欧盟《一般数据保护条例》（GDPR）概览（一）

第一章CHAPTER I

一般条款General provisions

第二章CHAPTER II

原则Principles

第三章CHAPTER III

数据主体的权利Rights of the data subject

第四章CHAPTER IV

控制者和处理者Controller and processor

第五章CHAPTER V

将个人数据转移到第三国或国际组织Transfers of personal data to third countries or internationalorganisations

第六章CHAPTER VI

独立监管机构Independent supervisory authorities

第七章CHAPTER VII

合作与一致性Cooperation and consistency

第八章CHAPTER VIII

救济、责任与惩罚Remedies, liability and penalties

第九章CHAPTER IX

和特定处理情形相关的条款Provisions relating to specific processing situations

第十章CHAPTER X

授权法案与实施性法案Delegated acts and implementing acts

序号

原则

1.            

合法、公正和透明processed lawfully, fairly and in a transparent

2.            

目的限制purpose limitation’

3.            

数据最小化data minimisation

4.            

准确性accuracy’

5.            

期限存储storage limitation’

6.            

完整性和保密性integrity and confidentiality

序号

权利名称

对应条文

1.            

同意权right of consent）

第7条

2.            

访问权Right of access

第14条

3.            

更正权Right to rectification

第16条

4.            

被遗忘权Right to erasure (‘right to be forgotten’)

第17条

5.            

限制处理权Right to restriction of processing

第18条

6.            

可携带权Right to data portability

第20条

7.            

反对权Right to object

第21条

8.            

自动化的个人自决权Automated individual decision-making

第22条

9.            

……

……

1.            

结合相关处理的性质、范围或目的，被影响的数据主体的数量以及损害程度而确定的违法的性质、严重性与持续时间；the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them;

2.            

违法的性质是基于故意还是过失；the intentional or negligent character of the infringement;

3.            

控制者或处理者为了减轻数据主体损失而采取的所有行动；any action taken by the controller or processor to mitigate the damage suffered by data subjects;

4.            

结合控制者或处理者采取的符合第25条和第32条的技术性与组织性措施而认定的控制者或处理者的责任程度；the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them pursuant to Articles 25 and 32;

5.            

控制者或处理者之前的所有相关违法行为；any relevant previous infringements by the controller or processor;

6.            

为了纠正违法行为和减轻违法所造成的可能负面影响而和监管机构进行合作的程度；the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement;

7.            

为违法行为所影响的个人数据类型；the categories of personal data affected by the infringement;

8.            

监管机构得知违法行为的方式，特别是控制者或处理者是否对违法行为进行了报告，以及在何种程度上进行了报告；the manner in which the infringement became known to the supervisory authority, in particular whether, and if so to what extent, the controller or processor notified the infringement;

9.            

如果对同一主题事项已经对控制者或处理者发布第58（2）条规定的措施，对这些措施是否遵守；

where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned with regard to the same subject-matter, compliance with those measures;

10.        

遵守符合第40条的已生效的行为准则或符合第42条的已生效的认证机制；以及adherence to approved codes of conduct pursuant to Article 40 or approved certification mechanisms pursuant to Article 42; and

11.        

对于案件情形可以适用的所有加重或减轻因素，例如因为违法而直接或间接导致的经济收益、避免的损失。

any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement.