Logistics is a field of knowledge that, by utilizing modern methods of organization and management supported by IT systems, enables the shaping of optimal supply chains from the moment of raw material acquisition, through their processing and distribution at various stages of trade, to the final buyer. This field allows for the shaping of optimal supply chains. The high level of competition in the market requires high operational efficiency and professionalism in customer service, regardless of which link in the chain it is. Achieving a high standard of customer service is not possible without the efficient flow of information and documents. Active companies implement customer-oriented activities that allow for achieving a competitive advantage. Applying such an approach in business cannot be efficiently and effectively implemented without creating data sets, which often contain personal data of potential clients or individuals designated for business contacts in specific matters. The processing of personal data in Poland is regulated by specific legal conditions, which include:
1. The Act of August 29, 1997, on the Protection of Personal Data (Journal of Laws No. 133 of 1997, item 883, as amended),
2. The Regulation of the Minister of Internal Affairs and Administration of April 29, 2004, on the documentation of personal data processing and the technical and organizational conditions that devices and IT systems used for processing personal data should meet,
3. The Regulation of the Minister of Internal Affairs and Administration of December 11, 2008, on the template for notifying a data set for registration to the Inspector General for Personal Data Protection.
The requirements resulting from the aforementioned legal acts are by no means simple for business entities to meet. Especially since they refer to sets processed both in IT systems and in files, indexes, books, lists, etc. registration sets. The interpretation of basic terms resulting from the Act (1) already causes many doubts and problems for personal data administrators.
The Act (1) specifies which sets containing personal data:
-
are subject to the obligation of registration with the Inspector General for Personal Data Protection (GIODO)
-
are not subject to registration
as well as which data administrators are exempt from the obligation to register processed data sets. The template for notifying a personal data set for registration to GIODO is defined by Regulation (3). However, the correct classification of a data set certainly also causes administrators a lot of problems.
In the era of widespread computerization and the popularization of communication via the Internet, administrators processing personal data must deal with the requirements resulting from Regulation (2), which is not so simple. According to this Regulation, administrators are obliged to have documentation describing the method of processing and the technical and organizational measures ensuring the protection of personal data appropriate to the risks and their categories, maintained in written form. This documentation consists of:
-
security policy
-
instruction for managing the IT system used for processing personal data.
The article comes from the magazine “Logistyka” 4/2009.