-
.
- Русский
In relation to some topical issues, on which articles/comments are published in the media and social networking, I find it useful to inform the public of the following:
Some publications refer to the creation of an application, which users will be able to "download" on their devices to be informed about services provided to Persons with Disabilities (PWD), such as.For example, locations where there are parking spaces and buildings to which people with disabilities can easily access. My Office is in contact with the company that designed the app to assess, among other things, how it works, the legal basis and the information that will be requested from users. Even if the legal basis is consent, the security of users' data should be ensured.
In relation to the cyber-attack on the Open University, my Office has received final notification. Subsequently, some clarifications were requested, which we have received and are evaluating. With regard to the cyber-attacks on the University of Cyprus and the Land Registry, initial and interim notifications have been received, which are also being assessed. Final disclosures are pending. These incidents are still under investigation and we are in contact with other competent authorities who are conducting parallel investigations.
I reiterate that it is the responsibility of my Office to assess the security measures in place before the attacks, the corrective measures implemented afterwards and how each organisation dealt with its own incident.
In relation to reports concerning the mobilisation of the Petrol Station Owners' Association and the taking of certain measures to address the problem of vehicle refuelling from the occupied territories, I wish to state that, if a measure involves the processing of personal data of citizens, that measure should be subject to consultation with my Office. To date, nothing has been brought before me.
Another issue of public concern is that of the digitisation of some services. In this regard I wish to reiterate that my Office supports technological progress and development. However, the technological solutions implemented must comply with the General Data Protection Regulation (GDPR). If citizens are forced to give the e-mail address of another person, for example to receive or pay a utility bill, this violates the GDPR.
Also, citizens cannot be required to have an e-mail address in order to receive a service. After all, some citizens do not have the appropriate skills and some, even a small number, do not even have internet in their homes. That is why, in my previous communications, I said that citizens should also be given some alternatives.
Regarding the issue of photocopying and the question of whether a private company is entitled to process citizens' data under the GDPR, the answer is yes. Any controller, in this case the Director of Traffic, as part of its lawful activities, may entrust the performance of processing operations to a processor, in this case the contractor company. A prerequisite is the conclusion of a written Processing Delegation Agreement committing the contractor company to take appropriate security measures to protect citizens' data. Other examples of outsourcing processing to private parties are airport screening and the issuing of driving licences.
(NΓ/EXP)
Contents of this article including associated images are owned by PIO
Views & opinions expressed are those of the author and/or PIO
Source
Source[/P]
