2024-04-23-世界卫生组织-WHO_Personal_Data_Protection_Policy_16页_388kb

报告摘要

WHO Personal Data Protection Policy Summary

This policy establishes the rules for processing personal data within the World Health Organization (WHO).

Key Aspects:

Scope: Applies to all personal data of living individuals held by WHO, regardless of location or sharing with third parties. Excludes anonymized data.
Definitions: Provides clarity on terms like Personal Data, Sensitive Personal Data, Automated Processing, Consent (Clear vs Explicit), Data Controller, and Data Processor.
General Principles: Outlines fundamental data protection principles including:
- Fair and legitimate processing
- Transparency and information disclosure
- Purpose specification and limitation
- Proportionality (Data minimization)
- Accuracy
- Confidentiality
- Time limitation for storage
- Security measures
- Data breach management
- Accountability
Sensitive Personal Data: Requires special measures due to their heightened sensitivity (e.g., racial/ethnic origin, genetic data, health data). Additional legitimate bases for processing are stipulated.
Research Data: Provides exceptions to some policy requirements for purely scientific research purposes, subject to limitations and safeguards.
Data Subject Rights: Individuals have rights regarding their personal data, including:
- Right to information
- Right of access
- Right to rectification
- Right to deletion/limitation of processing
- Right to object
- Right not to be subject to purely automated decisions (unless necessary for contracts or explicit consent).
Data Protection and Privacy Officer (DPPO): Designated, independent role responsible for policy implementation, providing advice, monitoring compliance, handling subject requests, and coordinating breach responses.
Third Party Transfers: Data can be transferred provided third parties implement robust safeguards and enter into specific agreements, unless WHO acts as a Data Processor or requires urgent action for vital interests.
Entry into Force and Review: Policy becomes effective upon signing by the WHO Director-General. It will be reviewed every two years initially and subsequently.