Search

Uredba (EU) 2016/679 Evropskega parlamenta in Sveta z dne 27. aprila 2016 o varstvu posameznikov pri obdelavi osebnih podatkov in o prostem pretoku takih podatkov ter o razveljavitvi Direktive 95/46/ES (Splošna uredba o varstvu podatkov) (v nadaljevanju: Uredba) je na področje varovanja osebnih podatkov prinesla veliko sprememb. Ena izmed njih določa, da je obdelava osebnih podatkov otroka, ki temelji na soglasju iz člena 6(1a) Uredbe in se nanaša na storitve informacijske družbe, ki se ponujajo direktno otroku, zakonita le, če takšno odobritev da ali odobri nosilec starševske skrbi otroka. Ker gre za nov predpis in se sodna praksa še ni razvila, se na to tematiko odpira mnogo vprašanj, na številna izmed njih pa še ni odgovora. Tako ni jasno, kaj naj bi pomenil termin, da se »storitev informacijske tehnologije ponuja direktno otroku«. Iz ohlapnih smernic organov Evropske Unije, bi se dalo razbrati, da so to tiste storitve, iz uporabe katerih se otroka izrecno ne izključi. Slednje bi pomenilo, da se ta člen nanaša tudi na družabna omrežja. Vsaj s strani omrežij: Facebook, Snapchat in Google, ugotovimo, da se tega člena, v kolikor je le mogoče izognejo. Kot osrednja pravna podlaga za obdelavo osebnih podatkov služi pogodba, člen 8 Uredbe pa se uporabi le v primeru, ko je za določen osebni podatek (na primer podatek o političnem mnenju, ki spada pod posebne vrste osebnih podatkov) potrebna izrecna privolitev in se ga ne more skriti pod namen izvajanja pogodbe. V pravilnikih posameznih družabnih omrežij lahko zasledimo neskladnosti z Uredbo, kot je na primer kršitev jasnosti in preprostosti jezika iz uvodne določbe 58, člena 7(2) ter 12(1). Najdemo tudi skrita in vnaprej odkljukana okenca, ki vsebinsko določajo obseg pooblastitev glede zbiranja podatkov o otroku, kar bi lahko bila kršitev uvodne določbe 32 Uredbe. Ugotovimo, da je prostora za izboljšave še na pretek in z zanimanjem lahko pričakujemo razvoj, ki ga bo ubrala Uredba in spremembe, ki jih bo še prinesla. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (further on in this document: the Regulation) brought a lot of changes to the field of personal data protection. One of these is that the processing of personal data by a child based on the consent referred to in Article 6(1a) of the Regulation and relating to information society services offered directly to a child is only legitimate if and to the extent that consent is given or authorized by the holder of parental responsibility over the child. Since this is a new legal act and the judicial practice has not yet developed, many issues are raised on this topic, some of them are yet to be answered. It is not clear what should the term “the offer of information society services directly to a child” actually mean. From the loose guidelines of the European Union bodies, it could be understood that these are services from which the child is not explicitly excluded. The latter would mean that this article also applies to social networks. We figure that at least social networks like Facebook, Snapchat and Google are trying very hard to avoid the article. The contract serves as the central legal basis for the processing of personal data. Article 8 of the Regulation applies only in cases where specific personal data (for example, information on political opinion, which ranks as specific types of personal data) needs explicit consent and cannot be hidden under the purpose of implementing a contract. In the rules of individual social networks, we can find inconsistencies with the Regulation, such as the violation of the clarity and simplicity of the language in recital 58, the Article 7(2) and 12(1). We also find hidden and pre-ticked check boxes that define the scope of authorizations for the collection of data on a child, which could be a violation of the Regulation of the recital 32. We are finding that there is still the room for improvements and we can expect with interest the development of the Regulation and the adaptions that it will bring.

Sodobna informacijska tehnologija je čedalje bolj nepogrešljiv element vsake organizacije. Ne glede na vrsto organizacije, naj bo ta javna ali zasebna, predstavlja prepletenost sodobnih tehnoloških rešitev s poslovnimi procesi organizacije vedno večji izziv za organizatorje. Preučevana organizacija, Agencija za trg vrednostnih papirjev, se sooča s problemom, ki je pravzaprav običajen za sodobno informacijsko organizacijo. Povečano število različnih informacijskih rešitev, ki so nujno potrebne za nemoteno in uspešno delovanje organizacije, zahteva vedno več vloženega truda in dela s strani informatikov, učinkovitost organizacije pa je vedno znova postavljena pred številne izzive. S pomočjo ITIL v3 zbirke dobrih praks si bomo ogledali, na kakšen način bi lahko še izboljšali organizacijo oddelka za informacijsko tehnologijo Agencije za trg vrednostnih papirjev. Izdelali bomo katalog storitev, ki jih oddelek za informatiko izvaja in tako postavili prvi temelj, ki bo organizacijo oddelka za informacijsko tehnologijo približal ISO/IEC 20000 standardu. Modern information technology has increasingly become an indispensable link in organizational structure of any organization. Whatever the type of organization, public or private, a mixture of modern technology solutions and business processes is increasingly a challenge for the organizers. Our studied organization, Securities Market Agency, is confronted with the problem, which is actually very common in any modern information organization. Increased number of different IT solutions, which are essential for the smooth and effective functioning of the organization, requires more and more effort and dedicated work from IT professionals and the effectiveness of the organization is constantly faced with numerous challenges. Using the ITIL v3 best practices, we will look at how we can improve the organization of IT department inside the Agency for Securities Market. Service Catalogue will be created, where all services that customer is offering will be described. With this the first important step will be undertaken for IT department toward the ISO/IEC 20000 standard.