12.07.2015 Views

Employee Share Plans in Europe and the USA - Sorainen

Employee Share Plans in Europe and the USA - Sorainen

Employee Share Plans in Europe and the USA - Sorainen

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

<strong>Employee</strong> <strong>Share</strong> <strong>Plans</strong> <strong>in</strong> <strong>Europe</strong> <strong>and</strong> <strong>the</strong> <strong>USA</strong>Italy196 of 30 June 2003 (<strong>the</strong> Data Protection Act) requires all process<strong>in</strong>g ofpersonal data to be authorised by <strong>the</strong> <strong>in</strong>terested persons (<strong>the</strong> so-called datasubjects), who are requested to give <strong>the</strong>ir consent. However, <strong>the</strong> data subject'sconsent is not necessary where <strong>the</strong> process<strong>in</strong>g is justified by meet<strong>in</strong>g at leastone of a series of specified conditions. If personal data is collected <strong>and</strong>processed <strong>in</strong> connection with an employee share plan, <strong>the</strong> justify<strong>in</strong>g conditionknown as "contractual necessity" (i.e. <strong>the</strong> process<strong>in</strong>g be<strong>in</strong>g necessary for <strong>the</strong>performance of a contract to which <strong>the</strong> data subject is a party or <strong>in</strong> order to takesteps at <strong>the</strong> data subject's request prior to enter<strong>in</strong>g <strong>in</strong>to such a contract) couldapply, <strong>in</strong> which case <strong>the</strong> employee's consent, should not be necessary. 2222As a general rule, any entity (<strong>the</strong> data controller) who <strong>in</strong>tends to process third parties’ personal data: (i)with<strong>in</strong> Italian territory or <strong>in</strong> a place that is under <strong>the</strong> Italian State's sovereignty, or (ii) outside <strong>the</strong> EU,<strong>and</strong> <strong>in</strong> ei<strong>the</strong>r case <strong>the</strong> entity process<strong>in</strong>g <strong>the</strong> data makes use, <strong>in</strong> connection with <strong>the</strong> process<strong>in</strong>g, ofelectronic or o<strong>the</strong>r equipment, located <strong>in</strong> Italian territory, <strong>and</strong> such equipment is not used only for <strong>the</strong>purpose of transit<strong>in</strong>g <strong>the</strong> data through <strong>the</strong> EU, must comply with <strong>the</strong> Data Protection Act.An authorisation from <strong>the</strong> Data Protection Authority is required if personal data processed <strong>in</strong>connection with an employee share plan is transferred to a non-EU country, as under <strong>the</strong> DataProtection Act <strong>in</strong>ternational transfers of data to non-EU countries must also be authorised by <strong>the</strong> DataProtection Authority unless one of <strong>the</strong> follow<strong>in</strong>g conditions is met: (a) <strong>the</strong> data subject has givenconsent, which <strong>in</strong> <strong>the</strong> case of a transfer of sensitive data must be <strong>in</strong> writ<strong>in</strong>g; (b) <strong>the</strong> transfer isnecessary <strong>in</strong> order to fulfil obligations under a contract to which <strong>the</strong> data subject is a party, or to takesteps at <strong>the</strong> data subject’s request prior to enter<strong>in</strong>g <strong>in</strong>to a contract, or to obta<strong>in</strong> pre-contractual<strong>in</strong>formation at <strong>the</strong> request of <strong>the</strong> data subject, or to conclude or execute a contract made <strong>in</strong> favour of<strong>the</strong> data subject; (c) <strong>the</strong> transfer is necessary to safeguard a public <strong>in</strong>terest identified by law; (d) <strong>the</strong>transfer is necessary for <strong>the</strong> purposes of a crim<strong>in</strong>al <strong>in</strong>vestigation or to establish or defend a legal claim,provided that it takes place only for that specific purpose <strong>and</strong> that <strong>the</strong> data are only used for <strong>the</strong> periodof time needed to achieve that purpose; (e) <strong>the</strong> transfer is necessary to safeguard <strong>the</strong> life <strong>and</strong> physicalsafety of <strong>the</strong> data subject or a third party, <strong>in</strong> circumstances where <strong>the</strong> data subject is physically orlegally unable to give consent; (f) <strong>the</strong> transfer is made pursuant to a request for access to a publicdocument or public <strong>in</strong>formation; (g) <strong>the</strong> transfer is authorised by <strong>the</strong> Data Protection Authority on <strong>the</strong>basis ei<strong>the</strong>r of guarantees of <strong>the</strong> rights of <strong>the</strong> data subject outl<strong>in</strong>ed <strong>in</strong> a contractual agreement, ordecisions by <strong>the</strong> <strong>Europe</strong>an Commission under Articles 25 <strong>and</strong> 26 of <strong>the</strong> EU Data Protection Directivethat a non-EU Member State affords an adequate level of protection or that certa<strong>in</strong> contractual clausesafford sufficient safeguards; (h) <strong>the</strong> transfer is made exclusively for scientific research or statisticalpurposes <strong>and</strong> <strong>in</strong> compliance with codes of conduct <strong>and</strong> professional practice; or (i) <strong>the</strong> process<strong>in</strong>gconcerns data relat<strong>in</strong>g to organisations (i.e. legal entities, bodies or associations).As a general rule, <strong>the</strong> data controller must provide - ei<strong>the</strong>r orally or <strong>in</strong> writ<strong>in</strong>g (<strong>the</strong> latter is advisablebecause <strong>the</strong> written consent of <strong>the</strong> data subject is required <strong>in</strong> <strong>the</strong> event that <strong>the</strong> data processed<strong>in</strong>cludes sensitive data) - <strong>the</strong> data subject with certa<strong>in</strong> <strong>in</strong>formation regard<strong>in</strong>g (a) <strong>the</strong> purposes ofprocess<strong>in</strong>g <strong>and</strong> how data will be processed. If process<strong>in</strong>g is for market<strong>in</strong>g purposes, <strong>the</strong> data subjectmust also be <strong>in</strong>formed of <strong>the</strong> right to object to such process<strong>in</strong>g; (b) whe<strong>the</strong>r provid<strong>in</strong>g <strong>the</strong> data ism<strong>and</strong>atory or optional; (c) <strong>the</strong> consequences if <strong>the</strong> data subject fails to reply; (d) <strong>the</strong> recipients orcategories of recipients to whom data may be disclosed (<strong>the</strong> Disclosed Entities), or who may haveknowledge of <strong>the</strong> data <strong>in</strong> <strong>the</strong>ir capacity of data processors or persons <strong>in</strong> charge of process<strong>in</strong>g, <strong>in</strong> <strong>the</strong>scope of dissem<strong>in</strong>ation of <strong>the</strong> data; (e) <strong>the</strong> data subject's access <strong>and</strong> amendment rights; <strong>and</strong> (f) <strong>the</strong>UK/1729295/03 122 September 2010

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!