RODO - What it is and what it concerns. Regulations.

RODO is English for GDPR (General Data Protection Regulation) - it is an EU regulation that contains provisions on the protection of natural persons in relation to the processing of personal data, as well as legal regulations on the free flow of personal data. In Poland, the name RODO stands for Regulation on the Protection of Personal Data.This Regulation of the European Parliament and the Council of the European Union of 27 April 2016 came into full force on 25 May 2018. Its aim is the free flow of personal data in the European Union, better control of it and the harmonisation of the law and the adaptation of the legislation in such a way that it responds to the various technological threats of the 21st century.Who is covered by the RODO? The regulation applies to:

• Any entrepreneur or company providing its services or products to (private) individuals within the European Union.
• Any company based outside the European Union, but providing services to people living there. This applies not only to large, global companies, but also to small, local companies e.g.: providing internet services.

RODO does not apply:

• legal persons
• Deceased persons

Personal data - what exactly it is. Key changes following the entry into force of the Data Protection Regulation  

Personal data is all that information from which we can identify a living individual. They include:

• Name
• Address of residence
• Identity card number
• Email address with first and last name
• Personal data held by a health service (doctor or hospital)

And also:

• IP address
• Accurate data about our location (e.g. set on the phone)

It is also not possible to process the data concerned:

• Revenue
• Sexual orientation
• Political views
• Trade union membership
• Philosophical and religious beliefs

Personal data, on the other hand, is not:

• KRS number
• Anonymous data
• Email address where our name does not appear, e.g.: rejestracja@firma.com

Personal data, when processed, goes to various organisations or companies. The main entities that process personal data are:

1. Data controller - decides how personal data is processed and for what purpose.
2. Processor - processes personal data on behalf of the controller. Its duties must be specified in a contract or other legal act. Its tasks include, for example, the provision of various IT solutions.

The processing of personal data within the company is monitored by the company's appointed Data Protection Officer (DPO). He or she also informs employees of their obligations and advises them on the processing of personal dataThe EU Regulation has introduced a great number of changes concerning personal data, among others: regarding their storage, administration, transfer or deletion. It also regulated administrative penalties in the event of non-compliance (which can reach 20 million euros, or 4% of the entrepreneur's total annual turnover,). The changes that came into force with the RODO regulation concern:

• Extension of the regulation to entrepreneurs from outside the European Union.
• Extend the definition of the concept of personal data to include biometric /genetic data, data relating to our health.
• Direct responsibility for the processing of personal data (including the risk of financial penalties), and gaining consent to process that data.
• Obligation to notify infringements
• Appointment of the Data Protection Officer
• Facilitating the international transfer of personal data
• Extension of the rights of every citizen: the right to access, complete and rectify data, and the right to request data portability. The citizen also has the right to ''be forgotten'' (related to the erasure of personal data).

The RODO regulations are based on several principles, which are the starting point of the legislation:

1. Reliability and transparency
2. Correctness
3. Confidentiality
4. Compliance with the law

RODO training

All information concerning the EU regulation, known in Poland as RODO, is extremely important for every company. The subject is quite extensive and requires time to familiarise oneself with it. For this reason, companies specialising in the organisation of RODO training courses come forward.Training courses on personal data protection in accordance with the EU regulation are primarily aimed at data administrators and their employees. During the courses, the participant learns about:

• Legal grounds for processing personal data
• Data protection definitions
• Processing of personal data (how to process it in accordance with the requirements of the RODO and the Labour Code)
• The concepts of; data controller, data processor, data protection officer and what their tasks are
• the subject of organisational structure
• Administrative penalties and their amounts
• Register of personal data processing activities and what are the conditions of consent for personal data processing. The participant learns what this register is.
• Which data protection measures comply with the RODO
• Rights of persons whose personal data is processed

Often, courses take the form of theoretical as well as practical classes. It is worthwhile for every company to carry out such training at least once and familiarise its employees with practical knowledge and skills. Participants can receive training materials and an RODO certificate.ERGON - Centre for the Improvement of Human Resources provides high-level training on the subject of personal data protection. In them you will learn everything you need to know about RODO. We have experienced instructors and our teaching methods are state-of-the-art and allow for effective knowledge transfer. Our main centre is located in Warsaw, but we also operate in other cities: Krakow, Bielsko-Biala and Katowice. Feel free to contact us.