### where goods other than those covered by articles 23 and 24 are suspected of infringing an intellectual property right , the holder of the decision granting the application shall initiate proceedings to determine whether an intellectual property right has been infringed within 10 working days of dispatch of the decision to suspend the release of the goods or to detain them . in the case of perishable goods suspected of infringing an intellectual property right , the period for initiating the proceedings referred to in the first subparagraph shall be three working days of dispatch of the decision to suspend the release of the goods or to detain them . ### goods of which the release has been suspended or which have been detained according to article 16&#160 ; may be destroyed under customs control , without there being any need to determine whether an intellectual property right has been infringed under the law of the member state where the goods are found , where all of the following conditions are fulfilled : the holder of the decision granting the application has , based on the information provided to him / her according to article 16 , &#160 ; confirmed in writing to the customs authorities&#160 ; that&#160 ; an intellectual property right has been infringed , indicating&#160 ; which intellectual&#160 ; right has been infringed , within 10 working days , or three working days in the case of perishable goods , of dispatch of the decision to suspend the release of the goods or to detain them ; &#160 ; the holder of the decision granting the application has confirmed in writing to the customs authorities his / her agreement to the destruction of the goods within 10 working days , or three working days in the case of perishable goods , of dispatch of the decision to suspend the release of the goods or to detain them ; the declarant or holder of the goods has confirmed in writing to the customs authorities his / her agreement to the destruction of the goods within 10 working days , or three working days in the case of perishable goods , of dispatch of the decision to suspend the release of the goods or to detain them .


### the customs authorities shall grant the release of the goods or put an end to their detention immediately after completion of all customs formalities where they have not been informed by the holder of the decision granting the application , within the period referred to in paragraph 1 , of any of the following : the initiation of proceedings to determine whether an intellectual property right has been infringed ; a written agreement between the holder of the decision granting the application and the holder of the goods to abandon the goods for destruction . ### where the declarant or holder of the goods within the periods set out in point of paragraph 1 has not confirmed his / her agreement to destruction nor notified his / her opposition to destruction to the customs authorities that adopted the decision to suspend the release of the goods or to detain them , the customs authorities shall deem that the declarant or holder of the goods has agreed to their destruction .


### in the case of an agreement to abandon the goods for destruction referred to in paragraph 2 , the destruction shall be carried out under customs control at the expense and under the responsibility of the holder of the decision granting the application , unless otherwise specified in the legislation of the member state where the goods are destroyed . ### the destruction shall be carried out under customs control , at the expense and under the responsibility of the holder of the decision granting the application , unless otherwise specified in the legislation of the member state where the goods are destroyed . samples may be taken prior to destruction .


### the customs authorities may extend the period referred to in the first subparagraph of paragraph 1 by a maximum of 10 working days upon request by the holder of the decision granting the application in appropriate cases . in the case of perishable goods , the period referred to in the second subparagraph of paragraph 1 shall not be extended . ### where there is no agreement to destruction or the declarant or the holder of the goods objects to destruction , the holder of the decision granting the application shall initiate proceedings to determine whether an intellectual property right has been infringed within 20 working days , or three working days in the case of perishable goods , of dispatch of the decision to suspend the release of the goods or to detain them .


### the customs authorities may allow the goods referred to in paragraph 1 to be moved under customs supervision between different places within the customs territory of the union with a view to their destruction under customs control . ### the customs authorities may allow the goods referred to in paragraph 1 to be moved under customs supervision between different places within the customs territory of the union with a view to their destruction under customs control or their use for education and exhibition purposes accompanied by appropriate security measures .


### the goods concerned may be destroyed where , within 20 working days of dispatch of the decision to suspend the release of the goods or to detain them , the declarant or holder of the goods has confirmed to the customs authorities his / her agreement to the destruction of the goods . ### the goods concerned may be destroyed where the declarant or holder of the goods has confirmed in writing to the customs authorities his / her agreement to the destruction of the goods . the destruction shall be carried out under customs control at the expense of the holder of the decision granting the application .


### where the declarant or holder of the goods objects to the destruction of the goods , the customs authorities shall inform the holder of the decision granting the application of such objection and of the number of items and their nature , including images of those items where appropriate . ### where the declarant or holder of the goods within 15 working days of dispatch of the decision to suspend the release of the goods or to detain them has not confirmed his / her agreement to destruction or notified his / her opposition to destruction , the customs authorities shall inform the holder of the decision granting the application of such missing agreement or objection and of the number of items and their nature , including images of those items where appropriate .


### committee , delegation and final provisions ### committee and final provisions


### all information referred to in paragraphs 1 and 2 shall be stored in a central database of the commission . ### all information referred to in paragraphs 1 and 2 shall be stored in a central database of the commission . in order to establish a legal basis for that database , the commission shall adopt a separate proposal for adoption under the ordinary legislative procedure within one year after entry into force of this regulation . when preparing its proposal , the commission shall consult the european data protection supervisor . the database shall be operational not later than 1 january 2015 .


### the commission shall make the relevant information referred to in paragraphs 1 and 2 available to the customs authorities of the member states in an electronic form . ### the commission shall make the relevant information referred to in paragraphs 1 and 2 available to the customs authorities of the member states in an electronic form as soon as possible and not later than 1 january 2015 .


### entry into force and application ### entry into force and reporting


### the scope of the eit contribution to the knowledge and innovation communities should be defined and the origins of kics ' financial resources clarified . ### the scope of the eit contribution to the knowledge and innovation communities should be defined and the origins of kics ' financial resources clarified . in particular , eu funding should be considered as leverage to encourage kics to pursue other sources of private or public funding , and a review of the use of eu funding as leverage should be considered in future by eu institutions .


### the composition of the eit bodies should be simplified . the functioning of the eit governing board should be streamlined and the respective roles and tasks of the governing board and the director should be further clarified . ### the composition of the eit bodies should be simplified . the functioning of the eit governing board should be streamlined and the respective roles and tasks of the governing board and the director should be further clarified . the governing board and the director must act in the interests of the eit in an independent , impartial and transparent way .


### the eit triennial work programme should take into account the commission ' s opinion concerning the eit ' s specific objectives , as defined in horizon 2020 , and its complementarities with european union policies and instruments . ### the eit triennial work programme should take into account the opinions of the commission , the european parliament and the council concerning the eit ' s specific objectives , as defined in horizon 2020 , and its complementarities with european union policies and instruments . these three eu institutions should be adequately involved when this programme is established .


### a rolling triennial work programme , based on the sia , once it is adopted , containing a statement of the major priorities and planned initiatives of the eit and the kics , including an estimate of financing needs and sources . it shall also contain appropriate indicators for monitoring the kics and eit activities . the preliminary rolling triennial work programme shall be submitted by the eit to the commission by 31 december each n - 2 . the commission shall deliver an opinion within three months with regard to eit specific objectives as defined in horizon 2020 and its complementarities with union policies and instruments . the eit shall take a due account of the commission opinion , and in case of disagreement justify its position . the final work programme shall be transmitted by the eit to the european parliament , the council , the commission , the european economic and social committee and the committee of the regions for information ; ### a rolling triennial work programme , based on the sia , once it is adopted , containing a statement of the major priorities and planned initiatives of the eit and the kics , including an estimate of financing needs and sources , and a review of the financial viability of each kics . it shall also contain appropriate indicators for monitoring the kics and eit activities . the preliminary rolling triennial work programme shall be submitted by the eit to the commission by 31 december each n - 2 . the commission shall deliver an opinion within three months with regard to eit specific objectives as defined in horizon 2020 and its complementarities with union policies and instruments . the eit shall take a due account of the commission opinion , and in case of disagreement justify its position . the final work programme shall be transmitted by the eit to the european parliament , the council , the commission , the european economic and social committee and the committee of the regions for information ;


### ' border control post ' means a place , and the facilities belonging to it , designated by a member state to perform the official controls provided for in article 45 ; ### ' border control post ' means an inspection centre , and the facilities belonging to it , designated by a member state to perform the official controls provided for in article 45 ;


### the activities under the control of operators ; ### the activities and precautionary measures under the control of operators ;


### competent authorities shall perform official controls on a regular basis and with appropriate frequency to identify possible intentional violations of the rules referred to in article 1 , taking into account , in addition to the criteria referred to in paragraph 1 , information regarding such possible intentional violations shared through the mechanisms of administrative assistance provided for in title iv and any other information pointing to the possibility of such violations . ### competent authorities shall perform official controls on a regular basis and with appropriate frequency to identify possible intentional violations of the rules referred to in article 1 , to verify compliance with the requirements and process criteria according to article 1 , taking into account , in addition to the criteria referred to in paragraph 1 , information regarding such possible intentional violations shared through the mechanisms of administrative assistance provided for in title iv and any other information pointing to the possibility of such violations .


### official controls on the fitness of the animals being transported and on the means of transport ; ### official controls on the fitness of the animals being transported and on the means of transport to verify compliance with chapter ii and where applicable chapter vi of annex i to regulation no 1 / 2005 ;


### the specific responsibilities and tasks of the competent authorities , in addition to those provided for in articles 4 , 8 , 9 , 10 , 11 to 13 , 34 and , and article 36 , and in addition to articles 25 , 29 , 30 and 32 for the approval and supervision of delegated bodies ; ### the specific responsibilities and tasks of the operators , the competent authorities , the delegated bodies to ensure compliance with the provisions of regulation no 834 / 2007 , in addition to those provided for in articles 4 , 8 , 9 , 10 , 11 to 13 , 34 and , and article 36 , and in addition to articles 25 , 29 , 30 and 32 for the approval and supervision of delegated bodies ;


### the commission may , by means of implementing acts , lay down rules for : ### the commission may , by means of implementing acts , insofar as these matters are not otherwise regulated , lay down rules for :


### that a sufficient number of other samples be taken for a second expert opinion ; or , ### that a sufficient number of samples be taken and divided into three parts for the purpose of an initial analysis and , if appropriate , a second expert opinion at the request of the operator , then another final analysis , if there is a discrepancy between the two previous ones ;


### competent authorities shall take all steps to ensure that the operators from whom the samples are ordered in accordance with paragraph 1 : ### competent authorities , once they are in possession of the samples , shall take all steps to ensure that the operators from whom these samples are ordered in accordance with paragraph 1 :


### operates in accordance with the standard en iso / iec 17025 on ' general requirements for the competence of testing and calibration laboratories ' and is assessed and accredited in accordance with that standard by a national accreditation body operating in accordance with regulation no 765 / 2008 . ### operates in accordance with the standard en iso / iec 17025 on ' general requirements for the competence of testing and calibration laboratories ' and is accredited in accordance with that standard by a national accreditation body operating in accordance with regulation no 765 / 2008 .


### the scope of the assessment and accreditation of an official laboratory referred to in point of paragraph 4 : ### the scope of the accreditation of an official laboratory referred to in point of paragraph 4 :


### derogations from the condition for the mandatory assessment and accreditation for certain official laboratories ### derogations from the condition for the mandatory accreditation for certain official laboratories


### temporary derogations from the condition for the mandatory assessment and accreditation of official laboratories ### temporary derogations from the condition for the mandatory accreditation of official laboratories


### that carry out the detection of trichinella under the supervision of the competent authorities or of an official laboratory designated in accordance with article 36 , and assessed and accredited in accordance with the standard en iso / iec 17025 on ‘ general requirements for the competence of testing and calibration laboratories’ for the use of the methods referred to in point of this paragraph ; ### that carry out the detection of trichinella under the supervision of the competent authorities or of an official laboratory designated in accordance with article 36 , and accredited in accordance with the standard en iso / iec 17025 on ‘ general requirements for the competence of testing and calibration laboratories’ for the use of the methods referred to in point of this paragraph ;


### powers to adopt derogations from the condition for the mandatory assessment and accreditation of all the methods of laboratory analysis , test and diagnosis used by official laboratories ### powers to adopt derogations from the condition for the mandatory accreditation of all the methods of laboratory analysis , test and diagnosis used by official laboratories


### in case of suspicion of non - compliance of consignments of the categories of animals and goods referred to in article 45 with the rules referred to in article 1 , the competent authorities shall perform official controls in order to confirm or to eliminate that suspicion . ### in case of suspicion of non - compliance of consignments of the categories of animals and goods referred to in article 45 with the rules referred to in article 1 , the competent authorities shall perform official controls or delegate the responsibility to other competent authorities in order to confirm or to eliminate that suspicion .


### having , where possible , heard the operator responsible for the consignment , the competent authorities shall , without delay , order that the operator : ### the competent authorities shall hear the operator responsible for the consignment . the competent authority may omit this if an immediate decision is necessary either because a delay would be dangerous or in the public interest . it shall , without delay , order that the operator :


### enable the identification of the person who signed them ; ### enable the identification of the person who signed them and the date of issue ;


### allow the verification of the link between the certificate and the consignment , lot or individual animal or good covered by the certificate . ### allow the easy verification of the link between the certificate , the issuing authority and the consignment , lot or individual animal or good covered by the certificate .


### coordinating the application by the national reference laboratories and , if necessary , by other official laboratories of the methods referred to in point , in particular , by organising regular inter - laboratory comparative testing and by ensuring appropriate follow - up of such comparative testing in accordance , where available , with internationally accepted protocols ; ### coordinating the application by the national reference laboratories of the methods referred to in point , in particular , by organising regular inter - laboratory comparative testing and by ensuring appropriate follow - up of such comparative testing in accordance , where available , with internationally accepted protocols and informing the competent authorities of the follow - up and results of such inter - laboratory comparative testing ;


### give all necessary assistance and provide all documentation and other technical support that commission experts request to enable them to perform controls efficiently and effectively ; ### give necessary assistance and provide documentation and other technical support for commission experts to enable them to perform controls efficiently and effectively ;


### the commission shall be assisted by the standing committee on plants , animals , food and feed established by article 58 of regulation no 178 / 2002 . that committee is a committee in the meaning of regulation no 182 / 2011 . ### the commission shall be assisted by the standing committee on plants , animals , food and feed established by article 58 of regulation no 178 / 2002 . that committee is a committee in the meaning of regulation no 182 / 2011 , except under article 23 , which requires the commission to be assisted by committees set up under regulation no 834 / 2007 on organic production , regulation no 1151 / 2012 regarding dop , pgi and tsg food product designations , regulation no 1234 / 2007 regarding dop and pgi wine designations and regulation no 110 / 2008 regarding the geographical indications of spirit drinks .


### insurance undertakings within the meaning of article 13 of directive 2009 / 138 / ec of the european parliament and of the council ; ### insurance undertakings within the meaning of article 13 of directive 2009 / 138 / ec of the european parliament and of the council ; member states may also designate other entities as public - interest entities , for instance entities that are of major public significance because of the nature of their business , their size or the number of their employees ;


### the competent authorities referred to in article 32 shall cooperate in view of achieving a convergence of the requirements set out in this article . they shall cooperate with the european securities and markets authority and the competent authorities referred to in article x of regulation [ xxx ] of [ xxx ] in so far as such convergence relates to the statutory audit of public - interest entities . ### the competent authorities referred to in article 32 shall cooperate with a view to achieving a minimum convergence of the requirements set out in this article . when engaging in such cooperation , these competent authorities shall take into account developments in auditing and the audit profession , and in particular , convergence that has already been achieved by the profession . they shall cooperate with the european securities and markets authority and the competent authorities referred to in article x of regulation [ xxx ] of [ xxx ] in so far as such convergence relates to the statutory audit of public - interest entities .


### the adaptation period shall not exceed three years and shall be subject to an assessment . ### the adaptation period shall not exceed three years and shall be subject to an assessment of professional competence achieved in national law relating to audits .


### paragraph 5 is replaced by the following : ### in paragraph 5 , the following second subparagraph is added :


### any actor in the supply chain who packages medicinal products has to be a holder of a manufacturing authorization . in order for the safety features to be effective , the manufacturing authorization holder should only be permitted to remove , replace or cover these features under strict conditions . ### any actor in the supply chain who labels or packages medicinal products or inserts changes to the labelling or packaging of medicinal products has to be a holder of a manufacturing authorization . in order for the safety features to be effective , the manufacturing authorization holder should only be permitted to remove , replace or cover these features under strict conditions . the strict conditions should provide adequate safeguards against falsified products entering the distribution chain and also reflect a strict duty of care of these manufacturing authorisation holders towards the original manufacturer and the marketing authorisation holder of the products and to consumers of the products .


### manufacturing authorisation holders shall be liable for damages in accordance with council directive 85 / 374 / eec caused by medicinal products which are falsified in terms of their identity . ### manufacturing authorisation holders referred to in paragraph 2 of this article shall be considered producers under council directive 85 / 374 / eec . they shall be liable for damages caused by medicinal products which are falsified in terms of their identity to the original manufacturer , to the holder of the marketing authorisation and to consumers .


### however , detailed rules may be agreed with the commission in order to facilitate the implementation of the union delegations ' operating appropriations entered in the eeas and the council sections of the budget . ### within the eeas a director general for budget and administration shall be responsible to the high representative / vice president of the commission for the administrative and internal budgetary management of the eeas . he shall follow the same budget lines and administrative rules as applicable in the part of section iii of the eu budget which falls under heading v of the multiannual financial framework .


### in order to guarantee the full autonomy and independence of the agency , it is considered necessary to grant it an autonomous budget whose revenue comes primarily from a contribution from the union and contributions from third countries participating in the agency ' s work . the host member state , or any other member state , should be allowed to make voluntary contributions to the revenue of the agency . the union ' s budgetary procedure remains applicable as far as any subsidies chargeable to the general budget of the european union are concerned . moreover , the court of auditors should undertake the auditing of accounts . ### in order to guarantee the full autonomy and independence of the agency and to enable it to perform additional and new tasks , it is considered necessary to grant it a sufficient and autonomous budget whose revenue comes primarily from a contribution from the union and contributions from third countries participating in the agency ' s work . the host member state , or any other member state , should be allowed to make voluntary contributions to the revenue of the agency . the union ' s budgetary procedure remains applicable as far as any subsidies chargeable to the general budget of the european union are concerned . moreover , the court of auditors should undertake the auditing of accounts .


### draft by the court of justice in order to increase the participation of all the judges in the decisions of the grand chamber of the court of justice , there should be an increase in the number of judges who may participate in the grand chamber , and the automatic participation of the presidents of chambers of five judges should cease . ### in order to provide for broader participation by all the judges and to allow them to sit more frequently in cases assigned to the grand chamber of the court of justice , there should be an increase in the number of judges who may participate in the grand chamber , and the automatic participation of the presidents of chambers of five judges should cease .


### draft by the court of justice ### the first paragraph of article 9 shall be replaced by the following : ' when , every three years , the judges are partially replaced , 20 and 19 judges shall be replaced alternately . ' .


### draft by the court of justice ### the 12 judges appointed following the entry into force of this regulation shall take up their posts immediately once they have taken the oath . six of them shall be chosen at random and their term of office shall end six years after the first partial replacement of the general court following the entry into force of this regulation . the term of office of the other six judges shall end six years after the second partial replacement of the general court following the entry into force of this regulation .


### draft by the court of justice consequently , the necessary measures should be taken to address this situation , and the possibility , provided for by the treaties , of increasing the number of judges of the general court is such as to enable both the volume of pending cases and the excessive duration of proceedings before the general court to be reduced within a short time . ### consequently , the necessary measures should be taken to address this situation , and the possibility , provided for by the treaties , of increasing the number of judges of the general court from 27 to 39 is such as to enable both the volume of pending cases and the excessive duration of proceedings before the general court to be reduced within a short time .


### article 174 of the treaty provides that , in order to strengthen its economic , social and territorial cohesion , the union shall aim at reducing disparities between the levels of development of the various regions and the backwardness of the least favoured regions or islands , particular rural areas , areas affected by industrial transition , and regions which suffer from severe and permanent natural or demographic handicaps . article 175 of the treaty requires that the union would support the achievement of these objectives by action it takes through the european agricultural guidance and guarantee fund , guidance section , the european social fund , the european regional development fund , the european investment bank and other instruments . ### article 174 of the treaty provides that , in order to strengthen its economic , social and territorial cohesion , the union shall aim at reducing disparities between the levels of development of the various regions and the backwardness of the least favoured regions . among those regions , particular attention should be paid to rural areas , areas affected by industrial transition , and regions which suffer from severe and permanent natural or demographic handicaps , such as island , cross - border and upland regions . article 175 of the treaty requires that the union would support the achievement of these objectives by action it takes through the european agricultural guidance and guarantee fund , guidance section , the european social fund , the european regional development fund , the european investment bank and other instruments .


### objective criteria should be fixed for designating eligible regions and areas for support from the funds . to this end , the identification of the regions and areas at union level should be based on the common system of classification of the regions established by regulation no 1059 / 2003 of the european parliament and the council of 26 may 2003 on the establishment of a common classification of territorial units for statistics . ### objective criteria should be fixed for designating eligible regions and areas for support from the funds . to this end , the identification of the regions and areas at union level should be based on the common system of classification of the regions established by regulation no 1059 / 2003 of the european parliament and the council of 26 may 2003 on the establishment of a common classification of territorial units for statistics 12 . particular attention should be paid to regions which suffer from severe and permanent natural or demographic handicaps , such as island , cross - border and upland regions , although it must be borne in mind that the current nuts classification does not necessarily reflect actual territorial specificities .


### responsibilities in ensuring nis lie to a great extent on public administrations and market operators . a culture of risk management , involving risk assessment and the implementation of security measures appropriate to the risks faced should be promoted and developed through appropriate regulatory requirements and voluntary industry practices . establishing a level playing field is also essential to the effective functioning of the cooperation network to ensure effective cooperation from all member states . ### responsibilities in ensuring nis lie to a great extent on public administrations and market operators . a culture of risk management , involving risk assessment and the implementation of security measures appropriate to the risks faced should be promoted and developed through appropriate regulatory requirements and voluntary industry practices . where such a culture of risk management already exists , and , in particular , where it relies on voluntary practices , it should be supported , strengthened and shared . establishing a level playing field is also essential to the effective functioning of the cooperation network to ensure effective cooperation from all member states .


### – a definition of the procedures and the criteria for the assessment of the risks and incidents by the cooperation network . ### – a definition of the criteria for the assessment of the risks and incidents by the cooperation network .


### member states shall ensure that public administrations and market operators take appropriate technical and organisational measures to manage the risks posed to the security of the networks and information systems which they control and use in their operations . having regard to the state of the art , these measures shall guarantee a level of security appropriate to the risk presented . in particular , measures shall be taken to prevent and minimise the impact of incidents affecting their network and information system on the core services they provide and thus ensure the continuity of the services underpinned by those networks and information systems . ### member states shall ensure that public administrations and market operators take appropriate and proportional technical and organisational measures to manage the risks posed to the security of the networks and information systems which they control and use in their operations . having regard to the state of the art , these measures shall guarantee a level of security appropriate to the risk presented . in particular , measures shall be taken to prevent and minimise the impact of incidents affecting their network and information system on the core services they provide and thus ensure the continuity of the services underpinned by those networks and information systems .


### the principles of protection should apply to any information concerning an identified or identifiable person . to determine whether a person is identifiable , account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the individual . the principles of data protection should not apply to data rendered anonymous in such a way that the data subject is no longer identifiable . ### the principles of protection should apply only to specific information concerning an identified or identifiable person . to determine whether a person is identifiable , account should be taken : only of those means likely reasonably to be used by the controller or by any other natural or legal person to identify the individual , and of the reasonable likeliness of a person being identified . the principles of data protection should not apply to data rendered anonymous in such a way that the data subject is no longer identifiable from the data .


### consent should be given explicitly by any appropriate method enabling a freely given specific and informed indication of the data subject ' s wishes , either by a statement or by a clear affirmative action by the data subject , ensuring that individuals are aware that they give their consent to the processing of personal data , including by ticking a box when visiting an internet website or by any other statement or conduct which clearly indicates in this context the data subject ' s acceptance of the proposed processing of their personal data . silence or inactivity should therefore not constitute consent . consent should cover all processing activities carried out for the same purpose or purposes . if the data subject ' s consent is to be given following an electronic request , the request must be clear , concise and not unnecessarily disruptive to the use of the service for which it is provided . ### consent should be given unambiguously by any appropriate method within the context of the product or service being offered enabling a freely given specific and informed indication of the data subject ' s wishes , either by a statement or by a clear affirmative action by the data subject , ensuring that individuals are aware that they give their consent to the processing of personal data , including by ticking a box when visiting an internet website or by any other statement or conduct which clearly indicates in this context the data subject ' s acceptance of the proposed processing of their personal data . silence or inactivity should therefore not constitute consent . consent should cover all processing activities carried out for the same purpose or purposes . if the data subject ' s consent is to be given following an electronic request , the request must be clear , concise and not unnecessarily disruptive to the use of the service for which it is provided .


### personal data relating to health should include in particular all data pertaining to the health status of a data subject ; information about the registration of the individual for the provision of health services ; information about payments or eligibility for healthcare with respect to the individual ; a number , symbol or particular assigned to an individual to uniquely identify the individual for health purposes ; any information about the individual collected in the course of the provision of health services to the individual ; information derived from the testing or examination of a body part or bodily substance , including biological samples ; identification of a person as provider of healthcare to the individual ; or any information on e . g . a disease , disability , disease risk , medical history , clinical treatment , or the actual physiological or biomedical state of the data subject independent of its source , such as e . g . from a physician or other health professional , a hospital , a medical device , or an in vitro diagnostic test . ### personal data relating to health should include in particular all personal data pertaining to the health status of a data subject ; information about the registration of the individual for the provision of health services ; information about payments or eligibility for healthcare with respect to the individual ; a number , symbol or particular assigned to an individual to uniquely identify the individual for health purposes ; any information about the individual collected in the course of the provision of health services to the individual ; personal data derived from the testing or examination of a body part , bodily substance or biological sample ; identification of a person as provider of healthcare to the individual ; or any information on e . g . a disease , disability , disease risk , medical history , clinical treatment , or the actual physiological or biomedical state of the data subject independent of its source , such as e . g . from a physician or other health professional , a hospital , a medical device , or an in vitro diagnostic test .


### personal data relating to health should include in particular all data pertaining to the health status of a data subject ; information about the registration of the individual for the provision of health services ; information about payments or eligibility for healthcare with respect to the individual ; a number , symbol or particular assigned to an individual to uniquely identify the individual for health purposes ; any information about the individual collected in the course of the provision of health services to the individual ; information derived from the testing or examination of a body part or bodily substance , including biological samples ; identification of a person as provider of healthcare to the individual ; or any information on e . g . a disease , disability , disease risk , medical history , clinical treatment , or the actual physiological or biomedical state of the data subject independent of its source , such as e . g . from a physician or other health professional , a hospital , a medical device , or an in vitro diagnostic test . ### personal data including genetic information relating to health should include in particular all data pertaining to the health status of a data subject ; information about the registration of the individual for the provision of health services ; information about payments or eligibility for healthcare with respect to the individual ; a number , symbol or particular assigned to an individual to uniquely identify the individual for health purposes ; any information about the individual collected in the course of the provision of health services to the individual ; information derived from the testing or examination of a body part or bodily substance , including biological samples ; identification of a person as provider of healthcare to the individual ; or any information on e . g . a disease , disability , disease risk , medical history , clinical treatment , or the actual physiological or biomedical state of the data subject independent of its source , such as e . g . from a physician or other health professional , a hospital , a medical device , or an in vitro diagnostic test .


### a group of undertakings should cover a controlling undertaking and its controlled undertakings , whereby the controlling undertaking should be the undertaking which can exercise a dominant influence over the other undertakings by virtue , for example , of ownership , financial participation or the rules which govern it or the power to have personal data protection rules implemented . ### a group of undertakings should cover a controlling undertaking and its controlled undertakings , whereby the controlling undertaking should be the undertaking which can exercise a dominant influence over the other undertakings by virtue , for example , of ownership , financial participation or the rules which govern it or the power to have personal data protection rules implemented . a group of undertakings may nominate a single main establishment in the union .


### children deserve specific protection of their personal data , as they may be less aware of risks , consequences , safeguards and their rights in relation to the processing of personal data . to determine when an individual is a child , this regulation should take over the definition laid down by the un convention on the rights of the child . ### children deserve specific protection of their personal data , as they may be less aware of risks , consequences , safeguards and their rights in relation to the processing of personal data . such protection is particularly important in the context of social networks , where children should be aware of the identities of those with whom they are communicating . to determine when an individual is a child , this regulation should take over the definition laid down by the un convention on the rights of the child .


### the processing of personal data for other purposes should be only allowed where the processing is compatible with those purposes for which the data have been initially collected , in particular where the processing is necessary for historical , statistical or scientific research purposes . where the other purpose is not compatible with the initial one for which the data are collected , the controller should obtain the consent of the data subject for this other purpose or should base the processing on another legitimate ground for lawful processing , in particular where provided by union law or the law of the member state to which the controller is subject . in any case , the application of the principles set out by this regulation and in particular the information of the data subject on those other purposes should be ensured . ### the processing of personal data for other purposes should be only allowed where the processing is compatible with those purposes for which the data have been initially collected , such as where the processing is necessary for historical , statistical or scientific purposes . where the other purpose is not compatible with the initial one for which the data are collected , the controller should obtain the consent of the data subject for this other purpose or should base the processing on another legitimate ground for lawful processing , in particular where provided by union law or the law of the member state to which the controller is subject . in any case , the application of the principles set out by this regulation and in particular the information of the data subject on those other purposes should be ensured .


### any person should have the right of access to data which has been collected concerning them , and to exercise this right easily , in order to be aware and verify the lawfulness of the processing . every data subject should therefore have the right to know and obtain communication in particular for what purposes the data are processed , for what period , which recipients receive the data , what is the logic of the data that are undergoing the processing and what might be , at least when based on profiling , the consequences of such processing . this right should not adversely affect the rights and freedoms of others , including trade secrets or intellectual property and in particular the copyright protecting the software . however , the result of these considerations should not be that all information is refused to the data subject . ### any person should have the right of access to personal data which has been collected concerning them , and to exercise this right easily , in order to be aware and verify the lawfulness of the processing . every data subject should therefore have the right to know and obtain communication in particular for what purposes the personal data are processed , for what period , which recipients receive the personal data , what is the logic of the personal data that are undergoing the processing and what might be the consequences of such processing . this right should not adversely affect the rights and freedoms of others , including trade secrets or intellectual property and in particular the copyright protecting the software . however , the result of these considerations should not be that all information is refused to the data subject .


### the controller should use all reasonable measures to verify the identity of a data subject that requests access , in particular in the context of online services and online identifiers . a controller should not retain personal data for the unique purpose of being able to react to potential requests . ### the controller should use all reasonable measures within the context of the product or service being provided , or otherwise within the context of the relationship between the controller and the data subject , and the sensitivity of the personal data being processed to verify the identity of a data subject that requests access , in particular in the context of online services and online identifiers . a controller should not retain nor be forced to gather personal data for the unique purpose of being able to react to potential requests .


### every natural person should have the right not to be subject to a measure which is based on profiling by means of automated processing . however , such measure should be allowed when expressly authorised by law , carried out in the course of entering or performance of a contract , or when the data subject has given his consent . in any case , such processing should be subject to suitable safeguards , including specific information of the data subject and the right to obtain human intervention and that such measure should not concern a child . ### unfair or discriminatory profiling shall be prohibited . as defined in article 5§2 in directive 2005 / 29 / ec on unfair commercial practices , the decision referred to in article 20 of this regulation is ' unfair ' if : it is contrary to the requirements of professional diligence , and it materially distorts or is likely to materially distort the economic behaviour with regard to the product of the average consumer whom it reaches or to whom it is addressed , or of the average member of the group when a commercial practice is directed to a particular group of consumers . the guidance on the unfair commercial practices directive issued by the european commission and the national enforcers , offers further clarifications to this definition .


### the protection of the rights and freedoms of data subjects with regard to the processing of personal data require that appropriate technical and organisational measures are taken , both at the time of the design of the processing and at the time of the processing itself , to ensure that the requirements of this regulation are met . in order to ensure and demonstrate compliance with this regulation , the controller should adopt internal policies and implement appropriate measures , which meet in particular the principles of data protection by design and data protection by default . ### to meet consumer and business expectations around the protection of the rights and freedoms of data subjects with regard to the processing of personal data , appropriate organisational measures may be taken , both at the time of the design of the processing and at the time of the processing itself , to ensure that the requirements of this regulation are met . measures having as an objective to increase consumer information and ease of choice shall be encouraged , based on industry cooperation and favouring innovative solutions , products and services .


### directive 95 / 46 / ec provided for a general obligation to notify processing of personal data to the supervisory authorities . while this obligation produces administrative and financial burdens , it did not in all cases contribute to improving the protection of personal data . therefore such indiscriminate general notification obligation should be abolished , and replaced by effective procedures and mechanism which focus instead on those processing operations which are likely to present specific risks to the rights and freedoms of data subjects by virtue of their nature , their scope or their purposes . in such cases , a data protection impact assessment should be carried out by the controller or processor prior to the processing , which should include in particular the envisaged measures , safeguards and mechanisms for ensuring the protection of personal data and for demonstrating the compliance with this regulation . ### directive 95 / 46 / ec provided for a general obligation to notify processing of personal data to the supervisory authorities . while this obligation produces administrative and financial burdens , it did not in all cases contribute to improving the protection of personal data . therefore such indiscriminate general notification obligation should be abolished , and replaced by effective procedures and mechanism which focus instead on those processing operations which are likely to present specific risks to the rights and freedoms of data subjects by virtue of their nature , their scope or their purposes . in such cases , a data protection impact assessment should be carried out by the controller prior to the processing , which should include in particular the envisaged measures , safeguards and mechanisms for ensuring the protection of personal data and for demonstrating the compliance with this regulation .


### where the processing of personal data in the context of the activities of an establishment of a controller or a processor in the union takes place in more than one member state , one single supervisory authority should be competent for monitoring the activities of the controller or processor throughout the union and taking the related decisions , in order to increase the consistent application , provide legal certainty and reduce administrative burden for such controllers and processors . ### where the processing of personal data takes place in more than one member state , one single supervisory authority should be competent for monitoring the activities of the controller or processor throughout the union and taking the related decisions , in order to increase the consistent application , provide legal certainty and reduce administrative burden for such controllers and processors .


### in order to ensure the consistent application of this regulation throughout the union , a consistency mechanism for co - operation between the supervisory authorities themselves and the commission should be established . this mechanism should in particular apply where a supervisory authority intends to take a measure as regards processing operations that are related to the offering of goods or services to data subjects in several member states , , or to the monitoring such data subjects , or that might substantially affect the free flow of personal data . it should also apply where any supervisory authority or the commission requests that the matter should be dealt with in the consistency mechanism . this mechanism should be without prejudice to any measures that the commission may take in the exercise of its powers under the treaties . ### in order to ensure the consistent application of this regulation throughout the union , a consistency mechanism for co - operation between the supervisory authorities themselves and the commission should be established . this mechanism should in particular apply where the competent supervisory authority intends to take a measure as regards processing operations that are related to the offering of goods or services to data subjects in several member states , or to the monitoring such data subjects , or that might substantially affect the free flow of personal data . it should also apply where any supervisory authority or the commission requests that the matter should be dealt with in the consistency mechanism . this mechanism should be without prejudice to any measures that the commission may take in the exercise of its powers under the treaties .


### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted in respect of lawfulness of processing ; specifying the criteria and conditions in relation to the consent of a child ; processing of special categories of data ; specifying the criteria and conditions for manifestly excessive requests and fees for exercising the rights of the data subject ; criteria and requirements for the information to the data subject and in relation to the right of access ; the right to be forgotten and to erasure ; measures based on profiling ; criteria and requirements in relation to the responsibility of the controller and to data protection by design and by default ; a processor ; criteria and requirements for the documentation and the security of processing ; criteria and requirements for establishing a personal data breach and for its notification to the supervisory authority , and on the circumstances where a personal data breach is likely to adversely affect the data subject ; the criteria and conditions for processing operations requiring a data protection impact assessment ; the criteria and requirements for determining a high degree of specific risks which require prior consultation ; designation and tasks of the data protection officer ; codes of conduct ; criteria and requirements for certification mechanisms ; criteria and requirements for transfers by way of binding corporate rules ; transfer derogations ; administrative sanctions ; processing for health purposes ; processing in the employment context and processing for historical , statistical and scientific research purposes . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council . ### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data , appropriate industry - led measures and policies shall take due account of the principles of technology , service and business model neutrality so as to favour the free movement of personal data within the union .


### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission for : specifying standard forms in relation to the processing of personal data of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; the right to data portability ; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation ; specific requirements for the security of processing ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; standards and procedures for a data protection impact assessment ; forms and procedures for prior authorisation and prior consultation ; technical standards and mechanisms for certification ; the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation ; disclosures not authorized by union law ; mutual assistance ; joint operations ; decisions under the consistency mechanism . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by the member states of the commission ' s exercise of implementing powers46 . in this context , the commission should consider specific measures for micro , small and medium - sized enterprises . ### in implementing the provisions of this regulation , it shall be ensured that no mandatory requirements for specific technical features are imposed on products and services , including terminal or other electronic communications equipment , which could impede the placing of equipment on the market and the free circulation of such equipment in and between member states .


### in view of the fact that , as underlined by the court of justice of the european union , the right to the protection of personal data is not an absolute right , but must be considered in relation to its function in society and be balanced with other fundamental rights , in accordance with the principle of proportionality , this regulation respects all fundamental rights and observes the principles recognised in the charter of fundamental rights of the european union as enshrined in the treaties , notably the right to respect for private and family life , home and communications , the right to the protection of personal data , the freedom of thought , conscience and religion , the freedom of expression and information , the freedom to conduct a business , the right to an effective remedy and to a fair trial as well as cultural , religious and linguistic diversity . ### in view of the fact that , as underlined by the court of justice of the european union , the right to the protection of personal data is not an absolute right , but must be considered in relation to its function in society and the actual and potential advances in science , health and technology and be balanced with other fundamental rights , in accordance with the principle of proportionality , this regulation respects all fundamental rights and observes the principles recognised in the charter of fundamental rights of the european union as enshrined in the treaties , notably the right to respect for private and family life , home and communications , the right to the protection of personal data , the freedom of thought , conscience and religion , the freedom of expression and information , the freedom to conduct a business , the right to property and in particular the protection of intellectual property the right to an effective remedy and to a fair trial as well as cultural , religious and linguistic diversity .


### this regulation applies to the processing of personal data wholly or partly by automated means , and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system . ### this regulation applies to the processing of personal data wholly or partly by automated means , without discrimination between such processing means , and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system .


### ' data subject ' means an identified natural person or a natural person who can be identified , directly or indirectly , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to an identification number , location data , online identifier or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural or social identity of that person ; ### ' data subject ' means an identified natural person or a natural person who can be identified , directly or indirectly , by means reasonably likely to be used by the controller , in particular by reference to an identification number , location data , online identifier or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural or social identity of that person and who is not acting in his / her professional capacity ;


### ‘ processor’ means a natural or legal person , public authority , agency or any other body which processes personal data on behalf of the controller ; ### ‘ processor’ means a natural or legal person , public authority , agency or any other body which processes personal data on behalf of the controller ; is able to access personal data in a technically feasible way , without disproportionate effort , and is reasonably likely to gain knowledge of its content ;


### ‘ genetic data’ means all data , of whatever type , concerning the characteristics of an individual which are inherited or acquired during early prenatal development ; ### ‘ genetic data’ means information on the hereditary characteristics , or alteration thereof , of an identified or identifiable person , obtained through nucleic acid analysis ;


### ‘ data concerning health’ means any information which relates to the physical or mental health of an individual , or to the provision of health services to the individual ; ### ‘ data concerning health’ means personal data which relates to the physical or mental health of an individual , or to the provision of health services to the individual ;


### ‘ representative’ means any natural or legal person established in the union who , explicitly designated by the controller , acts and may be addressed by any supervisory authority and other bodies in the union instead of the controller , with regard to the obligations of the controller under this regulation ; ### ‘ representative’ means any natural or legal person established in the union who , explicitly designated by the controller , acts and shall be addressed by the competent supervisory authority , with regard to the obligations of the controller under this regulation ;


### collected for specified , explicit and legitimate purposes and not further processed in a way incompatible with those purposes ; ### collected for specified , explicit and legitimate purposes and not further processed in a way irreconcilable with those purposes ;


### accurate and kept up to date ; every reasonable step must be taken to ensure that personal data that are inaccurate , having regard to the purposes for which they are processed , are erased or rectified without delay ; ### accurate and where necessary , kept up to date ; every reasonable step must be taken to ensure that personal data that are inaccurate , having regard to the purposes for which they are processed , are erased or rectified without undue delay ;


### kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ; personal data may be stored for longer periods insofar as the data will be processed solely for historical , statistical or scientific research purposes in accordance with the rules and conditions of article 83 and if a periodic review is carried out to assess the necessity to continue the storage ; ### kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ; personal data may be stored for longer periods insofar as the data will be processed solely for historical , statistical or scientific purposes in accordance with the rules and conditions of article 83 and if a periodic review is carried out to assess the necessity to continue the storage ;


### processing is necessary for compliance with a legal obligation to which the controller is subject ; ### processing is necessary for compliance with a legal obligation , regulatory rule , guidance , industry code of practice , either domestically or internationally to which the controller is subject including the requirements of supervisory authorities ;


### processing of personal data which is necessary for the purposes of historical , statistical or scientific research shall be lawful subject to the conditions and safeguards referred to in article 83 . ### subsequent processing of personal data which is necessary for the purposes of historical , statistical or scientific research shall be lawful subject to the conditions and safeguards referred to in article 83 .


### the law of the member state must meet an objective of public interest or must be necessary to protect the rights and freedoms of others , respect the essence of the right to the protection of personal data and be proportionate to the legitimate aim pursued . ### the law of the member state must meet an objective of public interest or must be necessary to protect the rights and freedoms of others . the law of the member state must also respect the essence of the right to the protection of personal data this regulation and international treatises that the member state has decided to follow . finally the member state is obliged to evaluate and decide if national legislation is and be proportionate to the legitimate aim pursued or if a legitimate aim could be achieved using less privacy invasive solutions .


### processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller in the field of employment law in so far as it is authorised by union law or member state law providing for adequate safeguards ; or ### processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller in the field of employment law in so far as it is authorised by union law , member state law or collective agreements on the labour market providing for adequate safeguards ; or


### processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation , association or any other non - profit - seeking body with a political , philosophical , religious or trade - union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the data are not disclosed outside that body without the consent of the data subjects ; or ### processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation , association , organizations on the labour market or any other non - profit - seeking body with a political , philosophical , religious or trade - union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the data are not disclosed outside that body without the consent of the data subjects ; or


### processing is necessary for the performance of a task carried out in the public interest , on the basis of union law , or member state law which shall provide for suitable measures to safeguard the data subject ' s legitimate interests ; or ### processing and sharing is necessary for the performance of a task carried out in the public interest , on the basis of union law , or member state law which shall provide for suitable measures to safeguard the data subject ' s legitimate interests ; or


### processing of data concerning health is necessary for health purposes and subject to the conditions and safeguards referred to in article 81 ; or ### processing and sharing of data concerning health is necessary for health purposes and subject to the conditions and safeguards referred to in article 81 ; or


### processing is necessary for historical , statistical or scientific research purposes subject to the conditions and safeguards referred to in article 83 ; or ### processing and sharing is necessary for historical , statistical or scientific research purposes subject to the conditions and safeguards referred to in article 83 ; or


### if the data processed by a controller do not permit the controller to identify a natural person , the controller shall not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this regulation . ### if the data processed by a controller do not permit the controller to identify a natural person , the controller shall not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this regulation . the controller of research databases shall provide general information on the original data sources of the research database .


### if the data processed by a controller do not permit the controller to identify a natural person , the controller shall not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this regulation . ### data protection regulation should not apply to data rendered anonymous . if the data processed by a controller do not permit the controller to identify a natural person , the controller shall not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this regulation .


### the controller shall establish procedures for providing the information referred to in article 14 and for the exercise of the rights of data subjects referred to in article 13 and articles 15 to 19 . the controller shall provide in particular mechanisms for facilitating the request for the actions referred to in article 13 and articles 15 to 19 . where personal data are processed by automated means , the controller shall also provide means for requests to be made electronically . ### the controller shall establish procedures for providing the information referred to in article 14 and for the exercise of the rights of data subjects referred to in article 13 and articles 15 to 19 . the controller shall provide in particular mechanisms for facilitating the request for the actions referred to in article 13 and articles 15 to 19 . where personal data are processed by automated means , the controller may also provide means for requests to be made electronically .


### the information and the actions taken on requests referred to in paragraph 1 shall be free of charge . where requests are manifestly excessive , in particular because of their repetitive character , the controller may charge a fee for providing the information or taking the action requested , or the controller may not take the action requested . in that case , the controller shall bear the burden of proving the manifestly excessive character of the request . ### the charges for taking action or providing information upon the request of data subject referred to in paragraph 1 shall not exceed actual costs of handling the requests born by the controller .


### the commission may lay down standard forms and specifying standard procedures for the communication referred to in paragraph 2 , including the electronic format . in doing so , the commission shall take the appropriate measures for micro , small and medium - sized enterprises . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the commission may specifying standard procedures for the communication referred to in paragraph 2 . in doing so , the commission shall take the appropriate measures for micro , small and medium - sized enterprises . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 .


### the data subject shall have the right to obtain from the controller at any time , on request , confirmation as to whether or not personal data relating to the data subject are being processed . where such personal data are being processed , the controller shall provide the following information : ### the data subject shall have the right to obtain from the controller at any time , on request , confirmation as to whether or not personal data relating to the data subject are being processed . with the exception of data is being used for historical , statistical or scientific research purposes , the controller shall provide the following information when personal data are being processed :


### the significance and envisaged consequences of such processing , at least in the case of measures referred to in article 20 . ### the significance and envisaged consequences of such processing .


### the data are no longer necessary in relation to the purposes for which they were collected or otherwise processed ; ### the data are no longer necessary in relation to the purposes for which they were collected or further processed and the legally mandatory minimum retention period has expired ;


### the data subject withdraws consent on which the processing is based according to point of article 6 , or when the storage period consented to has expired , and where there is no other legal ground for the processing of the data ; ### the data subject withdraws consent on which the processing is based according to point of article 6 , or when the storage period consented to has expired , and where there is no other legal ground for the processing or storage of the data ;


### for reasons of public interest in the area of public health in accordance with article 81 ; ### for reasons of public interest in the area of public health and health purposes in accordance with article 81 ;


### where the data subject has provided the personal data and the processing is based on consent or on a contract , the data subject shall have the right to transmit those personal data and any other information provided by the data subject and retained by an automated processing system , into another one , in an electronic format which is commonly used , without hindrance from the controller from whom the personal data are withdrawn . ### where the data subject has provided the personal data and the processing is based on consent or on a contract , the data subject shall have the right to transmit those personal data and any other information provided by the data subject and retained by an automated processing system .


### every natural person shall have the right not to be subject to a measure which produces legal effects concerning this natural person or significantly affects this natural person , and which is based solely on automated processing intended to evaluate certain personal aspects relating to this natural person or to analyse or predict in particular the natural person ' s performance at work , economic situation , location , health , personal preferences , reliability or behaviour . ### a natural person shall have the right not to be subject to a decision which is unfair or discriminatory , and which is based solely on automated processing intended to evaluate certain personal aspects relating to this natural person .


### every natural person shall have the right not to be subject to a measure which produces legal effects concerning this natural person or significantly affects this natural person , and which is based solely on automated processing intended to evaluate certain personal aspects relating to this natural person or to analyse or predict in particular the natural person ' s performance at work , economic situation , location , health , personal preferences , reliability or behaviour . ### every data subject shall have the right to request not to be subject to a measure which adversely affects this data subject and which is based solely on automated processing of data intended to evaluate , analyse or predict the data subject ' s performance at work , economic situation , location , health , personal preferences , reliability or behaviour .


### the controller shall adopt policies and implement appropriate measures to ensure and be able to demonstrate that the processing of personal data is performed in compliance with this regulation . ### having regard to the state of the art , the nature of personal data processing and the type of the organization , both at the time of the determination of the means for processing and at the time of the processing itself , appropriate and demonstrable technical and organizational measures should be implemented in such a way that the processing will meet the requirements of this regulation and ensures the protection of the rights of the data subject by design .


### the measures provided for in paragraph 1 shall in particular include : ### such measures include , without limitation :


### keeping the documentation pursuant to article 28 ; ### independent management oversight of processing of personal data to ensure the existence and effectiveness of the technical and organizational measures ;


### implementing the data security requirements laid down in article 30 ; ### existence of proper policies , instructions or other guidelines to guide data processing needed to comply with the regulation as well as procedures and enforcement to make such guidelines effective ;


### performing a data protection impact assessment pursuant to article 33 ; ### existence of proper planning procedures to ensure compliance and to address potentially risky processing of personal data prior to the commencement of the processing ;


### complying with the requirements for prior authorisation or prior consultation of the supervisory authority pursuant to article 34 and ; ### existence of appropriate documentation of data processing to enable compliance with the obligations arising from the regulation ;


### where a controller determines the purposes , conditions and means of the processing of personal data jointly with others , the joint controllers shall determine their respective responsibilities for compliance with the obligations under this regulation , in particular as regards the procedures and mechanisms for exercising the rights of the data subject , by means of an arrangement between them . ### where a controller determines the purposes of the processing of personal data jointly with others , the joint controllers shall determine their respective responsibilities for compliance with the obligations under this regulation , in particular as regards the procedures and mechanisms for exercising the rights of the data subject , by means of an arrangement between them . the arrangement shall duly reflect the joint controllers ' respective effective roles and relationships vis - à - vis data subjects .


### where a processing operation is to be carried out on behalf of a controller , the controller shall choose a processor providing sufficient guarantees to implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject , in particular in respect of the technical security measures and organizational measures governing the processing to be carried out and shall ensure compliance with those measures . ### where a processing operation is to be carried out on behalf of a controller and involves the processing of data that would permit the processor to reasonably identify the data subject , the controller shall choose a processor providing sufficient guarantees to implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject , in particular in respect of the technical security measures and organizational measures governing the processing to be carried out and shall ensure compliance with those measures . the controller remains solely responsible for ensuring compliance with the requirements of this regulation .


### each controller and processor and , if any , the controller ' s representative , shall maintain documentation of all processing operations under its responsibility . ### each controller and , if any , the controller ' s representative , shall maintain appropriate documentation of the main processing operations under its responsibility .


### the controller and the processor and , if any , the controller ' s representative , shall make the documentation available , on request , to the supervisory authority . ### the controller and , if any , the controller ' s representative , shall make the documentation available , on request , to the supervisory authority .


### the controller and the processor and , if any , the representative of the controller , shall co - operate , on request , with the supervisory authority in the performance of its duties , in particular by providing the information referred to in point of article 53 and by granting access as provided in point of that paragraph . ### the controller and the processor and , if any , the representative of the controller , shall co - operate , on request , with the supervisory authority in the performance of its duties , in particular by providing the information referred to in point of article 53 and by granting access as provided in point of that paragraph . the controller and the processor and , if any , the representative of the controller , shall make the documentation available , on the basis of a request outlining the reasons for requiring access to the documents , to the supervisory authority .


### in the case of a personal data breach , the controller shall without undue delay and , where feasible , not later than 24 hours after having become aware of it , notify the personal data breach to the supervisory authority . the notification to the supervisory authority shall be accompanied by a reasoned justification in cases where it is not made within 24 hours . ### in the case of a personal data breach , when the breach is likely to produce legal effects to the detriment of the data subject ' s privacy , the controller shall without undue delay notify the personal data breach to the supervisory authority .


### pursuant to point of article 26 , the processor shall alert and inform the controller immediately after the establishment of a personal data breach . ### pursuant to point of article 26 , the processor shall alert and inform the controller without undue delay after the identification of a personal data breach that is likely to produce legal effects to the detriment of the data subject ' s privacy .


### describe the measures proposed or taken by the controller to address the personal data breach . ### describe the measures proposed or taken by the controller to address the personal data breach and / or mitigate its effects .


### the controller shall document any personal data breaches , comprising the facts surrounding the breach , its effects and the remedial action taken . this documentation must enable the supervisory authority to verify compliance with this article . the documentation shall only include the information necessary for that purpose . ### the controller shall document any personal data breaches , comprising the facts surrounding the breach , its effects and the remedial action taken . this documentation must be sufficient to enable the supervisory authority to verify compliance with this article . the documentation shall only include the information necessary for that purpose .


### the commission may lay down the standard format of such notification to the supervisory authority , the procedures applicable to the notification requirement and the form and the modalities for the documentation referred to in paragraph 4 , including the time limits for erasure of the information contained therein . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the commission may lay down the standard format of such notification to the supervisory authority and the procedures applicable to the filing of reports .


### the communication of a personal data breach to the data subject shall not be required if the controller demonstrates to the satisfaction of the supervisory authority that it has implemented appropriate technological protection measures , and that those measures were applied to the data concerned by the personal data breach . such technological protection measures shall render the data unintelligible to any person who is not authorised to access it . ### the communication of a personal data breach to the data subject shall not be required if the data breach does not have significant risk of harm to citizens and the controller demonstrates to the satisfaction of the supervisory authority that it has implemented appropriate technological protection measures , and that those measures were applied to the data concerned by the personal data breach . such technological protection measures shall render the data unintelligible to any person who is not authorised to access it .


### the communication of a personal data breach to the data subject shall not be required if the controller demonstrates to the satisfaction of the supervisory authority that it has implemented appropriate technological protection measures , and that those measures were applied to the data concerned by the personal data breach . such technological protection measures shall render the data unintelligible to any person who is not authorised to access it . ### the communication of a personal data breach to the data subject shall not be required if the controller has implemented appropriate technological protection measures , and that those measures were applied to the data concerned by the personal data breach . such technological protection measures shall render the data unintelligible , unusable or anonymised to any person who is not authorised to access it .


### where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature , their scope or their purposes , the controller or the processor acting on the controller ' s behalf shall carry out an assessment of the impact of the envisaged processing operations on the protection of personal data . ### where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature , their scope or their purposes , or where processing takes place as a public sector infrastructure project the controller shall carry out an assessment of the impact of the envisaged processing operations on the protection of personal data .


### a systematic and extensive evaluation of personal aspects relating to a natural person or for analysing or predicting in particular the natural person ' s economic situation , location , health , personal preferences , reliability or behaviour , which is based on automated processing and on which measures are based that produce legal effects concerning the individual or significantly affect the individual ; ### a systematic and extensive evaluation of personal aspects relating to a natural person or for analysing or predicting in particular the natural person ' s economic situation , location , health , personal preferences , reliability or behaviour , which is based on automated processing and on which measures are based that produce legal effects to the detriment of the individual ;


### information on sex life , health , race and ethnic origin or for the provision of health care , epidemiological researches , or surveys of mental or infectious diseases , where the data are processed for taking measures or decisions regarding specific individuals on a large scale ; ### information on sex life , health , political opinions , religious beliefs , criminal convictions , race and ethnic origin or for the provision of health care , epidemiological researches , or surveys of mental or infectious diseases , where the data are processed for taking measures or decisions regarding specific individuals on a large scale ;


### the assessment shall contain at least a general description of the envisaged processing operations , an assessment of the risks to the rights and freedoms of data subjects , the measures envisaged to address the risks , safeguards , security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this regulation , taking into account the rights and legitimate interests of data subjects and other persons concerned . ### the assessment shall contain at least a general description of the envisaged processing operations , an assessment of the risks to the rights and freedoms of data subjects , the measures envisaged to address the risks , safeguards , security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this regulation , taking into account the rights and legitimate interests of data subjects and other persons concerned and also taking into account modern technologies and methods that can improve citizens ' privacy . where european guidelines exist , such guidelines provide the basis for the impact assessment .


### where the supervisory authority is of the opinion that the intended processing does not comply with this regulation , in particular where risks are insufficiently identified or mitigated , it shall prohibit the intended processing and make appropriate proposals to remedy such incompliance . ### where the supervisory authority is of the opinion that the intended processing does not comply with this regulation , in particular where risks are insufficiently identified or mitigated , it shall prohibit the intended processing and make appropriate proposals to remedy such incompliance . such a decision shall be subject to appeal in a competent court and it may not be enforceable while being appealed unless the processing results to immediate serious harm suffered by data subjects .


### the controller or processor shall provide the supervisory authority with the data protection impact assessment provided for in article 33 and , on request , with any other information to allow the supervisory authority to make an assessment of the compliance of the processing and in particular of the risks for the protection of personal data of the data subject and of the related safeguards . ### the controller shall provide the supervisory authority with the data protection impact assessment provided for in article 33 and , on request , with any other information to allow the supervisory authority to make an assessment of the compliance of the processing and in particular of the risks for the protection of personal data of the data subject and of the related safeguards .


### the controller and the processor shall designate a data protection officer in any case where : ### the controller and the processor shall designate a data protection organisation or data protection officer in any case where :


### the core activities of the controller or the processor consist of processing operations which , by virtue of their nature , their scope and / or their purposes , require regular and systematic monitoring of data subjects . ### the core activities of the controller or the processor consist of processing operations which , by virtue of their nature , their scope and / or their purposes , require regular and systematic monitoring of data subjects . core activities should be defined as activities where 50% of the annual turnover resulting from the sale of data or revenue is gained from this data . in relation to data protection , data processing activities which do not represent more than 50% of company ' s turnover shall be considered ancillary .


### where the controller or the processor is a public authority or body , the data protection officer may be designated for several of its entities , taking account of the organisational structure of the public authority or body . ### where the controller or the processor is a public authority or body , the data protection organisation or data protection officer may be designated for several of its entities , taking account of the organisational structure of the public authority or body .


### the controller or the processor shall ensure that any other professional duties of the data protection officer are compatible with the person ' s tasks and duties as data protection officer and do not result in a conflict of interests . ### the controller or the processor shall ensure that any other professional duties of the data protection organisation or data protection officer are compatible with the person ' s tasks and duties as data protection officer and do not result in a conflict of interests .


### data subjects shall have the right to contact the data protection officer on all issues related to the processing of the data subject ' s data and to request exercising the rights under this regulation . ### data subjects shall have the right to contact the data protection organisation or data protection officer on all issues related to the processing of the data subject ' s data and to request exercising the rights under this regulation .


### the controller or the processor shall ensure that the data protection officer is properly and in a timely manner involved in all issues which relate to the protection of personal data . ### the controller or the processor shall ensure that the data protection organisation or data protection officer is properly and in a timely manner involved in all issues which relate to the protection of personal data .


### the controller or the processor shall support the data protection officer in performing the tasks and shall provide staff , premises , equipment and any other resources necessary to carry out the duties and tasks referred to in article 37 . ### the controller or the processor shall support the data protection organisation or data protection officer in performing the tasks and shall provide staff , premises , equipment and any other resources necessary to carry out the duties and tasks referred to in article 37 .


### the controller or the processor shall entrust the data protection officer at least with the following tasks : ### the controller or the processor shall entrust the data protection organisation or the data protection officer at least with the following tasks :


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying the criteria and requirements for the data protection certification mechanisms referred to in paragraph 1 , including conditions for granting and withdrawal , and requirements for recognition within the union and in third countries . ### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying the criteria and requirements for the data protection certification mechanisms referred to in paragraph 1 , including conditions for granting and withdrawal , and requirements for recognition within the union and in third countries , provided such measures are technology neutral .


### where the commission has taken no decision pursuant to article 41 , a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has adduced appropriate safeguards with respect to the protection of personal data in a legally binding instrument . ### where the commission has taken no decision pursuant to article 41 , or decides that a third country , or a territory or a processing sector within that third country , or an international organisation does not ensure an adequate level of protection in accordance with article 41 , a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has adduced appropriate safeguards with respect to the protection of personal data in a legally binding instrument .


### standard data protection clauses adopted by a supervisory authority in accordance with the consistency mechanism referred to in article 57 when declared generally valid by the commission pursuant to point of article 62 ; or ### standard data protection clauses adopted by a supervisory authority in accordance with the consistency mechanism referred to in article 57 when declared generally valid by the commission pursuant to point of article 62 ;


### contractual clauses between the controller or processor and the recipient of the data authorised by a supervisory authority in accordance with paragraph 4 . ### contractual clauses between the controller or processor and the recipient of the data authorised by a supervisory authority in accordance with paragraph 4 ; or


### a supervisory authority shall in accordance with the consistency mechanism set out in article 58 approve binding corporate rules , provided that they : ### one supervisory authority shall in accordance with the consistency mechanism set out in article 58 and through a single act of approval authorize binding corporate rules for a group of undertakings . those rules will allow multiple intercompany international transfers in and out of europe , provided that they :