### optimal and efficient spectrum use requires continuous monitoring of developments , and up - to - date transparent information on spectrum use throughout the union . while commission decision 2007 / 344 / ec on harmonised availability of information regarding spectrum use within the community6 requires member states to publish information on usage rights , a detailed inventory of existing spectrum use together with an effective review and assessment methodology are necessary in the union to improve the efficiency of spectrum and radio equipment use , in particular between 300 mhz and 3 ghz . this would help to identify inefficient technologies and usages in both the commercial and public sectors , as well as unused assignments and sharing opportunities , and to evaluate future consumer and business needs . ### optimal and efficient spectrum use requires continuous monitoring of developments , and up - to - date transparent information on spectrum use throughout the union . while commission decision 2007 / 344 / ec on harmonised availability of information regarding spectrum use within the community6 requires member states to publish information on usage rights , a detailed inventory of existing spectrum use together with an effective review and assessment methodology are necessary in the union to improve the efficiency of spectrum and radio equipment use , in particular between 300 mhz and 6 ghz . this would help to identify inefficient technologies and usages in both the commercial and public sectors , as well as unused assignments and sharing opportunities , and to evaluate future consumer and business needs .


### applying the least onerous authorisation system possible in such a way as to maximise flexibility and efficiency in spectrum usage ; ### applying the most appropriate , non - discriminatory and least onerous authorisation system possible in such a way as to maximise flexibility and efficiency in spectrum usage ;


### additional spectrum may be needed by other sectors such as transport , r&d , public protection and disaster relief , e - health and e - inclusion . optimising synergies between spectrum policy and r&d activities and carrying out studies of radio compatibility between different spectrum users should help innovation . the commission ' s joint research centre should help in developing the technical aspects of spectrum regulation , notably by providing testing facilities to verify interference models relevant to union legislation . moreover , results of research under the seventh framework programme require the examination of the spectrum needs of projects that may have a large economic or investment potential , in particular for smes , e . g . cognitive radio or e - health . adequate protection against harmful interference should also be ensured to sustain r&d and scientific activities . ### additional spectrum may be needed by other sectors such as transport , r&d , e - health , e - inclusion and public protection and disaster relief , the latter in view of its increased use of video and data transmission for quick and more efficient service . optimising synergies between spectrum policy and r&d activities and carrying out studies of radio compatibility between different spectrum users should help innovation . the commission ' s joint research centre should help in developing the technical aspects of spectrum regulation , notably by providing testing facilities to verify interference models relevant to union legislation . moreover , results of research under the seventh framework programme require the examination of the spectrum needs of projects that may have a large economic or investment potential , in particular for smes , e . g . cognitive radio or e - health . adequate protection against harmful interference should also be ensured to sustain r&d and scientific activities .


### member states shall , by 1 january 2013 make the 800 mhz band available for electronic communications services in line with the harmonised technical conditions laid down pursuant to the decision no 676 / 2002 / ec . in member states where exceptional national or local circumstances would prevent the availability of the band , the commission may authorise specific derogations until 2015 . in accordance with article 9 of directive 2002 / 21 / ec , the commission , in cooperation with the member states , shall keep under review the use of the spectrum below 1ghz and assess whether additional spectrum could be freed and made available for new applications . ### member states shall , by 1 january 2013 make the 800 mhz band available for spectrum assignments for electronic communications services in line with the harmonised technical conditions laid down pursuant to the decision no 676 / 2002 / ec . only in exceptional cases and where duly justifiable historical reasons prevent the availability of the band , the commission may authorise specific derogations until 2015


### if necessary , the commission shall ensure the availability of additional spectrum bands for the provision of harmonised satellite services for broadband access that will cover the whole territory of the union including the most remote areas with a broadband offering enabling internet access at a comparable price to terrestrial offerings . ### in order to ensure that all citizens have access to advanced digital services including broadband , in particular in remote and sparsely populated areas , member states and the commission shall ensure the availability of sufficient spectrum for the provision of broadband satellite services enabling internet access .


### the union shall provide , upon request , political and technical support to member states in their bilateral negotiations with non - union neighbouring countries including candidate and acceding countries , to resolve spectrum coordination issues that prevent member states from implementing their obligations under union law regarding spectrum policy and management . the union shall also support efforts by third countries to implement spectrum management that is compatible with that of the union , so as to safeguard union spectrum policy objectives . ### in order to resolve spectrum coordination issues that would otherwise prevent member states from implementing their obligations under union law regarding spectrum policy and management , the union shall provide political and technical support to member states in their bilateral negotiations with non - union neighbouring countries including candidate and acceding countries . the union shall also support efforts by third countries to implement spectrum management that is compatible with that of the union , so as to safeguard union spectrum policy objectives


### without prejudice to the principles of service and technology neutrality , member states , in cooperation with the commission , shall take all steps necessary to ensure that sufficient spectrum for coverage and capacity purposes is allocated within the union , in order to ensure that wireless applications contribute effectively to achieving the target for all citizens to have access to broadband of a speed of at least 30 mbps by 2020 . ### without prejudice to the principles of service and technology neutrality , member states , in cooperation with the commission , shall take all steps necessary to ensure that sufficient harmonised spectrum for coverage and capacity purposes is allocated within the union , enabling the union to have the fastest broadband speed in the world in order to ensure that wireless applications and european leadership in new services contribute effectively to economic growth , achieving the target for all citizens to have access to broadband speeds of not less than 30 mbps by 2020 .


### member states shall , by 1 january 2012 , authorise the use of all the spectrum designated by commission decisions 2008 / 477 / ec , 2008 / 411 / ec and 2009 / 766 / ec , under conditions that provide consumers with easy access to wireless broadband services . ### member states shall , by 1 january 2012 , make the bands designated by commission decisions 2008 / 477 / ec , 2008 / 411 / ec and 2009 / 766 / ec , available , in order to promote wider availability of wireless broadband services for the benefit of eu citizens and consumers , without prejudice to the existing and future deployment of other services that have equal access to this spectrum under the conditions specified in those commission decisions .


### member states may limit the amount of spectrum for which rights of use are granted to any economic operator or may attach conditions to such rights of use , such as the provision of wholesale access , in certain bands or in certain groups of bands with similar characteristics , for instance the bands below 1 ghz allocated to electronic communication services ; ### member states may limit the amount of spectrum for which rights of use are granted to any economic operator or may attach conditions to such rights of use , such as the provision of wholesale access , national or regional roaming , in certain bands or in certain groups of bands with similar characteristics , for instance the bands below 1 ghz allocated to electronic communication services ;


### member states shall , by 1 january 2013 make the 800 mhz band available for electronic communications services in line with the harmonised technical conditions laid down pursuant to the decision no 676 / 2002 / ec . in member states where exceptional national or local circumstances would prevent the availability of the band , the commission may authorise specific derogations until 2015 . in accordance with article 9 of directive 2002 / 21 / ec , the commission , in cooperation with the member states , shall keep under review the use of the spectrum below 1ghz and assess whether additional spectrum could be freed and made available for new applications . ### member states shall , by 17 june 2015 make the 800 mhz band available for electronic communications services in line with the harmonised technical conditions laid down pursuant to the decision no 676 / 2002 / ec . in member states where the digital switchover process is already well advanced or completed and where the migration of incumbent services can be managed on time , the commission recommends to make the band available by 1 january 2013 .


### in the case referred to in point of paragraph 1 , a group of undertakings may appoint a single data protection officer . ### a group of undertakings may appoint a single data protection officer .


### where the appropriate safeguards with respect to the protection of personal data are not provided for in a legally binding instrument , the controller or processor shall obtain prior authorisation for the transfer , or a set of transfers , or for provisions to be inserted into administrative arrangements providing the basis for such transfer . such authorisation by the supervisory authority shall be in accordance with point of article 34 . if the transfer is related to processing activities which concern data subjects in another member state or other member states , or substantially affect the free movement of personal data within the union , the supervisory authority shall apply the consistency mechanism referred to in article 57 . authorisations by a supervisory authority on the basis of article 26 of directive 95 / 46 / ec shall remain valid , until amended , replaced or repealed by that supervisory authority . ### authorisations by a supervisory authority on the basis of article 26 of directive 95 / 46 / ec shall remain valid for two years after the entry into force of this regulation , or until amended , replaced or repealed by that supervisory authority .


### monitoring publicly accessible areas , especially when using optic - electronic devices on a large scale ; ### monitoring publicly accessible areas , involving the use of specific techniques such as facial recognition , or not answering to the reasonable expectations of the general public ;


### article 1 of directive 2002 / 58 / ec shall be deleted . ### articles 1 , 4 and 15 of directive 2002 / 58 / ec shall be deleted .


### the administrative sanction shall be in each individual case effective , proportionate and dissuasive . the amount of the administrative fine shall be fixed with due regard to the nature , gravity and duration of the breach , the intentional or negligent character of the infringement , the degree of responsibility of the natural or legal person and of previous breaches by this person , the technical and organisational measures and procedures implemented pursuant to article 23 and the degree of co - operation with the supervisory authority in order to remedy the breach . ### an administrative sanction shall be in every individual case effective , proportionate and dissuasive . in deciding on the nature , scope and seriousness of the administrative sanction to apply the supervisory authority shall have regard to all the circumstances and , in particular : the nature , gravity and duration of the breach ; whether the breach was deliberate ; whether reasonable steps were taken to prevent it ; whether the breach did or is likely to cause substantial harm or substantial prejudice to the fundamental rights and freedoms of a data subject , or substantial distress to a data subject ; any steps taken to mitigate the consequences of a breach , including the degree of cooperation with the supervisory authority in order to remedy the breach or its consequences ; any previous breaches .


### processing is necessary for compliance with a legal obligation to which the controller is subject ; ### processing is necessary for compliance with a legal obligation to which the controller or the group of undertakings of which the controller is a member or any other member thereof is subject ;


### this regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the union . ### this regulation applies to the processing of personal data of data subjects residing in the union in the context of the activities of an establishment of a controller or a processor in the union .


### the commission may specify standard forms and procedures for requesting and granting access to the information referred to in paragraph 1 , including for verification of the identity of the data subject and communicating the personal data to the data subject , taking into account the specific features and necessities of various sectors and data processing situations . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the commission suggest standard forms and specify procedures for requesting and granting access to the information referred to in paragraph 1 , including for verification of the identity of the data subject and communicating the personal data to the data subject , taking into account the specific features and necessities of various sectors and data processing situations . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 .


### member states shall provide for exemptions or derogations from the provisions on the general principles in chapter ii , the rights of the data subject in chapter iii , on controller and processor in chapter iv , on the transfer of personal data to third countries and international organisations in chapter v , the independent supervisory authorities in chapter vi and on co - operation and consistency in chapter vii for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression . ### chapter ii , chapter iii , chapter iv , chapter v , chapter vi , , chapter vii as well as articles 73 , 74 , 76 and 79 of chapter viii shall not apply to the processing of personal data carried out for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression .


### the supervisory authority shall impose a fine up to 250 000 eur , or in case of an enterprise up to 0 , 5 % of its annual worldwide turnover , to anyone who , intentionally or negligently : ### the supervisory authority shall , based on the gravity of the breach , impose a fine or a warning to anyone who , intentionally or negligently :


### is expressly authorized by a union or member state law which also lays down suitable measures to safeguard the data subject ' s legitimate interests ; or ### is expressly authorized by a union or member state law and which protects the data subjects legitimate interests and protects against possible discrimination resulting from measures described in paragraph 1 ;


### the supervisory authority shall impose a fine up to 500 000 eur , or in case of an enterprise up to 1 % of its annual worldwide turnover , to anyone who , intentionally or negligently : ### the supervisory authority may impose a fine up to 500 000 eur , or in case of an enterprise up to 1 % of its annual worldwide turnover , to anyone who , intentionally or negligently :


### each supervisory authority shall be empowered to impose administrative sanctions in accordance with this article . ### each supervisory authority shall be empowered to impose administrative sanctions in accordance with this article . the supervisory authorities shall co - operate with each other in accordance with articles 46 and 57 to guarantee a harmonized level of sanctions within the union .


### the supervisory authority shall impose a fine up to 500 000 eur , or in case of an enterprise up to 1 % of its annual worldwide turnover , to anyone who , intentionally or negligently : ### the supervisory authority imposes a fine up to 500 000 eur to anyone who intentionally :


### in the case of a personal data breach , the controller shall without undue delay and , where feasible , not later than 24 hours after having become aware of it , notify the personal data breach to the supervisory authority . the notification to the supervisory authority shall be accompanied by a reasoned justification in cases where it is not made within 24 hours . ### in the case of a personal data breach relating to special categories of personal date , personal data which are subject to professional secrecy , personal data relating to criminal offences or to the suspicion of a criminal act or personal data relating to bank or credit card accounts , which seriously threaten the rights or legitimate interests of the data subject , the controller shall without undue delay notify the personal data breach to the supervisory authority .


### supervisory authorities shall provide each other relevant information and mutual assistance in order to implement and apply this regulation in a consistent manner , and shall put in place measures for effective co - operation with one another . mutual assistance shall cover , in particular , information requests and supervisory measures , such as requests to carry out prior authorisations and consultations , inspections and prompt information on the opening of cases and ensuing developments where data subjects in several member states are likely to be affected by processing operations . ### supervisory authorities shall provide each other relevant information and mutual assistance in order to implement and apply this regulation in a consistent manner , and shall put in place measures for effective co - operation with one another . mutual assistance shall cover , in particular , information requests and supervisory measures , such as requests to carry out prior consultations , inspections and prompt information on the opening of cases and ensuing developments where data subjects in several member states are likely to cause legal effects to the detriment of the data subjects .


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying the criteria and requirements for the methods to obtain verifiable consent referred to in paragraph 1 . in doing so , the commission shall consider specific measures for micro , small and medium - sized enterprises . ### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of laying down standard forms for specific methods to obtain verifiable consent referred to in paragraph 1 .


### the controller or processor shall designate the data protection officer on the basis of professional qualities and , in particular , expert knowledge of data protection law and practices and ability to fulfil the tasks referred to in article 37 . the necessary level of expert knowledge shall be determined in particular according to the data processing carried out and the protection required for the personal data processed by the controller or the processor . ### the controller or processor shall designate the data protection officer or data protection officers on the basis of professional qualities and , in particular , expert knowledge of data protection law and practices and ability to fulfil the tasks referred to in article 37 . the necessary level of expert knowledge shall be determined in particular according to the data processing carried out and the protection required for the personal data processed by the controller or the processor .


### the supervisory authority referred to in paragraph 1 and the supervisory authority competent under article 51 shall take account of the opinion of the european data protection board and shall within two weeks after the information on the opinion by the chair of the european data protection board , electronically communicate to the chair of the european data protection board and to the commission whether it maintains or amends its draft measure and , if any , the amended draft measure , using a standardised format . ### the competent supervisory authority referred to in paragraph 1 shall take account of the opinion of the european data protection board and shall within two weeks after the information on the opinion by the chair of the european data protection board , electronically communicate to the chair of the european data protection board and to the commission whether it maintains or amends its draft measure and , if any , the amended draft measure , using a standardised format .


### where the supervisory authority is of the opinion that the intended processing does not comply with this regulation , in particular where risks are insufficiently identified or mitigated , it shall prohibit the intended processing and make appropriate proposals to remedy such incompliance . ### where the competent supervisory authority determines in accordance with its power that the intended processing does not comply with this regulation , in particular where risks are insufficiently identified or mitigated , it shall prohibit the intended processing and make appropriate proposals to remedy such incompliance . such a decision shall be subject to appeal in a competent court and it may not be enforceable while being appealed unless the processing results in immediate serious harm suffered by data subjects .


### in exceptional circumstances , where a supervisory authority considers that there is an urgent need to act in order to protect the interests of data subjects , in particular when the danger exists that the enforcement of a right of a data subject could be considerably impeded by means of an alteration of the existing state or for averting major disadvantages or for other reasons , by way of derogation from the procedure referred to in article 58 , it may immediately adopt provisional measures with a specified period of validity . the supervisory authority shall , without delay , communicate those measures , with full reasons , to the european data protection board and to the commission . ### in exceptional circumstances , where a supervisory authority considers that there is an urgent need to act in order to protect the interests of data subjects , when the danger exists that the enforcement of a right of a data subject could be considerably impeded by means of an alteration of the existing state or for averting major disadvantages , by way of derogation from the procedure referred to in article 58 , it may immediately adopt provisional measures with a specified period of validity . this supervisory authority shall , without delay , communicate those measures , with full reasons , to the competent supervisory authority , the european data protection board , the commission and the controller or processor concerned .


### the controller or processor shall ensure that the data protection officer performs the duties and tasks independently and does not receive any instructions as regards the exercise of the function . the data protection officer shall directly report to the management of the controller or the processor . ### the controller or processor shall ensure that the data protection officer performs the duties and tasks independently and does not receive any instructions as regards the exercise of the function . the data protection officer shall directly report to the management of the controller or the processor which is responsible for protecting personal data in accordance with this regulation .


### the data subject shall have the right to obtain from the controller at any time , on request , confirmation as to whether or not personal data relating to the data subject are being processed . where such personal data are being processed , the controller shall provide the following information : ### the data subject shall have the right to obtain from the controller at any time , on request , confirmation as to whether or not personal data relating to the data subject are being processed . with the exception of data being used for historical , statistical or scientific research purposes the controller shall provide the following information when person data are being processed :


### for compliance with a legal obligation to retain the personal data by union or member state law to which the controller is subject ; member state laws shall meet an objective of public interest , respect the essence of the right to the protection of personal data and be proportionate to the legitimate aim pursued ; ### for compliance with a legal obligation to retain the personal data by union or member state law to which the controller is subject ;


### the recipients or categories of recipients of the personal data ; ### the identity and contact details of all recipients who process the personal data received from the direct controller , and the purposes of the processing , irrespective of whether they have received the data directly from him or indirectly from another party . this shall not apply insofar as recipients are unknown , and this state of affairs has not arisen due to the deliberate intent or negligence of the direct controller .


### is based on the data subject ' s consent , subject to the conditions laid down in article 7 and to suitable safeguards . ### is based on the data subject ' s consent , subject to the conditions laid down in article 7 and to suitable safeguards , including effective protection against possible discrimination resulting from measures described in paragraph 1 .


### enlist another processor only with the prior permission of the controller ; ### determine the conditions for enlisting another processor , such as the need of specific or general prior permission of the controller , or the need of written agreement imposing the same obligations on the subprocessor as are imposed on the processor under this regulation ;


### the controller or the processor shall support the data protection officer in performing the tasks and shall provide staff , premises , equipment and any other resources necessary to carry out the duties and tasks referred to in article 37 . ### the controller or the processor shall support the data protection organisation or data protection officer in performing the tasks and shall provide staff , premises , equipment and any other resources necessary to carry out the duties and tasks referred to in article 37 .


### the controller shall inform the data subject without delay and , at the latest within one month of receipt of the request , whether or not any action has been taken pursuant to article 13 and articles 15 to 19 and shall provide the requested information . this period may be prolonged for a further month , if several data subjects exercise their rights and their cooperation is necessary to a reasonable extent to prevent an unnecessary and disproportionate effort on the part of the controller . the information shall be given in writing . where the data subject makes the request in electronic form , the information shall be provided in electronic form , unless otherwise requested by the data subject . ### the controller shall inform the data subject without delay and , at the latest within one month of receipt of the request , whether or not any action has been taken pursuant to article 13 and articles 15 to 19 and shall provide the requested information . this period may be prolonged for a further month , if several data subjects exercise their rights and their cooperation is necessary to a reasonable extent to prevent an unnecessary and disproportionate effort on the part of the controller . the information shall be given in writing .


### where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature , their scope or their purposes , the controller or the processor acting on the controller ' s behalf shall carry out an assessment of the impact of the envisaged processing operations on the protection of personal data . ### where required pursuant to article 32a , the controller or the processor acting on the controller ' s behalf shall carry out an assessment of the impact of the envisaged processing operations on the protection of personal data .


### member states shall provide for exemptions or derogations from the provisions on the general principles in chapter ii , the rights of the data subject in chapter iii , on controller and processor in chapter iv , on the transfer of personal data to third countries and international organisations in chapter v , the independent supervisory authorities in chapter vi and on co - operation and consistency in chapter vii for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression . ### chapter ii , chapter iii , chapter iv , chapter v , chapter vi , , chapter vii as well as articles 73 , 74 , 76 and 79 of chapter viii shall not apply to the processing of personal data carried out for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression .


### where the personal data are not collected from the data subject , the controller shall inform the data subject , in addition to the information referred to in paragraph 1 , from which source the personal data originate . ### where the personal data are not collected from the data subject , the controller shall inform the data subject , in addition to the information referred to in paragraph 1 , from which source the personal data originate , except where the data originate from a publicly available source or where the transfer is provided for by law .


### is expressly authorized by a union or member state law which also lays down suitable measures to safeguard the data subject ' s legitimate interests ; or ### is expressly authorized by a union or member state law and which protects the data subjects legitimate interests and protects against possible discrimination resulting from measures described in paragraph 1 ; or


### the european data protection board shall ensure the consistent application of this regulation . to this effect , the european data protection board shall , on its own initiative or at the request of the commission , in particular : ### the european data protection board shall ensure the consistent application of this regulation . to this effect , the european data protection board shall , on its own initiative , at the request of the commission or other stakeholders , in particular :


### the purposes of the processing for which the personal data are intended , including the contract terms and general conditions where the processing is based on point of article 6 and the legitimate interests pursued by the controller where the processing is based on point of article 6 ; ### the specific purpose or purposes of the processing for which the personal data are intended , including in relation to the provisions of article 6 , and notably the contract terms and general conditions where the processing is based on point of article 6 and the legitimate interests pursued by the controller where the processing is based on article 6 and ;


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of specifying any further criteria and requirements for appropriate measures referred to in paragraph 1 other than those already referred to in paragraph 2 , the conditions for the verification and auditing mechanisms referred to in paragraph 3 and as regards the criteria for proportionality under paragraph 3 , and considering specific measures for micro , small and medium - sized - enterprises . ### a group of undertakings may apply joint technical and organizational measures to meet the obligations arising from this regulation .


### the purposes of the processing for which the personal data are intended , including the contract terms and general conditions where the processing is based on point of article 6 and the legitimate interests pursued by the controller where the processing is based on point of article 6 ; ### the purposes of the processing for which the personal data are intended , including the contract terms and general conditions where the processing is based on point of article 6 and the legitimate interests pursued by the controller where the processing is based on article 6 , and ;


### every natural person shall have the right not to be subject to a measure which produces legal effects concerning this natural person or significantly affects this natural person , and which is based solely on automated processing intended to evaluate certain personal aspects relating to this natural person or to analyse or predict in particular the natural person ' s performance at work , economic situation , location , health , personal preferences , reliability or behaviour . ### a data subject shall have the right not to be subject to a measure which adversely affects this data subject , both offline and online which is based solely on automated processing of data intended to evaluate certain personal aspects relating to a data subject or to analyse or predict in particular the data subject ' s performance at work , economic situation , location , health , personal preferences , reliability or behaviour .


### where a transfer is based on contractual clauses as referred to in point of paragraph 2 of this article the controller or processor shall obtain prior authorisation of the contractual clauses according to point of article 34 from the supervisory authority . if the transfer is related to processing activities which concern data subjects in another member state or other member states , or substantially affect the free movement of personal data within the union , the supervisory authority shall apply the consistency mechanism referred to in article 57 . ### the controller or processor shall obtain prior authorisation of the contractual clauses according to point of article 34 from the competent supervisory authority for transfers according to this article . if the transfer is related to processing activities which substantially affect the free movement of personal data within the union , the competent supervisory authority shall apply the consistency mechanism referred to in article 57 .


### pursuant to point of article 26 , the processor shall alert and inform the controller immediately after the establishment of a personal data breach . ### pursuant to point of article 26 , the processor shall alert and inform the controller without undue delay after the identification of a personal data breach that is likely to produce legal effects to the detriment of the data subject ' s privacy .


### having regard to the state of the art and the cost of implementation , the controller shall , both at the time of the determination of the means for processing and at the time of the processing itself , implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject . ### having regard to the state of the art , the cost of implementation and international best practices , the controller shall , both at the time of the determination of the means for processing and at the time of the processing itself , implement appropriate measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject .


### the data subject shall have the right to object , on grounds relating to their particular situation , at any time to the processing of personal data which is based on points , and of article 6 , unless the controller demonstrates compelling legitimate grounds for the processing which override the interests or fundamental rights and freedoms of the data subject . ### the data subject shall have the right to object at any time to the processing of personal data which is based on points and of article 6 .


### the measures provided for in paragraph 1 shall in particular include : ### the measures provided for in paragraph 1 shall include , but not be limited to ,


### the significance and envisaged consequences of such processing , at least in the case of measures referred to in article 20 . ### in the case of decisions referred to in article 20 , knowledge of the logic involved in any automatic data processing , the significance and envisaged consequences of such processing .


### the supervisory authority shall impose a fine up to 1 000 000 eur or , in case of an enterprise up to 2 % of its annual worldwide turnover , to anyone who , intentionally or negligently : ### the supervisory authority may impose a fine up to 1 000 000 eur to anyone who , intentionally :


### the controller shall establish procedures for providing the information referred to in article 14 and for the exercise of the rights of data subjects referred to in article 13 and articles 15 to 19 . the controller shall provide in particular mechanisms for facilitating the request for the actions referred to in article 13 and articles 15 to 19 . where personal data are processed by automated means , the controller shall also provide means for requests to be made electronically . ### the controller shall establish procedures for providing the information referred to in article 14 and for the exercise of the rights of data subjects referred to in article 13 and articles 15 to 19 . where the data subject wishes to exercise the rights referred to in article 13 and articles 15 - 19 he shall make a request to this effect to the controller by a personally signed or otherwise comparable verified document .


### consent shall not provide a legal basis for the processing , where there is a significant imbalance between the position of the data subject and the controller . ### consent shall not provide a legal basis for the processing , where there is a significant imbalance between the position of the data subject and the controller , or where the processing of data for a purpose is disproportionate in relation to the obtained consent .


### having regard to the state of the art and the cost of implementation , the controller shall , both at the time of the determination of the means for processing and at the time of the processing itself , implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject . ### having regard to the state of the art , the cost of implementation and international best practice , the controller shall , both at the time of the determination of the means for processing and at the time of the processing itself , implement appropriate measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject . notwithstanding the first subparagraph , the controller shall only be burdened with measures that are proportionate to the risk of data processing reflected by the nature of the personal data to be processed .


### kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ; personal data may be stored for longer periods insofar as the data will be processed solely for historical , statistical or scientific research purposes in accordance with the rules and conditions of article 83 and if a periodic review is carried out to assess the necessity to continue the storage ; ### kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ; personal data may be stored for longer periods insofar as the data will be processed solely for historical , statistical or scientific purposes in accordance with the rules and conditions of article 83 and if a periodic review is carried out to assess the necessity to continue the storage ;


### other reasons of public interest in areas such as social protection , especially in order to ensure the quality and cost - effectiveness of the procedures used for settling claims for benefits and services in the health insurance system . ### other reasons of public interest in areas such as social protection , especially in order to ensure the quality and cost - effectiveness of the procedures used for settling claims for benefits and services in the health insurance system and the provision of health services .


### where the supervisory authority is of the opinion that the intended processing does not comply with this regulation , in particular where risks are insufficiently identified or mitigated , it shall prohibit the intended processing and make appropriate proposals to remedy such incompliance . ### where the supervisory authority is of the opinion that the intended processing referred to in paragraph 2 would not comply with this regulation it shall within a maximum period of 6 weeks following the request for consultation make appropriate recommendations to the data controller . this period may be extended for a further month , taking into account the complexity of the intended processing . where the extended period applies , the controller of processor shall be informed within one month of receipt of the request of the reasons for the delay .


### the controller shall document any personal data breaches , comprising the facts surrounding the breach , its effects and the remedial action taken . this documentation must enable the supervisory authority to verify compliance with this article . the documentation shall only include the information necessary for that purpose . ### the controller shall document any personal data breaches , comprising the facts surrounding the breach , its effects and the remedial action taken . this documentation must be sufficient to enable the supervisory authority to verify compliance with this article . the documentation shall only include the information necessary for that purpose .


### in the case of a personal data breach , the controller shall without undue delay and , where feasible , not later than 24 hours after having become aware of it , notify the personal data breach to the supervisory authority . the notification to the supervisory authority shall be accompanied by a reasoned justification in cases where it is not made within 24 hours . ### in the case of a personal data breach relating to special categories of personal date , personal data which are subject to professional secrecy , personal data relating to criminal offences or to the suspicion of a criminal act or personal data relating to bank or credit card accounts , which seriously threaten the rights or legitimate interests of the data subject , the controller shall without undue delay notify the personal data breach to the supervisory authority .


### where more than one controller or processor is involved in the processing , each controller or processor shall be jointly and severally liable for the entire amount of the damage . ### where more than one controller is involved in the processing , each controller shall be jointly and severally liable for the entire amount of the damage to the extent that the joint controllers ' respective liability has not been determined in the legal arrangement referred to in article 24 . in the case of a group of undertakings , the entire group shall be liable as a single economic entity .


### enlist another processor only with the prior permission of the controller ; ### determine the conditions for enlisting another processor , such as the need of specific or general prior permission of the controller , or the need of written agreement imposing the same obligations on the subprocessor as are imposed on the processor under this regulation ;


### the controller shall provide the information referred to in paragraphs 1 , 2 and 3 : at the time when the personal data are obtained from the data subject ; or where the personal data are not collected from the data subject , at the time of the recording or within a reasonable period after the collection , having regard to the specific circumstances in which the data are collected or otherwise processed , or , if a disclosure to another recipient is envisaged , and at the latest when the data are first disclosed . ### if the personal data are not collected from the data subject , the indirect controller shall , at the minimum , inform the direct controller of the purposes for which he is processing the personal data , stating his identity and contact details . this shall be done at the time when the personal data are collected or within a reasonable period thereafter , taking into account the specific circumstances in which the data are collected or otherwise processed . article 20 shall apply in addition to this provision .


### the controller or the processor shall entrust the data protection officer at least with the following tasks : ### the controller or the processor shall entrust the data protection organisation or the data protection officer at least with the following tasks :


### the data subject shall have the right to obtain from the controller the erasure of personal data relating to them and the abstention from further dissemination of such data , especially in relation to personal data which are made available by the data subject while he or she was a child , where one of the following grounds applies : ### the data subject shall have the right to obtain from the controller the erasure of personal data relating to them and the abstention from further dissemination of such data . there is no other legal ground for processing than the data subject ' s consent and one of the following grounds applies :


### if the data processed by a controller do not permit the controller to identify a natural person , the controller shall not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this regulation . ### if the data processed by a controller do not permit the controller , through means used by the controller , to identify a natural person , the controller shall not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this regulation .


### member states shall provide for exemptions or derogations from the provisions on the general principles in chapter ii , the rights of the data subject in chapter iii , on controller and processor in chapter iv , on the transfer of personal data to third countries and international organisations in chapter v , the independent supervisory authorities in chapter vi and on co - operation and consistency in chapter vii for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression . ### chapter ii , chapter iii , chapter iv , chapter v , chapter vi , , chapter vii as well as articles 73 , 74 , 76 and 79 of chapter viii shall not apply to the processing of personal data carried out for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression .


### processing of data relating to criminal convictions or related security measures is carried out either under the control of official authority or when the processing is necessary for compliance with a legal or regulatory obligation to which a controller is subject , or for the performance of a task carried out for important public interest reasons , and in so far as authorised by union law or member state law providing for adequate safeguards . a complete register of criminal convictions shall be kept only under the control of official authority . ### processing of data relating to criminal convictions or related security measures is carried out either subject to the conditions and safeguards referred to in article 83a or under the supervision of a supervisory authority or when the processing is necessary for compliance with or to avoid a breach of a legal or regulatory obligation or collective agreements on the labour market to which a controller is subject , or for the performance of a task carried out for important public interest reasons , and in so far as authorised by union law or member state law providing for adequate safeguards for the fundamental rights of the data subject . a complete register of criminal convictions shall be kept only under the control of official authority .


### the controller or processor shall provide the supervisory authority with the data protection impact assessment provided for in article 33 and , on request , with any other information to allow the supervisory authority to make an assessment of the compliance of the processing and in particular of the risks for the protection of personal data of the data subject and of the related safeguards . ### the controller shall provide the supervisory authority with the data protection impact assessment provided for in article 33 and , on request , with any other information to allow the supervisory authority to make an assessment of the compliance of the processing and in particular of the risks for the protection of personal data of the data subject and of the related safeguards .


### where the personal data are not collected from the data subject , the controller shall inform the data subject , in addition to the information referred to in paragraph 1 , from which source the personal data originate . ### where the personal data are collected from the data subject , the direct controller shall , at the time when the data are collected or immediately thereafter , inform the data subject , in addition to the information referred to in paragraph 1 , whether the provision of personal data is obligatory or voluntary , as well as the possible consequences of failure to provide such data ; the direct controller shall , after the first communication pursuant to paragraph 3 , provide the information pursuant to paragraph 1 once a year , provided that changes have occurred in the information since it was last communicated .


### the supervisory authority shall impose a fine up to 1 000 000 eur or , in case of an enterprise up to 2 % of its annual worldwide turnover , to anyone who , intentionally or negligently : ### the supervisory authority shall , based on the gravity of the breach , impose a fine or warning to anyone who , intentionally or negligently :


### is carried out in the course of the entering into , or performance of , a contract , where the request for the entering into or the performance of the contract , lodged by the data subject , has been satisfied or where suitable measures to safeguard the data subject ' s legitimate interests have been adduced , such as the right to obtain human intervention ; or ### is necessary for the entering into , or performance of , a contract , where the request for the entering into or the performance of the contract , lodged by the data subject , has been satisfied , or where suitable measures to safeguard the data subject ' s legitimate interests have been adduced , such as the right to obtain human intervention ; or


### every natural person shall have the right not to be subject to a measure which produces legal effects concerning this natural person or significantly affects this natural person , and which is based solely on automated processing intended to evaluate certain personal aspects relating to this natural person or to analyse or predict in particular the natural person ' s performance at work , economic situation , location , health , personal preferences , reliability or behaviour . ### every data subject shall have the right to request not to be subject to a measure which adversely affects this data subject and which is based solely on automated processing of data intended to evaluate , analyse or predict the data subject ' s performance at work , economic situation , location , health , personal preferences , reliability or behaviour .


### the controller or the processor shall designate a data protection officer for a period of at least two years . the data protection officer may be reappointed for further terms . during their term of office , the data protection officer may only be dismissed , if the data protection officer no longer fulfils the conditions required for the performance of their duties . ### the controller or the processor shall designate a data protection officer for a period of at least two years . the data protection officer may be reappointed for further terms .


### the data subject withdraws consent on which the processing is based according to point of article 6 , or when the storage period consented to has expired , and where there is no other legal ground for the processing of the data ; ### the data subject withdraws consent on which the processing is based according to point of article 6 , or when the retention period consented to has expired , and where there is no other legal ground for the processing or storage of the data ;


### the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected , having regard to the state of the art and the costs of their implementation . ### having regard to the state of technological development and the cost of implementation , the controller must implement appropriate technical and organisational measures to ensure a level of security in relation to the processing personal data that is appropriate to : the harm that might result from unauthorised or unlawful processing or accidental loss , destruction or damage as mentioned in article 5 , and the nature and scope of the data to be processed .


### the controller shall carry out the erasure without delay , except to the extent that the retention of the personal data is necessary : ### the controller or processor and , where applicable , the third party shall carry out the erasure without delay , except to the extent that the retention of the personal data is necessary :


### where the supervisory authority is of the opinion that the intended processing does not comply with this regulation , in particular where risks are insufficiently identified or mitigated , it shall prohibit the intended processing and make appropriate proposals to remedy such incompliance . ### where the competent supervisory authority determines in accordance with its power that the intended processing does not comply with this regulation , in particular where risks are insufficiently identified or mitigated , it shall prohibit the intended processing and make appropriate proposals to remedy such incompliance . such a decision shall be subject to appeal in a competent court and it may not be enforceable while being appealed unless the processing results in immediate serious harm suffered by data subjects .


### the data subject shall have the right to obtain from the controller communication of the personal data undergoing processing . where the data subject makes the request in electronic form , the information shall be provided in electronic form , unless otherwise requested by the data subject . ### to verify the lawfulness of the processing the data subject shall have the right to obtain from the controller communication of the personal data undergoing processing . where the data subject makes the request in electronic form , the information shall be provided in electronic form , unless otherwise requested by the data subject .


### each supervisory authority shall have the power to bring violations of this regulation to the attention of the judicial authorities and to engage in legal proceedings , in particular pursuant to article 74 and article 75 . ### the competent supervisory authority shall have the power to bring violations of this regulation to the attention of the judicial authorities and to engage in legal proceedings , in particular pursuant to article 74 and article 75 .


### if the data processed by a controller do not permit the controller to identify a natural person , the controller shall not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this regulation . ### if the data processed by a controller do not permit the controller , through means used by the controller to identify a data subject , in particular when rendered anonymous or pseudonymous , the controller shall not acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this regulation . the controller of research databases shall provide general information on the original data sources of the research database .


### the information and the actions taken on requests referred to in paragraph 1 shall be free of charge . where requests are manifestly excessive , in particular because of their repetitive character , the controller may charge a fee for providing the information or taking the action requested , or the controller may not take the action requested . in that case , the controller shall bear the burden of proving the manifestly excessive character of the request . ### the information and the actions taken on requests referred to in paragraph 1 shall be free of charge . where requests are manifestly excessive , in particular because of their repetitive character , the controller may charge a reasonable fee for providing the information or taking the action requested . in that case , the controller shall bear the burden of proving the manifestly excessive character of the request .


### where more than one controller or processor is involved in the processing , each controller or processor shall be jointly and severally liable for the entire amount of the damage . ### where more than one controller is involved in the processing , each controller shall be jointly and severally liable for the entire amount of the damage to the extent that the joint controllers ' respective liability has not been determined in the legal arrangement referred to in article 24 . in the case of a group of undertakings , the entire group shall be liable as a single economic entity .


### the controller or processor acting on the controller ' s behalf shall consult the supervisory authority prior to the processing of personal data in order to ensure the compliance of the intended processing with this regulation and in particular to mitigate the risks involved for the data subjects where : ### the controller shall consult the supervisory authority prior to the processing of personal data in order to ensure the compliance of the intended processing with this regulation where :


### where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature , their scope or their purposes , the controller or the processor acting on the controller ' s behalf shall carry out an assessment of the impact of the envisaged processing operations on the protection of personal data . ### where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature , their scope or their purposes , the controller shall carry out an assessment of the impact of the envisaged processing operations on the protection of personal data . a single assessment shall be sufficient to address a set of processing operations that present similar risks .


### the controller shall adopt policies and implement appropriate measures to ensure and be able to demonstrate that the processing of personal data is performed in compliance with this regulation . ### having regard to the state of the art , the nature of personal data processing and the type of the organization , both at the time of the determination of the means for processing and at the time of the processing itself , appropriate and demonstrable technical and organizational measures should be implemented in such a way that the processing will meet the requirements of this regulation and ensures the protection of the rights of the data subject by design .


### the controller shall adopt policies and implement appropriate measures to ensure and be able to demonstrate that the processing of personal data is performed in compliance with this regulation . ### the controller shall adopt policies and implement appropriate measures to ensure and be able to demonstrate in a transparent manner that the processing of personal data is performed in compliance with this regulation . accountability will always remain with the management .


### communicate the identity and contact details of the data protection officer or other contact point where more information can be obtained ; ### communicate the contact details of the controller or other contact point where more information can be obtained ;


### assist the controller in ensuring compliance with the obligations pursuant to articles 30 to 34 ; ### insofar as this is possible given the nature of processing , the information available to the processor and his ability to assist with reasonable effort , an agreement on how compliance will be ensured with the obligations pursuant to articles 30 to 34 ;


### where the appropriate safeguards with respect to the protection of personal data are not provided for in a legally binding instrument , the controller or processor shall obtain prior authorisation for the transfer , or a set of transfers , or for provisions to be inserted into administrative arrangements providing the basis for such transfer . such authorisation by the supervisory authority shall be in accordance with point of article 34 . if the transfer is related to processing activities which concern data subjects in another member state or other member states , or substantially affect the free movement of personal data within the union , the supervisory authority shall apply the consistency mechanism referred to in article 57 . authorisations by a supervisory authority on the basis of article 26 of directive 95 / 46 / ec shall remain valid , until amended , replaced or repealed by that supervisory authority . ### authorisations by a supervisory authority on the basis of article 26 of directive 95 / 46 / ec shall remain valid for two years after the entry into force of this regulation , or until amended , replaced or repealed by that supervisory authority .


### consent shall not provide a legal basis for the processing , where there is a significant imbalance between the position of the data subject and the controller . ### consent shall not as a rule provide a legal basis for the processing of personal data in case where there is a significant imbalance in terms of dependence between the position of the data subject and the controller .


### keeping the documentation pursuant to article 28 ; ### independent management oversight of processing of personal data to ensure the existence and effectiveness of the technical and organizational measures ;


### within the limits of this regulation , personal data may be processed for historical , statistical or scientific research purposes only if : ### within the limits of this regulation , personal data may be processed for historical , statistical or scientific purposes only if :


### member states shall provide for exemptions or derogations from the provisions on the general principles in chapter ii , the rights of the data subject in chapter iii , on controller and processor in chapter iv , on the transfer of personal data to third countries and international organisations in chapter v , the independent supervisory authorities in chapter vi and on co - operation and consistency in chapter vii for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression . ### chapter ii , chapter iii , chapter iv , chapter v , chapter vi , chapter vii as well as articles 73 , 74 , 76 and 79 of chapter viii shall not apply to the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression .


### the controller or the processor shall ensure that the data protection officer is properly and in a timely manner involved in all issues which relate to the protection of personal data . ### the controller or the processor shall ensure that the data protection officer or officers are properly and in a timely manner involved in issues which relate to the protection of personal data .


### right to be forgotten and to erasure ### right to erasure


### is carried out in the course of the entering into , or performance of , a contract , where the request for the entering into or the performance of the contract , lodged by the data subject , has been satisfied or where suitable measures to safeguard the data subject ' s legitimate interests have been adduced , such as the right to obtain human intervention ; or ### is necessary for the performance of a contract to which the data subject is a party , or for the implementation of pre - contractual measures taken at the request of the data subject , provided that suitable measures to safeguard the data subject ' s legitimate interests have been adduced , such as the right to obtain human intervention ; or


### the significance and envisaged consequences of such processing , at least in the case of measures referred to in article 20 . ### the significance and envisaged consequences of such processing .


### subject to the other provisions of this regulation , a person may be subjected to a measure of the kind referred to in paragraph 1 only if the processing : is carried out in the course of the entering into , or performance of , a contract , where the request for the entering into or the performance of the contract , lodged by the data subject , has been satisfied or where suitable measures to safeguard the data subject ' s legitimate interests have been adduced , such as the right to obtain human intervention ; or is expressly authorized by a union or member state law which also lays down suitable measures to safeguard the data subject ' s legitimate interests ; or is based on the data subject ' s consent , subject to the conditions laid down in article 7 and to suitable safeguards . ### subject to the other provisions of this regulation , a data subject may be subject to a decision of the kind referred to in paragraph 1 if the processing : is authorized by a union or member state law which also lays down suitable measures to safeguard the data subject ' s legitimate interests ; or is lawful pursuant to points to of article 6 of this regulation ; with due regard to article 9 , paragraph 2 , profiling shall not have the effect of discriminating against individuals on the basis , for instance , of race or ethnic origin , religion or sexual orientation .


### the data subject shall have the right to obtain from the controller the erasure of personal data relating to them and the abstention from further dissemination of such data , especially in relation to personal data which are made available by the data subject while he or she was a child , where one of the following grounds applies : ### the data subject shall have the right to obtain from the controller and the processor the erasure of personal data relating to them and the abstention from further dissemination of such data and , where applicable , from third parties the erasure of any links to , or copy or replication of that personal data , where one of the following grounds applies :


### the controller and the processor shall designate a data protection officer in any case where : ### the controller and the processor shall designate a data protection organisation or data protection officer in any case where :


### the existence of the right to request from the controller access to and rectification or erasure of the personal data concerning the data subject or to object to the processing of such personal data ; ### the existence of the right to request from the controller access to and rectification , to be forgotten or erasure of the personal data concerning the data subject or to object to the processing of such personal data or to obtain data portability ;


### the data subject shall have the right to obtain from the controller at any time , on request , confirmation as to whether or not personal data relating to the data subject are being processed . where such personal data are being processed , the controller shall provide the following information : ### the data subject shall have the right to obtain from every controller at any time , on request , confirmation as to whether or not personal data relating to the data subject are being processed . the confirmation shall , at the minimum , include the following information :


### in order to ensure correct and consistent application of this regulation , the commission may request that any matter shall be dealt with in the consistency mechanism . ### in order to ensure correct and consistent application of this regulation , the commission may , acting on its own behalf , and shall at the request of a stakeholder , request that any matter shall be dealt with in the consistency mechanism .


### the controller shall carry out the erasure without delay , except to the extent that the retention of the personal data is necessary : ### the controller shall carry out the erasure without undue delay , except to the extent that the retention and dissemination of the personal data is necessary :


### the commission may lay down standard forms and specifying standard procedures for the communication referred to in paragraph 2 , including the electronic format . in doing so , the commission shall take the appropriate measures for micro , small and medium - sized enterprises . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the commission may specify standard procedures for the communication referred to in paragraph 2 . in doing so , the commission shall take the appropriate measures for micro , small and medium - sized enterprises . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 .


### the administrative sanction shall be in each individual case effective , proportionate and dissuasive . the amount of the administrative fine shall be fixed with due regard to the nature , gravity and duration of the breach , the intentional or negligent character of the infringement , the degree of responsibility of the natural or legal person and of previous breaches by this person , the technical and organisational measures and procedures implemented pursuant to article 23 and the degree of co - operation with the supervisory authority in order to remedy the breach . ### the administrative sanction shall be in each individual case effective , proportionate and dissuasive . the amount of the administrative fine shall be fixed with due regard to the nature , gravity and duration of the breach , the sensitivity of the personal data at issue , the intentional or negligent character of the infringement , the degree of harm or risk of significant harm created by the violation , the degree of responsibility of the natural or legal person and of previous breaches by this person , the technical and organisational measures and procedures implemented pursuant to article 23 and the degree of co - operation with the supervisory authority in order to remedy the breach . while some discretion is granted in the imposition of such sanctions to take into account the circumstances outlined above and other facts specific to the situation , divergences in the application of administrative sanctions may be subject to review pursuant to the consistency mechanism .


### automated processing of personal data intended to evaluate certain personal aspects relating to a natural person shall not be based solely on the special categories of personal data referred to in article 9 . ### profiling activities relating to a natural person shall not include or generate any data that fall under the special categories of personal data referred to in article 9 , except when falling within the exceptions listed in article 9 .


### ‘ representative’ means any natural or legal person established in the union who , explicitly designated by the controller , acts and may be addressed by any supervisory authority and other bodies in the union instead of the controller , with regard to the obligations of the controller under this regulation ; ### ‘ representative’ means any natural or legal person established in the union who , explicitly designated by the controller , acts instead of the controller , with regard to the obligations of the controller under this regulation ;


### a transfer based on standard data protection clauses or binding corporate rules as referred to in points , or of paragraph 2 shall not require any further authorisation . ### a transfer based on standard data protection clauses or binding corporate rules as referred to in points , or of paragraph 2 , a single legally binding document as referred to in paragraph 3 or between groups of undertakings with binding corporate rules shall be deemed to comply with paragraph 1 of this article and shall not require any consultation with , submission to , approval or authorisation by supervisory authorities .


### the controller and the processor shall , following an evaluation of the risks , take the measures referred to in paragraph 1 to protect personal data against accidental or unlawful destruction or accidental loss and to prevent any unlawful forms of processing , in particular any unauthorised disclosure , dissemination or access , or alteration of personal data . ### the measures referred to in paragraph 1 shall at least : ensure that personal data can be accessed only by authorised personnel for legally authorised purposes ; protect personal data stored or transmitted against accidental or unlawful destruction , accidental loss or alteration , and unauthorised or unlawful storage , processing , access or disclosure ; and ensure the implementation of a security policy with respect to the processing of personal data .


### is carried out in the course of the entering into , or performance of , a contract , where the request for the entering into or the performance of the contract , lodged by the data subject , has been satisfied or where suitable measures to safeguard the data subject ' s legitimate interests have been adduced , such as the right to obtain human intervention ; or ### is necessary for the entering into , or performance of , a contract , where the request for the entering into or the performance of the contract , lodged by the data subject , has been satisfied , or where suitable measures to safeguard the data subject ' s legitimate interests have been adduced , including the right to be provided with meaningful information about the logic used in the profiling , and the right to obtain human intervention , including an explanation of the decision reached after such intervention ; or


### where a controller determines the purposes , conditions and means of the processing of personal data jointly with others , the joint controllers shall determine their respective responsibilities for compliance with the obligations under this regulation , in particular as regards the procedures and mechanisms for exercising the rights of the data subject , by means of an arrangement between them . ### where a controller determines the purposes , conditions and means of the processing of personal data jointly with others , he and they shall be joint data controllers . where this regulation does not impose any particular obligations on the data controllers who are directly and indirectly responsible for the operation , the joint controllers shall determine their respective responsibilities for compliance with the obligations under this regulation , in particular as regards the procedures and mechanisms for exercising the rights of the data subject , by means of an arrangement between them .


### the controller or processor shall ensure that the data protection officer performs the duties and tasks independently and does not receive any instructions as regards the exercise of the function . the data protection officer shall directly report to the management of the controller or the processor . ### the data protection organisation or data protection officer shall perform his or her duties and tasks independently and shall directly report to the management of the controller or the processor .


### where more than one controller or processor is involved in the processing , each controller or processor shall be jointly and severally liable for the entire amount of the damage . ### where more than one controller is involved in the processing , each controller shall be liable only to the extent that he is responsible for the event giving rise to the damage and that liability has not already been established in the determination or responsibilities envisaged in article 24 .


### the controller shall adopt policies and implement appropriate measures to ensure and be able to demonstrate that the processing of personal data is performed in compliance with this regulation . ### having regard to the state of the art , the nature of personal data processing and the type of the organisation , both at the time of the determination of the means for processing and at the time of the processing itself , appropriate and demonstrable technical and organisational measures shall be implemented in such a way that the processing will meet the requirements of this regulation and ensures the protection of the rights of the data subject by design .


### the law of the member state must meet an objective of public interest or must be necessary to protect the rights and freedoms of others , respect the essence of the right to the protection of personal data and be proportionate to the legitimate aim pursued . ### the law of the member state must meet an objective of public interest or must be necessary to protect the rights and freedoms of others . the law of the member state must also respect this regulation and international treatises that the member state has decided to follow . finally the member state is obliged to evaluate and decide if national legislation is proportionate to the legitimate aim pursued or if a legitimate aim could be achieved using less privacy invasive solutions .


### the rule of law , relevant legislation in force , both general and sectoral , including concerning public security , defence , national security and criminal law , the professional rules and security measures which are complied with in that country or by that international organisation , as well as effective and enforceable rights including effective administrative and judicial redress for data subjects , in particular for those data subjects residing in the union whose personal data are being transferred ; ### the rule of law , relevant legislation in force , including concerning public security , defence , national security and criminal law as well as the implementation of this legislation , the professional rules and security measures which are complied with in that country or by that international organisation , as well as effective and enforceable rights including effective administrative and judicial redress for data subjects , in particular for those data subjects residing in the union whose personal data are being transferred ;


### for the purposes of this regulation , in relation to the offering of information society services directly to a child , the processing of personal data of a child below the age of 13 years shall only be lawful if and to the extent that consent is given or authorised by the child ' s parent or custodian . the controller shall make reasonable efforts to obtain verifiable consent , taking into consideration available technology . ### for the purposes of this regulation , in relation to the offering of goods or services directly to a child , the processing of personal data of a child below the age of 13 years shall only be lawful if and to the extent that consent is given or authorised by the child ' s parent or legal representative . the controller shall make reasonable efforts to obtain verifiable consent , taking into consideration available technology . the methods to obtain verifiable consent shall not lead to the further processing of personal data which would otherwise not be necessary .


### the controller or processor shall provide the supervisory authority with the data protection impact assessment provided for in article 33 and , on request , with any other information to allow the supervisory authority to make an assessment of the compliance of the processing and in particular of the risks for the protection of personal data of the data subject and of the related safeguards . ### the controller shall provide the supervisory authority , on request , with the data protection impact assessment pursuant to article 33 and with any other information to allow the supervisory authority to make an assessment of the compliance of the processing and in particular of the risks for the protection of personal data of the data subject and of the related safeguards .


### where a controller determines the purposes , conditions and means of the processing of personal data jointly with others , the joint controllers shall determine their respective responsibilities for compliance with the obligations under this regulation , in particular as regards the procedures and mechanisms for exercising the rights of the data subject , by means of an arrangement between them . ### where several controllers share personal data by determining the purposes and means of the processing of personal data jointly , the joint controllers shall equally fulfil their responsibilities for compliance with the obligations under this regulation , in particular as regards the procedures and mechanisms for exercising the rights of the data subject , by means of an arrangement between them .


### in exceptional circumstances , where a supervisory authority considers that there is an urgent need to act in order to protect the interests of data subjects , in particular when the danger exists that the enforcement of a right of a data subject could be considerably impeded by means of an alteration of the existing state or for averting major disadvantages or for other reasons , by way of derogation from the procedure referred to in article 58 , it may immediately adopt provisional measures with a specified period of validity . the supervisory authority shall , without delay , communicate those measures , with full reasons , to the european data protection board and to the commission . ### in exceptional circumstances , where a supervisory authority considers that there is an urgent need to act in order to protect the interests of data subjects , when the danger exists that the enforcement of a right of a data subject could be considerably impeded by means of an alteration of the existing state or for averting major disadvantages , by way of derogation from the procedure referred to in article 58 , it may immediately adopt provisional measures with a specified period of validity . this supervisory authority shall , without delay , communicate those measures , with full reasons , to the competent supervisory authority , the european data protection board , the commission and the controller or processor concerned .


### every natural person shall have the right not to be subject to a measure which produces legal effects concerning this natural person or significantly affects this natural person , and which is based solely on automated processing intended to evaluate certain personal aspects relating to this natural person or to analyse or predict in particular the natural person ' s performance at work , economic situation , location , health , personal preferences , reliability or behaviour . ### every data subject shall have the right to request not to be subject to a measure which adversely affects this data subject and which is based solely on automated processing of data intended to evaluate , analyse or predict the data subject ' s performance at work , economic situation , location , health , personal preferences , reliability or behaviour .


### each supervisory authority shall promote the awareness of the public on risks , rules , safeguards and rights in relation to the processing of personal data . activities addressed specifically to children shall receive specific attention . ### each supervisory authority shall promote the awareness of the public on risks , rules , safeguards and rights in relation to the processing of personal data and on appropriate measures for personal protection . activities addressed specifically to children shall receive specific attention .


### where the appropriate safeguards with respect to the protection of personal data are not provided for in a legally binding instrument , the controller or processor shall obtain prior authorisation for the transfer , or a set of transfers , or for provisions to be inserted into administrative arrangements providing the basis for such transfer . such authorisation by the supervisory authority shall be in accordance with point of article 34 . if the transfer is related to processing activities which concern data subjects in another member state or other member states , or substantially affect the free movement of personal data within the union , the supervisory authority shall apply the consistency mechanism referred to in article 57 . authorisations by a supervisory authority on the basis of article 26 of directive 95 / 46 / ec shall remain valid , until amended , replaced or repealed by that supervisory authority . ### authorisations by a supervisory authority on the basis of article 26 of directive 95 / 46 / ec shall remain valid for two years after the entry into force of this regulation , or until amended , replaced or repealed by that supervisory authority .


### the controller shall provide the information referred to in paragraphs 1 , 2 and 3 : at the time when the personal data are obtained from the data subject ; or where the personal data are not collected from the data subject , at the time of the recording or within a reasonable period after the collection , having regard to the specific circumstances in which the data are collected or otherwise processed , or , if a disclosure to another recipient is envisaged , and at the latest when the data are first disclosed . ### if the personal data are not collected from the data subject , the indirect controller shall , at the minimum , inform the direct controller of the purposes for which he is processing the personal data , stating his identity and contact details . this shall be done at the time when the personal data are collected or within a reasonable period thereafter , taking into account the specific circumstances in which the data are collected or otherwise processed . article 20 shall apply in addition to this provision .


### processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller ; ### processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in the third party to which the data are transferred ;


### the supervisory authority shall impose a fine up to 500 000 eur , or in case of an enterprise up to 1 % of its annual worldwide turnover , to anyone who , intentionally or negligently : ### the supervisory authority imposes a fine up to 500 000 eur to anyone who intentionally :


### the assessment shall contain at least a general description of the envisaged processing operations , an assessment of the risks to the rights and freedoms of data subjects , the measures envisaged to address the risks , safeguards , security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this regulation , taking into account the rights and legitimate interests of data subjects and other persons concerned . ### the assessment shall contain at least a general description of the envisaged processing operations , assess the likelihood of the processing operation giving rise to harm to the fundamental rights and freedoms of data subjects or any other person , and the seriousness of any such harm , and explain the measures the controller intends to take to mitigate the chance of that harm or its seriousness , including the security measures and other safeguards and mechanisms the controller intends to put in place to ensure protection of personal data in accordance with this regulation , taking into account the rights and legitimate interests of data subjects and other persons concerned .


### associations and other bodies representing categories of controllers or processors in one member state which intend to draw up codes of conduct or to amend or extend existing codes of conduct may submit them to an opinion of the supervisory authority in that member state . the supervisory authority may give an opinion whether the draft code of conduct or the amendment is in compliance with this regulation . the supervisory authority shall seek the views of data subjects or their representatives on these drafts . ### associations and other bodies representing categories of controllers or processors in one member state which intend to draw up codes of conduct or to amend or extend existing codes of conduct may submit them to an opinion of the supervisory authority in that member state . the supervisory authority may give an opinion whether the processing under the code is in compliance with this regulation .


### the carrying out of processing by a processor shall be governed by a contract or other legal act binding the processor to the controller and stipulating in particular that the processor shall : ### the carrying out of processing by a processor shall be governed by a contract or other legal act binding the processor to the controller . the controller and the processor shall be free to determine their respective roles and responsibilities with respect to the requirements of this regulation , and shall provide for the following :


### hand over all results to the controller after the end of the processing and not process the personal data otherwise ; ### hand over all results to the controller after the end of the processing , not process the personal data otherwise and delete existing copies without prejudice to union or member state laws ;


### the communication of a personal data breach to the data subject shall not be required if the controller demonstrates to the satisfaction of the supervisory authority that it has implemented appropriate technological protection measures , and that those measures were applied to the data concerned by the personal data breach . such technological protection measures shall render the data unintelligible to any person who is not authorised to access it . ### the communication of a personal data breach to the data subject shall not be required if the data breach has not produced significant harm and the controller has implemented appropriate technological protection measures , and that those measures where applied to the data concerned by the personal data breach . such technological protection measures shall render the data unintelligible , unusable or anonymised to any person who is not authorised access to it .


### processing of personal data which is necessary for the purposes of historical , statistical or scientific research shall be lawful subject to the conditions and safeguards referred to in article 83 . ### subsequent processing of personal data which is necessary for the purposes of historical , statistical or scientific research shall be lawful subject to the conditions and safeguards referred to in article 83 .


### where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature , their scope or their purposes , the controller or the processor acting on the controller ' s behalf shall carry out an assessment of the impact of the envisaged processing operations on the protection of personal data . ### where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature , their scope or their purposes , the controller shall carry out an assessment of the impact of the envisaged processing operations on the protection of personal data . a single assessment shall be sufficient to address a set of processing operations that present similar risks . smes shall only be required to perform an impact assessment after their third year of incorporation where data processing is deemed as a core activity of their business .


### the supervisory authority shall impose a fine up to 1 000 000 eur or , in case of an enterprise up to 2 % of its annual worldwide turnover , to anyone who , intentionally or negligently : ### the supervisory authority shall , based on the gravity of the breach , impose a fine or warning to anyone who , intentionally or negligently :


### the supervisory authority shall impose a fine up to 500 000 eur , or in case of an enterprise up to 1 % of its annual worldwide turnover , to anyone who , intentionally or negligently : ### the supervisory authority shall , based on the gravity of the breach , impose a fine or a warning to anyone who , intentionally or negligently :


### within the limits of this regulation , member states may adopt by law specific rules regulating the processing of employees ' personal data in the employment context , in particular for the purposes of the recruitment , the performance of the contract of employment , including discharge of obligations laid down by law or by collective agreements , management , planning and organisation of work , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship . ### member states may , in accordance with the rules set out in this regulation , and taking into account the principle of proportionality , adopt by legal provisions specific rules regulating the processing of employees ' personal data in the employment context , in particular but not limited to the purposes of the recruitment and job applications within the group of undertakings , the performance of the contract of employment , including discharge of obligations laid down by law and by collective agreements , company agreements and collective agreements in accordance with national law and practice , management , planning and organisation of work , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship . the level of protection afforded by this regulation may not be undercut . notwithstanding the previous sentence , where arrangements are made by agreement between employee representatives and the management of the undertaking or of the controlling undertaking of a group of undertakings the level of protection afforded by this regulation may not be significantly undercut . the right of member states , or the social partners via collective agreements , to provide employees with more favourable protection provisions in respect of the processing of personal data in the employment context shall remain unaffected .