Weboldalunk használatával jóváhagyja a cookie-k használatát a Cookie-kkal kapcsolatos irányelv értelmében.

Cookie süti tájékoztató: KATT IDE

Menu

DATA PROCESSING POLICY

DATA PROCESSING POLICY

The Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred as ”Regulation”) provides that the controller shall take appropriate measures to provide any information and any communication relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language and that the controller shall facilitate the exercise of data subject rights.

The obligation to provide prior information is stipulated by the Act CXII of 2011 on information self-determination and freedom of information, as well.

The information whereby we fulfil this legal obligation is provided below.

The information shall be published on the company’s website or  sent to the data subject on the request of the latter.

CHAPTER I- INFORMATION ABOUT THE CONTROLLER

The publisher of this information, at the same time the controller:

Company name: BIONIKA Medline Kft.

Headquarter: 3516 Miskolc, Tégla utca 29.

Company registration number: 05-09-005354

Tax number: 11443915-2-05

Representative: József Hajdú

Telephone number: +36 (20) 9583-629

E-mail address: info@bionika.hu

Website: www.bionika.hu

Webshop: www.implantshop.hu

(hereinafter referred to as: ”the Company”)

Personal data are known only to those employees who, related to the relevant data processing objectives,  have a right to access and those entities or persons who carry out data processing activities under a service contract, to the extent which is determined by the Company and which is necessary for them to carry out their activities.(hereinafter referred to as: ”the Company”)

CHAPTER II-INFORMATION ABOUT THE PROCESSORS

‘Processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller; (Article 4 (8) of the Regulation)

The use of a Processor does not require the prior consent of the data subject but informing them is necessary. Accordingly, we provide the following information:

1. The IT Service Provider of the Company

Our Company uses a data processor to manage and maintain its website which provides IT services (hosting services) and, in the framework of this contract, keeps the personal data provided on the website. Its operation is to store personal information on the server.

These Processors are the following:

Company name: MAXER Hosting Kft.

Headquarter: 9024 Győr, Répce utca 24. 1. em. 3.

Company registration number: 08-09-013763

Tax number: 13670452-2-08

Representative: Péter Nyers

Telephone number: +36 (1) 257-9913

E-mail address: iroda@maxer.hu

Website: www.maxer.hu

 

2. Postal service, delivery

These providers receive the necessary personal data (name, address, telephone number of the data subject) which they use to deliver the ordered product.

These service providers are the following:

Company name: GLS General Logistics Systems Hungary Kft.

Headquarter: 2351 Alsónémedi, GLS Európa u. 2.

Company registration number: 13-09-111755

Tax number: 12369410-2-44

Representative: Back Rico Ralph Hermann

Telephone number: +36 (29) 886-670

E-mail address: info@gls-hungary.com

Website: www.gls-group.eu


Company name: Magyar Posta Zrt.

Headquarter: 1138 Budapest, Dunavirág utca 2-6.

Company registration number: 01-10-042463

Tax number: 10901232-2-44

Representative: Zoltán Illés

Telephone number: +36 (1) 767-8272

E-mail address: uzleti.ugyfelszolgalat@posta.hu

Website: www.posta.hu


Company name: UPS Magyarország Kft.

Headquarter: 2220 Vecsés, Lőrinci út 154. Airport City Logistic Park. G. ép.

Company registration number: 13-09-139285

Tax number: 22776082-2-13

Telephone number: +36 1 877 0000

E-mail address: upshungary@ups.com

Website: https://www.ups.com/hu/en/Home.page


3. Recording customer data

Our Company uses a Processor to record customer data.

This service provider is the following:


Company name:
ShopRenter.hu Kereskedelmi és Szolgáltató Korlátolt Felelősségű Társaság

Headquarter: 4028 Debrecen, Kassai út 129.

Company registration number: 09-09-020636

Tax number: 23174108-2-09

Representative: Tamás Szivák, Csaba Zajdó

Telephone number: +36 (1) 234-5012

E-mail address: info@shoprenter.hu

Website: www.shoprenter.hu

 

4. E-mail service

Our company uses a Processor to manage e-mails. Within this framework, the processor manages the personal data related to e-mails.

This service provider is the following:

 

Company name: Microsoft Magyarország Számítástechnikai Szolgáltató és Kereskedelmi Korlátolt Felelősségű Társaság

Headquarter: 1031 Budapest, Graphisoft Park 3.

Company registration number: 01-09-262313

Tax number: 10836653-2-44

Representative: Bábel Gabriella, Benjamin Orndorff, Christopher Mark Mattheisen, Csanak Gabriella

Telephone number: +36 (1) 437-2800

Website: www.microsoft.com


Company name: ShopRenter.hu Kereskedelmi és Szolgáltató Korlátolt Felelősségű Társaság

Headquarter: 4028 Debrecen, Kassai út 129.

Company registration number: 09-09-020636

Tax number: 23174108-2-09

Representative: Tamás Szivák, Csaba Zajdó

Telephone number: +36 (1) 234-5012

E-mail address: info@shoprenter.hu

Website: www.shoprenter.hu

 

CHAPTER III - INSURENCE OF LEGALITY OF DATA MANAGEMENT

 

1. Data management based on the consent of the data subject

  1. If the Company intends to carry out data management based on consent, the consent of the data subject for handling their personal data shall be requested by the content and information contained in the data request form specified in the data management rules.

 

  1. A consent shall also be deemed to be given if the data subject checks a relevant box when viewing the Company’s website, makes technical adjustments when using information society services, and any other statement or action which, in that context, clearly indicates the consent of the data subject to the intended treatment of their personal data. Silence, the pre-checked box or non-action is therefore not a consent.
  2. Consent may cover all data management activities for the same purpose or purposes. If data management serves multiple purposes at the same time, the consent shall be given for all data management purposes.
  3. If the data subject's consent is given in the context of a written declaration which also concerns other matters – such as the conclusion of a sales contract or a service contract - the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of the Regulation shall not be binding.
  4. The Company may not make the conclusion of a contract subject to a requirement that the data subject gives their consent to manage such personal data which are not necessary for the performance of the contract.
  5. The data subject has the right to withdraw his or her consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.
  6. If the personal data has been recorded with the consent of the data subject, the controller may, unless otherwise provided by law, handle the data recorded to fulfill its legal obligation without further consent or after the withdrawal of the consent, as well.

2. Data management based on the fulfillment of a legal obligation

  1. In the case of data processing based on a legal obligation, the provisions of the applicable law govern the scope of manageable data, the purpose of processing, the length of data storage and the recipients.
  2. Data management based on the fulfillment of a legal obligation is independent of the consent of the data subject as processing is  required by the law. In this case, the data subject is to be informed beforehand that processing is mandatory and the data subject is to be clearly and thoroughly informed beforehand of all facts related to processing, in particular the objective and the legal basis of processing,  the person entitled to processing, the length of processing, the fact that the processor processes the personal data of the data subject in order to fulfill a legal duty and who may know the data. The information should also include the rights and remedies available to the data subject. In the case of mandatory processing, the information may also be given by disclosing the reference to the legal provisions containing the abovementioned information.

3. Facilitating the rights of the data subject

The Company is required to ensure in all its data processing activities the exercise of the rights of the data subject.

CHAPTER IV – USER DATA MANAGEMENT ON THE WEBSITE OF THE COMPANY – INFORMATION ABOUT THE USE OF COOKIES

1.The visitor of the website shall be informed about the application of cookies, and their approval shall be asked for this.

2. General information on the cookies:

2.1. A cookie is a piece of data that the visited website sends to the visitor’s browser (in a variable name-value format) to store it and later the same website can also reload its content. A cookie may have a validity period, it can be valid until the browser is closed, but also for an unlimited period. Later on, the browser will send this data to the server upon all HTTP(S) request. Thereby it modifies the data on the user’s computer.

2.2. The essence of a cookie is that by the nature of website services there is a need for users to be identified (e.g. that they entered the webpage) and to manage them accordingly. Its danger lies in that the users are not always aware of it and it may be suitable for the operator or other service provider whose content is embedded in the webpage ( e.g. facebook, google Analytics, AdWords) to track the user, thus resulting in a profile and in this case the content of the cookie can be considered personal data.

2.3. Types of cookies:

2.3.1. Technically indispensable session cookies: without which the webpage would not function properly, these are necessary to identify the user ( e.g. to manage whether they logged in, what they put into the shopping cart, etc.) This is typically the storage of a session-ID, other data are stored on the server which is thereby safer. This has got a safety aspect, if the value of the session cookie is not generated properly, there is a risk of session-hijacking thus it is essential for these values to be properly generated. Other terminologies call each cookies session cookies that are deleted when exiting the browser (a session is a use of the browser from start to exit)

2.3.2. Usage Promoting Cookies: Those cookies are called as such which store the choices of the user, e.g. in what format the user wishes to visit the website. These types of cookies mean the settings data that are stored in the cookie.

2.3.3. Cookies ensuring performance: Althought they do not have much to do with ”performance”, usually those cookies are called as such which collect information of the behaviour, usage time and clicks of the user on the visited website.  These are typically the applications of a third party (e.g. Google Analytics, AdWords or Yandex.ru cookies). These are suitable for profiling the visitor.

For information on Google Analytics cookies, see:

https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage

For information on AdWords cookies, see:

https://support.google.com/adwords/answer/2407785?hl=hu

For information on Facebook pixel, see:

https://en-gb.facebook.com/business/help/742478679120153?id=1205376682832142

2.4. Accepting, authorising using cookies is not compulsory. You can restore the settings of your browser for it to reject all cookies or to indicate that the system is currently sending a cookie. Although most browsers have a default setting to automatically accept cookies, this can usually be modified in order to prevent automatic acceptance and to offer the possibility of choice each time.

For information on the cookie settings of the most popular browsers, see the following links:

  • Google Chrome: https://support.google.com/chrome/answer/95647?co=GENIE.Platform%3DAndroid&hl=hu
  • Firefox: https://support.mozilla.org/hu/kb/sutik-engedelyezese-es-tiltasa-amit-weboldak-haszn
  • Microsoft Internet Explorer 11: http://windows.microsoft.com/hu-hu/internet-explorer/delete-manage-cookies#ie=ie-11
  • Microsoft Internet Explorer 10: http://windows.microsoft.com/hu-hu/internet-explorer/delete-manage-cookies#ie=ie-10-win-7
  • Microsoft Internet Explorer 9: http://windows.microsoft.com/hu-hu/internet-explorer/delete-manage-cookies#ie=ie-9
  • Microsoft Internet Explorer 8: http://windows.microsoft.com/hu-hu/internet-explorer/delete-manage-cookies#ie=ie-8
  • Microsoft Edge: http://windows.microsoft.com/hu-hu/windows-10/edge-privacy-faq
  • Safari: https://support.apple.com/hu-hu/HT201265

Above all, however, it should be highlighted that certain website functions or website supplies will not function properly without cookies.

3. Information about the cookies used on the website of the Company:

3.1. The set of data managed by the cookies: The website of the Company, throught the use of the webpage records and processes the following data about the visitor and the device used to browsing:

  • the IP address used by the visitor,
  • the type of the browser,
  • the characteristics of the operating system of the device used to browsing (chosen language),
  • the time of the visiting,
  • the visited (sub)page, function or service,
  • click.

3.2. Cookies used on the website

3.2.1. Technically indispensable session cookies

The aim of processing: Ensuring the proper functioning of the website. These cookies are needed for the visitors to browse the website, smoothly and fully use its functions and the services available on the website, including in particular to memorise the visitor’s operations on the website. In the case of these cookies, the length of processing covers only the current visit of the visitor. This type of cookies is automatically deleted from their computer at the end of the action and after closing the browser.

The set of data managed: AVChatUserId, JSESSIONID, portal_referer.

The legal basis of this processing is the paragraph (3) of the Article 13/A of the Act CVIII of 2001 on certain issues of electronic commerce activities and information society services the service provider may – for the purpose of providing the service – process personal data indispensable for providing the service for technical reasons. Should other conditions be identical, the service provider shall select and operate the means applied in the course of providing information society service at all times, so that personal data be processed only if it is absolutely indispensable for providing the service or achieving other objectives stipulated in this Act, and only to the required extent and duration.

3.2.1. Usage Promoting Cookies:

They cookies store the choices of the user, e.g. in what format the user wishes to visit the website. These types of cookies mean the settings data that are stored in the cookie.

The legal basis of processing is the consent of the visitor.

The aim of processing: Increasing the efficiency of the service, increasing the user experience, making the use of the website more convenient.

3.2.2. Cookies ensuring performance:

They collect information of the behaviour, usage time and clicks of the user on the visited website.  These are typically the applications of a third party (e.g. Google Analytics, AdWords).

The legal basis of processing: the consent of the data subject.

The aim of processing: Analysising website, sending advertising offers.

CHAPTER V- PROVIDING INFORMATION ABOUT THE RIGHTS OF THE DATA SUBJECT

I. The rights of the data subject in short:

  1. Transparent information, communication and the promotion of the practising of the rights of the data subject
  2. The right for prior information – if the personal data are collected from the data subject
  3. Providing information to the data subject and the information to be available, if personal data have not been obtained from them
  4. Right of access by the data subject
  5. Right to rectification
  6. Right to erasure (‘right to be forgotten’)
  7. Right to restriction of processing
  8. Notification obligation regarding rectification or erasure of personal data or restriction of processing
  9. Right to data portability
  10. Right to object
  11. Automated individual decision-making, including profiling
  12. Restrictions
  13. Communication of a personal data breach to the data subject
  14. Right to lodge a complaint with a supervisory authority (right to official remedy)
  15. Right to an effective judicial remedy against a supervisory authority
  16. Right to an effective judicial remedy against a controller or processor

II. The rights of the data subject in detail:

1. Transparent information, communication and the promotion of the practising of the rights of the data subject

1.1. The controller shall take appropriate measures to provide any information relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means.

1.2. The controller shall facilitate the exercise of data subject rights.

1.3. The controller shall provide information on action taken on a request to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary under the conditions laid down in the Regulation, and the controller shall inform the data subject of any such extension.

1.4. If the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

1.5. Any information and any communication and any actions taken shall be provided free of charge, however, a fee may be charged in the cases written in the Regulation. 
The detailed rules can be found in Article 12 of the Regulation.

2. The right for prior information – if the personal data are collected from the data subject

2.1.The data subject shall be entitled to receive information prior to the start of the data handling regarding the facts and information connected to the data handling. In the framework of this, the data subject must be informed of:the identity and the contact details of the controller and, where applicable, of the controller's representative;

  1. the contact details of the data protection officer (where applicable);
  2. the purposes of the processing for which the personal data are intended, as well as the legal basis for the processing;
  3. where the processing is based on legitimate interest, the legitimate interests pursued by the controller or by a third party;
  4. the recipients or categories of recipients of the personal data, if any;
  5. where applicable, the fact that the controller intends to transfer the personal data to a third country or to an international organisation

2.2.For the purpose of ensuring a fair and transparent processing, the controller must inform the data subject about the following supplementary information:the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;

  1. the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;
  2. where the processing is based on the consent of the data subject, the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
  3. the right to lodge a complaint with a supervisory authority;
  4. whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data;
  5. the existence of automated decision-making, including profiling, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject;

2.3. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information

The detailed rules of the right for prior information is included in Article 13 of the Regulation.

3. Providing information to the data subject and the information to be available, if personal data have not been obtained from the data subject

3.1.If the controller does not acquire the personal data from the data subject, the data subject must be informed by the controller within a reasonable period after obtaining the personal data, but at the latest within one month; if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject; or if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed about the facts and information written in Section 2 above, as well as about the categories of the personal data, and further of the sources of the data and in given cases about whether the data originate from publicly accessible sources.

3.2. The contents of Section 2 above (The right for prior information) are applicable to further rules.

The detailed rules of the providing of this information are contained in Article 14 of the Regulation.

4.Right of access by the data subject

4.1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the related information contained in Sections 2 and 3 (Article 15 of the Regulation).

4.2.Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.

4.3.The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs.

The detailed rules related to the rights of the person concerned related to access rights are included in Article 15 of the Regulation.

5. Right to rectification

5.1.The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her.

5.2.Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

These rules are contained in Article 16 of the Regulation.

6. Right to erasure (‘right to be forgotten’)

6.1.The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

  1. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  2. the data subject withdraws consent on which the processing is based and there is no other legal ground for the processing;
  3. the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
  4. the personal data have been unlawfully processed;
  5. the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
  6. the personal data have been collected in relation to the offer of information society services directly to a child.

6.2. The right for deletion may not be enforced if processing is necessary

  1. for exercising the right of freedom of expression and information;
  2. for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
  3. for reasons of public interest in the area of public health;
  4. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in so far as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
  5. for the establishment, exercise or defence of legal claims.

The detailed rules related to the right for deletion are contained in Article 17 of the Regulation.

7. Right to restriction of processing

7.1. Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the the data subject’s consent or for the estbalishment, exercise or defence of legal claims, or for protectionof the rights of another natural and legal person or for reasons of important public interest of the European Union or of a Member State.

7.2.   The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:

  1. the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
  2. the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
  3. the controller no longer needs the personal data for the purposes of processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
  4. the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.

7.3. A data subject who has obtained restriction of processing shall be informed by the controller before the restriction of processing is lifted.

The relevant rules are contained in Article 18 of the Regulation.

8. Notification obligation regarding rectification or erasure of personal data or restriction of processing

The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.

These rules can be found in Article 19 of the Regulation.

9. Right to data portability

9.1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

  1. the processing is based on consent or on a contract; and
  2. the processing is carried out by automated means.

9.2. The data subject shall have the right to have the personal data transmitted directly from one controller to another.

9.3.The exercise of the right to data portability shall be without prejudice to Article 17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. This right shall not adversely affect the rights and freedoms of others.

The detailed rules are included in Article 20 of the Regulation.

10. Right to object

10.1. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6 (1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

10.2.   Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

10.3. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

10.4. At the latest at the time of the first communication with the data subject, these rights shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.

10.5. The data subject may exercise his or her right to object by automated means using technical specifications.

10.6.   Where personal data are processed for scientific or historical research purposes or statistical purposes, the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

The detailed rules are included in Article 21 of the Regulation.

11. Automated individual decision-making, including profiling

11.1. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

11.2. This right shall not apply if the decision:

  1. is necessary for entering into, or performance of, a contract between the data subject and a data controller;
  2. is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or
  3. is based on the data subject's explicit consent.

11.3. In the cases referred to in points (a) and (c), the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

Further rules are contained in Article 22 of the Regulation.

12. Restrictions

Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights ( Articles 12 to 22 and Article 34, as well as Article 5) in so far as its provisions correspond the essential content of basic rights and freedoms.

The conditions of this limitation are included in Article 23 of the Regulation.

13. Communication of a personal data breach to the data subject

13.1.   When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.

13.2. The communication to the data subject shall describe in clear and plain language the nature of the personal data breach and contain at least the followings:

  1. the name and contact details of the data protection officer or other contact point where more information can be obtained;
  2. describe the likely consequences of the personal data breach;
  3. describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

13.2. The communication to the data subject shall not be required if any of the following conditions are met:

  1. the controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption;
  2. the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects is no longer likely to materialise;
  3. it would involve disproportionate effort. In such a case, there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner.

Further rules are contained in Article 34 of the Regulation.

14. Right to lodge a complaint with a supervisory authority (right to official remedy)

14.1. The data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes the Regulation.

14.2. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy.

These rules are contained in Article 77 of the Regulation.

15. Right to an effective judicial remedy against a supervisory authority

15.1.Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.

15.2.Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to an effective judicial remedy where the supervisory authority does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged.

15.3.Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.

15.4.Where proceedings are brought against a decision of a supervisory authority which was preceded by an opinion or a decision of the Board in the consistency mechanism, the supervisory authority shall forward that opinion or decision to the court.

These rules are contained in Article 78 of the Regulation.

16. Right to an effective judicial remedy against a controller or processor

16.1.Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under the Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with the Regulation.

16.2.   Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.

These rules are contained in Article 79 of the Regulation.

 

Miskolc, 23 July 2020.