by persons subject to a legal obligation of professional secrecy. Union or Member State law should provide for
specific and suitable measures so as to protect the fundamental rights and the personal data of natural persons.
Member States should be allowed to maintain or introduce further conditions, including limitations, with regard
to the processing of genetic data, biometric data or data concerning health. However, this should not hamper the
free flow of personal data within the Union when those conditions apply to cross-border processing of such data.
(54) The processing of special categories of personal data may be necessary for reasons of public interest in the areas
of public health without consent of the data subject. Such processing should be subject to suitable and specific
measures so as to protect the rights and freedoms of natural persons. In that context, ‘public health’ should be
interpreted as defined in Regulation (EC) No 1338/2008 of the European Parliament and of the Council (
1
),
namely all elements related to health, namely health status, including morbidity and disability, the determinants
having an effect on that health status, health care needs, resources allocated to health care, the provision of, and
universal access to, health care as well as health care expenditure and financing, and the causes of mortality. Such
processing of data concerning health for reasons of public interest should not result in personal data being
processed for other purposes by third parties such as employers or insurance and banking companies.
(55) Moreover, the processing of personal data by official authorities for the purpose of achieving the aims, laid down
by constitutional law or by international public law, of officially recognised religious associations, is carried out
on grounds of public interest.
(56) Where in the course of electoral activities, the operation of the democratic system in a Member State requires
that political parties compile personal data on people's political opinions, the processing of such data may be
permitted for reasons of public interest, provided that appropriate safeguards are established.
(57) If the personal data processed by a controller do not permit the controller to identify a natural person, the data
controller should not be obliged to acquire additional information in order to identify the data subject for the
sole purpose of complying with any provision of this Regulation. However, the controller should not refuse to
take additional information provided by the data subject in order to support the exercise of his or her rights.
Identification should include the digital identification of a data subject, for example through authentication
mechanism such as the same credentials, used by the data subject to log-in to the on-line service offered by the
data controller.
(58) The principle of transparency requires that any information addressed to the public or to the data subject be
concise, easily accessible and easy to understand, and that clear and plain language and, additionally, where
appropriate, visualisation be used. Such information could be provided in electronic form, for example, when
addressed to the public, through a website. This is of particular relevance in situations where the proliferation of
actors and the technological complexity of practice make it difficult for the data subject to know and understand
whether, by whom and for what purpose personal data relating to him or her are being collected, such as in the
case of online advertising. Given that children merit specific protection, any information and communication,
where processing is addressed to a child, should be in such a clear and plain language that the child can easily
understand.
(59) Modalities should be provided for facilitating the exercise of the data subject's rights under this Regulation,
including mechanisms to request and, if applicable, obtain, free of charge, in particular, access to and rectification
or erasure of personal data and the exercise of the right to object. The controller should also provide means for
requests to be made electronically, especially where personal data are processed by electronic means. The
controller should be obliged to respond to requests from the data subject without undue delay and at the latest
within one month and to give reasons where the controller does not intend to comply with any such requests.
4.5.2016 EN Official Journal of the European Union L 119/11
(
1
) Regulation (EC) No 1338/2008 of the European Parliament and of the Council of 16 December 2008 on Community statistics on public
health and health and safety at work (OJ L 354, 31.12.2008, p. 70).
Comments