- DEFINITIONS
“GDPR”, “Regulation” – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing the Directive 95/46/CE (General Data Protection Regulation, in English General Data Protection Regulation);
“personal data” – any information regarding an identified or identifiable natural person (“data subject”); an identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more many specific elements, specific to his physical, physiological, genetic, psychological, economic, cultural or social identity;
“processing” – means any operation or set of operations performed on personal data or sets of personal data, with or without the use of automated means, such as collection, recording, organization, structuring, storage, adaptation or modification , extracting, consulting, using, disclosing by transmission, disseminating or otherwise making available, aligning or combining, restricting, erasing or destroying;
“operator” – means the natural or legal person, public authority, agency or other body that, alone or together with others, establishes the purposes and means of personal data processing; when the purposes and means of processing are established by Union law or domestic law, the operator or the specific criteria for its designation may be provided for in Union law or domestic law;
“person authorized by the operator” – means the natural or legal person, public authority, agency or other body that processes personal data on behalf of the operator;
“recipient” – means the natural or legal person, public authority, agency or other body to whom (to whom) personal data is disclosed, regardless of whether it is a third party or not. However, the public authorities to which personal data may be communicated within a
certain inquiries in accordance with Union or national law are not considered recipients; the processing of this data by the respective public authorities complies with the applicable data protection rules, in accordance with the purposes of the processing;
“third party” – means a natural or legal person, public authority, agency or body other than the data subject, the operator, the person authorized by the operator and the persons who, under the direct authority of the operator or the person authorized by the operator, are authorized to process data personal;
“consent” – of the data subject means any manifestation of the data subject’s free, specific, informed and unambiguous will by which the data subject accepts, through a statement or an unequivocal action, that the personal data concerning him/her be processed;
“personal data security breach” – means a security breach that leads, accidentally or unlawfully, to the destruction, loss, modification, or unauthorized disclosure of personal data transmitted, stored or otherwise processed, or to unauthorized access to them;
“representative” – means a natural or legal person established in the Union, designated in writing by the operator or the person authorized by the operator, who represents the operator or the authorized person with regard to their respective obligations under the GDPR;
“mandatory corporate rules” – means the personal data protection policies that must be respected by an operator or a person authorized by the operator established in the territory of a member state, with regard to transfers or sets of transfers of personal data personally to an operator or a person authorized by the operator in one or more third countries within a group of enterprises or a group of enterprises involved in a common economic activity;
“supervisory authority” – means an independent public authority established by a Member State;
“DPO” – data protection officer (in English, data protection officer);
“DPIA” – data protection impact assessment (in English, data-protection impact assessment, DPIA);
“Supervisory Authority” – the National Supervisory Authority for the Processing of Personal Data (ANSPDCP).
- PURPOSE AND SCOPE
2.1. THE GOAL
This procedure documents the requirements regarding the preparation of the document called “Personal data mapping”.
2.2. APLICATION DOMAIN
This procedure applies to all organizational structures of the Operator TRIPLAST from Tirgu-Mures. This procedure will be considered as having a general character and will apply to all processing carried out by the Operator.
If it is found that there are certain aspects for which this procedure does not provide appropriate directives, Employees must immediately request advice from the Data Protection Officer (DPO) or the legal representative of the Operator.
2.3. REFERENCE DOCUMENTS
– GDPR
– Internal regulation
– Internal procedures
GENERAL RULES
3.1. GENERAL. The operator – TRIPLAST – from Tirgu-Mures will draw up a table (preferably in excel format), in which he will list each line (e.g. “activity” carried out within each process) together with information related to the collection, storage, use, transfer and destruction of critical data content for each department.
IMPORTANT: The operator will go through the points below each type of document that contains personal data.
3.2. TYPE/NAME OF DOCUMENTS FOR PERSONAL DATA COLLECTION
The operator – TRIPLAST – from Tirgu-Mureș will identify the type/name of the documents for the collection of personal data, the categories of data from the Data Classification Scheme (Annex 1) will be selected.
3.3. DATA CATEGORIES
The operator – TRIPLAST – from Tirgu-Mures will select the categories of personal data. In order to identify the categories of personal data collected, the Data Classification Scheme (Annex 1) will be considered.
3.4. DATA TYPE
The operator – TRIPLAST – will select the type of personal data. In order to identify the type of personal data collected, the Data Classification Scheme (Annex 1) will be considered.
3.5. DATA SOURCE
The operator – TRPLAST – will select where the personal data comes from (eg input source)? Tick ”X” the data input source (multiple options are possible).
☐ Clients (PF or PJ)
☐ Employees
☐ Third parties (suppliers, partners, service providers)
3.6. DATA COLLECTION METHOD
The operator – TRIPLAST – will select the method of collecting personal data. Tick with “X” the support type of data collection (multiple options are possible).
☐ Physical (Paper Support)
☐ Post/Courier
☐ Fax
☐ Web portal
☐ Online form
☐ USB Drive
☐ Hard drive
☐ CDs/DVDs
☐ FTP server
☐ Social Media
☐ Call Center
3.7. NEXT TRANSFER LOCATION
The operator – TRIPLAST – will select the location of the transfer of personal data. Tick ”X” the data transfer location (multiple options are possible).
☐ Offices (Files)
☐ Email Server
☐ IT applications (name of applications used)
☐ Databases
☐ Electronic files
☐ Mobile phones
3.8. STORAGE LOCATION
The operator – TRIPLAST – will select the location of personal data storage. Tick ”X” the data storage location (multiple options are possible).
☐ Offices (Files)
☐ Email Server
☐ IT applications (name of applications used)
☐ Generic System/Server
☐ Electronic files
☐ Databases
☐ Web server
☐ Electronic Archive (back-up)
☐ Cloud
3.9. DATA USE (Internal)
The operator – TRIPLAST – will select the method of using personal data. Tick with “X” the method of use (more options are possible).
☐ Department
☐ Internal transfer to another department
☐ How many employees have access to personal data?
3.10. DATA TRANSFER (External)
The operator – TRIPLAST – will select the method of transfer of personal data. Tick with “X” the method of transfer (several options are possible).
☐ Authorities
☐ Third parties (suppliers, partners, service providers)
☐ Cross-border (in the EU/EEA or outside the EU/EEA)
3.11. DATA RETENTION AND ARCHIVING
The operator – TRIPLAST – will select the data retention/storage location. Tick ”X” the data retention/storage location (multiple options are possible).
☐ Offices (Archive)
☐ Email Server
☐ IT applications (name of applications used)
☐ Generic System/Server
☐ Electronic files
☐ Databases
☐ Web server
☐ Electronic Archiving (back-up)
☐ Cloud
3.12. STORAGE/RETENTION TERM
The operator – TRIPLAST – will complete the storage/retention term for each topic of personal data processing.
☐ Consent
☐ Legal obligation
☐ Contractual obligation
☐ Public interest
☐ Public authorities
☐ Protecting vital interests
☐ Legitimate interest
3.13. DESTRUCTION/DELETION
The operator – TRIPLAST – will complete the method of destruction/deletion of personal data. Tick with “X” the data deletion/destruction method (several options are possible).
☐ Trash can
☐ Paper shredder
☐ Delete computer systems .
Annex 1: Data classification scheme
| Warning! | ONLY attributes (data) of natural persons shall be considered |
| Below you can find the list of personal data (P.D.) categogories. The list below in non-exhaustive, new entries shall be added as new P.D. are identified, collected, and processed. | |
| CATEGORY | DESCRIPTION |
| A | Identification data and personal characteristics |
| A.1 | Name, Surname |
| A.2 | Date of birth |
| A.3 | Personal Identification Number (CNP) |
| A.4 | Citizenship |
| A.5 | ID Card / Passport / Other document serial number (e.g. driving license, work permit, residency permit, e.a.) |
| A.6 | Home address (including those previous if applicable) |
| A.7 | Date of issuing of identification documents |
| A.8 | Date of expiry of identification documents |
| A.9 | Photo (CV, identity documents, diplomas, e.a.) |
| A.10 | Residence (if applicable) |
| A.11 | Marital status |
| A.12 | Phone number (personal and/or workplace) |
| A.13 | E-mail (personal and/or workplace) |
| A.14 | Pseudoname(s) |
| A.15 | Signature |
| A.16 | Age |
| A.17 | Religion |
| A.18 | Sex |
| A.19 | Place of birth |
| A.20 | Nationality |
| A.21 | Father’s name and surname |
| A.22 | Mother’s name and surname |
| A.23 | Vehicle’s registration number (personal and/or workplace) |
| A.24 | Driving license number |
| A.25 | Social security number or health insurance number |
| A.26 | Spoken languages |
| A.27 | Rasial or ethnical origin |
| A.28 | Religious or philosophical beliefs |
| CATEGORY | DESCRIPTION |
| B. | Details about family members |
| B.1 | Spouse’s name and surname |
| B.2 | Spouse’s date of birth |
| B.3 | Spouse’s name before marriage |
| B.4 | Spouse’s name after marriage |
| B.5 | Kids’ name and surname |
| B.6 | Kids’ dates of birth |
| B.7 | Kids’ personal identification number |
| B.8 | Serial number of marriage certificate, divorce sentence, death certificate, e.a. |
| B.9 | Spouse’s personal identification number |
| B.10 | Parents’ name and surname |
| B.11 | Marital status history: previous marriages, divorces, e.a. |
| B.12 | Information of other family members: number of children, dependants, parents, e.a. |
| B.13 | Information on dependant kids (alimony) |
|
| |
| CATEGORY | DESCRIPTION |
| C. | Electronic identification |
| C.1 | “Cookies” |
| C.2 | Employees’ access logs |
| C.3 | Employees’ IP addresses |
| C.4 | GPS coordinates, location |
| C.5 | Serial number of employees’ / visitors’ access card |
| C.6 | Employees’ log entry number |
| C.7 | Health and fitness equipment |
| CATEGORY | DESCRIPTION |
| D. | Financial elements (banking, financials and wealth) |
| D.1 | Natural person’s banking identification (e.g. employees’ bank account number). |
| D.2 | Natural person’s bank card number |
| D.3 | Undisclosed codes (e.g. access codes for certain areas) |
| D.4 | Any transactions involving natural persons (e.g. receiving/paying natural persons within a payment operation) |
| D.5 | Commercial contracts, other documents financial in nature, concluded between a legal entity and a natural person or by the natural person from within the legal entity with a third party (legal entity or natural person) |
| D.6 | Income and wealth |
| D.7 | Debts and expenses |
| D.8 | Loans and mortgages |
| D.9 | Solvency, delays, incidents |
| D.10 | Financial transactions |
| D.11 | Compensations |
| D.12 | Agreements and commitments |
| D.13 | Materials and equipment |
| D.14 | Properties, housing, land, e.a. |
| D.15 | Certifications, personal development trainings, professional activities (types of activities, business relations) of the natural person from within the legal entity |
| CATEGORY | DESCRIPTION |
| E. | Other personal characteristics |
| E.1 | Information on military training |
| E.2 | Information on alien: visa details, work permit, special conditions |
| E.3 | Identification numbers issued by government |
| CATEGORY | DESCRIPTION |
| F. | Physical characteristics |
| F.1 | Height |
| F.2 | Weight |
| F.3 | Hair colour |
| F.4 | Eye colour |
| F.5 | Distinctive features |
| CATEGORY | DESCRIPTION |
| G. | Information on lifestyle and behaviour |
| G.1 | Smoking and alcohol consumption |
| G.2 | Consumption of market goods |
| G.3 | Details regarding travels: visas, work permits |
| G.4 | Social media contacts: friends, associates, relations other than family |
| G.5 | Public positions previously held |
| G.6 | Information on previous accidents, implicated persons, nature of accident |
| G.7 | Psychological profile |
| G.8 | Civil awards, distinctions received |
|
| |
| CATEGORY | DESCRIPTION |
| H. | Hobbies and interests |
| H.1 | Hobby type activities, sports attended |
|
| |
| CATEGORY | DESCRIPTION |
| I. | Affiliations |
| I.1 | Membership in various organisations (exempting police force): charitable, voluntary, clubs, associations, e.a. |
| I.2 | Union membership, professional sindicates |
| CATEGORY | DESCRIPTION |
| J. | Legal information |
| J.1 | Criminal convictions |
| J.2 | Administrative penalties |
| J.3 | Suspicions, accusations, investigations (civil, criminal) |
| J.4 | Legal measures: Măsuri judiciare: guardianship, judicial seisure, e.a. |
| J.5 | Administrative penalties: administrative-disciplinary, administrative-contraventional, administrative-patrimonial |
| J.6 | Penalties under labour law: administrative-disciplinary, caviets, disciplinary actions, wage fortfeit |
| J.7 | Administrative sanctions: administrative-patrimonial, wage fortfeit / bank account blockings |
| J.8 | Criminal record certificate, fiscal, auto |
| CATEGORY | DESCRIPTION |
| K. | Data regarding personal health and wellbeing (special category) |
| K.1 | Social security number |
| K.2 | Information on persoanl health of person: medical certificates, medical reports, medical records, treatments, analysis results, sick leaves, e.a. |
| K.3 | Blood type |
| K.4 | Disability status |
| K.5 | Information on personal health of person regarding sex life: STD’s |
| CATEGORY | DESCRIPTION |
| L. | Information regarding studies and courses |
| L.1 | Information regarding the sudy level of the person: schooling institutes attended, courses taken, diplomas, exam results, e.a. |
| L.2 | Professional qualifications: patents, licenses, certifiates, e.a. |
| L.3 | Publications: newspapers, books, articles, reports, e.a. |
| CATEGORY | DESCRIPTION |
| M. | Information regarding professional history and professional life |
| M.1 | Information on current employer: employer, title, date of employment, disciplinary measures, e.a. |
| M.2 | Information on work contract termination: date of leave, windup periods, e.a. |
| M.3 | Carrier: professional history, position held, information on previous emplyers |
| M.4 | Financial information: salary, benefits, bonuses, pensions, taxes, e.a. |
| M.5 | Contact detail of employer (e-mail address, phone number, address) |
| M.6 | Goods in responsibility: inventory items, equipment, e.a. |
| M.7 | Organisational and professional affiliations |
| M.8 | Public positions held |
| CATEGORY | DESCRIPTION |
| N. | Information on political views, philosophical opinions, and sindicate affiliations. Religious beliefs |
| N.1 | Political opinions and preferencies |
| N.2 | Membership in any parties |
| N.3 | Lobby activities |
| N.4 | Union membership |
| N.5 | Religious beliefs |
| CATEGORY | DESCRIPTION |
| O. | Information on photographic processing |
| O.1 | Photographs, video recordings, e.a. |
| O.2 | Biometrical data: digital fingerprint, retinal model, facial structure, voice recognition, hand geometry, vane model, and some deeply rooted abilities, including behavioural characteristics (e.g. signature) |
| CATEGORY | DESCRIPTION |
| P. | Information on sound processing |
| P.1 | Recording of phone conversations |
| CATEGORY | DESCRIPTION |
| R. | Information regarding sex life |
| R.1 | Information on sexual orientation |
| R.2 | Information on sex life |
| CATEGORY | DESCRIPTION |
| S. | Other personal data |
