|
What
Needs to be Done Prior to Collection
Contact the data subject
Contact the CNPD
Article 10 Right to
information
1 – The controller or his
representative shall provide a data subject from whom data relating
to himself
is collected with the following information, except
where he already has it:
(a) the identity of the controller and
of his representative, if any;
(b) the purposes of the processing;
(c) other information such as:
The recipients or categories of
recipients;
Whether replies are obligatory or
voluntary, as well as the possible consequences of failure to reply;
The existence and conditions of the
right of access and the right to rectify, provided they are
necessary, taking account of the specific circumstances of
collection of the data in order to guarantee the data subject that
they will be processed fairly.
2 – The documents supporting the
collection of personal data shall contain the information set down
in the previous number.
3 – If the data
is not collected from the data subject and except where
he already has it, the controller or his representative must provide
the data subject with the information set down in 1 at the time of
undertaking the recording of data or, if a disclosure to third
parties is envisaged, no later than the time the data
is first disclosed.
4 – If data
is collected on open networks the data subject shall be
informed, except where he is already aware of it, that personal data
relating to him may be circulated on the network without security
measures and may be at risk of being seen and used by
unauthorised third parties.
5 – The obligation to provide
information may be waived by a legal provision or decision of the
CNPD on the grounds of State security and criminal prevention or
investigation and also in particular for processing for statistical
purposes or for the purposes of historical or scientific research,
when the provision of such information proves impossible or would
involve a disproportionate effort or if recording or disclosure is
expressly laid down by law.
6 – The obligation to provide
information under this Article shall not apply to the processing of
data carried out solely for journalistic purposes or the purpose of
artistic or literary expression.
Contact the CNPD
Notification - Article 27
Obligation to notify the CNPD
1 – The controller or his
representative, if any, must notify the CNPD before carrying out any
wholly or partly automatic processing operation or set of such
operations intended to serve a single purpose or several related
purposes.
2 – The CNPD may
authorize
the simplification of or exemption from notification for particular
categories of processing which are unlikely, taking account of the
data to be processed, to affect adversely the rights and freedoms of
the data subjects and to take account of criteria of speed, economy
and efficiency.
3 – The authorization,
which must be published in the Diário da República , must
specify the purposes of the processing, the data or category of data
to be processed, the category or categories of data subjects, the
recipients or categories of recipients to whom the data may be
disclosed and the length of time the data are to be stored.
4 – Processing whose sole purpose is
the keeping of a register which according to laws or regulations is
intended to provide information to the public and which is open to
consultation by the public in general or by any person demonstrating
a legitimate interest shall be exempted from notification.
5 – The non-automatic processing of
the personal data provided for in Article 7 (1) shall be subject to
notification when they are processed under 3 (a) of that Article.
|
