Learning And Blog

 by persons subject to a legal obligation of professional secrecy. Union or Member State law should provide for  specific and suitable measures so as to protect the fundamental rights and the personal data of natural persons.  Member States should be allowed to maintain or introduce further conditions, including limitations, with regard  to the processing of genetic data, biometric data or data concerning health. However, this should not hamper the  free flow of personal data within the Union when those conditions apply to cross-border processing of such data.  (54) The processing of special categories of personal data may be necessary for reasons of public interest in the areas  of public health without consent of the data subject. Such processing should be subject to suitable and specific  measures so as to protect the rights and freedoms of natural persons. In that context, ‘public health’ should be  interpreted as defined in Regulation (E...

 further use; the nature of the personal data; the consequences of the intended further processing for data  subjects; and the existence of appropriate safeguards in both the original and intended further processing  operations.  Where the data subject has given consent or the processing is based on Union or Member State law which  constitutes a necessary and proportionate measure in a democratic society to safeguard, in particular, important  objectives of general public interest, the controller should be allowed to further process the personal data  irrespective of the compatibility of the purposes. In any case, the application of the principles set out in this  Regulation and in particular the information of the data subject on those other purposes and on his or her rights  including the right to object, should be ensured. Indicating possible criminal acts or threats to public security by  the controller and transmitting the relevant ...

 based on the vital interest of another natural person should in principle take place only where the processing  cannot be manifestly based on another legal basis. Some types of processing may serve both important grounds  of public interest and the vital interests of the data subject as for instance when processing is necessary for  humanitarian purposes, including for monitoring epidemics and their spread or in situations of humanitarian  emergencies, in particular in situations of natural and man-made disasters.  (47) The legitimate interests of a controller, including those of a controller to which the personal data may be  disclosed, or of a third party, may provide a legal basis for processing, provided that the interests or the  fundamental rights and freedoms of the data subject are not overriding, taking into consideration the reasonable  expectations of data subjects based on their relationship with the controller. Such legitimate i...

 Member State law as referred to in this Regulation, including the necessity for compliance with the legal  obligation to which the controller is subject or the necessity for the performance of a contract to which the data  subject is party or in order to take steps at the request of the data subject prior to entering into a contract.  (41) Where this Regulation refers to a legal basis or a legislative measure, this does not necessarily require a legislative  act adopted by a parliament, without prejudice to requirements pursuant to the constitutional order of the  Member State concerned. However, such a legal basis or legislative measure should be clear and precise and its  application should be foreseeable to persons subject to it, in accordance with the case-law of the Court of Justice  of the European Union (the ‘Court of Justice’) and the European Court of Human Rights.  (42) Where processing is based on the data subject's consent, the c...

 the main establishment. The main establishment of a controller in the Union should be determined according to  objective criteria and should imply the effective and real exercise of management activities determining the main  decisions as to the purposes and means of processing through stable arrangements. That criterion should not  depend on whether the processing of personal data is carried out at that location. The presence and use of  technical means and technologies for processing personal data or processing activities do not, in themselves,  constitute a main establishment and are therefore not determining criteria for a main establishment. The main  establishment of the processor should be the place of its central administration in the Union or, if it has no  central administration in the Union, the place where the main processing activities take place in the Union. In  cases involving both the controller and the processor, the compet...

 Natural persons may be associated with online identifiers provided by their devices, applications, tools and  protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency  identification tags. This may leave traces which, in particular when combined with unique identifiers and other  information received by the servers, may be used to create profiles of the natural persons and identify them.  (31) Public authorities to which personal data are disclosed in accordance with a legal obligation for the exercise of  their official mission, such as tax and customs authorities, financial investigation units, independent adminis- trative authorities, or financial market authorities responsible for the regulation and supervision of securities  markets should not be regarded as recipients if they receive personal data which are necessary to carry out a  particular inquiry in the general interest, in accorda...