The Bank has
implemented processes aimed
to efficiently respond
to exercising of
rights requests and
to
manage potential personal data security breaches.
A Data
Protection Officer
(DPO) has
been appointed
since the
application of
GDPR and
a structure
has
been established
within the
Bank –
the Data
Protection Cell
(DPO), monitoring
the compliance
of Bank’s
processes, services, products,
operations from the
perspective of data
protection at central
level, in close
cooperation with Legal and Compliance departments. Beside the DPO, at Bank level have been appointed
Data
Protection
Correspondents
within
central
structures.
Data
Protection
Correspondents
ensure
the
operational
tasks
of
the
activity
carried
out
by
the
DPO,
including
the
following:
providing
necessary
information
to keep
the Processing
Register
up to
date,
support for
preparing responses
to requests
for
exercise
of
rights
received
from
data
subjects,
providing
advice
and
support
to
business
departments
regarding the assessment of the
impact on data protection, support
for the analysis and documentation
of
security breaches, involvement of DPO
in all activities that require
this thing. For local affiliates,
even they
have
appointed
their
own
PDPO
or
not
(for
the
latter
case
being
nominalized
only
a
Data
Protection
Correspondent
with
the
above
responsibilities),
the
activity
is
closely
monitored
and
Group's
rules
and
principles are applicable.
Also,
at
Bank's
level
is
developed
a
GDPR
Program,
monitored
quarterly
by
BRD's
Top
Management
through a dedicated Steering
Committee, program within
which are assured
the implementation of
GDPR
requirements, improvement of
different data protection aspects,
and the management
of certain transversal
projects involving GDPR aspects.
The Bank has taken
measures to continuously improve the
security of its applications in
order to keep pace
with technological
developments. Moreover,
the selection
process of
services/goods providers
that could
have access to Bank’s data considers only the third parties that have implemented adequate technical and
organizational measures to keep Bank’s data secure. Also,
in situations where the suppliers with whom
the
Bank
enters
into
contracts
act
as
'data
processors'
according
to
GDPR,
they
are
obligated
to
act
in
accordance with BRD's instructions and comply with BRD's
data protection policies and rules.
The technical
and organizational
measures
implemented
by the
Bank to
ensure
compliance with
GDPR
requirements include the following:
●
Information notices made available to clients, candidates,
suppliers, free of charge, both in
branches and/or published on the Bank’s website
●
Information notice made available to BRD staff on
the Bank's Intranet.
o
Note: Updates/Modifications of Information Notices are
communicated to the data
subjects in accordance with the requirements/guidelines
(e.g., pop-ups on the website,
etc.).
●
Offering the possibility for data subjects to express
or withdraw the consent when the
processing is based on this legal basis and exercise their rights
through various channels (bank
units, website, email, etc.)
●
Implementation of cookies consent on Bank’s website
●
Implementation of an incident management flow for data
security breaches, including notifying
ANSPDCP and the data subjects, if applicable
●
Encryption of data at rest and in transit
●
Developing a comprehensive training program including on
-line and e-learning for all employees
●
Ensuring data protection by design and by default, including
performance of privacy impact
analysis for sensitive processing and minimization of data
●
Granting access to data to employees based on need
to know basis
●
Periodic revision of access rights mentioned above
●
Performance of penetration tests in order to timely detect
vulnerabilities of exposed applications
●
Implementation of a normative framework aimed to the protection
of personal data
●
Keeping records of processing activities
●
Set up of structure within the Bank - the Data
Protection Cell in order to monitor compliance with
regulation, inform
and advise
on the obligations
arising under the
Regulation, manage
requests
from the ANSPDCP (investigations, inquiries, requests for additional information, PIAs, etc.), and
the relationship with it, evaluate the contractual documentation applicable both in relation to data