欧盟
The lawful basis to process personal data identified in Section 3 are regulated in the following provisions of the GDPR:
- Application of pre-contractual measures at data subjects' request: article 6.1(b) of GDPR
- Legal obligation: article 6.1(c) of GDPR
- Consent: article 6.1(a) of GDPR
- Legitimate interest (of Grifols and/or any third party): article 6.1(f) of GDPR
The processing of special categories of personal data is covered by your explicit consent (article 9.2(a) of the GDPR), the fulfilment of obligations and the exercise of specific rights in the field of employment, social security and social protection law (article 9.2(b) of the GDPR) or the processing is necessary for the assessment of the working capacity of the employee (article 9.2 (h) of the GDPR).
The processing of personal data related to criminal convictions and offences is permitted only under the control of official authority or covered by the fulfilment of legal obligations (article 10 of the GDPR).
The legal obligation referred to in Section 3 with respect to the performance of criminal background checks by Grifols is regulated in the following laws and in any other laws that develop, complement and/or replace them:
- Regulation (EC) No 300/2008 of the European Parliament and of the Council of 11 March 2008 on common rules in the field of civil aviation security and repealing Regulation (EC) No 2320/2002.
- Regulation (EU) 2015/1998 of 5 November 2015 laying down detailed measures for the implementation of the common basic standards on aviation security.
法国
如果 Grifols FranceS.A.R.L. 为数据控制者,数据主体有权就其身故后的数据管理提供指导。
德国
In Germany, any processing of a candidate’s personal data necessary for the decision about establishing an employment relationship with that respective candidate may be based on Sec. 26 Par. 1 S. 1 of the Federal Data Protection Act in addition to Art. 6.1(b) of the GDPR.
According to Sec. 26 Par. 3 S. 1 of the Federal Data Protection Act, this legal basis also covers the processing of sensitive data normally prohibited under Art. 9.1 GDPR.
Furthermore, there are additional German provisions on data subject rights (cf. Secs. 32 to 37 of the Federal Data Protection Act).
葡萄牙
如果 Grifols Portugal – Produtos Farmacêuticos e Hospitalares,Lda. 为数据控制者,数据主体有权就其身故后的数据管理提供指导。如果已故数据主体生前未就其数据管理提供指导,则可由其继承人行使第 6 节所界定的数据保护权利。数据主体还可决定在其身故后不能行使这些权利。
如果存在保密的法律义务,将不能行使数据主体的权利。
西班牙
The legal obligation referred to in Section 3 with respect to the performance of criminal background checks by Grifols is regulated in Law 21/2003 of 7 July 2003 on Aviation Safety and in any other laws that develop, complement and/or replace it.
泰国
如果 Grifols (Thailand) Ltd. 为数据控制者,请参阅此处的完整隐私声明。
英国
本文件中所有的GDPR引用在适用时也指GDPR,因为它是英格兰和威尔士、苏格兰和北爱尔兰法律的一部分。
Grifols UK Ltd. will usually undertake DBS checks on personnel involved in the supply of services to UK hospitals in order to meet its contractual obligations to hospitals in the UK to comply with NHS and regulatory requirements in relation to background checks on staff. Where we undertake DBS checks: (a) we consider that we have a legitimate interest in doing so in accordance with Article 6.1(f) of the UK GDPR, and (b) we may share the results of the DBS check with the UK hospitals to which our services are being provided and with which we have a contract, and to Grifols, S.A.
美国
When Grifols Shared Services North America, Inc. on behalf of itself and its affiliated companies under common ownership and control, is the data controller, see the California Personnel Privacy Policy here.