EU General Data Protection Regulation

EU General Data Protection Regulation

1. Chapter I - General Provisions

   • Article 1 - Subject Matter & Objectives
     • 2. Protects fundamental rights of and freedoms of natural persons and their right to protection of personal data
     • 1. Lays down rules regarding processing of personal data and free movement of personal data
     • 3. Free movement of personal data within EU not restricted or prohibited by data protection
   • Article 2 - Material Scope
     • 1. Applies to proessing of personal data by
       • By automated means
         • Wholly
         • Partly
       • By non-automated means forming (or intended to) part of filing system
     • 2. Exempt Activities
       • a. Activities outside scope of EU law
       • c. Activities within scope of Common Foreign and Security Policy
       • d. Natural person in personal or household activity
       • e. Competent Authorities involved in crime prevention, investigation, detection or prosecution, execution of criminal penalties and prevention of threats to public security
       • 2a. EU processing of personal data covered by Regulation 45/2001 which will be apated to the principles and reuls of this REgualtion per Articce 90a.
       • 3. Without prejudice to Diorective 2000/31/EC which governs electronic Commerce especially liasbilities of intermediary service providers
         • Article 12: Mere Conduit
         • Article 13: Caching
         • Article 14: Hosting
         • Article 15: No general obligation to monitor
   • Article 3 - Territorial Scope
     • Applies to
       • 1. Processing of personal data as part of activities of controller/processor established in EU
       • 2. Processing of personal data fo subjects in EU by controller/processor not established in EU, where
         • a. Goods/services offered to subjects in EU, regardless of whether payment is required
         • b. Monitoring of their behaviour within EU
       • 3. Processing of personal data by a controller not established in EU, but in a place where law of a member State applies
   • Article 4 - Definitions
     • 1. Personal data
     • 2.
     • 3. Processing
       • 3a. Restriction of Processing
       • 3b. Pseudonymisation
     • 4. Filing System
     • 5. Controller
     • 6. Processor
     • 7. Recipient
       • 7a. Third party
     • 8. Data Subject's Consent
     • 9. Personal data breach
     • 10. Genetic data
     • 11. Biometric data
     • 12. Data concerning health
       • 12a.
     • 13. Main establishment
       • a. Place of central administration or where decisions on processing personal data are made and implements where Controller has >1 EU establishments
       • b. Place of central administration or where main processing takes place where Processor has >1 EU establishments
     • 14. Representative
     • 15. Enterprise
     • 16. Group of undertakings
     • 17. Binding corporate rules
     • 18.
     • 19. Supervisory authority
       • 19a. Supervisory authority concenrned
         • c. Complaint lodged to that Supervisory Authority
         • b. Data subjects of Member State are or likely to be substantially affected
         • a. Controller/Processor established on EU Member State's territory
       • 19b. Cross-border processing of personal data
         • a. Processing by Controller/Processor taking place in and established in > 1 Member State
         • b. Data subjects of >1 Member State are or likely to be substantially affected by processing in establishment in 1 Member State
       • 19c. Relevant and reasoned objection
     • 20. Information Society service
     • 21. International organisation

Bilder und Dateien der Mindmap