The most important changes for companies will be higher penalties for violations, stricter conditions at processing personal data, and obligatory reports on data base invasions. For a number of companies the process for assuring compliance with the new decree will be demanding, and costly.
The purpose of the amendment of the decree is to protect privacy of users, and integrity of personal data collected by companies. Companies violating the provisions of the decree will face higher penalties, up to 20 million euros, and loss of reputation or clients. One of the largest novelties for individual persons is the right to transferability of data, Andrej Tomšič, Deputy Information Commissioner, explained.
Lawyer Nataša Pirc Musar is convinced that companies which are familiar with the law on protection of personal data and basic legal foundation should have no bigger problems with the new decree. In future, every individual will have to be precisely informed what personal data are used for by a company, and who will personal data be transferred to; consequently, the so-called forms of consent will have change.
The new decree also demands that companies report to law-enforcement bodies in detail on invasion or theft or misuse of personal data within 72 hours.
Jure Čepin, Radio Slovenija; translated by G. K.