Modelo de tratamiento de datos RGPDWorkplace access control with person over template control
Finalidades (2)
La finalidad de un tratamiento es el objetivo principal del uso de los datos personales. Estos datos deben ser recopilados para un propósito bien determinado y legítimo y no deben ser tratados posteriormente de manera incompatible con este objetivo inicial.
Datos (3)
El artículo 30 del RGPD exige el registro de las categorías de datos tratados. Se trata aquí de definir las categorías de datos tratados. Estas pueden ser consideradas comunes o sensibles.
Data on employees' working lives
Detalles de los datos
Reglas de conservación
Base activa:
Duration of employment contract
Orden final
Employee movement logs
Detalles de los datos
Reglas de conservación
Base activa:
Active: 3 months maximum (proportionality and necessity test).
Information Commission (ICO) monitoring workers guidance
Orden final
Employee identification data
Detalles de los datos
Definición
- Type 1 : templates under the control of the persons concerned are those whose only durable storage medium is held by the person him/herself, e.g. in the form of a badge or smart card ;- Type 2 : Templates under shared control are those whose durable storage medium is controlled by the employer or his employees, but which are kept in a form that makes them unusable without the use of a secret held by the person concerned;Type 3: templates not controlled by the persons concerned are those whose permanent storage medium is controlled by the employer or his agents in an exploitable form requiring neither a badge containing the template nor the use of a secret controlled by the person concerned.
Definición
Photograph including the person's face
Reglas de conservación
Base activa:
No statutory period applies; the controller should set the periods based on the purpose (UK GDPR, Article 5(1)(e)). Biometric data are special category data and a non-biometric alternative (badge, PIN) should be offered. For example: the biometric template is kept only while the person's access authorisation is valid and is deleted when the person leaves or opts for the alternative; identity, professional and parking data are deleted 3 months after the end of a one-off access authorisation and, for long-term access, after a period set by the controller (for example 12 months after departure, or up to 6 years where needed to defend contractual claims under the Limitation Act 1980, s.5).
UK GDPR, Article 5(1)(e); Limitation Act 1980, s.5
Orden final
Personas afectadas (1)
Una persona interesada es toda persona cuyos datos son recopilados, retenidos o tratados por el tratamiento de datos en cuestión. Ej: En el marco de un tratamiento de gestión de reclutamiento, cualquier candidato para el puesto en cuestión constituye una persona interesada.
- Employees
Attribution / Pas d'utilisation commerciale
CC-BY-NC
