GDPR

Applicable Domain

The Regulation applies to any processing of personal data by any organization:

1. If the controlling or processing organization is located in the EU.
2. If the organization is not in the EU, but the processing involves personal data of data subjects located in the EU and is related to commercial offers or behaviour monitoring.

The scope therefore includes non-EU companies, which was not the case with the older legislation.

Roles

The regulation distinguishes two main types of entities:

• Data controller: any entity that determines the purposes and means of processing personal data, alone or jointly. As a general rule, each organization is a controller for its own data.
• Data processor: any entity that processes data on behalf of a data controller.

Personal Data

GDPR provides a broad definition of personal data: any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly,by their name, emails, phone numbers, biometric information, location data, financial data, etc. Online identifiers (IP addresses, device IDs, …) are also in the scope.

This also applies in business contexts: info@clinica-vasculara.ro is not considered personal, but dan.stoica@clinica-vasculara.ro is, because it can be used to identify an individual within a company.

The GDPR also requires a higher level of protection for sensitive data, which includes specific categories of personal data such as health, genetic, racial or religious information.

Data Processing Principles

To be compliant, processing activities must comply with the following rules:

(all listed in Article 5 of the GDPR)

1. Lawfulness, fairness and transparency: to collect data you must have a legal basis, a clear purpose, and you must inform the data subject:
   
   • Have a simple and clear privacy policy and refer to it wherever you collect data;
   • Check the legal basis for each of your data processing activities.
2. Purpose limitation: once collected for one purpose, ask for permission if you want to use it for another purpose.
   e.g. – You cannot decide to sell your customer data if it has not been collected for that purpose.
3. Minimization: you should only collect data that is necessary for your purpose.
4. Accuracy: reasonable steps should be taken to ensure that the data are kept up to date, according to the purpose for which they are intended;
   e.g. – Asigurați-vă că gestionați e-mailurile respinse și corectați sau ștergeți adresele.
5. Limiting storage: personal data should be kept only as long as necessary to fulfill its main purpose.
   Define time limits for erasure or review of the personal data you process, depending on the purpose of the data.
6. Integrity and Confidentiality: Data Processors must implement appropriate access control, security and data loss prevention measures in accordance with the types and extent of data being processed.
   e.g. – Make sure your backup system works, have adequate security controls, use encryption to protect sensitive data such as passwords, …
7. Accountability: data controllers are accountable and must be able to demonstrate compliance with all the above processing principles.
   
   • Establish and maintain a data mapping baseline for your organization that describes the compliance of your processing activities;
   • Inform your customers with a clear privacy policy.

Legal Basis

To be lawful under the GDPR (first principle), the processing of personal data must be based on one of the six possible legal bases, as set out in Article 6 (1):

1. Consent: It is valid when the data subject has given his or her consent explicitly and freely after having been duly informed, including with a clear and specific purpose. The burden of proof for all these lies with the controller.
2. Necessary for the performance of a contract, or to fulfill requests from the data subject in preparation of a contract.
3. Compliance with a legal obligation imposed on the controller.
4. Protecting a vital interest. When processing is necessary to save a life.
5. Public interest or official authority.
6. Legitimate Interest. Applicable when the controller has a legitimate interest that is not overridden by the interests and fundamental rights of the data subject.

A major change brought by the GDPR compared to previous data privacy regulations are the stricter requirements for obtaining valid consent.

Data Subject Rights

Existing data privacy rights for individuals are further extended by GDPR. Organizations must be prepared to handle requests from data subjects in a timely manner (within 1 month), free of charge:

1. Right of access – Individuals have the right to know what and how their personal data is processed, in full transparency.
2. Right to rectification – Individuals have the right to have their personal data corrected or completed.
3. Right to erasure – Individuals have the right to have their personal data deleted for legitimate reasons (consent withdrawn, no longer necessary for the purpose, etc.).
4. Right to restriction – Individuals may request the controller to stop processing their personal data if they do not wish or are unable to request complete erasure.
5. Right to object – Individuals have the right to object at any time to certain processing of their personal data, for example for direct marketing purposes.
6. Data Portability – Individuals have the right to request that personal data held by a controller be provided to them, or to another controller.