarian: Закон за изменение и допълнение на Закона за защита на личните данни) in view of the GDPR
(“Implementing Law”) was published in the State Gazette. The Implementing Law has a twofold purpose – it
implements the GDPR into national legislation and also transposes Directive (EU) 2016/680 of the European
Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of
personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution
of criminal offences or the execution of criminal penalties, and on the free movement of such data (“Directive
(EU) 2016/680”).
The Implementing Law does not reproduce the core provisions of the GDPR, such as the data processing
principles and legal grounds for data processing. Instead, the Bulgarian legislator has adopted the approach of
directly referring to the GDPR and introducing national rules complementary to the GDPR on matters that have
not been explicitly covered by the regulation, or where the GDPR has left room for the exercise of legislative
discretion.
The Implementing Law regulates, inter alia, the status and competences of local data protection authorities,
the accreditation and certification in the field of personal data protection and the available legal remedies in
case of violation of data protection legislations. Additional rules are also set with respect to certain specific data
processing circumstances reflecting the practice under the former data protection framework.
Here we highlight the most important provisions of the Implementing Law which are within the framework of, but
differ from, the GDPR1.
Rules on the activity of the Commission for Personal Data Protection and its administration2
List of processing operations requiring data protection impact assessment pursuant to Art. 35(4)
Regulation (EU) 2016/679
Guidelines on drafting and proposing a Code of Conduct in accordance with Art. 40 of Regulation
(EU) 2016/679
1 The provisions of the Implementing Law adopted for the purposes of transposing Directive (EU) 2016/680 into
national legislation fall outside the scope of this guide.
2 The Implementing Law envisages amendment of the Rules on the activity of the Commission for Personal
Data Protection (“Rules”) and its administration to further regulate the competences and responsibilities of
the CPDP under the GDPR. Currently, there is no publicly available information on the expected date for the
adoption of the amended Rules.
18
GDPR: Local Implementation in Central, Eastern & Southeastern Europe BULGARIA
NB: The Implementing Law envisages the adoption of secondary legislation to provide more detailed regulation
on certain topics within the new data protection framework (e.g. requirements and procedure for granting
accreditation of certifying bodies). Currently, there is no publicly available information on when such secondary
legislation is to be expected.
Art 25o the protection of the independence of the judiciary and judicial proceedings
(25о) prevention, investigation, detection and prosecution of breaches of ethical codes in
regulated professions
the protection of the data subject or the rights and freedoms of others
the enforcement of civil claims
19
20
GDPR: Local Implementation in Central, Eastern & Southeastern Europe BULGARIA
21
22
GDPR: Local Implementation in Central, Eastern & Southeastern Europe BULGARIA
In February 2019, the CPDP imposed the first significant sanction for the violation of the GDPR in the amount of
BGN 53,000 (approx. EUR 26,000). The sanction was imposed on a mobile operator for violation of the principles of
processing of personal data, including the requirements for consent for data processing. A subscriber of the mobile
operator established that his subscription plan was transformed into a contract for prepaid services without his
knowledge or consent.
In its decision, the CPDP indicates that the high amount of the sanction is due to the repeated violations of data
protection rules committed by this particular mobile operator (including for the same infringement), for which the
CPDP has already sanctioned the latter several times.
23
24
CROATIA
25
The GDPR has been introduced into the Croatian legal system through the Law on Implementation of the General
Data Protection Regulation (Croatian: Zakon o provedbi Opće uredbe o zaštiti podataka; “ZPGDPR”).
The ZPGDPR primarily regulates the composition and powers of the Croatian regulator – being the Croatian
Personal Data Protection Agency (“AZOP”) and also provides for some specific provisions related to certain
types of data processing or processing of certain data categories (e.g., biometric data and video surveillance).
However, the Croatian legislator did not use many derogation possibilities provided under the GDPR, which is
why in most of the situations the provisions of GDPR will be directly applicable.
Besides, based on its authority as regulator given under Art. 35(4) GDPR, the AZOP established a list of processing
operations which are subject to the requirement of the performance of a data protection impact assessment (PIA).
Law on Implementation of the General Data Protection Regulation (Croatian: Zakon o provedbi
Opće uredbe o zaštiti podataka), Official Gazette of the Republic of Croatia, No. 42/18
Abb.: ZPGDPR
Decision of a list of processing operations which are subject to the requirement of a data
protection impact assessment, rendered by the regulator based on its authority given under Art
35(4) GDPR (so called Black-List)
Croatian Personal Data Protection Agency (Croatian: Agencija za zaštitu osobnih podataka)
Abb.: AZOP
26
GDPR: Local Implementation in Central, Eastern & Southeastern Europe CROATIA
Art. 23
Art. 89(2)
Art. 89(3)
Are there provisions that allow for the processing of data for secondary purposes (i.e. exceptions to the principle of
purpose limitation in the case of a legal basis for processing)?
Art. 6(4) N/A No
Is there any change to the age of consent for children?
Art. 8 Art. 19 No
Processing of data of minors residing in Croatia in relation to information society is lawful
only if the child is at least 16 years old.
Are there additional obligations, conditions, or exemptions in connection with privacy impact assessments?
Art. 35(10) N/A No
See only Black-List (link above).
Are there any further obligations, conditions, or exemptions in connection with data processing by a processor?
Art. 28(3) N/A No
Art. 28(4)
Art. 29
Art. 32(4)
Are there any additional obligations when to appoint a data protection officer?
Art. 37(4) N/A No
27
28
GDPR: Local Implementation in Central, Eastern & Southeastern Europe CROATIA
29
30
CZECH
REPUBLIC
31
On 12 March 2019, the Czech Republic approved a legislation incorporating the provisions of the GDPR. The
Chamber of Deputies approved the final version of the bill Data Processing Act (DPA) repealing the previous Act
No. 101/2000 Coll., on Personal Data Protection, that was partly inapplicable from the day the GDPR came into
force (25 May 2018).
Here, we highlight the most important provisions of the Czech DPA that differ from the GDPR (for instance, age
of child consent, possibilities for restricting data subjects’ rights in matters of public interest and regarding the
enforcement of private claims, possibility of informing data subjects online when data processing is based on law
and in the public interest.
1.1 Law
Bill amending certain acts in relation to the Act on Personal Data Processing / Návrh zákona,
kterým se mění některé zákony v souvislosti s přijetím zákona o zpracování osobních údajů
Abb.: Amending Act
Act No. 101/2000 Coll., on Personal Data Protection / Zákon o ochraně osobních údajů
Abb.: Former DPA
Non-binding draft of a list of personal data processing operations that are not subject to a
privacy impact assessment issued by the Czech Office for Personal Data Protection (so called
“White-List”) / Návrh seznamu operací zpracování osobních údajů, která nepodléhají posouzení
vlivu na ochranu osobních údajů
Abb.: DPIA White-List
32
GDPR: Local Implementation in Central, Eastern & Southeastern Europe CZECH REPUBLIC
Apart from the regulations under the GDPR, are there any further obligations, conditions, or exemptions from data
subject rights?
Art. 17(1) Section 5 The Controller may process the data if it is necessary to:
Art. 17(3) comply with legal obligations to which the controller is subject
Art. 22(2) perform a task carried out in the public interest or in the exercise of official authority
Art. 23 vested in the controller
Art. 89(2) Section 9 The obligation to inform about corrections, limitations or erasure of personal data may be
fulfilled by updating the initial records that are available to the data subject.
Art. 89(3)
Section 11 The obligations of the controller/processor (set out in Art. 5 and Art. 12-22 GDPR) shall be
applied proportionately or postponed when necessary and adequate to prevent a serious
threat to protected objections2 defined in Section §6(2) DPA. The controller will have to
notify the Authority about the above without undue delay and provide adequate extent
information under Art. 23(2) GDPR.
2 Protected objection under Section 6(2) DPA means particularly defense/security of the Czech Republic;
public order, internal security; prevention, investigation, detection of criminal activities, prosecution of criminal
offences or enforcement of criminal penalties; other public interest objective of the EU/Member State (such
as monetary, fiscal, tax, public health and social security); protection of judiciary independence and of judicial
proceedings; prevention, investigation, detection or prosecution of ethical rules violations of regulated
professions; or monitoring, inspection or regulatory functions linked, even occasionally, to the exercise of
official authority in the cases referred to in points above; protection of the rights and freedoms of a data subject
persons, or the enforcement of private claims.
33
34
GDPR: Local Implementation in Central, Eastern & Southeastern Europe CZECH REPUBLIC
3 Section 180 of the Act No. 40/2009 Coll., Criminal Code; Section 8(5) of the Act No. 418/2011 Coll., Legal
Persons Criminal Liability Act
35
There have been no significant fines so far. The largest GDPR fines imposed till date by the Czech Data Protection
Authority were approximately CZK 30,000 (EUR 1,100). One was for failing to secure contracts with client details and
the other was for GPS use in company cars.
36
37
HUNGARY
38
On 25 July 2018, the Act XXXVIII of 2018 on the amendment of the Act CXII of 2011 on the Right of Informational
Self-Determination and on Freedom of Information (“Hungarian DPA”) in connection with the data protection
reform of the European Union and the amendment of corresponding laws (in Hungarian: 2018. évi XXXVIII.
törvény az információs önrendelkezési jogról és az információszabadságról szóló 2011. évi CXII. törvénynek
az Európai Unió adatvédelmi reformjával összefüggő módosításáról, valamint más kapcsolódó törvények
módosításáról) (“Implementing Law”) was published in the Official Gazette to transpose and harmonise the
provisions of the GDPR into national law.
The Implementing Law regulates, inter alia, the status and competences of the local data protection authority
and the available legal remedies in case of violation of the data protection legislation. Additional rules are also
set with respect to certain specific data processing circumstances reflecting the practice under the former data
protection framework.
Besides the Implementing Law another important piece of legislation was promulgated on 11 April 2019.
The Act XXXIV. of 2019 on amendment of certain acts in connection with the execution of the data protection
reform of the European Union (in Hungarian: 2019. évi XXXIV. törvény az Európai Unió adatvédelmi reformjának
végrehajtása érdekében szükséges törvénymódosításokról) (“Execution Act”). It covers 86 sectorial regulations.1
Here, we highlight the most important provisions of the Implementing Law which are within the framework of but
differ from the GDPR.
Act XXXVIII of 2018 on the amendment of the Act CXII of 2011 on the Right of Informational Self-
Determination and on Freedom of Information in connection with the data protection reform of
the European Union and the amendment of corresponding laws
Act XXXIV. of 2019 on amendment of certain acts in connection with the execution of the data
protection reform of the European Union
List of processing operations requiring data protection impact assessment pursuant to Art. 35(4) of
Regulation (EU) 2016/679 (so called Black list)
1 The Execution Act will amend (enter into force on 26 April 2019), among others
• the Labour Code (Act I of 2012 on the Labour Code)
• the Act CXXXIII of 2005 on Security Services and the Activities of Private Investigators
• Act CXIX of 1995 on the Use of Name and Address Information Serving the Purposes of Research and
Direct Marketing
• ACT XLVII of 1997 on the Processing and Protection of Health – and Connected Personal Data
39
GDPR: Local Implementation in Central, Eastern & Southeastern Europe HUNGARY
40
Are there any additional obligations when to appoint a data protection officer?
Art. 37(4) Art. 25/M (2) The data protection officer should keep confidential any personal data, classified
and 25/N information, secrets protected by law and secrets obtained in the course of professional
activities.
Confidential information includes any data, fact or circumstance that an employer, data
controller or data processor is not required by law to make available to the public during
the term of their employment and after the termination thereof.
Are there additional obligations, conditions, or exemptions in connection with the transfer of data to a third country or
an international organisation?
Art. 49(1) Art. 13 (2) International data transfers may be carried out under international agreements specified
Art. 49(5) in Art. 96 GDPR (and Art. 61 of Directive 2016/680/EU) even in the absence of the
conditions set out in the DPA.
Are there additional limits on the transfer of specific categories of personal data to a third country or an international
organisation?
Art. 49(5) N/A No
In a nutshell, what are the local regulations in connection with the supervisory authority’s powers, due process and
remedies against actions and decisions of the local supervisory authority?
Art. 58 Chapter V The NAIH is an autonomous administrative agency and the central administrative body
and VI for the protection of personal data.
Art. 83(8)
(Sections
38 -61) It conducts inquiries, administrative proceedings and conducts data processing
authorization procedures. It can act upon notification and ex officio.
Furthermore, the NAIH enforces subjects to abide by the regulation and imposes fines
and conducts certification procedures in line with Art. 42 GDPR.
The NAIH publishes a report on its activities each year and presents this report to the
Parliament. It makes recommendations for new regulations and for the amendment
of legislations pertaining to the processing of personal data, to public information and
information of public interests, and expresses its opinion on bills covering the same
subject.
Does a body, organisation or association have the right to: (i) lodge a complaint with the supervisory authority,
(ii) sue for damages?
Does this apply independently of a data subject’s mandate, too? If so, which are these?
Art. 80(2) N/A Yes, but only on the data subject’s instructions.
Are there modifications regarding sanctions (including criminal offences) for breach?
Please explain, including amount of fines or imprisonment, etc.
Art. 84 Section 23 Data subjects are entitled to challenge the actions and acts of the data controller/
processor directly before the courts. The burden of proof to ascertain that data processing
is in compliance with the provisions of law or binding legislation of the European Union
lies with the data controller and/or the data processor.
41
GDPR: Local Implementation in Central, Eastern & Southeastern Europe HUNGARY
42
43
POLAND
44
Poland incorporated the provisions of the GDPR by introducing the new Personal Data Protection Act (The Act of
10 May 2018 on the protection of personal data) and simultaneously the Provisions Implementing the Personal
Data Protection Act (Act amending certain acts in connection with the application of the GDPR) – together as:
“Implementing Law”.
The new Personal Data Protection Act extends GDPR requirements in some points. The Provisions Implementing
the Personal Data Protection Act amended more than 160 sectoral acts, including banking, finance, insurance,
administration, culture and labour acts, in order to adjust the sectoral regulations to the GDPR.
Here, we highlight the most important provisions of the Implementing Law which are within the framework of, but
differ from, the GDPR. Outside of the scope of this Guide are provisions of the Implementing Law adopted for the
purposes of transposing Directive (EU) 2016/680 into national legislation.
Act amending certain acts in connection with the application of Regulation (EU) 2016/679 of the
European Parliament and of the Council of 27 April 2016 on the protection of individuals with
regard to the processing of personal data and on the free movement of such data and repealing
Directive 95/46/EC
Abb.: IDPA
The Polish Act of 14 December 2018 on personal data protection regarding processing of
personal data in connection with the prevention and combating of crime
Abb.: APDC
Various industry codes have been created that specify how data are to be protected. One
example is the health care sector, which describes how personal data contained within patients’
medical records may be shared in accordance with the GDPR.
45
GDPR: Local Implementation in Central, Eastern & Southeastern Europe POLAND
Apart from Art. 9 GDPR, are there any further conditions or limitations for processing special categories of personal data?
Art. 9(2) Art. 2 The DPA excludes the application of the GDPR provisions prohibiting the processing of
a, b, j; DPA special categories of personal data for activities relating to the editing, preparation, creation or
publication of press materials (as regulated by the Press Law Act) and literary or artistic activity.
Art. 9(4)
Art. 14 Under the APDC, special categories of personal data may be processed when:
APDC legislative provisions allow for their processing
such processing is necessary to protect the life or health of the data subject or another
person
such data has been made public by the data subject concerned
Are there any additional authorisations required for processing personal data relating to criminal convictions/offences?
Art. 10 Art. 1 The APDC authorizes the processing of personal data by competent authorities for the
APDC purposes of identifying, preventing, detecting and combating crimes (including threats to
public safety), as well as applying punishment orders and coercive measures involving
imprisonment.
Apart from Art. 13, 14 GDPR, are there any further obligations, conditions, or exemptions from information duties?
Art. 13 Art. 2 The notification requirements under Art. 13 and 14 GDPR are excluded for journalistic,
APDC literary or artistic activity and the notification requirements under Art. 13 GDPR are
Art. 14
excluded for academic statements.
Under certain circumstances, there are also exemptions from information duties in the
case of controllers carrying out public tasks.
Apart from the regulations under the GDPR, are there any further obligations, conditions, or exemptions from data
subject rights?
Art. 17(1) Art. 2 DPA Some data subject rights do not apply in relation to journalistic, literary, or artistic activity
and academic statements.
Art. 17(3)
The IDPA introduced a number of exemptions from data subjects’ rights, in particular:
Art. 22(2)
Art. 5 DPA The rights to rectification and restriction of processing are restricted with respect to the
Art. 23
archiving activities of the state archive network.
Art. 89(2)
Art. 11 IDPA The right of access, restriction of data processing and the notification obligations
Art. 89(3) regarding the rectification or erasure of personal data or restriction of data processing
apply only to the extent that they do not infringe the confidentiality obligation of an
attorney, attorney-at-law, notary in public, tax advisor, or sworn translator.
Art. 6, 7, The right to object to the processing of personal data does not apply in the case of
16, 35, 81 data obtained by an attorney or attorney-at-law while providing legal advice, a notary
IDPA in public while performing notarial acts, a tax advisor while rendering tax advice, or a
sworn translator while translating.
Are there provisions that allow for the processing of data for secondary purposes (i.e. exceptions to the principle of
purpose limitation in the case of a legal basis for processing)?
Art. 6(4) N/A No
Is there any change to the age of consent for children?
Art. 8 N/A No
Are there additional obligations, conditions, or exemptions in connection with privacy impact assessments?
Art. 35(10) N/A No
Are there any further obligations, conditions, or exemptions in connection with data processing by a processor?
Art. 28(3) N/A No
Art. 28(4)
Art. 29
Art. 32(4)
46
47
GDPR: Local Implementation in Central, Eastern & Southeastern Europe POLAND
The UODO issued the first decision imposing an administrative fine in the amount of PLN 943,000 (approx.
EUR 220,000) for the infringement of the information obligation stipulated in Art. 14 GDPR: A company processed
data from publicly available registers informing only approx. 680,000 individuals of which it had the email address.
The remaining over 6m data subjects were not informed even though their postal addresses were partially known.
The company claimed the exemption from the information duty due to disproportional effort (Art. 14(5)b GDPR). The
authority denied the application of the exemption in this case and the company announced it will appeal against the
decision.
This chapter was written by Peter Daszkowski, Agnieszka Nowak-Blaszczak and Monika Gaczkowska.
PETER DASZKOWSKI
Partner
48
49
ROMANIA
50
On 31 July 2018, Law no. 190/2018 on the measures for the application of the GDPR entered into force.
Law no. 190/2018 brings in some more rules on processing special categories of data, as well as some
exemptions from the GDPR rules in case of certain categories of data processing. This law establishes the
measures necessary for the national implementation of the provisions of, inter alia, Art. 6(2), Art. 9(4), Art. 37-39,
42, 43, Art. 83(7), Art. 85 and Art. 87-89 GDPR.
Law no. 190/2018 on the measures for the application of Regulation (EU) 2016/679 of the
European Parliament and of the Council of 27 April 2016 on the protection of natural persons
with regard to the processing of personal data and on the free movement of such data, and
repealing Directive 95/46/EC (General Data Protection Regulation)
Abb.: Law 190/2018
Law no.102/2005 regarding the setting up, organisation and functioning of the National
Supervisory Authority for Personal Data Processing Law no. 129/2018 amending and
supplementing Law no. 102/2005 regarding the setting up, organisation and functioning of the
National Supervisory Authority for Personal Data Processing
Law no.506/2004 on the processing of personal data and the protection of privacy in the
electronic communications sector
Law no. 682/2001 on the ratification of the Convention on the protection of individuals with
regard to automatic processing of personal data, adopted in Strasbourg on 28 January 1981
Law no. 363/2018 on the protection of individuals with regard to the processing of personal data
by competent authorities for the purpose of prevention, detection, investigation, criminal
investigation and combating offences or the execution of sanctions, educational and safety
measures, and on the free movement of such data1
Decision of the National Supervisory Authority for Personal Data Processing no. 174/18.10.2018
regarding the list of operations for which the impact assessment on the protection of personal
data is mandatory (“Black List”)
Decision of the National Supervisory Authority for Personal Data Processing no. 161/09.10.2018
regarding the approval of the procedure of performing the investigations
1 The analysis of this law does not fall within the scope of this guide.
51
GDPR: Local Implementation in Central, Eastern & Southeastern Europe ROMANIA
The National Authority for the Supervision of Personal Data Processing / Romanian Data
Protection Authority
Abb.: NASPDP / RDPA
52
LAW
GDPR 190/2018 ROMANIAN IMPLEMENTATION
Are there provisions that allow for the processing of data for secondary purposes (i.e. exceptions to the principle of
purpose limitation in the case of a legal basis for processing)?
Art. 6(4) Art.8 Yes
The law allows for processing for secondary purposes, such as, for scientific or historical
research purposes, statistic purposes or public interest archiving purposes. In these
cases, the data controller has to apply appropriate safeguards to protect the rights and
freedoms of the data subjects, provided under Art. 89(1) GDPR.
Is there any change to the age of consent for children?
Art. 8 N/A No
The law does not provide for specific regulations regarding the age of consent in the
context of Art. 8 GDPR. Nonetheless, the Romanian Civil Code establishes that children
may perform judicial acts of small value or administration actions starting at the age
of 16. The assistance of the child’s legal representative is required in case of judicial acts
of higher values.
Therefore, the age of consent is 16 for the purpose of personal data processing in relation
to information society services.
Are there additional obligations, conditions, or exemptions in connection with privacy impact assessments?
Art. 35(10) N/A No
See only Romanian Black-List (link above).
Are there any further obligations, conditions, or exemptions in connection with data processing by a processor?
Art. 28(3) N/A No
Art. 28(4)
Art. 29
Art. 32(4)
Are there any further additional obligations when to appoint a data protection officer?
Art. 37(4) Art. 4 Yes
para 2, Additionally it is also necessary to appoint a data protection officer:
letter b)
for the processing of a national identification number;
Art. 6,
letter b) for the processing personal data and special categories of personal data in the context
of carrying out a task in public interest.
Are there additional obligations, conditions, or exemptions in connection with the transfer of data to a third country or
an international organisation?
Art. 49(1) N/A No
Art. 49(5)
Are there additional limits on the transfer of specific categories of personal data to a third country or an international
organisation?
Art. 49(5) N/A No
In a nutshell, what are the local regulations in connection with the supervisory authority’s powers, due process and
remedies against actions and decisions of the local supervisory authority?
Art. 58 Law The RDPA carries out its activities independently and impartially. It supervises and
102/2005 controls the legality of personal data processing which falls under the Law 190/2018 and
Art. 83(8)
the GDPR. For this purpose, the RDPA has specific prerogatives, such as:
Law
129/2018
RDPA
Decision
161/ 2018
53
GDPR: Local Implementation in Central, Eastern & Southeastern Europe ROMANIA
LAW
GDPR 190/2018 ROMANIAN IMPLEMENTATION
i.) It informs the controllers and processors about their obligations and duties in the area
of personal data protection.
ii.) It approves codes of conduct, receives and solves the complaints/request of the
data subjects and communicates the given solution or, according to each case, the
approaches carried out.
iii.) It performs investigations, deals with offences and imposes fines.
iv.) It provides consulting in the area of personal data protection.
v.) Law no. 102/2005 was completed by Law no. 129/2018 with new chapters, detailing
the control duties and procedures for resolving complaints by the authority and also
the relevant judicial remedies available in relation to data subjects and controllers/
processors.
vi.) The control personnel of the RDPA are now entitled to carry out investigations
(including unannounced ones) and to request and obtain any information and
documents (regardless of the storage support) from the data controller/processor or
their representatives.
vii.) Fines of up to EUR 300,000 may be imposed by the inspectors of the RDPA through
the minutes concluded on the field. Higher fines may also be imposed on the Decision
of the RDPA President.
Does a body, organisation or association have the right to: (i) lodge a complaint with the supervisory authority,
(ii) sue for damages?
Does this apply independently of a data subject’s mandate, too? If so, which are these?
Art. 80(2) N/A No
Are there modifications regarding sanctions (including criminal offences) for breach?
Please explain, including amount of fines or imprisonment, etc.
Art. 84 Art. 14 Yes
para 4
The law imposes significantly lower penalties or sanctions on public authorities compared
and 6
to companies.
The RDPA cannot apply fines higher than RON 200,000 (EUR 42,000 approximately) on
public authorities/institutions, religious units and non-governmental organisations acting
in the public interest, for failing to comply with the GDPR’s provisions or for failing to
implement remediation plans drafted by the RDPA.
Furthermore, the possibility to eliminate any data protection breaches within a grace
period of up to three months, based on a predetermined resolution plan is only provided
for public authorities/institutions, religious units and non-governmental organisations
acting in public interest.
Are there provisions to balance the protection of personal data with the rights to freedom of expression and information,
including processing for journalistic, academic, artistic, or literary purposes?
Art. 85 Art. 7 Yes
To ensure a balance between the right to personal data protection, the freedom of
expression and the right to information, data processing for journalistic purposes or for
academic, artistic or literary expression may be carried out, provided that it refers to
personal data that was expressly made public by the data subject or which is strictly
related to the quality of the public person of the data subject or the public character of the
facts that the person is involved in.
Are there specific rules regarding data processing relating to employment?
Art. 88 Art. 5 Yes
The law provides for specific rules regarding the processing of data relating to employment.
In cases where workplace monitoring systems through electronic communications
and/or video surveillance measures are used, the processing of personal data being
performed is based on the legitimate interest of the employer.
54
LAW
GDPR 190/2018 ROMANIAN IMPLEMENTATION
Prior to implementing any monitoring measures in the workplace, the employer must
make sure that other less intrusive methods have been tested and have not proven to
be efficient. This means an actual and documented attempt from the employer. Also,
employees’ representatives or the trade union must be consulted.
The duration for which personal data may be stored cannot exceed 30 days (unless
other legal grounds are applicable). The extension of the period should be documented
in advance.
Are there specific rules regarding the processing of personal data for scientific or historic research, statistical
purposes, big data operations, etc.?
Art. 89 N/A No
Any other relevant local law derogations to consider? (e.g. CCTV / video surveillance, provisions concerning the
admissibility of processing of national identification numbers)
Art. 87 N/A No
Are there any landmark decisions, material fines (including the underlying violation, eg violation of consent
requirements), sector-focused investigations (e.g. banks, telecoms, health care) under the new law (GDPR or local
DPA) to report so far?
No
55
56
SLOVAK
REPUBLIC
57
The Slovak data protection law is governed by the Act No. 18/2018 Coll. on Protection of Personal Data
(zákon o ochrane osobných údajov) (the “Data Protection Act” or “DPA”) which entered into force on
25 May 2018 implementing the GDPR and repealed the Act No. 122/2013 Coll. on Personal Data Protection, as
amended.
The Decree of the Office for Personal Data Protection no. 158/2018 Coll. on Data Protection
Impact Assessment Procedure / Vyhláška Úradu na ochranu osobných údajov SR č. 158/2018 Z. z.
o postupe pri posudzovaní vplyvu na ochranu osobných údajov
Abb.: Decree
Legal processing of personal data related to clinical testing / Zákonné spracúvanie osobných
údajov pri klinickom skúšaní
Guideline No. 2/2018 – legal basis of processing. Updated version as of 22 January 2019 /
Metodické usmernenie č. 2/2018 – Zákonnosť spracúvania. Aktualizovaná verzia zo dňa
22.01.2019
Frequently asked questions related to photography and audiovisual records / Často kladené
otázky k fotografiám a audiovizuálnym záznam
Statement of the Data Protection Office of the Slovak Republic related to delivery writings in an
administrative proceeding and administrative file inspection / Stanovisko ÚOOÚ SR k
doručovaniu písomností v správnom konaní a nazeranie do administratívneho spisu
Natural persons – entrepreneurs and legal persons standing from the data protection perspective /
Postavenie právnických osôb a fyzických osôb – podnikateľov z pohľadu ochrany osobných
údajov
58
GDPR: Local Implementation in Central, Eastern & Southeastern Europe SLOVAK REPUBLIC
Terms “Fundamental rights and freedoms” versus “rights and freedoms” – how to define them /
Pojmy “Základné práva a slobody” verzus “práva a slobody “ – a ako ich identifikovať
Guideline – when the regulation and when the act on data protection? / Metodika – Kedy
nariadenie a kedy zákon o ochrane osobných údajov?
Designation / K oznamovaniu určenia zodpovednej osoby a jej kontaktných údajov úradu podľa
novej právnej úpravy
Authorised person and instruction of authorised person under new legislation / Oprávnená
osoba a poučenie oprávnenej osoby podľa novej právnej úpravy
30 steps of the compliance with the new legislation on personal data protection / 30 krokov
súladu s novou právnou úpravou ochrany osobných údajov
Data Protection Office of the Slovak Republic / Úrad na ochranu osobných údajov Slovenskej
republiky
Abb.: DPO
Art. 9(2) § 16 Yes, there is an additional requirement. The consent to process sensitive data is void if
a, b, j; granting such consent is excluded by a separate regulation.
Art. 9(4) Processing is also permitted when;
It is necessary for the purposes of carrying out the obligations and exercising specific
rights of the controller or the data subject in the area of labour law, social law insurance,
social protection, or public health insurance; and
it is necessary for the purpose of social insurance, social security for police and
soldiers, and providing specific social benefits.
Are there any additional authorisations required for processing personal data relating to criminal convictions/offences?
Art. 10 § 17 Under the DPA only a state body may be a data controller for personal data relating to
criminal convictions/offences.
As regards criminal record background checks in an employment context, no official
opinion has been issued on this matter by the DPO.
Apart from Art 13, 14 GDPR, are there any further obligations, conditions, or exemptions from information duties?
Art. 13 § 19 No
Art. 14 § 20
59
Are there additional limits on the transfer of specific categories of personal data to a third country or an international
organisation?
Art. 49(5) N/A No
In a nutshell, what are the local regulations in connection with the supervisory authority’s powers, due process and
remedies against actions and decisions of the local supervisory authority?
Art. 58 § 80 Rights and obligations stated in the GDPR correspond with the provisions of the DPA.
Art. 83(8) § 99-103 Additionally, the DPO is authorized to invite the controller or processor to submit an
explanation of suspected breaches of the DPA, special regulation, or international law.
§ 104-106
The DPO’s scope of competence does not include contractual disputes between the
controller/processor and another person if the court and other bodies are competent
to hear and decide the dispute. The DPO may also charge an appropriate fee for
administrative costs or refuse to act on an application if it is manifestly unfounded,
inappropriate, or repetitive.
As regards the administrative sanctions, the DPA empowers the DPO to impose a fine
of up to EUR 2,000 on persons who are not the controller or processor for failure to
cooperate with the DPO. The DPO may also fine the controller or processor if it fails to
ensure adequate conditions for the exercise of DPO controls under the DPA.
60
GDPR: Local Implementation in Central, Eastern & Southeastern Europe SLOVAK REPUBLIC
61
62
SLOVENIA
63
Still to be implemented.
64
CONTACT INFORMATION
OUR OFFICES
ALBANIA POLAND
Murat Toptani Street ul. Mokotowska 49
AL - 1001 Tirana PL - 00-542 Warszawa
T. +355 4 227 45 21 T. +48 22 3788 900
E. [email protected] E. [email protected]
AUSTRIA ROMANIA
Schubertring 6 4 Vasile Alecsandri Street
A - 1010 Vienna RO - 010639 Bucharest
T. +43 1 515 10 T. +40 21 3088 100
E. [email protected] E. [email protected]
CROATIA SLOVENIA
Ivana Lučića 2a/19 Bleiweisova cesta 30
HR - 10 000 Zagreb SI - 1000 Ljubljana
T. +385 1 4925 400 T. +386 1 438 00 00
E. [email protected] E. [email protected]
HUNGARY
Kálvin tér 12-13
H - 1085 Budapest
T. +36 1 484 88 00
E. [email protected]
65
WOLF THEISS is one of the largest and most respected law
firms in Central, Eastern and Southeastern Europe (CEE/SEE).
We opened our first office in Vienna over 60 years ago.
Our team now brings together over 340 lawyers from a diverse
range of backgrounds, working in offices in 13 countries
throughout the CEE/SEE region. During that time, we have
worked on many cases that have broken new ground.
www.wolftheiss.com