Regulation on the Protection of Personal Data of Centrum Patachich
Chapter I: GENERAL PROVISIONS
Article 1 – Purpose and Scope of Application
(1) The purpose of this regulation is to protect the fundamental rights and freedoms of individuals, particularly with regard to the processing of personal data, by establishing rules on the processing and free movement of such data.
(2) This regulation has been drafted in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council (“General Data Protection Regulation” – GDPR), taking into account the general principles applicable to civil society organizations, as well as the provisions that came into force on May 25, 2018.
(3) The regulation applies to all organizational units operating within Centrum Patachich and aims to ensure the respect of rights related to personal data during both automated and non-automated processing, insofar as such data are part of a record system or intended to be included in such a system.
Article 2 – Legal Definitions
For the purposes of this regulation, the following definitions apply:
“Personal data”: any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to a name, an identification number, location data, an online identifier, or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
“Controller”: the organizational unit within Centrum Patachich which, alone or jointly with others, determines the purposes and means of processing personal data.
“Processor”: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
“Processing”: any operation or set of operations which is performed on personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
“Supervisory authority”: in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP), an independent authority operating under Article 51 of the GDPR.
“Restriction of processing”: the marking of stored personal data with the aim of limiting their future processing.
“Filing system”: any structured set of personal data which are accessible according to specific criteria.
“Third party”: a natural or legal person, public authority, agency or body other than the data subject, controller, processor, or persons authorized to process data under the direct authority of the controller or processor.
“Data subject’s consent”: any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.
Article 3 – Principles
In processing personal data, the following principles shall be observed:
Lawfulness, fairness and transparency: processing must be lawful, fair and transparent to the data subject.
Purpose limitation: personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
Data minimization: processing must be adequate, relevant and limited to what is necessary in relation to the purposes for which data are processed.
Accuracy: reasonable steps must be taken to ensure that personal data are accurate and, where necessary, kept up to date.
Storage limitation: personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
Integrity and confidentiality: appropriate technical and organizational measures must be taken to ensure security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage.
Accountability: Centrum Patachich shall be responsible for, and be able to demonstrate compliance with, the data protection principles.
Chapter II: RIGHTS OF DATA SUBJECTS
Article 4 – Right to Information
(1) When Centrum Patachich collects data from the data subject, it is obliged to provide clear and transparent information about the following:
the identity and contact details of the data controller,
the purpose of data collection,
the intended use of personal data,
the recipients of the data, if any,
the storage period of the data,
the data subject’s rights, including the right of access, rectification, erasure, restriction of processing, objection, and the right to lodge a complaint with the supervisory authority.
(2) The information must be written in a clear and understandable language, taking into account any specific needs of the data subjects.
(3) If personal data are not collected directly from the data subject, information must still be provided regarding the source and context of data collection.
Article 5 – Right of Access to Personal Data
(1) The data subject has the right to obtain confirmation as to whether or not personal data concerning them are being processed and, if so, to gain access to such data and information about the processing.
(2) Upon request, the controller shall:
provide a copy of the personal data being processed,
indicate the purpose of processing,
inform the data subject of their rights in relation to the processing.
Article 6 – Right to Rectification
The data subject may request that Centrum Patachich rectify inaccurate personal data or complete incomplete data concerning them.
Article 7 – Right to Restriction of Processing
(1) The data subject may request the restriction of processing of their personal data in the following cases:
they contest the accuracy of the data,
the processing is unlawful but they oppose erasure,
the controller no longer needs the data but the data subject requires them for the establishment, exercise or defense of legal claims,
they have objected to processing, and the verification of overriding legitimate grounds is pending.
(2) During the restriction period, personal data may only be stored and not processed in any other way without the data subject’s consent.
Article 8 – Right to Erasure (“Right to be Forgotten”)
(1) The data subject has the right to request that Centrum Patachich erase personal data concerning them without undue delay in the following situations:
the data are no longer necessary for the purposes for which they were collected,
the data subject has withdrawn their consent, and there is no other legal basis for the processing,
the data have been unlawfully processed,
there is a legal obligation to erase the data.
(2) In cases of processing for scientific, historical or statistical purposes, the right to erasure may be limited.
Article 9 – Right to Data Portability
The data subject has the right to receive the personal data concerning them in a structured, commonly used and machine-readable format and to request the transfer of those data to another controller.
Article 10 – Right to Object
The data subject has the right to object to the processing of their personal data when the legal basis for processing is the legitimate interest of the controller or of a third party.
Article 11 – Consent and Withdrawal of Consent
(1) The processing of personal data is generally based on the freely given and unambiguous consent of the data subject.
(2) The data subject has the right to withdraw their consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Chapter III: INTERNAL STRUCTURES FOR DATA PROTECTION
Article 12 – Coordination Committee for Personal Data Protection
(1) Within Centrum Patachich, a committee is established to coordinate activities related to the protection of personal data (hereinafter referred to as the “Committee”).
(2) The Committee acts on behalf of Centrum Patachich in the field of data protection, in accordance with its own internal regulations.
(3) To effectively carry out its work, the Committee may, if necessary, set up an operational body.
(4) The Committee consists of three members appointed and nominated by the leadership or membership of Centrum Patachich.
(5) The Committee is chaired by a president who represents it in relations with authorities, organizations, third parties, and any other natural or legal persons.
(6) In the event of a vacancy on the Committee, a new member must be appointed within no more than 6 months from the date of the vacancy.
(7) The transfer of personal data to third parties may only take place after verifying compliance with the conditions set forth in the legislation.
Article 13 – Data Protection Officer
(1) Centrum Patachich appoints a Data Protection Officer (DPO) responsible for overseeing the processing of personal data and ensuring compliance with the applicable rules.
(2) The appointed person must have appropriate expertise in the field of data protection and an understanding of the specific characteristics of civil society organizations.
(3) The DPO acts on behalf of Centrum Patachich, maintains contact with the national data protection authority, and provides internal data protection advice.
(4) In carrying out their duties, the DPO must ensure full confidentiality, maintain independence, and avoid any conflict of interest.
(5) The DPO’s duties include, in particular:
supervising and monitoring data processing activities,
promoting compliance with data protection rules,
assessing and managing data protection risks,
ensuring the rights of data subjects,
maintaining contact with the supervisory authority,
training employees on data protection.
(6) The DPO reports directly to the Presidency of Centrum Patachich.
(7) The DPO is entitled to delegate certain tasks to designated data protection advisors within the various organizational units, in accordance with established policies.
Article 14 – Controllers and Processors
(1) Each organizational unit within Centrum Patachich that processes personal data acts as a controller or processor in accordance with the applicable legislation and the provisions of this regulation.
(2) Controllers are required to keep records of the data processing operations they perform.
(3) Data processing by processors is based on a written contract that includes all the mandatory elements required by the GDPR.
(4) Responsibility for the processing of personal data must be clearly defined between the controller and the processor.
Article 15 – Transfer of Personal Data to Third Parties
(1) The transfer of personal data to third parties may take place only lawfully, with proper information provided to the data subject and with strict compliance with data protection requirements.
(2) The Committee is responsible for approving data transfer requests in accordance with internal regulations and applicable legislation.
Chapter IV: FINAL PROVISIONS
Article 16 – Methodology for Implementing the Regulation and National and/or European Legislation
(1) Centrum Patachich shall take all necessary organizational, technical and administrative measures to ensure compliance with this regulation as well as with applicable national and European data protection legislation, with particular attention to:
developing and applying internal regulations,
training controllers and processors,
respecting the rights of data subjects,
fulfilling obligations related to the protection of personal data.
(2) Methodological provisions, internal regulations and procedures are mandatory for all organizational units and employees of Centrum Patachich and are continuously updated to reflect changes in legislation.
Article 17 – Entry into Force of the Regulation
This regulation shall enter into force on the date of its publication on the official website of Centrum Patachich and shall be binding from that date for all organizational units, members, and employees of the organization.
Signature
Drawn up at:
Böcskei László
President of the Patachich Association