Term bank

The controller has an obligation to demonstrate that its operations comply with the GDPR. Accountability requires the controller to evaluate how the principles of data protection are being implemented in its day-to-day operations.

Additional information: Demonstrate your compliance with data protection regulations | Data Protection Ombudsman’s Office

All processing of personal data requires a legal basis. This basis must be defined before the start of processing. The General Data Protection Regulation provides for six bases on which the processing of personal data is permitted: the consent of the data subject, the performance of a contract, the controller’s legal obligation, the protection of vital interests, the performance of a task carried out in the public interest or in the exercise of official authority, and the legitimate interest of the controller or a third party.

Additional information:
When is the processing of personal data permitted? | Data Protection Ombudsman’s Office

The controller is the party who determines the purposes and means of processing personal data. In hobbies, the controller can be the club or association.

A Data Protection Officer (DPO) is an internal expert who monitors the processing of personal data and helps your personnel comply with data protection regulations. The DPO also serves as the contact person for data subjects in matters related to the processing of personal data and cooperates with the Office of the Data Protection Ombudsman.

Additional information: Data protection officers | Data Protection Ombudsman’s Office

The person whose personal data is being processed and who can be identified either directly or indirectly based on some of that data. In hobbies, for example club members, club employees and the custodians of underage club members can all be data subjects.

The processing of personal data is provided for in the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data). The GDPR applies to the processing of personal data wholly or partly by automated means and to the non-automatic processing personal data which form or are intended to form a register or part of a register. The obligations laid down in the GDPR must be taken into account when personal data is processed in the context of hobbies.

The impact assessment is a process for assessing the effects of the planned processing on data protection and individual freedoms. In other words, an impact assessment identifies, assesses and seeks to manage the risks involved in the processing of personal data. The controller is required to conduct a data protection impact assessment if the intended processing is likely to cause a high risk. However, an impact assessment can be made even when not required by the GDPR.

Additional information: Impact assessments | Data Protection Ombudsman’s Office

The controller is required to provide all information concerning the processing of personal data to the data subjects in a concise, transparent, intelligible and clear form. This information is often provided in a privacy statement that tells the data subjects what they need to know about the processing of personal data and the rights of the data subject.

Additional information: Inform data subjects about processing | Data Protection Ombudsman’s Office

If at least two controllers together determine the purposes and means of processing personal data, they are joint controllers. In such cases, the controllers’ responsibilities for the processing must be defined clearly and the key principles concerning the division of those responsibilities must be made available to the data subjects.

All data that can be used to identify a person directly or indirectly are personal data.

Additional information:  What is personal data? | Data Protection Ombudsman’s Office

An accident or offence that results in the destruction, loss, alteration or unauthorised disclosure of personal data, or that grants a party not authorised to process the data access to personal data. Examples of personal data breaches include the loss of a USB memory stick, theft of a computer, loss of papers containing personal data, hacking, malware infection, or mailing a letter containing personal data to the wrong address.

Additional information: Personal data breaches | Data Protection Ombudsman’s Office

All operations involving personal data, from the planning of processing to erasure, constitute processing of personal data. For example, the collection, storage, use, transfer and disclosure of personal data all constitute processing. Hobbies involve the processing of personal data at many points, such as in connection with registrations, events and competitions.

The processor processes personal data on behalf of the controller and according to the controller’s instructions. The processor is a distinct entity from the controller.

The rights of the data subject are the right to obtain information on the processing of their personal data, the right of access, the right to rectification and erasure, the right to restriction of processing, the right to data portability, the right to object, and the right not to be subject to a decision based solely on automated processing. Not all of these rights can be exercised in all situations, depending on factors such as the basis for the processing of personal data. If an organisation processes the personal data of a child or adolescent, the minor’s custodian may also have the right to exercise the minor’s rights on their behalf.

Additional information: Rights of the data subject | Data Protection Ombudsman’s Office

Article: Data protection is a fundamental right for minors – what does it mean?

Data revealing information about a person’s racial or ethnic origin, political opinion, religious or philosophic beliefs, trade union membership, genetic data, biometric data and health data or sex life or sexual orientation. Such data must be protected with especial care, as their processing could create significant risks to the fundamental rights and freedoms of the individual concerned. The processing of special categories of personal data requires a basis in the GDPR or other legislation. Special categories of personal data processed in the context of hobbies can include information on a child’s allergies, illnesses or medication.

Additional information: Processing of special categories of personal data | Data Protection Ombudsman’s Office

Article:  Processing children’s health data in hobby activities