Aktualni izzivi implementacije Splošne uredbe o varstvu podatkov pri izvajanju gospodarske dejavnosti

Gradišnik, Tina (author), Horvat, Mitja (mentor)

Od uveljavitve Splošne uredbe o varstvu podatkov sta minili že več kot dve leti, pri čemer se zdi, da je zanimanje za aktualno stanje na področju varstva osebnih podatkov strmo upadlo. V predmetnem magistrskem delu se na podlagi analize trenutne normativne urejenosti področja in posebnih institutov, ki so bili uveljavljeni s Splošno uredbo o varstvu podatkov, skuša ovrednotiti aktualno stanje varstva osebnih podatkov v okviru izvajanja gospodarske dejavnosti. Uvodoma je na kratko predstavljeno ozadje in sam namen vzpostavitve strožjega režima varstva osebnih podatkov v evropskem prostoru ter kronološki pregled obravnavane tematike. Aktualni izzivi gospodarskih subjektov so povezani predvsem z dejstvom, da je Slovenija edina država članica Evropske unije, ki v času priprave predmetnega magistrskega dela še vedno ni sprejela nove zakonodaje ali pa prilagodila obstoječe zakonodaje zahtevam Splošne uredbe o varstvu podatkov. V posledici tega je v Sloveniji nastala pravna praznina, ki predstavlja podlago za kar nekaj aktualnih izzivov, ki pestijo gospodarske subjekte. Gre predvsem za vprašanja povezana s sprejemom in uveljavitvijo ZVOP-2, identifikacijo in uporabo veljavne zakonodaje do takrat in vplive, ki jih bo uveljavitev ZVOP-2 potencialno prinesla gospodarskim subjektom. Hkrati so predstavljeni izzivi povezani z Oceno učinka v zvezi z varstvom osebnih podatkov, Kodeksi ravnanja in certificiranjem, Uradnim obvestilom nadzornemu organu o kršitvi varnosti osebnih podatkov in imenovanjem pooblaščene osebe za varstvo osebnih podatkov. Posebej je obravnavana nepristojnost slovenskega nadzornega organa Informacijskega pooblaščenca za prekrškovno ukrepanje, ki bo mogoče šele po ustrezni vzpostavitvi pravne podlage v zakonodaji Slovenije (ZVOP-2). Obravnavana problematika je v zaključku primerjana z ugotovitvami iz Letnega poročila Informacijskega pooblaščenca za leto 2019 in Sporočila Komisije Evropskemu parlamentu in Svetu z dne 24. 06. 2020, ki obravnavane izzive za gospodarske subjekte potrjujejo.

• Language: Slovenian
• Keywords: varstvo osebnih podatkov, gospodarska dejavnost, GDPR, ZVOP-2, ocena učinka, pooblaščena oseba za varstvo podatkov, informacijski pooblaščenec, uradno obvestilo, upravne globe, poročilo Komisije
• Work type: Master's thesis/paper
• Organization: PF - Faculty of Law
• Year: 2020
• PID: 20.500.12556/RUL-122374
• COBISS.SI-ID: 45021187
• Publication date in RUL: 05.12.2020

Secondary language

• Language: English
• Title: The Current Challenges of Incorporating the General Data Protection Regulation into Economic Activity

Abstract

More than two years have passed since the implementation of the General Data Protection Regulation and it seems that interest in the general state of affairs in the area of personal data protection has sharply declined. This master's thesis aims to evaluate the state of personal data protection in the area of performing commercial activities, analysing the current normative situation of the area and the dedicated regulations that were implemented along with the General Data Protection Regulation. The introduction briefly presents the background and purpose of imposing stricter regulations in personal data protection in Europe and a chronological overview of the subject matter. The current challenges faced by business entities pertain primarily to the fact that Slovenia is the sole EU member state, which, as of the writing of this thesis, has still not adopted new legislation or amended existing legislation to the requirements of the General Data Protection Regulation. As a consequence, Slovenia is facing a legal void, which is the basis for a number of current challenges that business entities are faced with. The challenges in question are mainly connected with passing and enforcing ZVOP-2 (Personal Data Protection Act), identifying and implementing current legislation until that moment and the effects that implementing ZVOP-2 could potentially have on business entities. The thesis simultaneously presents the challenges associated with the Data protection impact assessment, Codes of conduct and certification, formal authorisation to supervisory bodies on personal data security violations and Designation of the data protection officer. Special focus is placed on the lack of jurisdiction of the Slovenian supervisory body of the Information Commissioner to act in cases of misdemeanours, which will only be possible after Slovenia adopts the appropriate legal bases (ZVOP-2). In the end, the discussed issues are compared to the findings in the Annual Report 2019 of the Information Commissioner and the Communication from the Commission to the European Parliament and the Council on 24 June 2020, which confirm the discussed issues facing business entities.

• Keywords: personal data protection, economic activity, GDPR, ZVOP-2, Data protection impact assessment, Data protection officer, Information Commissioner, formal authorisation, administrative fines, Commission report