(4) The processing of personal_data should be designed to serve mankind.
The right to the protection of personal_data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality.
This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal_data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity.
- = -
(5) The economic and social integration resulting from the functioning of the internal market has led to a substantial increase in cross-border flows of personal_data.
The exchange of personal_data between public and private actors, including natural persons, associations and undertakings across the Union has increased.
National authorities in the Member States are being called upon by Union law to cooperate and exchange personal_data so as to be able to perform their duties or carry out tasks on behalf of an authority in another Member State.
- = -
(6) Rapid technological developments and globalisation have brought new challenges for the protection of personal_data.
The scale of the collection and sharing of personal_data has increased significantly.
Technology allows both private companies and public authorities to make use of personal_data on an unprecedented scale in order to pursue their activities.
Natural persons increasingly make personal information available publicly and globally.
Technology has transformed both the economy and social life, and should further facilitate the free flow of personal_data within the Union and the transfer to third countries and international_organisations, while ensuring a high level of the protection of personal_data.
- = -
(45) Where processing is carried out in accordance with a legal obligation to which the controller is subject or where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, the processing should have a basis in Union or Member State law.
This Regulation does not require a specific law for each individual processing.
A law as a basis for several processing operations based on a legal obligation to which the controller is subject or where processing is necessary for the performance of a task carried out in the public interest or in the exercise of an official authority may be sufficient.
It should also be for Union or Member State law to determine the purpose of processing.
Furthermore, that law could specify the general conditions of this Regulation governing the lawfulness of personal_data processing, establish specifications for determining the controller, the type of personal_data which are subject to the processing, the data subjects concerned, the entities to which the personal_data may be disclosed, the purpose limitations, the storage period and other measures to ensure lawful and fair processing.
It should also be for Union or Member State law to determine whether the controller performing a task carried out in the public interest or in the exercise of official authority should be a public authority or another natural or legal person governed by public law, or, where it is in the public interest to do so, including for health purposes such as public health and social protection and the management of health care services, by private law, such as a professional association.
- = -
(97) Where the processing is carried out by a public authority, except for courts or independent judicial authorities when acting in their judicial capacity, where, in the private sector, processing is carried out by a controller whose core activities consist of processing operations that require regular and systematic monitoring of the data subjects on a large scale, or where the core activities of the controller or the processor consist of processing on a large scale of special categories of personal_data and data relating to criminal convictions and offences, a person with expert knowledge of data protection law and practices should assist the controller or processor to monitor internal compliance with this Regulation.
In the private sector, the core activities of a controller relate to its primary activities and do not relate to the processing of personal_data as ancillary activities.
The necessary level of expert knowledge should be determined in particular according to the data processing operations carried out and the protection required for the personal_data processed by the controller or the processor.
Such data protection officers, whether or not they are an employee of the controller, should be in a position to perform their duties and tasks in an independent manner.
- = -
(122) Each supervisory_authority should be competent on the territory of its own Member State to exercise the powers and to perform the tasks conferred on it in accordance with this Regulation.
This should cover in particular the processing in the context of the activities of an establishment of the controller or processor on the territory of its own Member State, the processing of personal_data carried out by public authorities or private bodies acting in the public interest, processing affecting data subjects on its territory or processing carried out by a controller or processor not established in the Union when targeting data subjects residing on its territory.
This should include handling complaints lodged by a data subject, conducting investigations on the application of this Regulation and promoting public awareness of the risks, rules, safeguards and rights in relation to the processing of personal_data.
- = -
(128) The rules on the lead supervisory_authority and the one-stop-shop mechanism should not apply where the processing is carried out by public authorities or private bodies in the public interest.
In such cases the only supervisory_authority competent to exercise the powers conferred to it in accordance with this Regulation should be the supervisory_authority of the Member State where the public authority or private body is established.
- = -
(158) Where personal_data are processed for archiving purposes, this Regulation should also apply to that processing, bearing in mind that this Regulation should not apply to deceased persons.
Public authorities or public or private bodies that hold records of public interest should be services which, pursuant to Union or Member State law, have a legal obligation to acquire, preserve, appraise, arrange, describe, communicate, promote, disseminate and provide access to records of enduring value for general public interest.
Member States should also be authorised to provide for the further processing of personal_data for archiving purposes, for example with a view to providing specific information related to the political behaviour under former totalitarian state regimes, genocide, crimes against humanity, in particular the Holocaust, or war crimes.
- = -
(159) Where personal_data are processed for scientific research purposes, this Regulation should also apply to that processing.
For the purposes of this Regulation, the processing of personal_data for scientific research purposes should be interpreted in a broad manner including for example technological development and demonstration, fundamental research, applied research and privately funded research.
In addition, it should take into account the Union's objective under Article 179(1) TFEU of achieving a European Research Area.
Scientific research purposes should also include studies conducted in the public interest in the area of public health.
To meet the specificities of processing personal_data for scientific research purposes, specific conditions should apply in particular as regards the publication or otherwise disclosure of personal_data in the context of scientific research purposes.
If the result of scientific research in particular in the health context gives reason for further measures in the interest of the data subject, the general rules of this Regulation should apply in view of those measures.
- = -
