Some types of personal data belong to special categories of personal data, meaning they deserve more protection, so-called sensitive data. Sensitive data includes data that reveals information about:

  • an individual’s health;
  • an individual’s sexual orientation;
  • an individual’s racial or ethnic origin;
  • an individual’s political opinions, religious or philosophical beliefs; an individual’s trade union membership;
  • an individual’s biometric and genetic data.

The processing of an individual’s sensitive data is generally prohibited, except under specific circumstances that justify its processing.

 

More information:

Did you find your answer?

Processing personal data means any type of activity (processing operation) performed on or with individuals’ personal data. This includes the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, inquiry, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.

On the same topic:
Did you find your answer?

Personal data means any information relating to an identified or identifiable individual. An identifiable individual is anyone who can be identified, either directly or indirectly. Different pieces of information that added together could lead to the identification of a particular person also constitute personal data.

Examples of personal data include:

  • name and surname;
  • a home address;
  • an email address;
  • an ID card number;
  • location data;
  • an Internet Protocol (IP) address;
  • a cookie ID;
  • bank accounts;
  • tax reports;
  • biometric data (like fingerprint);
  • a social security number;
  • passport number;
  • test results;
  • grades in school;
  • browsing history;
  • photograph of individual;
  • vehicle registration number etc.

 

More information:

 

Did you find your answer?

Yes, the GDPR applies if the personal data are contained or are intended to be contained in a filing system. This means that the GDPR also applies to paper records and not solely to automated processing of personal data.

 

More information:

 

Did you find your answer?

Every organisation, regardless of the their size or sector, established in the European Economic Area (EEA) or offering products or services to individuals in the EEA, processing personal data whether or not by automated means needs to comply with the GDPR. Even if the GDPR mainly relates to automated processing of personal data, processing operations carried out manually will also be subject to the GDPR from the moment the paper files are organised in a systematic manner, e.g. ordered alphabetically in a filing cabinet. 

Examples of processing operations include collecting, recording, organising, using, modifying, storing, disclosing, altering and erasing individuals’ personal data.

Nevertheless, the application of the GDPR is modulated according to the nature, context, purposes and risks of the processing operations carried out. For SMEs whose core business is not the processing of personal data, the obligations can be less strict than for a large company.

 

More information:

 

On the same topic:
Did you find your answer?

The GDPR or General Data Protection Regulation creates a harmonised set of rules applicable to all personal data processing by organisations (public or private, regardless of their size)  established in the European Economic Area (EEA) or targeting individuals in the EU. The primary objective of GDPR is to ensure that personal data enjoys the same high standard of protection everywhere in the EEA, increasing legal certainty for both individuals and organisations processing data, and offering a high degree of protection for individuals.

The regulation entered into force on 24 May 2016 and applies since 25 May 2018.

Did you find your answer?

European initiative on the designation and position of data protection officers

On 15 March, the European Data Protection Board (EDPB) has kicked off its 2023 coordinated enforcement action. Throughout the year, 26 Supervisory Authorities (SAs) across the EEA, including the Data Protection Authority Liechtenstein (DSS), will take part in this joint initiative on the designation and position of data protection officers (DPOs).

As intermediaries between SAs, individuals and organisations, DPOs have an essential role in contributing to compliance with data protection law and promoting effective protection of data subject rights. With this initiative the SAs aim to gauge whether DPOs have the position in their organisations required by Art. 37-39 GDPR and the resources needed to carry out their tasks. The DSS is participating in this European initiative by conducting a survey among all DPOs notified in Liechtenstein pursuant to Art. 37 (7) GDPR.

The results of the joint initiative will be analysed in a coordinated manner and the SAs will decide on possible further national measures and activities. In addition, results will be aggregated, generating deeper insight into the topic and allowing targeted follow-up at EU level. The EDPB will publish a report on the outcome of this analysis once the actions are concluded.

 

Further information:

The Commissioner’s Office participates in the EDPB’s coordinated action with regard to the role of Data protection Officers (DPOs)

Nicosia, on 15th March 2023, the European Data Protection Board (EDPB) launched its second coordinated action with regard to the appointment and the role of Data protection Officers (DPOs). The aim of this initiative is to collect information on practices followed in Member States and the evaluation of compliance with the General Data Protection Regulation.

In the frame of this initiative, the Office will forward a relevant questionnaire* prepared by the EDPB, to DPOs both in the public and the private sector. The replies will be evaluated and sent to the EDPB, for deciding the next steps, both at national and at European level.

 

Irene Loizidou Nicolaidou, Commissioner for Personal Data Protection

 

*Note: The questionnaire was sent through the European Commission’s EU Survey tool, from the address DIGIT-EUSURVEY@nomail.ec.europa.eu.

Subscribe to