Data Subject Rights Management Procedure (GDPR)

Transcription

1 Data Subject Rights Management Prcedure (GDPR) PROC-CORP-04

2 Cntent: 1. Objetive Scpe Terms and Definitins Descriptin f data subject rights Persnal data and prcessing frm Gnvarri emplyees Data subject rights executin Reply deadlines Refusal the exercise the rights f the data subject Language Cntrl f versins Apprval and entry int frce... 9 ANEXO Data Subject Rights Management Prcedure (GDPR) (PROC-CORP-04) Página: 2 / 15

3 1. Objetive The purpse f this dcument is t determine the prtcl t be fllwed in rder t cmply with the rights f access, rectificatin, cancellatin, frgetfulness, ppsitin, limitatin f prcessing, prtability and ppsitin t autmated decisin-making f persnal data held in the files wned by the cmpanies within the Gnvarri Steel Services (hereinafter GSS) management system. The Eurpean General Data Prtectin Regulatin (GDPR) cntains the rights f the data subject, including clarificatins and new rights. The Regulatin als lays dwn specific cnditins cncerning the prcedure t be fllwed in rder t ensure that data subjects can exercise their rights. The purpse f this prcedure is t bring clser tgether and facilitate the prcedure t be fllwed by GSS stakehlders in rder t give effect t their rights in this area with regard t the persnal data prvided t the cmpany 2. Scpe This prcedure applies t all the cmpanies that make up the Gnvarri Steel Services Grup, in which the parent cmpany, Gnvarri Crpración Financiera, S.L.U., and all the persnnel f the Gnvarri Steel Services Grup hld a majrity interest, directly r indirectly, in the exercise f their functins and respnsibilities, and in all the prfessinal areas in which they represent the Grup, meaning the directrs, executives, emplyees and cllabratrs f the GSS Grup, regardless f their psitin, respnsibility r gegraphical lcatin. In any case, the Grup's actins cmply with the legislatin in frce in each jurisdictin, and therefre, in sme f these jurisdictins, the principles set frth in this plicy may be replaced by mre restrictive laws and regulatins in frce. 3. Terms and Definitins Affected: The persn t whm the data belngs. Cmmunicatin r transfer f data: Any disclsure f data t a persn ther than the data subject. Cnsent f the data subject: Any expressin f free, unequivcal, specific and infrmed will by which the data subject cnsents t the prcessing f persnal data cncerning him/her. Data Subject Rights Management Prcedure (GDPR) (PROC-CORP-04) Página: 3 / 15

4 Persnal Data: Any infrmatin cncerning identified r identifiable individuals. Right f Access: It is acknwledged that the interested party may request a cpy f the persnal data prcessed by GSS. Right t Erasure/t be frgtten: Request the cancellatin f yur data. Yu must take int accunt whether the data whse cancellatin is requested is necessary and nt errneus, neither bslete nr excessive, in the emplyment relatinship. Right t restrictin f prcessing: In the exercise f this right, the interested party can request that, t his persnal data, temprarily r indefinitely, the peratins f treatment that wuld crrespnd in each case are nt applied. Right t bject: With the exercise f this right, the wner f the data is ppsed t the use f any persnal data fr a specific purpse. Yu must take int accunt whether the prcessing f the data t which yu bject is necessary in the emplyment relatinship, because if it is, GSS will be authrized t refuse it. Right t data Prtability: In the exercise f this right, the data subject may request that his/her data be transmitted frm ne party respnsible t anther, r t his/her persn, in a structured, cmmn and autmated frmat that allws fr its autmated reading. Right t rectificatin: By exercising this right, the data subject cmmunicates t GSS the data that have changed and n lnger crrespnd t his persn s that they can be mdified r cancelled. Data prcessr: A natural r legal persn, public authrity, service r any ther bdy which, alne r jintly with thers, prcesses data n behalf f the cntrller. File: Any rganized set f persnal data, whatever the frm r mdality f its creatin, strage, rganizatin and access. Stakehlder: The persn t whm the data belngs. Data prcessing: Operatins and technical prcedures f an autmated r nn-autmated nature that allw fr the cllectin, recrding, strage, prcessing, mdificatin, blcking and cancellatin, as well as the transfer f data resulting frm cmmunicatins, queries, intercnnectins and transfers. Cntrller: Natural r legal persn, public r private, r administrative bdy, wh decides n the purpse, cntent and use f the prcessing. Applicant: Persn t whm the data belngs. Data Subject Rights Management Prcedure (GDPR) (PROC-CORP-04) Página: 4 / 15

5 4. Descriptin f data subject rights 4.1 Persnal data and prcessing frm Gnvarri emplyees Any persn shall have the right t request and btain, free f charge, infrmatin n the persnal data subject t prcessing, the rigin f such data, as well as the cmmunicatins made r planned. Additinally, the interested party may request the rectificatin, cancellatin, ppsitin r prtability f their persnal data. The rights will be exercised by means f a request addressed t the mailbx Privacy.Rights@Gnvarri.cm using the frm included in Annex. N cnsideratin is required fr the exercise f the rights f the data subjects Right f Access The data subject shall have the right t btain cnfirmatin frm the Privacy Officer as t whether the data are being prcessed r transferred t a third cuntry r t an internatinal rganizatin. In the event that the data subject requests a cpy f the persnal data prcessed, the Privacy Officer shall prvide it in a cmmn electrnic frmat Right f Rectificatin The data subject shall have the right t have inaccurate persnal data cncerning him crrected withut undue delay by the cntrller. Taking int accunt the purpses f the prcessing, the data subject shall have the right t have incmplete persnal data supplemented, including by an additinal declaratin Right t erasure (Right t be frgtten) The data subject shall have the right t btain withut undue delay frm the Privacy Officer the deletin f persnal data cncerning him/her. The Privacy Officer is bliged t delete persnal data when: The data are nt necessary fr the purpses fr which they were cllected. Are bslete. The data subject's cnsent t prcessing is withdrawn. Have been used in an unlawful manner Right t bject The data subject shall have the right t bject at any time t the prcessing f his r her persnal data, prvided that such prcessing is lawful. Yu may bject t the prcessing f yur data fr reasns related t yur particular situatin, when the prcessing is based n: direct marketing; Data Subject Rights Management Prcedure (GDPR) (PROC-CORP-04) Página: 5 / 15

6 prfiling; legitimate interest f the data cntrller r third parties, prvided that the interests r rights and freedms f the data subject d nt prevail, especially if yu are a child; r the purpses f the prcessing are assciated with: histrical, statistical r scientific research, unless the prcessing is necessary fr reasns f public interest Right t restrictin f prcessing The data subject shall have the right t btain frm the Privacy Officer the limitatin f the prcessing f the data when any f the fllwing cnditins are met: The data subject cntests the accuracy f the persnal data. The prcessing is unlawful and the data subject bjects t the deletin f the data and instead requests the limitatin f their use. The data cntrller n lnger needs the persnal data fr the purpses f prcessing, but the data subject needs them fr the frmulatin, exercise r defence f claims. The data subject has ppsed prcessing, while it is being checked whether the data cntrller's legitimate reasns prevail ver the data subjects Right t data prtability The data subject shall have the right t have his r her data transmitted by the Privacy Officer t anther Data Prcessr r t the data subject himself r herself, in a structured frmat fr nrmal use and mechanical reading, when prcessing is carried ut by autmated means Right t bject autmated decisin-making The data subject shall have the right nt t be the subject f a decisin based slely n autmated prcessing, including prfiling, which has legal effect n him r affects him in a similar manner. 4.2 Data subject rights executin The Privacy Officer must infrm the data subjects f the pssibility f exercising the data subject's rights under the new Eurpean regulatin. Fr the exercise f the rights, the template available n the website will be cmpleted with the data f the persn interested in exercising the rights and will be sent t the address privacy.rights@gnvarri.cm The infrmatin may be requested by the data subject r his r her legal representative (in cases f disability r minrity), expressly by sending the frm in Annex A and a phtcpy f the Natinal Identity Dcument t the mailbx privacy.rights@gnvarri.cm t certify his r her representatin and detailing, where apprpriate, the data t which he r she wishes t have access r n which the Privacy Officer must act. In the event that the requirement f identificatin f the data subject is nt met (e.g.: request requested by a persn ther than the data subject, lack f accreditatin by the legal Data Subject Rights Management Prcedure (GDPR) (PROC-CORP-04) Página: 6 / 15

7 representative, etc.), the Privacy Officer infrms the data subject in writing f the impssibility f attending t the request until it is identified as specified. Once the request is received, the Privacy Officer decides whether r nt t accept it. In bth cases, it cmmunicates the decisin t the persn cncerned in writing s that he r she can subsequently prve it (registered mail with acknwledgement f receipt). Likewise, in the event f acceptance, the Privacy Officer may als facilitate access t yur persnal data in the crrespnding file thrugh direct viewing by the interested party at the Privacy Officer's premises. In this case, the Privacy Officer issues a written statement stating, with the signature f the interested party, that the right f access has been exercised in frm and time. All requests fr the exercise f rights received frm the data subject are duly recrded. In all cases, the Privacy Officer infrms the Privacy Officer f the actins t be taken in relatin t the requests received In cases where the data have been cllected r recrded by fraudulent, unfair r illicit means, the cancellatin f the same always invlves the immediate deletin, and never the blcking f the data. In any event, such deletin is carried ut when pssible cntractual bligatins are extinguished r when the law impses n the maintenance f dcuments. This premise must be studied by the Privacy Officer and the sectr invlved befre prceeding with any actin. Data Subject Rights Management Prcedure (GDPR) (PROC-CORP-04) Página: 7 / 15

8 4.3 Reply deadlines Privacy Officer must answer all the requests received and analysed, regardless f whether r nt the persnal data f the data subject appear in his r her files r prcessing. T this end, it uses the reply frmats mentined in sectin 4.2 "Exercise f these Rights" and any ther means f prving that the message has been sent and received (registered letter with acknwledgement f receipt). T answer the requests received, whether estimated r nt, the Privacy Officer has the fllwing maximum deadlines: Right Deadline Right f access Right t rectificatin Right t erasure/t be frgtten Right t bject Right t restrictin f prcessing Right t prtability Right t bject autmated decisinmaking 1 mnth frm receipt f the applicatin. 1 mnth frm receipt f the applicatin. 1 mnth frm receipt f the applicatin. 1 mnth frm receipt f the applicatin. 1 mnth frm receipt f the applicatin. 1 mnth frm receipt f the applicatin. 1 mnth frm receipt f the applicatin. Once the afrementined perids have elapsed, as apprpriate, withut the Privacy Officer expressly respnding t the requests, these may be cnsidered rejected and the applicant may ldge the crrespnding cmplaint with the crrespnding data prtectin agency and take legal actin. 4.4 Refusal the exercise the rights f the data subject The Privacy Officer may deny access t files r prcessing when: The data subject has already exercised his right within a perid f less than twelve mnths and there is n evidence f a legitimate interest t that effect. The request has been made by a persn ther than the affected persn (nly in cases f disability and minrity f the affected persn, when it is nt prven that he r she is the legal representative). Data Subject Rights Management Prcedure (GDPR) (PROC-CORP-04) Página: 8 / 15

9 The Privacy Officer can nly refuse the rectificatin, ppsitin r cancellatin r frgetfulness f the files r prcessing when: The request has been made by a persn ther than the affected persn (nly in cases f disability and minrity f the affected persn, when it is nt prven that he r she is the legal representative). The cancellatin causes damage t the legitimate interests f the affected party r third parties. There is an bligatin t retain the data. 5. Language This Standard is published in Spanish and English, the frmer being prevalent in case f divergence between the tw. 6. Cntrl f versins Versin Date Descriptin Prepared by Review by Versin 1 19th July 2018 Initial Versin f the Daniel Lluch Cmpliance Dcument Cmmittee 7. Apprval and entry int frce This Standard has been apprved by the Cmpliance Cmmittee f Gnvarri Steel Services Grup n July the 19th f 2018, and takes effect 20 calendar days after its apprval. As f the entry int frce, the previus prvisins existing in their case that regulate the same cntent are repealed. Data Subject Rights Management Prcedure (GDPR) (PROC-CORP-04) Página: 9 / 15

10 SIGNED BY COMPLIANCE COMMITTEE Pabl Gnzález de Sus Jesus Bal Francisc Bazaga Antni Barbsa Data Subject Rights Management Prcedure (GDPR) (PROC-CORP-04) Página: 10 / 15

11 ANNEX Instructins fr the Exercise f the Data Subject Rights Data Subject Rights Management Prcedure (GDPR) (PROC-CORP-04) Página: 11 / 15

12 Instructins fr the Exercise f the Data Subject Rights The frm yu will find n the fllwing page is the way Gnvarri Steel Service has established fr the exercise f the rights f the interested party (Access, Rectificatin, Cancellatin r Frgetfulness, Oppsitin, Autmated Oppsitin, Prtability and Limitatin f Prcessing), in cmpliance with the new Eurpean regulatin n the Prtectin f Persnal Data, GDPR. The methd t send us yur request is the BOX. The prcedure is as fllws (all steps are necessary): 1. Print the frm and fill it in 2. Sign it 3. Include a phtcpy f yur ID card r alternative dcument prving yur identity (if yu are acting n behalf f a third party, cpies f the ID card f the representative and f the dcument prving the representatin f the interested party will be included). 4. Send the dcuments t the inbx: privacy.rights@gnvarri.cm Data Subject Rights Management Prcedure (GDPR) (PROC-CORP-04) Página: 12 / 15

13 Rights Executin Request Frm Mr Mrs. Address Zip Cde: ID: City Cunty/ Regin Telephne: Relatinship with the cntrller: Online Registratin CV Scunting Supplier Client Cntact GSS Emplyee Other (Describe) I request t execute my right (check the crrespnding bx): Access, t be infrmed f my persnal Data in the cntrller s pssessin. Rectificatin, f the fllw data which are incrrect r unnecessary t recrd: Erasure, f the fllwing data: Objectin, f the persnal data fr the fllwing purpses: T receive cmmunicatins r infrmatin Others (specify) Data Subject Rights Management Prcedure (GDPR) (PROC-CORP-04) Página: 13 / 15

14 Restrictin f prcessing, f the fllwing data that shall nt be used the prcessing peratin: Prtability, f the fllwing data, the data subject have right t get this data transferred t anther cntrller: Objectin t the autmated prcessing f the fllwing data, this persnal infrmatin might nt be the subject f an autmated decisin making prcess, including prfiling f the data subject. Signature: The prcessing f the persnal data prvided, as well as any ther data cllected in the curse f the prcess, is authrized, as prvided fr in Regulatin (EU) 2016/679 f the Eurpean Parliament and f the Cuncil. These will be treated by Gnvarri Steel Services, Prlngación de Embajadres S/N,28053 Madrid inf@gnvarri.cm, as the persn in charge f the data prcessing.. The data are prcessed with the aim f respnding t the rights f the data subjects. The persnal data prcessed have been prvided by the data subject r his r her legal representative. The persnal data t be prcessed are the cntact details f the interested parties. The persnal data prvided will be kept as lng as n request fr deletin is made by the data subject r his r her legal representative. The interested party is infrmed that his r her data will nt be passed n t third parties, unless legally bliged t d s. Whenever there is any alteratin r mdificatin in the persnal data, the interested party must infrm Gnvarri Steel Service as sn as pssible. The interested party may exercise their rights by filling in this frm and sending it t the abve address. Data Subject Rights Management Prcedure (GDPR) (PROC-CORP-04) Página: 14 / 15

15 Data Subject Rights Management Prcedure (GDPR) (PROC-CORP-04) Página: 15 / 15