Registration Of E-Shops At The Office For Personal Data Protection. When Yes, When Not?

The operation of an e-shop requires more than just the legal form for the owners to cover their business. However, sales through e-shops are still in their infancy, and the constant legislative changes are directly proportional to this. One of the last, concerning registration with the Office for Personal Data Protection, is valid only from the second half of July. It brings some facilitation, but it does not radically reduce red tape in practice.

Duties are gradually being phased out

By creating an e-shop according to the law, you make an Information System (IS), which can process, summarize and archive personal data, and thus comes under the provisions of the Personal Data Protection Act. The former obligation to automatically register each e-shop on the Office for Personal Data Protection website has disappeared from the responsibilities that await the operator of the online store.

The bureaucratic loop by which officials wanted to tie up free enterprise on the Internet was slowly being released. Initially, the possibility of registration was made available free of charge, which was once an absurd 20 euros. Today, it is no longer necessary to notify or register every e-shop.

This obligation ended with the regular e-shop on July. The change is related to the fact that according to the new rules, the merchant no longer has to require customers to consent to the processing of personal data when ordering goods or services in the online store. This is a standard contract, even if it is concluded at a distance.

Just keep records

The e-shop operator is not obliged to notify the IS e-shop to the Office. Under the law, he can manage the data necessary for the performance of the contract in which the affected person acts as one of the contracting parties without the permission of the person concerned. This is the classic form of a contract between the seller and the buyer.

Although the Office no longer requires registration, there is still some remnant of the obligation. And it is keeping essential records to the extent provided by law. This means filling in the Records of the personal data information system. However, it is interesting that this form must be filled in, but it is not sent anywhere, either by e-mail or regular mail.

When does nothing need to be sent to the Office?

The Office for Personal Data Protection says that the e-shop operator does not send the completed   Records of the personal data information system to the Office but keeps it with them. The operator is obliged to keep this record in the scope of data according to § 35 par—1 of the Personal Data Protection Act.

These are, for example, cases where it processes personal data based on special laws or entrusts the responsible person or several responsible persons with the performance of personal data protection supervision. The records themselves probably have no significance, and the control of such an obligation would be complicated so that this regulation may fall out of the law in time. Still, today it is required that the requirements of the legislation be met.

If you do marketing, you need to register.

However, the obligation to register and replace records only applies to stores that do not send a newsletter or collect data for other marketing activities. However, practically every e-shop needs this to survive today. Therefore, a slight adjustment of the conditions concerns only a minimum of operations.

In the case of marketing activities, registration with the Office for Personal Data Protection is still required, but this time in the category of marketing information systems. It is about sending information such as advertising e-mails, newsletters, news, events, and the like.

When marketing an e-shop, it is necessary to obtain the consent of the person concerned when collecting and processing data for these purposes. If the e-shop operator does not have an authorized person, the IS marketing of the given e-shop is obliged to notify the Office.

The Office for Personal Data Protection does not send any confirmation of registration. You can then find your registered e-shop directly on its website, where it currently publishes notification statuses. Of course, the e-shop operator can start processing customers’ data from the date of notification of the information system (IS marketing) to the Office or from the date of preparation of the record sheet for these information systems.

SUMMARY of duties in a nutshell

If the e-shop is only a separate sales channel, only the registration form is used, and the Office for Personal Data Protection does not send anything.

If the data is also used for marketing/newsletter sending/consumer competition of the given e-shop and if the e-shop operator does not have an authorized person responsible, the notification registers with the given facts and sends information to the Office.

If the e-shop operator has an authorized person in charge, the IS marketing / IS newsletter / IS consumer competition record sheet of the given e-shop is not sent to the Office.

Also Read : How To Set Up Marketing And Manage The Crisis To Survive?