← Lietuva

GOVERNMENT OF THE REPUBLIC OF LITHUANIA

GOVERNMENT OF THE REPUBLIC OF LITHUANIA Official translation GOVERNMENT OF THE REPUBLIC OF LITHUANIA RESOLUTION ON THE REORGANISATION OF THE STATE REGISTER OF PERSONAL DATA CONTROLLERS, APPROVAL OF THE REGULATIONS OF THE REGISTER AND OF THE PROCEDURE OF NOTIFICATION BY PERSONAL DATA CONTROLLERS OF AUTOMATED PROCESSING OF PERSONAL DATA 20 February 2002 No. 262 Vilnius Acting in accordance with subparagraph 3 of paragraph 3 of Article 2 the Law of the Republic of Lithuania on the Amendment of the Law on Legal Protection of Personal Data (Official Gazette, 2000, No. 64-1924), Articles 22 and 23 of the Law of the Republic of Lithuania on Legal Protection of Personal Data (Official Gazette, 1996, No. 63-1479; 2000, No. 64-1924; 2002, No. 13-473), the Law of the Republic of Lithuania on State Registers (Official Gazette, 1996, No. 86-2043) and implementing the Resolution of the Government of the Republic of Lithuania “On the Establishment, Designing, Reorganisation and Use of State Registers” (Official Gazette, 1996, No. 118-2743), the Government of the Republic of Lithuania h a s r e s o l v e d:

  1. To reorganise the State Register of Personal Data Controllers by revising the list of data subject to processing and the procedure of data collection and use.
  2. To approve the appended hereto: 2.
  3. Regulations of the State Register of Personal Data Controllers; 2.
  4. procedure of notification by personal data controllers of automated processing of personal data.
  5. To establish that data controllers who are obligated under Article 22 of the Law of the Republic of Lithuania on Legal Protection of Personal Data to notify of automated processing of personal data and are registered in the State Register of Personal Data Controllers must within 2 months from the coming into effect of this Resolution submit to the State Data Protection Inspectorate with revised and supplemented data according to the established Procedure of Notification by Personal Data Controllers of Automated Processing of Personal Data.
  6. To declare invalid paragraph 2 of the Resolution of the Government of the Republic of Lithuania No. 349 of 27 March 2000 “Regarding the Establishment of the State Register of Personal Data Controllers and Approval of the Register Regulations” (Official Gazette No. 27-721). Minister of Economy acting for the Prime Minister Petras Èësna Minister of Justice Vytautas Markevièius APROVED by the Resolution No. 262 of 20 February 2002 of the Government of the Republic of Lithuania REGULATIONS OF STATE REGISTER OF PERSONAL DATA CONTROLLERS I.GENERAL PROVISIONS
  7. The Regulations shall regulate the purpose, objects of the State Register of Personal Data Controllers (hereinafter referred to as the Register), the rights and duties of the institution administering the Register, the administration, reorganisation and liquidation of the Register.
  8. The purpose of the Register is to collect, accumulate, process, systematise, store and disclose the data of the Register.
  9. The object of the Register are personal data controllers (hereinafter referred to as data controllers).
  10. The Register shall be administered in accordance with the Law of the Republic of Lithuania on State Registers (Official Gazette 1996, No. 86-2043), the Law of the Republic of Lithuania on Legal Protection of Personal Data (Official Gazette 1996, No. 63-1479; 2000, No. 64-1924; 2002, No. 13-473), other legal acts regulating the administration of State Registers and personal data processing and these Regulations.
  11. The Register is not the principal Register of the State and shall be administered with the help of automatic equipment.
  12. The data controllers shall be registered free of charge. II. INSTITUTION ADMINISTERING THE REGISTER
  13. The institution administering the Register shall be the State Data Protection Inspectorate (hereinafter referred to as the Register Institution).
  14. The Register Institution shall perform the following functions: 8.
  15. collect from the personal data controllers the registration data specified in these Regulations; 8.
  16. register the data controllers and processing the database of the Register; 8.
  17. ensure conformity of the Register data with the data presented in the registration documents; 8.
  18. check the registration data submitted by the data controllers, making use of the data of other State Registers; 8.
  19. disclose the register data to the users - natural and legal persons; 8.
  20. accumulate, update, alter the data, remove the register data to the register data archives; 8.
  21. ensure the protection of the register database and the archives of the register data; 8.
  22. keep the archives of the data submitted for registration, ensure the protection of the archives; 8.
  23. organise technical maintenance and supervision of the register database; 8.
  24. organise upgrading works of the register’s instrumentation and software; 8.11 perform other functions provided by laws and other legal acts.
  25. Public servants employed in the Register Institution who take part in the processing of registration data must keep the data processed in the Register confidential for the time period fixed by laws and other legal acts.
  26. The Register Institution shall have the following rights: 10.
  27. to obtain from the personal data controllers registration data, other information, documents and explanations regarding the processing of personal data; 10.
  28. to demand that data controllers rectify the incorrect and/or inaccurate registration data in accordance with the procedure laid down in these Regulations; 10.
  29. to present certified transcripts of the register data; 10.
  30. to select, according to the procedure laid down in laws and other legal acts, entities for designing the register data base, performing technical maintenance and supervision of the register data base; 10.
  31. other rights provided for in laws and other legal acts.
  32. The Register Institution shall be responsible for: 11.1 conformity of the register data to the documents submitted for registration; 11.
  33. protection of the data disclosed by the data controllers; 11.
  34. protection of the register database; 11.
  35. functional character of the register database. III. REGISTRATION DATA
  36. The registration number assigned to the personal data controller upon his registration by the Register Institution shall be the identification number (code) of the data controller, comprised of a letter indicating the time period of personal data processing and a six-figure identifier - number of recording in the register.
  37. The following shall constitute the registration data: 13.
  38. identification number (code) of the data controller; 13.
  39. date of registration of the data controller; 13.
  40. the name and seat of the data controller and his representative, if such has been assigned, or, if the data controller and/or his representative is a natural person - his name, surname and place of residence; 13.
  41. purpose or purposes of data processing; 13.
  42. group or groups of data subjects which are identified by reference to one or more factors specific to them (land owners, patients, pensioners, debtors, etc.) and the list of data related to the groups; 13.
  43. sources of personal data; 13.
  44. data recipients or group or groups of recipients identified by the factors specific to them (debt recovery institutions, banks, etc.) to whom the data controllers intend to disclose or are disclosing personal data; 13.
  45. transfer of personal data to recipients in foreign countries (purpose of transfer, list of data transferred, the country or a group or groups of countries); 13.
  46. time period of data storage; 13.
  47. data relating to the person responsible for data protection (name and surname, place of work, telephone and fax numbers, e-mail address); 13.
  48. the list of data controllers and their representatives, if such have been assigned; 13.
  49. a general description of data protection measures (according to the requirements set by the Register Institution) and the date of drawing up thereof. The general description shall not be processed with the help of automatic equipment - it shall be kept in the document file.
  50. Where, in the cases established by laws and other legal acts, the data controller has assigned a representative for data protection, the registration data shall be as follows: 14.
  51. identification number of the data controller; 14.
  52. date of registration of the data controller; 14.
  53. the name and seat of the data controller and his representative, if such has been assigned, or, if the data controller and/or his representative is a natural person - his name, surname and place of residence; 14.
  54. data relating to the representative for data protection (name, surname, workplace, official telephone and fax number, e-mail address). IV. REGISTRATION OF OBJECTS
  55. Data controllers who, governed by the Law of the Republic of Lithuania on the Legal Protection of Personal Data and implementing the Procedure of Notification by Personal Data Controllers of Automated Processing of Personal Data, approved by this Resolution, have notified of the automated processing of data shall be registered in the register.
  56. The Register Institution shall within 30 days from the receipt of notification make a decision to register the data controller, provided that the information submitted in the data controller’s notification conforms to the requirements laid down in the Procedure of Notification by Personal Data Controllers of Automated Processing of Personal Data, approved by this Resolution and is consistent with lawful processing of data.
  57. Having made a decision to register the data controller, the Register Institution shall enter in the register data base the registration data from the data controller’s notification, which are specified in subparagraphs 13.1-13.11 or, accordingly, 14.3-14.4 of these Regulations and assign the registration number.
  58. Having established that the data submitted by the data controller are incomplete and/or inaccurate, the Register Institution shall demand to revise and/or rectify the data. Having received revised information, the Register Institution shall within 15 calendar days make a decision regarding the registration of the data controller.
  59. The Register Institution shall notify the data controller in writing of the registration of the data controller and assignment of the identification number (code) or refusal to register, specifying the reasons for refusal.
  60. Data controllers must submit the changed registration data, specified in subparagraphs 13.1-13.11 or, accordingly, 14.3-14.4 of these Regulations to the Register Institution within 15 calendar days after the change in the registration data. Upon receipt of the data controller's notification of the changed registration data, the Register Institution shall within 30 calendar days from the day of receipt thereof adopt a decision to enter the changes in the register data base and to remove records of the changed register data to the register data archives. The data controllers must every year by 31 January submit the changed registration data specified in subparagraph 13.12 of these Regulations to the Register Institution.
  61. The data controller shall be entitled to have access free of charge to the registration date submitted by him and stored in the register, also to demand that incorrect data be rectified and/or incomplete data be supplemented. Having received the application of the data controller requesting rectification and/or supplementing of the registration data submitted by him, the Register Institution must within 10 calendar days from the receipt of the application consider it, rectify the data and notify the data controller thereof in writing or make a motivated decision to reject the application as unreasonable and notify the data controller thereof in writing.
  62. Having ascertained, that incorrect registration data were given in the documents submitted by the registered data controller, the Register Institution shall forthwith inform the data controller thereof and demand rectification of the error. Upon the rectification of the error, the Register Institution shall notify all data recipients thereof.
  63. If due to the fault of the Register Institution the registration data entered in the register data base are not in conformity with the registration data given in the documents, the Register Institution shall promptly, but not later than within 3 calendar days from the discovery of the error rectify it and notify all recipients of the register data thereof.
  64. The Register Institution shall cancel the registration of the data controllers if: 24.
  65. the data controller discontinues personal data processing; 24.
  66. the data controller is relieved of the duty to notify of data processing; 24.
  67. the temporary time period of personal data processing, specified in the data controller’s notification, expires and the data controller fails to notify of the extension of the time period of personal data processing; 24.
  68. the activities of the data controller are terminated.
  69. In the cases provided for in paragraph 24 of these Regulations the Register Institution shall transfer the registration data to the register data archives and record the date of the data controller’s removal from the register in the archives of the register data.
  70. Where there is a change in the registration data list, the registration data which have become insignificant shall be transferred to the archives of the register data.
  71. The archives of the register data shall be kept in accordance with the procedure established by the Law of the Republic of Lithuania on Archives (Official Gazette 1995, No. 107-2389) and other legal acts. V. INTERACTION WITH OTHER REGISTERS
  72. The following data from other State Registers may be used in order to check the register data specified in subparagraph 13.3 or, accordingly, 14.3 of these Regulations: 28.
  73. from the registers where legal persons are registered - the name, registration number (code), address and type of activities; 28.
  74. from the Population Register - personal number, name, surname, place of residence of the natural person. VI. USE OF REGISTER DATA
  75. The register data shall be public, with the exception of the data specified in subparagraphs 13.10 and 13.12 or, accordingly, 14.4 of these Regulations.
  76. The public data of the register shall be announced on the Internet (www.ada.lt) and shall be printed out to persons who file a corresponding application. VII. TRANSFER OF REGISTER DATA TO FOREIGN COUNTRIES
  77. The Register Institution may transfer to foreign states via computer network and other means the data specified in subparagraphs 13.1-13.9 and 13.11, 14.1-14.3 of these Regulations as well as consolidated data relating to personal data protection means used in the Republic of Lithuania only in the cases provided for by laws, other legal acts of the Republic of Lithuania and international agreements to which the Republic of Lithuania is a party. VIII. PROTECTION OF REGISTER DATA
  78. The Register Institution shall be responsible for the protection the register data.
  79. In the course of administration of the register measures must be implemented to ensures the protection of the data against any unlawful destruction, alteration or use. The specific measures for the protection of the register data shall be established by the Register Institution in the technical design of the register. IX. FINANCING OF THE REGISTER
  80. The Register shall be financed with the funds of the State Budget of the Republic of Lithuania. X. REORGANISATION AND LIQUIDATION OF THE REGISTER
  81. The register shall be reorganised and liquidated in accordance with the legal acts of the Republic of Lithuania.
  82. The data of the register subject to liquidation shall be transferred into another register, State archives or shall be destroyed in accordance with the procedure laid down by the legal acts of the Republic of Lithuania. APROVED by the Resolution No. 262 of 20 February 2002 of the Government of the Republic of Lithuania PROCEDURE OF NOTIFICATION BY PERSONAL DATA CONTROLLERS OF THE AUTOMATED PROCESSING OF DATA
  83. This procedure shall regulate the contents and presentation of the notification of the processing of data.
  84. Before commencing the processing of personal data by automatic means, the data controller must notify the Register Institution of the processing of data, save for the exceptions established by the Law of the Republic of Lithuania on Legal Protection of Personal Data.
  85. The following data shall be submitted in the notification of the processing of data: 3.
  86. the name of the data controller and its representative, if such has been assigned, and its seat or, where the data controller and/or his representative is a natural person, his name, surname and place of residence; 3.
  87. the purpose or purposes of personal data processing; 3.
  88. group or groups of data subjects which are identified by reference to one or more factors specific to them (land owners, patients, pensioners, debtors, etc.) and the list of data related to the groups; 3.
  89. sources of personal data; 3.
  90. data recipients or group or groups of recipients identified by the factors specific to them (debt recovery institutions, banks, etc.) to whom the data may be disclosed; 3.
  91. transfer of data to recipients in foreign countries (purpose of transfer, list of data transferred, the country or a group or groups of countries); 3.
  92. the time-limits for storing the data; 3.
  93. data relating to the person responsible for data protection (name and surname, place of work, telephone and fax numbers, e-mail address); 3.
  94. the list of data controllers and their representatives, if such have been assigned.
  95. Filled in lists with the data controller’s and each data processor’s general description of data protection measures in compliance with the requirements set by the State Data Protection Inspectorate shall be attached to the notification.
  96. Where, in the cases provided by laws or other legal acts, the data controller has assigned a representative for the protection of data, a simplified notification procedure may be applied. In such case the following data shall be submitted in the notification of the processing of data by automatic means: 5.
  97. the name of the data controller and its representative, if such has been assigned, and its seat or, where the data controller and/or his representative is a natural person, his name, surname and place of residence; 5.
  98. data relating to the person responsible for data protection (name and surname, place of work, telephone and fax numbers, e-mail address).
  99. When notifying of the processing of data according to the simplified procedure, the data controller shall obligate the person responsible for data protection to keep a public register of data processing operations, which shall contain the data listed in subparagraphs 3.1 - 3.9 of this Procedure.
  100. The notification of the processing of data shall be signed by the data controller (natural person), the head of the office of the data controller (legal person) or the person authorised by him.
  101. The data controller shall deliver the notification to the State Data Protection Inspecotrate or send it by post. The notification may be signed by electronic signature and sent via computer network. Where the notification is sent by fax or via computer network, the original copy must be delivered or sent within 10 days.
  102. The data controller shall be responsible for the accuracy of the data presented in the notification.

🔗 Į oficialų šaltinį

DI paaiškinimas pagal oficialų įstatymo tekstą. Orientacinis, nepakeičia teisinės konsultacijos.