GDPR and local legislation

Do state authorities have to comply with GDPR? Are there any restrictions?

Yes, all controller entities must comply with the GDPR provisions. There is one exemption for state authorities and these cannot rely on legitimate interest when processing personal data.

How does the GDPR compare to the national laws?

The EU GDPR is called in legal terms “lex generalis” meaning that it can be overwritten by special national laws such as Criminal Code, Tax code, etc.

Which will prevail in a conflict between GDPR and national laws?

If the conflict is between a special national law and the GDPR the national law will prevail.

Does an IP constitutes persoanl data?

Personal data is defined in art. 4 as “means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”. IP is an identification number thus is considered personal data.

Can you please provide an example on what automated decision making means?

A classic example of automated decision making is automated credit checking performed by banks. Basically some algorithm is deployed to calculate the eligibility of a loan based on age, studies, income, gender, etc. to automatically generate a report on the solvability of the potential client.

If you want to find out more about the EU GDPR check out this EU GDPR Foundations Course (https://advisera.com/training/eu-gdpr-foundations-course//)