Regulation (EU) 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 (GDPR) introduces, among others, the procedure for certification of personal data protection.
The mechanisms for the certification of personal data protection, as completely new solutions, are intended to ensure greater protection of personal data and the compatibility of their processing with the GDPR and the purposes for which personal data were collected.
In accordance with the General Data Protection Regulation, certification will be voluntary, but implementation by the administrator of certification mechanisms and obtaining an appropriate certificate will demonstrate the reliability of the processing of personal data.
The procedure for obtaining the certificate was described in the draft Data Protection Act dated 12 September 2017
The provisions of the General Data Protection Regulation introduce a new solution concerning the certification of personal data protection, which was designed to create a mechanism for assessing entities in terms of compliance with the GDPR provisions. The introduction of the certification procedure is a fundamental change to the current legislation, since there is no tool in the current legal order to verify that the entity actually has the right qualifications and to apply the arrangements to which it is obliged under the law.
According to Article 42(1) The GDPR certificate proves that the processing of personal data conducted by administrators and processors complies with the GDPR provisions. The certificate will therefore constitute an official confirmation that the data controller or the data processor is legally acting.
The certificate is also a good guide and argument to facilitate the selection of the relevant processor.
The General Data Protection Regulation introduces the obligation to use the services of such processors, which will guarantee the processing of data in accordance with the requirements of the GDPR and the protection of the rights of data subjects by appropriate technical and organisational means.
The application of certification mechanisms also plays an important role in the procedure for imposing the fines provided for in the GDPR. According to Article 83 The GDPR should take into account the factors which affect the level of penalties mentioned in this provision, including the application of approved certification mechanisms by the entity concerned. This means that certification by the entity to which the penalty is to be imposed will reduce this penalty.
The introduction of a certification mechanism is undoubtedly a positive solution, as certification will have a positive effect on compliance with personal data protection rules.