GDPR

Introductory Provisions

Article 1. Purpose of the Directive and Authority to Issue It

1. In connection with the entry into effect of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter “GDPR”), the Church of the Baptist Union in Olomouc (Sbor Bratrské jednoty baptistů v Olomouci), Reg. no. 68148003, with its registered office at tř. Svornosti 111/2a, 779 00 Olomouc (hereinafter “the church”), adopts this Directive governing the processing and protection of personal data by churches and other legal entities (hereinafter “the Directive”).

Article 2. Subject Matter and Scope

1. The Directive governs the procedures for processing and protecting personal data processed by the church in the course of its activities as a controller and a processor, and the obligations of workers involved in the processing of personal data by the church.
2. The Directive applies to all personal data processing activities carried out by the church in the position of controller or processor, and to all workers of the church.
3. If another regulation of general law is stricter than this Directive, that regulation shall apply.
4. If other regulations of particular law lay down less strict rules for the processing of personal data, the Directive takes precedence in application over those regulations.

Article 3. Definitions

Unless otherwise provided below, the following terms have the following meanings for the purposes of the Directive:

1. where the Directive uses the term church administrator, this also means the church manager; what is provided below regarding the church administrator applies, in the case of other legal entities, to a member of the statutory body;
2. personal data means any information relating to an identified or identifiable person; an identifiable person is any person who can be identified on the basis of specific personal data, either directly or in combination with other personal data;
3. sensitive personal data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health or a natural person's sex life or sexual orientation, and data relating to criminal offenses and criminal convictions;
4. confidential personal data means personal data that the natural persons to whom they relate consider particularly significant for their rights and freedoms;
5. data subject means the natural person to whom the personal data relate; a deceased natural person is not a data subject;
6. workers of the church means pastors, mission workers and other persons performing activities for the church on the basis of appointment, election or a similar title
7. external person means a person other than a worker, processor or controller;
8. processing of personal data means any operation or set of operations performed on personal data or sets of personal data, in particular their collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
9. processing activity means a set of personal data processing operations carried out for a single purpose;
10. personal data controller (also “controller”) means the person determining the means and purpose of the processing of personal data; processing of personal data carried out by the controller's workers according to its instructions counts as processing of personal data carried out by the controller;
11. personal data processor means a person other than a worker who carries out processing of personal data for the controller;
12. computer means a desktop computer, laptop, tablet, smartphone and any similar device enabling work with personal data in electronic form,

Basic Obligations

Article 4. Principles of Personal Data Processing

1. The church always processes personal data with the knowledge of the data subject to whom they relate, and in a manner that the data subject can expect and of which the data subject is informed.
2. Processing of personal data always takes place for a specific defined purpose that is communicated to the data subject, or for purposes related to the defined purpose that the data subject can expect.
3. For each processing activity, the church must have a legal basis within the meaning of Article 6 GDPR, namely:
4. the processing is carried out on the basis of a legal obligation imposed on the controller,
5. the processing is necessary for the performance of a contract concluded with the data subject or for pre-contractual activities,
6. the processing is necessary to protect the vital interests of the data subject or of another natural person,
7. the processing is necessary for the performance of a task carried out in the public interest,
8. the controller or a third party has a legitimate interest in the processing of personal data that overrides the data subject's interest in the data not being processed, or
9. the data subject has given consent to the processing of his or her personal data.
10. If personal data are processed on the basis of the data subject's consent, employees shall ensure that the consent given is freely given and informed. It is prohibited to include consents to the processing of personal data in contracts, terms and conditions and other documents in which withholding consent would have negative consequences for the data subject.
11. The church shall ensure that for each defined purpose it processes only personal data that are necessary for that purpose, and that the personal data processed are accurate and true.
12. Personal data must not be kept longer than required by the purpose for which they were collected and processed, or than prescribed by the legal regulations the church must comply with in connection with the given processing activity.
13. The church shall ensure that only those workers who must work with the processed personal data in the performance of their tasks, and only those external persons who are authorized to do so, have access to the processed personal data.
14. If it is found that the processing of personal data is contrary to the principles, it is suspended until the problem is resolved.

Article 5. Basic Obligations in Processing

1. The church takes care to comply with its obligation to process personal data in accordance with the basic principles of GDPR and to ensure the protection of such personal data and of the rights and freedoms of data subjects at all stages of the processing activity.
2. The church fulfills these obligations by introducing appropriate organizational and security measures, to which it subjects all processing activities it carries out.
3. When introducing these measures, the church shall ensure that they are proportionate to the amount of personal data processed, the number of data subjects to whom they relate, the category and confidentiality of the personal data, the risk of a personal data breach, the level of that risk, and the extent and type of harm threatening data subjects in the event of a breach. Factual and financial feasibility is also a measure of proportionality.
4. The church keeps records of all measures, which it retains for the duration of the measure and for ten years after its change or termination.

Article 6. Obligations of Workers

1. Workers are obliged to process personal data in accordance with the principles set out in Article IV and to fulfill the obligations under Article V.
2. Workers are obliged to familiarize themselves with the provisions of GDPR that apply to the church and to the processing activities it carries out.
3. Workers carry out only such processing as the church has assigned to them, and make reasonably expected efforts to ensure that personal data are not made available to unauthorized persons.
4. Workers are obliged to maintain confidentiality about all facts they learn in the course of processing personal data, even after the termination of the legal relationship on the basis of which they performed activities for the church. This is without prejudice to their obligations arising from other legal regulations.
5. Once every two years, workers complete mandatory training on information security and personal data protection. This training takes place during the workers' working hours.

Article 7. Obligations of the Statutory Representative

1. As the statutory body of the church, the statutory representative supervises compliance with all regulations on personal data protection, including this Directive, and directs the processing of personal data by the church.
2. The statutory representative may entrust another worker with the supervision and tasks under point 7.1.
3. The statutory representative is obliged to familiarize himself or herself with the report on the state of personal data protection in the church prepared under Article VIII, point 8.4(h), and to adopt measures to remedy any deficiencies identified.

Article 8. Data Protection Impact Assessment of a Processing Activity

1. Before the processing of personal data begins, the statutory representative designates a worker who will prepare an assessment of the impact of the processing activity on the protection of personal data within the meaning of Article 35 GDPR, or determines, in accordance with the exceptions set out in GDPR, that an assessment need not be carried out.
2. The provision of point 10.1 applies mutatis mutandis where the church plans to begin using new means of processing personal data, such as computer programs.
3. The intended processing activity must be adjusted according to the assessment and opinion so that any risks to the rights and freedoms of data subjects are minimized.
4. If the risks cannot be reduced to an acceptable level, the processing activity may not begin.

Article 9. Records of Processing Activities

1. A record of processing activity is prepared for each processing activity.

2. The record of processing activity contains:

3. the name of the employee who prepared the record,

4. the date the record was prepared,

5. the purposes of the processing,

6. the categories of data subjects,

7. the categories of personal data,

8. the categories of recipients of the personal data,

9. the envisaged time limits for retention of the personal data,

10. a general description of the technical and organizational measures for the protection of personal data,

11. The statutory representative determines which worker will prepare the record. This worker hands the record over to the statutory representative. In the event of a change in the processing activity, the employee prepares a new record.

12. Records under this Article are retained for 10 years after the termination of the processing activity or from the change of the processing activity.

Organizational and Security Measures

Article 10. Risk Prevention

1. If it was not necessary to carry out a data protection impact assessment for a processing activity, the statutory representative designates a worker who will prepare a risk analysis.
2. The risk analysis contains at least:
3. a description of the individual processing operations within the processing activity,
4. threats to the protection of personal data in the individual processing operations,
5. an assessment of the likelihood of the individual threats occurring,
6. an assessment of the extent of harm resulting from the individual threats,
7. a determination of the level of risk resulting from the individual threats,
8. a proposal of measures to eliminate or reduce the threats.
9. The likelihood of a threat occurring and the extent of harm resulting from the threat are rated on a scale of 1-5. Level five represents the highest level of likelihood of the threat occurring and of the extent of harm.
10. On the basis of the risk analysis, the church adopts appropriate measures to reduce the risks.

Article 11. Security and Storage of Personal Data

1. Workers observe the basic rules of premises security and record who enters the premises used by the church and for what reason.
2. External persons must not be left alone in premises where personal data are kept, in particular church records.
3. All documents in physical form containing personal data are kept in locked cabinets when not in use. Outside locked cabinets, they may be kept in locked rooms to which external persons are not permitted access.
4. Documents in physical form containing personal data are grouped according to the processing activity to which they relate and kept in labeled folders.
5. Documents related to keeping church records and documents related to keeping accounts are kept separately from other documents containing personal data and from each other.
6. If a computer is used for processing personal data, including the storage of personal data, only workers may access that computer. Use of that computer by external persons is prohibited.
7. Computers used for processing personal data are accessible only upon entering the account password. Each worker using a computer has his or her own account set up, which he or she accesses. Workers are prohibited from disclosing their login credentials to other persons or writing them down anywhere.
8. The church ensures the protection of personal data kept in electronic form against accidental destruction or loss. For this purpose, it introduces a data backup system.
9. Computer programs used for processing personal data are accessible only by means of a username and password. Each worker's username and password are identical for all programs and for the computer account.
10. After finishing work with physical documents containing personal data, workers are obliged to put them back in their storage place. It is prohibited to leave documents containing personal data lying around.
11. After finishing work with a computer used for processing personal data, workers are obliged to log out of their user account. The same applies to the computer programs used.

Article 12. Use of Portable Storage and Transfer of Personal Data

1. The internal storage of tablets and smartphones used for storing personal data must be encrypted.
2. If workers use a device in their private ownership for processing personal data, they are obliged to ensure the same level of personal data protection on these devices as is applied on computers owned by the church.
3. Where data media (CDs, flash drives, etc.) are used for storing or transferring personal data, documents containing personal data are copied onto these media in the form of a password-protected .rar or .zip archive.
4. If email messages are used to transfer personal data, documents containing personal data are transferred in the form of a password-protected .rar or .zip archive. The password to the relevant archive is sent to the recipient of the email message by text message (SMS).

Article 13. Handling of Documents After the End of Their Use

1. If the processing activity for which the personal data were processed has ended, and the personal data are not processed for another purpose within the meaning of Article 6(4) GDPR, documents containing personal data are kept for the duration of the archiving periods laid down by the relevant regulations.
2. Physical documents intended for shredding are destroyed using a shredding device or by a specialized external company. A personal data processing agreement will be concluded with the specialized external company.
3. Documents kept in electronic form are erased in such a way that they cannot be recovered.

Rights of Data Subjects

Article 14. General Provisions

1. In connection with the processing of personal data, data subjects have the rights set out in Articles 12 to 22 GDPR, namely:

2. the right to information about the processing of personal data,

3. the right of access to personal data,

4. the right to rectification,

5. rights to erasure,

6. the right to object,

7. the right to personal data portability.

8. When handling requests from data subjects to exercise their rights, workers act in an accommodating manner and endeavor to satisfy data subjects to the maximum extent possible, while respecting the relevant provisions of GDPR and the interests of the church that are not in conflict with GDPR.

9. Workers are obliged to proceed carefully and without undue delay when handling requests from data subjects or individual steps leading to the handling of a request.

Article 15. Duty to Inform

1. If the church obtains personal data for a defined purpose directly from the data subject, it provides the data subject with information about the processing of personal data, namely:
2. the identity and contact details of the church,
3. the contact details of the data protection officer,
4. the purposes of the processing,
5. the legal basis for the processing,
6. in the case of processing on the basis of a legitimate interest, that legitimate interest,
7. the categories of recipients of the personal data,
8. the expected period for which the personal data will be processed,
9. the possibility of exercising rights under GDPR,
10. if the processing is based on consent, the possibility of withdrawing consent,
11. the existence of the right to lodge a complaint with the Office for Personal Data Protection,
12. the fact that automated decision-making takes place, and
13. in the case of processing on the basis of law or a contract, the consequences of not providing the personal data.
14. If the church obtains personal data from a source other than the data subject, the church provides the data subject, at the first contact with the data subject, but no later than one month after obtaining them, in addition to the information under point 22.1, also the following information:
15. the categories of personal data processed, and
16. the source from which the personal data were obtained,
17. Providing information about the processing of personal data under point 22.2 is not necessary if it is evident that the data subject already has the relevant information.
18. The church provides information under points 22.1 and 22.2 to the maximum extent possible.
19. Information under points 22.1 and 22.2 is provided in a verifiable form, namely in writing upon obtaining one copy of the information signed by the data subject, by delivering the information to the data subject's email, or by displaying the information as a mandatory step within a web interface. The form of providing the information depends on the form of communication with the data subject.
20. Within a processing activity, a different procedure for providing information may be chosen, provided that the provision of the information can be documented.

Article 16. Handling of a Data Subject's Request

1. If the church receives a request from a data subject to exercise his or her rights, it prepares a record of receipt of the data subject's request.
2. The church keeps records of receipt of data subjects' requests for 10 years from the handling of the request.

Security Breach Incidents

Article 17. Reporting of Security Breaches

1. The church reports a personal data breach in a verifiable manner
2. At the same time, the church carries out the measures it is able to carry out to prevent the continuation or recurrence of the breach.
3. The data protection officer assesses whether the breach is of such a nature that it requires notification to the Office for Personal Data Protection or, where applicable, to the data subjects whose personal data are affected by the breach.
4. If such a notification must be made, the designated employee makes it within 72 hours of the moment the breach was reported, and includes in it all the information required under Article 33 GDPR.

Article 18. Handling of Security Breach Incidents

1. Handling a security breach incident is a priority task of all workers involved in the processing activity.
2. Workers and the data protection officer make every effort to avert negative consequences of the breach for data subjects.
3. If a security breach incident was reported to the Office for Personal Data Protection and the Office for Personal Data Protection determined necessary steps or gave the church any recommendations, workers are obliged to follow those recommendations and carry out the specified steps.
4. The statutory representative designates a worker who, on the basis of an investigation of the security breach incident, carries out a repeated data protection impact assessment of the activity and determines measures to prevent the incident from recurring.

Oversight

Article 19. Internal Oversight

1. In the course of carrying out the processing activity, workers continuously examine whether the established processes comply with GDPR, whether they are being followed, whether they are sufficient for the protection of personal data, and whether they represent the best available solution for the protection of personal data.

Final Provisions

Article 20. Transitional Provisions

1. Data protection impact assessments of activities and records of processing activities must be prepared within two months of the date the Directive takes effect.
2. Workers performing activities for the church at the moment the Directive takes effect complete the mandatory training under point 6.5 of the Directive within 6 months of the date the Directive takes effect. Completion of similar training in the period of two months before the Directive takes effect also counts as completion of the mandatory training.

Article 21. Effective Date

1. The Directive takes effect on 25 May 2018.