GDPR Data Processing Record Obligation And Its Enlightenment

The GDPR data processing record obligation stems from the “Personal Protection Related to the Processing of Personal Data and the Free Circulation of Such Data and Directive 95/46 / EC /” adopted by the European Union in 1995,since the Directive does not record data processing obligations Separately listed as an independent obligation,but included in the “duty of reporting to regulatory authorities” as provided in Article 18,paragraph 2(b);Subsequently,Article 5 of the "Privacy and Electronic Communications Directive" issued in 2002 "Confidentiality of Communications" and Article 3 of the "EU Data Retention Directive" issued in2006 "Obligations to retain data" have gradually begun to develop separate provisions Recording of data processing activities;After years of development,Article 28“Document Management” of the “Proposal on Regulations of the European Parliament and the Council of the European Union on Regulating the Protection of Individuals in the Processing of Personal Data and the Free Circulation of the Data Involved” was promulgated in 2012 and Article 30 “Records of Processing Activities”of the “General Data Protection Regulations” promulgated in 2016 all stipulate detailed data processing records.This obligation corresponds to the right of the data subject to receive information notification and reflects the main principles of the data processing process,especially the specific implementation of the "Accountability Principle".This obligation not only helps data controllers and processors to use Logging content to assess data processing risks can also determine security measures for the data processing process.The obligation of comprehensively cognizing data processing records can be expanded from the four dimensions of obligation subject,content,exceptions and exception restrictions,and illegal punishment measures:The subjects of its obligations include data controllers,data processors and their representatives;their contents have formulated different records for data controllers and data processors,and different recorders have different focuses to protect data effectively Subject's personal privacy;The exceptions and exceptions are that companies with fewer than 250 employees can be exempted from performing data processing and recording obligations,but they need to be recorded when data processing is not accidental,when processing data of a special type or criminal conviction data;The illegal punishmentmeasures are that if the data processing and recording obligations are not fully fulfilled in accordance with the regulations,the regulatory agency will impose administrative penalties on the data controller or processor.Although China's existing laws and regulations mention that the relevant responsible parties are obliged to record the data processing process,the regulations are relatively broad and rough,and no strict data protection laws have been promulgated,which fails to curb the sale of personal customers Information and data caused serious data breaches.To this end,the GDPR data processing and recording obligation has reference significance for China to construct corresponding supporting laws and regulations for the recording of personal information and important data during the processing process,especially the division of recording obligation subjects,record content,exceptions,sanctions,etc.In order to promote the soundness of the system,raising the level of legislation is an inevitable means,and it is possible to develop a processing record template from the relevant administrative powers and guidance documents given to the regulatory agency to build a data processing record obligation that complies with China's legal soil.