Who must appoint a personal data protection officer?
Under Article 33, a public institution, insurance organization, commercial bank, microfinance organization, credit bureau, electronic communications company, airline, airport and medical institution must appoint an officer; so must any controller processing the data of a large number of subjects or carrying out systematic, large-scale monitoring of their behavior. Other controllers may do so voluntarily.
What information must be recorded about processing?
Under Article 28, the record covers the identity and contacts of the controller and related parties, the purposes of processing, the categories of subjects and data, categories of recipients, international transfers and safeguards, storage periods, a description of security measures, and incidents. Upon request this material is submitted to the State Audit Office no later than 3 working days after the request.
Can the officer's function be outsourced?
Yes. Under point 3 of Article 33, the officer's function may be performed by an employee or by another person under a service contract, provided no conflict of interest arises. Several entities may also appoint a common officer.
What is protection by design?
Under Article 26, when creating a new product or service the controller must adopt technical and organizational measures — pseudonymization included — so that only the data necessary for the purpose is processed automatically and an indefinite circle of persons has automatic access only to minimal data before an alternative approach is chosen.
Within what period is the State Audit Office notified of an officer's appointment?
Within 10 working days of appointing, designating or replacing the officer, the controller must communicate the officer's identity and contact details to the State Audit Office, which publishes this information; the same details are proactively published on the organization's own website.
