GDPR
The processing of personal data is regulated by:
– domestic law – Law no. 677/2001 on the protection of personal data
– Community legislation – Regulation no. 679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data
Regulation no. 679/2016 is mandatory from 25.05.2018 for all Member States and regulates essential aspects regarding the personal data of individuals. One of the recognized rights, freedoms and principles is the Protection of personal data. The regulation provides for the protection of the natural person in terms of processing and storage of his data, as well as the rights of the citizen over his own data.
Personal data from the perspective of the webcam studio
The webcam studio, as a legal entity, is an operator that has access to the personal data of the data subject (employee, audiovisual service provider, seller of audiovisual works rights), which will process them and use them in the sense of carrying out legally of the object of activity, in any of the forms of legality agreed by AMP Adult Media Promotion, respectively
– employment relations of Studio SRL type – employee,
– contractual contributions for the provision of services between micro-enterprises Studio SRL – provider Model SRL,
– contractual reports of copyright assignment type.
Therefore, the company that manages the webcam studio is seen in terms of the European legal text as a personal data controller, so we appreciate that it is no longer necessary to register / affiliate that company to a body authorized to notify the processing of the National Supervisory Authority of Personal Data Processing (ANSPDCP).
The studio is obliged to use the collaborator’s data based on strictly regulated principles, likely to lead to the legal and adequate processing of personal data and information. Thus, personal data must be processed legally, equitably and transparently to the data subject (“legality, fairness and transparency”) and will be collected for specific, explicit and legitimate purposes according to the object of activity of the studio, as a platform for intermediation between sites. and models. “Data minimization” means the principle that the data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed, ie the establishment and promotion of model accounts of the employee / provider / transferee. The data must also be accurate, otherwise they must be rectified or deleted without delay.
Regarding the legality of the data processing, we specify that the administration of information concerns a series of conditions that the studio must meet:
- a) the data subject (model) must give his consent for the processing (collection, making accounts on sites, promotion of the model) of his personal data related to the specifics of the legal relationship between studio and collaborator (employee, provider, assignee);
The model must be informed in advance that the studio is authorized to collect, own, operate and transmit (to sites) the model data in order to fulfill the object of activity, respectively the operation of model profiles on the sites with which it has contract.
- b) the processing is necessary for the execution of a contract to which the data subject is a party or to take steps at the request of the data subject before concluding a contract; We appreciate that it is necessary to adjust the contracts (employment, services, assignment) regarding the European and Romanian legislation regarding the obligations of the studio (as operator) correlated with the rights of the model (data subject) on its own data and information at any time.
This condition is sufficient to meet the legality of holding personal data because the studio has a contractual obligation to operate and transmit model data according to the existing or future legal relationship, respectively employment contract, services, copyright assignment.
- c) the processing is necessary in order to fulfill a legal obligation incumbent on the operator; The obligation of the operator is contractual and it will be carried out according to the object of activity and the specifics of the contract concluded with the model.
From a procedural point of view (in relation to the operator and the authorized person), another obligation of the studio is the mandate of the admins / studio manager by the company administrator (as the legal representative of the operator) to collect data and inform the models about their rights over their personal data. The authorized person will inform in advance the models that the operator is authorized to process personal data in order to fulfill the object of the contract with the model and will find his written consent by a declaration in duplicate. Although the European legal text also describes the unequivocal mode of action in which consent can be found, we appreciate that the written form of a signed statement of the model proves the fact (together with the witness evidence) that the model was informed in advance about the processing of personal data by the operator.
With regard to consent, we specify that the controller must be able to demonstrate that the data subject has given his or her consent to the processing of his or her personal data, which must be attested in writing in an intelligible and easily accessible form, using clear and simple language.
From a procedural point of view (in relation to the operator with the data subject – the model) the operator is obliged to inform the data subject in advance about all the following information:
– identity and contact details of the operator / his representative (available in the contract concluded with the operator)
– the contact details of the data protection officer
– the purposes for which the personal data are processed, as well as the legal basis of the processing. In this case, the purpose is obvious, respectively to conclude the contract (work, services, assignment of copyright) in order to make profiles of the person concerned in the studio structure of the operator.
– recipients or categories of recipients of personal data: sites, accounting, etc.
In order to ensure fair and transparent processing, the controller shall provide the data subject with the following additional information necessary for:
– the period for which the personal data will be stored or, if this is not possible, the criteria used to establish this period: the period of the contract concluded by the controller with the data subject
– the right to request from the controller access to personal data, rectification, deletion, restriction of processing or the right to oppose the processing, as well as the right to data portability;
– the right to lodge a complaint with a supervisory authority; – whether the provision of personal data is a contractual obligation or an obligation necessary for the conclusion of a contract, and whether the data subject is obliged to provide such personal data and what are the possible consequences of non-compliance with this obligation: the sanction consists in not concluding the contract between the operator and the data subject as well as the impossibility to perform profiles within the studio structure.
Personal data from the model’s perspective
The Community legal text states the rights of the data subject as the legal holder of his or her personal data. Moreover, it establishes a series of legal guarantees that oblige the operator
– The right to rectify the data provided by art. 16 of Regulation no. 679/2016 EU
– The right to delete data (“the right to be forgotten”) established by art. 17 of Regulation no. 679/2016 EU. The data subject may request the operator to delete personal data, in conjunction with the operator’s obligation to delete the model data if:
– personal data are no longer necessary for the purposes for which they were collected or processed – the contract has been terminated
– the data subject withdraws the consent on the basis of which the processing takes place, with the consequence that the contract concluded is terminated
– the data subject opposes processing in accordance with the right to object – personal data have been processed unlawfully – hypothesis unlikely from a practical point of view
– The right to restrict the processing of Art. 18 of Regulation no. 679/2016 EU. The data subject has the right to obtain from the operator the restriction of processing if
– the data subject disputes the accuracy of the data, for a period which allows the controller to verify the accuracy of the data;
– the processing is illegal, and the data subject opposes the deletion of personal data, requesting instead the restriction of their use;
– the controller no longer needs personal data for the purpose of processing, but the data subject requests them for the establishment, exercise or defense of a right in court.
We consider that the data subject (model) may withdraw his consent at any time regarding the processing, possession and use of his data by the operator, for reasons related to the particular situation in which he is (without motivating the decision), even if he or she does not give its initial consent explicitly in this regard through a written statement of intent. (Lack of initial agreement in the absence of application of the EU Regulation although the specific Romanian law was in force since 2001) Otherwise, the possession of data by the operator is illegal and is sanctioned according to art. 83 (5) of the Regulation with administrative fines of up to EUR 20 000 000 or, in the case of an undertaking, up to 4% of the total annual global turnover for the preceding financial year.
0730 633 335 / 0730 633 334