Znamo li da kršimo GDPR ako u tom slučaju koristimo besplatno Wetransfer rješenje za prijenos osobnih podataka?
Na službenim Wetransfer web stranicama
https://help.wetransfer.com/hc/en-us/articles/360000905623-GDPR-Requesting-a-Data-Processing-Agreement
piše slijedeće, citiramo:
Under the GDPR, you may be required to sign a DPA.
When does it apply to you?
Two things must be true:
- You need to be a professional with a WeTransfer account and using this account on behalf of a business.
- In the transfer you send there is personal data, which is data that can identify an individual.
If these two things are true for you, the GDPR tells us to define the relationship that exists between you, as a professional user, and us, WeTransfer.
To znači, ako koristimo We transfer za prijenos dokumenata s osobnim podacima u svrhe koje nisu isključivo privatne ili kućne svrhe, posebice ako ga koristimo kao poslovni subjekt, tada smo mi, kao poslovni subjekti voditelj obrade osobnih podataka unutar dokumenata koje želimo prenijeti Wetransferom, a Wetransfer je izvršitelj obrade.
Stoga naša tvrtka mora sklopiti Ugovor o obradi podataka ili Data Protection Agreement iz članka 28. GDPR-a s Wetransfer.
A u tu svrhu tvrtka ne smije koristiti privatnu besplatnu licencu, već mora kupiti jedan od poslovnih paketa Wetransfer i moramo biti registrirani kao poslovni ili profesionalni korisnik.
Usput, dobro je skrenuti pozornost i na Privacy Policy Wetransfera i uočiti dvije zanimljive rečenice u vezi pristupa dokumentaciji koju dijelimo putem Wetransfera:
- Law enforcement agencies or regulators: we are obliged to share your personal information in case of a legal request. In case we run across CSAI or when we’re notified on other illegal Content we’ll also share your personal information with law enforcement agencies
- We trust you understand that in order to fulfill our moral responsibility to reduce the spread of Child Sexual Abuse Imagery (CSAI), we do use automated systems to to detect such Content. Finally, we’re obliged to delete your Content when we receive a Notice-and-takedown/DMCA-request or when we receive a legal request.
Screenshot from wetransfer website
#gdprcroatia
