Predlog zakona o zaštiti podataka o ličnosti

1. Naziv propisa EU

UREDBA 2016/679 EVROPSKOG PARLAMENTA I SAVETA o zaštiti pojedinca u vezi sa obradom podataka o ličnosti i slobodnom kretanju takvih podataka od 27.04.2016. godine i stavljanju van snage Direktive 98/46/EZ (Opšta uredba o zaštiti podataka)

REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46EC (General Data Protection Regulation)

Službeni list L 119, 4.5.2016. str. 1-88 |2. „CELEX” oznaka EU propisa | | 32016R0679 3. Ovlašćeni predlagač propisa: VladaObrađivač: Ministarstvo pravde 4. datum izrade tabele 14.09.2018. 5. Naziv (važećeg, nacrta, predloga) propisa čije odredbe su predmet analize usklađenosti sa propisom EUPredlog zakona o zaštiti podataka o ličnostiDRAFT OF THE LAW ON PERSONAL DATA PROTECTION 6. Brojčane oznake (šifre) planiranih propisa iz baze NPI2018/21 7. Usklađenost odredaba propisa sa odredbama propisa EU

a) |a1) |b) |b1) |v) |g) |d) |đ) | |Odre-dba propisa EU (član, stav, podstav, tačka, aneks) |Sadržina odredbe |Odre-dbe propisa

(član, stav, tačka) |Sadržina odredbe |Usklađe-nost odredbe propisa sa odred-bom propisa EU |Razlozi za delimičnu usklađenost, neusklađenost ili

neprenosivost |Predviđeni datum za postizanje potpune usklađenosti |Napomena o usklađe-nosti propisa sa propisima EU | |1.1. |This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.

|1.1. |Ovim zakonom uređuje se pravo na zaštitu fizičkih lica u vezi sa obradom podataka o ličnosti i slobodni protok takvih podataka, načela obrade, prava lica na koje se podaci odnose, obaveze rukovalaca i obrađivača podataka o ličnosti, kodeks postupanja, prenos podataka o ličnosti u druge države i međunarodne organizacije, nadzor nad sprovođenjem ovog zakona, pravna sredstva, odgovornost i kazne u slučaju povrede prava fizičkih lica u vezi sa obradom podataka o ličnosti, kao i posebni slučajevi obrade. |PU | | | | |1.2. |This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data. |2.1 |Ovim zakonom se obezbeđuje zaštita osnovnih prava i sloboda fizičkih lica, a posebno njihovog prava na zaštitu podataka o ličnosti. |PU | | | | |1.3. |The free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data. | | |NP |Propisane obaveze se odnose na države članice Evropske unije | | | |2.1. |This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. |3.1. |Ovaj zakon primenjuje se na obradu podataka o ličnosti koja se vrši, u celini ili delimično, na automatizovan način, kao i na neautomatizovanu obradu podataka o ličnosti koji čine deo zbirke podataka ili su namenjeni zbirci podataka. |PU | | | | |2.2 |This Regulation does not apply to the processing of personal data:

(a)

in the course of an activity which falls outside the scope of Union law;

(b)

by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; |

(c)

by a natural person in the course of a purely personal or household activity;

(d)

by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

3.2.

1.2.

Ovaj zakon ne primenjuje se na obradu podataka o ličnosti koju vrši fizičko lice za lične potrebe, odnosno potrebe svog domaćinstva.

Ovim zakonom se uređuje i pravo na zaštitu fizičkih lica u vezi sa obradom podataka o ličnosti koju vrše nadležni organi u svrhe sprečavanja, istrage i otkrivanja krivičnih dela, gonjenja učinilaca krivičnih dela ili izvršenja krivičnih sankcija, uključujući sprečavanje i zaštitu od pretnji javnoj i nacionalnoj bezbednosti, kao i slobodni protok takvih podataka. |NP

PU |Tačka a) se odnosi na propisane obaveze koje se odnose na države članice Evropske unije

Tačka b) se odnosi na propisane obaveze koje se odnose na države članice Evropske unije

Uredba se ne odnosi na obradu podataka o ličnosti koju vrše nadležni organi u svrhe sprečavanja, istrage i otkrivanja krivičnih dela i drugo, s obzirom da je takva obrada uređena Direktivom 2016/680 o zaštiti pojedinca u vezi sa obradom podataka o ličnosti od strane nadležnih tela u svrhe sprečavanja, istrage, otkrivanja ili gonjenja krivičnih dela ili izvršenja krivičnih sankcija i slobodnom kretanju takvih podataka. Međutim, s obzirom da se Predlogom zakona istovremeno vrši usklađenost sa oba navedena dokumenta Evropske unije, obezbeđena je usklađenost i sa ovom odredbom. | | | |2.3. |For the processing of personal data by the Union institutions, bodies, offices and agencies, Regulation (EC) No 45/2001 applies. Regulation (EC) No 45/2001 and other Union legal acts applicable to such processing of personal data shall be adapted to the principles and rules of this Regulation in accordance with Article 98. |2.2. |Odredbe posebnih zakona kojima se uređuje obrada podataka o ličnosti moraju biti u skladu sa ovim zakonom. |PU | | | | |2.4. |This Regulation shall be without prejudice to the application of Directive 2000/31/EC, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive. | | |NP |Ova odredba nije preneta iz razloga što je ovo pitanje uređeno zakonom koji uređuje elektronske komunikacije | | | |3.1. |This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. |3.3. |Ovaj zakon primenjuje se na obradu podataka o ličnosti koju vrši rukovalac, odnosno obrađivač koji ima sedište, odnosno prebivalište ili boravište na teritoriji Republike Srbije, u okviru aktivnosti koje se vrše na teritoriji Republike Srbije, bez obzira da li se radnja obrade vrši na teritoriji Republike Srbije. |PU | | | | |3.2. |This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

(a)

the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

(b)

the monitoring of their behaviour as far as their behaviour takes place within the Union.

|3.4. |Ovaj zakon primenjuje se na obradu podataka o ličnosti lica na koje se podaci odnose koje ima prebivalište, odnosno boravište na teritoriji Republike Srbije od strane rukovaoca, odnosno obrađivača koji nema sedište, odnosno prebivalište ili boravište na teritoriji Republike Srbije, ako su radnje obrade vezane za:

1) ponudu robe, odnosno usluge licu na koje se podaci odnose na teritoriji Republike Srbije, bez obzira da li se od tog lica zahteva plaćanje naknade za ovu robu, odnosno uslugu;

2) praćenje aktivnosti lica na koje se podaci odnose, ako se aktivnosti vrše na teritoriji Republike Srbije. |PU | | | | |3.3. |This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |4. |For the purposes of this Regulation: |4. |Pojedini izrazi u ovom zakonu imaju sledeće značenje: |PU | | | | |(1) |‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; |1) |„podatak o ličnosti” je svaki podatak koji se odnosi na fizičko lice čiji je identitet određen ili odrediv, neposredno ili posredno, posebno na osnovu oznake identiteta, kao što je ime i identifikacioni broj, podataka o lokaciji, identifikatora u elektronskim komunikacionim mrežama ili jednog, odnosno više obeležja njegovog fizičkog, fiziološkog, genetskog, mentalnog, ekonomskog, kulturnog i društvenog identiteta; |PU | | | | |(2) |‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; |3) |„obrada podataka o ličnosti” je svaka radnja ili skup radnji koje se vrše automatizovano ili neautomatizovano sa podacima o ličnosti ili njihovim skupovima, kao što su prikupljanje, beleženje, razvrstavanje, grupisanje, odnosno strukturisanje, pohranjivanje, upodobljavanje ili menjanje, otkrivanje, uvid, upotreba, otkrivanje prenosom, odnosno dostavljanjem, umnožavanje, širenje ili na drugi način činjenje dostupnim, upoređivanje, ograničavanje, brisanje ili uništavanje (u daljem tekstu: obrada); |PU | | | | |(3) |‘restriction of processing’ means the marking of stored personal data with the aim of limiting their processing in the future; |4) |„ograničavanje obrade” je označavanje pohranjenih podataka o ličnosti u cilju ograničenja njihove obrade u budućnosti; |PU | | | | |(4) |‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements; |5) |„profilisanje” je svaki oblik automatizovane obrade koji se koristi da bi se ocenilo određeno svojstvo ličnosti, posebno u cilju analize ili predviđanja radnog učinka fizičkog lica, njegovog ekonomskog položaja, zdravstvenog stanja, ličnih sklonosti, interesa, pouzdanosti, ponašanja, lokacije ili kretanja; |PU | | | | |(5) |‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person; |6) |„pseudonimizacija” je obrada na način koji onemogućava pripisivanje podataka o ličnosti određenom licu bez korišćenja dodatnih podataka, pod uslovom da se ovi dodatni podaci čuvaju posebno i da su preduzete tehničke, organizacione i kadrovske mere koje obezbeđuju da se podatak o ličnosti ne može pripisati određenom ili odredivom licu; |PU | | | | |(6) |‘filing system’ means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis; |7) |„zbirka podataka” je svaki strukturisani skup podataka o ličnosti koji je dostupan u skladu sa posebnim kriterijumima, bez obzira da li je zbirka centralizovana, decentralizovana ili razvrstana po funkcionalnim ili geografskim osnovama; |PU | | | | |(7) |‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law; |8) |„rukovalac” je fizičko ili pravno lice, odnosno organ vlasti koji samostalno ili zajedno sa drugima određuje svrhu i način obrade. Zakonom kojim se određuje svrha i način obrade, može se odrediti i rukovalac ili propisati uslovi za njegovo određivanje; |PU | | | | |(8) |‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller; |9) |„obrađivač” je fizičko ili pravno lice, odnosno organ vlasti koji obrađuje podatke o ličnosti u ime rukovaoca; |PU | | | | |(9) |‘recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing; |10) |„primalac” je fizičko ili pravno lice, odnosno organ vlasti kome su podaci o ličnosti otkriveni, bez obzira da li se radi o trećoj strani ili ne, osim ako se radi o organima vlasti koji u skladu sa zakonom primaju podatke o ličnosti u okviru istraživanja određenog slučaja i obrađuju ove podatke u skladu sa pravilima o zaštiti podataka o ličnosti koja se odnose na svrhu obrade; |PU | | | | |(10) |‘third party’ means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data; |11) |„treća strana” je fizičko ili pravno lice, odnosno organ vlasti, koji nije lice na koje se podaci odnose, rukovalac ili obrađivač, kao ni lice koje je ovlašćeno da obrađuje podatke o ličnosti pod neposrednim nadzorom rukovaoca ili obrađivača; |PU | | | | |(11) |‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her; |12) |„pristanak” lica na koje se podaci odnose je svako dobrovoljno, određeno, informisano i nedvosmisleno izražavanje volje tog lica, kojim to lice, izjavom ili jasnom potvrdnom radnjom, daje pristanak za obradu podataka o ličnosti koji se na njega odnose; |PU | | | | |(12) |‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed; |13) |„povreda podataka o ličnosti” je povreda bezbednosti podataka o ličnosti koja dovodi do slučajnog ili nezakonitog uništenja, gubitka, izmene, neovlašćenog otkrivanja ili pristupa podacima o ličnosti koji su preneseni, pohranjeni ili na drugi način obrađivani; |PU | | | | |(13) |‘genetic data’ means personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question; |14) |„genetski podatak” je podatak o ličnosti koji se odnosi na nasleđena ili stečena genetska obeležja fizičkog lica koja pružaju jedinstvenu informaciju o fiziologiji ili zdravlju tog lica, a naročito oni koji su dobijeni analizom iz uzorka biološkog porekla; |PU | | | | |(14) |‘biometric data’ means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data; |15) |„biometrijski podatak” je podatak o ličnosti dobijen posebnom tehničkom obradom u vezi sa fizičkim obeležjima, fiziološkim obeležjima ili obeležjima ponašanja fizičkog lica, koja omogućava ili potvrđuje jedinstvenu identifikaciju tog lica, kao što je slika njegovog lica ili njegovi daktiloskopski podaci; |PU | | | | |(15) |‘data concerning health’ means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status; |16) |„podaci o zdravlju” su podaci o fizičkom ili mentalnom zdravlju fizičkog lica, uključujući i one o pružanju zdravstvenih usluga, kojima se otkrivaju informacije o njegovom zdravstvenom stanju; |PU | | | | |(16) |‘main establishment’ means:

(a)

as regards a controller with establishments in more than one Member State, the place of its central administration in the Union, unless the decisions on the purposes and means of the processing of personal data are taken in another establishment of the controller in the Union and the latter establishment has the power to have such decisions implemented, in which case the establishment having taken such decisions is to be considered to be the main establishment;

(b)

as regards a processor with establishments in more than one Member State, the place of its central administration in the Union, or, if the processor has no central administration in the Union, the establishment of the processor in the Union where the main processing activities in the context of the activities of an establishment of the processor take place to the extent that the processor is subject to specific obligations under this Regulation;

| | |NP |Propisane obaveze se odnose na države članice Evropske unije | | | |(17) |‘representative’ means a natural or legal person established in the Union who, designated by the controller or processor in writing pursuant to Article 27, represents the controller or processor with regard to their respective obligations under this Regulation; |17) |„predstavnik” je fizičko ili pravno lice sa prebivalištem, odnosno sedištem na teritoriji Republike Srbije koje je u skladu sa članom 44. ovog zakona ovlašćeno da predstavlja rukovaoca, odnosno obrađivača u vezi sa njihovim obavezama predviđenim ovim zakonom; |PU | | | | |(18) |‘enterprise’ means a natural or legal person engaged in an economic activity, irrespective of its legal form, including partnerships or associations regularly engaged in an economic activity; |18) |„privredni subjekat” je fizičko ili pravno lice koje obavlja privrednu delatnost, bez obzira na njegov pravni oblik, uključujući i ortačko društvo ili udruženje koje redovno obavlja privrednu delatnost; |PU | | | | |(19) |‘group of undertakings’ means a controlling undertaking and its controlled undertakings; |20) |„grupa privrednih subjekata” je grupa povezanih privrednih subjekata, u skladu sa zakonom kojim se uređuje povezivanje privrednih subjekata; |PU | | | | |(20) |‘binding corporate rules’ means personal data protection policies which are adhered to by a controller or processor established on the territory of a Member State for transfers or a set of transfers of personal data to a controller or processor in one or more third countries within a group of undertakings, or group of enterprises engaged in a joint economic activity; |21) |„obavezujuća poslovna pravila” su interna pravila o zaštiti podataka o ličnosti koja su usvojena i koja se primenjuju od strane rukovaoca, odnosno obrađivača, sa prebivalištem ili boravištem, odnosno sedištem na teritoriji Republike Srbije, u svrhu regulisanja prenošenja podataka o ličnosti rukovaocu ili obrađivaču u jednoj ili više država unutar multinacionalne kompanije ili grupe privrednih subjekata; |PU | | | | |(21) |‘supervisory authority’ means an independent public authority which is established by a Member State pursuant to Article 51; |22) |„Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti (u daljem tekstu: Poverenik)” je nezavisan i samostalni organ vlasti ustanovljen na osnovu zakona, koji je nadležan za nadzor nad sprovođenjem ovog zakona i obavljanje drugih poslova propisanih zakonom; |PU | | | | |(22) |‘supervisory authority concerned’ means a supervisory authority which is concerned by the processing of personal data because:

(a)

the controller or processor is established on the territory of the Member State of that supervisory authority;

(b)

data subjects residing in the Member State of that supervisory authority are substantially affected or likely to be substantially affected by the processing; or

(c)

a complaint has been lodged with that supervisory authority;

| | |NP |Propisane obaveze se odnose na države članice Evropske unije | | | |(23) |‘cross-border processing’ means either:

(a)

processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or

(b)

processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.

| | |NP |Propisane obaveze se odnose na države članice Evropske unije | | | |(24) |‘relevant and reasoned objection’ means an objection to a draft decision as to whether there is an infringement of this Regulation, or whether envisaged action in relation to the controller or processor complies with this Regulation, which clearly demonstrates the significance of the risks posed by the draft decision as regards the fundamental rights and freedoms of data subjects and, where applicable, the free flow of personal data within the Union; | | |NP |Propisane obaveze se odnose na države članice Evropske unije | | | |(25) |‘information society service’ means a service as defined in point (b) of Article 1(1) of Directive (EU) 2015/1535 of the European Parliament and of the Council |23) |„usluga informacionog društva” je svaka usluga koja se uobičajno pruža uz naknadu, na daljinu, elektronskim sredstvima na zahtev primaoca usluga; |PU | | | | |(26) |‘international organisation’ means an organisation and its subordinate bodies governed by public international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries. |24) |„međunarodna organizacija” je organizacija ili njeno telo koje uređuje međunarodno javno pravo, kao i bilo koje drugo telo ustanovljeno sporazumom ili na osnovu sporazuma između država; |PU | | | | |5.1. |Personal data shall be:

(a)

processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);

(b)

collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);

(c)

adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);

(d)

accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);

(e)

kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed;

personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);

(f)

processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

|5.1.

6.1.

5.1.

8.1.

5.1. |Podaci o ličnosti moraju:

1) se obrađivati zakonito, pošteno i transparentno u odnosu na lice na koje se podaci odnose („zakonitost, poštenje i transparentnost”). Zakonita obrada je obrada koja se vrši u skladu sa ovim, odnosno drugim zakonom kojim se uređuje obrada;

2) se prikupljati u svrhe koje su konkretno određene, izričite, opravdane i zakonite i dalje se ne mogu obrađivati na način koji nije u skladu sa tim svrhama („ograničenje u odnosu na svrhu obrade”);

Izuzetno od člana 5. stav 1. tačka 2) ovog zakona, ako se dalja obrada vrši u svrhe arhiviranja u javnom interesu, u svrhe naučnog ili istorijskog istraživanja, kao i u statističke svrhe, u skladu sa ovim zakonom, smatra se da se podaci o ličnosti ne obrađuju na način koji nije u skladu sa prvobitnom svrhom.

3) biti primereni, bitni i ograničeni na ono što je neophodno u odnosu na svrhu obrade („minimizacija podataka”);

4) biti tačni i, ako je to neophodno, ažurirani. Uzimajući u obzir svrhu obrade, moraju se preduzeti sve razumne mere kojima se obezbeđuje da se netačni podaci o ličnosti bez odlaganja izbrišu ili isprave („tačnost”);

5) se čuvati u obliku koji omogućava identifikaciju lica samo u roku koji je neophodan za ostvarivanje svrhe obrade („ograničenje čuvanja”);

Izuzetno od člana 5. stav 1. tačka 5) ovog zakona, podaci o ličnosti koji se obrađuju isključivo u svrhe arhiviranja u javnom interesu, u svrhe naučnog ili istorijskog istraživanja, kao i u statističke svrhe, mogu se čuvati i u dužem roku, uz poštovanje odredaba ovog zakona o primeni odgovarajućih tehničkih, organizacionih i kadrovskih mera, a u cilju zaštite prava i sloboda lica na koje se podaci odnose.

6) se obrađivati na način koji obezbeđuje odgovarajuću zaštitu podataka o ličnosti, uključujući zaštitu od neovlašćene ili nezakonite obrade, kao i od slučajnog gubitka, uništenja ili oštećenja primenom odgovarajućih tehničkih, organizacionih i kadrovskih mera („integritet i poverljivost”). |PU

| | | | |5.2. |The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’). |5.2. |Rukovalac je odgovoran za primenu odredaba stava 1. ovog člana i mora biti u mogućnosti da predoči njihovu primenu („odgovornost za postupanje”). |PU | | | | |6.1. |Processing shall be lawful only if and to the extent that at least one of the following applies:

(a)

the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

(b)

processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

(c)

processing is necessary for compliance with a legal obligation to which the controller is subject;

(d)

processing is necessary in order to protect the vital interests of the data subject or of another natural person;

(e)

processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(f)

processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

|12.1. |Obrada je zakonita samo ako je ispunjen jedan od sledećih uslova:

1) lice na koje se podaci o ličnosti odnose je pristalo na obradu svojih podataka o ličnosti za jednu ili više posebno određenih svrha;

2) obrada je neophodna za izvršenje ugovora zaključenog sa licem na koje se podaci odnose ili za preduzimanje radnji, na zahtev lica na koje se podaci odnose, pre zaključenja ugovora;

3) obrada je neophodna u cilju poštovanja pravnih obaveza rukovaoca;

4) obrada je neophodna u cilju zaštite životno važnih interesa lica na koje se podaci odnose ili drugog fizičkog lica;

5) obrada je neophodna u cilju obavljanja poslova u javnom interesu ili izvršenja zakonom propisanih ovlašćenja rukovaoca;

6) obrada je neophodna u cilju ostvarivanja legitimnih interesa rukovaoca ili treće strane, osim ako su nad tim interesima pretežniji interesi ili osnovna prava i slobode lica na koje se podaci odnose koji zahtevaju zaštitu podataka o ličnosti, posebno ako je lice na koje se podaci odnose maloletno lice. |PU | | | | |6.1. |Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks. |12.2. |Stav 1. tačka 6) ovog člana ne primenjuje se na obradu koju vrši organ vlasti u okviru svoje nadležnosti. |PU | | | | |6.2. |Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX. |14.1.

14.3. |Osnov za obradu iz člana 12. stav 1. tač. 3) i 5) ovog zakona određuje se zakonom.

(a)

Union law; or

(b)

Member State law to which the controller is subject.

The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued. |14.1.

14.2.

14.3.

|Osnov za obradu iz člana 12. stav 1. tač. 3) i 5) ovog zakona određuje se zakonom.

Ako se radi o obradi iz člana 12. stav 1. tačka 3) ovog zakona, zakonom se određuje i svrha obrade, a ako se radi o obradi iz člana 12. stav 1. tačka 5) ovog zakona, zakonom se propisuje da je obrada neophodna u cilju obavljanja poslova u javnom interesu ili izvršenja zakonom propisanih ovlašćenja rukovaoca.

Zakonom iz stava 1. ovog člana propisuje se javni interes koji se namerava ostvariti, kao i obaveza poštovanja pravila o srazmernosti obrade u odnosu na cilj koji se namerava ostvariti, a mogu se propisati i uslovi za dozvoljenost obrade od strane rukovaoca, vrsta podataka koji su predmet obrade, lica na koje se podaci o ličnosti odnose, lica kojima se podaci mogu otkriti i svrha njihovog otkrivanja, ograničenja koja se odnose na svrhu obrade, vremenski period pohranjivanja i čuvanja podataka, kao i druge posebne radnje i postupak obrade, uključujući i mere za obezbeđivanje zakonite i poštene obrade. |PU | | | | |6.4. |Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject’s consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia:

(a)

any link between the purposes for which the personal data have been collected and the purposes of the intended further processing;

(b)

the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller;

(c)

the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10;

(d)

the possible consequences of the intended further processing for data subjects;

(e))

the existence of appropriate safeguards, which may include encryption or pseudonymisation.

|6.2. |Ako obrada u svrhu koja je različita od svrhe za koju su podaci prikupljeni nije zasnovana na zakonu koji propisuje neophodne i srazmerne mere u demokratskom društvu radi zaštite ciljeva iz člana 40. stav 1. ovog zakona, ili na pristanku lica na koje se podaci odnose, rukovalac je dužan da oceni da li je ta druga svrha obrade u skladu sa svrhom obrade za koju su podaci prikupljeni, posebno uzimajući u obzir:

1) da li postoji veza između svrhe za koju su podaci prikupljeni i druge svrhe nameravane obrade;

2) okolnosti u kojima su podaci prikupljeni, uključujući i odnos između rukovaoca i lica na koje se podaci odnose;

3) prirodu podataka, a posebno da li se obrađuju posebne vrste podataka o ličnosti iz člana 17. ovog zakona, odnosno podaci o ličnosti u vezi sa krivičnim presudama i kažnjivim delima iz člana 19. ovog zakona;

4) moguće posledice dalje obrade za lice na koje se podaci odnose;

5) primenu odgovarajućih mera, kao što su kriptozaštita i pseudonimizacija.

|PU | | | | |7.1. |Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data. |15.1. |Ako se obrada zasniva na pristanku, rukovalac mora biti u mogućnosti da predoči da je lice pristalo na obradu svojih podataka o ličnosti. |PU | | | | |7.2. |If the data subject’s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding. |15.2. |Ako se pristanak lica na koje se podaci odnose daje u okviru pismene izjave koja se odnosi i na druga pitanja, zahtev za davanje pristanka mora biti predstavljen na način kojim se izdvaja od tih drugih pitanja, u razumljivom i lako dostupnom obliku, kao i uz upotrebu jasnih i jednostavnih reči. Deo pismene izjave koji je u suprotnosti sa ovim zakonom ne proizvodi pravno dejstvo. |PU | | | | |7.3 |The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent. |15.3. |Lice na koje se podaci odnose ima pravo da opozove pristanak u svakom trenutku. Opoziv pristanka ne utiče na dopuštenost obrade koja je vršena na osnovu pristanka pre opoziva. Pre davanja pristanka lice na koje se podaci odnose mora biti obavešteno o pravu na opoziv, kao i dejstvu opoziva. Opozivanje pristanka mora biti jednostavno, kao i davanje pristanka. |PU | | | | |7.4. |When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. |15.4. |Prilikom ocenjivanja da li je pristanak za obradu podataka o ličnosti slobodno dat, posebno se mora voditi računa o tome da li se izvršenje ugovora, uključujući i pružanje usluga, uslovljava davanjem pristanka koji nije neophodan za njegovo izvršenje. |PU | | | | |8.1. |Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.

Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years. |16.1.

16.2. |Maloletno lice koje je navršilo 15 godina može samostalno da daje pristanak za obradu podataka o svojoj ličnosti u korišćenju usluga informacionog društva.

Ako se radi o maloletnom licu koje nije navršilo 15 godina, za obradu podataka iz stava 1. ovog člana pristanak mora dati roditelj koji vrši roditeljsko pravo, odnosno drugi zakonski zastupnik maloletnog lica.

|PU | | | | |8.2. |The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology. |16.3. |Rukovalac mora preduzeti razumne mere u cilju utvrđivanja da li je pristanak dao roditelj koji vrši roditeljsko pravo, odnosno drugi zakonski zastupnik maloletnog lica, uzimajući u obzir dostupne tehnologije. |PU | | | | |8.3. |Paragraph 1 shall not affect the general contract law of Member States such as the rules on the validity, formation or effect of a contract in relation to a child. | | |NP |Propisane obaveze se odnose na države članice Evropske unije | |

| |9.1. |Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited. |17.1. |Zabranjena je obrada kojom se otkriva rasno ili etničko poreklo, političko mišljenje, versko ili filozofsko uverenje ili članstvo u sindikatu, kao i obrada genetskih podataka, biometrijskih podataka u cilju jedinstvene identifikacije lica, podataka o zdravstvenom stanju ili podataka o seksualnom životu ili seksualnoj orijentaciji fizičkog lica. |PU | | | | |9.2. |Paragraph 1 shall not apply if one of the following applies:

(a)

the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;

(b)

processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;

(c)

processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent;

(d)

processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects;

(e)

processing relates to personal data which are manifestly made public by the data subject;

(f)

processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;

(g)

processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;

(h)

processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;

(i)

processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;

(j)

processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

|17.2. |Izuzetno, obrada iz stava 1. ovog člana dopuštena je u sledećim slučajevima:

1) lice na koje se podaci odnose je dalo izričit pristanak za obradu za jednu ili više svrha obrade, osim ako je zakonom propisano da se obrada ne vrši na osnovu pristanka;

2) obrada je neophodna u cilju izvršenja obaveza ili primene zakonom propisanih ovlašćenja rukovaoca ili lica na koje se podaci odnose u oblasti rada, socijalnog osiguranja i socijalne zaštite, ako je takva obrada propisana zakonom ili kolektivnim ugovorom koji propisuje primenu odgovarajućih mera zaštite osnovnih prava, sloboda i interesa lica na koje se podaci odnose;

3) obrada je neophodna u cilju zaštite životno važnih interesa lica na koje se podaci odnose ili drugog fizičkog lica, ako lice na koje se podaci odnose fizički ili pravno nije u mogućnosti da daje pristanak;

4) obrada se vrši u okviru registrovane delatnosti i uz primenu odgovarajućih mera zaštite od strane zadužbine, fondacije, udruženja ili druge nedobitne organizacije sa političkim, filozofskim, verskim ili sindikalnim ciljem, pod uslovom da se obrada odnosi isključivo na članove, odnosno bivše članove te organizacije ili lica koja imaju redovne kontakte sa njom u vezi sa ciljem organizacije, kao i da se podaci o ličnosti ne otkrivaju izvan te organizacije bez pristanka lica na koje se odnose;

5) obrađuju se podaci o ličnosti koje je lice na koje se oni odnose očigledno učinilo javno dostupnim;

6) obrada je neophodna u cilju podnošenja, ostvarivanja ili odbrane pravnog zahteva ili u slučaju kad sud postupa u okviru svoje nadležosti;

7) obrada je neophodna u cilju ostvarivanja značajnog javnog interesa određenog zakonom, ako je takva obrada srazmerna ostvarivanju cilja, uz poštovanje suštine prava na zaštitu podataka o ličnosti i ako je obezbeđena primena odgovarajućih i posebnih mera zaštite osnovnih prava i interesa lica na koje se ovi podaci odnose;

8) obrada je neophodna u svrhu preventivne medicine ili medicine rada, radi procene radne sposobnosti zaposlenih, medicinske dijagnostike, pružanja usluga zdravstvene ili socijalne zaštite, odnosno upravljanja zdravstvenim ili socijalnim sistemima, na osnovu zakona ili na osnovu ugovora sa zdravstvenim radnikom, ako se obrada vrši od strane ili pod nadzorom zdravstvenog radnika ili drugog lica koje ima obavezu čuvanja profesionalne tajne propisane zakonom ili profesionalnim pravilima;

9) obrada je neophodna u cilju ostvarivanja javnog interesa u oblasti javnog zdravlja, kao što je zaštita od ozbiljnih prekograničnih pretnji zdravlju stanovništva ili obezbeđivanje visokih standarda kvaliteta i sigurnosti zdravstvene zaštite i lekova ili medicinskih sredstava, na osnovu zakona koji obezbeđuje odgovarajuće i posebne mere zaštite prava i sloboda lica na koje se podaci odnose, posebno u pogledu čuvanje profesionalne tajne;

10) obrada je neophodna u svrhe arhiviranja u javnom interesu, u svrhe naučnog ili istorijskog istraživanja i u statističke svrhe, u skladu sa članom 92. stav 1. ovog zakona, ako je takva obrada srazmerna ostvarivanju ciljeva koji se nameravaju postići, uz poštovanje suštine prava na zaštitu podataka o ličnosti i ako je obezbeđena primena odgovarajućih i posebnih mera zaštite osnovnih prava i interesa lica na koje se ovi podaci odnose. |PU | | | | |9.3. |Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies. |17.2. |8) obrada je neophodna u svrhu preventivne medicine ili medicine rada, radi procene radne sposobnosti zaposlenih, medicinske dijagnostike, pružanja usluga zdravstvene ili socijalne zaštite, odnosno upravljanja zdravstvenim ili socijalnim sistemima, na osnovu zakona ili na osnovu ugovora sa zdravstvenim radnikom, ako se obrada vrši od strane ili pod nadzorom zdravstvenog radnika ili drugog lica koje ima obavezu čuvanja profesionalne tajne propisane zakonom ili profesionalnim pravilima; |PU | | | | |9.4. |Member States may maintain or introduce further conditions, including limitations, with regard to the processing of genetic data, biometric data or data concerning health. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. Pored toga, reč je o odredbi koja nije obavezujuća. | | | |10. |Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.

|19.1.

19.2. |Obrada podataka o ličnosti koji se odnose na krivične presude, kažnjiva dela i mere bezbednosti, može se vršiti na osnovu člana 12. stav 1. ovog zakona samo pod nadzorom nadležnog organa ili, ako je obrada dopuštena zakonom, uz primenu odgovarajućih posebnih mera zaštite prava i sloboda lica na koje se podaci odnose.

Jedinstvena evidencija o krivičnim presudama vodi se isključivo od strane i pod nadzorom nadležnog organa. |PU | | | | |11.1. |If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation. |20.1. |Ako za ostvarivanje svrhe obrade nije potrebno, odnosno više nije potrebno da rukovalac identifikuje lice na koje se podaci odnose, rukovalac nije dužan da zadrži, pribavi ili obradi dodatne informacije radi identifikacije tog lica samo u cilju primene ovog zakona. |PU | | | | |11.2. |Where, in cases referred to in paragraph 1 of this Article, the controller is able to demonstrate that it is not in a position to identify the data subject, the controller shall inform the data subject accordingly, if possible. In such cases, Articles 15 to 20 shall not apply except where the data subject, for the purpose of exercising his or her rights under those articles, provides additional information enabling his or her identification. |20.2.

20.3. |Ako je u slučaju iz stava 1. ovog člana rukovalac u mogućnosti da predoči da ne može da identifikuje lice na koje se podaci odnose, dužan je da o tome na odgovarajući način informiše to lice, ako je to moguće.

U slučaju iz st. 1. i 2. ovog člana ne primenjuju se odredbe člana 26. st. 1. do 4, člana 29, člana 30. st. 1. do 5, člana 31. st. 1. do 3, člana 33. st. 1. i 2. i člana 36. st. 1. do 4. ovog zakona, osim ako lice na koje se podaci odnose, u cilju ostvarivanja prava iz tih članova, dostavi dodatne informacije koje omogućavaju njegovu identifikaciju. |PU | | | | |12.1. |The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means. |21.1. |Rukovalac je dužan da preduzme odgovarajuće mere da bi licu na koje se podaci odnose pružio sve informacije iz čl. 23. i 24. ovog zakona, odnosno informacije u vezi sa ostvarivanjem prava iz člana 26, čl. 29. do 31, člana 33, čl. 36. do 38. i člana 53. ovog zakona, na sažet, transparentan, razumljiv i lako dostupan način, korišćenjem jasnih i jednostavnih reči, a posebno ako se radi o informaciji koja je namenjena maloletnom licu. Te informacije pružaju se u pismenom ili drugom obliku, uključujući i elektronski oblik, ako je to pogodno. Ako lice na koje se podaci odnose to zahteva, informacije se mogu pružiti usmeno, pod uslovom da je identitet lica nesumnjivo utvrđen. |PU | | | | |12.2. |The controller shall facilitate the exercise of data subject rights under Articles 15 to 22. In the cases referred to in Article 11(2), the controller shall not refuse to act on the request of the data subject for exercising his or her rights under Articles 15 to 22, unless the controller demonstrates that it is not in a position to identify the data subject. |21.2. |Rukovalac je dužan da pruži pomoć licu na koje se podaci odnose u ostvarivanju njegovih prava iz člana 26, čl. 29. do 31, člana 33. i čl. 36. do 38. ovog zakona. U slučajevima iz člana 20. st. 2. i 3. ovog zakona, rukovalac ne može odbiti da postupi po zahtevu lica na koje se podaci odnose u ostvarivanju njegovih prava iz člana 26, čl. 29. do 31, člana 33. i čl. 36. do 38. ovog zakona, osim ako rukovalac predoči da nije u mogućnosti da identifikuje lice. |PU | | | | |12.3. |The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject. |21.3. |Rukovalac je dužan da licu na koje se podaci odnose pruži informacije o postupanju na osnovu zahteva iz člana 26, čl. 29. do 31, člana 33. i čl. 36. do 38. ovog zakona bez odlaganja, a najkasnije u roku od 30 dana od dana prijema zahteva. Taj rok može biti produžen za još 60 dana ako je to neophodno, uzimajući u obzir složenost i broj zahteva. O produženju roka i razlozima za to produženje rukovalac je dužan da obavesti lice na koje se podaci odnose u roku od 30 dana od dana prijema zahteva. Ako je lice na koje se podaci odnose podnelo zahtev elektronskim putem, informacija se mora pružiti elektronskim putem ako je to moguće, osim ako je to lice zahtevalo da se informacija pruži na drugi način. |PU | | | | |12.4. |If the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy. |21.4. |Ako rukovalac ne postupi po zahtevu lica na koje se podaci odnose dužan je da o razlozima za nepostupanje obavesti to lice bez odlaganja, a najkasnije u roku od 30 dana od dana prijema zahteva, kao i o pravu na podnošenje pritužbe Povereniku, odnosno tužbe sudu. |PU | | | | |12.5. |Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either:

(a)

charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

(b)

refuse to act on the request.

The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request. |21.5.

21.6. |Rukovalac pruža informacije iz čl. 23. i 24. ovog zakona, odnosno informacije u vezi sa ostvarivanjem prava iz člana 26, čl. 29. do 31, člana 33, čl. 36. do 38. i član 53. ovog zakona bez naknade. Ako je zahtev lica na koje se podaci odnose očigledno neosnovan ili preteran, a posebno ako se isti zahtev učestalo ponovlja, rukovalac može da:

1) naplati nužne administrativne troškove pružanja informacije, odnosno postupanja po zahtevu;

2) odbije da postupi po zahtevu.

Teret dokazivanja da je zahtev očigledno neosnovan ili preteran leži na rukovaocu. |PU | | | | |12.6. |Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject. |21.7. |Ako rukovalac opravdano sumnja u identitet lica koje je podnelo zahtev iz člana 26, čl. 29. do 31, člana 33. i čl. 36. do 38. ovog zakona, rukovalac može da zahteva dostavljanje dodatnih informacija neophodnih za potvrdu identiteta lica, što ne isključuje primenu člana 20. ovog zakona. |PU | | | | |12.7. |The information to be provided to data subjects pursuant to Articles 13 and 14 may be provided in combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner a meaningful overview of the intended processing. Where the icons are presented electronically they shall be machine-readable. |21.8. |Informacije koje se pružaju licima na koje se podaci odnose u skladu sa čl. 23. i 24. ovog zakona mogu se pružiti u kombinaciji sa standardizovanim ikonama prikazanim u elektronskom obliku kako bi se, na lako vidljiv, razumljiv i jasno uočljiv način, obezbedio svrsishodan uvid u nameravanu obradu. Mora se obezbediti da standardizovane ikone prikazane u elektronskom obliku budu čitljive na elektronskom uređaju. |PU | | | | |12.8. |The Commission shall be empowered to adopt delegated acts in accordance with Article 92 for the purpose of determining the information to be presented by the icons and the procedures for providing standardised icons. |21.9. |Poverenik određuje informacije koje se predstavljaju standardizovanim ikonama prikazanim u elektronskom obliku i uređuje postupak za njihovo utvrđivanje. |PU | | |

| |13.1. | Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:

(a)

the identity and the contact details of the controller and, where applicable, of the controller’s representative;

(b)

the contact details of the data protection officer, where applicable;

(c)

the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;

(d)

where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;

(e)

the recipients or categories of recipients of the personal data, if any;

(f)

where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.

|23.1. |Ako se podaci o ličnosti prikupljaju od lica na koje se odnose, rukovalac je dužan da u trenutku prikupljanja podataka o ličnosti tom licu pruži sledeće informacije:

1) o identitetu i kontakt podacima rukovaoca, kao i njegovog predstavnika, ako je on određen;

2) kontakt podatke lica za zaštitu podataka o ličnosti, ako je ono određeno;

3) o svrsi nameravane obrade i pravnom osnovu za obradu;

4) o postojanju legitimnog interesa rukovaoca ili treće strane, ako se obrada vrši na osnovu člana 12. stav 1. tačka 6) ovog zakona;

5) o primaocu, odnosno grupi primalaca podataka o ličnosti, ako oni postoje;

6) o činjenici da rukovalac namerava da iznese podatke o ličnosti u drugu državu ili međunarodnu organizaciju, kao i o tome da li se ta država ili međunarodna organizacija nalazi na listi iz člana 64. stav 7. ovog zakona, a u slučaju prenosa iz čl. 65. i 67. ili člana 69. stava 2. ovog zakona, o upućivanju na odgovarajuće mere zaštite, kao i o načinu na koji se lice na koje se podaci odnose može upoznati sa tim merama.

|PU | | | | |13.2. |In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing

(a)

the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;

(b)

the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;

(c)

where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

(d)

the right to lodge a complaint with a supervisory authority;

(e)

whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data;

(f)

the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

|23.2. |Uz informacije iz stava 1. ovog člana, rukovalac je dužan da u trenutku prikupljanja podataka o ličnosti licu na koje se podaci odnose pruži i sledeće dodatne informacije koje mogu da budu neophodne da bi se obezbedila poštena i transparentna obrada u odnosu na to lice:

1) o roku čuvanja podataka o ličnosti ili, ako to nije moguće, o kriterijumima za njegovo određivanje;

2) o postojanju prava da se od rukovaoca zahteva pristup, ispravka ili brisanje njegovih podataka o ličnosti, odnosno postojanju prava na ograničenje obrade, prava na prigovor, kao i prava na prenosivost podataka;

3) o postojanju prava na opoziv pristanka u bilo koje vreme, kao i o tome da opoziv pristanka ne utiče na dopuštenost obrade na osnovu pristanka pre opoziva, ako se obrada vrši na osnovu člana 12. stav 1. tačka 1) ili član 17. stav 2. tačka 1) ovog zakona;

4) o pravu da se podnese pritužba Povereniku;

5) o tome da li je davanje podataka o ličnosti zakonska ili ugovorna obaveza ili je davanje podataka neophodan uslov za zaključenje ugovora, kao i o tome da li lice na koje se podaci odnose ima obavezu da da podatke o svojoj ličnosti i o mogućim posledicama ako se podaci ne daju;

6) o postojanju automatizovanog donošenja odluke, uključujući profilisanje iz člana 38. st. 1. i 4. ovog zakona, i, najmanje u tim slučajevima, svrsishodne informacije o logici koja se pri tome koristi, kao i o značaju i očekivanim posledicama te obrade po lice na koje se podaci odnose. |PU | | | | |13.3. |Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2. |23.3. |Ako rukovalac namerava da dalje odbrađuje podatke o ličnosti u drugu svrhu koja je različita od one za koju su podaci prikupljeni, rukovalac je dužan da pre započinjanja dalje obrade, licu na koje se podaci odnose, pruži informacije o toj drugoj svrsi, kao i sve ostale bitne informacije iz stava 2. ovog člana. |PU | | | | |13.4. |Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information. |23.4. |Ako je lice na koje se podaci odnose već upoznato sa nekom od informacija iz st. 1. do 3. ovog člana, rukovalac nema obavezu pružanja tih informacija. |PU | | | | |14.1. |Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information:

(a)

the identity and the contact details of the controller and, where applicable, of the controller’s representative;

(b)

the contact details of the data protection officer, where applicable;

(c)

the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;

(d)

the categories of personal data concerned;

(e)

the recipients or categories of recipients of the personal data, if any;

(f)

where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means to obtain a copy of them or where they have been made available.

|24.1. |Ako se podaci o ličnosti ne prikupljaju od lica na koje se odnose, rukovalac je dužan da licu na koje se podaci odnose pruži sledeće informacije:

1) o identitetu i kontakt podacima rukovaoca, kao i njegovog predstavnika, ako je on određen;

2) kontakt podatke lica za zaštitu podataka o ličnosti, ako je ono određeno;

3) o svrsi nameravane obrade i pravnom osnovu za obradu;

4) o vrsti podataka koji se obrađuju;

5) o primaocu, odnosno grupi primalaca podataka o ličnosti, ako oni postoje;

6) o činjenici da rukovalac namerava da iznese podatke o ličnosti u drugu državu ili međunarodnu organizaciju, kao i o tome da li se ova država, odnosno međunarodna organizacija nalazi na listi iz člana 64. stav 7. ovog zakona, a u slučaju prenosa iz čl. 65. i 67. ili člana 69. stava 2. ovog zakona, o upućivanju na odgovarajuće mere zaštite, kao i načinu na koji se lice može upoznati sa tim merama.

|PU | | | | |14.2. |In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject:

(a)

the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;

(b)

where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;

(c)

the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability;

(d)

where processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

(e)

the right to lodge a complaint with a supervisory authority;

(f)

from which source the personal data originate, and if applicable, whether it came from publicly accessible sources;

(g)

|24.2. |Uz informacije iz stava 1. ovog člana, rukovalac je dužan da licu na koje se podaci odnose pruži i sledeće dodatne informacije koje mogu da budu neophodne da bi se obezbedila poštena i transparentna obrada u odnosu na lice na koje se podaci odnose:

1) o roku čuvanja podataka o ličnosti ili, ako to nije moguće, o kriterijumima za njegovo određivanje;

2) o postojanju legitimnog interesa rukovaoca ili treće strane, ako se obrada vrši na osnovu člana 12. stav 1. tačka 6) ovog zakona;

3) o postojanju prava da se od rukovaoca zahteva pristup, ispravka ili brisanje podataka o njegovoj ličnosti, odnosno prava na ograničenje obrade, prava na prigovor na obradu, kao i prava na prenosivost podataka;

4) o postojanju prava na opoziv pristanka u bilo koje vreme, kao i o tome da opoziv pristanka ne utiče na dopuštenost obrade na osnovu pristanka pre opoziva, ako se obrada vrši na osnovu člana 12. stav 1. tačka 1) ili člana 17. stav 2. tačka 1) ovog zakona;

5) o pravu da se podnese pritužba Povereniku;

6) o izvoru iz kog potiču podaci o ličnosti i, prema potrebi, da li podaci potiču iz javno dostupnih izvora;

7) o postojanju automatizovanog donošenja odluke, uključujući profilisanje iz člana 38. st. 1. i 4. ovog zakona, i, najmanje u tim slučajevima, svrsishodne informacije o logici koja se pri tome koristi, kao i o značaju i očekivanim posledicama te obrade po lice na koje se podaci odnose. |PU | | | | |14.3. |The controller shall provide the information referred to in paragraphs 1 and 2:

(a)

within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed;

(b)

if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject; or

(c)

if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed.

|24.3. |Rukovalac je dužan da informacije iz st. 1. i 2. ovog člana pruži:

1) u razumnom roku posle prikupljanja podataka o ličnosti, a najkasnije u roku od 30 dana, uzimajući u obzir sve posebne okolnosti obrade;

2) najkasnije prilikom uspostavljanja prve komunikacije, ako se podaci o ličnosti koriste za komunikaciju sa licem na koje se odnose;

3) najkasnije prilikom prvog otkrivanja podataka o ličnosti, ako je predviđeno otkrivanje podataka o ličnosti drugom primaocu. |PU | | | | |14.4. |Where the controller intends to further process the personal data for a purpose other than that for which the personal data were obtained, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2. |24.4. |Ako rukovalac namerava da dalje odbrađuje podatke o ličnosti u drugu svrhu koja je različita od one za koju su podaci prikupljeni, rukovalac je dužan da pre započinjanja dalje obrade, licu na koje se podaci odnose, pruži informacije o toj drugoj svrsi, kao i sve ostale bitne informacije iz stava 2. ovog člana. |PU | | | | |14.5. |Paragraphs 1 to 4 shall not apply where and insofar as:

(a)

the data subject already has the information;

(b)

the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available;

(c)

obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject’s legitimate interests; or

(d)

where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy.

|24.5. |Rukovalac nije dužan da licu na koje se odnose podaci o ličnosti pruži informacije iz st. 1. do 4. ovog člana ako:

1) lice na koje se podaci o ličnosti odnose već ima te informacije;

2) je pružanje takvih informacija nemoguće ili bi zahtevalo nesrazmeran utrošak vremena i sredstava, a naročito u slučaju obrade u svrhe arhiviranja u javnom interesu, u svrhe naučnog ili istorijskog istraživanja, kao i u statističke svrhe, ako se primenjuju uslovi i mere iz člana 92. stav 1. ovog zakona ili ako je verovatno da bi izvršenje obaveza iz stava 1. ovog člana onemogućilo ili bitno otežalo ostvarivanje svrhe obrade. U tim slučajevima rukovalac je dužan da preduzme odgovarajuće mere zaštite prava i sloboda, kao i legitimnih interesa lica na koje se podaci, što uključuje i javno objavljivanje informacija;

3) je prikupljanje ili otkrivanje podataka o ličnosti izričito propisano zakonom kojim se obezbeđuju odgovarajuće mere zaštite legitimnih interesa lica na koje se podaci odnose;

4) se poverljivost podataka o ličnosti mora čuvati u skladu sa obavezom čuvanja profesionalne tajne koja je propisana zakonom.

|PU | | | | |15.1. |The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

(a)

the purposes of the processing;

(b)

the categories of personal data concerned;

(c)

the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

(d)

where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

(e)

the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;

(f)

the right to lodge a complaint with a supervisory authority;

(g)

where the personal data are not collected from the data subject, any available information as to their source;

(h)

|26.1. |Lice na koje se podaci odnose ima pravo da od rukovaoca zahteva informaciju o tome da li obrađuje njegove podatke o ličnosti, pristup tim podacima, kao i sledeće informacije:

1) o svrsi obrade;

2) o vrstama podataka o ličnosti koji se obrađuju;

3) o primaocu ili vrstama primalaca kojima su podaci o ličnosti otkriveni ili će im biti otkriveni, a posebno primaocima u drugim državama ili međunarodnim organizacijama;

4) o predviđenom roku čuvanja podataka o ličnosti, ili ako to nije moguće, o kriterijumima za određivanje tog roka;

5) o postojanju prava da se od rukovaoca zahteva ispravka ili brisanje njegovih podataka o ličnosti, prava na ograničenje obrade i prava na prigovor na obradu;

6) o pravu da se podnese pritužba Povereniku;

7) dostupne informacije o izvoru podataka o ličnosti, ako podaci o ličnosti nisu prikupljeni od lica na koje se odnose;

8) o postojanju postupka automatizovanog donošenja odluke, uključujući profilisanje iz člana 38. st. 1. i 4. ovog zakona, i, najmanje u tim slučajevima, svrsishodne informacije o logici koja se pri tome koristi, kao i o značaju i očekivanim posledicama te obrade po lice na koje se podaci odnose. |PU | | | | |15.2. |Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer. |26.2. |Ako se podaci o ličnosti prenose u drugu državu ili međunarodnu organizaciju, lice na koje se odnose ima pravo da bude informisano o odgovarajućim merama zaštite koje se odnose na prenos, u skladu sa članom 65. ovog zakona. |PU | | | | |15.3. |The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. |26.3. |Rukovalac je dužan da licu na koje se podaci odnose na njegov zahtev dostavi kopiju podataka koje obrađuje. Rukovalac može da zahteva naknadu nužnih troškova za izradu dodatnih kopija koje zahteva lice na koje se podaci odnose. Ako se zahtev za kopiju dostavlja elektronskim putem, informacije se dostavljaju u uobičajeno korišćenom elektronskom obliku, osim ako je lice na koje se podaci odnose zahtevalo drugačije dostavljanje. |PU | | | | |15.4. |The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. |26.4. |Ostvarivanje prava i sloboda drugih lica ne može se ugroziti ostvarivanjem prava na dostavljanje kopije iz stava 3. ovog člana. |PU | | | | |16. |The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. |29. |Lice na koje se podaci odnose ima pravo da se njegovi netačni podaci o ličnosti bez nepotrebnog odlaganja isprave. U zavisnosti od svrhe obrade, lice na koje se podaci odnose ima pravo da svoje nepotpune podatke o ličnosti dopuni, što uključuje i davanje dodatne izjave. |PU | | | | |17.1. |The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

(a)

the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

(b)

the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;

(c)

the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);

(d)

the personal data have been unlawfully processed;

(e)

the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;

(f)

the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).

|30.1.

30.2. |Lice na koje se podaci odnose ima pravo da se njegovi podaci o ličnosti izbrišu od strane rukovaoca.

Rukovalac je dužan da bez nepotrebnog odlaganja podatke iz stava 1. ovog člana izbriše u sledećim slučajevima:

1) podaci o ličnosti više nisu neophodni za ostvarivanje svrhe zbog koje su prikupljeni ili na drugi način obrađivani;

2) lice na koje se podaci odnose je opozvalo pristanak na osnovu kojeg se obrada vršila, u skladu sa članom 12. stav 1. tačka 1) ili članom 17. stav 2. tačka 1) ovog zakona, a nema drugog pravnog osnova za obradu;

3) lice na koje se podaci odnose je podnelo prigovor na obradu u skladu sa:

a) članom 37. stav 1. ovog zakona, a nema drugog pravnog osnova za obradu koji preteže nad legitimnim interesom, pravom ili slobodom lica na koje se podaci odnose;

b) članom 37. stav 2. ovog zakona;

4) podaci o ličnosti su nezakonito obrađivani;

5) podaci o ličnosti moraju biti izbrisani u cilju izvršenja zakonskih obaveza rukovaoca;

6) podaci o ličnosti su prikupljeni u vezi sa korišćenjem usluga informacionog društva iz člana 16. stav 1. ovog zakona. |PU | | | | |17.2. |Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data. |30.3.

30.4. |Ako je rukovalac javno objavio podatke o ličnosti, njegova obaveza da izbriše podatke u skladu sa stavom 1. ovog člana obuhvata i preduzimanje svih razumnih mera, uključujući i tehničke mere, u skladu sa dostupnim tehnologijama i mogućnostima snošenja troškova njihove upotrebe, u cilju obaveštavanja drugih rukovaoca koji te podatke obrađuju da je lice na koje se podaci odnose podnelo zahtev za brisanje svih kopija ovih podataka i upućivanja, odnosno elektronskih veza prema ovim podacima.

Lice na koje se podaci odnose podnosi zahtev za ostvarivanje prava iz stava 1. ovog člana rukovaocu. |PU | | | | |17.3. |Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:

(a)

for exercising the right of freedom of expression and information;

(b)

for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(c)

for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3);

(d)

for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

(e)

for the establishment, exercise or defence of legal claims.

|30.5. |Stavovi 1. do 3. ovog člana ne primenjuju se u meri u kojoj je obrada neophodna zbog:

1) ostvarivanja slobode izražavanja i informisanja;

2) poštovanja zakonske obaveze rukovaoca kojom se zahteva obrada ili izvršenja poslova u javnom interesu ili izvršenja službenih ovlašćenja rukovaoca;

3) ostvarivanja javnog interesa u oblasti javnog zdravlja, u skladu sa članom 17. stav 2. tač. 8) i 9) ovog zakona;

4) svrhe arhiviranja u javnom interesu, svrhe naučnog ili istorijskog istraživanja, kao i statističke svrhe u skladu sa članom 92. stav 1. ovog zakona, a opravdano se očekuje da bi ostvarivanje prava iz st. 1. i 2. ovog člana moglo da onemogući ili bitno ugrozi ostvarivanje ciljeva te svrhe;

5) podnošenja, ostvarivanja ili odbrane pravnog zahteva. |PU | | | | |18.1. |The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:

(a)

the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;

(b)

the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

(c)

the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;

(d)

the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.

|31.1. |Lice na koje se podaci odnose ima pravo da se obrada njegovih podataka o ličnosti ograniči od strane rukovaoca ako je ispunjen jedan od sledećih slučajeva:

1) lice na koje se podaci odnose osporava tačnost podataka o ličnosti, u roku koji omogućava rukovaocu proveru tačnosti podataka o ličnosti;

2) obrada je nezakonita, a lice na koje se podaci odnose se protivi brisanju podataka o ličnosti i umesto brisanja zahteva ograničenje upotrebe podataka;

3) rukovaocu više nisu potrebni podaci o ličnosti za ostvarivanje svrhe obrade, ali ih je lice na koje se podaci odnose zatražilo u cilju podnošenja, ostvarivanja ili odbrane pravnog zahteva;

4) lice na koje se podaci odnose je podnelo prigovor na obradu u skladu sa članom 37. stav 1. ovog zakona, a u toku je procenjivanje da li pravni osnov za obradu od strane rukovaoca preteže nad interesima tog lica. |PU | | | | |18.2. |Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. |31.2. |Ako je obrada ograničena u skladu sa stavom 1. ovog člana, ti podaci mogu se dalje obrađivati samo na osnovu pristanka lica na koje se podaci odnose, osim ako se radi o njihovom pohranjivanju ili u cilju podnošenja, ostvarivanja ili odbrane pravnog zahteva ili zbog zaštite prava drugih fizičkih, odnosno pravnih lica ili zbog ostvarivanja značajnih javnih interesa. |PU | | | | |18.3. |A data subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction of processing is lifted. |31.3. |Ako je obrada ograničena u skladu sa stavom 1. ovog člana, rukovalac je dužan da informiše lice na koje se podaci odnose o prestanku ograničenja, pre nego što ograničenje prestane da važi. |PU | | | | |19. |The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.

|33.1.

33.2. |Rukovalac je dužan da obavesti sve primaoce kojima su podaci o ličnosti otkriveni o svakoj ispravci ili brisanju podataka o ličnosti ili ograničenju njihove obrade u skladu sa članom 29, članom 30. stav 1. i članom 31. ovog zakona, osim ako je to nemoguće ili zahteva prekomeran utrošak vremena i sredstava.

Rukovalac je dužan da lice na koje se podaci odnose, na njegov zahtev, informiše o svim primaocima iz stava 1. ovog člana. |PU | | | | |20.1. |The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

(a)

the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and

(b)

the processing is carried out by automated means.

|36.1. |Lice na koje se podaci odnose ima pravo da njegove podatke o ličnosti koje je prethodno dostavilo rukovaocu primi od njega u strukturisanom, uobičajno korišćenom i elektronski čitljivom obliku i ima pravo da ove podatke prenese drugom rukovaocu bez ometanja od strane rukovaoca kojem su ti podaci bili dostavljeni, ako su zajedno ispunjeni sledeći uslovi:

1) obrada je zasnovana na pristanku u skladu sa članom 12. stav 1. tačka 1) ili članom 17. stav 2. tačka 1) ovog zakona ili na osnovu ugovora, u skladu sa članom 12. stav 1. tačka 2) ovog zakona;

2) obrada se vrši automatizovano. |PU | | | | |20.2. |In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible. |36.2. |Pravo iz stava 1. ovog člana obuhavata i pravo lica da njegovi podaci o ličnosti budu neposredno preneti drugom rukovaocu od strane rukovaoca kojem su ovi podaci prethodno dostavljeni, ako je to tehnički izvodljivo. |PU | | | | |20.3. |The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. |36.3. |Ostvarivanje prava iz stava 1. ovog člana nema uticaja na primenu člana 30. ovog zakona. Pravo iz stava 1. ovog člana se ne može ostvariti ako je obrada nužna za izvršenje poslova od javnog interesa ili za vršenje službenih ovlašćenja rukovaoca. |PU | | | | |20.4. |The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others. |36.4. |Ostvarivanje prava iz stava 1. ovog člana ne može štetno uticati na ostvarivanje prava i sloboda drugih lica. |PU | | | | |21.1. |The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. |37.1. |Ako smatra da je to opravdano u odnosu na posebnu situaciju u kojoj se nalazi, lice na koje se podaci odnose ima pravo da u svakom trenutku podnese rukovaocu prigovor na obradu njegovih podataka o ličnosti, koja se vrši u skladu sa članom 12. stav 1. tač. 5) i 6) ovog zakona, uključujući i profilisanje koje se zasniva na tim odredbama. Rukovalac je dužan da prekine sa obradom podataka o licu koje je podnelo prigovor, osim ako je predočio da postoje zakonski razlozi za obradu koji pretežu nad interesima, pravima ili slobodama lica na koji se podaci odnose ili su u vezi sa podnošenjem, ostvarivanjem ili odbranom pravnog zahteva. |PU | | | | |21.2. |Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. |37.2. |Lice na koje se podaci odnose ima pravo da u svakom trenutku podnese prigovor na obradu svojih podataka o ličnosti koji se obrađuju za potrebe direktnog oglašavanja, uključujući i profilisanje, u meri u kojoj je ono povezano sa direktnim oglašavanjem. |PU | | | | |21.3. |Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes. |37.3. |Ako lice na koje se podaci odnose podnese prigovor na obradu za potrebe direktnog oglašavanja, podaci o ličnosti se ne mogu se dalje obrađivati u takve svrhe. |PU | | | | |21.4. |At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information. |37.4. |Rukovalac je dužan da najkasnije prilikom uspostavljanja prve komunikacije sa licem na koje se podaci odnose, upozori to lice na postojanje prava iz st. 1. i 2. ovog člana i da ga upozna sa tim pravima na izričit i jasan način, odvojeno od svih drugih informacija koje mu pruža. |PU | | | | |21.5. |In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications. |37.5. |U korišćenju usluga informacionog društva, lice na koje se podaci odnose ima pravo na podnese prigovor automatizovanim putem, u skladu sa tehničkim specifikacijama korišćenja usluga. |PU | | | | |21.6. |Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest. |37.6. |Ako se podaci o ličnosti obrađuju u svrhe naučnog ili istorijskog istraživanja ili u statističke svrhe, u skladu sa članom 92. ovog zakona, lice na koje se podaci odnose na osnovu svoje posebne situacije ima pravo da podnese prigovor na obradu svojih podataka o ličnosti, osim ako je obrada neophodna za obavljanje poslova u javnom interesu. |PU | | | | |22.1. |The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. |38.1. |Lice na koje se podaci odnose ima pravo da se na njega ne primenjuje odluka doneta isključivo na osnovu automatizovane obrade, uključujući i profilisanje, ako se tom odlukom proizvode pravne posledice po to lice ili ta odluka značajno utiče na njegov položaj. |PU | | | | |22.2. |Paragraph 1 shall not apply if the decision:

(a)

is necessary for entering into, or performance of, a contract between the data subject and a data controller;

(b)

is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or

(c)

is based on the data subject’s explicit consent.

|38.2. |Stav 1. ovog člana ne primenjuje se ako je odluka:

1) neophodna za zaključenje ili izvršenje ugovora između lica na koje se podaci odnose i rukovaoca;

2) zasnovana na zakonu, ako su tim zakonom propisane odgovarajuće mere zaštite prava, sloboda i na zakonu zasnovanih interesa lica na koje se podaci odnose;

3) zasnovana na izričitom pristanku lica na koje se podaci odnose. |PU | | | | |22.3. |In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision. |38.3. |U slučaju iz stava 2. tač. 1) i 3) ovog člana rukovalac je dužan da primeni odgovarajuće mere zaštite prava, sloboda i legitimnih interesa lica na koje se podaci odnose, a najmanje pravo da se obezbedi učešće fizičkog lica pod kontrolom rukovaoca u donošenju odluke, pravo lica na koje se podaci odnose da izrazi svoj stav u vezi sa odlukom, kao i pravo lica na koje se podaci odnose da ospori odluku pred ovlašćenim licem rukovaoca. |PU | | | | |22.4. |Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests are in place. |38.4. |Odluke iz stava 2. ovog člana ne mogu se zasnivati na posebnim vrstama podataka o ličnosti iz člana 17. stav 1. ovog zakona, osim ako se primenjuje član 17. stav 2. tač. 1) i 5) ovog zakona i ako su obezbeđene odgovarajuće mere zaštite prava, sloboda i legitimnih interesa lica na koje se podaci odnose. |PU | | | | |23.1. | Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:

(a)

national security;

(b)

defence;

(c)

public security;

(d)

the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;

(e)

other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security;

(f)

the protection of judicial independence and judicial proceedings;

(g)

the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;

(h)

a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);

(i)

the protection of the data subject or the rights and freedoms of others;

(j)

the enforcement of civil law claims.

|40.1. |Prava i obaveze iz čl. 21, 23, 24, 26, čl. 29. do 31, člana 33, čl. 36. do 39. i člana 53, kao i člana 5. ovog zakona ako se te odredbe odnose na ostvarivanje prava i obaveza iz čl. 21, 23, 24, 26, čl. 29. do 31, člana 33. i čl. 36. do 39. ovog zakona, mogu se ograničiti ako ta ograničenja ne zadiru u suštinu osnovnih prava i sloboda i ako to predstavlja neophodnu i srazmernu meru u demokratskom društvu za zaštitu:

1) nacionalne bezbednosti;

2) odbrane;

3) javne bezbednosti;

4) sprečavanja, istrage i otkrivanja krivičnih dela, gonjenja učinilaca krivičnih dela, ili izvršenje krivičnih sankcija, uključujući sprečavanje i zaštitu od pretnji po javnu bezbednost;

5) drugih važnih opštih javnih interesa, a posebno važnih državnih ili finansijskih interesa Republike Srbije, uključujući monetarnu politiku, budzet, poreski sistem, javno zdravlje i socijalnu zaštitu;

6) nezavisnosti pravosuđa i sudskih postupaka;

7) sprečavanja, istraživanja, otkrivanja i gonjenja za povredu profesionalne etike;

8) funkcije praćenja, nadzora ili vršenja regulatorne funkcije koja je stalno ili povremeno povezana sa vršenjem službenih ovlašćenja u slučajevima iz tač. 1) do 5) i tačke 7) ovog stava;

9) lica na koje se podaci odnose ili prava i sloboda drugih lica;

10) ostvarivanja potraživanja u građanskim stvarima. |PU | | | | |23.2. |In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to:

(a)

the purposes of the processing or categories of processing;

(b)

the categories of personal data;

(c)

the scope of the restrictions introduced;

(d)

the safeguards to prevent abuse or unlawful access or transfer;

(e)

the specification of the controller or categories of controllers;

(f)

the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;

(g)

the risks to the rights and freedoms of data subjects; and

(h)

the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.

|40.2. |Prilikom primene ograničenja prava i obaveza iz stava 1. ovog člana moraju se, prema potrebi, uzeti u obzir najmanje:

1) svrhe obrade ili vrste obrade;

2) vrste podataka o ličnosti;

3) obim ograničenja;

4) mere zaštite u cilju sprečavanja zloupotrebe, nedozvoljenog pristupa ili prenosa podataka o ličnosti;

5) posebnosti rukovaoca, odnosno vrsta rukovaoca;

6) vremenski period čuvanja i mere zaštite podataka o ličnosti koje se mogu primeniti, s obzirom na prirodu, obim i svrhu obrade ili vrste obrade;

7) rizici po prava i slobode lica na koje se podaci odnose;

8) pravo lica na koje se odnose podaci da bude informisano o organičenju, osim ako to informisanje onemogućava ostvarivanje svrhe ograničenja. |PU | | | | |24.1. |Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary. |41.1.

41.2. |Rukovalac je dužan da preduzme odgovarajuće tehničke, organizacione i kadrovske mere kako bi obezbedio da se obrada vrši u skladu sa ovim zakonom i bio u mogućnosti da to predoči, uzimajući u obzir prirodu, obim, okolnosti i svrhu obrade, kao i verovatnoću nastupanja rizika i nivo rizika za prava i slobode fizičkih lica.

Mere iz stava 1. ovog člana se preispituju i ažuriraju, ako je to neophodno. |PU | | | | |24.2. |Where proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller. |41.3. |Ako je to u srazmeri sa obradom podataka, mere iz stava 1. ovog člana uključuju primenu odgovarajućih internih akata rukovaoca o zaštiti podataka o ličnosti. |PU | | | | |24.3. |Adherence to approved codes of conduct as referred to in Article 40 or approved certification mechanisms as referred to in Article 42 may be used as an element by which to demonstrate compliance with the obligations of the controller. |41.4. |Rukovalac može predočiti da se pridržava obaveza iz stava 1. ovog člana na osnovu primene odobrenog kodeksa postupanja iz člana 59. ovog zakona ili izdatog sertifikata iz člana 61. ovog zakona. |PU | | | | |25.1. |Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects. |42.1. |Uzimajući u obzir nivo tehnoloških dostignuća i troškove njihove primene, prirodu, obim, okolnosti i svrhu obrade, kao i verovatnoću nastupanja rizika i nivo rizika za prava i slobode fizičkih lica koji proizilaze iz obrade, rukovalac je prilikom određivanja načina obrade, kao i u toku obrade, dužan da:

1) primeni odgovarajuće tehničke, organizacione i kadrovske mere, kao što je pseudonimizacija, koje imaju za cilj obezbeđivanje delotvorne primene načela zaštite podataka o ličnosti, kao što je smanjenje broja podataka;

2) obezbedi primenu neophodnih mehanizama zaštite u toku obrade, kako bi se ispunili uslovi za obradu propisani ovim zakonom i zaštitila prava i slobode lica na koja se podaci odnose. |PU | | | | |25.2. |The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual’s intervention to an indefinite number of natural persons. |42.2.

42.3. |Rukovalac je dužan da stalnom primenom odgovarajućih tehničkih, organizacionih i kadrovskih mera obezbedi da se uvek obrađuju samo oni podaci o ličnosti koji su neophodni za ostvarivanje svake pojedinačne svrhe obrade. Ta se obaveza primenjuje u odnosu na broj prikupljenih podataka, obim njihove obrade, vremenski period njihovog pohranjivanja i njihovu dostupnost.

Merama iz stava 2. ovog člana mora se uvek obezbediti da se bez učešća fizičkog lica podaci o ličnosti ne mogu učiniti dostupnim neograničenom broju fizičkih lica. |PU | | | | |25.3. |An approved certification mechanism pursuant to Article 42 may be used as an element to demonstrate compliance with the requirements set out in paragraphs 1 and 2 of this Article. |42.4. |Izdati sertifikat iz člana 61. ovog zakona rukovalac može koristiti da predoči da se pridržava obaveza iz st. 1. do 3. ovog člana.

|PU | | | | |26.1. |Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information referred to in Articles 13 and 14, by means of an arrangement between them unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject. The arrangement may designate a contact point for data subjects. |43.1.

43.2.

43.3.

43.4. |Ako dva ili više rukovaoca zajednički određuju svrhu i način obrade, oni se smatraju zajedničkim rukovaocima.

Zajednički rukovaoci iz stava 1. ovog člana na transparentan način određuju odgovornost svakog od njih za poštovanje obaveza propisanih ovim zakonom, a posebno obaveza u pogledu ostvarivanja prava lica na koje se podaci odnose i ispunjavanja njihovih obaveza da tom licu pruže informacije iz čl. 23. do 25. ovog zakona.

Odgovornost iz stava 2. ovog člana uređuje se sporazumom zajedničkih rukovaoca, osim ako je ova odgovornost propisana zakonom koji se primenjuje na rukovaoce.

Sporazumom iz stava 3. ovog člana mora se odrediti lice za kontakt sa licem na koje se podaci odnose i urediti odnos svakog od zajedničkih rukovaoca sa licem na koje se podaci odnose. |PU | | | | |26.2. |The arrangement referred to in paragraph 1 shall duly reflect the respective roles and relationships of the joint controllers vis-à-vis the data subjects. The essence of the arrangement shall be made available to the data subject. |43.4.

43.5. |Sporazumom iz stava 3. ovog člana mora se odrediti lice za kontakt sa licem na koje se podaci odnose i urediti odnos svakog od zajedničkih rukovaoca sa licem na koje se podaci odnose.

Suština odredbi sporazuma iz stava 3. ovog člana mora biti dostupna licu na koje se podaci odnose. |PU | | | | |26.3. |Irrespective of the terms of the arrangement referred to in paragraph 1, the data subject may exercise his or her rights under this Regulation in respect of and against each of the controllers. |43.7. |Bez obzira na odredbe sporazuma iz stava 3. ovog člana, lice na koje se podaci odnose može ostvariti svoja prava utvrđena ovim zakonom pojedinačno u odnosu prema svakom od zajedničkih rukovaoca. |PU | | | | |27.1. |Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union. |44.1. |Rukovalac, odnosno obrađivač, u slučajevima iz člana 3. stav 4. ovog zakona, dužan je da odredi u pismenom obliku svog predstavnika u Republici Srbiji, osim ako je:

1) obrada povremena, ne uključuje u velikoj meri obradu posebnih podataka iz člana 17. stav 1. ovog zakona ili podataka o ličnosti koji se odnose na osude za krivična dela i kažnjiva dela iz člana 19. ovog zakona, i verovatno je da neće prouzrokovati rizik za prava i slobode fizičkih lica uzimajući u obzir prirodu, okolnosti, obim i svrhe obrade;

2) rukovalac, odnosno obrađivač organ vlasti. |PU | | | | |27.2. |The obligation laid down in paragraph 1 of this Article shall not apply to:

(a)

processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or

(b)

a public authority or body.

|44.1. |Rukovalac, odnosno obrađivač, u slučajevima iz člana 3. stav 4. ovog zakona, dužan je da odredi u pismenom obliku svog predstavnika u Republici Srbiji, osim ako je:

2) rukovalac, odnosno obrađivač organ vlasti. |PU | | | | |27.3. |The representative shall be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |27.4. |The representative shall be mandated by the controller or processor to be addressed in addition to or instead of the controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with this Regulation. |44.2. |Rukovalac, odnosno obrađivač ovlašćuje predstavnika iz stava 1. ovog člana kao lice kome se, uz rukovaoca ili obrađivača, odnosno umesto njih, lice na koje se podaci odnose, Poverenik ili drugo lice može obratiti u pogledu svih pitanja u vezi sa obradom podatka o ličnosti, a u cilju obezbeđivanja poštovanja odredbi ovog zakona. |PU | | | | |27.5. |The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves. |44.3. |Pritužba, tužba i ostali pravni zahtevi iz ovog zakona se mogu podneti protiv rukovaoca ili obrađivača, bez obzira na to da li je određen njihov predstavnik iz stava 1. ovog člana. |PU | | | | |28.1. |Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject. |45.1. |Ako se obrada vrši u ime rukovaoca, rukovalac može da odredi kao obrađivača samo ono lice ili organ vlasti koji u potpunosti garantuje primenu odgovarajućih tehničkih, organizacionih i kadrovskih mera, na način koji obezbeđuje da se obrada vrši u skladu sa odredbama ovog zakona i da se obezbeđuje zaštita prava lica na koje se podaci odnose. |PU | | | | |28.2. |The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes. |45.2. |Obrađivač iz stava 1. ovog člana može poveriti obradu drugom obrađivaču samo ako ga rukovalac za to ovlasti na osnovu opšteg ili posebnog pismenog ovlašćenja. Ako se obrada vrši na osnovu opšteg ovlašćenja, obrađivač je dužan da informiše rukovaoca o nameravanom izboru drugog obrađivača, odnosno zameni drugog obrađivača, kako bi rukovalac imao mogućnost da se suprotstavi takvoj promeni. | | | | | |28.3. |Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller.

That contract or other legal act shall stipulate, in particular, that the processor:

(a)

processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest;

(b)

ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;

(c)

takes all measures required pursuant to Article 32;

(d)

respects the conditions referred to in paragraphs 2 and 4 for engaging another processor;

(e)

taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III;

(f)

assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 taking into account the nature of processing and the information available to the processor;

(g)

at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data;

(h)

makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.

With regard to point (h) of the first subparagraph, the processor shall immediately inform the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions. |45.3.

45.4.

45.5. |Obrada od strane obrađivača mora biti uređena ugovorom ili drugim pravno obavezujućim aktom, koji je zaključen, odnosno usvojen u pismenom obliku, što obuhvata i elektronski oblik, koji obavezuje obrađivača prema rukovaocu i koji uređuje predmet i trajanje obrade, prirodu i svrhu obradu, vrstu podataka o ličnosti i vrstu lica o kojima se podaci obrađuju, kao i prava i obaveze rukovaoca.

Ugovorom ili drugim pravno obavezujućim aktom iz stava 3. ovog člana propisuje se da je obrađivač dužan da:

1) obrađuje podatke o ličnosti samo na osnovu pismenih uputstava rukovaoca, uključujući i uputstvo u odnosu na prenošenje podataka o ličnosti u druge države ili međunarodne organizacije, osim ako je obrađivač zakonom obavezan da obrađuje podatke. U tom slučaju, obrađivač je dužan da obavesti rukovaoca o toj zakonskoj obavezi pre započinjanja obrade, osim ako zakon zabranjuje dostavljanje tih informacija zbog potrebe zaštite važnog javnog interesa;

2) obezbedi da se fizičko lice koje je ovlašćeno da obrađuje podatke o ličnosti obavezalo na čuvanje poverljivosti podataka ili da to lice podleže zakonskoj obavezi čuvanja poverljivosti podataka;

3) preduzme sve potrebne mere u skladu sa članom 50. ovog zakona;

4) poštuje uslove za poveravanje obrade drugom obrađivaču iz st. 2. i 7. ovog člana;

5) uzimajući u obzir prirodu obrade, pomaže rukovaocu primenom odgovarajućih tehničkih, organizacionih i kadrovskih mera, koliko je to moguće, u ispunjavanju obaveza rukovaoca u odnosu na zahteve za ostvarivanje prava lica na koje se podaci odnose iz Glave III. ovog zakona;

6) pomaže rukovaocu u ispunjavanju obaveza iz člana 50. i čl. 52. do 55. ovog zakona, uzimajući u obzir prirodu obrade i informacije koje su mu dostupne;

7) posle okončanja ugovorenih radnji obrade, a na osnovu odluke rukovaoca, izbriše ili vrati rukovaocu sve podatke o ličnosti i izbriše sve kopije ovih podataka, osim ako je zakonom propisana obaveza čuvanja podataka;

8) učini dostupnim rukovaocu sve informacije koje su neophodne za predočavanje ispunjenosti obaveza obrađivača propisanih ovim članom, kao i informacije koje omogućavaju i doprinose kontroli rada obrađivača, koju sprovodi rukovalac ili drugo lice koje on za to ovlasti.

U slučaju iz stava 4. tačka 8) ovog člana, obrađivač je dužan da bez odlaganja upozori rukovaoca ako smatra da pismeno uputstvo koje je od njega dobio nije u skladu sa ovim zakonom ili drugim zakonom kojim se uređuje zaštita podataka o ličnosti. |PU | | | | |28.4. |Where a processor engages another processor for carrying out specific processing activities on behalf of the controller, the same data protection obligations as set out in the contract or other legal act between the controller and the processor as referred to in paragraph 3 shall be imposed on that other processor by way of a contract or other legal act under Union or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of this Regulation. Where that other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to the controller for the performance of that other processor’s obligations. |45.7. |Ako obrađivač odredi drugog obrađivača za vršenje posebnih radnji obrade u ime rukovaoca, iste obaveze zaštite podataka o ličnosti propisane ugovorom ili drugim pravno obavezujućim aktom između rukovaoca i obrađivača iz st. 3. i 4. ovog člana obavezuju i tog drugog obrađivača, na osnovu posebnog ugovora ili drugog pravno obavezujućeg akta, koji je zaključen, odnosno usvojen u pismenom obliku, što obuhvata i elektronski oblik, kojim se u odnosu između obrađivača i drugog obrađivača propisuju dovoljne garancije za primenu odgovarajućih tehničkih, organizacionih i kadrovskih mera koje obezbeđuju da se obrada vrši u skladu sa ovim zakonom. Ako drugi obrađivač ne ispuni svoje obaveze u vezi sa zaštitom podataka o ličnosti, za ispunjenje ovih obaveza drugog obrađivača rukovaocu odgovora obrađivač. |PU | | | | |28.5. |Adherence of a processor to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate sufficient guarantees as referred to in paragraphs 1 and 4 of this Article. |45.9. |Primena odobrenog kodeksa postupanja iz člana 59. ovog zakona, odnosno izdatog sertifikata iz člana 61. ovog zakona može se koristiti da se predoči da obrađivač ispunjava obaveze pružanja garancija iz st. 1. i 7. ovog člana.

|PU | | | | |28.6. | Without prejudice to an individual contract between the controller and the processor, the contract or the other legal act referred to in paragraphs 3 and 4 of this Article may be based, in whole or in part, on standard contractual clauses referred to in paragraphs 7 and 8 of this Article, including when they are part of a certification granted to the controller or processor pursuant to Articles 42 and 43. |45.10. |Pravni odnos između rukovaoca i obrađivača koji se uređuje u skladu sa st. 3. i 7. ovog člana, može biti zasnovan u celini ili delimično na standardnim ugovornim klauzulama iz stava 11. ovog člana, uključujući i one koje su vezane za sertifikat koji se odobrava rukovaocu ili obrađivaču u skladu sa čl. 61. i 62. ovog zakona. |PU | | | | |28.7. |The Commission may lay down standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the examination procedure referred to in Article 93(2). | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |28.8. |A supervisory authority may adopt standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the consistency mechanism referred to in Article 63. |45.11. |Poverenik može da izradi standardne ugovorne klauzule koja se odnose na obaveze iz st. 3. i 7. ovog člana, posebno uzimajući u obzir evropsku praksu u izradi standardnih ugovornih klauzula. |PU | | | | |28.9. |The contract or the other legal act referred to in paragraphs 3 and 4 shall be in writing, including in electronic form. |45.7. |Ako obrađivač odredi drugog obrađivača za vršenje posebnih radnji obrade u ime rukovaoca, iste obaveze zaštite podataka o ličnosti propisane ugovorom ili drugim pravno obavezujućim aktom između rukovaoca i obrađivača iz st. 3. i 4. ovog člana obavezuju i tog drugog obrađivača, na osnovu posebnog ugovora ili drugog pravno obavezujućeg akta, koji je zaključen, odnosno usvojen u pismenom obliku, što obuhvata i elektronski oblik, kojim se u odnosu između obrađivača i drugog obrađivača propisuju dovoljne garancije za primenu odgovarajućih tehničkih, organizacionih i kadrovskih mera koje obezbeđuju da se obrada vrši u skladu sa ovim zakonom. Ako drugi obrađivač ne ispuni svoje obaveze u vezi sa zaštitom podataka o ličnosti, za ispunjenje ovih obaveza drugog obrađivača rukovaocu odgovora obrađivač. |PU | | | | |28.10. |Without prejudice to Articles 82, 83 and 84, if a processor infringes this Regulation by determining the purposes and means of processing, the processor shall be considered to be a controller in respect of that processing. |45.8. |Ako obrađivač povredi odredbe ovog zakona određujući svrhu i način obrade podatka o ličnosti, obrađivač se smatra rukovaocem u odnosu na tu obradu.

|PU | | | | |29. |The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law. |46. |Obrađivač, odnosno drugo lice koje je od strane rukovaoca ili obrađivača ovlašćeno za pristup podacima o ličnosti, ne može da obrađuje te podatke bez naloga rukovaoca, osim ako je takva obrada propisana zakonom.

|PU | | | | |30.1. | Each controller and, where applicable, the controller’s representative, shall maintain a record of processing activities under its responsibility. That record shall contain all of the following information:

(a)

the name and contact details of the controller and, where applicable, the joint controller, the controller’s representative and the data protection officer;

(b)

the purposes of the processing;

(c)

a description of the categories of data subjects and of the categories of personal data;

(d)

the categories of recipients to whom the personal data have been or will be disclosed including recipients in third countries or international organisations;

(e)

where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards;

(f)

where possible, the envisaged time limits for erasure of the different categories of data;

(g)

where possible, a general description of the technical and organisational security measures referred to in Article 32(1).

|47.1. |Rukovalac i njegov predstavnik, ako je određen, dužan je da vodi evidenciju o radnjama obrade za koje je odgovoran, a koja sadrži informacije o:

1) imenu i kontakt podacima rukovaoca, zajedničkih rukovaoca, predstavnika rukovaoca i lica za zaštitu podataka o ličnosti, ako oni postoje, odnosno ako su određeni;

2) svrsi obrade;

3) vrsti lica na koje se podaci odnose i vrsti podataka o ličnosti;

4) vrsti primalaca kojima su podaci o ličnosti otkriveni ili će biti otkriveni, uključujući i primaoce u drugim državama ili međunarodnim organizacijama;

5) prenosu podataka o ličnosti u druge države ili međunarodne organizacije, uključujući i naziv druge države ili međunarodne organizacije, kao i dokumente o primeni mera zaštite ako se podaci prenose u skladu sa članom 69. stav 2. ovog zakona, ako se takav prenos podataka o ličnosti vrši;

6) roku posle čijeg isteka se brišu određene vrste podataka o ličnosti, ako je takav rok određen;

7) opštem opisu mera zaštite iz člana 50. stav 1. ovog zakona, ako je to moguće.

|PU | | | | |30.2. |Each processor and, where applicable, the processor’s representative shall maintain a record of all categories of processing activities carried out on behalf of a controller, containing:

(a)

the name and contact details of the processor or processors and of each controller on behalf of which the processor is acting, and, where applicable, of the controller’s or the processor’s representative, and the data protection officer;

(b)

the categories of processing carried out on behalf of each controller;

(c)

(d)

where possible, a general description of the technical and organisational security measures referred to in Article 32(1).

|47.4. |Obrađivač i njegov predstavnik, ako je određen, dužan je da vodi evidenciju o svim vrstama radnji obrade koje se vrše u ime rukovaoca, a koja sadrži informacije o:

1) imenu i kontakt podacima svakog obrađivača i svakog rukovaoca u čije ime se obrada vrši, odnosno predstavnika rukovaoca ili obrađivača i lica za zaštitu podataka o ličnosti, ako oni postoje, odnosno ako su određeni;

2) vrsti obrada koje se vrše u ime svakog rukovaoca;

3) prenosu podataka o ličnosti u druge države ili međunarodne organizacije, uključujući i naziv druge države ili međunarodne organizacije, kao i dokumente o primeni mera zaštite ako se podaci prenose u skladu sa članom 69. stav 2. ovog zakona, ako se takav prenos podataka o ličnosti vrši;

4) opštem opisu mera zaštite iz člana 50. stav 1. ovog zakona, ako je to moguće.

|PU | | | | |30.3. |The records referred to in paragraphs 1 and 2 shall be in writing, including in electronic form. |47.7. |Evidencije iz st. 1, 3, 4. i 6. ovog člana vode se u pismenom obliku, što obuhvata i elektronski oblik i čuvaju se trajno. |PU | | | | |30.4. |The controller or the processor and, where applicable, the controller’s or the processor’s representative, shall make the record available to the supervisory authority on request. |47.8. |Rukovalac ili obrađivač, kao i njihovi predstavnici, ako su određeni, dužni su da evidencije iz st. 1, 3, 4. i 6. ovog člana učine dostupnim Povereniku, na njegov zahtev. |PU | | | | |30.5. |The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10. |47.9. |Odredbe st. 1. i 4. ovog člana ne primenjuju se na privredne subjekte i organizacije u kojima je zaposleno manje od 250 lica, osim ako:

1) obrada koju vrše može da prouzrokuje visok rizik po prava i slobode lica na koje se podaci odnose;

2) obrada nije povremena;

3) obrada obuhvata posebne vrste podataka o ličnosti iz člana 17. stav 1. ovog zakona ili podatke o ličnosti koji se odnose na krivične presude, kažnjiva dela i mere bezbednosti iz člana 19. ovog zakona. |PU | | | | |31. |The controller and the processor and, where applicable, their representatives, shall cooperate, on request, with the supervisory authority in the performance of its tasks. |49. |Rukovalac, obrađivač i njihovi predstavnici, ako su određeni, dužni su da sarađuju sa Poverenikom u vršenju njegovih ovlašćenja. |PU | | | | |32.1. |Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:

(a)

the pseudonymisation and encryption of personal data;

(b)

the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;

(c)

the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;

(d)

a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.

|50.1.

50.2. |U skladu sa nivoom tehnoloških dostignuća i troškovima njihove primene, prirodom, obimom, okolnostima i svrhom obrade, kao i verovatnoćom nastupanja rizika i nivoom rizika za prava i slobode fizičkih lica, rukovalac i obrađivač sprovode odgovarajuće tehničke, organizacione i kadrovske mere kako bi dostigli odgovarajući nivo bezbednosti u odnosu na rizik.

Prema potrebi, mere iz stava 1. ovog člana naročito obuhvataju:

1) pseudonimizaciju i kriptozaštitu podataka o ličnosti;

2) sposobnost obezbeđivanja trajne poverljivosti, integriteta, raspoloživosti i otpornosti sistema i usluga obrade;

3) obezbeđivanje uspostavljanja ponovne raspoloživosti i pristupa podacima o ličnosti u slučaju fizičkih ili tehničkih incidenata u najkraćem roku;

4) postupak redovnog testiranja, ocenjivanja i procenjivanja delotvornosti tehničkih, organizacionih i kadrovskih mera bezbednosti obrade.

|PU | | | | |32.2. |. In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed. |50.3. |Prilikom procenjivanja odgovarajućeg nivoa bezbednosti iz stava 1. ovog člana posebno se uzimaju u obzir rizici obrade, a naročito rizici od slučajnog ili nezakonitog uništenja, gubitka, izmene, neovlašćenog otkrivanja ili pristupa podacima o ličnosti koji su preneseni, pohranjeni ili obrađivani na drugi način. |PU | | | | |32.3. |Adherence to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate compliance with the requirements set out in paragraph 1 of this Article. |50.4. |Primena odobrenog kodeksa postupanja iz člana 59. ovog zakona, odnosno izdat sertifikat iz člana 61. ovog zakona, može se koristiti u cilju predočavanja ispunjenosti obaveza iz stava 1. ovog člana. |PU | | | | |32.4. |The controller and processor shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law. |50.5. |Rukovalac i obrađivač dužni su da preduzmu mere u cilju obezbeđivanja da svako fizičko lice koje je ovlašćeno za pristup podacima o ličnosti od strane rukovaoca ili obrađivača, obrađuje ove podatke samo po nalogu rukovaoca ili ako je na to obavezano zakonom. |PU | | | | |33.1. |In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay. |52.1.

52.2. |Rukovalac je dužan da o povredi podataka o ličnosti koja može da proizvede rizik po prava i slobode fizičkih lica obavesti Poverenika bez nepotrebnog odlaganja, ili, ako je to moguće, u roku od 72 časa od saznanja za povredu.

Ako rukovalac ne postupi u roku od 72 časa od saznanja za povredu, dužan je da obrazloži razloge zbog kojih nije postupio u tom roku.

|PU | | | | |33.2. |The processor shall notify the controller without undue delay after becoming aware of a personal data breach. |52.3. |Obrađivač je dužan da, posle saznanja za povredu podataka o ličnosti, bez nepotrebnog odlaganja obavesti rukovaoca o toj povredi. |PU | | | | |33.3. |The notification referred to in paragraph 1 shall at least:

(a)

describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

(b)

communicate the name and contact details of the data protection officer or other contact point where more information can be obtained;

(c)

describe the likely consequences of the personal data breach;

(d)

describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

|52.4. |Obaveštenje iz stava 1. ovog člana mora da sadrži najmanje sledeće informacije:

1) opis prirode povrede podataka o ličnosti, uključujući vrste podataka i približan broj lica na koje se podaci odnose te vrste, kao i približan broj podataka o ličnosti čija je bezbednost povređena;

2) ime i kontakt podatke lica za zaštitu podataka o ličnosti ili informacije o drugom načinu na koji se mogu dobiti podaci o povredi;

3) opis mogućih posledica povrede;

4) opis mera koje je rukovalac preduzeo ili čije je preduzimanje predloženo u vezi sa povredom, uključujući i mere koje su preduzete u cilju umanjenja štetnih posledica.

|PU | | | | |33.4. |Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay. |52.5. |Ako se sve informacije iz stava 4. ovog člana ne mogu dostaviti istovremeno, rukovalac bez nepotrebnog odlaganja postupno dostavlja dostupne informacije. |PU | | | | |33.5. |The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation shall enable the supervisory authority to verify compliance with this Article. |52.6.

52.7. |Rukovalac je dužan da dokumentuje svaku povredu podataka o ličnosti, uključujući i činjenice o povredi, njenim posledicama i preduzetim merama za njihovo otklanjanje.

Dokumentacija iz stava 6. ovog člana mora omogućiti Povereniku da utvrdi da li je rukovalac postupio u skladu sa odredbama ovog člana. |PU | | | | |34.1. |When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay. |53.1. |Ako povreda podataka o ličnosti može da proizvede visok rizik po prava i slobode fizičkih lica, rukovalac je dužan da bez nepotrebnog odlaganja o povredi obavesti lice na koje se podaci odnose. |PU | | | | |34.2. |The communication to the data subject referred to in paragraph 1 of this Article shall describe in clear and plain language the nature of the personal data breach and contain at least the information and measures referred to in points (b), (c) and (d) of Article 33(3). |53.2. |U obaveštenju iz stava 1. ovog člana rukovalac je dužan da na jasan i razumljiv način opiše prirodu povrede podataka i navede najmanje informacije iz člana 52. stav 4. tač. 2) do 4) ovog zakona.

|PU | | | | |34.3. |The communication to the data subject referred to in paragraph 1 shall not be required if any of the following conditions are met:

(a)

the controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption;

(b)

the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to in paragraph 1 is no longer likely to materialise;

(c)

it would involve disproportionate effort. In such a case, there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner.

|53.3. |Rukovalac nije dužan da obavesti lice iz stava 1. ovog člana ako:

1) je preduzeo odgovarajuće tehničke, organizacione i kadrovske mere zaštite u odnosu na podatke o ličnosti čija je bezbednost povređena, a posebno ako je kriptozaštitom ili drugim merama onemogućio razumljivost podataka svim licima koja nisu ovlašćena za pristup ovim podacima;

2) je naknadno preduzeo mere kojima je obezbedio da povreda podataka o ličnosti sa visokim rizikom za prava i slobode lica na koje se podaci odnose više ne može da proizvede posledice za to lice;

3) bi obaveštavanje lica na koje se podaci odnose predstavljalo nesrazmeran utrošak vremena i sredstava. U tom slučaju, rukovalac je dužan da putem javnog obaveštavanja ili na drugi delotvoran način obezbedi pružanje obaveštenja licu na koje se podaci odnose. |PU | | | | |34.4. |If the controller has not already communicated the personal data breach to the data subject, the supervisory authority, having considered the likelihood of the personal data breach resulting in a high risk, may require it to do so or may decide that any of the conditions referred to in paragraph 3 are met. |53.4. |Ako rukovalac nije obavestio lice na koje se podaci odnose o povredi podataka o ličnosti, Poverenik može, uzimajući u obzir mogućnost da povreda podataka proizvede visok rizik, da naloži rukovaocu da to učini ili može da utvrdi da su ispunjeni uslovi iz stava 3. ovog člana. |PU | | | | |35.1. |Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. A single assessment may address a set of similar processing operations that present similar high risks. |54.1.

54.2. |Ako je verovatno da će neka vrsta obrade, posebno upotrebom novih tehnologija i uzimajući u obzir prirodu, obim, okolnosti i svrhu obrade, prouzrokovati visok rizik za prava i slobode fizičkih lica, rukovalac je dužan da pre nego što započne sa obradom izvrši procenu uticaja predviđenih radnji obrade na zaštitu podataka o ličnosti.

Ako više sličnih radnji obrade mogu prouzrokovati slične visoke rizike za zaštitu podataka o ličnosti, može se izvršiti zajednička procena. |PU | | | | |35.2. |The controller shall seek the advice of the data protection officer, where designated, when carrying out a data protection impact assessment. |54.3. |Prilikom procene uticaja rukovalac je dužan da zatraži mišljenje lica za zaštitu podataka o ličnosti, ako je ono određeno.

|PU | | | | |35.3. |A data protection impact assessment referred to in paragraph 1 shall in particular be required in the case of:

(a)

a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person;

(b)

processing on a large scale of special categories of data referred to in Article 9(1), or of personal data relating to criminal convictions and offences referred to in Article 10; or

(c)

a systematic monitoring of a publicly accessible area on a large scale.

|54.4. |Procena uticaja iz stava 1. ovog člana obavezno se vrši u slučaju:

1) sistematske i sveobuhvatne procene stanja i osobina fizičkog lica koja se vrši pomoću automatizovane obrade podataka o ličnosti, uključujući i profilisanje, na osnovu koje se donose odluke od značaja za pravni položaj pojedinca ili na sličan način značajno utiču na njega;

2) obrade posebnih vrsta podataka o ličnosti iz člana 17. stav 1. i člana 18. stav 1. ili podataka o ličnosti u vezi sa krivičnim presudama i kažnjivim delima iz člana 19. ovog zakona, u velikom obimu;

3) sistematskog nadzora nad javno dostupnim površinama u velikoj meri. |PU | | | | |35.4. |The supervisory authority shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1. The supervisory authority shall communicate those lists to the Board referred to in Article 68. |54.5. |Poverenik je dužan da sačini i javno objavi na svojoj internet stranici listu vrsta radnji obrade za koje se mora izvršiti procena uticaja iz stava 1. ovog člana, a može da sačini i objavi i listu vrsta radnji obrade za koje procena nije potrebna.

|PU

NP |

Druga rečenica je neprenosiva. Propisane obaveze se odnose na države članice Evropske unije. | | | |35.5. |The supervisory authority may also establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. The supervisory authority shall communicate those lists to the Board. |54.5. |Poverenik je dužan da sačini i javno objavi na svojoj internet stranici listu vrsta radnji obrade za koje se mora izvršiti procena uticaja iz stava 1. ovog člana, a može da sačini i objavi i listu vrsta radnji obrade za koje procena nije potrebna.

|PU

Druga rečenica je neprenosiva. Propisane obaveze se odnose na države članice Evropske unije. | | | |35.6. |Prior to the adoption of the lists referred to in paragraphs 4 and 5, the competent supervisory authority shall apply the consistency mechanism referred to in Article 63 where such lists involve processing activities which are related to the offering of goods or services to data subjects or to the monitoring of their behaviour in several Member States, or may substantially affect the free movement of personal data within the Union. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |35.7. | The assessment shall contain at least:

(a)

a systematic description of the envisaged processing operations and the purposes of the processing, including, where applicable, the legitimate interest pursued by the controller;

(b)

an assessment of the necessity and proportionality of the processing operations in relation to the purposes;

(c)

an assessment of the risks to the rights and freedoms of data subjects referred to in paragraph 1;

and

(d)

the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation taking into account the rights and legitimate interests of data subjects and other persons concerned.

|54.6. |Procena uticaja najmanje mora da sadrži:

1) sveobuhvatan opis predviđenih radnji obrade i svrhu obrade, uključujući i opis legitimnog interesa rukovaoca, ako on postoji;

2) procenu neophodnosti i srazmernosti vršenja radnji obrade u odnosu na svrhe obrade;

3) procenu rizika za prava i slobode lica na koje se podaci odnose iz stava 1. ovog člana;

4) opis mera koje se nameravaju preduzeti u odnosu na postojanje rizika, uključujući mehanizme zaštite, kao i tehničke, organizacione i kadrovske mere u cilju zaštite podatka o ličnosti i obezbeđivanja dokaza o poštovanju odredbi ovog zakona, uzimajući u obzir prava i legitimne interese lica na koje se podaci odnose i drugih lica. |PU | | | | |35.8. |Compliance with approved codes of conduct referred to in Article 40 by the relevant controllers or processors shall be taken into due account in assessing the impact of the processing operations performed by such controllers or processors, in particular for the purposes of a data protection impact assessment. |54.9. |Primena odobrenog kodeksa postupanja iz člana 59. ovog zakona od strane rukovaoca ili obrađivača mora se uzeti u obzir prilikom procene uticaja radnji obrade na zaštitu podataka o ličnosti.

|PU | | | | |35.9. |Where appropriate, the controller shall seek the views of data subjects or their representatives on the intended processing, without prejudice to the protection of commercial or public interests or the security of processing operations. |54.11. |Prema potrebi, rukovalac od lica na koje se podaci odnose ili njihovih predstavnika traži mišljenje o radnjama obrade koje namerava da vrši, ne dovodeći u pitanje zaštitu poslovnih ili javnih interesa ili bezbednost radnji obrade. |PU | | | | |35.10. |Where processing pursuant to point (c) or (e) of Article 6(1) has a legal basis in Union law or in the law of the Member State to which the controller is subject, that law regulates the specific processing operation or set of operations in question, and a data protection impact assessment has already been carried out as part of a general impact assessment in the context of the adoption of that legal basis, paragraphs 1 to 7 shall not apply unless Member States deem it to be necessary to carry out such an assessment prior to processing activities. |54.12. |Ako se posebnim zakonom propisuju pojedine radnje obrade, odnosno grupe radnji obrade, a obrada se vrši u skladu sa članom 12. stav 1. tačka 3) ili tačka 5) ovog zakona, pa je procena uticaja na zaštitu podataka o ličnosti već izvršena u okviru opšte procene uticaja prilikom donošenja zakona, st. 1. do 9. ovog člana se ne primenjuje, osim ako se utvrdi da je neophodno izvršiti novu procenu. |PU | | | | |35.11. |Where necessary, the controller shall carry out a review to assess if processing is performed in accordance with the data protection impact assessment at least when there is a change of the risk represented by processing operations. |54.13. |Prema potrebi, a najmanje u slučaju kad je došlo do promene nivoa rizika u vezi sa radnjama obrade, rukovalac je dužan da preispita da li se radnje obrada vrši u skladu sa izvršenom procenom uticaja na zaštitu podataka o ličnosti. |PU | | | | |36.1. |The controller shall consult the supervisory authority prior to processing where a data protection impact assessment under Article 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk. |55.1. |Ako procena uticaja na zaštitu podataka o ličnosti koja je izvršena u skladu sa članom 54. ovog zakona ukazuje da će nameravane radnje obrade proizvesti visok rizik ako se ne preduzmu mere za umanjenje rizika, rukovalac je dužan da zatraži mišenje Poverenika pre započinjanja radnje obrade. |PU | | | | |36.2. |Where the supervisory authority is of the opinion that the intended processing referred to in paragraph 1 would infringe this Regulation, in particular where the controller has insufficiently identified or mitigated the risk, the supervisory authority shall, within period of up to eight weeks of receipt of the request for consultation, provide written advice to the controller and, where applicable to the processor, and may use any of its powers referred to in Article 58. That period may be extended by six weeks, taking into account the complexity of the intended processing. The supervisory authority shall inform the controller and, where applicable, the processor, of any such extension within one month of receipt of the request for consultation together with the reasons for the delay. Those periods may be suspended until the supervisory authority has obtained information it has requested for the purposes of the consultation. |55.4.

55.5.

55.6. |Ako Poverenik smatra da bi nameravane radnje obrade iz st. 1. i 3. ovog člana mogle da povrede odredbe ovog zakona, a posebno ako rukovalac nije na odgovarajući način procenio ili umanjio rizik, Poverenik je dužan da u roku od 60 dana od dana prijema zahteva dostavi pismeno mišljenje rukovaocu ili obrađivaču, ako je on podneo zahtev, kao i da po potrebi iskoristi ovlašćenja iz člana 79. ovog zakona.

Rok iz stava 4. ovog člana može se produžiti za 45 dana uzimajući u obzir složenost nameravanih radnji obrade, a Poverenik je dužan da o odlaganju i razlozima za odlaganje davanja mišljenja upozna rukovaoca ili obrađivača, ako je on podneo zahtev, u roku od 30 dana od prijema zahteva za mišljenje.

Rokovi iz st. 4. i 5. ovog člana ne teku dok Poverenik ne dobije sve tražene informacije koje su neophodne za davanje mišljenja. |PU | | | | |36.3. |When consulting the supervisory authority pursuant to paragraph 1, the controller shall provide the supervisory authority with:

(a)

where applicable, the respective responsibilities of the controller, joint controllers and processors involved in the processing, in particular for processing within a group of undertakings;

(b)

the purposes and means of the intended processing;

(c)

the measures and safeguards provided to protect the rights and freedoms of data subjects pursuant to this Regulation;

(d)

where applicable, the contact details of the data protection officer;

(e)

the data protection impact assessment provided for in Article 35; and

(f)

any other information requested by the supervisory authority.

|55.7. |Uz zahtev za mišljenje, rukovalac je dužan da Povereniku dostavi podatke o:

1) dužnostima rukovaoca, i, ako postoje, zajedničkih rukovaoca i obrađivača koji učestvuju u obradi, posebno ako se radi o obradi koja se vrši unutar grupe privrednih subjekata;

2) svrhama i načinima nameravane obrade;

3) tehničkim, organizacionim i kadrovskim merama, kao i mehanizmima zaštite prava i sloboda lica na koje se podaci odnose u skladu sa ovim zakonom;

4) kontakt podacima lica za zaštitu podataka, ako je ono određeno;

5) proceni uticaja na zaštitu podataka o ličnosti iz člana 54. ovog zakona;

6) svim drugim informacijama koje zatraži Poverenik.

|PU | | | | |36.4. |Member States shall consult the supervisory authority during the preparation of a proposal for a legislative measure to be adopted by a national parliament, or of a regulatory measure based on such a legislative measure, which relates to processing. |55.11. |Organi vlasti koji predlažu usvajanje zakona i drugih propisa zasnovanih na zakonima, a koji sadrže odredbe o obradi podataka o ličnosti, dužni su da u toku njihove pripreme zatraže mišljenje Poverenika.

|PU | | | | |36.5. |Notwithstanding paragraph 1, Member State law may require controllers to consult with, and obtain prior authorisation from, the supervisory authority in relation to processing by a controller for the performance of a task carried out by the controller in the public interest, including processing in relation to social protection and public health. | | |NP |Odredba nije preuzeta, jer nije obavezujuća | | | |37.1. |The controller and the processor shall designate a data protection officer in any case where:

(a)

the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;

(b)

the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or

(c)

the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10.

|56.2. |Rukovalac i obrađivač dužni su da odrede lice za zaštitu podataka o ličnosti ako se:

1) obrada vrši od strane organa vlasti, osim ako se radi o obradi koju vrši sud u svrhu obavljanja njihovih sudskih ovlašćenja;

2) osnovne aktivnosti rukovaoca ili obrađivača sastoje u radnjama obrade koje po svojoj prirodi, obimu, odnosno svrhama zahtevaju redovan i sistematski nadzor velikog broja lica na koje se podaci odnose;

3) osnovne aktivnosti rukovaoca ili obrađivača sastoje u obradi posebnih vrsta podataka o ličnosti iz člana 17. stav 1. ili podataka o ličnosti u vezi sa krivičnim presudama i kažnjivim delima iz člana 19. ovog zakona, u velikom obimu. |PU | | | | |37.2. |A group of undertakings may appoint a single data protection officer provided that a data protection officer is easily accessible from each establishment. |56.5. |Grupa privrednih subjekata može odrediti zajedničko lice za zaštitu podataka o ličnosti, pod uslovom da je ovo lice jednako dostupno svakom članu grupe. |PU | | | | |37.3. |Where the controller or the processor is a public authority or body, a single data protection officer may be designated for several such authorities or bodies, taking account of their organisational structure and size. |56.6. |Ako su rukovaoci ili obrađivači organi vlasti ili nadležni organi, može se odrediti zajedničko lice za zaštitu podataka o ličnosti, uzimajući u obzir organizacionu strukturu i veličinu tih organa vlasti. |PU | | | | |37.4. |In cases other than those referred to in paragraph 1, the controller or processor or associations and other bodies representing categories of controllers or processors may or, where required by Union or Member State law shall, designate a data protection officer. The data protection officer may act for such associations and other bodies representing controllers or processors. |56.7. |Posebnim zakonom može se propisati da rukovaoci, odnosno obrađivači ili njihova udruženja koja ih predstavljaju, moraju odrediti lice za zaštitu podataka o ličnosti. |PU

| | | | |37.5. |The data protection officer shall be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39. |56.8. |Lice za zaštitu podataka o ličnosti određuje se na osnovu njegovih stručnih kvalifikacija, a naročito stručnog znanja i iskustva u oblasti zaštite podataka o ličnosti, kao i sposobnosti za izvršavanje obaveza iz člana 58. ovog zakona. |PU | | | | |37.6. |The data protection officer may be a staff member of the controller or processor, or fulfil the tasks on the basis of a service contract. |56.9. |Lice za zaštitu podataka o ličnosti može biti zaposleno kod rukovaoca ili obrađivača ili može obavljati poslove na osnovu ugovora. |PU | | | | |37.7. |The controller or the processor shall publish the contact details of the data protection officer and communicate them to the supervisory authority. |56.10. |Rukovalac ili obrađivač dužan je da objavi kontakt podatke lica za zaštitu podataka o ličnosti i dostavi ih Povereniku.

|PU | | | | |38.1. |The controller and the processor shall ensure that the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of personal data. |57.1. |Rukovalac i obrađivač dužni su da blagovremeno i na odgovarajući način uključe lice za zaštitu podataka o ličnosti u sve poslove koji se odnose na zaštitu podataka o ličnosti. |PU | | | | |38.2. |The controller and processor shall support the data protection officer in performing the tasks referred to in Article 39 by providing resources necessary to carry out those tasks and access to personal data and processing operations, and to maintain his or her expert knowledge. |57.2. |Rukovalac i obrađivač dužni su da omoguće licu za zaštitu podataka o ličnosti izvršavanje obaveza iz člana 58. ovog zakona na taj način što mu obezbeđuju neophodna sredstva za izvršavanje ovih obaveza, pristup podacima o ličnosti i radnjama obrade, kao i njegovo stručno usavršavanje. |PU | | | | |38.3. |The controller and processor shall ensure that the data protection officer does not receive any instructions regarding the exercise of those tasks. He or she shall not be dismissed or penalised by the controller or the processor for performing his tasks. The data protection officer shall directly report to the highest management level of the controller or the processor. |57.3.

57.4.

57.5. |Rukovalac i obrađivač dužni su da obezbede nezavisnost lica za zaštitu podataka o ličnosti u izvršavanju njegovih obaveza.

Rukovalac ili obrađivač ne mogu kazniti lice za zaštitu podataka o ličnosti, niti raskinuti radni odnos, odnosno ugovor sa njim zbog izvršavanja obaveza iz člana 58. ovog zakona.

Za izvršavanje obaveza iz člana 58. ovog zakona lice za zaštitu podataka o ličnosti neposredno je odgovorno rukovodiocu rukovaoca ili obrađivača.

|PU | | | | |38.4. | Data subjects may contact the data protection officer with regard to all issues related to processing of their personal data and to the exercise of their rights under this Regulation. |57.6 |Lica na koje se podaci odnose mogu se obratiti licu za zaštitu podataka o ličnosti u vezi sa svim pitanjima koje se odnose na obradu svojih podatka o ličnosti, kao i u vezi sa ostvarivanjem svojih prava propisanih ovim zakonom. |PU | | | | |38.5. |The data protection officer shall be bound by secrecy or confidentiality concerning the performance of his or her tasks, in accordance with Union or Member State law. |57.7. |Lice za zaštitu podataka o ličnosti dužno je da čuva tajnost, odnosno poverljivost podataka do kojih je došlo u izvršavanju obaveza iz člana 58. ovog zakona, u skladu sa zakonom. |PU | | | | |38.6. |The data protection officer may fulfil other tasks and duties. The controller or processor shall ensure that any such tasks and duties do not result in a conflict of interests. |57.8. |Lice za zaštitu podataka o ličnosti može da obavlja druge poslove i izvršava druge obaveze, a rukovalac ili obrađivač dužni su da obezbede da izvršavanje drugih poslova i obaveza ne dovede lice za zaštitu podataka o ličnosti u sukob interesa. |PU | | | | |39.1. |The data protection officer shall have at least the following tasks:

(a)

to inform and advise the controller or the processor and the employees who carry out processing of their obligations pursuant to this Regulation and to other Union or Member State data protection provisions;

(b)

to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits;

(c)

to provide advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 35;

(d)

to cooperate with the supervisory authority;

(e)

to act as the contact point for the supervisory authority on issues relating to processing, including the prior consultation referred to in Article 36, and to consult, where appropriate, with regard to any other matter.

|58.1. |Lice za zaštitu podataka o ličnosti ima najmanje obavezu da:

1) informiše i daje mišljenje rukovaocu ili obrađivaču, kao i zaposlenima koji vrše radnje obrade o njihovim zakonskim obavezama u vezi sa zaštitom podataka o ličnosti;

2) prati primenu odredbi ovog zakona, drugih zakona i internih propisa rukovaoca ili obrađivača koji se odnose na zaštitu podataka o ličnosti, uključujući i pitanja podele odgovornosti, podizanja svesti i obuke zaposlenih koji učestvuju u radnjama obrade, kao i kontrole;

3) daje mišljenje, kada se to zatraži, o proceni uticaja obrade na zaštitu podataka o ličnosti i prati postupanje po toj proceni, u skladu sa članom 54. ovog zakona;

4) sarađuje sa Poverenikom, predstavlja kontakt tačku za saradnju sa Poverenikom i savetuje se sa njim u vezi sa pitanjima koje se odnose na obradu, uključujući i obaveštavanje i pribavljanje mišljenja iz člana 55. ovog zakona.

|PU | | | | |39.2. |The data protection officer shall in the performance of his or her tasks have due regard to the risk associated with processing operations, taking into account the nature, scope, context and purposes of processing. |58.2. |U izvršavanju svojih obaveza lice za zaštitu podataka o ličnosti dužno je da posebno vodi računa o riziku koji se odnosi na radnje obrade, uzimajući u obzir prirodu, obim, okolnosti i svrhe obrade. |PU | | | | |40.1. |The Member States, the supervisory authorities, the Board and the Commission shall encourage the drawing up of codes of conduct intended to contribute to the proper application of this Regulation, taking account of the specific features of the various processing sectors and the specific needs of micro, small and medium-sized enterprises. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |40.2. |Associations and other bodies representing categories of controllers or processors may prepare codes of conduct, or amend or extend such codes, for the purpose of specifying the application of this Regulation, such as with regard to:

(a)

fair and transparent processing;

(b)

the legitimate interests pursued by controllers in specific contexts;

(c)

the collection of personal data;

(d)

the pseudonymisation of personal data;

(e)

the information provided to the public and to data subjects;

(f)

the exercise of the rights of data subjects;

(g)

the information provided to, and the protection of, children, and the manner in which the consent of the holders of parental responsibility over children is to be obtained;

(h)

the measures and procedures referred to in Articles 24 and 25 and the measures to ensure security of processing referred to in Article 32;

(i)

the notification of personal data breaches to supervisory authorities and the communication of such personal data breaches to data subjects;

(j)

the transfer of personal data to third countries or international organisations; or

(k)

out-of-court proceedings and other dispute resolution procedures for resolving disputes between controllers and data subjects with regard to processing, without prejudice to the rights of data subjects pursuant to Articles 77 and 79.

|59.1. |Udruženja i drugi subjekti koji predstavljaju grupe rukovaoca ili obrađivača mogu izraditi kodeks postupanja u cilju efikasnije primene ovog zakona, a naročito u pogledu:

1) poštene i transparentne obrade;

2) legitimnih interesa rukovaoca, uzimajući u obzir okolnosti konkretnih slučajeva;

3) prikupljanja podataka o ličnosti;

4) pseudonimizacije podataka o ličnosti;

5) informacija koje se pružaju javnosti i licima na koje se podaci odnose;

6) ostvarivanja prava lica na koje se podaci odnose;

7) informacija koje se pružaju maloletnim licima, njihovoj zaštiti, kao i načina na koji se pribavlja pristanak roditelja koji vrši roditeljsko pravo;

8) mera i postupaka iz čl. 41. i 42. ovog zakona, kao i mera koje imaju za cilj bezbednost obrade iz člana 50. ovog zakona;

9) obaveštavanja Poverenika o povredi podataka o ličnosti, kao i informisanja lica na koje se podaci odnose o takvim povredama;

10) prenosa podataka o ličnosti u druge države ili međunarodne organizacije;

11) načina rešavanja sporova između rukovaoca i lica na koje se podaci odnose mirnim putem, što ne utiče na ostvarivanja prava lica na koje se podaci odnose iz čl. 82. i 84. ovog zakona.

|PU | | | | |40.3. |In addition to adherence by controllers or processors subject to this Regulation, codes of conduct approved pursuant to paragraph 5 of this Article and having general validity pursuant to paragraph 9 of this Article may also be adhered to by controllers or processors that are not subject to this Regulation pursuant to Article 3 in order to provide appropriate safeguards within the framework of personal data transfers to third countries or international organisations under the terms referred to in point (e) of Article 46(2). Such controllers or processors shall make binding and enforceable commitments, via contractual or other legally binding instruments, to apply those appropriate safeguards including with regard to the rights of data subjects. |59.2. |Rukovaoci, odnosno obrađivači na koje se ovaj zakon ne primenjuje, u cilju obezbeđivanja odgovarajućih mera zaštite lica na koje se podaci odnose u okviru prenosa njihovih podataka o ličnosti u druge države ili međunarodne organizacije na osnovu člana 65. stav 2. tačka 3) ovog zakona, mogu prihvatiti ili se obavezati na primenu kodeksa postupanja koji je odobren u skladu sa stavom 5. ovog člana, putem ugovornih ili drugih pravno obavezujućih akata kojima se obavezuju na primenu tih mera zaštite, a posebno u odnosu na prava lica na koje se podaci odnose. |PU | | | | |40.4. |A code of conduct referred to in paragraph 2 of this Article shall contain mechanisms which enable the body referred to in Article 41(1) to carry out the mandatory monitoring of compliance with its provisions by the controllers or processors which undertake to apply it, without prejudice to the tasks and powers of supervisory authorities competent pursuant to Article 55 or 56. |59.3. |Kodeks postupanja iz stava 1. ovog člana obavezno sadrži odredbe koje omogućavaju licu iz člana 60. stav 1. ovog zakona vršenje nadzora nad primenom kodeksa od strane rukovaoca ili obrađivača koji su se obavezali na primenu kodeksa, što ne utiče na inspekcijska i druga ovlašćenja Poverenika iz čl. 77. do 79. ovog zakona.

|PU | | | | |40.5. |Associations and other bodies referred to in paragraph 2 of this Article which intend to prepare a code of conduct or to amend or extend an existing code shall submit the draft code, amendment or extension to the supervisory authority which is competent pursuant to Article 55. The supervisory authority shall provide an opinion on whether the draft code, amendment or extension complies with this Regulation and shall approve that draft code, amendment or extension if it finds that it provides sufficient appropriate safeguards. |59.4.

59.5. |Udruženja i drugi subjekti iz stava 1. ovog člana koji nameravaju da izrade kodeks postupanja ili da izmene postojeći kodeks, dužni su da predlog kodeksa ili njegovih izmena dostave Povereniku na mišljenje.

Poverenik daje mišljenje o usklađenosti predloga kodeksa postupanja ili njegovih izmena sa odredbama ovog zakona, a ako utvrdi da predlog kodeksa sadrži dovoljne garancije za zaštitu podataka o ličnosti, kodeks postupanja ili njegove izmene registruje i javno objavljuje na svojoj internet stranici. |PU | | | | |40.6. |Where the draft code, or amendment or extension is approved in accordance with paragraph 5, and where the code of conduct concerned does not relate to processing activities in several Member States, the supervisory authority shall register and publish the code.

|59.5. |Poverenik daje mišljenje o usklađenosti predloga kodeksa postupanja ili njegovih izmena sa odredbama ovog zakona, a ako utvrdi da predlog kodeksa sadrži dovoljne garancije za zaštitu podataka o ličnosti, kodeks postupanja ili njegove izmene registruje i javno objavljuje na svojoj internet stranici. |PU | | | | |40.7. |Where a draft code of conduct relates to processing activities in several Member States, the supervisory authority which is competent pursuant to Article 55 shall, before approving the draft code, amendment or extension, submit it in the procedure referred to in Article 63 to the Board which shall provide an opinion on whether the draft code, amendment or extension complies with this Regulation or, in the situation referred to in paragraph 3 of this Article, provides appropriate safeguards. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |40.8. |Where the opinion referred to in paragraph 7 confirms that the draft code, amendment or extension complies with this Regulation, or, in the situation referred to in paragraph 3, provides appropriate safeguards, the Board shall submit its opinion to the Commission. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |40.9. |The Commission may, by way of implementing acts, decide that the approved code of conduct, amendment or extension submitted to it pursuant to paragraph 8 of this Article have general validity within the Union. Those implementing acts shall be adopted in accordance with the examination procedure set out in Article 93(2). | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |40.10. |The Commission shall ensure appropriate publicity for the approved codes which have been decided as having general validity in accordance with paragraph 9. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |40.11. |The Board shall collate all approved codes of conduct, amendments and extensions in a register and shall make them publicly available by way of appropriate means. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |41.1. |Without prejudice to the tasks and powers of the competent supervisory authority under Articles 57 and 58, the monitoring of compliance with a code of conduct pursuant to Article 40 may be carried out by a body which has an appropriate level of expertise in relation to the subject-matter of the code and is accredited for that purpose by the competent supervisory authority.

|60.1.

60.2. |Kontrolu primene kodeksa postupanja, u skladu sa članom 59. stav 3. ovog zakona, može vršiti pravno lice koje je akreditovano za vršenje kontrole u skladu sa zakonom koji uređuje akreditaciju.

Vršenje kontrole iz stava 1. ovog člana ne utiče na inspekcijska i druga ovlašćenja Poverenika iz čl. 77. do 79. ovog zakona. |PU | | | | |41.2. |A body as referred to in paragraph 1 may be accredited to monitor compliance with a code of conduct where that body has:

(a)

demonstrated its independence and expertise in relation to the subject-matter of the code to the satisfaction of the competent supervisory authority;

(b)

established procedures which allow it to assess the eligibility of controllers and processors concerned to apply the code, to monitor their compliance with its provisions and to periodically review its operation;

(c)

established procedures and structures to handle complaints about infringements of the code or the manner in which the code has been, or is being, implemented by a controller or processor, and to make those procedures and structures transparent to data subjects and the public; and

(d)

demonstrated to the satisfaction of the competent supervisory authority that its tasks and duties do not result in a conflict of interests.

|60.3. |Pravno lice iz stava 1. ovog člana može se akreditovati samo ako je:

1) dokazalo Povereniku svoju nezavisnost i stručnost u odnosu na sadržinu kodeksa;

2) uspostavilo postupak procene osposobljenosti rukovaoca i obrađivača za primenu kodeksa postupanja, praćenja primene kodeksa od strane rukovaoca ili obrađivača, kao i periodičnog preispitivanje njegove delotvornosti;

3) uspostavilo postupak i organ za odlučivanje o pritužbama zbog povrede kodeksa postupanja ili načina njegove primene od strane rukovaoca ili obrađivača, kao i obezbedilo transparentnost tog postupka i organa prema javnosti i licima na koje se podaci odnose;

4) dokazalo Povereniku da u vršenju njegovih ovlašćenja ne može doći do sukoba interesa.

|PU | | | | |41.3. |The competent supervisory authority shall submit the draft criteria for accreditation of a body as referred to in paragraph 1 of this Article to the Board pursuant to the consistency mechanism referred to in Article 63. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |41.4. |Without prejudice to the tasks and powers of the competent supervisory authority and the provisions of Chapter VIII, a body as referred to in paragraph 1 of this Article shall, subject to appropriate safeguards, take appropriate action in cases of infringement of the code by a controller or processor, including suspension or exclusion of the controller or processor concerned from the code. It shall inform the competent supervisory authority of such actions and the reasons for taking them.

|60.4.

60.5.

60.6. |U slučaju povrede kodeksa postupanja od strane rukovaoca ili obrađivača, pravno lice iz stava 1. ovog člana preduzima odgovarajuće mere u propisanom postupku, uključujući i privremeno ili trajno isključenje rukovaoca, odnosno obrađivača iz primene kodeksa.

Pravno lice iz stava 1. ovog člana dužno je da obavesti Poverenika o preduzetim merama iz stava 4. ovog člana, kao i razlozima za njihovo određivanje.

Preduzimanje mera iz stava 4. ovog člana ne utiče na ovlašćenja Poverenika i primenu odredbi Glave VII. ovog zakona. |PU | | | | |41.5. |The competent supervisory authority shall revoke the accreditation of a body as referred to in paragraph 1 if the conditions for accreditation are not, or are no longer, met or where actions taken by the body infringe this Regulation. |60.7. |Pravnom licu iz stava 1. ovog člana akreditacija se oduzima ako se utvrdi da ono više ne ispunjava uslove za akreditaciju ili da mere koje ono preduzima krše odredbe ovog zakona. |PU | | | | |41.6. |This Article shall not apply to processing carried out by public authorities and bodies.

|60.8. |Odredbe st. 1. do 7. ovog člana ne primenjuju se na organe vlasti i obradu koju vrše nadležni organi u posebne svrhe. |PU | | | | |42.1. |The Member States, the supervisory authorities, the Board and the Commission shall encourage, in particular at Union level, the establishment of data protection certification mechanisms and of data protection seals and marks, for the purpose of demonstrating compliance with this Regulation of processing operations by controllers and processors. The specific needs of micro, small and medium-sized enterprises shall be taken into account. |61.1. |U cilju dokazivanja poštovanja odredbi ovog zakona od strane rukovaoca i obrađivača, a posebno uzimajući u obzir potrebe malih i srednjih preduzeća, mogu se ustanoviti postupci izdavanja sertifikata o zaštiti podataka o ličnosti, sa odgovarajućim žigovima i oznakama za zaštitu podataka.

|PU | | | | |42.2. | In addition to adherence by controllers or processors subject to this Regulation, data protection certification mechanisms, seals or marks approved pursuant to paragraph 5 of this Article may be established for the purpose of demonstrating the existence of appropriate safeguards provided by controllers or processors that are not subject to this Regulation pursuant to Article 3 within the framework of personal data transfers to third countries or international organisations under the terms referred to in point (f) of Article 46(2). Such controllers or processors shall make binding and enforceable commitments, via contractual or other legally binding instruments, to apply those appropriate safeguards, including with regard to the rights of data subjects. |61.2. |Rukovaocu, odnosno obrađivaču na koje se ovaj zakon ne primenjuje, u cilju dokazivanja preduzimanja mera zaštite od strane rukovaoca i obrađivača, a u okviru prenosa njihovih podataka o ličnosti u druge države ili međunarodne organizacije na osnovu člana 65. stav 2. tačka 5) ovog zakona, može se izdati sertifikat, sa odgovarajućem žigovima i oznakama, u skladu sa stavom 5. ovog člana, pod uslovom da oni putem ugovora ili drugog pravno obavezujućeg akta prihvate primenu ovih mera zaštite, uključujući i zaštitu prava lica na koje se podaci odnose.

|PU | | | | |42.3. |The certification shall be voluntary and available via a process that is transparent. |61.3. |Postupak izdavanja sertifikata je dobrovoljan i transparentan. |PU | | | | |42.4. |A certification pursuant to this Article does not reduce the responsibility of the controller or the processor for compliance with this Regulation and is without prejudice to the tasks and powers of the supervisory authorities which are competent pursuant to Article 55 or 56. |61.4. |Postojanje izdatog sertifikata ne može uticati na zakonske obaveze rukovaoca i obrađivača, niti na inspekcijska i druga ovlašćenja Poverenika iz čl. 77. do 79. ovog zakona. |PU | | | | |42.5. | A certification pursuant to this Article shall be issued by the certification bodies referred to in Article 43 or by the competent supervisory authority, on the basis of criteria approved by that competent supervisory authority pursuant to Article 58(3) or by the Board pursuant to Article 63. Where the criteria are approved by the Board, this may result in a common certification, the European Data Protection Seal. |61.5. |Sertifikat izdaje sertifikaciono telo iz člana 62. ovog zakona ili Poverenik, na osnovu kriterijuma koje propisuje Poverenik, u skladu sa ovlašćenjima iz člana 79. stav 3. ovog zakona. |PU | | | | |42.6. |The controller or processor which submits its processing to the certification mechanism shall provide the certification body referred to in Article 43, or where applicable, the competent supervisory authority, with all information and access to its processing activities which are necessary to conduct the certification procedure. |61.6. |Rukovalac i obrađivač koji zahtevaju izdavanje sertifikata dužni su da sertifikacionom telu iz člana 62. ovog zakona, odnosno Povereniku, ako je zahtev upućen njemu, omoguće pristup radnjama obrade i pruže sve informacije o obradi koje su neophodne za sprovođenje postupka izdavanja sertifikata. |PU | | | | |42.7. |Certification shall be issued to a controller or processor for a maximum period of three years and may be renewed, under the same conditions, provided that the relevant requirements continue to be met. Certification shall be withdrawn, as applicable, by the certification bodies referred to in Article 43 or by the competent supervisory authority where the requirements for the certification are not or are no longer met.

|61.7.

61.8. |Sertifikat se izdaje rukovaocu i obrađivaču na period koji ne može biti duži od tri godine, a može se obnoviti ako oni i dalje ispunjavaju iste propisane uslove i kriterijumime za izdavanje sertifikata.

Sertifikat iz stava 7. ovog člana ukida se u slučaju kad sertifikaciono telo, odnosno Poverenik, ako je zahtev upućen njemu, utvrdi da rukovalac, odnosno obrađivač više ne ispunjava propisane kriterijume za izdavanje sertifikata.

|PU | | | | |42.8. |The Board shall collate all certification mechanisms and data protection seals and marks in a register and shall make them publicly available by any appropriate means. |61.9. |Poverenik vodi i javno objavljuje na svojoj internet stranici spisak sertifikacionih tela i izdatih sertifikata, sa odgovarajućim žigovima i oznakama.

|PU | | | | |43.1. |Without prejudice to the tasks and powers of the competent supervisory authority under Articles 57 and 58, certification bodies which have an appropriate level of expertise in relation to data protection shall, after informing the supervisory authority in order to allow it to exercise its powers pursuant to point (h) of Article 58(2) where necessary, issue and renew certification. Member States shall ensure that those certification bodies are accredited by one or both of the following:

(a)

the supervisory authority which is competent pursuant to Article 55 or 56;

(b)

the national accreditation body named in accordance with Regulation (EC) No 765/2008 of the European Parliament and of the Council (20) in accordance with EN-ISO/IEC 17065/2012 and with the additional requirements established by the supervisory authority which is competent pursuant to Article 55 or 56.

|62.1. |Sertifikaciono telo, koje ima odgovarajući nivo stručnosti u pogledu zaštite podataka o ličnosti i koje je akreditovano u skladu sa zakonom kojim se uređuje akreditacija, izdaje, obnavlja i ukida sertifikat, zajedno sa žigom i oznakom, posle obaveštavanja Poverenika o odluci koja se namerava doneti, što ne utiče na inspekcijska i druga ovlašćenja Poverenika iz čl. 77. do 79. ovog zakona.

|PU | | | | |43.2. |Certification bodies referred to in paragraph 1 shall be accredited in accordance with that paragraph only where they have:

(a)

demonstrated their independence and expertise in relation to the subject-matter of the certification to the satisfaction of the competent supervisory authority;

(b)

undertaken to respect the criteria referred to in Article 42(5) and approved by the supervisory authority which is competent pursuant to Article 55 or 56 or by the Board pursuant to Article 63;

(c)

established procedures for the issuing, periodic review and withdrawal of data protection certification, seals and marks;

(d)

established procedures and structures to handle complaints about infringements of the certification or the manner in which the certification has been, or is being, implemented by the controller or processor, and to make those procedures and structures transparent to data subjects and the public; and

(e)

demonstrated, to the satisfaction of the competent supervisory authority, that their tasks and duties do not result in a conflict of interests.

|62.2. |Sertifikaciono telo iz stava 1. ovog člana može biti akreditovano samo ako:

1) dokaže Povereniku svoju nezavisnost i stručnost u odnosu na predmet sertifikacije;

2) se obavezalo na poštovanje propisanih kriterijuma iz člana 61. stav 5. ovog zakona;

3) propiše postupak za izdavanje, periodičnu proveru i ukidanje sertifikata, žiga i oznake;

4) propiše postupak i odredi organe za postupanje po pritužbama protiv rukovaoca i obrađivača zbog vršenja radnji obrade na način suprotan izdatom sertifikatu i učini ih dostupnim javnosti i licu na koje se podaci odnose;

5) dokaže Povereniku da u izvršavanju njegovih poslova ne može nastati sukob interesa. |PU | | | | |43.3. |The accreditation of certification bodies as referred to in paragraphs 1 and 2 of this Article shall take place on the basis of criteria approved by the supervisory authority which is competent pursuant to Article 55 or 56 or by the Board pursuant to Article 63. In the case of accreditation pursuant to point (b) of paragraph 1 of this Article, those requirements shall complement those envisaged in Regulation (EC) No 765/2008 and the technical rules that describe the methods and procedures of the certification bodies. |62.3. |Poverenik propisuje kriterijume za akreditaciju sertifikacionog tela, na osnovu uslova iz stava 2. ovog člana.

|PU | | | | |43.4. |The certification bodies referred to in paragraph 1 shall be responsible for the proper assessment leading to the certification or the withdrawal of such certification without prejudice to the responsibility of the controller or processor for compliance with this Regulation. The accreditation shall be issued for a maximum period of five years and may be renewed on the same conditions provided that the certification body meets the requirements set out in this Article. |62.6.

62.4.

|Sertifikaciono telo je odgovorno za pravilnu procenu ispunjenosti kriterijuma za izdavanje, obnavljanje i ukidanje sertifikata i dužno je da Poverenika upozna sa razlozima za izdavanje, obnavljanje ili ukidanje sertifikata.

Akreditacija se izdaje sertifikacionom telu na period do pet godina i može se obnoviti ako sertifikaciono telo i dalje ispunjava propisane uslove i kriterijume za akreditaciju. |PU | | | | |43.5. |The certification bodies referred to in paragraph 1 shall provide the competent supervisory authorities with the reasons for granting or withdrawing the requested certification.

|62.6. |Sertifikaciono telo je odgovorno za pravilnu procenu ispunjenosti kriterijuma za izdavanje, obnavljanje i ukidanje sertifikata i dužno je da Poverenika upozna sa razlozima za izdavanje, obnavljanje ili ukidanje sertifikata. |PU | | | | |43.6. |The requirements referred to in paragraph 3 of this Article and the criteria referred to in Article 42(5) shall be made public by the supervisory authority in an easily accessible form. The supervisory authorities shall also transmit those requirements and criteria to the Board. The Board shall collate all certification mechanisms and data protection seals in a register and shall make them publicly available by any appropriate means. |62.7. |Poverenik objavljuje kriterijume za akreditaciju iz stava 3. ovog člana. |PU | | | | |43.7. |Without prejudice to Chapter VIII, the competent supervisory authority or the national accreditation body shall revoke an accreditation of a certification body pursuant to paragraph 1 of this Article where the conditions for the accreditation are not, or are no longer, met or where actions taken by a certification body infringe this Regulation. |62.5. |Akreditacija sertifikacionog tela se ukida ako se utvrdi da ono više ne ispunjava uslove i kriterijume za akreditaciju ili ako se utvrdi da sertifikaciono telo krši odredbe ovog zakona.

|PU | | | | |43.8. |The Commission shall be empowered to adopt delegated acts in accordance with Article 92 for the purpose of specifying the requirements to be taken into account for the data protection certification mechanisms referred to in Article 42(1). | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |43.9. |The Commission may adopt implementing acts laying down technical standards for certification mechanisms and data protection seals and marks, and mechanisms to promote and recognise those certification mechanisms, seals and marks. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2). | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |44. |Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined. |63.1. |Svaki prenos podataka o ličnosti čija je obrada u toku ili su namenjeni daljoj obradi posle njihovog prenošenja u drugu državu ili međunarodnu organizaciju, može se izvršiti samo ako u skladu sa drugim odredbama ovog zakona rukovalac i obrađivač postupaju u skladu sa uslovima propisanim ovim poglavljem zakona, što obuhvata i dalji prenos podataka o ličnosti iz druge države ili međunarodne organizacije u treću državu ili međunarodnu organizaciju, a u cilju obezbeđivanja primerenog nivoa zaštite fizičkih lica koji je jednak nivou koji garantuje ovaj zakon. |PU | | | | |45.1. |A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection. Such a transfer shall not require any specific authorisation.

|64.1.

64.2. |Prenos podataka o ličnosti u drugu državu, na deo njene teritorije, ili u jedan ili više sektora određenih delatnosti u toj državi ili u međunarodnu organizaciju, bez prethodnog odobrenja, može se izvršiti ako je utvrđeno da ta druga država, deo njene teritorije ili jedan ili više sektora određenih delatnosti u toj državi ili ta međunarodna organizacija obezbeđuje primereni nivo zaštite podataka o ličnosti.

Smatra se da je primereni nivo zaštite iz stava 1. ovog člana obezbeđen u državama i međunarodnim organizacijama koje su članice Konvencije Saveta Evrope o zaštiti lica u odnosu na automatsku obradu ličnih podataka, odnosno u državama, na delovima njihovih teritorija ili u jednom ili više sektora određenih delatnosti u tim državama ili međunarodnim organizacijama za koje je od strane Evropske unije utvrđeno da obezbeđuju primereni nivo zaštite.

|PU | | | | |45.2. |When assessing the adequacy of the level of protection, the Commission shall, in particular, take account of the following elements:

(a)

the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of such legislation, data protection rules, professional rules and security measures, including rules for the onward transfer of personal data to another third country or international organisation which are complied with in that country or international organisation, case-law, as well as effective and enforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal data are being transferred;

(b)

the existence and effective functioning of one or more independent supervisory authorities in the third country or to which an international organisation is subject, with responsibility for ensuring and enforcing compliance with the data protection rules, including adequate enforcement powers, for assisting and advising the data subjects in exercising their rights and for cooperation with the supervisory authorities of the Member States; and

(c)

the international commitments the third country or international organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data.

|64.3. |Vlada može da utvrdi da država, deo njene teritorije, oblast delatnosti, odnosno pravnog regulisanja ili međunarodna organizacija ne obezbeđuje primereni nivo zaštite iz stava 1. ovog člana, osim ako se radi o članicama Konvencije Saveta Evrope o zaštiti lica u odnosu na automatsku obradu ličnih podataka, uzimajući u obzir:

1) princip vladavine prava i poštovanja ljudskih prava i osnovnih sloboda, važeće zakonodavstvo, uključujući i propise u oblasti javne bezbednosti, odbrane, nacionalne bezbednosti, krivičnog prava i pristupa organa vlasti podacima o ličnosti, kao i primenu ovih propisa, pravila o zaštiti podataka o ličnosti i profesionalnih pravila u ovoj oblasti, odnosno preduzimanje mera zaštite podataka o ličnosti, uključujući i pravila o daljem prenošenju podataka o ličnosti u treće države ili međunarodne organizacije, koja se primenjuju u praksi sudova i drugih organa vlasti u drugoj državi ili međunarodnoj organizaciji, kao i delotvornost ostvarivanja prava lica na koje se odnose podaci, a posebno delotvornost upravnih i sudskih postupaka zaštite prava lica čiji se podaci prenose;

2) postojanje i delotvornost rada nadzornog tela za zaštitu podataka o ličnosti u drugoj državi ili nadzornog tela koje je nadležno za nadzor nad međunarodnom organizacijom u ovoj oblasti, sa ovlašćenjem da obezbedi primenu pravila o zaštiti podataka o ličnosti i pokrene postupke zaštite podataka o ličnosti u slučaju njihovog nepoštovanja, pruži pomoć i savetuje lica na koje se podaci odnose u ostvarivanju njegovih prava, kao i da sarađuje sa nadzornim telima drugih država;

3) međunarodne obaveze koje je druga država ili međunarodna organizacija preuzela, ili druge obaveze koje proizilaze iz pravnoobavezujućih međunarodnih ugovora ili drugih pravnih instrumenata, kao i iz članstva u multilateralnim ili regionalnim organizacijama, a posebno u pogledu zaštite podatka o ličnosti. |PU | | | | |45.3. |The Commission, after assessing the adequacy of the level of protection, may decide, by means of implementing act, that a third country, a territory or one or more specified sectors within a third country, or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 of this Article. The implementing act shall provide for a mechanism for a periodic review, at least every four years, which shall take into account all relevant developments in the third country or international organisation. The implementing act shall specify its territorial and sectoral application and, where applicable, identify the supervisory authority or authorities referred to in point (b) of paragraph 2 of this Article. The implementing act shall be adopted in accordance with the examination procedure referred to in Article 93(2). |64.6. |Vlada prati stanje u oblasti zaštite podataka u ličnosti u drugim državama, na delovima njenih teritorija ili u jednom ili više sektora određnih delatnosti u tim državama ili u međunarodnim organizacijima, na osnovu dostupnih prikupljenih informacija i na osnovu informacije prikupljene od strane međunarodnih organizacija, koje su od značaja za preispitivanje postojanja primerenog nivoa zaštite.

|PU | | | | |45.4. |The Commission shall, on an ongoing basis, monitor developments in third countries and international organisations that could affect the functioning of decisions adopted pursuant to paragraph 3 of this Article and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC.

|64.6. |Vlada prati stanje u oblasti zaštite podataka u ličnosti u drugim državama, na delovima njenih teritorija ili u jednom ili više sektora određnih delatnosti u tim državama ili u međunarodnim organizacijima, na osnovu dostupnih prikupljenih informacija i na osnovu informacije prikupljene od strane međunarodnih organizacija, koje su od značaja za preispitivanje postojanja primerenog nivoa zaštite. |PU | | | | |45.5. |The Commission shall, where available information reveals, in particular following the review referred to in paragraph 3 of this Article, that a third country, a territory or one or more specified sectors within a third country, or an international organisation no longer ensures an adequate level of protection within the meaning of paragraph 2 of this Article, to the extent necessary, repeal, amend or suspend the decision referred to in paragraph 3 of this Article by means of implementing acts without retro-active effect. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2).

On duly justified imperative grounds of urgency, the Commission shall adopt immediately applicable implementing acts in accordance with the procedure referred to in Article 93(3). |64.6. |Vlada prati stanje u oblasti zaštite podataka u ličnosti u drugim državama, na delovima njenih teritorija ili u jednom ili više sektora određnih delatnosti u tim državama ili u međunarodnim organizacijima, na osnovu dostupnih prikupljenih informacija i na osnovu informacije prikupljene od strane međunarodnih organizacija, koje su od značaja za preispitivanje postojanja primerenog nivoa zaštite.

|PU

Propisane obaveze se odnose na države članice Evropske unije.

| | | |45.6. |The Commission shall enter into consultations with the third country or international organisation with a view to remedying the situation giving rise to the decision made pursuant to paragraph 5. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |45.7. |A decision pursuant to paragraph 5 of this Article is without prejudice to transfers of personal data to the third country, a territory or one or more specified sectors within that third country, or the international organisation in question pursuant to Articles 46 to 49. | | |NP

|Propisane obaveze se odnose na države članice Evropske unije. | | | |45.8. |The Commission shall publish in the Official Journal of the European Union and on its website a list of the third countries, territories and specified sectors within a third country and international organisations for which it has decided that an adequate level of protection is or is no longer ensured. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |45.9. |Decisions adopted by the Commission on the basis of Article 25(6) of Directive 95/46/EC shall remain in force until amended, replaced or repealed by a Commission Decision adopted in accordance with paragraph 3 or 5 of this Article. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |46.1. |In the absence of a decision pursuant to Article 45(3), a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.

|65.1. |Rukovalac ili obrađivač mogu da prenesu podatke o ličnosti u drugu državu, na deo njene teritorije ili u jedan ili više sektora određenih delatnosti u toj državi ili u međunarodnu organizaciju za koju listom iz člana 64. stav 7. ovog zakona nije utvrđeno postojanje primerenog nivoa zaštite, samo ako je rukovalac, odnosno obrađivač obezbedio odgovarajuće mere zaštite ovih podataka i ako je licu na koje se podaci odnose obezbeđena ostvarivost njegovih prava i delotvorna pravna zaštita. |PU | | | | |46.2. |The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by:

(a)

a legally binding and enforceable instrument between public authorities or bodies;

(b)

binding corporate rules in accordance with Article 47;

(c)

standard data protection clauses adopted by the Commission in accordance with the examination procedure referred to in Article 93(2);

(d)

standard data protection clauses adopted by a supervisory authority and approved by the Commission pursuant to the examination procedure referred to in Article 93(2);

(e)

an approved code of conduct pursuant to Article 40 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects’ rights; or

(f)

an approved certification mechanism pursuant to Article 42 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects’ rights.

|65.2. |Odgovarajuće mere zaštite iz stava 1. ovog člana mogu se bez posebnog odobrenja Poverenika obezbediti:

1) pravno obavezujućim aktom sačinjenog između organa vlasti;

2) standardnim ugovornim klauzulama izrađenim od strane Poverenika u skladu sa članom 45. ovog zakona, kojima se u celini uređuje pravni odnos između rukovaoca i obrađivača;

3) obavezujućim poslovnim pravilama, u skladu sa članom 67. ovog zakona;

4) odobrenim kodeksom postupanja u skladu sa članom 59. ovog zakona, zajedno sa obavezujućom i sprovodivom primenom odgovarajućih mera zaštite, uključujući i zaštitu prava lica na koje se podaci odnose, od strane rukovaoca ili obrađivača u drugoj državi ili međunarodnoj organizaciji;

5) izdatim sertifikatima iz člana 61. ovog zakona, zajedno sa preuzetim obavezama primene odgovarajućih mera zaštite, uključujući i zaštitu prava lica na koje se podaci odnose, od strane rukovaoca ili obrađivača u drugoj državi ili međunarodnoj organizaciji.

|PU

NP |

Tačka c) se odnosi na države članice Evropske unije | | | |46.3. | Subject to the authorisation from the competent supervisory authority, the appropriate safeguards referred to in paragraph 1 may also be provided for, in particular, by:

(a)

contractual clauses between the controller or processor and the controller, processor or the recipient of the personal data in the third country or international organisation; or

(b)

provisions to be inserted into administrative arrangements between public authorities or bodies which include enforceable and effective data subject rights.

|65.3. |Odgovarajuće mere zaštite iz stava 1. ovog člana mogu se obezbediti i na osnovu posebnog odobrenja Poverenika:

1) ugovornim odredbama između rukovaoca ili obrađivača i rukovaoca, obrađivača ili primaoca u drugoj državi ili međunarodnoj organizaciji;

2) odredbama koje se unose u sporazum između organa vlasti, a kojima se obezbeđuje delotvorna i sprovodiva zaštita prava lica na koje se podaci odnose.

|PU | | | | |46.4. |The supervisory authority shall apply the consistency mechanism referred to in Article 63 in the cases referred to in paragraph 3 of this Article. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |46.5. |Authorisations by a Member State or supervisory authority on the basis of Article 26(2) of Directive 95/46/EC shall remain valid until amended, replaced or repealed, if necessary, by that supervisory authority. Decisions adopted by the Commission on the basis of Article 26(4) of Directive 95/46/EC shall remain in force until amended, replaced or repealed, if necessary, by a Commission Decision adopted in accordance with paragraph 2 of this Article. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |47.1. |The competent supervisory authority shall approve binding corporate rules in accordance with the consistency mechanism set out in Article 63, provided that they:

(a)

are legally binding and apply to and are enforced by every member concerned of the group of undertakings, or group of enterprises engaged in a joint economic activity, including their employees;

(b)

expressly confer enforceable rights on data subjects with regard to the processing of their personal data; and

(c)

fulfil the requirements laid down in paragraph 2.

|67.1. |Poverenik odobrava obavezujuća poslovna pravila, ako ta pravila zajedno ispunjavaju sledeće uslove:

1) pravno su obavezujuća, primenjuju se na i sprovode se od strane svakog člana multinacionalne kompanije ili grupe privrednih subjekata, uključujući i njihove zaposlene;

2) izričito obezbeđuju ostvarivanje prava lica na koje se podaci odnose u vezi sa obradom njihovih podataka;

3) ispunjavaju uslove propisane stavom 2. ovog člana.

|PU | | | | |47.2. |. The binding corporate rules referred to in paragraph 1 shall specify at least:

(a)

the structure and contact details of the group of undertakings, or group of enterprises engaged in a joint economic activity and of each of its members;

(b)

the data transfers or set of transfers, including the categories of personal data, the type of processing and its purposes, the type of data subjects affected and the identification of the third country or countries in question;

(c)

their legally binding nature, both internally and externally;

(d)

the application of the general data protection principles, in particular purpose limitation, data minimisation, limited storage periods, data quality, data protection by design and by default, legal basis for processing, processing of special categories of personal data, measures to ensure data security, and the requirements in respect of onward transfers to bodies not bound by the binding corporate rules;

(e)

the rights of data subjects in regard to processing and the means to exercise those rights, including the right not to be subject to decisions based solely on automated processing, including profiling in accordance with Article 22, the right to lodge a complaint with the competent supervisory authority and before the competent courts of the Member States in accordance with Article 79, and to obtain redress and, where appropriate, compensation for a breach of the binding corporate rules;

(f)

the acceptance by the controller or processor established on the territory of a Member State of liability for any breaches of the binding corporate rules by any member concerned not established in the Union; the controller or the processor shall be exempt from that liability, in whole or in part, only if it proves that that member is not responsible for the event giving rise to the damage;

(g)

how the information on the binding corporate rules, in particular on the provisions referred to in points (d), (e) and (f) of this paragraph is provided to the data subjects in addition to Articles 13 and 14;

(h)

the tasks of any data protection officer designated in accordance with Article 37 or any other person or entity in charge of the monitoring compliance with the binding corporate rules within the group of undertakings, or group of enterprises engaged in a joint economic activity, as well as monitoring training and complaint-handling;

(i)

the complaint procedures;

(j)

the mechanisms within the group of undertakings, or group of enterprises engaged in a joint economic activity for ensuring the verification of compliance with the binding corporate rules. Such mechanisms shall include data protection audits and methods for ensuring corrective actions to protect the rights of the data subject. Results of such verification should be communicated to the person or entity referred to in point (h) and to the board of the controlling undertaking of a group of undertakings, or of the group of enterprises engaged in a joint economic activity, and should be available upon request to the competent supervisory authority;

(k)

the mechanisms for reporting and recording changes to the rules and reporting those changes to the supervisory authority;

(l)

the cooperation mechanism with the supervisory authority to ensure compliance by any member of the group of undertakings, or group of enterprises engaged in a joint economic activity, in particular by making available to the supervisory authority the results of verifications of the measures referred to in point (j);

(m)

the mechanisms for reporting to the competent supervisory authority any legal requirements to which a member of the group of undertakings, or group of enterprises engaged in a joint economic activity is subject in a third country which are likely to have a substantial adverse effect on the guarantees provided by the binding corporate rules; and

(n)

the appropriate data protection training to personnel having permanent or regular access to personal data.

|67.2. |Obavezujućim poslovnim pravilima iz stava 1. ovog člana najmanje se mora odrediti:

1) struktura i kontakt podaci multinacionalne kompanije ili grupe privrednih subjekata, kao i svakog od njenih članova;

2) prenos ili grupe prenosa podataka o ličnosti, uključujući vrste podataka o ličnosti, vrste radnji obrade i njihovu svrhu, vrste lica na koje se podaci odnose i naziv države u koju se podaci prenose;

3) obaveznost primene obavezujućih poslovnih pravila, kako u okviru multinacionalne kompanije ili grupe privrednih subjekata, tako i izvan njih;

4) primena opštih načela zaštite podataka o ličnosti, a naročito ograničenja svrhe obrade, minimizacija podataka, ograničenje čuvanja, integritet podataka, mere stalne zaštite podataka, pravni osnov za obradu, obrade posebnih vrsta podataka o ličnosti, mere bezbednosti i uslove za dalji prenos podataka o ličnosti drugim licima ili telima koja nisu obavezana obavezujućim poslovnim pravilima;

5) prava lica na koje se podaci odnose u odnosu na obradu i načine ostvarivanja tih prava, uključujući i prava u vezi sa automatizovanim donošenjem pojedinačnih odluka i profilisanjem iz člana 38. ovog zakona, pravo na podnošenje pritužbe Povereniku, odnosno tužbe sudu u skladu sa čl. 82. i 84. ovog zakona, kao i pravo na naknadu štete zbog povrede obavezujućih poslovnih pravila;

6) prihvatanje odgovornosti rukovaoca, odnosno obrađivača sa prebivalištem, boravištem ili sedištem na teritoriji Republike Srbije za povredu ovih pravila koju je učinio drugi član grupe koji nema prebivalište, boravište ili sedište na teritoriji Republike Srbije, osim ako rukovalac ili obrađivač dokaže da taj drugi član grupe nije odgovoran za događaj koji je prouzrokovao štetu;

7) način na koji se licu na koje se podaci odnose pružaju informacije o obavezujućim poslovnim pravilima, a posebno o odredbama tač. 4) do 6) ovog stava, uz pružanje ostalih informacija iz čl. 23. i 24. ovog zakona;

8) ovlašćenja lica za zaštitu podataka o ličnosti, određenog u skladu sa članom 58. ovog zakona, ili bilo kog drugog lica koje je ovlašćeno za nadzor nad primenom obavezujućih poslovnih pravila unutar multinacionalne kompanije ili grupe privrednih subjekata, uključujući i nadzor nad obukom i odlučivanje o pritužbama unutar multinacionalne kompanije ili grupe;

9) postupak koji se sprovodi po pritužbama;

10) mehanizam provere postupanja u skladu sa obavezujućim poslovnim pravilima unutar multinacionalne kompanije ili grupe privrednih subjekata. Ovaj mehanizam uključuje reviziju zaštite podataka o ličnosti i korektivne mere za zaštitu prava lica na koje se podaci odnose. Rezultati provere moraju biti saopšteni licu iz tačke 8) ovog stava, kao i upravljačkom organu multinacionalne kompanije ili grupe privrednih subjekata, a moraju biti stavljeni na raspolaganje i Povereniku, na njegov zahtev;

11) način izveštavanja i vođenja evidencije o promenama obavezujućih poslovnih pravila i način obaveštavanje Poverenika o tim promenama;

12) način saradnje sa Poverenikom u cilju obezbeđenja primene obavezujućih poslovnih pravila od strane svakog člana multinacionalne kompanije ili grupe privrednih subjekata pojedinačno, a posebno način na koji se Povereniku stavljaju na raspolaganje rezultati provere iz tačke 10) ovog stava;

13) način izveštavanja Poverenika o pravnim obavezama koje se primenjuju prema članu multinacionalne kompanije ili grupe privrednih subjekata u drugoj državi, a koji bi mogli imati značajan štetan uticaj na garancije propisane obavezujućim poslovnim pravilima;

14) odgovarajuća obuka za zaštitu podataka o ličnosti lica koja imaju trajan ili redovan pristup podacima o ličnosti. |PU | | | | |47.3. | The Commission may specify the format and procedures for the exchange of information between controllers, processors and supervisory authorities for binding corporate rules within the meaning of this Article. Those implementing acts shall be adopted in accordance with the examination procedure set out in Article 93(2). |67.3. |Poverenik može bliže urediti način razmene informacija između rukovalaca, obrađivača i Poverenika u primeni stava 2. ovog člana.

|PU

NP |

Druga rečenica se odnosi na države članice Evropske unije | | | |48. |Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforceable in any manner if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State, without prejudice to other grounds for transfer pursuant to this Chapter. |68. |Odluke suda ili upravnog organa druge države, kojima se od rukovaoca ili obrađivača zahteva prenos ili otkrivanje podataka o ličnosti, mogu biti priznate ili izvršene u Republici Srbiji samo ako se zasnivaju na međunarodnom sporazumu, kao što je sporazum o međunarodnoj pravnoj pomoći zaključen između Republike Srbije i te druge države, što ne utiče na primenu drugih osnova za prenos u skladu sa odredbama ove glave zakona. |PU | | | | |49.1. |In the absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions:

(a)

the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards;

(b)

the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject’s request;

(c)

the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person;

(d)

the transfer is necessary for important reasons of public interest;

(e)

the transfer is necessary for the establishment, exercise or defence of legal claims;

(f)

the transfer is necessary in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent;

(g)

the transfer is made from a register which according to Union or Member State law is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest, but only to the extent that the conditions laid down by Union or Member State law for consultation are fulfilled in the particular case.

Where a transfer could not be based on a provision in Article 45 or 46, including the provisions on binding corporate rules, and none of the derogations for a specific situation referred to in the first subparagraph of this paragraph is applicable, a transfer to a third country or an international organisation may take place only if the transfer is not repetitive, concerns only a limited number of data subjects, is necessary for the purposes of compelling legitimate interests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject, and the controller has assessed all the circumstances surrounding the data transfer and has on the basis of that assessment provided suitable safeguards with regard to the protection of personal data. The controller shall inform the supervisory authority of the transfer. The controller shall, in addition to providing the information referred to in Articles 13 and 14, inform the data subject of the transfer and on the compelling legitimate interests pursued.

|69.1.

69.2.

69.4.

69.5. |Ako se prenos podatka o ličnosti ne vrši u skladu sa odredbama čl. 64, 65. i 67. ovog zakona, ovi podaci mogu se preneti u drugu državu ili međunarodnu organizaciju samo ako se radi o jednom od sledećih slučajeva:

1) lice na koje se podaci odnose je izričito pristalo na predloženi prenos, pošto je, zbog nepostojanja odluke o primerenom nivou zaštite i odgovarajućih mera zaštite, informisano o mogućim rizicima vezanim za taj prenos;

2) prenos je neophodan za izvršenje ugovora između lica na koje se podaci odnose i rukovaoca ili za primenu predugovornih mera preduzetih na zahtev lica na koje se podaci odnose;

3) prenos je neophodan za zaključenje ili izvršenje ugovora zaključenog u interesu lica na koje se podaci odnose između rukovaoca i drugog fizičkog ili pravnog lica;

4) prenos je neophodan za ostvarivanje važnog javnog interesa propisanog zakonom Republike Srbije, pod uslovom da prenos pojedinih vrsta podataka o ličnosti ovim zakonom nije ograničen;

5) prenos je neophodan za podnošenje, ostvarivanje ili odbranu pravnog zahteva;

6) prenos je neophodan za zaštitu životno važnih interesa lica na koje se podaci odnose ili drugog fizičkog lica, ako lice na koje se podaci odnose fizički ili pravno nije u mogućnosti da daje pristanak;

7) vrši se prenos pojedinih podataka o ličnosti sadržanih u javnom registru, koji su dostupni javnosti ili bilo kom licu koje može da dokaže da ima opravdani interes, ali samo u meri u kojoj su ispunjeni zakonom propisani uslovi za uvid u tom posebnom slučaju.

Ako se prenos ne može izvršiti u skladu sa stavom 1. ovog člana i čl. 64, 65. i 67. ovog zakona, podaci o ličnosti se mogu prenetu u drugu državu ili međunarodnu organizaciju samo ako su zajedno ispunjeni sledeći uslovi:

1) prenos podataka se ne ponavlja;

2) prenose se podaci ograničenog broja fizičkih lica;

3) prenos je neophodan u cilju ostvarivanja legitimnog interesa rukovaoca koji preteže nad interesima, odnosno pravima ili slobodama lica na koje se podaci odnose;

4) rukovalac je obezbedio primenu odgovarajućih mera zaštite podataka o ličnosti na osnovu prethodne procene svih okolnosti u vezi sa prenosom ovih podataka.

Rukovalac je dužan da obavesti Poverenika o prenosu podataka izvršenom u skladu sa stavom 2. ovog člana.

Rukovalac je dužan da licu na koje se podaci odnose, uz informacije iz čl. 23. i 24. ovog zakona, pruži i informaciju o prenosu podataka iz stava 2. ovog člana, uključujući i informaciju o tome koji se legitimni interes rukovaoca ostvaruje takvim prenosom. |PU | | | | |49.2. | A transfer pursuant to point (g) of the first subparagraph of paragraph 1 shall not involve the entirety of the personal data or entire categories of the personal data contained in the register. Where the register is intended for consultation by persons having a legitimate interest, the transfer shall be made only at the request of those persons or if they are to be the recipients.

|69.6.

69.7. |Prenos podataka iz stava 1. tačka 7) ovog člana ne može da se odnosi na sve podatke o ličnosti ili na cele vrste podataka o ličnosti iz registra.

Ako se prenose podaci iz registra koji su dostupni samo licu koje ima opravdani interes, u skladu sa stavom 1. tačka 7) ovog člana, prenos se može izvršiti samo na zahtev tog lica ili ako je to lice primalac podataka. |PU | | | | |49.3. |Points (a), (b) and (c) of the first subparagraph of paragraph 1 and the second subparagraph thereof shall not apply to activities carried out by public authorities in the exercise of their public powers. |69.8 |Odredbe stava 1. tač. 1) do 3) i stava 2. ovog člana ne primenjuju se na aktivnosti organa vlasti u vršenju njihovih nadležnosti. |PU | | | | |49.4. |The public interest referred to in point (d) of the first subparagraph of paragraph 1 shall be recognised in Union law or in the law of the Member State to which the controller is subject. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |49.5. |In the absence of an adequacy decision, Union or Member State law may, for important reasons of public interest, expressly set limits to the transfer of specific categories of personal data to a third country or an international organisation. Member States shall notify such provisions to the Commission. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |49.6. |The controller or processor shall document the assessment as well as the suitable safeguards referred to in the second subparagraph of paragraph 1 of this Article in the records referred to in Article 30. |69.3. |Rukovalac, odnosno obrađivač dužni su da u evidenciji o radnjama obrade iz člana 47. ovog zakona obezbede dokaz o izvršenoj proceni i primeni odgovarajućih mera zaštite iz stava 2. tačka 4) ovog člana. |PU | | | | |50. |In relation to third countries and international organisations, the Commission and supervisory authorities shall take appropriate steps to:

(a)

develop international cooperation mechanisms to facilitate the effective enforcement of legislation for the protection of personal data;

(b)

provide international mutual assistance in the enforcement of legislation for the protection of personal data, including through notification, complaint referral, investigative assistance and information exchange, subject to appropriate safeguards for the protection of personal data and other fundamental rights and freedoms;

(c)

engage relevant stakeholders in discussion and activities aimed at furthering international cooperation in the enforcement of legislation for the protection of personal data;

(d)

promote the exchange and documentation of personal data protection legislation and practice, including on jurisdictional conflicts with third countries.

|72. |Poverenik preduzima odgovarajuće mere u odnosima sa organima nadležnim za zaštitu podataka o ličnosti u drugim državama i međunarodnim organizacijama u cilju:

1) razvoja mehanizama međunarodne saradnje za olakšavanje delotvorne primene zakona koji se odnose na zaštitu podataka o ličnosti;

2) obezbeđivanja međunarodne uzajamne pomoći u primeni zakona koji se odnose na zaštitu podataka o ličnosti, uključujući i obaveštavanje, upućivanje na postupke zaštite i pravne pomoći u vršenju nadzora, kao i razmenu informacija, pod uslovom da su preduzete odgovarajuće mere zaštite podataka o ličnosti i osnovnih prava i sloboda;

3) angažovanja zainteresovanih strana u raspravama i aktivnostima koje su usmerene na razvoj međunarodne saradnje u primeni zakona koji se odnose na zaštitu podataka o ličnosti;

4) podsticanja i unapređivanja razmene informacija o zakonodavstvu koje se odnosi na zaštitu podataka o ličnosti i njegovoj primeni, uključujući i pitanja sukoba nadležnosti sa drugim državama u ovoj oblasti. |PU | | | | |51.1. |Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (‘supervisory authority’). |73.1. |U cilju zaštite osnovnih prava i sloboda fizičkih lica u vezi sa obradom, poslove praćenja primene ovog zakona u skladu sa propisanim ovlašćenjima vrši Poverenik, kao nezavisan državni organ.

|PU | | | | |51.2. |Each supervisory authority shall contribute to the consistent application of this Regulation throughout the Union. For that purpose, the supervisory authorities shall cooperate with each other and the Commission in accordance with Chapter VII. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |51.3. |Where more than one supervisory authority is established in a Member State, that Member State shall designate the supervisory authority which is to represent those authorities in the Board and shall set out the mechanism to ensure compliance by the other authorities with the rules relating to the consistency mechanism referred to in Article 63. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |51.4. |Each Member State shall notify to the Commission the provisions of its law which it adopts pursuant to this Chapter, by 25 May 2018 and, without delay, any subsequent amendment affecting them. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |52.1. |Each supervisory authority shall act with complete independence in performing its tasks and exercising its powers in accordance with this Regulation. |74.1. |U vršenju svojih ovlašćenja i poslova, u skladu sa ovim zakonom, Poverenik je potpuno nezavisan, slobodan je od svakog neposrednog ili posrednog spoljnog uticaja i ne može da traži niti prima naloge od bilo koga. |PU | | | | |52.2. |The member or members of each supervisory authority shall, in the performance of their tasks and exercise of their powers in accordance with this Regulation, remain free from external influence, whether direct or indirect, and shall neither seek nor take instructions from anybody. |74.1. |U vršenju svojih ovlašćenja i poslova, u skladu sa ovim zakonom, Poverenik je potpuno nezavisan, slobodan je od svakog neposrednog ili posrednog spoljnog uticaja i ne može da traži niti prima naloge od bilo koga. |PU | | | | |52.3. |Member or members of each supervisory authority shall refrain from any action incompatible with their duties and shall not, during their term of office, engage in any incompatible occupation, whether gainful or not. |74.2. |Poverenik se ne može baviti drugom delatnošću ni drugim poslom, uz naknadu ili bez naknade, niti može obavljati drugu javnu funkciju ili vršiti drugo javno ovlašćenje, niti politički delovati. |PU | | | | |52.4. |Each Member State shall ensure that each supervisory authority is provided with the human, technical and financial resources, premises and infrastructure necessary for the effective performance of its tasks and exercise of its powers, including those to be carried out in the context of mutual assistance, cooperation and participation in the Board. |74.3. |U cilju obezbeđivanja delotvornog vršenja zakonom propisanih ovlašćenja, neophodna finansijska sredstva za rad, prostorije za rad, kao i neophodne tehničke, organizacione i kadrovske uslove za rad Poverenika obezbeđuju se u skladu sa zakonom kojim se uređuje budzet i zakonima kojima se uređuje državna uprava i položaj državnih službenika. |PU | | | | |52.5. |Each Member State shall ensure that each supervisory authority chooses and has its own staff which shall be subject to the exclusive direction of the member or members of the supervisory authority concerned. |74.4. |Poverenik samostalno vrši izbor zaposlenih između kandidata koji ispunjavaju zakonom propisane uslove za rad u državnim organima i njima potpuno samostalno rukovodi. |PU | | | | |52.6. |Each Member State shall ensure that each supervisory authority is subject to financial control which does not affect its independence and that it has separate, public annual budgets, which may be part of the overall state or national budget. |74.5. |Kontrolu nad trošenjem sredstava za rad Poverenika vrši Državna revizorska institucija, u skladu sa zakonom, na način koji ne utiče na nezavisnost Poverenika.

|PU | | | | |53.1. |Member States shall provide for each member of their supervisory authorities to be appointed by means of a transparent procedure by:

—

their parliament;

—

their government;

—

their head of State; or

—

an independent body entrusted with the appointment under Member State law.

|73.3. |Na sedište Poverenika, izbor Poverenika i zamenika Poverenika, prestanak njihovog mandata, postupak njihovog razrešenja, njihov položaj, stručnu službu Poverenika, kao i na finansiranje i podnošenje izveštaja, primenjuju se odredbe zakona kojim se uređuje slobodan pristup informacijama od javnog značaja, ako ovim zakonom nije drugačije određeno. |PU | | | | |53.2. |Each member shall have the qualifications, experience and skills, in particular in the area of the protection of personal data, required to perform its duties and exercise its powers. |75.1. |Pored uslova za izbor Poverenika, propisanih zakonom kojim se uređuje slobodan pristup informacijama od javnog značaja, Poverenik mora da ima potrebno stručno znanje i iskustvo u oblasti zaštite podataka o ličnosti. |PU | | | | |53.3. |The duties of a member shall end in the event of the expiry of the term of office, resignation or compulsory retirement, in accordance with the law of the Member State concerned. |73.3. |Na sedište Poverenika, izbor Poverenika i zamenika Poverenika, prestanak njihovog mandata, postupak njihovog razrešenja, njihov položaj, stručnu službu Poverenika, kao i na finansiranje i podnošenje izveštaja, primenjuju se odredbe zakona kojim se uređuje slobodan pristup informacijama od javnog značaja, ako ovim zakonom nije drugačije određeno. |PU | | | | |53.4. |A member shall be dismissed only in cases of serious misconduct or if the member no longer fulfils the conditions required for the performance of the duties. |73.3. |Na sedište Poverenika, izbor Poverenika i zamenika Poverenika, prestanak njihovog mandata, postupak njihovog razrešenja, njihov položaj, stručnu službu Poverenika, kao i na finansiranje i podnošenje izveštaja, primenjuju se odredbe zakona kojim se uređuje slobodan pristup informacijama od javnog značaja, ako ovim zakonom nije drugačije određeno. | PU | | | | |54.1. | Each Member State shall provide by law for all of the following:

(a)

the establishment of each supervisory authority;

(b)

the qualifications and eligibility conditions required to be appointed as member of each supervisory authority;

(c)

the rules and procedures for the appointment of the member or members of each supervisory authority;

(d)

the duration of the term of the member or members of each supervisory authority of no less than four years, except for the first appointment after 24 May 2016, part of which may take place for a shorter period where that is necessary to protect the independence of the supervisory authority by means of a staggered appointment procedure;

(e)

whether and, if so, for how many terms the member or members of each supervisory authority is eligible for reappointment;

(f)

the conditions governing the obligations of the member or members and staff of each supervisory authority, prohibitions on actions, occupations and benefits incompatible therewith during and after the term of office and rules governing the cessation of employment.

76.2. |Poverenik, zamenik Poverenika i zaposleni u službi Poverenika dužni su da kao profesionalnu tajnu čuvaju sve podatke do kojih su došli u obavljanju svoje funkcije, odnosno poslova, uključujući i podatke u vezi sa povredom ovog zakona sa kojima ih je upoznalo lice koje nije zaposleno kod Poverenika.

Obaveza iz stava 1. ovog člana traje i posle prestanka obavljanja funkcije Poverenika ili zamenika Poverenika, odnosno prestanka rada u službi Poverenika. |PU | | | | |55.1. | Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State. |77.1. |Poverenik vrši svoja ovlašćenja, u skladu sa ovim zakonom, na teritoriji Republike Srbije.

|PU | | | | |55.2. |Where processing is carried out by public authorities or private bodies acting on the basis of point (c) or (e) of Article 6(1), the supervisory authority of the Member State concerned shall be competent. In such cases Article 56 does not apply. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |55.3. | Supervisory authorities shall not be competent to supervise processing operations of courts acting in their judicial capacity. |77.3. |Poverenik nije nadležan da vrši nadzor nad obradom od strane sudova u vršenju njihovih sudskih ovlašćenja. |PU | | | | |56.1. |Without prejudice to Article 55, the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |56.2. |By derogation from paragraph 1, each supervisory authority shall be competent to handle a complaint lodged with it or a possible infringement of this Regulation, if the subject matter relates only to an establishment in its Member State or substantially affects data subjects only in its Member State. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |56.3. |In the cases referred to in paragraph 2 of this Article, the supervisory authority shall inform the lead supervisory authority without delay on that matter. Within a period of three weeks after being informed the lead supervisory authority shall decide whether or not it will handle the case in accordance with the procedure provided in Article 60, taking into account whether or not there is an establishment of the controller or processor in the Member State of which the supervisory authority informed it. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |56.4. |Where the lead supervisory authority decides to handle the case, the procedure provided in Article 60 shall apply. The supervisory authority which informed the lead supervisory authority may submit to the lead supervisory authority a draft for a decision. The lead supervisory authority shall take utmost account of that draft when preparing the draft decision referred to in Article 60(3). | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |56.5. |Where the lead supervisory authority decides not to handle the case, the supervisory authority which informed the lead supervisory authority shall handle it according to Articles 61 and 62. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |56.6. |The lead supervisory authority shall be the sole interlocutor of the controller or processor for the cross-border processing carried out by that controller or processor. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |57.1. |Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:

(a)

monitor and enforce the application of this Regulation;

(b)

promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing. Activities addressed specifically to children shall receive specific attention;

(c)

advise, in accordance with Member State law, the national parliament, the government, and other institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to processing;

(d)

promote the awareness of controllers and processors of their obligations under this Regulation;

(e)

upon request, provide information to any data subject concerning the exercise of their rights under this Regulation and, if appropriate, cooperate with the supervisory authorities in other Member States to that end;

(f)

handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;

(g)

cooperate with, including sharing information and provide mutual assistance to, other supervisory authorities with a view to ensuring the consistency of application and enforcement of this Regulation;

(h)

conduct investigations on the application of this Regulation, including on the basis of information received from another supervisory authority or other public authority;

(i)

monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies and commercial practices;

(j)

adopt standard contractual clauses referred to in Article 28(8) and in point (d) of Article 46(2);

(k)

establish and maintain a list in relation to the requirement for data protection impact assessment pursuant to Article 35(4);

(l)

give advice on the processing operations referred to in Article 36(2);

(m)

encourage the drawing up of codes of conduct pursuant to Article 40(1) and provide an opinion and approve such codes of conduct which provide sufficient safeguards, pursuant to Article 40(5);

(n)

encourage the establishment of data protection certification mechanisms and of data protection seals and marks pursuant to Article 42(1), and approve the criteria of certification pursuant to Article 42(5);

(o)

where applicable, carry out a periodic review of certifications issued in accordance with Article 42(7);

(p)

draft and publish the criteria for accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;

(q)

conduct the accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;

(r)

authorise contractual clauses and provisions referred to in Article 46(3);

(s)

approve binding corporate rules pursuant to Article 47;

(t)

contribute to the activities of the Board;

(u)

keep internal records of infringements of this Regulation and of measures taken in accordance with Article 58(2); and

(v)

fulfil any other tasks related to the protection of personal data.

|78.1. |Poverenik:

1) vrši nadzor i obezbeđuje primenu ovog zakona u skladu sa svojim ovlašćenjima;

2) stara se o podizanju javne svesti o rizicima, pravilima, merama zaštite i pravima u vezi sa obradom, a posebno ako se radi o obradi podataka o maloletnom licu;

3) daje mišljenje Narodnoj skupštini, Vladi, drugim organima vlasti i organizacijama, u skladu sa propisom, o zakonskim i drugim merama koje se odnose na zaštitu prava i sloboda fizičkih lica u vezi sa obradom;

4) stara se o podizanju svesti rukovaoca i obrađivača u vezi sa njihovim obavezama propisanim ovim zakonom;

5) na zahtev lica na koje se podaci odnose, pruža informacije o njihovim pravima propisanim ovim zakonom;

6) postupa po pritužbama lica na koje se podaci odnose, utvrđuje da li je došlo do povrede ovog zakona i obaveštava podnosioca pritužbe o toku i rezultatima postupka koji vodi u skladu sa članom 82. ovog zakona;

7) sarađuje sa nadzornim organima drugih država u vezi sa zaštitom podataka o ličnosti, a posebno u razmeni informacija i pružanju uzajamne pravne pomoći;

8) vrši inspekcijski nadzor nad primenom ovog zakona, u skladu sa ovim zakonom i shodnom primenom zakona kojim se uređuje inspekcijski nadzor, i podnosi zahtev za pokretanje prekršajnog postupka ako utvrdi da je došlo do povrede ovog zakona, u skladu sa zakonom kojim se uređuju prekršaji;

9) prati razvoj informacionih i komunikacionih tehnologija, kao i poslovne i druge prakse od značaja za zaštitu podataka o ličnosti;

10) izrađuje standardne ugovorne klauzule iz člana 45. stav 11. ovog zakona;

11) sačinjava i javno objavljuje liste iz člana 54. stav 5. ovog zakona;

12) daje pismeno mišljenje iz člana 55. stav 4. ovog zakona;

13) vodi evidenciju lica za zaštitu podataka o ličnosti iz člana 56. stav 11. ovog zakona;

14) podstiče izradu kodeksa postupanja u skladu sa članom 59. stav 1. ovog zakona i daje mišljenje i saglasnost na kodeks postupanja u skladu sa članom 59. stav 5. ovog zakona;

15) obavlja poslove u skladu sa članom 60. ovog zakona;

16) podstiče izdavanje sertifikata za zaštitu podataka o ličnosti i odgovarajućih žigova i oznaka u skladu sa članom 61. stav 1. i propisuje kriterijume za sertifikaciju u skladu sa članom 61. stav 5. ovog zakona;

17) sprovodi periodično preispitivanje sertifikata u skladu sa članom 61. stav 8. ovog zakona;

18) propisuje i objavljuje kriterijume za akreditaciju sertifikacionog tela i obavlja poslove u skladu sa članom 62. ovog zakona;

19) odobrava odredbe ugovora ili sporazuma iz člana 65. stav 3. ovog zakona;

20) odobrava obavezujuća poslovna pravila u skladu sa članom 67. ovog zakona;

21) vodi internu evidenciju o povredama ovog zakona i merama koje se u vršenju inspekcijskog nadzora preduzimaju u skladu sa članom 79. stav 2. ovog zakona;

23) obavlja i druge poslove određene ovim zakonom.

|PU

NP |

U odnosu na tačku q) nije predviđena ova nadležnost Poverenika, jer u skladu sa članom 61. Nacrta zakona akreditaciju sprovodi akredaciono telo, a što je u skladu sa čl. 41. i 43. Uredbe.

U odnosu na tačku t)

propisane obaveze se odnose na države članice Evropske unije. | | | |57.2. |Each supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by measures such as a complaint submission form which can also be completed electronically, without excluding other means of communication. |78.5. |U cilju pojednostavljivanja podnošenja pritužbe, Poverenik propisuje obrazac pritužbe i omogućava njeno podnošenje elektronskim putem, ne isključujući i ostala sredstva komunikacije. |PU | | | | |57.3. |The performance of the tasks of each supervisory authority shall be free of charge for the data subject and, where applicable, for the data protection officer. |78.6. |Poverenik obavlja svoje poslove besplatno za lice na koje se podaci odnose i lice za zaštitu podataka o ličnosti. |PU | | | | |57.4 |Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the supervisory authority may charge a reasonable fee based on administrative costs, or refuse to act on the request. The supervisory authority shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request. |78.7. |Ako je pritužba Povereniku očigledno neosnovana, preobimna ili se preterano ponavlja, Poverenik može da traži naknadu nužnih troškova ili da odbije da postupa po toj pritužbi, uz navođenje razloga kojima se dokazuje da se radi o neosnovanom, preobimnom ili preterano ponavljanom zahtevu. |PU | | | | |58.1. |Each supervisory authority shall have all of the following investigative powers:

(a)

to order the controller and the processor, and, where applicable, the controller’s or the processor’s representative to provide any information it requires for the performance of its tasks;

(b)

to carry out investigations in the form of data protection audits;

(c)

to carry out a review on certifications issued pursuant to Article 42(7);

(d)

to notify the controller or the processor of an alleged infringement of this Regulation;

(e)

to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks;

(f)

to obtain access to any premises of the controller and the processor, including to any data processing equipment and means, in accordance with Union or Member State procedural law.

|79.1. |Poverenik je ovlašćen da:

1) naloži rukovaocu i obrađivaču, a prema potrebi i njihovim predstavnicima, da mu pruže sve informacije koje zatraži u vršenju svojih ovlašćenja;

2) proverava i ocenjuje primenu odredbi zakona i na drugi način vrši nadzor nad zaštitom podataka o ličnosti korišćenjem inspekcijskih ovlašćenja;

3) proverava ispunjenost uslova za sertifikaciju u skladu sa članom 61. stav 8. ovog zakona;

4) obaveštava rukovaoca, odnosno obrađivača o mogućim povredama ovog zakona;

5) zatraži i dobije od rukovaoca i obrađivača pristup svim podacima o ličnosti, kao i informacijama neophodnim za vršenje njegovih ovlašćenja;

6) zatraži i dobije pristup svim prostorijama rukovaoca i obrađivača, uključujući i pristup svim sredstvima i opremi. |PU | | | | |58.2. |Each supervisory authority shall have all of the following corrective powers:

(a)

to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation;

(b)

to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation;

(c)

to order the controller or the processor to comply with the data subject’s requests to exercise his or her rights pursuant to this Regulation;

(d)

to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period;

(e)

to order the controller to communicate a personal data breach to the data subject;

(f)

to impose a temporary or definitive limitation including a ban on processing;

(g)

to order the rectification or erasure of personal data or restriction of processing pursuant to Articles 16, 17 and 18 and the notification of such actions to recipients to whom the personal data have been disclosed pursuant to Article 17(2) and Article 19;

(h)

to withdraw a certification or to order the certification body to withdraw a certification issued pursuant to Articles 42 and 43, or to order the certification body not to issue certification if the requirements for the certification are not or are no longer met;

(i)

to impose an administrative fine pursuant to Article 83, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case;

(j)

to order the suspension of data flows to a recipient in a third country or to an international organisation.

|79.2. |Poverenik je ovlašćen da preduzme sledeće korektivne mere:

1) da upozori rukovaoca i obrađivača dostavljanjem pismenog mišljenja da se nameravanim radnjama obrade mogu povrediti odredbe ovog zakona u skladu sa članom 55. stav 4. ovog zakona;

2) da izrekne opomenu rukovaocu, odnosno obrađivaču ako se obradom povređuju odredbe ovog zakona;

3) da naloži rukovaocu i obrađivaču da postupe po zahtevu lica na koje se podaci odnose u vezi sa ostvarivanjem njegovih prava, u skladu sa ovim zakonom;

4) da naloži rukovaocu i obrađivaču da usklade radnje obrade sa odredbama ovog zakona, na tačno određeni način i u tačno određenom vremenskom periodu;

5) da naloži rukovaocu da obavesti lice na koje se podaci o ličnosti odnose o povredi podataka o ličnosti;

6) da izrekne privremeno ili trajno ograničenje vršenja radnje obrade, uključujući i zabranu obrade;

7) da naloži ispravljanje, odnosno brisanje podataka o ličnosti ili ograniči vršenje radnje obrade u skladu sa čl. 29. do 32. ovog zakona, kao i da naloži rukovaocu da obavesti o tome drugog rukovaoca, lice na koje se podaci odnose i primaoce kojima su podaci o ličnosti otkriveni ili preneti, u skladu sa članom 30. stav 3. i čl. 33. i 34. ovog zakona;

8) da ukine sertifikat ili da naloži sertifikacionom telu ukidanje sertifikata koji je izdat u skladu sa čl. 61. i 62. ovog zakona, kao i da naloži sertifikacionom telu da odbije izdavanje sertifikata ako nisu ispunjeni uslovi za njegovo izdavanje;

9) da izrekne novčanu kaznu na osnovu prekršajnog naloga ako je prilikom inspekcijskog nadzora utvrđeno da je došlo do prekršaja za koji je ovim zakonom propisana novčana kazna u fiksnom iznosu, umesto drugih mera propisanih ovim stavom ili uz njih, a u zavisnosti od okolnosti konkretnog slučaja;

10) da obustavi prenos podataka o ličnosti primaocu u drugoj državi ili međunarodnoj organizaciji. |PU | | | | |58.3. |Each supervisory authority shall have all of the following authorisation and advisory powers:

(a)

to advise the controller in accordance with the prior consultation procedure referred to in Article 36;

(b)

to issue, on its own initiative or on request, opinions to the national parliament, the Member State government or, in accordance with Member State law, to other institutions and bodies as well as to the public on any issue related to the protection of personal data;

(c)

to authorise processing referred to in Article 36(5), if the law of the Member State requires such prior authorisation;

(d)

to issue an opinion and approve draft codes of conduct pursuant to Article 40(5);

(e)

to accredit certification bodies pursuant to Article 43;

(f)

to issue certifications and approve criteria of certification in accordance with Article 42(5);

(g)

to adopt standard data protection clauses referred to in Article 28(8) and in point (d) of Article 46(2);

(h)

to authorise contractual clauses referred to in point (a) of Article 46(3);

(i)

to authorise administrative arrangements referred to in point (b) of Article 46(3)

(j)

to approve binding corporate rules pursuant to Article 47.

|79.3. |Poverenik je ovlašćen i da:

1) izrađuje standardne ugovorne klauzule iz člana 45. stav 11;

2) daje mišljenje rukovaocima u postupku prethodnog pribavljanja mišljenja Poverenika, skladu sa članom 55. ovog zakona;

3) daje mišljenje Narodnoj skupštini, Vladi, drugim organima vlasti i organizacijama, po sopstvenoj inicijativi ili na njihov zahtev, kao i javnosti, o svim pitanjima u vezi sa zaštitom podataka o ličnosti;

4) registruje i objavljuje kodeks postupanja, na koji je prethodno dao saglasnost, u skladu sa članom 59. stav 5. ovog zakona;

5) izdaje sertifikate i propisuje kriterijume za izdavanje sertifikata, u skladu sa članom 61. stav 5. ovog zakona;

6) propisuje kriterijume za akreditaciju, u skladu sa članom 62. ovog zakona;

7) odobrava ugovorne odredbe, odnosno odredbe koje se unose u sporazum, u skladu sa članom 65. stav 3. ovog zakona;

8) odobrava obavezujuća poslovna pravila, u skladu sa članom 67. ovog zakona.

|PU

NP |

U odnosu na tačku e) nije predviđena ova nadležnost Poverenika, jer u skladu sa članom 61. Nacrta zakona akreditaciju sprovodi akredaciono telo, a što je u skladu sa članom 43. Uredbe.

U odnosu na tačku g) nije preuzeta odredba člana 28.8. Uredbe, s obzirom da se odnosi samo na države čalnice Evropske unije. | | | |58.4. |The exercise of the powers conferred on the supervisory authority pursuant to this Article shall be subject to appropriate safeguards, including effective judicial remedy and due process, set out in Union and Member State law in accordance with the Charter. |79.4. |Kontrolu akata Poverenika donetih na osnovu ovog člana vrši sud, u skladu sa zakonom. |PU | | | | |58.5. |Each Member State shall provide by law that its supervisory authority shall have the power to bring infringements of this Regulation to the attention of the judicial authorities and where appropriate, to commence or engage otherwise in legal proceedings, in order to enforce the provisions of this Regulation. |79.5. |U vršenju svojih ovlašćenja Poverenik može da pokrene postupak pred sudom ili drugim organom, u skladu sa zakonom.

|PU | | | | |58.6. |Each Member State may provide by law that its supervisory authority shall have additional powers to those referred to in paragraphs 1, 2 and 3. The exercise of those powers shall not impair the effective operation of Chapter VII. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |59. |Each supervisory authority shall draw up an annual report on its activities, which may include a list of types of infringement notified and types of measures taken in accordance with Article 58(2). Those reports shall be transmitted to the national parliament, the government and other authorities as designated by Member State law. They shall be made available to the public, to the Commission and to the Board. |81.1.

81.2. |Poverenik je dužan da sačini godišnji izveštaj o svojim aktivnostima, koji sadrži podatke o vrstama povreda ovog zakona i merama koje su preduzete u vezi sa tim povredama, kao i da ga podnese Narodnoj skupštini.

Izveštaj iz stava 1. ovog stava dostavlja se i Vladi i stavlja se na uvid javnosti, na odgovarajući način.

|PU | | | | |60.1. |The lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance with this Article in an endeavour to reach consensus. The lead supervisory authority and the supervisory authorities concerned shall exchange all relevant information with each other. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |60.2. |The lead supervisory authority may request at any time other supervisory authorities concerned to provide mutual assistance pursuant to Article 61 and may conduct joint operations pursuant to Article 62, in particular for carrying out investigations or for monitoring the implementation of a measure concerning a controller or processor established in another Member State. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |60.3. |The lead supervisory authority shall, without delay, communicate the relevant information on the matter to the other supervisory authorities concerned. It shall without delay submit a draft decision to the other supervisory authorities concerned for their opinion and take due account of their views. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |60.4. |Where any of the other supervisory authorities concerned within a period of four weeks after having been consulted in accordance with paragraph 3 of this Article, expresses a relevant and reasoned objection to the draft decision, the lead supervisory authority shall, if it does not follow the relevant and reasoned objection or is of the opinion that the objection is not relevant or reasoned, submit the matter to the consistency mechanism referred to in Article 63. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |60.5. |Where the lead supervisory authority intends to follow the relevant and reasoned objection made, it shall submit to the other supervisory authorities concerned a revised draft decision for their opinion. That revised draft decision shall be subject to the procedure referred to in paragraph 4 within a period of two weeks. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |60.6. |Where none of the other supervisory authorities concerned has objected to the draft decision submitted by the lead supervisory authority within the period referred to in paragraphs 4 and 5, the lead supervisory authority and the supervisory authorities concerned shall be deemed to be in agreement with that draft decision and shall be bound by it. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |60.7. |The lead supervisory authority shall adopt and notify the decision to the main establishment or single establishment of the controller or processor, as the case may be and inform the other supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds. The supervisory authority with which a complaint has been lodged shall inform the complainant on the decision. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |60.8. |By derogation from paragraph 7, where a complaint is dismissed or rejected, the supervisory authority with which the complaint was lodged shall adopt the decision and notify it to the complainant and shall inform the controller thereof. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |60.9. |Where the lead supervisory authority and the supervisory authorities concerned agree to dismiss or reject parts of a complaint and to act on other parts of that complaint, a separate decision shall be adopted for each of those parts of the matter. The lead supervisory authority shall adopt the decision for the part concerning actions in relation to the controller, shall notify it to the main establishment or single establishment of the controller or processor on the territory of its Member State and shall inform the complainant thereof, while the supervisory authority of the complainant shall adopt the decision for the part concerning dismissal or rejection of that complaint, and shall notify it to that complainant and shall inform the controller or processor thereof. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |60.10. |After being notified of the decision of the lead supervisory authority pursuant to paragraphs 7 and 9, the controller or processor shall take the necessary measures to ensure compliance with the decision as regards processing activities in the context of all its establishments in the Union. The controller or processor shall notify the measures taken for complying with the decision to the lead supervisory authority, which shall inform the other supervisory authorities concerned. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |60.11. |Where, in exceptional circumstances, a supervisory authority concerned has reasons to consider that there is an urgent need to act in order to protect the interests of data subjects, the urgency procedure referred to in Article 66 shall apply. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |60.12. |The lead supervisory authority and the other supervisory authorities concerned shall supply the information required under this Article to each other by electronic means, using a standardised format. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |61.1. |Supervisory authorities shall provide each other with relevant information and mutual assistance in order to implement and apply this Regulation in a consistent manner, and shall put in place measures for effective cooperation with one another. Mutual assistance shall cover, in particular, information requests and supervisory measures, such as requests to carry out prior authorisations and consultations, inspections and investigations. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |61.2. | Each supervisory authority shall take all appropriate measures required to reply to a request of another supervisory authority without undue delay and no later than one month after receiving the request. Such measures may include, in particular, the transmission of relevant information on the conduct of an investigation. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |61.3. |Requests for assistance shall contain all the necessary information, including the purpose of and reasons for the request. Information exchanged shall be used only for the purpose for which it was requested. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |61.4. |The requested supervisory authority shall not refuse to comply with the request unless:

(a)

it is not competent for the subject-matter of the request or for the measures it is requested to execute; or

(b)

compliance with the request would infringe this Regulation or Union or Member State law to which the supervisory authority receiving the request is subject.

| | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |61.5. |The requested supervisory authority shall inform the requesting supervisory authority of the results or, as the case may be, of the progress of the measures taken in order to respond to the request. The requested supervisory authority shall provide reasons for any refusal to comply with a request pursuant to paragraph 4. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |61.6. |Requested supervisory authorities shall, as a rule, supply the information requested by other supervisory authorities by electronic means, using a standardised format. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |61.7. |Requested supervisory authorities shall not charge a fee for any action taken by them pursuant to a request for mutual assistance. Supervisory authorities may agree on rules to indemnify each other for specific expenditure arising from the provision of mutual assistance in exceptional circumstances. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |61.8. |Where a supervisory authority does not provide the information referred to in paragraph 5 of this Article within one month of receiving the request of another supervisory authority, the requesting supervisory authority may adopt a provisional measure on the territory of its Member State in accordance with Article 55(1). In that case, the urgent need to act under Article 66(1) shall be presumed to be met and require an urgent binding decision from the Board pursuant to Article 66(2). | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |61.9. |The Commission may, by means of implementing acts, specify the format and procedures for mutual assistance referred to in this Article and the arrangements for the exchange of information by electronic means between supervisory authorities, and between supervisory authorities and the Board, in particular the standardised format referred to in paragraph 6 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2). | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |62.1. |The supervisory authorities shall, where appropriate, conduct joint operations including joint investigations and joint enforcement measures in which members or staff of the supervisory authorities of other Member States are involved. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |62.2. | Where the controller or processor has establishments in several Member States or where a significant number of data subjects in more than one Member State are likely to be substantially affected by processing operations, a supervisory authority of each of those Member States shall have the right to participate in joint operations. The supervisory authority which is competent pursuant to Article 56(1) or (4) shall invite the supervisory authority of each of those Member States to take part in the joint operations and shall respond without delay to the request of a supervisory authority to participate. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |62.3. |A supervisory authority may, in accordance with Member State law, and with the seconding supervisory authority’s authorisation, confer powers, including investigative powers on the seconding supervisory authority’s members or staff involved in joint operations or, in so far as the law of the Member State of the host supervisory authority permits, allow the seconding supervisory authority’s members or staff to exercise their investigative powers in accordance with the law of the Member State of the seconding supervisory authority. Such investigative powers may be exercised only under the guidance and in the presence of members or staff of the host supervisory authority. The seconding supervisory authority’s members or staff shall be subject to the Member State law of the host supervisory authority. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |62.4. |Where, in accordance with paragraph 1, staff of a seconding supervisory authority operate in another Member State, the Member State of the host supervisory authority shall assume responsibility for their actions, including liability, for any damage caused by them during their operations, in accordance with the law of the Member State in whose territory they are operating. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |62.5. |The Member State in whose territory the damage was caused shall make good such damage under the conditions applicable to damage caused by its own staff. The Member State of the seconding supervisory authority whose staff has caused damage to any person in the territory of another Member State shall reimburse that other Member State in full any sums it has paid to the persons entitled on their behalf. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |62.6. |Without prejudice to the exercise of its rights vis-à-vis third parties and with the exception of paragraph 5, each Member State shall refrain, in the case provided for in paragraph 1, from requesting reimbursement from another Member State in relation to damage referred to in paragraph 4. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |62.7. |Where a joint operation is intended and a supervisory authority does not, within one month, comply with the obligation laid down in the second sentence of paragraph 2 of this Article, the other supervisory authorities may adopt a provisional measure on the territory of its Member State in accordance with Article 55. In that case, the urgent need to act under Article 66(1) shall be presumed to be met and require an opinion or an urgent binding decision from the Board pursuant to Article 66(2). | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |63. |In order to contribute to the consistent application of this Regulation throughout the Union, the supervisory authorities shall cooperate with each other and, where relevant, with the Commission, through the consistency mechanism as set out in this Section. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |64.1. |The Board shall issue an opinion where a competent supervisory authority intends to adopt any of the measures below. To that end, the competent supervisory authority shall communicate the draft decision to the Board, when it:

(a)

aims to adopt a list of the processing operations subject to the requirement for a data protection impact assessment pursuant to Article 35(4);

(b)

concerns a matter pursuant to Article 40(7) whether a draft code of conduct or an amendment or extension to a code of conduct complies with this Regulation;

(c)

aims to approve the criteria for accreditation of a body pursuant to Article 41(3) or a certification body pursuant to Article 43(3);

(d)

aims to determine standard data protection clauses referred to in point (d) of Article 46(2) and in Article 28(8);

(e)

aims to authorise contractual clauses referred to in point (a) of Article 46(3); or

(f)

aims to approve binding corporate rules within the meaning of Article 47.

| | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |64.2. |Any supervisory authority, the Chair of the Board or the Commission may request that any matter of general application or producing effects in more than one Member State be examined by the Board with a view to obtaining an opinion, in particular where a competent supervisory authority does not comply with the obligations for mutual assistance in accordance with Article 61 or for joint operations in accordance with Article 62. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |64.3. |In the cases referred to in paragraphs 1 and 2, the Board shall issue an opinion on the matter submitted to it provided that it has not already issued an opinion on the same matter. That opinion shall be adopted within eight weeks by simple majority of the members of the Board. That period may be extended by a further six weeks, taking into account the complexity of the subject matter. Regarding the draft decision referred to in paragraph 1 circulated to the members of the Board in accordance with paragraph 5, a member which has not objected within a reasonable period indicated by the Chair, shall be deemed to be in agreement with the draft decision. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |64.4. |Supervisory authorities and the Commission shall, without undue delay, communicate by electronic means to the Board, using a standardised format any relevant information, including as the case may be a summary of the facts, the draft decision, the grounds which make the enactment of such measure necessary, and the views of other supervisory authorities concerned. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |64.5. |The Chair of the Board shall, without undue, delay inform by electronic means:

(a)

the members of the Board and the Commission of any relevant information which has been communicated to it using a standardised format. The secretariat of the Board shall, where necessary, provide translations of relevant information; and

(b)

the supervisory authority referred to, as the case may be, in paragraphs 1 and 2, and the Commission of the opinion and make it public.

| | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |64.6. |The competent supervisory authority shall not adopt its draft decision referred to in paragraph 1 within the period referred to in paragraph 3. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |64.7. |The supervisory authority referred to in paragraph 1 shall take utmost account of the opinion of the Board and shall, within two weeks after receiving the opinion, communicate to the Chair of the Board by electronic means whether it will maintain or amend its draft decision and, if any, the amended draft decision, using a standardised format. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |64.8. |Where the supervisory authority concerned informs the Chair of the Board within the period referred to in paragraph 7 of this Article that it does not intend to follow the opinion of the Board, in whole or in part, providing the relevant grounds, Article 65(1) shall apply. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |65.1. | In order to ensure the correct and consistent application of this Regulation in individual cases, the Board shall adopt a binding decision in the following cases:

(a)

where, in a case referred to in Article 60(4), a supervisory authority concerned has raised a relevant and reasoned objection to a draft decision of the lead authority or the lead authority has rejected such an objection as being not relevant or reasoned. The binding decision shall concern all the matters which are the subject of the relevant and reasoned objection, in particular whether there is an infringement of this Regulation;

(b)

where there are conflicting views on which of the supervisory authorities concerned is competent for the main establishment;

(c)

where a competent supervisory authority does not request the opinion of the Board in the cases referred to in Article 64(1), or does not follow the opinion of the Board issued under Article 64. In that case, any supervisory authority concerned or the Commission may communicate the matter to the Board.

| | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |65.2. |The decision referred to in paragraph 1 shall be adopted within one month from the referral of the subject-matter by a two-thirds majority of the members of the Board. That period may be extended by a further month on account of the complexity of the subject-matter. The decision referred to in paragraph 1 shall be reasoned and addressed to the lead supervisory authority and all the supervisory authorities concerned and binding on them. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |65.3. |Where the Board has been unable to adopt a decision within the periods referred to in paragraph 2, it shall adopt its decision within two weeks following the expiration of the second month referred to in paragraph 2 by a simple majority of the members of the Board. Where the members of the Board are split, the decision shall by adopted by the vote of its Chair. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |65.4. |The supervisory authorities concerned shall not adopt a decision on the subject matter submitted to the Board under paragraph 1 during the periods referred to in paragraphs 2 and 3. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |65.5. |The Chair of the Board shall notify, without undue delay, the decision referred to in paragraph 1 to the supervisory authorities concerned. It shall inform the Commission thereof. The decision shall be published on the website of the Board without delay after the supervisory authority has notified the final decision referred to in paragraph 6. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |65.6. |The lead supervisory authority or, as the case may be, the supervisory authority with which the complaint has been lodged shall adopt its final decision on the basis of the decision referred to in paragraph 1 of this Article, without undue delay and at the latest by one month after the Board has notified its decision. The lead supervisory authority or, as the case may be, the supervisory authority with which the complaint has been lodged, shall inform the Board of the date when its final decision is notified respectively to the controller or the processor and to the data subject. The final decision of the supervisory authorities concerned shall be adopted under the terms of Article 60(7), (8) and (9). The final decision shall refer to the decision referred to in paragraph 1 of this Article and shall specify that the decision referred to in that paragraph will be published on the website of the Board in accordance with paragraph 5 of this Article. The final decision shall attach the decision referred to in paragraph 1 of this Article. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |66.1. |In exceptional circumstances, where a supervisory authority concerned considers that there is an urgent need to act in order to protect the rights and freedoms of data subjects, it may, by way of derogation from the consistency mechanism referred to in Articles 63, 64 and 65 or the procedure referred to in Article 60, immediately adopt provisional measures intended to produce legal effects on its own territory with a specified period of validity which shall not exceed three months. The supervisory authority shall, without delay, communicate those measures and the reasons for adopting them to the other supervisory authorities concerned, to the Board and to the Commission. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |66.2. |Where a supervisory authority has taken a measure pursuant to paragraph 1 and considers that final measures need urgently be adopted, it may request an urgent opinion or an urgent binding decision from the Board, giving reasons for requesting such opinion or decision. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |66.3. |Any supervisory authority may request an urgent opinion or an urgent binding decision, as the case may be, from the Board where a competent supervisory authority has not taken an appropriate measure in a situation where there is an urgent need to act, in order to protect the rights and freedoms of data subjects, giving reasons for requesting such opinion or decision, including for the urgent need to act. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |66.4. |By derogation from Article 64(3) and Article 65(2), an urgent opinion or an urgent binding decision referred to in paragraphs 2 and 3 of this Article shall be adopted within two weeks by simple majority of the members of the Board. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |67. |The Commission may adopt implementing acts of general scope in order to specify the arrangements for the exchange of information by electronic means between supervisory authorities, and between supervisory authorities and the Board, in particular the standardised format referred to in Article 64.

Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2). | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |68.1. |The European Data Protection Board (the ‘Board’) is hereby established as a body of the Union and shall have legal personality. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |68.2. |The Board shall be represented by its Chair. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |68.3. |The Board shall be composed of the head of one supervisory authority of each Member State and of the European Data Protection Supervisor, or their respective representatives. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |68.4. |Where in a Member State more than one supervisory authority is responsible for monitoring the application of the provisions pursuant to this Regulation, a joint representative shall be appointed in accordance with that Member State’s law. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |68.5. |The Commission shall have the right to participate in the activities and meetings of the Board without voting right. The Commission shall designate a representative. The Chair of the Board shall communicate to the Commission the activities of the Board. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |68.6. |In the cases referred to in Article 65, the European Data Protection Supervisor shall have voting rights only on decisions which concern principles and rules applicable to the Union institutions, bodies, offices and agencies which correspond in substance to those of this Regulation. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |69.1. |The Board shall act independently when performing its tasks or exercising its powers pursuant to Articles 70 and 71. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |69.2. |Without prejudice to requests by the Commission referred to in point (b) of Article 70(1) and in Article 70(2), the Board shall, in the performance of its tasks or the exercise of its powers, neither seek nor take instructions from anybody. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |70.1. |The Board shall ensure the consistent application of this Regulation. To that end, the Board shall, on its own initiative or, where relevant, at the request of the Commission, in particular:

(a)

monitor and ensure the correct application of this Regulation in the cases provided for in Articles 64 and 65 without prejudice to the tasks of national supervisory authorities;

(b)

advise the Commission on any issue related to the protection of personal data in the Union, including on any proposed amendment of this Regulation;

(c)

advise the Commission on the format and procedures for the exchange of information between controllers, processors and supervisory authorities for binding corporate rules;

(d)

issue guidelines, recommendations, and best practices on procedures for erasing links, copies or replications of personal data from publicly available communication services as referred to in Article 17(2);

(e)

examine, on its own initiative, on request of one of its members or on request of the Commission, any question covering the application of this Regulation and issue guidelines, recommendations and best practices in order to encourage consistent application of this Regulation;

(f)

issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for further specifying the criteria and conditions for decisions based on profiling pursuant to Article 22(2);

(g)

issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for establishing the personal data breaches and determining the undue delay referred to in Article 33(1) and (2) and for the particular circumstances in which a controller or a processor is required to notify the personal data breach;

(h)

issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph as to the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of the natural persons referred to in Article 34(1).

(i)

issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for the purpose of further specifying the criteria and requirements for personal data transfers based on binding corporate rules adhered to by controllers and binding corporate rules adhered to by processors and on further necessary requirements to ensure the protection of personal data of the data subjects concerned referred to in Article 47;

(j)

issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for the purpose of further specifying the criteria and requirements for the personal data transfers on the basis of Article 49(1);

(k)

draw up guidelines for supervisory authorities concerning the application of measures referred to in Article 58(1), (2) and (3) and the setting of administrative fines pursuant to Article 83;

(l)

review the practical application of the guidelines, recommendations and best practices referred to in points (e) and (f);

(m)

issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for establishing common procedures for reporting by natural persons of infringements of this Regulation pursuant to Article 54(2);

(n)

encourage the drawing-up of codes of conduct and the establishment of data protection certification mechanisms and data protection seals and marks pursuant to Articles 40 and 42;

(o)

carry out the accreditation of certification bodies and its periodic review pursuant to Article 43 and maintain a public register of accredited bodies pursuant to Article 43(6) and of the accredited controllers or processors established in third countries pursuant to Article 42(7);

(p)

specify the requirements referred to in Article 43(3) with a view to the accreditation of certification bodies under Article 42;

(q)

provide the Commission with an opinion on the certification requirements referred to in Article 43(8);

(r)

provide the Commission with an opinion on the icons referred to in Article 12(7);

(s)

provide the Commission with an opinion for the assessment of the adequacy of the level of protection in a third country or international organisation, including for the assessment whether a third country, a territory or one or more specified sectors within that third country, or an international organisation no longer ensures an adequate level of protection. To that end, the Commission shall provide the Board with all necessary documentation, including correspondence with the government of the third country, with regard to that third country, territory or specified sector, or with the international organisation.

(t)

issue opinions on draft decisions of supervisory authorities pursuant to the consistency mechanism referred to in Article 64(1), on matters submitted pursuant to Article 64(2) and to issue binding decisions pursuant to Article 65, including in cases referred to in Article 66;

(u)

promote the cooperation and the effective bilateral and multilateral exchange of information and best practices between the supervisory authorities;

(v)

promote common training programmes and facilitate personnel exchanges between the supervisory authorities and, where appropriate, with the supervisory authorities of third countries or with international organisations;

(w)

promote the exchange of knowledge and documentation on data protection legislation and practice with data protection supervisory authorities worldwide.

(x)

issue opinions on codes of conduct drawn up at Union level pursuant to Article 40(9); and

(y)

maintain a publicly accessible electronic register of decisions taken by supervisory authorities and courts on issues handled in the consistency mechanism.

| | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |70.2. |Where the Commission requests advice from the Board, it may indicate a time limit, taking into account the urgency of the matter. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |70.3. |The Board shall forward its opinions, guidelines, recommendations, and best practices to the Commission and to the committee referred to in Article 93 and make them public. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |70.4. |The Board shall, where appropriate, consult interested parties and give them the opportunity to comment within a reasonable period. The Board shall, without prejudice to Article 76, make the results of the consultation procedure publicly available. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |71.1. |The Board shall draw up an annual report regarding the protection of natural persons with regard to processing in the Union and, where relevant, in third countries and international organisations. The report shall be made public and be transmitted to the European Parliament, to the Council and to the Commission. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |71.2. |The annual report shall include a review of the practical application of the guidelines, recommendations and best practices referred to in point (l) of Article 70(1) as well as of the binding decisions referred to in Article 65. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |72.1. |The Board shall take decisions by a simple majority of its members, unless otherwise provided for in this Regulation. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |72.2. |The Board shall adopt its own rules of procedure by a two-thirds majority of its members and organise its own operational arrangements. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |73.1. |The Board shall elect a chair and two deputy chairs from amongst its members by simple majority. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |73.2. |The term of office of the Chair and of the deputy chairs shall be five years and be renewable once. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |74.1. |The Chair shall have the following tasks:

(a)

to convene the meetings of the Board and prepare its agenda;

(b)

to notify decisions adopted by the Board pursuant to Article 65 to the lead supervisory authority and the supervisory authorities concerned;

(c)

to ensure the timely performance of the tasks of the Board, in particular in relation to the consistency mechanism referred to in Article 63.

| | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |74.2. |The Board shall lay down the allocation of tasks between the Chair and the deputy chairs in its rules of procedure. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |75.1. |The Board shall have a secretariat, which shall be provided by the European Data Protection Supervisor. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |75.2. | The secretariat shall perform its tasks exclusively under the instructions of the Chair of the Board. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |75.3. | The staff of the European Data Protection Supervisor involved in carrying out the tasks conferred on the Board by this Regulation shall be subject to separate reporting lines from the staff involved in carrying out tasks conferred on the European Data Protection Supervisor. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |75.4. |Where appropriate, the Board and the European Data Protection Supervisor shall establish and publish a Memorandum of Understanding implementing this Article, determining the terms of their cooperation, and applicable to the staff of the European Data Protection Supervisor involved in carrying out the tasks conferred on the Board by this Regulation. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |75.5. |The secretariat shall provide analytical, administrative and logistical support to the Board. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |75.6. |The secretariat shall be responsible in particular for:

(a)

the day-to-day business of the Board;

(b)

communication between the members of the Board, its Chair and the Commission;

(c)

communication with other institutions and the public;

(d)

the use of electronic means for the internal and external communication;

(e)

the translation of relevant information;

(f)

the preparation and follow-up of the meetings of the Board;

(g)

the preparation, drafting and publication of opinions, decisions on the settlement of disputes between supervisory authorities and other texts adopted by the Board.

| | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |76.1. |The discussions of the Board shall be confidential where the Board deems it necessary, as provided for in its rules of procedure. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |76.2. |Access to documents submitted to members of the Board, experts and representatives of third parties shall be governed by Regulation (EC) No 1049/2001 of the European Parliament and of the Council (21). | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |77.1. |Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation. |82.1. |Lice na koje se podaci odnose ima pravo da podnese pritužbu Povereniku ako smatra da je obrada podataka o njegovoj ličnosti izvršena suprotno odredbama ovog zakona. U postupku po pritužbi shodno se primenjuju odredbe zakona kojim se uređuje inspekcijski nadzor u delu koji se odnosi na postupanje po predstavkama. Podnošenje pritužbe Povereniku ne utiče na pravo ovog lica da pokrene druge postupke upravne ili sudske zaštite. |PU | | | | |77.2. |The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78. |82.2. |Poverenik je dužan da podnosioca pritužbe obavesti o toku postupka koji vodi, rezultatima postupka, kao i o pravu lica da pokrene sudski postupak u skladu sa članom 83. ovog zakona.

|PU | | | | |78.1. |Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. |83.1. |Lice na koje se podaci odnose, rukovalac, obrađivač, odnosno drugo fizičko ili pravno lice na koje se odnosi odluka Poverenika, doneta u skladu sa ovim zakonom, ima pravo da protiv te odluke tužbom pokrene upravni spor u roku od 30 dana od dana prijema odluke. Podnošenje tužbe u upravnom sporu ne utiče na pravo da se pokrenu drugi postupci upravne ili sudske zaštite. |PU | | | | |78.2. |Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to a an effective judicial remedy where the supervisory authority which is competent pursuant to Articles 55 and 56 does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77. |83.2. |Ako Poverenik u roku od 60 dana od dana podnošenja pritužbe ne postupi po pritužbi ili ne postupi u skladu sa članom 82. stav 2. ovog zakona, lice na koje se podaci odnose ima pravo da pokrene upravni spor.

|PU | | | | |78.3. |Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |78.4. |Where proceedings are brought against a decision of a supervisory authority which was preceded by an opinion or a decision of the Board in the consistency mechanism, the supervisory authority shall forward that opinion or decision to the court. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |79.1. |Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation. |84.1.

84.2.

84.3. |Lice na koje se podaci odnose ima pravo na sudsku zaštitu ako smatra da mu je, suprotno ovom zakonu, od strane rukovaoca ili obrađivača radnjom obrade njegovih podataka o ličnosti povređeno pravo propisano ovim zakonom. Podnošenje tužbe sudu ne utiče na pravo ovog lica da pokrene druge postupke upravne ili sudske zaštite.

Tužbom za zaštitu prava iz stava 1. ovog člana može se zahtevati od suda da obaveže tuženog na:

1) davanje informacije iz čl. 22. do 27, čl. 33. do 35. i člana 37. ovog zakona;

2) ispravku, odnosno brisanje podataka o tužiocu iz čl. 29, 30. i 32. ovog zakona;

3) ograničenje obrade iz čl. 31. i 32. ovog zakona;

4) davanje podataka u strukturisanom, uobičajno korišćenom i elektronski čitljivom obliku;

5) prenošenje podataka drugom rukovaocu iz člana 36. ovog zakona;

6) prekid obrade podataka iz člana 37. ovog zakona.

Tužbom za zaštitu prava iz stava 1. ovog člana može se zahtevati od suda i da utvrdi da je odluka koja se odnosi na tužioca doneta suprotno čl. 38. i 39. ovog zakona. |PU | | | | |79.2. |Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers. |84.4. |Tužba iz st. 2. i 3. ovog člana podnosi se višem sudu na čijoj teritoriji rukovalac, odnosno obrađivač ili njihov predstavnik ima prebivalište, boravište, odnosno sedište ili na čijoj teritoriji lice na koje se odnose podaci ima prebivalište ili boravište, osim ako je rukovalac, odnosno obrađivač organ vlasti.

|PU | | | | |80.1. |The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects’ rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law. |85. |Lice na koje se podaci odnose, u vezi sa zaštitom podataka o ličnosti, ima pravo da ovlasti predstavnika udruženja koje se bavi zaštitom prava i sloboda lica na koje se podaci odnose da ga, u skladu sa zakonom, zastupa u postupcima iz čl. 82. do 84. i člana 86. ovog zakona.

|PU | | | | |80.2. |Member States may provide that any body, organisation or association referred to in paragraph 1 of this Article, independently of a data subject’s mandate, has the right to lodge, in that Member State, a complaint with the supervisory authority which is competent pursuant to Article 77 and to exercise the rights referred to in Articles 78 and 79 if it considers that the rights of a data subject under this Regulation have been infringed as a result of the processing. | | |NP |Odredba nije obavezujuća | | | |81.1. |Where a competent court of a Member State has information on proceedings, concerning the same subject matter as regards processing by the same controller or processor, that are pending in a court in another Member State, it shall contact that court in the other Member State to confirm the existence of such proceedings. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |81.2. |Where proceedings concerning the same subject matter as regards processing of the same controller or processor are pending in a court in another Member State, any competent court other than the court first seized may suspend its proceedings. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |81.3. |Where those proceedings are pending at first instance, any court other than the court first seized may also, on the application of one of the parties, decline jurisdiction if the court first seized has jurisdiction over the actions in question and its law permits the consolidation thereof. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |82.1. |Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered. |86.1. |Lice koje je pretrpelo materijalnu ili nematerijalnu štetu zbog povrede odredaba ovog zakona ima pravo na novčanu naknadu ove štete od rukovaoca, odnosno obrađivača koji je štetu prouzrokovao. |PU | | | | |82.2. |Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation. A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller. |86.3. |Za štetu iz stava 1. ovog člana odgovara rukovalac, a obrađivač odgovara samo ako nije postupao u skladu sa obavezama propisanim ovim zakonom koje se odnose neposredno na njega ili kad je postupao izvan uputstava ili suprotno uputstvima rukovaoca, izdatim u skladu sa ovim zakonom. |PU | | | | |82.3. |A controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage. |86.4. |Rukovalac, odnosno obrađivač oslobađa se odgovornosti za štetu ako dokaže da ni na koji način nije odgovoran za nastanak štete.

|PU | | | | |82.4. |Where more than one controller or processor, or both a controller and a processor, are involved in the same processing and where they are, under paragraphs 2 and 3, responsible for any damage caused by processing, each controller or processor shall be held liable for the entire damage in order to ensure effective compensation of the data subject. |86.5. |Ako obradu vrše više rukovalaca, odnosno obrađivača ili zajedno rukovalac i obrađivač, i ako su oni odgovorni za štetu, svaki rukovalac, odnosno obrađivač odgovoran je za celokupan iznos naknade štete.

|PU | | | | |82.5. |Where a controller or processor has, in accordance with paragraph 4, paid full compensation for the damage suffered, that controller or processor shall be entitled to claim back from the other controllers or processors involved in the same processing that part of the compensation corresponding to their part of responsibility for the damage, in accordance with the conditions set out in paragraph 2. |86.6. |Ako je rukovalac, odnosno obrađivač iz stava 5. ovog člana isplatio celokupan iznos naknade štete, on ima pravo da zahteva od drugih rukovaoca, odnosno obrađivača povraćaj dela iznosa koji odgovara njihovoj odgovornosti za nastanak štete, u skladu sa stavom 3. ovog člana.

|PU | | | | |82.6. |Court proceedings for exercising the right to receive compensation shall be brought before the courts competent under the law of the Member State referred to in Article 79(2). | | |NP |Pitanje nadležnosti u sporovima za naknadu štete je uređeno Zakonom o uređenju sudova | | | |83.1. |Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive. |87.1. |Novčane kazne zbog povrede odredbi ovog zakona u svakom pojedinačnom slučaju izriču se i primenjuju na delotvoran, srazmeran i preventivan način.

|PU | | | | |83.2. |Administrative fines shall, depending on the circumstances of each individual case, be imposed in addition to, or instead of, measures referred to in points (a) to (h) and (j) of Article 58(2). When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following:

(a)

the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them;

(b)

the intentional or negligent character of the infringement;

(c)

any action taken by the controller or processor to mitigate the damage suffered by data subjects;

(d)

the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them pursuant to Articles 25 and 32;

(e)

any relevant previous infringements by the controller or processor;

(f)

the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement;

(g)

the categories of personal data affected by the infringement;

(h)

the manner in which the infringement became known to the supervisory authority, in particular whether, and if so to what extent, the controller or processor notified the infringement;

(i)

where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned with regard to the same subject-matter, compliance with those measures;

(j)

adherence to approved codes of conduct pursuant to Article 40 or approved certification mechanisms pursuant to Article 42; and

(k)

any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement.

|87.2.

87.3. |Novčane kazne iz stava 1. ovog člana, u zavisnosti od okolnosti pojedinačnog slučaja, mogu se izreći uz mere ili umesto mera propisanih članom 79. stav 2. tač. 1) do 8) i tačka 10) ovog zakona.

Prilikom odlučivanja o izricanju novčanih kazni i njihovom iznosu mora se u svakom pojedinačnom slučaju voditi računa o:

1) prirodi, težini i trajanju povrede odredbi zakona, uzimajući u obzir vrstu, obim i svrhu obrade, kao i broj lica na koje se podaci odnose i nivo štete koju su oni pretrpeli;

2) postojanju namere ili nepažnje prekršioca;

3) svakoj radnji rukovaoca i obrađivača usmerenoj na otklanjanje ili ublažavanje štete koju su pretrpela lica na koje se podaci odnose;

4) stepenu odgovornosti rukovaoca i obrađivača, uzimajući u obzir mere koje su primenili u skladu sa članom 42. i članom 50. ovog zakona;

5) prethodnim slučajevima kršenja odredbi ovog zakona od strane rukovaoca i obrađivača koji su od značaja za izricanje kazne;

6) stepenu saradnje rukovaoca i obrađivača sa Poverenikom u cilju otklanjanja posledica povrede zakona i otklanjanja ili ublažavanja štetnih posledica povrede;

7) vrstama podataka o ličnosti na koje se odnose povrede;

8) načinu na koji je Poverenik saznao za povredu, a posebno o tome da li je i u kojoj meri rukovalac, odnosno obrađivač obavestio Poverenika o povredi;

9) postupanju u skladu sa korektivnim merama Poverenika koje su ranije izrečene rukovaocu, odnosno obrađivaču u vezi sa istim slučajem povrede, u skladu sa članom 79. stav 2. ovog zakona;

10) primeni odobrenih kodeksa postupanja u skladu sa članom 59. ovog zakona, odnosno postojanju sertifikata iz člana 61. ovog zakona;

11) svim drugim otežavajućim i olakšavajućim okolnostima u konkretnom slučaju, kao što su izbegavanje finansijskog gubitka ili finansijska korist koja je ostvarena na neposredan ili posredan način povredom odredbi ovog zakona. |PU | | | | |83.3. |If a controller or processor intentionally or negligently, for the same or linked processing operations, infringes several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount specified for the gravest infringement. | | |NP |Novčane kazne i njihovi iznosi uređeni su Zakonom o prekršajima. | | | |83.4. |Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:

(a)

the obligations of the controller and the processor pursuant to Articles 8, 11, 25 to 39 and 42 and 43;

(b)

the obligations of the certification body pursuant to Articles 42 and 43;

(c)

the obligations of the monitoring body pursuant to Article 41(4).

| | |NP |Novčane kazne i njihovi iznosi uređeni su Zakonom o prekršajima. | | | |83.5. |Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:

(a)

the basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7 and 9;

(b)

the data subjects’ rights pursuant to Articles 12 to 22;

(c)

the transfers of personal data to a recipient in a third country or an international organisation pursuant to Articles 44 to 49;

(d)

any obligations pursuant to Member State law adopted under Chapter IX;

(e)

non-compliance with an order or a temporary or definitive limitation on processing or the suspension of data flows by the supervisory authority pursuant to Article 58(2) or failure to provide access in violation of Article 58(1).

| | |NP |Novčane kazne i njihovi iznosi uređeni su Zakonom o prekršajima. | | | |83.6. |Non-compliance with an order by the supervisory authority as referred to in Article 58(2) shall, in accordance with paragraph 2 of this Article, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher. | | |NP |Novčane kazne i njihovi iznosi uređeni su Zakonom o prekršajima. | | | |83.7. |Without prejudice to the corrective powers of supervisory authorities pursuant to Article 58(2), each Member State may lay down the rules on whether and to what extent administrative fines may be imposed on public authorities and bodies established in that Member State. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |83.8. |The exercise by the supervisory authority of its powers under this Article shall be subject to appropriate procedural safeguards in accordance with Union and Member State law, including effective judicial remedy and due process. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |83.9. |Where the legal system of the Member State does not provide for administrative fines, this Article may be applied in such a manner that the fine is initiated by the competent supervisory authority and imposed by competent national courts, while ensuring that those legal remedies are effective and have an equivalent effect to the administrative fines imposed by supervisory authorities. In any event, the fines imposed shall be effective, proportionate and dissuasive. Those Member States shall notify to the Commission the provisions of their laws which they adopt pursuant to this paragraph by 25 May 2018 and, without delay, any subsequent amendment law or amendment affecting them. |78.1.

tačka 8) |Poverenik:

……

|PU | | | | |84.1. |Member States shall lay down the rules on other penalties applicable to infringements of this Regulation in particular for infringements which are not subject to administrative fines pursuant to Article 83, and shall take all measures necessary to ensure that they are implemented. Such penalties shall be effective, proportionate and dissuasive. |87.1. |Novčane kazne zbog povrede odredbi ovog zakona u svakom pojedinačnom slučaju izriču se i primenjuju na delotvoran, srazmeran i preventivan način.

|PU | | | | |84.2. |Each Member State shall notify to the Commission the provisions of its law which it adopts pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |85.1. |Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression. |100. |Odredbe drugih zakona, koje se odnose na obradu podataka o ličnosti, uskladiće se sa odredbama ovog zakona do kraja 2020. godine.

|PU | | | | |85.2. |For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information. |88. |Na obradu koja se vrši u svrhe novinarskog istraživanja i objavljivanja informacija u medijima, kao i u svrhe naučnog, umetničkog ili književnog izražavanja, ne primenjuju se odredbe Glave II. do VI. i čl. 89. do 94. ovog zakona, ako su u konkretnom slučaju ova ograničenje neophodna u cilju zaštite slobode izražavanja i informisanja.

|PU | | | | |85.3. |Each Member State shall notify to the Commission the provisions of its law which it has adopted pursuant to paragraph 2 and, without delay, any subsequent amendment law or amendment affecting them. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |86. |Personal data in official documents held by a public authority or a public body or a private body for the performance of a task carried out in the public interest may be disclosed by the authority or body in accordance with Union or Member State law to which the public authority or body is subject in order to reconcile public access to official documents with the right to the protection of personal data pursuant to this Regulation. |89. |Informacije od javnog značaja koje sadrže podatke o ličnosti mogu biti učinjene dostupnim tražiocu informacije od strane organa vlasti na način kojim se obezbeđuje da se pravo javnosti da zna i pravo na zaštitu podataka o ličnosti mogu ostvariti zajedno, u meri propisanoj zakonom kojim se uređuje slobodan pristup informacijama od javnog značaja i ovim zakonom.

|PU | | | | |87. |Member States may further determine the specific conditions for the processing of a national identification number or any other identifier of general application. In that case the national identification number or any other identifier of general application shall be used only under appropriate safeguards for the rights and freedoms of the data subject pursuant to this Regulation. |90. |Na obradu jedinstvenog matičnog broja građana, primenjuju se odredbe zakona kojim se uređuje jedinstveni matični broj građana, odnosno drugog zakona, uz primenu odredbi ovog zakona koje se odnose na zaštitu prava i sloboda lica na koje se podaci odnose. |PU | | | | |88.1. | Member States may, by law or by collective agreements, provide for more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees’ personal data in the employment context, in particular for the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, equality and diversity in the workplace, health and safety at work, protection of employer’s or customer’s property and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship. |91.1. |Na obradu u oblasti rada i zapošljavanja primenjuju se odredbe zakona kojima se uređuje rad i zapošljavanje i kolektivni ugovori, uz primenu odredbi ovog zakona.

|PU | | | | |88.2. |Those rules shall include suitable and specific measures to safeguard the data subject’s human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place. |91.2. |Ako zakon koji uređuje rad i zapošljavanje ili kolektivni ugovor sadrže odredbe o zaštiti podataka o ličnosti, moraju se propisati i posebne mere zaštite dostojanstva ličnosti, legitimnih interesa i osnovnih prava lica na koje se podaci odnose, posebno u odnosu na transparentnost obrade, razmenu podataka o ličnosti unutar multinacionalne kompanije, odnosno grupe privrednih subjekata, kao i sistem nadzora u radnoj sredini. |PU | | | | |88.3. |Each Member State shall notify to the Commission those provisions of its law which it adopts pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |89.1. |Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner. |92.1.

92.2.

|Na obradu u svrhe arhiviranja u javnom interesu, u svrhe naučnog ili istorijskog istraživanja ili u statističke svrhe primenjuju se odgovarajuće mere zaštite prava i sloboda lica na koje se podaci odnose propisane ovim zakonom. Te mere obezbeđuju primenu tehničkih, organizacionih i kadrovskih mera, a posebno kako bi se obezbedilo poštovanja načela minimizacije podataka. Te mere mogu obuhvatiti pseudonimizaciju, ako se svrha obrade može ostvariti upotrebom te mere.

Ako se svrhe iz stava 1. ovog člana mogu ostvariti bez identifikacije ili bez dalje identifikacije lica na koje se podaci odnose, te svrhe se moraju ostvariti na način koji onemogućava dalju identifikaciju tog lica. |PU | | | | |89.2. |Where personal data are processed for scientific or historical research purposes or statistical purposes, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes. |92.3.

|Odredbe o pravima lica na koje se podaci odnose iz čl. 26, 29, 31. i 37. ovog zakona se ne primenjuju ako se obrada vrši u svrhe naučnog ili istorijskog istraživanja ili statističke svrhe, ako je to neophodno za ostvarivanje tih svrha ili ako bi primena tih odredbi zakona onemogućila ili značajno otežala njihovo ostvarivanje, uz primenu mera iz st. 1. i 2. ovog člana. |PU | | | | |89.3. |Where personal data are processed for archiving purposes in the public interest, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18, 19, 20 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes. |92.4.

|Odredbe o pravima lica na koje se podaci odnose iz čl. 26. i 29. i čl. 31. do 37. ovog zakona ne primenjuju se ako se obrada vrši u svrhe arhiviranja u javnom interesu, ako je to neophodno za ostvarivanje te svrhe ili ako bi primena tih odredbi zakona onemogućila ili značajno otežala njeno ostvarivanje, uz primenu mera iz st. 1. i 2. ovog člana.

|PU | | | | |89.4. |Where processing referred to in paragraphs 2 and 3 serves at the same time another purpose, the derogations shall apply only to processing for the purposes referred to in those paragraphs. |92.5. |Ako se obrada iz st. 3. i 4. ovog člana vrši i u druge svrhe, na obradu u druge svrhe primenjuju se odredbe ovog zakona bez ograničenja.

|PU | | | | |90.1. |Member States may adopt specific rules to set out the powers of the supervisory authorities laid down in points (e) and (f) of Article 58(1) in relation to controllers or processors that are subject, under Union or Member State law or rules established by national competent bodies, to an obligation of professional secrecy or other equivalent obligations of secrecy where this is necessary and proportionate to reconcile the right of the protection of personal data with the obligation of secrecy. Those rules shall apply only with regard to personal data which the controller or processor has received as a result of or has obtained in an activity covered by that obligation of secrecy. | | |NP |Ovo pitanje je uređeno Zakonom o tajnosti podataka. | | | |90.2. |Each Member State shall notify to the Commission the rules adopted pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |91.1. |Where in a Member State, churches and religious associations or communities apply, at the time of entry into force of this Regulation, comprehensive rules relating to the protection of natural persons with regard to processing, such rules may continue to apply, provided that they are brought into line with this Regulation. |93.1. |Ako crkve ili verske zajednice primenjuju sveobuhvatna pravila u pogledu zaštite fizičkih lica u odnosu na obradu, ta postojeća pravila mogu se i dalje primenjivati pod uslovom da se usklade sa ovim zakonom.

|PU | | | | |91.2. |Churches and religious associations which apply comprehensive rules in accordance with paragraph 1 of this Article shall be subject to the supervision of an independent supervisory authority, which may be specific, provided that it fulfils the conditions laid down in Chapter VI of this Regulation. |93.2. |U slučaju iz stava 1. ovog člana, primenjuju se i odredbe ovog zakona o inspekcijskim i drugim ovlašćenjima Poverenika iz čl. 77. do 79. ovog zakona, osim ako crkva, odnosno verska zajednica, ne obrazuje posebno nezavisno nadzorno telo koje će vršiti ta ovlašćenja, pod uslovom da takvo telo ispunjava sve uslove predviđene Poglavljem VI. ovog zakona. |PU | | | | |92.1. |The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |92.2. |The delegation of power referred to in Article 12(8) and Article 43(8) shall be conferred on the Commission for an indeterminate period of time from 24 May 2016. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |92.3. |The delegation of power referred to in Article 12(8) and Article 43(8) may be revoked at any time by the European Parliament or by the Council. A decision of revocation shall put an end to the delegation of power specified in that decision. It shall take effect the day following that of its publication in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |92.4. |As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |92.5. |A delegated act adopted pursuant to Article 12(8) and Article 43(8) shall enter into force only if no objection has been expressed by either the European Parliament or the Council within a period of three months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by three months at the initiative of the European Parliament or of the Council. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |93.1. |The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |93.2. |Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |93.3. |Where reference is made to this paragraph, Article 8 of Regulation (EU) No 182/2011, in conjunction with Article 5 thereof, shall apply. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |94.1. | Directive 95/46/EC is repealed with effect from 25 May 2018. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |94.2. |References to the repealed Directive shall be construed as references to this Regulation. References to the Working Party on the Protection of Individuals with regard to the Processing of Personal Data established by Article 29 of Directive 95/46/EC shall be construed as references to the European Data Protection Board established by this Regulation. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |95. |This Regulation shall not impose additional obligations on natural or legal persons in relation to processing in connection with the provision of publicly available electronic communications services in public communication networks in the Union in relation to matters for which they are subject to specific obligations with the same objective set out in Directive 2002/58/EC. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |96. |International agreements involving the transfer of personal data to third countries or international organisations which were concluded by Member States prior to 24 May 2016, and which comply with Union law as applicable prior to that date, shall remain in force until amended, replaced or revoked. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |97.1. |By 25 May 2020 and every four years thereafter, the Commission shall submit a report on the evaluation and review of this Regulation to the European Parliament and to the Council. The reports shall be made public. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |97.2. |In the context of the evaluations and reviews referred to in paragraph 1, the Commission shall examine, in particular, the application and functioning of:

(a)

Chapter V on the transfer of personal data to third countries or international organisations with particular regard to decisions adopted pursuant to Article 45(3) of this Regulation and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC;

(b)

Chapter VII on cooperation and consistency.

| | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |97.3. |For the purpose of paragraph 1, the Commission may request information from Member States and supervisory authorities. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |97.4. |In carrying out the evaluations and reviews referred to in paragraphs 1 and 2, the Commission shall take into account the positions and findings of the European Parliament, of the Council, and of other relevant bodies or sources. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |97.5. |The Commission shall, if necessary, submit appropriate proposals to amend this Regulation, in particular taking into account of developments in information technology and in the light of the state of progress in the information society. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |98. |The Commission shall, if appropriate, submit legislative proposals with a view to amending other Union legal acts on the protection of personal data, in order to ensure uniform and consistent protection of natural persons with regard to processing. This shall in particular concern the rules relating to the protection of natural persons with regard to processing by Union institutions, bodies, offices and agencies and on the free movement of such data. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |99.1. |This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |99.2. |It shall apply from 25 May 2018.

This Regulation shall be binding in its entirety and directly applicable in all Member States. | | |NP |Propisane obaveze se odnose na države članice Evropske unije. | | | |