|
|
APPROVED BY Order of the Chairman of the Vitebsk Regional Executive Committee 30.05.2023 No. 131r |
REGULATION
REGULATION
on the Policy of the Vitebsk Regional Executive Committee regarding the processing of personal data
CHAPTER 1
GENERAL PROVISIONS
1. This Regulation defines the policy of the Regional Executive Committee regarding the processing of personal data (hereinafter referred to as the Policy).
2. The Policy has been developed in accordance with the Law of the Republic of Belarus «On Personal Data Protection» (hereinafter referred to as Law No. 99-Z) and other legislative acts on personal data in order to ensure the protection of personal data, as well as the rights of individuals in the processing of their personal data.
3. This Policy uses terms and their definitions in the meanings established in Article 1 of Law No. 99-Z.
4. The scope of this Policy extends to all methods of processing personal data in the Regional Executive Committee, both using automation tools and without their use.
CHAPTER 2
PURPOSES AND LEGAL GROUNDS FOR PROCESSING PERSONAL DATA
5. The Regional Executive Committee is the operator carrying out the processing of personal data.
6. The Regional Executive Committee processes personal data for the following purposes:
processing personal data of employment candidates;
formalizing employment (official) relations, as well as in the course of employment (official) activities of the personal data subject;
maintaining the personnel register of the Regional Executive Committee, forming a personnel reserve;
maintaining military registration records;
calculating and paying wages;
assigning and paying pensions and allowances;
paying monetary rewards in accordance with the legislation;
maintaining individual (personalized) records of information about insured persons;
considering appeals of citizens, including individual entrepreneurs, and legal entities, organizing preliminary appointments for personal reception, registering incoming calls to the «hotline»;
carrying out administrative procedures, considering administrative complaints;
considering requests from state bodies (in relation to the persons specified in the requests);
conducting administrative proceedings;
processing personal data when such data are specified in a document addressed to the Regional Executive Committee and signed by the personal data subject;
concluding, executing, modifying, and terminating civil law contracts;
providing rental housing in accordance with the Decree of the President of the Republic of Belarus dated November 17, 2014 No. 535 «On Rental Housing»;
conducting «direct telephone lines»;
ensuring access control regime;
fulfilling other duties (powers) provided for by the legislation.
7. The Regional Executive Committee processes only those personal data that are necessary for achieving the stated purposes and does not allow their excessive processing.
8. Personal data processing is carried out with the consent of the personal data subject, except in cases established by the legislation when personal data processing is carried out without obtaining such consent.
The consent of the personal data subject is a free, specific, and informed expression of his or her will, by which he or she permits the processing of his or her personal data.
CHAPTER 3
CATEGORIES OF PERSONAL DATA SUBJECTS WHOSE DATA ARE PROCESSED. LIST OF PROCESSED PERSONAL DATA
9. The Regional Executive Committee processes personal data of the following categories of personal data subjects:
candidates for employment in the Regional Executive Committee;
employees of the Regional Executive Committee, including dismissed ones, as well as members of their families and close relatives;
heads of subordinate organizations, including dismissed ones, as well as members of their families and close relatives;
candidates for employment in other state bodies and organizations in cases of coordination of appointments to positions in the established manner;
counterparties – individuals, representatives of counterparties – legal entities, including potential ones;
individuals against whom administrative proceedings are being conducted;
candidates for inclusion in the personnel reserve;
persons included in the personnel register of the Regional Executive Committee;
individuals for whom reward documents have been submitted;
visitors and (or) users of information systems (resources) of the Regional Executive Committee;
individuals whose data are specified in appeals and other documents addressed to the Regional Executive Committee;
individuals who have applied for the implementation of administrative procedures, as well as those who have filed administrative complaints;
individuals who have contacted the «direct telephone line» and «hotline» of the Regional Executive Committee;
individuals who have given consent to the processing of personal data;
visitors to the Regional Executive Committee;
other persons in cases provided for by the legislation.
10. The personal data processed in the Regional Executive Committee include:
surname, first name, patronymic (if any), including previous surnames, first names, patronymics in case of their change;
day, month, year of birth;
place of birth;
gender;
information on citizenship (nationality), including previous citizenships, other citizenships;
passport details or details of another identity document;
identification number;
registration address at the place of residence (stay), actual residence address;
work, home (landline) and mobile phone numbers, email address or details of other means of communication;
details of the social insurance certificate;
information on marital status, family composition, close relatives;
information on employment activities;
information on military registration records and details of military registration documents;
information on education (when and which educational, scientific and other organizations were graduated, numbers of education (training) documents, specialty according to the education document, qualification);
information on academic degree;
information on foreign language proficiency, including the level of proficiency;
photograph;
information on state awards, other awards and decorations;
information on retraining and (or) advanced training;
information on social benefits;
information on the existence of enforcement proceedings in compulsory enforcement bodies;
information on criminal record, administrative liability;
other data in accordance with the legislation.
11. The content and volume of personal data processed by the Regional Executive Committee for each category of personal data subjects are determined by the necessity of achieving specific purposes of their processing.
CHAPTER 4
PROCEDURE AND CONDITIONS FOR PROCESSING PERSONAL DATA
12. The processing of personal data by the Regional Executive Committee includes collection, systematization, storage, modification, use, depersonalization, blocking, dissemination, provision, deletion, and other actions or sets of actions in accordance with the legislation.
13. When processing personal data, the Regional Executive Committee takes the necessary legal, organizational, and technical measures to ensure the protection of personal data from unauthorized or accidental access to them, modification, blocking, copying, dissemination, provision, deletion of personal data, as well as from other illegal actions in relation to personal data.
14. Processing of personal data on behalf of the Regional Executive Committee or in its interests may be carried out by authorized persons on the basis of legislative acts, decisions of the relevant state bodies, and a contract (agreement) concluded between the Regional Executive Committee and a third party in accordance with the legislation.
15. In the event that the Regional Executive Committee entrusts the processing of personal data to an authorized person, the Regional Executive Committee bears responsibility to the personal data subject for the actions of the specified person. The authorized person bears responsibility to the Regional Executive Committee.
16. The processing of personal data by the Regional Executive Committee is carried out in the following ways:
using automation tools;
without using automation tools.
17. The Regional Executive Committee transfers personal data:
to the personal data subject in respect of himself or herself – without restrictions, except in cases directly provided for by the requirements of the legislation;
to third parties – in cases provided for by the legislation.
18. Personal data are stored in a form that allows the identification of the personal data subject, no longer than required by the purposes of processing personal data, except in cases where the retention period is established by the legislation.
19. The conditions for termination of personal data processing may include the achievement of the purposes of personal data processing, the expiration of the personal data processing period, the withdrawal of consent of the personal data subject to the processing of his or her personal data, as well as the detection of unlawful processing of personal data.
CHAPTER 5
RIGHTS AND OBLIGATIONS OF THE REGIONAL EXECUTIVE COMMITTEE AND THE PERSONAL DATA SUBJECT
20. When processing personal data, the Regional Executive Committee has the right to:
receive from the personal data subject reliable information and (or) documents containing personal data;
request from the personal data subject information on the relevance and reliability of the provided personal data;
refuse to satisfy the personal data subject's requirements for termination of processing of his or her personal data and (or) their deletion if there are grounds for processing personal data provided for by the legislation, including if they are necessary for the stated purposes of their processing, notifying the personal data subject thereof within fifteen days.
21. When processing personal data, the Regional Executive Committee is obliged to:
explain to the personal data subject his or her rights related to the processing of personal data;
obtain the consent of the personal data subject, except in cases provided for by the legislation;
ensure the protection of personal data in the course of their processing;
provide the personal data subject with information about his or her personal data, as well as about the provision of his or her personal data to third parties, except in cases provided for by the legislation;
make changes to personal data that are incomplete, outdated, or inaccurate, except in cases where a different procedure for making changes to personal data is established by legislative acts or if the purposes of processing personal data do not imply subsequent changes to such data;
terminate the processing of personal data, as well as carry out their deletion or blocking (ensure the termination of personal data processing, as well as their deletion or blocking by an authorized person) in the absence of grounds for processing personal data provided for by the legislation;
notify the National Center for Personal Data Protection about violations of personal data protection systems immediately, but no later than three working days after the Regional Executive Committee became aware of such violations, except in cases provided for by the National Center for Personal Data Protection;
carry out the modification, blocking, or deletion of inaccurate or illegally obtained personal data of the personal data subject upon the request of the National Center for Personal Data Protection, if a different procedure for making changes to personal data, their blocking, or deletion is not established by legislative acts;
fulfill other requirements of the National Center for Personal Data Protection on the elimination of violations of the legislation on personal data;
fulfill other obligations provided for by the legislation.
22. The personal data subject has the right to:
receive information concerning the processing of his or her personal data;
make changes to his or her personal data in case the personal data are incomplete, outdated, or inaccurate;
withdraw consent to the processing of personal data;
receive information about the provision of his or her personal data to third parties;
terminate the processing of his or her personal data, including their deletion, in the absence of grounds for processing personal data provided for by the legislation;
appeal the actions (inaction) and decisions of the Regional Executive Committee that violate his or her rights in the processing of personal data to the National Center for Personal Data Protection in the manner prescribed by the legislation;
exercise other rights provided for by the legislation.
CHAPTER 6
CROSS-BORDER TRANSFER OF PERSONAL DATA
23. Before starting the cross-border transfer of personal data, the Regional Executive Committee is obliged to ensure that the foreign state to whose territory the personal data is supposed to be transferred ensures an adequate level of protection of the rights of personal data subjects.
Cross-border transfer of personal data to the territories of foreign states that do not meet the above requirement may be carried out only in the cases provided for in paragraph 1 of Article 9 of Law No. 99-Z.
24. The list of countries on whose territories an adequate level of protection of the rights of personal data subjects is ensured is determined by the National Center for Personal Data Protection.