Learning And Blog

 The principles of fair and transparent processing require that the data subject be informed of the existence of the  processing operation and its purposes. The controller should provide the data subject with any further  information necessary to ensure fair and transparent processing taking into account the specific circumstances  and context in which the personal data are processed. Furthermore, the data subject should be informed of the  existence of profiling and the consequences of such profiling. Where the personal data are collected from the  data subject, the data subject should also be informed whether he or she is obliged to provide the personal data  and of the consequences, where he or she does not provide such data. That information may be provided in  combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner, a  meaningful overview of the intended processing. Where the ico...

 by persons subject to a legal obligation of professional secrecy. Union or Member State law should provide for  specific and suitable measures so as to protect the fundamental rights and the personal data of natural persons.  Member States should be allowed to maintain or introduce further conditions, including limitations, with regard  to the processing of genetic data, biometric data or data concerning health. However, this should not hamper the  free flow of personal data within the Union when those conditions apply to cross-border processing of such data.  (54) The processing of special categories of personal data may be necessary for reasons of public interest in the areas  of public health without consent of the data subject. Such processing should be subject to suitable and specific  measures so as to protect the rights and freedoms of natural persons. In that context, ‘public health’ should be  interpreted as defined in Regulation (E...

 further use; the nature of the personal data; the consequences of the intended further processing for data  subjects; and the existence of appropriate safeguards in both the original and intended further processing  operations.  Where the data subject has given consent or the processing is based on Union or Member State law which  constitutes a necessary and proportionate measure in a democratic society to safeguard, in particular, important  objectives of general public interest, the controller should be allowed to further process the personal data  irrespective of the compatibility of the purposes. In any case, the application of the principles set out in this  Regulation and in particular the information of the data subject on those other purposes and on his or her rights  including the right to object, should be ensured. Indicating possible criminal acts or threats to public security by  the controller and transmitting the relevant ...

 based on the vital interest of another natural person should in principle take place only where the processing  cannot be manifestly based on another legal basis. Some types of processing may serve both important grounds  of public interest and the vital interests of the data subject as for instance when processing is necessary for  humanitarian purposes, including for monitoring epidemics and their spread or in situations of humanitarian  emergencies, in particular in situations of natural and man-made disasters.  (47) The legitimate interests of a controller, including those of a controller to which the personal data may be  disclosed, or of a third party, may provide a legal basis for processing, provided that the interests or the  fundamental rights and freedoms of the data subject are not overriding, taking into consideration the reasonable  expectations of data subjects based on their relationship with the controller. Such legitimate i...

 Member State law as referred to in this Regulation, including the necessity for compliance with the legal  obligation to which the controller is subject or the necessity for the performance of a contract to which the data  subject is party or in order to take steps at the request of the data subject prior to entering into a contract.  (41) Where this Regulation refers to a legal basis or a legislative measure, this does not necessarily require a legislative  act adopted by a parliament, without prejudice to requirements pursuant to the constitutional order of the  Member State concerned. However, such a legal basis or legislative measure should be clear and precise and its  application should be foreseeable to persons subject to it, in accordance with the case-law of the Court of Justice  of the European Union (the ‘Court of Justice’) and the European Court of Human Rights.  (42) Where processing is based on the data subject's consent, the c...

 the main establishment. The main establishment of a controller in the Union should be determined according to  objective criteria and should imply the effective and real exercise of management activities determining the main  decisions as to the purposes and means of processing through stable arrangements. That criterion should not  depend on whether the processing of personal data is carried out at that location. The presence and use of  technical means and technologies for processing personal data or processing activities do not, in themselves,  constitute a main establishment and are therefore not determining criteria for a main establishment. The main  establishment of the processor should be the place of its central administration in the Union or, if it has no  central administration in the Union, the place where the main processing activities take place in the Union. In  cases involving both the controller and the processor, the compet...

 Natural persons may be associated with online identifiers provided by their devices, applications, tools and  protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency  identification tags. This may leave traces which, in particular when combined with unique identifiers and other  information received by the servers, may be used to create profiles of the natural persons and identify them.  (31) Public authorities to which personal data are disclosed in accordance with a legal obligation for the exercise of  their official mission, such as tax and customs authorities, financial investigation units, independent adminis- trative authorities, or financial market authorities responsible for the regulation and supervision of securities  markets should not be regarded as recipients if they receive personal data which are necessary to carry out a  particular inquiry in the general interest, in accorda...

 In order to ensure that natural persons are not deprived of the protection to which they are entitled under this  Regulation, the processing of personal data of data subjects who are in the Union by a controller or a processor  not established in the Union should be subject to this Regulation where the processing activities are related to  offering goods or services to such data subjects irrespective of whether connected to a payment. In order to  determine whether such a controller or processor is offering goods or services to data subjects who are in the  Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services  to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller's,  processor's or an intermediary's website in the Union, of an email address or of other contact details, or the use  of a language generally used in the third cou...

 household activities could include correspondence and the holding of addresses, or social networking and online  activity undertaken within the context of such activities. However, this Regulation applies to controllers or  processors which provide the means for processing personal data for such personal or household activities.  (19) The protection of natural persons with regard to the processing of personal data by competent authorities for the  purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of  criminal penalties, including the safeguarding against and the prevention of threats to public security and the free  movement of such data, is the subject of a specific Union legal act. This Regulation should not, therefore, apply  to processing activities for those purposes. However, personal data processed by public authorities under this  Regulation should, when used for those purposes,...

 Effective protection of personal data throughout the Union requires the strengthening and setting out in detail of  the rights of data subjects and the obligations of those who process and determine the processing of personal  data, as well as equivalent powers for monitoring and ensuring compliance with the rules for the protection of  personal data and equivalent sanctions for infringements in the Member States.  (12) Article 16(2) TFEU mandates the European Parliament and the Council to lay down the rules relating to the  protection of natural persons with regard to the processing of personal data and the rules relating to the free  movement of personal data.  (13) In order to ensure a consistent level of protection for natural persons throughout the Union and to prevent  divergences hampering the free movement of personal data within the internal market, a Regulation is necessary  to provide legal certainty and transparency for econ...

 The processing of personal data should be designed to serve mankind. The right to the protection of personal  data is not an absolute right; it must be considered in relation to its function in society and be balanced against  other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all  fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the  Treaties, in particular the respect for private and family life, home and communications, the protection of  personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to  conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic  diversity.  (5) The economic and social integration resulting from the functioning of the internal market has led to a substantial  increase in cross-border flows of persona...

 I  (Legislative acts)  REGULATIONS  REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL  of 27 April 2016  on the protection of natural persons with regard to the processing of personal data and on the free  movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)  (Text with EEA relevance)  THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,  Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,  Having regard to the proposal from the European Commission,  After transmission of the draft legislative act to the national parliaments,  Having regard to the opinion of the European Economic and Social Committee ( 1 ),  Having regard to the opinion of the Committee of the Regions ( 2 ),  Acting in accordance with the ordinary legislative procedure ( 3 ),  Whereas:  (1) The protection of na...