Some correlations between the principles relating to personal data processing and the records of processing activities

• Author: Silviu-Dorin Schiopu
• Position: Transilvania University of Brasov
• Pages: 431-436

Bulletin of the Transilvania University of Braşov

Series VII: Social Sciences • Law • Vol. 12 (61) No. 2 – 2019

https://doi.org/10.31926/but.scl.2019.61.12.2.26

SOME CORRELATIONS BETWEEN THE PRINCIPLES

RELATING TO PERSONAL DATA PROCESSING AND

THE RECORDS OF PROCESSING ACTIVITIES

Silviu-Dorin ȘCHIOPU 1

Abstract: In this short paper we intend to examine how the records of

processing activities can facilitate the operator's obligation to demonstrate

compliance with the principles relating to the processing of personal data

and we will argue that the record of processing activities is an instrument

that can support the analysis of the implications of any processing and the

controller should keep extended records of processing activities in order to

also demonstrate at least in part the compliance with the principles set out

in article 5 of the General Data Protection Regulation (GDPR).

Key words: GDPR, personal data, principles relating to processing, records

of processing activities, compliance, accountability.

1. The accountability principle

Recital (74) of the General Data Protection Regulation (GDPR) provides that “the

controller should […] be able to demonstrate the compliance of processing activities

with this Regulation […]”. On this line, usually any processing should comply with the

principles relating to the processing of personal data set out in article 5 GDPR and the

controller should be able to demonstrate such compliance under the principle o f

accountability. Furthermore, according to article 85 paragraph (5) letter a) GDPR, the

infringement of the basic principles for processing may result in administrative fines up

to 20.000.000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide

annual turnover of the preceding financial year, whichever is higher.

In order to demonstrate compliance with the GDPR, recital (82) states that the

controller “should maintain records of processing activities under its responsibility” and

article 30 paragraph (4) GDPR provides that the controller will make the record available

to the supervisory authority on request. Thus, under the principle of accounta bility, the

controllers are required to actively demonstrate compliance and not merely wait for

data subjects or supervisory authorities to point out the shortcomings (European Union

Agency for Fundamental Rights, Council of Europe, 201 8, p. 138).

The proper identification of all data processing operations and the maintenance of an

1 Transilvania University of Braşov, silviu-dorin.schiopu@unitbv.ro