interactive GDPR 2016/0679 EN

(a)

the data subject has given explicit high_tag_cloud' title='definition'>consent to the high_tag_cloud' title='definition'>processing of those high_tag_cloud' title='definition'>personal_data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;

(b)

high_tag_cloud' title='definition'>processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the high_tag_cloud' title='definition'>controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;

(c)

high_tag_cloud' title='definition'>processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving high_tag_cloud' title='definition'>consent;

(d)

high_tag_cloud' title='definition'>processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the high_tag_cloud' title='definition'>processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the high_tag_cloud' title='definition'>personal_data are not disclosed outside that body without the high_tag_cloud' title='definition'>consent of the data subjects;

(e)

high_tag_cloud' title='definition'>processing relates to high_tag_cloud' title='definition'>personal_data which are manifestly made public by the data subject;

(f)

high_tag_cloud' title='definition'>processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;

(g)

high_tag_cloud' title='definition'>processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;

(h)

high_tag_cloud' title='definition'>processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;

(i)

high_tag_cloud' title='definition'>processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;

(j)

high_tag_cloud' title='definition'>processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

(a)

the high_tag_cloud' title='definition'>controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the high_tag_cloud' title='definition'>personal_data affected by the high_tag_cloud' title='definition'>personal_data breach, in particular those that render the high_tag_cloud' title='definition'>personal_data unintelligible to any person who is not authorised to access it, such as encryption;

(b)

the high_tag_cloud' title='definition'>controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to in paragraph 1 is no longer likely to materialise;

(c)

it would involve disproportionate effort. In such a case, there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner.

(a)

a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated high_tag_cloud' title='definition'>processing, including high_tag_cloud' title='definition'>profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person;

(b)

high_tag_cloud' title='definition'>processing on a large scale of special categories of data referred to in Article 9(1), or of high_tag_cloud' title='definition'>personal_data relating to criminal convictions and offences referred to in Article 10; or

(c)

a systematic monitoring of a publicly accessible area on a large scale.

(a)

a systematic description of the envisaged high_tag_cloud' title='definition'>processing operations and the purposes of the high_tag_cloud' title='definition'>processing, including, where applicable, the legitimate interest pursued by the high_tag_cloud' title='definition'>controller;

(b)

an assessment of the necessity and proportionality of the high_tag_cloud' title='definition'>processing operations in relation to the purposes;

(c)

an assessment of the risks to the rights and freedoms of data subjects referred to in paragraph 1; and

(d)

the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of high_tag_cloud' title='definition'>personal_data and to demonstrate compliance with this Regulation taking into account the rights and legitimate interests of data subjects and other persons concerned.

(a)

where applicable, the respective responsibilities of the high_tag_cloud' title='definition'>controller, joint high_tag_cloud' title='definition'>controllers and high_tag_cloud' title='definition'>processors involved in the high_tag_cloud' title='definition'>processing, in particular for high_tag_cloud' title='definition'>processing within a high_tag_cloud' title='definition'>group_of_undertakings;

(b)

the purposes and means of the intended high_tag_cloud' title='definition'>processing;

(c)

the measures and safeguards provided to protect the rights and freedoms of data subjects pursuant to this Regulation;

(d)

where applicable, the contact details of the data protection officer;

(e)

the data protection impact assessment provided for in Article 35; and

(f)

any other information requested by the high_tag_cloud' title='definition'>supervisory_authority.

(a)

monitor and ensure the correct application of this Regulation in the cases provided for in Articles 64 and 65 without prejudice to the tasks of national supervisory authorities;

(b)

advise the Commission on any issue related to the protection of high_tag_cloud' title='definition'>personal_data in the Union, including on any proposed amendment of this Regulation;

(c)

advise the Commission on the format and procedures for the exchange of information between high_tag_cloud' title='definition'>controllers, high_tag_cloud' title='definition'>processors and supervisory authorities for high_tag_cloud' title='definition'>binding_corporate_rules;

(d)

issue guidelines, recommendations, and best practices on procedures for erasing links, copies or replications of high_tag_cloud' title='definition'>personal_data from publicly available communication services as referred to in Article 17(2);

(e)

examine, on its own initiative, on request of one of its members or on request of the Commission, any question covering the application of this Regulation and issue guidelines, recommendations and best practices in order to encourage consistent application of this Regulation;

(f)

issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for further specifying the criteria and conditions for decisions based on high_tag_cloud' title='definition'>profiling pursuant to Article 22(2);

(g)

issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for establishing the high_tag_cloud' title='definition'>personal_data breaches and determining the undue delay referred to in Article 33(1) and (2) and for the particular circumstances in which a high_tag_cloud' title='definition'>controller or a high_tag_cloud' title='definition'>processor is required to notify the high_tag_cloud' title='definition'>personal_data breach;

(h)

issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph as to the circumstances in which a high_tag_cloud' title='definition'>personal_data breach is likely to result in a high risk to the rights and freedoms of the natural persons referred to in Article 34(1).

(i)

issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for the purpose of further specifying the criteria and requirements for high_tag_cloud' title='definition'>personal_data transfers based on high_tag_cloud' title='definition'>binding_corporate_rules adhered to by high_tag_cloud' title='definition'>controllers and high_tag_cloud' title='definition'>binding_corporate_rules adhered to by high_tag_cloud' title='definition'>processors and on further necessary requirements to ensure the protection of high_tag_cloud' title='definition'>personal_data of the data subjects concerned referred to in Article 47;

(j)

issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for the purpose of further specifying the criteria and requirements for the high_tag_cloud' title='definition'>personal_data transfers on the basis of Article 49(1);

(k)

draw up guidelines for supervisory authorities concerning the application of measures referred to in Article 58(1), (2) and (3) and the setting of administrative fines pursuant to Article 83;

(l)

review the practical application of the guidelines, recommendations and best practices referred to in points (e) and (f);

(m)

issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for establishing common procedures for reporting by natural persons of infringements of this Regulation pursuant to Article 54(2);

(n)

encourage the drawing-up of codes of conduct and the establishment of data protection certification mechanisms and data protection seals and marks pursuant to Articles 40 and 42;

(o)

carry out the accreditation of certification bodies and its periodic review pursuant to Article 43 and maintain a public register of accredited bodies pursuant to Article 43(6) and of the accredited high_tag_cloud' title='definition'>controllers or high_tag_cloud' title='definition'>processors established in third countries pursuant to Article 42(7);

(p)

specify the requirements referred to in Article 43(3) with a view to the accreditation of certification bodies under Article 42;

(q)

provide the Commission with an opinion on the certification requirements referred to in Article 43(8);

(r)

provide the Commission with an opinion on the icons referred to in Article 12(7);

(s)

provide the Commission with an opinion for the assessment of the adequacy of the level of protection in a third country or high_tag_cloud' title='definition'>international_organisation, including for the assessment whether a third country, a territory or one or more specified sectors within that third country, or an high_tag_cloud' title='definition'>international_organisation no longer ensures an adequate level of protection. To that end, the Commission shall provide the Board with all necessary documentation, including correspondence with the government of the third country, with regard to that third country, territory or specified sector, or with the high_tag_cloud' title='definition'>international_organisation.

(t)

issue opinions on draft decisions of supervisory authorities pursuant to the consistency mechanism referred to in Article 64(1), on matters submitted pursuant to Article 64(2) and to issue binding decisions pursuant to Article 65, including in cases referred to in Article 66;

(u)

promote the cooperation and the effective bilateral and multilateral exchange of information and best practices between the supervisory authorities;

(v)

promote common training programmes and facilitate personnel exchanges between the supervisory authorities and, where appropriate, with the supervisory authorities of third countries or with high_tag_cloud' title='definition'>international_organisations;

(w)

promote the exchange of knowledge and documentation on data protection legislation and practice with data protection supervisory authorities worldwide.

(x)

issue opinions on codes of conduct drawn up at Union level pursuant to Article 40(9); and

(y)

maintain a publicly accessible electronic register of decisions taken by supervisory authorities and courts on issues handled in the consistency mechanism.

(a)

the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the high_tag_cloud' title='definition'>processing concerned as well as the number of data subjects affected and the level of damage suffered by them;

(b)

the intentional or negligent character of the infringement;

(c)

any action taken by the high_tag_cloud' title='definition'>controller or high_tag_cloud' title='definition'>processor to mitigate the damage suffered by data subjects;

(d)

the degree of responsibility of the high_tag_cloud' title='definition'>controller or high_tag_cloud' title='definition'>processor taking into account technical and organisational measures implemented by them pursuant to Articles 25 and 32;

(e)

any relevant previous infringements by the high_tag_cloud' title='definition'>controller or high_tag_cloud' title='definition'>processor;

(f)

the degree of cooperation with the high_tag_cloud' title='definition'>supervisory_authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement;

(g)

the categories of high_tag_cloud' title='definition'>personal_data affected by the infringement;

(h)

the manner in which the infringement became known to the high_tag_cloud' title='definition'>supervisory_authority, in particular whether, and if so to what extent, the high_tag_cloud' title='definition'>controller or high_tag_cloud' title='definition'>processor notified the infringement;

(i)

where measures referred to in Article 58(2) have previously been ordered against the high_tag_cloud' title='definition'>controller or high_tag_cloud' title='definition'>processor concerned with regard to the same subject-matter, compliance with those measures;

(j)

adherence to approved codes of conduct pursuant to Article 40 or approved certification mechanisms pursuant to Article 42; and

(k)

any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement.

(a)

the obligations of the high_tag_cloud' title='definition'>controller and the high_tag_cloud' title='definition'>processor pursuant to Articles 8, 11, 25 to 39 and 42 and 43;

(b)

the obligations of the certification body pursuant to Articles 42 and 43;

(c)

the obligations of the monitoring body pursuant to Article 41(4).

(a)

the basic principles for high_tag_cloud' title='definition'>processing, including conditions for high_tag_cloud' title='definition'>consent, pursuant to Articles 5, 6, 7 and 9;

(b)

the data subjects' rights pursuant to Articles 12 to 22;

(c)

the transfers of high_tag_cloud' title='definition'>personal_data to a high_tag_cloud' title='definition'>recipient in a third country or an high_tag_cloud' title='definition'>international_organisation pursuant to Articles 44 to 49;

(d)

any obligations pursuant to Member State law adopted under Chapter IX;

(e)

non-compliance with an order or a temporary or definitive limitation on high_tag_cloud' title='definition'>processing or the suspension of data flows by the high_tag_cloud' title='definition'>supervisory_authority pursuant to Article 58(2) or failure to provide access in violation of Article 58(1).