Ordinance of the Governing Council on Data Protection (Data Protection Ordinance, TG DSV) - Data Subjects (RPD)

1. Data Subjects are natural or legal persons whose data is processed.

1. Special Risks Requiring Prior Inspection in Data Processing Arise Especially When

1. Sensitive personal data is processed manually or through information technology systems;

2. The affected person's ability to act or develop may be restricted;

3. There is an increased risk of technology-related errors or abuses.

1. Adequate data protection in cross-border data traffic is ensured when an adequate level of data protection is guaranteed in the recipient state.

2. Such a level is particularly present, considering all circumstances, when

1. fundamental and human rights are upheld;

2. the level of data protection corresponds to European standards.

1. An excessive administrative burden within the meaning of § 20a paragraph 2 of the Act is deemed to exist particularly when

1. a person repeatedly submits an application on the same matter;

2. the applicant fails to comply with their duty to cooperate despite being requested to do so by the responsible authority;

3. the processing of the application involves a particularly high material or time expenditure.

1. The Data Protection Officer is elected for a term of four years.

2. They are administratively assigned to the State Chancellery.

1. Municipalities may establish their own supervisory authorities, delegate supervision to private entities, or collaborate with other municipalities for the purpose of managing a joint supervisory authority.

2. Municipalities shall ensure the independence of their supervisory authorities.

3. The supervisory authorities of the municipalities must be established no later than one year after the law comes into effect and must be reported to the Data Protection Officer. Any changes to the supervisory authority must be communicated immediately.

1. The Annual Report of the Data Protection Officer is provided as part of the Executive Council's annual report.

1. Data collections must be designed in such a way that the individuals concerned can exercise their rights.

1. The responsible body maintains the register of data collections it has created in a form suitable for integration into the central register. The supervisory authority may issue directives in this regard.

2. Short-term data collections within the meaning of § 14 para. 3 item 1 of the Act are those maintained only temporarily, especially for the duration of an administrative procedure.

3. Exclusively personal work aids within the meaning of § 14 para. 3 item 4 of the Act are data collections that serve to facilitate work and to which only the responsible person or their deputy has access.

4. The central register contains information about the data collections created by each responsible body within its jurisdiction.

1. The responsible entity reports the establishment and discontinuation of registrable data collections with the details in accordance with § 14 para. 2 of the law to the supervisory authority.

1. The following personal data may be disclosed for publications of general interest

1. for address books and similar directories: name, first name, company, address, telephone number, profession, and title of natural and legal persons;

2. for state calendars, government directories, and similar reference works: name, first name, title, profession, year of birth, address, telephone number, and position of individuals who are or have been in public service;

3. for vehicle directories: name, first name, company, and address of owners or holders.

2. There is no legal entitlement to the disclosure of this information.

1. The responsible entity must ensure adequate data security and take measures to guarantee confidentiality, integrity, availability, data existence, and traceability.

2. Personal data must be protected against the following threats

1. unauthorized destruction;

2. accidental loss;

3. technical errors;

4. forgery, theft, or unlawful use;

5. unauthorized alteration, copying, access, or other unauthorized processing.

3. The technical and organizational measures must be appropriate. In particular, they must take into account the following criteria

1. Purpose of data processing;

2. Nature and scope of data processing;

3. Assessment of potential risks to the affected individuals;

4. Current state of the art.

4. The measures are to be periodically reviewed by the supervisory authority.

1. When processing particularly sensitive personal data using electronic data processing (EDP), the responsible body must ensure logging.

2. The logs must be protected with appropriate measures according to their sensitivity and retained for one year.

1. Requests for access to data registers and data collections must be submitted in writing to the responsible body.

2. The request must be formulated in such a way that it clearly indicates which data collections or data access is sought. The applicant must provide proof of identity.

3. General or blanket access requests are inadmissible.

1. Applications for the assertion of further rights pursuant to § 22, § 23, and § 23a of the Act must be submitted in writing and with justification to the responsible authority. The applicant must provide proof of their identity.

1. The Regulation of the Government Council on Data Protection of December 6, 1988, is repealed.

1. The Act of December 19, 2007, concerning the Amendment of the Data Protection Act of November 9, 1987, and this regulation shall enter into force on December 5, 2008.