First name, last name, address, telephone number, e-mail address, location data, IP address, marital status, face photo, habits and preferences, online identifiers and any other data related to the physical, physiological, economic, cultural or social identity that can be used to directly or indirectly identify a natural person.
Data relating to racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, health data, genetic data, biometrics, personal identification data or data related to life or sexual orientation. The processing of these data is allowed only in the cases strictly provided by law.
You can by yourself transmit personal data when this is necessary to fulfill certain obligations, or when this is provided by law. For example, provide the home address of an online store to deliver the order, present the identity card to confirm the age when you buy alcohol in a store, provide personal data to a hospital to receive treatment, etc.
You can process the personal data of other people, if this data is necessary to achieve a legal purpose. Provide this information when requested by law enforcement. You can transmit personal data to the court to defend your rights. In general, the volume and categories of data transmitted should not exceed the established purpose. If, for example, a divorced person seeks the contact details of the ex-spouse, disclosure of this information would not be justified.
You must comply with personal data protection legislation if you collect, store, transfer, disclose by transmission or if, by automated means, you process personal data, which are part of a filing system in connection with a professional or commercial activity. The legislation in the field does not apply to the processing of personal data for personal or domestic purposes (phone numbers registered in the phone book, family photo album, use of data when selling the property).
A company must determine the purpose for which it is going to collect the data and how it will use it. A company may process personal data only for the purpose for which it was collected. The company must inform data subjects about the purposes of data collection and use. The company may use personal data for other purposes only if the new purpose is compatible with the purpose for which the data was originally collected (a related agreement, legitimate or vital interest).
Consent is not the only legal way in which data processing can take place. The legislation also provides for other possibilities that may be more appropriate than consent, such as a contract (for the provision of services), an activity of public interest (an obligation provided by law), the protection of the vital interests of individuals or the legitimate interests of an entity or individuals.
The company or other organization may request a copy of the identity document only if this is necessary to fulfill an obligation under the law. For example, a bank may make a copy of your ID for opening a bank account. However, in order to sign a contract for the provision of telecommunications services, it is enough just to present the identity document. The company will use the identity card only to identify the person and transcribe the necessary data from it in the contract.
You can install video surveillance cameras on your property for personal or domestic activities. In this case, data protection legislation does not apply. However, you must respect the right to privacy of neighbors, guests or passers-by. When the video surveillance camera covers a public space (street, sidewalk, neighbor’s property), data protection legislation applies.
The company must designate a data protection officer in the cases provided by the legislation on personal data protection. For example, if the core business of the company involves the processing of personal data that requires regular monitoring of a large number of individuals or the company processes special categories of data on a large scale.