further use; the nature of the personal data; the consequences of the intended further processing for data
subjects; and the existence of appropriate safeguards in both the original and intended further processing
operations.
Where the data subject has given consent or the processing is based on Union or Member State law which
constitutes a necessary and proportionate measure in a democratic society to safeguard, in particular, important
objectives of general public interest, the controller should be allowed to further process the personal data
irrespective of the compatibility of the purposes. In any case, the application of the principles set out in this
Regulation and in particular the information of the data subject on those other purposes and on his or her rights
including the right to object, should be ensured. Indicating possible criminal acts or threats to public security by
the controller and transmitting the relevant personal data in individual cases or in several cases relating to the
same criminal act or threats to public security to a competent authority should be regarded as being in the
legitimate interest pursued by the controller. However, such transmission in the legitimate interest of the
controller or further processing of personal data should be prohibited if the processing is not compatible with a
legal, professional or other binding obligation of secrecy.
(51) Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms
merit specific protection as the context of their processing could create significant risks to the fundamental rights
and freedoms. Those personal data should include personal data revealing racial or ethnic origin, whereby the use
of the term ‘racial origin’ in this Regulation does not imply an acceptance by the Union of theories which
attempt to determine the existence of separate human races. The processing of photographs should not systemati-
cally be considered to be processing of special categories of personal data as they are covered by the definition of
biometric data only when processed through a specific technical means allowing the unique identification or
authentication of a natural person. Such personal data should not be processed, unless processing is allowed in
specific cases set out in this Regulation, taking into account that Member States law may lay down specific
provisions on data protection in order to adapt the application of the rules of this Regulation for compliance
with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of
official authority vested in the controller. In addition to the specific requirements for such processing, the general
principles and other rules of this Regulation should apply, in particular as regards the conditions for lawful
processing. Derogations from the general prohibition for processing such special categories of personal data
should be explicitly provided, inter alia, where the data subject gives his or her explicit consent or in respect of
specific needs in particular where the processing is carried out in the course of legitimate activities by certain
associations or foundations the purpose of which is to permit the exercise of fundamental freedoms.
(52) Derogating from the prohibition on processing special categories of personal data should also be allowed when
provided for in Union or Member State law and subject to suitable safeguards, so as to protect personal data and
other fundamental rights, where it is in the public interest to do so, in particular processing personal data in the
field of employment law, social protection law including pensions and for health security, monitoring and alert
purposes, the prevention or control of communicable diseases and other serious threats to health. Such a
derogation may be made for health purposes, including public health and the management of health-care
services, especially in order to ensure the quality and cost-effectiveness of the procedures used for settling claims
for benefits and services in the health insurance system, or for archiving purposes in the public interest, scientific
or historical research purposes or statistical purposes. A derogation should also allow the processing of such
personal data where necessary for the establishment, exercise or defence of legal claims, whether in court
proceedings or in an administrative or out-of-court procedure.
(53) Special categories of personal data which merit higher protection should be processed for health-related purposes
only where necessary to achieve those purposes for the benefit of natural persons and society as a whole, in
particular in the context of the management of health or social care services and systems, including processing
by the management and central national health authorities of such data for the purpose of quality control,
management information and the general national and local supervision of the health or social care system, and
ensuring continuity of health or social care and cross-border healthcare or health security, monitoring and alert
purposes, or for archiving purposes in the public interest, scientific or historical research purposes or statistical
purposes, based on Union or Member State law which has to meet an objective of public interest, as well as for
studies conducted in the public interest in the area of public health. Therefore, this Regulation should provide for
harmonised conditions for the processing of special categories of personal data concerning health, in respect of
specific needs, in particular where the processing of such data is carried out for certain health-related purposes
Comments