Establishing technical and organizational measures to be applied in order to adapt the requests of the departments concerned, regarding the use of personal data, to solve the requests of the persons concerned by the use of their data by the University of Medicine and Pharmacy “Iuliu Hațieganu” Cluj Napoca, as well as the internal monitoring of the departments regarding the protection, use, compliance, monitoring, implementation and issuance of responses and / or recommendations of Regulation (EU) 689/2016 on the protection of personal data.

APLICATION DOMAIN

The scope is reflected in the processing of personal data, carried out in whole or in part by automated means, as well as the processing by means other than automated of personal data which are part of a data record system or which are intended to is part of a data record system.

REFERENCE DOCUMENTS

Law 190/2018 on measures for the implementation of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and data repealing Directive 95/46 / EC (General Data Protection Regulation);

REGULATION (EU) no. 679 of 27 April 2016 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (General Data Protection Regulation, continue GDPR).

DESCRIPTION OF THE ACTIVITY

The possibility is offered to the targeted departments, as well as to the persons whose personal data are processed, in accordance with art. 12 of the GDPR, to submit a written request in physical or electronic format, whenever it wishes to exercise your rights regarding the protection of personal data (pursuant to Articles 13-22 of the GDPR).

The personal data are:

a) processed lawfully, fairly and transparently to the data subject (legality, fairness and transparency);

b) collected for specified, explicit and legitimate purposes and are not further processed in a manner incompatible with those purposes; further processing for archiving purposes in the public interest, for scientific or historical research or for statistical purposes shall not be considered incompatible with the original purposes, in accordance with Article 89 (1) (purpose-related limitations);

c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (minimization of data);

d) accurate and, if necessary, updated; all necessary measures must be taken to ensure that personal data which are inaccurate, having regard to the purposes for which they are processed, are deleted or rectified without delay (accuracy);

e) kept in a form which permits identification of data subjects for a period not exceeding the period necessary for the purposes for which the data are processed; personal data may be stored for longer periods to the extent that they are processed exclusively for archiving purposes in the public interest, for scientific or historical research or for statistical purposes, in accordance with Article 89 (1), subject to the implementation of the appropriate technical and organizational measures provided for in this Regulation in order to guarantee the rights and freedoms of the data subject (storage restrictions);

f) processed in a manner that ensures adequate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, by taking appropriate technical or organizational measures (integrity and confidentiality). 

The information provided pursuant to Articles 13 and 14 of the GDPR and any communication and any action taken pursuant to Articles 15-22 and 34 of the GDPR shall be provided free of charge by the institution.

If the requests from a data subject are clearly unfounded or excessive, especially due to their repetitive nature, the University of Medicine and Pharmacy “Iuliu Hațieganu” Cluj-Napoca exercises its right (based on art. 12, para. 5)) to take the following measures:

• Charge a reasonable fee taking into account the administrative costs of providing the information or communication or of taking the required measures;
• Refuse to comply with the request.

The request for the exercise of the rights to the protection of personal data, governed by the GDPR, shall be in writing and shall contain at least the following information:

• identification data of the person making the request / complaint (name, surname and CNP);
• the quality of the person making the request / complaint;
• the object of the request, respectively the complete description of the requested information / changes;
• correspondence data (correspondence address and e-mail address), in order to send the reply;
• date of preparation;
• signature of the person making the request / complaint.

In accordance with art. 12, paragraph (6), UMF Cluj Napoca may request the provision of additional information necessary to confirm the identity of the data subject.

Applications can be sent as follows: By submitting them in physical format to the DPO’s correspondence address (the data can be found in the DPO contact details section) or scanned, by e-mail, to the e-mail address: gdpr@umfcluj.ro.

The response to the request made by the data subject shall be in writing and shall include at least the following information:

• the identity and contact details of the operator;
• the purposes for which the personal data are processed, as well as the legal basis for the processing;
• the categories of personal data processed;
• the recipients or categories of recipients of personal data, if any;
• where possible, the period for which personal data are expected to be stored or, if this is not possible, the criteria used to determine this period;
• source of data collection and data subject’s rights regarding: rectification, deletion, restriction, opposition and the possibility to lodge a complaint with ANSPDCP. (in case of request regarding access to personal data);
• information on the reasons for rejecting the application (if applicable);
• measures taken under Articles 15-22 and 34 of the GDPR to resolve the request (depending on the subject of the request: rectification, deletion, restriction, data porting, etc.)

The answer will be sent as follows:

• In physical format at the correspondence address of the data subject, mentioned in the application;
• Scanned by e-mail to the e-mail address specified by the data subject.

The period within which the Data Protection Officer will provide the data subject with any information referred to in Articles 13 and 14 of the GDPR and any communications under Articles 15-22 and 34 of the GDPR is 30 working days.

This period may be extended by two months where necessary, taking into account the complexity and number of applications.

UMF Cluj Napoca informs the data subject about any such extension, within one month of receiving the request, also presenting the reasons for the delay.

If it does not take action on the request of the data subject, UMF Cluj Napoca shall inform the data subject, without delay and within a maximum of one month of receipt of the request, of the reasons for not taking action and the possibility of filing a complaint. before a supervisory authority and to bring a judicial appeal.DPO contact details.

Your rights as a data subject

• Right of access to the personal data processed: you have the right to obtain confirmation that your personal data is being processed or not, and if so, you have access to the type of personal data and the conditions of their processing, by making a request to that effect to the operator;
• The right to request the rectification or deletion of personal data: you may request, by sending a request to the controller, the rectification of personal data that are inaccurate, the addition of personal data in the event that they are incomplete or deletion of your personal data in situations where: (i) personal data are no longer necessary for their original purpose (and there is no new legal purpose for processing), (ii) the legal basis for the processing is the consent of the data subject, and the data subject withdraws his or her consent, and there is no other legal basis for the processing, (iii) the data subject exercises his right of opposition and the controller has no reason to continue the prevailing processing, (iv) personal data has been processed unlawfully, (v) the deletion is necessary to comply with EU or Romanian law, or (vi) personal data have been collected in connection with the provision of information society services to children (if applicable), for which consent is governed by special rules;
• Right to request restriction of processing: You have the right to obtain restriction of processing in situations where: (i) you consider that inaccurate personal data is being processed for a period that allows the controller to verify the accuracy of your personal data; (ii) the processing is illegal, but you do not want to delete your personal data, requesting only the restriction of their use; (iii) if the controller no longer needs your personal data for processing for the purposes mentioned above, but you request the data to establish, exercise or defend a right in court, or (iv) you have objected to the processing, for the period during which it is verified whether the legitimate grounds of the controller prevail over the rights of the data subject;
• The right to withdraw your consent for processing, when the processing is based on your consent, without affecting the lawfulness of the processing performed until the time of withdrawal of consent;
• The right to object to the processing of personal data for reasons related to your particular situation, when the processing is based on a legitimate interest and to oppose at any time the processing of personal data for direct marketing purposes, including profiling;The right not to be the subject of a decision based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly affects him to a significant extent;
• The right to data portability, ie the right to receive your personal data, which you have provided to the controller in a structured, commonly used and automatically readable format and the right to transmit this data to a another operator, if the processing is done on the basis of your consent or the execution of a contract and is carried out by automatic means;
• The right to file a complaint with the National Authority for the Supervision of Personal Data Processing (ANSPDCP) and the right to address you to the competent courts.

All these rights can be exercised by a written request, signed and dated, sent to our headquarters or to the email address: gdpr@umfcluj.ro.

Requests will be sent to the personal data controller, by e-mail or to the mailing address, as set out below:

Name: Andreieș Ovidiu;

Correspondence address: Victor Babeș Street, no. 8

Phone number: 0740086400

Email address: ovidiu.andreies@umfcluj.ro; gdpr@umfcluj.ro

The aim is to identify all the actions related to the process / activity and to establish them on the compartments which have the responsibilities regarding the processing of personal data, as the case may be, the responsibilities towards them, by nominating the personnel involved in the procedural activity of personal data processing.

Issuing recommendations regarding the inclusion of the actions in the logical order of their development and of the compartments or managers, in the order of the intervention in the procedural activity of the personnel involved in the processing of personal data.

Issuance of agreements regarding the information of the persons concerned by the processing of personal data in support of the departments that have actions regarding the processing of personal data, according to art. 6 of Regulation 679/2016.

Formulation of answers on the requests of the persons concerned by regulation 679/2016.