Page 1

Authorized person and instructions of the authorized person according to the new legislation
Legal regulation valid and effective until 24.05.2018, ie Act no. 122/2013 Coll. on the protection of personal data
and on the amendment of certain laws as amended by Act no. 84/2014 Coll. (hereinafter referred to as "Act No. 122/2013 Coll.")
contains a legal definition of the term entitled person. According to § 4 par. 2 letter e) of Act no. 122/2013 Coll. justified
the person can be both an employee and an external person who is in a non-employment relationship
with the controller, but must be a natural person who comes into contact with personal data and has been instructed
on rights, obligations as well as responsibilities according to Act no. 122/2013 Coll.
New legislation on personal data protection, which will apply from 25.05.2018, ie the Regulation
(EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to processing
personal data and on the free movement of such data, repealing Directive 95/46 / EC (General Regulation
on data protection) and Act no. 18/2018 Coll. on Personal Data Protection and on Amendments to Certain Acts
(hereinafter referred to as “GDPR” and “Act No. 18/2018 Coll.”) does not recognize the obligation to instruct authorized persons. In Art. 29 resp. § 36
Act no. 18/2018 Coll. the operator is required to ensure that any person (eg employees) acting
on the basis of the authorization of the operator or intermediary (the authorization can be considered e.g.
employment contract, service contract, agreement, power of attorney or similar document) which has
access to personal data, process such data only on the instructions of the controller, except in cases where
it is required of it according to a special regulation (eg EU regulation, laws of the Slovak Republic, etc.) or international
the agreement by which the Slovak Republic is bound. If these instructions result from a special regulation or
international agreement by which the Slovak Republic is bound, the operator is not obliged to give to such a person
further instructions.
The operator is obliged to accept in order to ensure compliance with the above instructions
measures pursuant to Art. 32 par. 4 GDPR resp. § 39 par. 4 of Act no. 18/2018 Coll.
If the operator currently has instructed authorized persons in accordance with § 21 of Act no. 122/2013 Z.
z., such instructions can be considered as instructions of the operator if they take into account the actual situation
and set personal data protection processes as imposed by GDPR resp. Act no. 18/2018 Coll. Listed
means that the operator should take into account the results of the risk analysis, ie e.g. or the analysis does not indicate that it has occurred
new rules on the processing of personal data to date or changes in security measures in connection with
with the processing of personal data so far, and thus whether the current instructions are really instructions from the controller, which
reflect current safety standards.
The operator should also reassess whether the current instructions are not formulated and linked to
information systems according to legal bases in accordance with Act no. 122/2013 Coll., Which do not reflect the current ones
and, where appropriate, new purposes for the processing of personal data according to the legal basis within the meaning of Art. 6 GDPR, if applicable
in conjunction with Art. 9 GDPR resp. according to § 13 of Act no. 18/2018 Coll. in connection with § 16 of Act no. 18/2018 Coll.
The operator should practically review all existing lessons in the light of the above
and see if they need to be updated. If an update is needed, it should already follow the provisions
new legislation, and would therefore be instructions from the operator, which may be included, for example, in internal
regulations of the operator and should be as address as possible. If the operator finds that the update is not
necessary, it is not necessary to convert the instructions into instructions for a formal reason only, as the content would continue
take into account the actual state and set processes. It is sufficient if the results of such a review are marked
for example, in the safety documentation, which also states that the instructions so far are to be understood as guidelines
in accordance with the new legislation in the field of personal data protection.
In conclusion, we draw attention to the fact that the operator and the intermediary are according to Art. 90 GDPR in conjunction with
§ 79 par. 2 of Act no. 18/2018 Coll. obliged to keep confidential the personal data of natural persons who come
into contact with personal data with the operator or intermediary. However, the institute of secrecy fulfills a different one
function as the operator's instruction itself pursuant to Art. 29 GDPR resp. § 36 of Act no. 18/2018 Coll. Ide
o a security measure by which both the operator and the intermediary are obliged to maintain confidentiality
about the personal data they process. Such an obligation is both the operator and the intermediary
must also bind natural persons who come into contact with personal data with the controller; or
intermediary. This means that in addition to the instruction under Art. 29 GDPR resp. § 36 of Act no. 18/2018 Coll.

Page 2

there is also an obligation to bind natural persons who come into contact with personal data with the controller; or
mediator by secrecy.
Fulfillment of obligations under Art. 29 GDPR resp. § 36 of Act no. 18/2018 Coll. and according to § 79 of Act no. 18/2018
Z. z. it may also be contained in a single document, as has been the case in the past
effectiveness of Act no. 122/2013 Coll.
In the light of the above, the above can be summarized as follows:
The operator is obliged to fulfill the obligations under Art. 29 GDPR resp. § 36 of Act no. 18/2018 Coll. and according to § 79
Act no. 18/2018 Coll., And therefore
• if the current instruction according to § 21 of Act no. 122/2013 Coll. reflects the obligations under the first sentence,
new instructions and confidentiality do not need to be drawn up by the operator,
• If the current instruction according to § 21 of Act no. 122/2013 Coll. does not reflect the obligations under the first sentence,
it is necessary (current lessons) to update - e.g. in the form of amendments or redrafted.

