Data Protection

THE CONTROLLER’S DUTY TO PROVIDE INFORMATION  

Dear citizens,
in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), as amended (hereinafter referred to as the ‘GDPR’), we would like to inform you about how the City of Příbram processes your personal data.

THE CONTROLLER OF YOUR PERSONAL DATA IS:

The Town of Příbram
, Tyršova 108, 261 01 Příbram I
, Company Registration Number: 00243132
, Email: e-podatelna@pribram.eu
, Data Box ID for the Town of Příbram: 2ebbrqu

DATA PROTECTION OFFICER:

As a public authority, we are required to appoint a Data Protection Officer to assist us in protecting your personal data. Our Data Protection Officer is:

Keystone Company a.s.
Ing. Radek Vrňák
Prague 10, Vinohrady, Korunní 2569/108
Company registration number: 05983649
Email: poverenec@pribram.eu

What is the role of the Data Protection Officer?

You may contact the DPO with any queries, suggestions or requests to exercise your rights relating directly to your personal data used in connection with a particular matter

The Data Protection Officer will professionally assess your enquiries, requests and suggestions, forward them to the data controller along with recommendations on how to address them, or provide you with basic information and advice. They are bound by a duty of confidentiality and maintain confidentiality even regarding complaints. However, the controller alone is responsible for handling your enquiries, suggestions, objections and requests.

TERMS

• Data subject – a natural person to whom personal data relates
• Personal data – any information relating to an identified or identifiable natural person.
• An identifiable natural person is a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person
• Sensitive data – a special category of personal data – personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, and data concerning a natural person’s health or sex life or sexual orientation
• Personal data processor – any entity which, on the basis of a specific law or on the instructions of the controller, processes personal data on behalf of the controller. This primarily refers to organisations that manage information systems.
• Purpose of personal data processing – an activity, process or action for which it is necessary or appropriate to process the data subject’s personal data.
• Legal basis for the processing of personal data – the lawfulness of the processing of personal data. The data processor processes only the personal data of data subjects for whom it has been authorised by a specific legal provision, or on the basis of a voluntary contractual agreement, in its legitimate interest, in the exercise of official authority or in the performance of a task carried out in the public interest, or on the basis of the data subject’s free and informed consent.
• Sources of personal data – a natural person or legal entity, public authority, agency or other body from which personal data is obtained.
• Recipient of personal data – a natural person or legal entity, public authority, agency or other body to whom personal data are disclosed.
• Processing of personal data – any operation or set of operations performed on personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment or combination, restriction, erasure or destruction

 
PURPOSES OF PROCESSING FOR WHICH PERSONAL DATA ARE INTENDED AND THE LEGAL BASIS FOR PROCESSING

The City of Příbram acts as the data controller (hereinafter referred to as the ‘CONTROLLER’). Personal data obtained from the data subject (hereinafter referred to as the “citizen”) is processed for the purpose of fulfilling legal obligations, for the purpose of performing a contract, or on the grounds of a legitimate interest.

The CONTROLLER maintains, in both paper and electronic form, an Overview of the individual purposes for which personal data are intended and the legal basis for processing.

POTENTIAL RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA

The CONTROLLER maintains, in both paper and electronic form, an overview of the individual categories of recipients of personal data, identifying other personal data controllers to whom personal data may be transferred.

THE CONTROLLER’S INTENTION, IF ANY, TO TRANSFER PERSONAL DATA TO A THIRD COUNTRY OR AN INTERNATIONAL ORGANISATION

Where there is a legal basis for transferring personal data to a third country or an international organisation, the data subject will always be informed of this intention. All personal data must be protected against misuse.

THE PERIOD FOR WHICH PERSONAL DATA WILL BE STORED

The CONTROLLER maintains a record, in both paper and electronic form, of the individual time limits for which personal data will be stored by the controller.

Where it is not possible to determine the period for which personal data will be stored by the controller in accordance with Act No. 499/2004 Coll., the Act on Archiving and Records Management and on Amendments to Certain Acts, the criteria used to determine this period will be communicated to the data subject.

FURTHER INFORMATION FOR THE DATA SUBJECT:

The data subject has the right to request from the controller access to personal data relating to the data subject.  The point of contact for citizens to whom the personal data relates (i.e. data subjects) is the Data Protection Officer. Data subjects may contact the Data Protection Officer regarding all matters relating to the processing of their personal data and the exercise of their rights under the Regulation.

RIGHT TO RECTIFICATION, RESTRICTION AND ERASURE OF PERSONAL DATA

The data subject has the right to request that the controller rectify, restrict or erase their data. The data subject has the right to erasure of data if there is no other legal basis for the processing of personal data or if the data subject withdraws the informed explicit consent on the basis of which data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, and data concerning a natural person’s health or sex life or sexual orientation.

INFORMATION ON THE POSSIBLE CONSEQUENCES OF FAILING TO PROVIDE SUCH DATA

Where the provision of personal data is a statutory or contractual requirement, or a requirement that must be included in a contract, or where the data subject is obliged to provide personal data, the data subject shall be informed by the controller of the possible consequences of failing to provide such data.

FURTHER PROCESSING OF DATA FOR A DIFFERENT PURPOSE

Where the controller intends to further process personal data for a purpose other than that for which it was collected, the controller shall provide the data subject, prior to such further processing, with information regarding that other purpose and the relevant further information set out in the preceding points.

The above provisions concerning the provision of information to the data subject by the controller shall not apply if the data subject already has the information in question, and to the extent that they have it.

INFORMATION TO BE PROVIDED WHERE PERSONAL DATA HAVE NOT BEEN OBTAINED FROM THE DATA SUBJECT

Where personal data have not been obtained from the data subject, the CONTROLLER shall provide the data subject with the following information:

1. the identity and contact details of any other controller and, where applicable, their representative;
2. where applicable, the contact details of any data protection officer;
3. the purposes of the processing for which the personal data are intended and the legal basis for the processing;
4. the categories of personal data concerned;
5. any recipients or categories of recipients of the personal data.

INFORMATION ON THE SOURCE OF PERSONAL DATA

Where the CONTROLLER obtains information about the data subject from sources other than directly from the data subject, the CONTROLLER shall always provide information on the source from which the personal data originates and, where applicable, information as to whether the data originates from publicly available sources.

TIME LIMIT FOR PROVIDING INFORMATION

The Controller shall provide the information referred to in the preceding two paragraphs within a reasonable period of time after obtaining the personal data, but no later than one month, taking into account the specific circumstances in which the personal data are processed, or at the latest at the time of the first communication with the data subject,if the personal data is to be used for the purposes of such communication, or at the latest upon the first disclosure of the personal data, if the controller intends to disclose it to another recipient.

If the controller intends to further process personal data for a purpose other than that for which it was collected, it shall provide the data subject, prior to such further processing, with information regarding that other purpose and the relevant further information referred to in the first paragraph.

1. the identity and contact details of the other controller and, where applicable, their representative;
2. where applicable, the contact details of any data protection officer;
3. the purposes of the processing for which the personal data are intended and the legal basis for the processing;
4. the categories of personal data concerned;
5. any recipients or categories of recipients of the personal data;

 
where applicable, the controller’s intention to transfer personal data to a recipient in a third country or to an international organisation, and the existence or absence of a Commission decision on adequate protection or, in the case of transfers referred to in Articles 46 or 47 or in the second subparagraph of Article 49(1) of the Regulation.

This obligation to provide information does not apply where the data subject already has the information in question, or where it is demonstrated that providing such information is not possible or would require disproportionate effort. This applies in particular where processing is carried out for archiving purposes in the public interest, for the purposes of scientific or historical research, or for statistical or similar purposes, or where the data have been pseudonymised. Another exception to the obligation to provide information is where personal data must remain confidential in view of an obligation of professional secrecy governed by Union or Member State law.

THE DATA SUBJECT’S RIGHT OF ACCESS TO PERSONAL DATA

A data subject has the right to obtain confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, has the right to access such personal data and the following information:

1. the purposes of the processing;
2. the categories of personal data concerned;
3. the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
4. the envisaged period for which the personal data will be stored, or, if this cannot be determined, the criteria used to determine that period;
5. the existence of the right to request from the controller the rectification or erasure of personal data relating to them, or the restriction of their processing, or to object to such processing;
6. the right to lodge a complaint with a supervisory authority;
7. any available information on the source of the personal data, where it has not been obtained from the data subject;
8. the fact that automated decision-making, including profiling, takes place, where the CONTROLLER carries out such processing, and, in such cases, meaningful information regarding the procedure used, as well as the significance and anticipated consequences of such processing for the individual.

 
Where personal data are transferred to a third country or an international organisation, the data subject has the right to be informed of the appropriate safeguards relating to the transfer.

The CONTROLLER shall provide a copy of the personal data being processed. For any further copies requested by the data subject, the CONTROLLER may charge a reasonable fee based on administrative costs. Where the data subject submits a request in electronic form, the information shall be provided in a commonly used electronic form, unless the data subject requests otherwise.

The right to obtain a copy of the personal data being processed must not adversely affect the rights and freedoms of others.

RIGHT TO RECTIFICATION

A data subject has the right to have the CONTROLLER rectify, without undue delay, any inaccurate personal data concerning them. Taking into account the purposes of the processing, a data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

RIGHT TO ERASURE (‘RIGHT TO BE FORGOTTEN’)

A citizen has the right to have the CONTROLLER erase personal data relating to them without undue delay, and the CONTROLLER is obliged to erase the citizen’s personal data without undue delay if one of the following grounds applies:

1. the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
2. the data subject withdraws the consent on the basis of which the data were processed in accordance with Article 6(1)(a) or Article 9(2)(a), and there is no other legal basis for the processing;
3. the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
4. the personal data have been processed unlawfully;
5. the personal data must be erased in order to comply with a legal obligation under Union or Member State law to which the controller is subject;
6. the personal data were collected in connection with the provision of information society services as referred to in Article 8(1).

 
Where the CONTROLLER has made the personal data public and is obliged to erase it, it shall, taking into account the state of the art and the cost of implementation, take reasonable steps, including technical measures, to inform other controllers processing that personal data that the data subject requests them to erase any links to, or copies or replicas of, that personal data.

The erasure of a data subject’s personal data may not take place if the processing is necessary:

1. for the exercise of the right to freedom of expression and information;
2. for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
3. on grounds of public interest in the area of public health in accordance with Article 9(2)(h) and (i) and Article 9(3);
4. for archiving purposes in the public interest, for the purposes of scientific or historical research or for statistical purposes in accordance with Article 89(1), where the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the purposes of such processing;
5. for the establishment, exercise or defence of legal claims.

RIGHT TO RESTRICTION OF PROCESSING

A data subject has the right to have the CONTROLLER restrict processing in any of the following cases:

1. the data subject contests the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data;
2. the processing is unlawful and the data subject opposes the erasure of the personal data and requests, instead, that its use be restricted;
3. the controller no longer requires the personal data for the purposes of the processing, but the data subject requires it for the establishment, exercise or defence of legal claims;
4. the data subject has objected to the processing pursuant to Article 21(1), pending verification of whether the controller’s legitimate grounds override those of the data subject.
 

Where processing has been restricted in accordance with paragraph 1, such personal data, apart from storage, may only be processed:

1. with the consent of the data subject, or for the purpose of establishing,
2. exercising or defending legal claims,
3. for the purpose of protecting the rights of another natural or legal person
, 4. for reasons of an important public interest of the Union or of a Member State.
 

A data subject who has obtained a restriction of processing pursuant to paragraph 1 shall be notified in advance that the restriction of processing is to be lifted.

NOTIFICATION OBLIGATION REGARDING THE RECTIFICATION OR ERASURE OF PERSONAL DATA OR THE RESTRICTION OF PROCESSING

The CONTROLLER shall notify each recipient to whom the personal data have been disclosed of any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18, unless this proves impossible or involves a disproportionate effort. The controller shall inform the data subject of these recipients if the data subject so requests.

RIGHT TO DATA PORTABILITY

A data subject has the right to receive the personal data concerning him or her, which he or she has provided to the controller, in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller without hindrance from the controller to whom the personal data have been provided, , provided that: a) the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a), or on a contract pursuant to Article 6(1)(b); and b) the processing is carried out by automated means.

When exercising their right to data portability (as set out in the previous paragraph), a data subject has the right to have their personal data transmitted directly from one controller to another, where technically feasible.

The right to data portability must not adversely affect the rights and freedoms of others.

Restrictions on the right to data portability:

1. where the processing of data is necessary for the performance of a task carried out in the public interest;
2. the exercise of official authority vested in the CONTROLLER (on the basis of the authority’s statutory powers);
3. where the rights and freedoms of other persons would be adversely affected.

RIGHT TO OBJECT

A data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them on the basis of Article 6(1)(e) or (f) of the Regulation, including profiling based on those provisions. The data controller shall no longer process the data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

AUTOMATED INDIVIDUAL DECISION-MAKING, INCLUDING PROFILING

Within the scope of the activities carried out by the CONTROLLER, there is no automated decision-making or profiling that has legal effects on the data subject or significantly affects them in a similar manner.

UNJUSTIFIED REQUESTS BY DATA SUBJECTS AND THEIR RESOLUTION

The right to information is not absolute. The right to information must not infringe upon another person’s data protection rights. Furthermore, the Regulation also addresses unreasonable and repetitive requests in which the data subject seeks the provision of information.

Article 12 of the Regulation governs the time limits, the form and the principle that information on measures taken in response to requests by data subjects exercising their rights (Articles 15 to 22 of the Regulation) must be provided free of charge.

The Regulation states in Article 12(5), second sentence:

Where requests made by a data subject are manifestly unfounded or excessive, in particular because they are repetitive, the controller may either:

1. charge a reasonable fee taking into account the administrative costs associated with providing the requested information or communication, or with carrying out the requested actions; or
2. refuse to comply with the request.”

It is for the CONTROLLER to demonstrate that a request is manifestly unfounded or excessive. This therefore provides a direct regulatory basis for refusing a request (refusing to take action in accordance with the request) on the grounds of manifest unfoundedness or excessiveness. The unreasonableness of a request relates to the criterion of proportionality, as one of the fundamental principles of personal data protection.

The principle of proportionality is a means of resolving situations where there is a conflict between two or more subjective rights protected by objective law. Such a situation is assessed by giving priority to the right that protects the most important value, whilst imposing only the minimum necessary restriction on the other competing rights, so as to maintain proportionality, that is, a balance between the individual rights that are in conflict.

The CONTROLLER is therefore entitled to refuse to comply with a request. 

Where a request is refused, the CONTROLLER must, in cooperation with the Data Protection Officer, draw up a brief statement of reasons and send the data subject a document stating that the request has been refused, stating the reasons for the refusal, and that the data subject has the right to lodge a complaint with the supervisory authority, namely the Office for Personal Data Protection, and to bring the matter before a court.

WHAT SHOULD YOU DO IF YOU BELIEVE WE ARE NOT PROCESSING YOUR PERSONAL DATA CORRECTLY?

In such a case, you may contact our Data Protection Officer or you have the right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection, with its registered office at: Pplk. Sochora 27, 170 00 Prague 7, telephone: +420 234 665 111 (switchboard), fax: +420 234 665 444, Electronic mailroom (processes notifications received at the Office’s email address) Email: posta@uoou.cz; Data box: qkbaa2n, website: https://www.uoou.cz

HOW TO SUBMIT A REQUEST?

The CONTROLLER accepts requests for information both in paper form and in electronic form.

Verification of the applicant’s identity forms part of the request acceptance process. This verification is necessary to protect the applicant’s personal data against unauthorised access to such personal information.

Methods of identity verification:

1. Receipt via a data box from the data
subject’s data box 2. Receipt via the e-registry, where the submission is signed with a valid qualified electronic signature
3. Verification of identity at the Příbram
City Registry Office 4. The application is signed with a certified signature (by a public authority or notary)