- DEFINITION
„
GDPR”, “Regulation” – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95 /46/CE (General Data Protection Regulation, in English General Data Protection Regulation);
“personal data” – any information regarding an identified or identifiable natural person (“data subject”); an identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more many specific elements, specific to his physical, physiological, genetic, psychological, economic, cultural or social identity;
“processing” – means any operation or set of operations performed on personal data or sets of personal data, with or without the use of automated means, such as collection, recording, organization, structuring, storage, adaptation or modification , extract, consult, use, disclose by transmission, disseminate or otherwise make available, align or combine, restrict, delete or destroy;
“operator” – means the natural or legal person, public authority, agency or other body that, alone or together with others, determines the purposes and means of personal data processing; when the purposes and means of processing are established by Union law or domestic law, the operator or the specific criteria for its designation may be provided for in Union law or domestic law;
“person authorized by the operator” – means the natural or legal person, public authority, agency or other body that processes personal data on behalf of the operator;
“recipient” – means the natural or legal person, public authority, agency or other body to whom (to whom) personal data is disclosed, whether or not it is a third party. However, public authorities to whom personal data may be communicated in the context of a specific investigation in accordance with Union or national law are not considered recipients; the processing of this data by the respective public authorities complies with the applicable data protection rules, in accordance with the purposes of the processing;
“third party” – means a natural or legal person, public authority, agency or body other than the data subject, the operator, the person authorized by the operator and the persons who, under the direct authority of the operator or the person authorized by the operator, are authorized to process data personal;
“consent” – of the data subject means any manifestation of the data subject’s free, specific, informed and unambiguous will by which he accepts, through a statement or an unequivocal action, that the personal data concerning him be processed;
“breach of personal data security” – means a breach of security that leads, accidentally or unlawfully, to the destruction, loss, alteration, or unauthorized disclosure of personal data transmitted, stored or otherwise processed, or to unauthorized access to them;
“representative” – means a natural or legal person established in the Union, designated in writing by the controller or the person authorized by the controller, who represents the controller or the authorized person with regard to their respective obligations under the GDPR;
“mandatory corporate rules” – means the personal data protection policies that must be followed by a controller or a person authorized by the controller established in the territory of a Member State, in relation to transfers or sets of transfers of personal data personally to an operator or a person authorized by the operator in one or more third countries within a group of enterprises or a group of enterprises involved in a joint economic activity;
“supervisory authority” – means an independent public authority established by a Member State;
“DPO” – responsible for data protection (in English, data protection officer);
“DPIA” – data protection impact assessment (in English, data-protection impact assessment, DPIA);
“Storage/Retention of personal data” – means the storage of collected personal data on any kind of support;
“Deletion of personal data” – means the actual removal/destruction of data
- GENERAL RULES
3.1. Evidence of documents
At the Operator level, all departments are obliged to register and keep track of all incoming documents, those drawn up for internal use and those issued, according to the procedures of the respective activities.
The documents/records are kept by the initiators and users at the workplace (active archive), for the duration specified by the legal norms. After the expiration of the operative retention period, the department heads/responsibles draw up proposals for archiving in the Operator’s archive.
Annually, the person responsible for filing the documents in each compartment groups the documents into archival units according to the issue and the retention terms established in the archival nomenclature. The archival nomenclature is prepared by the person in charge of the archive within the Operator, based on the proposals submitted by the heads/responsibles of the compartments within the Operator and is approved by the decision of the management bodies.
A cover page is inserted in each file, which is filled in by the person responsible for filing the documents in each compartment. Each page in the file is numbered and the total number of pages is entered on the cover page. The documents grouped in this way are submitted by the person responsible for filing them, in the second year after their establishment, at the Operator’s archive depository, based on the document inventory and handover-receipt minutes.
The records of all entries and exits of archival units in/from the archive warehouse are kept by the Operator’s archivist (the person designated by internal decision with archivist duties) in a record register.
The removal of documents from the archive records is done only with the approval of the Operator’s management, following the selection or transfer to another archive storage.
3.2. Document selection
Within the Operator, there is a selection committee, appointed by the Operator’s management, composed of 3 people: a president, a secretary and a member. The selection committee meets annually or whenever necessary, at the proposal of the Operator’s archivist, to analyze each individual archival unit and to approve the list of documents to be eliminated as useless, expiring their retention period; the decision taken is recorded in a Minutes of the Selection Committee.
The selection minutes, accompanied by the inventories of the documents proposed for elimination, as well as the inventories of the documents that are kept permanently.
The documents are removed from the archive records and can only be removed based on the Minutes of the commission mentioned above.
3.3. Retention of documents
The operator is obliged to keep the documents created or held under appropriate conditions, in spaces specially arranged for the archive, ensuring them against destruction, degradation, theft or commercialization under conditions other than legal ones.
The archive warehouses will be equipped, depending on the format and support of the documents, with adequate means of keeping and protecting them, as well as with fire prevention and extinguishing means, installations and systems.
As the case may be and according to its needs, the Operator may appoint a person to exercise the duties of archivist, who has the obligation to keep the documents held in the archive under appropriate conditions. The Management of the Operator, at the proposal of the archivist, allocates the necessary and appropriate space for the archive (from the point of view of temperature, humidity, brightness, safety conditions).
The archivist monitors the return of documents issued for consultation, at the request of department heads/responsibles, and notifies the superior hierarchical head in case of their delay or other problems arising in the archive.
Documents are kept in the archive for the duration provided in the archival nomenclature.
responsibility
4.1. Management of the Operator:
Allocate the space required for archiving.
It ensures the human and material resources for creating the conditions for the normal operation of the archive.
Name the composition of the Selection Committee.
Appoint the person to exercise the function of archivist.
Approves the removal of documents from the archive record, following selection or moving to another repository.4.2. Heads/heads of departments:
It ensures the preservation at the workplace of the documents drawn up in the framework of the processed activity (operative archive), the binding, carding and creation of archival units, according to the Operator’s Archival Nomenclature, as well as the filing of documents in the archive after the expiration of the operative preservation period.
I propose handing over the documents to the Operator’s archive.
Coordinates the filing of documents on archival units at department level.
