### essential public interest objectives such as safety of life call for coordinated technical solutions for the interworking of safety and emergency services between member states . sufficient spectrum should be made available on a coherent basis for the development and free circulation of safety services and devices and innovative pan - european or interoperable safety and emergency solutions . studies have already shown the need for additional harmonised spectrum below 1 ghz to deliver mobile broadband services for public protection and disaster relief , across the union in the next 5 to 10 years . ### essential public interest objectives such as safety of life call for coordinated technical solutions for the interworking of safety and emergency services between member states . sufficient spectrum should be made available on a coherent basis for the development and free circulation of safety services and devices and innovative pan - european or interoperable safety and emergency solutions . studies have already shown the need for additional harmonised spectrum below 1 ghz to deliver mobile broadband services for public protection and disaster relief , across the union in the next 5 to 10 years . satellite will also play an essential role in the delivery of a world class internal and external disaster response capability , a policy goal that has been foreseen in the recent communication from dg echo , which will entail the use of satellite spectrum to contribute to european capabilities both within and beyond europe’s borders .


### ensuring the optimal use of spectrum may require innovative authorisation solutions such as collective use of spectrum , general authorisations or infrastructure sharing . the application of such principles in the union might be facilitated by the definition of certain common or converging conditions for spectrum usage . general authorisations , which are the least onerous authorisation system , are of particular interest where interference does not risk hampering the development of other services . ### ensuring the optimal and productive use of spectrum may require innovative authorisation solutions such as collective use of spectrum , general authorisations , auctions or infrastructure sharing . the application of such principles in the union might be facilitated by identifying best practices and encouraging information sharing , as well as the definition of certain common or converging conditions for spectrum usage . general authorisations , which are the most appropriate and least onerous authorisation system , are of particular interest where interference does not risk hampering the development of other services .


### harmonised standards under directive 1999 / 5 / ec of the european parliament and of the council of 9 march 1999 on radio equipment and telecommunications terminal equipment and the mutual recognition of their conformity are essential to achieve efficient spectrum use and should take account of legally defined sharing conditions . european standards for non - radio electric and electronic equipment and networks should also avoid disturbance to spectrum use . the cumulative impact of the increasing volume and density of wireless devices and applications combined with the diversity of spectrum use challenges current approaches to interference management . these should be examined and reassessed together with receiver characteristics and more sophisticated interference avoidance mechanisms . ### harmonised standards under directive 1999 / 5 / ec of the european parliament and of the council of 9 march 1999 on radio equipment and telecommunications terminal equipment , the mutual recognition of their conformity and future harmonisations in respect of electronic networks and wireless devices are essential to achieve efficient spectrum use and should ensure the coexistence of existing and new applications . european standards for non - radio electric and electronic equipment and networks should also avoid disturbance to spectrum use . the cumulative impact of the increasing volume and density of wireless devices and applications combined with the diversity of spectrum use challenges current approaches to interference management . these should be examined and reassessed together with receiver characteristics - such as increasing reliability of receivers and appropriate output levels for emitting devices - and more sophisticated interference avoidance mechanisms .


### harmonised standards under directive 1999 / 5 / ec of the european parliament and of the council of 9 march 1999 on radio equipment and telecommunications terminal equipment and the mutual recognition of their conformity7 are essential to achieve efficient spectrum use and should take account of legally defined sharing conditions . european standards for non - radio electric and electronic equipment and networks should also avoid disturbance to spectrum use . the cumulative impact of the increasing volume and density of wireless devices and applications combined with the diversity of spectrum use challenges current approaches to interference management . these should be examined and reassessed together with receiver characteristics and more sophisticated interference avoidance mechanisms . ### harmonised standards under directive 1999 / 5 / ec of the european parliament and of the council of 9 march 1999 on radio equipment and telecommunications terminal equipment and the mutual recognition of their conformity7 and future eu standardization for non - radio electronic networks and equipment are essential to achieve efficient spectrum use and should facilitate co - existence between new and existing devices . future european standards for non - radio electric and electronic equipment and networks should also avoid disturbance to spectrum use . the cumulative impact of the increasing volume and density of wireless devices and applications combined with the diversity of spectrum use challenges current approaches to interference management . these should be examined and reassessed together with receiver characteristics and more sophisticated interference avoidance mechanisms such as improving immunity levels of receivers and setting appropriate power levels for new emitting radio equipment .


### this first programme should in particular support the europe 2020 strategy for smart , sustainable and inclusive growth given the huge potential of wireless services to promote an information - based economy , develop and assist sectors relying on information and communications technologies and overcome the digital divide . it is also a key action in the digital agenda for europe which aims to deliver fast broadband internet in the future network - based knowledge economy , with an ambitious target for universal broadband coverage with speeds of at least 30 mbps for all europeans by 2020 , thereby achieving the sustainable economic and social benefits of a digital single market . it should also support and promote other union sectoral policies such as a sustainable environment and economic and social inclusion for all union citizens . given the importance of wireless applications for innovation , this programme is also a key initiative in support of union policies on innovation . ### this first programme should in particular support the europe 2020 strategy for smart , sustainable and inclusive growth given the huge potential of wireless services to promote an information - based economy , develop and assist sectors relying on information and communications technologies and overcome the digital divide . it is also a key action in the digital agenda for europe which aims to deliver fast broadband internet in the future network - based knowledge economy , with an ambitious target for universal broadband coverage . providing the highest possible broadband speeds and capacity , ensuring not less than 30 mbps for all by 2020 with at least half of european households having broadband access at a speed of at least 100 mbps , is important for fostering economic growth and global competitiveness , thereby achieving the sustainable economic and social benefits of a digital single market . it should also support and promote other union sectoral policies such as a sustainable environment and economic and social inclusion for all union citizens . given the importance of wireless applications for innovation , this programme is also a key initiative in support of union policies on innovation .


### the 800 mhz band is optimal for the coverage of large areas by wireless broadband services . building on the harmonisation of technical conditions under decision 2010 / 267 / eu , and on commission recommendation of 28 october 2009 calling for analogue broadcasting to be switched off by 1 january 2012 , and given rapid national regulatory developments , this band should in principle be made available for electronic communications in the union by 2013 . in the longer term , additional spectrum below 790 mhz could also be envisaged , depending on experience and the lack of spectrum in other bands adequate for coverage . considering the capacity of the 800 mhz band to transmit over large areas , coverage obligations should be attached to rights . ### in addition to a timely and pro - competitive opening up of the 900 mhz band in accordance with the revised gsm directive 2009 / 114 / ec , the 800 mhz band is optimal for the coverage of large areas by wireless broadband services . building on the harmonisation of technical conditions under decision 2010 / 267 / eu , and on commission recommendation of 28 october 2009 calling for analogue broadcasting to be switched off by 1 january 2012 , and given rapid national regulatory developments , this band should in principle be made available for electronic communications in the union by 2013 . in the longer term , additional spectrum below 790 mhz could also be envisaged , depending on experience and the lack of spectrum in other bands adequate for coverage . considering the capacity of the 800 mhz band to transmit over large areas , coverage obligations should be attached to rights .


### the 800 mhz band is optimal for the coverage of large areas by wireless broadband services . building on the harmonisation of technical conditions under decision 2010 / 267 / eu , and on commission recommendation of 28 october 2009 calling for analogue broadcasting to be switched off by 1 january 2012 , and given rapid national regulatory developments , this band should in principle be made available for electronic communications in the union by 2013 . in the longer term , additional spectrum below 790 mhz could also be envisaged , depending on experience and the lack of spectrum in other bands adequate for coverage . considering the capacity of the 800 mhz band to transmit over large areas , coverage obligations should be attached to rights . ### . the 800 mhz band is optimal for the coverage of large areas by wireless broadband services . building on the harmonisation of technical conditions under decision 2010 / 267 / eu , and on commission recommendation of 28 october 2009 calling for analogue broadcasting to be switched off by 1 january 2012 , and given rapid national regulatory developments , this band should be made available for electronic communications in the union by 2013 . considering the capacity of the 800 mhz band to transmit over large areas , coverage obligations achieved through the principles of technical and service neutrality should be attached to rights . additional spectrum for wireless broadband services in the 1 . 5 mhz band and the 2 . 3 ghz band should be freed up to meet the increasing demand for mobile traffic . further mobile service spectrum allocations , such as the 700 mhz band , should be evaluated depending on future capacity requirements for wireless broadband services and terrestrial tv .


### make sufficient appropriate spectrum available in a timely manner to support union policy objectives ; ### ensure that sufficient and appropriate spectrum is allocated for wireless services , amounting to at least 1200 mhz by 2015 , unless specified otherwise in the radio spectrum policy programme , in order to meet a rapidly growing demand for mobile data traffic , thereby allowing the development of commercial and public services ;


### without prejudice to the principles of service and technology neutrality , member states , in cooperation with the commission , shall take all steps necessary to ensure that sufficient spectrum for coverage and capacity purposes is allocated within the union , in order to ensure that wireless applications contribute effectively to achieving the target for all citizens to have access to broadband of a speed of at least 30 mbps by 2020 . ### without prejudice to the principles of service and technology neutrality , member states , in cooperation with the commission , shall take all steps necessary to ensure that sufficient harmonised spectrum for coverage and capacity purposes is allocated within the union , enabling the union to have the fastest broadband speed in the world in order to ensure that wireless applications and european leadership in new services contribute effectively to economic growth , achieving the target for all citizens to have access to broadband speeds of not less than 30 mbps by 2020 .


### reduce the fragmentation of the internal market by enhancing coordination and harmonisation of technical conditions for the use and availability of spectrum , as appropriate , including the development of transnational services , and by promoting economies of scale at union level ; ### reduce the fragmentation and fully exploit the potential of the internal market in order to foster economic growth and economies of scope and scale at union level by enhancing coordination and harmonisation of technical conditions for the use and availability of spectrum , as appropriate ;


### member states , in cooperation with the commission , shall ensure that the provision of access to broadband content and services using the 790 - 862 mhz band is encouraged in sparsely populated areas , in particular through coverage obligations ; in doing so , they shall examine ways and , where necessary , take appropriate measures to ensure that the freeing of the 800 mhz band does not adversely affect programme making and special events users . ### member states , in cooperation with the commission , shall ensure that the provision of access to broadband services using the 790 - 862 mhz band is encouraged in sparsely populated areas , in particular through coverage obligations ; member - states in cooperation with the commission shall examine ways and , where appropriate , take technical and regulatory measures to ensure that sufficient spectrum is available for programme making and special events users . the commission should encourage member states to ensure the timely availability of sufficient funds to cover the direct migration costs and the direct costs associated with the protection of pmse and broadcasting services .


### member states may limit the amount of spectrum for which rights of use are granted to any economic operator or may attach conditions to such rights of use , such as the provision of wholesale access , in certain bands or in certain groups of bands with similar characteristics , for instance the bands below 1 ghz allocated to electronic communication services ; ### member states may limit the amount of spectrum for which rights of use are granted to any economic operator or may attach conditions to such rights of use , such as the provision of wholesale access , national or regional roaming , in certain bands or in certain groups of bands with similar characteristics , for instance the bands below 1 ghz allocated to electronic communication services ;


### in defining the technical conditions for the allocation of spectrum , take full account of the results of research certified by the relevant international organisations into the potential effects on human health of electromagnetic field emissions . ### in defining the technical conditions for the allocation of spectrum , take full account of the results of research certified by the relevant international organisations into the potential effects on human health of electromagnetic field emissions and apply them in a technology and service neutral way .


### the first programme should specify guiding principles and objectives up to 2015 for member states and union institutions , and set out specific implementation initiatives . while spectrum management is still largely a national competence , it should be exercised in compliance with existing union law and allow for action to pursue union policies . ### the first programme should specify guiding principles and objectives up to 2015 for member states and union institutions , and set out specific implementation initiatives . spectrum management is a national competence . it should be carried out in a manner consistent with existing union law and should allow for action to pursue a union spectrum policy . pursuant to article 8a of the framework directive , member states are required only to cooperate with one another and with the commission in connection with the strategic planning , coordination and harmonisation of spectrum use .


### guaranteeing the functioning of the internal market , in particular by ensuring effective competition . ### promoting the functioning of the internal market , in particular by fostering effective competition .


### in the case referred to in point of paragraph 1 , a group of undertakings may appoint a single data protection officer . ### a group of undertakings may appoint a single data protection officer .


### where the appropriate safeguards with respect to the protection of personal data are not provided for in a legally binding instrument , the controller or processor shall obtain prior authorisation for the transfer , or a set of transfers , or for provisions to be inserted into administrative arrangements providing the basis for such transfer . such authorisation by the supervisory authority shall be in accordance with point of article 34 . if the transfer is related to processing activities which concern data subjects in another member state or other member states , or substantially affect the free movement of personal data within the union , the supervisory authority shall apply the consistency mechanism referred to in article 57 . authorisations by a supervisory authority on the basis of article 26 of directive 95 / 46 / ec shall remain valid , until amended , replaced or repealed by that supervisory authority . ### authorisations by a supervisory authority on the basis of article 26 of directive 95 / 46 / ec shall remain valid for two years after the entry into force of this regulation , or until amended , replaced or repealed by that supervisory authority .


### the period for which the personal data will be stored ; ### the period for which the personal data will be stored , or if this is not possible , the criteria used to determine this period ;


### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted in respect of lawfulness of processing ; specifying the criteria and conditions in relation to the consent of a child ; processing of special categories of data ; specifying the criteria and conditions for manifestly excessive requests and fees for exercising the rights of the data subject ; criteria and requirements for the information to the data subject and in relation to the right of access ; the right to be forgotten and to erasure ; measures based on profiling ; criteria and requirements in relation to the responsibility of the controller and to data protection by design and by default ; a processor ; criteria and requirements for the documentation and the security of processing ; criteria and requirements for establishing a personal data breach and for its notification to the supervisory authority , and on the circumstances where a personal data breach is likely to adversely affect the data subject ; the criteria and conditions for processing operations requiring a data protection impact assessment ; the criteria and requirements for determining a high degree of specific risks which require prior consultation ; designation and tasks of the data protection officer ; codes of conduct ; criteria and requirements for certification mechanisms ; criteria and requirements for transfers by way of binding corporate rules ; transfer derogations ; administrative sanctions ; processing for health purposes ; processing in the employment context and processing for historical , statistical and scientific research purposes . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council . ### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted specifying the technical standars to give consent ; specifyng conditions of icon - based mode for provision of information ; specifying the criteria and conditions for fees for exercising the rights of the data subject ; criteria and requirements for the information to the data subject and in relation to the right of access ; the right to be forgotten and to erasure ; criteria and requirements for verification of the responsibility of the controller ; criteria and requirements for establishing a personal data breach and for its notification to the supervisory authority , and on the circumstances where a personal data breach is likely to adversely affect the data subject ; the criteria and conditions for processing operations requiring a data protection impact assessment ; the criteria and requirements for determining a high degree of specific risks which require prior consultation ; codes of conduct ; criteria and requirements for certification mechanisms ; the adequate level of protection afforded by a third country or an international organisation ; administrative sanctions ; processing for health purposes ; processing in the employment context and processing for historical , statistical and scientific research purposes . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level in particular with the european data protection board . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council .


### this regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the union . ### this regulation applies to the processing of personal data of data subjects residing in the union in the context of the activities of an establishment of a controller or a processor in the union .


### when using online services , individuals may be associated with online identifiers provided by their devices , applications , tools and protocols , such as internet protocol addresses or cookie identifiers . this may leave traces which , combined with unique identifiers and other information received by the servers , may be used to create profiles of the individuals and identify them . it follows that identification numbers , location data , online identifiers or other specific factors as such need not necessarily be considered as personal data in all circumstances . ### when using online services , individuals may be associated with online identifiers provided by their devices , applications , tools and protocols , such as internet protocol addresses or cookie identifiers . this may leave traces which , combined with unique identifiers and other information received by the servers , may be used to create profiles of the individuals and identify them . it follows that a study should be conducted , on a case - by - case basis and in accordance with technological developments , into whether identification numbers , location data , online identifiers or other specific factors as such must necessarily be considered as personal data but shall be considered as one , when processed with the intention of targeting particular content at an individual or of singling that individual out for any other purpose ;


### the commission may specify standard forms and procedures for requesting and granting access to the information referred to in paragraph 1 , including for verification of the identity of the data subject and communicating the personal data to the data subject , taking into account the specific features and necessities of various sectors and data processing situations . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the commission suggest standard forms and specify procedures for requesting and granting access to the information referred to in paragraph 1 , including for verification of the identity of the data subject and communicating the personal data to the data subject , taking into account the specific features and necessities of various sectors and data processing situations . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 .


### member states shall provide for exemptions or derogations from the provisions on the general principles in chapter ii , the rights of the data subject in chapter iii , on controller and processor in chapter iv , on the transfer of personal data to third countries and international organisations in chapter v , the independent supervisory authorities in chapter vi and on co - operation and consistency in chapter vii for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression . ### chapter ii , chapter iii , chapter iv , chapter v , chapter vi , , chapter vii as well as articles 73 , 74 , 76 and 79 of chapter viii shall not apply to the processing of personal data carried out for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression .


### the supervisory authority shall impose a fine up to 1 000 000 eur or , in case of an enterprise up to 2 % of its annual worldwide turnover , to anyone who , intentionally or negligently : ### the supervisory authority shall impose a fine up to 1 000 000 eur or , in case of an enterprise , up to 2 % of its average annual worldwide profits to anyone who intentionally or negligently :


### the supervisory authority shall impose a fine up to 500 000 eur , or in case of an enterprise up to 1 % of its annual worldwide turnover , to anyone who , intentionally or negligently : ### the supervisory authority may impose a fine up to 500 000 eur , or in case of an enterprise up to 1 % of its annual worldwide turnover , to anyone who , intentionally or negligently :


### where the controller referred to in paragraph 1 has made the personal data public , it shall take all reasonable steps , including technical measures , in relation to data for the publication of which the controller is responsible , to inform third parties which are processing such data , that a data subject requests them to erase any links to , or copy or replication of that personal data . where the controller has authorised a third party publication of personal data , the controller shall be considered responsible for that publication . ### where the controller referred to in paragraph 1 has transferred the personal data , or has made such data public without the consent of the data subject , it shall take all reasonable steps , including technical measures , in relation to data for the publication of which the controller is responsible , to inform third parties which are processing such data , that a data subject requests them to erase any links to , or copy or replication of that personal data . when data has been transferred , the transferring controller shall inform these subsequent controllers that the data subject requests the deletion of the personal data , any links to , or copy or replication of that personal data . where the controller has authorised a third party publication of personal data , the controller shall be considered responsible for that publication .


### in the case of a personal data breach , the controller shall without undue delay and , where feasible , not later than 24 hours after having become aware of it , notify the personal data breach to the supervisory authority . the notification to the supervisory authority shall be accompanied by a reasoned justification in cases where it is not made within 24 hours . ### in the case of a personal data breach relating to special categories of personal date , personal data which are subject to professional secrecy , personal data relating to criminal offences or to the suspicion of a criminal act or personal data relating to bank or credit card accounts , which seriously threaten the rights or legitimate interests of the data subject , the controller shall without undue delay notify the personal data breach to the supervisory authority .


### supervisory authorities shall provide each other relevant information and mutual assistance in order to implement and apply this regulation in a consistent manner , and shall put in place measures for effective co - operation with one another . mutual assistance shall cover , in particular , information requests and supervisory measures , such as requests to carry out prior authorisations and consultations , inspections and prompt information on the opening of cases and ensuing developments where data subjects in several member states are likely to be affected by processing operations . ### supervisory authorities shall provide each other relevant information and mutual assistance in order to implement and apply this regulation in a consistent manner , and shall put in place measures for effective co - operation with one another . mutual assistance shall cover , in particular , information requests and supervisory measures , such as requests to carry out prior consultations , inspections and prompt information on the opening of cases and ensuing developments where data subjects in several member states are likely to cause legal effects to the detriment of the data subjects .


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying the criteria and requirements for the communication to the data subject of the content of the personal data referred to in point of paragraph 1 . ### the data subject shall have the right , where personal data are processed by electronic means and in a structured and commonly used format , to obtain from the controller a copy of data which were provided by the data subject itself and that undergoing processing in an electronic and structured format which is commonly used and allows for further use by the data subject . this right shall not restrict rights of others as trade secrets or intellectual property rights . this does not apply on the processing of anonymised and pseudonymised data , insofar as the data subject is not sufficiently identifiable on the basis of such data or identification would require the controller to undo the process of pseudonymisation .


### any body , organisation or association which aims to protect data subjects’ rights and interests concerning the protection of their personal data and has been properly constituted according to the law of a member state shall have the right to lodge a complaint with a supervisory authority in any member state on behalf of one or more data subjects if it considers that a data subject’s rights under this regulation have been infringed as a result of the processing of personal data . ### any body , organisation or association which aims to protect data subjects’ rights and interests concerning the protection of their personal data and has been properly constituted according to the law of a member state may lodge a complaint with a supervisory authority in that member state for an alleged breach of this regulation . the rights bestowed on it under this regulation also empower it to act on behalf of one or more data subjects resident in that member state , provided it has sufficient power of attorney to do so .


### without prejudice to any other administrative or judicial remedy , every data subject shall have the right to lodge a complaint with a supervisory authority in any member state if they consider that the processing of personal data relating to them does not comply with this regulation . ### without prejudice to any other administrative or judicial remedy , every data subject shall have the right to lodge a complaint with the supervisory authority in the member state of his habitual residence or in the member state where the data controller has its main establishment ; if they consider that the processing of personal data relating to them does not comply with this regulation .


### the supervisory authority referred to in paragraph 1 and the supervisory authority competent under article 51 shall take account of the opinion of the european data protection board and shall within two weeks after the information on the opinion by the chair of the european data protection board , electronically communicate to the chair of the european data protection board and to the commission whether it maintains or amends its draft measure and , if any , the amended draft measure , using a standardised format . ### the competent supervisory authority referred to in paragraph 1 shall take account of the opinion of the european data protection board and shall within two weeks after the information on the opinion by the chair of the european data protection board , electronically communicate to the chair of the european data protection board and to the commission whether it maintains or amends its draft measure and , if any , the amended draft measure , using a standardised format .


### where the supervisory authority is of the opinion that the intended processing does not comply with this regulation , in particular where risks are insufficiently identified or mitigated , it shall prohibit the intended processing and make appropriate proposals to remedy such incompliance . ### where the competent supervisory authority determines in accordance with its power that the intended processing does not comply with this regulation , in particular where risks are insufficiently identified or mitigated , it shall prohibit the intended processing and make appropriate proposals to remedy such incompliance . such a decision shall be subject to appeal in a competent court and it may not be enforceable while being appealed unless the processing results in immediate serious harm suffered by data subjects .


### the communication of a personal data breach to the data subject shall not be required if the controller demonstrates to the satisfaction of the supervisory authority that it has implemented appropriate technological protection measures , and that those measures were applied to the data concerned by the personal data breach . such technological protection measures shall render the data unintelligible to any person who is not authorised to access it . ### the communication of a personal data breach to the data subject shall not be required if the data breach has not produced significant harm and the controller has implemented appropriate technological protection measures , and that those measures where applied to the data concerned by the personal data breach . such technological protection measures shall render the data unintelligible , unusable or anonymised to any person who is not authorised access to it .


### in exceptional circumstances , where a supervisory authority considers that there is an urgent need to act in order to protect the interests of data subjects , in particular when the danger exists that the enforcement of a right of a data subject could be considerably impeded by means of an alteration of the existing state or for averting major disadvantages or for other reasons , by way of derogation from the procedure referred to in article 58 , it may immediately adopt provisional measures with a specified period of validity . the supervisory authority shall , without delay , communicate those measures , with full reasons , to the european data protection board and to the commission . ### in exceptional circumstances , where a supervisory authority considers that there is an urgent need to act in order to protect the interests of data subjects , when the danger exists that the enforcement of a right of a data subject could be considerably impeded by means of an alteration of the existing state or for averting major disadvantages , by way of derogation from the procedure referred to in article 58 , it may immediately adopt provisional measures with a specified period of validity . this supervisory authority shall , without delay , communicate those measures , with full reasons , to the competent supervisory authority , the european data protection board , the commission and the controller or processor concerned .


### the information and the actions taken on requests referred to in paragraph 1 shall be free of charge . where requests are manifestly excessive , in particular because of their repetitive character , the controller may charge a fee for providing the information or taking the action requested , or the controller may not take the action requested . in that case , the controller shall bear the burden of proving the manifestly excessive character of the request . ### the information and the actions taken on requests referred to in paragraph 1 shall be free of charge . where requests are manifestly excessive , if the request of the same character repeats more than once per 6 months , the controller may charge an administrative fee for providing the information or taking the action requested , or the controller may not take the action requested . in that case , the controller shall bear the burden of proving the repetitiveness of the request .


### the delegation of power referred to in article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 33 , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 may be revoked at any time by the european parliament or by the council . a decision of revocation shall put an end to the delegation of power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force . ### the delegation of power referred to in article 8 , article 9 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 31 , article 32 , article 33 , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 81 , article 82 and article 83 may be revoked at any time by the european parliament or by the council . a decision of revocation shall put an end to the delegation of power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force .


### the controller or the processor shall support the data protection officer in performing the tasks and shall provide staff , premises , equipment and any other resources necessary to carry out the duties and tasks referred to in article 37 . ### the controller or the processor shall support the data protection officer in performing the tasks and , when necessary , shall provide staff , premises , equipment and any other resources required to carry out the duties and tasks referred to in article 37 .


### the data subject shall have the right to obtain from the controller at any time , on request , confirmation as to whether or not personal data relating to the data subject are being processed . where such personal data are being processed , the controller shall provide the following information : ### the data subject shall have the right to obtain from the controller at any time , on request , confirmation as to whether or not personal data relating to the data subject are being processed . with the exception of data being used for historical , statistical or scientific research purposes the controller shall provide the following information when person data are being processed :


### for compliance with a legal obligation to retain the personal data by union or member state law to which the controller is subject ; member state laws shall meet an objective of public interest , respect the essence of the right to the protection of personal data and be proportionate to the legitimate aim pursued ; ### for compliance with a legal obligation to retain the personal data by union or member state law to which the controller is subject ;


### each supervisory authority must draw up an annual report on its activities . the report shall be presented to the national parliament and shall be made be available to the public , the commission and the european data protection board . ### each supervisory authority must draw up an annual report on its activities . the report shall be presented to the respective parliament and / or to the other authorities stipulated in the relevant national legislation and shall be made be available to the public , the commission and the european data protection board .


### each member state shall notify to the commission those provisions of its law which it adopts pursuant to paragraph 1 , by the date specified in article 91 at the latest and , without delay , any subsequent amendment affecting them . ### each member state shall notify to the commission those legal provisions which it adopts pursuant to paragraphs 1 and 1b , by the date specified in article 91 at the latest and , without delay , any subsequent amendment affecting them .


### the controller shall implement mechanisms for ensuring that , by default , only those personal data are processed which are necessary for each specific purpose of the processing and are especially not collected or retained beyond the minimum necessary for those purposes , both in terms of the amount of the data and the time of their storage . in particular , those mechanisms shall ensure that by default personal data are not made accessible to an indefinite number of individuals . ### the controller shall implement mechanisms for ensuring that , by default , only those personal data are processed which are not excessive for each specific purpose of the processing and are especially not collected or retained or disseminated beyond the minimum necessary for those purposes , both in terms of the amount of the data and the time of their storage . in particular , those mechanisms shall ensure that by default personal data are not made accessible to an indefinite number of individuals .


### the controller and the processor shall designate a data protection officer in any case where : ### the controller shall designate a data protection officer in any case where :


### where the list provided for in paragraph 4 involves processing activities which are related to the offering of goods or services to data subjects in several member states , or to the monitoring of their behaviour , or may substantially affect the free movement of personal data within the union , the supervisory authority shall apply the consistency mechanism referred to in article 57 prior to the adoption of the list . ### where processing activities relate to the offering of goods or services to data subjects in several member states , or to the monitoring of their behaviour , or may substantially affect the free movement of personal data within the union , the supervisory authority shall apply the consistency mechanism referred to in article 57 .


### where the personal data are not collected from the data subject , the controller shall inform the data subject , in addition to the information referred to in paragraph 1 , from which source the personal data originate . ### where the personal data are not collected from the data subject , the controller shall inform the data subject , as far as possible , in addition to the information referred to in paragraph 1 , from which source the personal data originate , except where the data originate from a publicly available source or where the transfer is provided by law or the processing is used for purposes relating to the professional activities of the person concerned .


### to inform and advise the controller or the processor of their obligations pursuant to this regulation and to document this activity and the responses received ; ### to raise awareness , to inform and advise the controller or the processor of their obligations pursuant to this regulation and to document this activity and the responses received ;


### the data are not collected from the data subject and the provision of such information proves impossible or would involve a disproportionate effort ; ### the data are not collected from the data subject and the provision of such information proves impossible – for example because the data have been rendered pseudonymous – or would involve a disproportionate effort ;


### the controller or the processor shall support the data protection officer in performing the tasks and shall provide staff , premises , equipment and any other resources necessary to carry out the duties and tasks referred to in article 37 . ### the controller or the processor shall support the data protection organisation or data protection officer in performing the tasks and shall provide staff , premises , equipment and any other resources necessary to carry out the duties and tasks referred to in article 37 .


### the controller shall inform the data subject without delay and , at the latest within one month of receipt of the request , whether or not any action has been taken pursuant to article 13 and articles 15 to 19 and shall provide the requested information . this period may be prolonged for a further month , if several data subjects exercise their rights and their cooperation is necessary to a reasonable extent to prevent an unnecessary and disproportionate effort on the part of the controller . the information shall be given in writing . where the data subject makes the request in electronic form , the information shall be provided in electronic form , unless otherwise requested by the data subject . ### the controller shall inform the data subject without delay and , at the latest within one month of receipt of the request , whether or not any action has been taken pursuant to article 13 and articles 15 to 19 and shall provide the requested information . this period may be prolonged for a further month , if several data subjects exercise their rights and their cooperation is necessary to a reasonable extent to prevent an unnecessary and disproportionate effort on the part of the controller . the information shall be given in writing .


### pursuant to point of article 26 , the processor shall alert and inform the controller immediately after the establishment of a personal data breach . ### pursuant to point of article 26 , the processor shall alert and inform the controller immediately after the establishment of a personal data breach as referred to in paragraph 1 .


### member states shall provide for exemptions or derogations from the provisions on the general principles in chapter ii , the rights of the data subject in chapter iii , on controller and processor in chapter iv , on the transfer of personal data to third countries and international organisations in chapter v , the independent supervisory authorities in chapter vi and on co - operation and consistency in chapter vii for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression . ### chapter ii , chapter iii , chapter iv , chapter v , chapter vi , , chapter vii as well as articles 73 , 74 , 76 and 79 of chapter viii shall not apply to the processing of personal data carried out for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression .


### where the personal data are not collected from the data subject , the controller shall inform the data subject , in addition to the information referred to in paragraph 1 , from which source the personal data originate . ### where the personal data are not collected from the data subject , the controller shall inform the data subject , in addition to the information referred to in paragraph 1 , from which source the personal data originate , except where the data originate from a publicly available source or where the transfer is provided for by law .


### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , as soon as the controller becomes aware that such a breach has occurred , the controller should notify the breach to the supervisory authority without undue delay and , where feasible , within 24 hours . where this cannot be achieved within 24 hours , an explanation of the reasons for the delay should accompany the notification . the individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation or damage to reputation . the notification should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay . ### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , addressing such economic loss and social harm should be the first and utmost priority . after that , as soon as the controller becomes aware that a breach , which would have a significantly adverse impact on the protection of the personal data or the privacy of the data subject concerned , has occurred , the controller should notify the breach to the supervisory authority without undue delay . the individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions , avoiding information overload for the data subject . a breach should be considered as significantly adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation , damage to reputation the notification should describe the nature of the personal data breach as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay .


### . ### automated processing of personal data intended to evaluate certain personal aspects relating to a natural person shall not be based solely on the special categories of personal data referred to in article 9 .


### the controller and the processor and , if any , the representative of the controller , shall co - operate , on request , with the supervisory authority in the performance of its duties , in particular by providing the information referred to in point of article 53 and by granting access as provided in point of that paragraph . ### the controller and , where appropriate , the processor and , if any , the representative of the controller , shall co - operate , on request , with the supervisory authority in the performance of its duties , in particular by providing the information referred to in point of article 53 and by granting access as provided in point of that paragraph .


### the controller shall implement mechanisms for ensuring that , by default , only those personal data are processed which are necessary for each specific purpose of the processing and are especially not collected or retained beyond the minimum necessary for those purposes , both in terms of the amount of the data and the time of their storage . in particular , those mechanisms shall ensure that by default personal data are not made accessible to an indefinite number of individuals . ### the measures and procedures referred to in paragraph 1 shall : take due account of existing technical standards and regulations in the area of public safety and security ; follow the principle of technology , service and business model neutrality ; be based on global industry - led efforts and standards ; take due account of international developments .


### the controller shall implement mechanisms for ensuring that , by default , only those personal data are processed which are necessary for each specific purpose of the processing and are especially not collected or retained beyond the minimum necessary for those purposes , both in terms of the amount of the data and the time of their storage . in particular , those mechanisms shall ensure that by default personal data are not made accessible to an indefinite number of individuals . ### where the data subject is given a choice regarding the processing of personal data , the controller shall ensure that , by default , only those personal data are processed which are necessary for each specific purpose of the processing and are especially not collected or retained beyond the minimum necessary for those purposes , both in terms of the amount of the data and the time of their storage . in particular , those mechanisms shall ensure that by default personal data are not made accessible to an indefinite number of individuals and that data subjects are able to control the distribution of their personal data .


### the european data protection board shall ensure the consistent application of this regulation . to this effect , the european data protection board shall , on its own initiative or at the request of the commission , in particular : ### the european data protection board shall ensure the consistent application of this regulation . to this effect , the european data protection board shall , on its own initiative , at the request of the commission or other stakeholders , in particular :


### the principles of fair and transparent processing require that the data subject should be informed in particular of the existence of the processing operation and its purposes , how long the data will be stored , on the existence of the right of access , rectification or erasure and on the right to lodge a complaint . where the data are collected from the data subject , the data subject should also be informed whether they are obliged to provide the data and of the consequences , in cases they do not provide such data . ### the principles of fair and transparent processing require that the data subject should be informed in particular of the existence of the processing operation and its purposes , how long the data will be stored and the criteria which may be used as the basis for determining how long the data will be stored , on the existence of the right of access , rectification or erasure and on the right to lodge a complaint . where the data are collected from the data subject , the data subject should also be informed whether they are obliged to provide the data and of the consequences , in cases they do not provide such data .


### each natural or legal person shall have the right to a judicial remedy against decisions of a supervisory authority concerning them . ### each natural or legal person shall have the right to take legal action against decisions of a supervisory authority concerning them or affecting them in any way .


### the controller shall inform the data subject without delay and , at the latest within one month of receipt of the request , whether or not any action has been taken pursuant to article 13 and articles 15 to 19 and shall provide the requested information . this period may be prolonged for a further month , if several data subjects exercise their rights and their cooperation is necessary to a reasonable extent to prevent an unnecessary and disproportionate effort on the part of the controller . the information shall be given in writing . where the data subject makes the request in electronic form , the information shall be provided in electronic form , unless otherwise requested by the data subject . ### the controller shall inform the data subject without delay and , at the latest within 40 calendar days of receipt of the request , whether or not any action has been taken pursuant to article 13 and articles 15 to 19 and shall provide the requested information . this period may be prolonged further , if several data subjects exercise their rights resulting in a large and exceptional number of requests and their cooperation is necessary to a reasonable extent to prevent an unnecessary and disproportionate effort on the part of the controller . however , the controller must comply with the requests as soon as practicable and , if requested , should justify this extension to the supervisory authority . the information shall be given in writing or , where feasible , the data controller may provide access to a secure online platform which would provide the data subject with direct access their personal data . where the data subject makes the request in electronic form , the information shall be provided in electronic form , unless otherwise requested by the data subject or not available in that format .


### having regard to the state of the art and the cost of implementation , the controller shall , both at the time of the determination of the means for processing and at the time of the processing itself , implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject . ### having regard to the state of the art , current technical knowledge and the cost of implementation , the controller shall , both at the time of the determination of the means for processing and at the time of the processing itself , implement technical and organisational measures and procedures appropriate to the activities and their purposes , in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject .


### where personal data are processed for direct marketing purposes , the data subject shall have the right to object free of charge to the processing of their personal data for such marketing . this right shall be explicitly offered to the data subject in an intelligible manner and shall be clearly distinguishable from other information . ### where personal data are processed for direct marketing purposes or where processing is based on point of article 6 , the data subject shall have the right to object free of charge to the processing of their personal data for such marketing . this right shall be explicitly offered to the data subject in an intelligible manner , using clear and plain language , adapted to the data subject , in particular for any information addressed specifically to a child , and shall be clearly distinguishable from other information .


### every natural person shall have the right not to be subject to a measure which produces legal effects concerning this natural person or significantly affects this natural person , and which is based solely on automated processing intended to evaluate certain personal aspects relating to this natural person or to analyse or predict in particular the natural person ' s performance at work , economic situation , location , health , personal preferences , reliability or behaviour . ### a data subject shall have the right not to be subject to a measure which adversely affects this data subject , both offline and online which is based solely on automated processing of data intended to evaluate certain personal aspects relating to a data subject or to analyse or predict in particular the data subject ' s performance at work , economic situation , location , health , personal preferences , reliability or behaviour .


### where a transfer is based on contractual clauses as referred to in point of paragraph 2 of this article the controller or processor shall obtain prior authorisation of the contractual clauses according to point of article 34 from the supervisory authority . if the transfer is related to processing activities which concern data subjects in another member state or other member states , or substantially affect the free movement of personal data within the union , the supervisory authority shall apply the consistency mechanism referred to in article 57 . ### the controller or processor shall obtain prior authorisation of the contractual clauses according to point of article 34 from the competent supervisory authority for transfers according to this article . if the transfer is related to processing activities which substantially affect the free movement of personal data within the union , the competent supervisory authority shall apply the consistency mechanism referred to in article 57 .


### pursuant to point of article 26 , the processor shall alert and inform the controller immediately after the establishment of a personal data breach . ### pursuant to point of article 26 , the processor shall alert and inform the controller without undue delay after the identification of a personal data breach that is likely to produce legal effects to the detriment of the data subject ' s privacy .


### the supervisory authority shall impose a fine up to 1 000 000 eur or , in case of an enterprise up to 2 % of its annual worldwide turnover , to anyone who , intentionally or negligently : ### the supervisory authority shall impose a fine up to 1 000 000 eur or , in case of an enterprise , up to 2 % of its average annual worldwide profits to anyone who intentionally or negligently :


### having regard to the state of the art and the cost of implementation , the controller shall , both at the time of the determination of the means for processing and at the time of the processing itself , implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject . ### having regard to the state of the art , the cost of implementation and international best practices , the controller shall , both at the time of the determination of the means for processing and at the time of the processing itself , implement appropriate measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject .


### for the purposes of this regulation , in relation to the offering of information society services directly to a child , the processing of personal data of a child below the age of 13 years shall only be lawful if and to the extent that consent is given or authorised by the child ' s parent or custodian . the controller shall make reasonable efforts to obtain verifiable consent , taking into consideration available technology . ### for the purposes of this regulation , in relation to the offering of goods or services directly to a child , the processing of personal data of a child below the age of 13 years shall only be lawful if and to the extent that consent is given or authorised by the child ' s parent or legal representative . the controller shall make reasonable efforts to obtain verifiable consent , taking into consideration available technology . the methods to obtain verifiable consent shall not lead to the further processing of personal data which would otherwise not be necessary .


### the data subject shall have the right to object , on grounds relating to their particular situation , at any time to the processing of personal data which is based on points , and of article 6 , unless the controller demonstrates compelling legitimate grounds for the processing which override the interests or fundamental rights and freedoms of the data subject . ### the data subject shall have the right to object at any time to the processing of personal data which is based on points and of article 6 .


### the data subject shall have the right to object , on grounds relating to their particular situation , at any time to the processing of personal data which is based on points , and of article 6 , unless the controller demonstrates compelling legitimate grounds for the processing which override the interests or fundamental rights and freedoms of the data subject . ### the data subject shall have the right to object , on grounds relating to their particular situation , unless the controller demonstrates legitimate interests which override the interests of the data subject . there shall be no right to object where the processing is required by law .


### a systematic and extensive evaluation of personal aspects relating to a natural person or for analysing or predicting in particular the natural person ' s economic situation , location , health , personal preferences , reliability or behaviour , which is based on automated processing and on which measures are based that produce legal effects concerning the individual or significantly affect the individual ; ### a systematic and extensive evaluation of personal aspects relating to a natural person or for analysing or predicting in particular the natural person ' s economic situation , location , health , personal preferences , reliability or behaviour , which is based on automated processing and on which measures are based that produce legal effects to the detriment of the individual , including any further processing operation of the kind referred to in article 20 of this regulation ;


### in order to strengthen the judicial protection of the data subject in situations where the competent supervisory authority is established in another member state than the one where the data subject is residing , the data subject may request any body , organisation or association aiming to protect the rights and interests of data subjects in relation to the protection of their data to bring on the data subject’s behalf proceedings against that supervisory authority to the competent court in the other member state . ### in the spirit of this regulation , in order to strengthen the judicial protection of the data subject in situations where the competent supervisory authority is established in another member state than the one where the data subject is residing , the data subject may request any body , organisation or association acting in the public interest to bring on their behalf proceedings against that supervisory authority to the competent court in the other member state .


### the delegation of power referred to in article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 336 ) , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation . ### the delegation of power referred to in article 7 , article 11 , article 12 , article 14 , article 17 , article 22 , article 31 , article 32 , article 33 , article 38 , article 39 , article 41 , article 41 , article 79 , article 81 and article 82 shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation .


### the delegation of power referred to in article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 33 , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation . ### the delegation of power referred to in article 14 , article 26 , article 33 , article 35 , article 37 , article 39 and article 43 shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation .


### where personal data relating to a data subject are collected , the controller shall provide the data subject with at least the following information : ### where personal data relating to a data subject are collected , the controller shall provide the data subject with at least the following information . the following paragraphs do not apply to small enterprises in the course of their own activity and for data which is strictly and exclusively for their internal use .


### decisions adopted by the commission on the basis of article 25 or article 26 of directive 95 / 46 / ec shall remain in force , until amended , replaced or repealed by the commission . ### decisions adopted by the commission on the basis of article 25 or article 26 of directive 95 / 46 / ec shall be reviewed after the entry into force of this regulation . the commission shall report to the council and parliament two years after the entry into force of this regulation on the results of its review and the measures taken . the european data protection committee shall be given the opportunity in advance to adopt a position on the report .


### the assessment shall contain at least a general description of the envisaged processing operations , an assessment of the risks to the rights and freedoms of data subjects , the measures envisaged to address the risks , safeguards , security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this regulation , taking into account the rights and legitimate interests of data subjects and other persons concerned . ### the assessment shall contain at least a general description of the envisaged processing operations , an assessment of the risks to the rights and freedoms of data subjects , the measures envisaged to address the risks , safeguards , security measures and mechanisms to ensure the protection of personal data , taking into account the rights and legitimate interests of data subjects and other persons concerned .


### having regard to the state of the art and the cost of implementation , the controller shall , both at the time of the determination of the means for processing and at the time of the processing itself , implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject . ### having regard to the state of the art , the cost of implementation and international best practice , the controller shall , both at the time of the determination of the means for processing and at the time of the processing itself , implement appropriate measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject . notwithstanding the first subparagraph , the controller shall only be burdened with measures that are proportionate to the risk of data processing reflected by the nature of the personal data to be processed .


### kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ; personal data may be stored for longer periods insofar as the data will be processed solely for historical , statistical or scientific research purposes in accordance with the rules and conditions of article 83 and if a periodic review is carried out to assess the necessity to continue the storage ; ### kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ; personal data may be stored for longer periods insofar as the data will be processed solely for historical , statistical or scientific purposes in accordance with the rules and conditions of article 83 and if a periodic review is carried out to assess the necessity to continue the storage ;


### each supervisory authority should hear complaints lodged by any data subject and should investigate the matter . the investigation following a complaint should be carried out , subject to judicial review , to the extent that is appropriate in the specific case . the supervisory authority should inform the data subject of the progress and the outcome of the complaint within a reasonable period . if the case requires further investigation or coordination with another supervisory authority , intermediate information should be given to the data subject . ### each supervisory authority should hear complaints lodged by any data subject or by association acting in the public interest and should investigate the matter . the investigation following a complaint should be carried out , subject to judicial review , to the extent that is appropriate in the specific case . the supervisory authority should inform the data subject or the association of the progress and the outcome of the complaint within a reasonable period . if the case requires further investigation or coordination with another supervisory authority , intermediate information should be given to the data subject .


### other reasons of public interest in areas such as social protection , especially in order to ensure the quality and cost - effectiveness of the procedures used for settling claims for benefits and services in the health insurance system . ### other reasons of public interest in areas such as social protection , especially in order to ensure the quality and cost - effectiveness of the procedures used for settling claims for benefits and services in the health insurance system and the provision of health services .


### responsibility of the controller ### overall principle of responsibility of the controller .


### the controller shall document any personal data breaches , comprising the facts surrounding the breach , its effects and the remedial action taken . this documentation must enable the supervisory authority to verify compliance with this article . the documentation shall only include the information necessary for that purpose . ### the controller shall document any personal data breaches , comprising the facts surrounding the breach , its effects and the remedial action taken . this documentation must be sufficient to enable the supervisory authority to verify compliance with this article . the documentation shall only include the information necessary for that purpose .


### the members and the staff of the supervisory authority shall be subject , both during and after their term of office , to a duty of professional secrecy with regard to any confidential information which has come to their knowledge in the course of the performance of their official duties . ### the members and the staff of the supervisory authorities shall be subject , both during and after their term of office , to a duty of professional secrecy with regard to any confidential information which has come to their knowledge in the course of the performance of their official duties .


### in the case of a personal data breach , the controller shall without undue delay and , where feasible , not later than 24 hours after having become aware of it , notify the personal data breach to the supervisory authority . the notification to the supervisory authority shall be accompanied by a reasoned justification in cases where it is not made within 24 hours . ### in the case of a personal data breach relating to special categories of personal date , personal data which are subject to professional secrecy , personal data relating to criminal offences or to the suspicion of a criminal act or personal data relating to bank or credit card accounts , which seriously threaten the rights or legitimate interests of the data subject , the controller shall without undue delay notify the personal data breach to the supervisory authority .


### the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected , having regard to the state of the art and the costs of their implementation . ### the controller and the processor shall implement appropriate technical and organisational measures , including pseudonymisation , to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected , having regard to the state of the art and the costs of their implementation . notwithstanding the first subparagraph , the controller and the processor shall only be burdened with measures that are proportionate to the risk of data processing reflected by the nature of the personal data to be processed .


### where more than one controller or processor is involved in the processing , each controller or processor shall be jointly and severally liable for the entire amount of the damage . ### where more than one controller is involved in the processing , each controller shall be jointly and severally liable for the entire amount of the damage to the extent that the joint controllers ' respective liability has not been determined in the legal arrangement referred to in article 24 . in the case of a group of undertakings , the entire group shall be liable as a single economic entity .


### the controller shall implement mechanisms to ensure the verification of the effectiveness of the measures referred to in paragraphs 1 and 2 . if proportionate , this verification shall be carried out by independent internal or external auditors . ### the controller shall implement mechanisms to ensure the verification of the effectiveness of the measures referred to in paragraphs 1 and 2 . if proportionate , and a high level of risk exists , this verification shall be carried out by independent internal or external auditors .


### the controller or the processor shall entrust the data protection officer at least with the following tasks : ### the controller or the processor shall entrust the data protection organisation or the data protection officer at least with the following tasks :


### the supervisory authority shall act with complete independence in exercising the duties and powers entrusted to it . ### the supervisory authority shall act with complete independence in exercising the duties and powers entrusted to it , notwithstanding co - operative and consistency arrangements related to chapter vii of this regulation and within the legal and administrative limits of the own member state .


### the data transfers or set of transfers , including the categories of personal data , the type of processing and its purposes , the type of data subjects affected and the identification of the third country or countries in question ; ### the data transfers or set of transfers , including the categories of personal data , the type of processing and its purposes , the type of data subjects affected and where appropriate the identification of the third country or countries in question ;


### in particular , any legislative measure referred to in paragraph 1 shall contain specific provisions at least as to the objectives to be pursued by the processing and the determination of the controller . ### in particular , any legislative measure referred to in paragraph 1 must be necessary and proportionate in a democratic society and shall contain specific provisions at least as to : the objectives to be pursued by the processing ; the determination of the controller ; the specific purposes and means of processing ; the categories of persons authorised to process the data ; the procedure to be followed for the processing ; the safeguards to prevent abuse ; the right of data subjects to be informed about the restriction .


### is expressly authorized by a union or member state law which also lays down suitable measures to safeguard the data subject ' s legitimate interests ; or ### is authorized by a union or member state law which also lays down suitable measures to safeguard the data subject ' s legitimate interests and fundamental rights , including the right to non - discrimination ; or


### member states shall provide for exemptions or derogations from the provisions on the general principles in chapter ii , the rights of the data subject in chapter iii , on controller and processor in chapter iv , on the transfer of personal data to third countries and international organisations in chapter v , the independent supervisory authorities in chapter vi and on co - operation and consistency in chapter vii for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression . ### chapter ii , chapter iii , chapter iv , chapter v , chapter vi , , chapter vii as well as articles 73 , 74 , 76 and 79 of chapter viii shall not apply to the processing of personal data carried out for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression .


### processing of data relating to criminal convictions or related security measures is carried out either under the control of official authority or when the processing is necessary for compliance with a legal or regulatory obligation to which a controller is subject , or for the performance of a task carried out for important public interest reasons , and in so far as authorised by union law or member state law providing for adequate safeguards . a complete register of criminal convictions shall be kept only under the control of official authority . ### processing of data relating to criminal convictions or related security measures is carried out either subject to the conditions and safeguards referred to in article 83a or under the supervision of a supervisory authority or when the processing is necessary for compliance with or to avoid a breach of a legal or regulatory obligation or collective agreements on the labour market to which a controller is subject , or for the performance of a task carried out for important public interest reasons , and in so far as authorised by union law or member state law providing for adequate safeguards for the fundamental rights of the data subject . a complete register of criminal convictions shall be kept only under the control of official authority .


### the controller or processor shall provide the supervisory authority with the data protection impact assessment provided for in article 33 and , on request , with any other information to allow the supervisory authority to make an assessment of the compliance of the processing and in particular of the risks for the protection of personal data of the data subject and of the related safeguards . ### the controller shall provide the supervisory authority with the data protection impact assessment provided for in article 33 and , on request , with any other information to allow the supervisory authority to make an assessment of the compliance of the processing and in particular of the risks for the protection of personal data of the data subject and of the related safeguards .


### in order to strengthen the judicial protection of the data subject in situations where the competent supervisory authority is established in another member state than the one where the data subject is residing , the data subject may request any body , organisation or association aiming to protect the rights and interests of data subjects in relation to the protection of their data to bring on the data subject’s behalf proceedings against that supervisory authority to the competent court in the other member state . ### in the spirit of this regulation , in order to strengthen the judicial protection of the data subject in situations where the competent supervisory authority is established in another member state than the one where the data subject is residing , the data subject may request any body , organisation or association acting in the public interest to bring on their behalf proceedings against that supervisory authority to the competent court in the other member state .


### every natural person shall have the right not to be subject to a measure which produces legal effects concerning this natural person or significantly affects this natural person , and which is based solely on automated processing intended to evaluate certain personal aspects relating to this natural person or to analyse or predict in particular the natural person ' s performance at work , economic situation , location , health , personal preferences , reliability or behaviour . ### every data subject shall have the right to request not to be subject to a measure which adversely affects this data subject and which is based solely on automated processing of data intended to evaluate , analyse or predict the data subject ' s performance at work , economic situation , location , health , personal preferences , reliability or behaviour .


### is based on the data subject ' s consent , subject to the conditions laid down in article 7 and to suitable safeguards . ### is lawful pursuant to article 6 to of this regulation .


### the controller or the processor shall designate a data protection officer for a period of at least two years . the data protection officer may be reappointed for further terms . during their term of office , the data protection officer may only be dismissed , if the data protection officer no longer fulfils the conditions required for the performance of their duties . ### the controller or the processor shall designate a data protection officer for a period of at least two years . the data protection officer may be reappointed for further terms .


### the data subject shall have the right to obtain from the controller the erasure of personal data relating to them and the abstention from further dissemination of such data , especially in relation to personal data which are made available by the data subject while he or she was a child , where one of the following grounds applies : ### the data subject has the right to obtain from the controller the erasure of personal data relating to them and the abstention from further processing of such data , unless the data controller is a public authority or an entity commissioned by a public authority or otherwise acting on the behalf of the public authority , including in relation to personal data which are made available by the data subject while he or she was a child , where one of the following grounds applies :


### the identity and the contact details of the controller and , if any , of the controller ' s representative and of the data protection officer ; ### the identity and the contact details of the controller and , if any , of the controller ' s representative ;


### the controller or processor acting on the controller ' s behalf shall consult the supervisory authority prior to the processing of personal data in order to ensure the compliance of the intended processing with this regulation and in particular to mitigate the risks involved for the data subjects where : ### the controller or processor acting on the controller ' s behalf may consult the supervisory authority prior to the processing of special categories of personal data in order to ensure the compliance of the intended processing with this regulation and in particular to mitigate the risks involved for the data subjects where :


### the data subject withdraws consent on which the processing is based according to point of article 6 , or when the storage period consented to has expired , and where there is no other legal ground for the processing of the data ; ### the data subject withdraws consent on which the processing is based according to point of article 6 , or when the retention period consented to has expired , and where there is no other legal ground for the processing or storage of the data ;


### processing is necessary for the purposes of the legitimate interests pursued by a controller , except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data , in particular where the data subject is a child . this shall not apply to processing carried out by public authorities in the performance of their tasks . ### processing is necessary for the purposes of the legitimate interests pursued by , or on behalf of a controller or a processor , or by a third party or parties in whose interest the data is processed , including for the security of processing , except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data , such as in the case of processing data pertaining to a child . the interest or fundamental rights and freedoms of the data subject shall not override processing carried out by public authorities in the performance of their tasks .


### a delegated act adopted pursuant to article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 336 ) , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or the council . ### a delegated act adopted pursuant to article 7 , article 11 , article 12 , article 14 , article 17 , article 22 , article 31 , article 32 , article 33 , article 38 , article 39 , article 41 , article 41 , article 79 , article 81 and article 82 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of four months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or the council .


### where the controller is a public authority or body and where the processing results from a legal obligation pursuant to point of article 6 providing for rules and procedures pertaining to the processing operations and regulated by union law , paragraphs 1 to 4 shall not apply , unless member states deem it necessary to carry out such assessment prior to the processing activities . ### where the controller is a public authority or body or where the data is processed by another body which has been entrusted with the responsibility of delivering public service tasks , and where the processing results from a legal obligation pursuant to point of article 6 providing for rules and procedures pertaining to the processing operations and regulated by union law , paragraphs 1 to 4 shall not apply , unless member states deem it necessary to carry out such assessment prior to the processing activities .


### the chair of the european data protection board shall immediately electronically inform the members of the european data protection board and the commission of any relevant information which has been communicated to it , using a standardised format . the chair of the european data protection board shall provide translations of relevant information , where necessary . ### the chair of the european data protection board shall without undue delay electronically inform the members of the european data protection board and the commission of any relevant information which has been communicated to it , using a standardised format . the chair of the european data protection board shall provide translations of relevant information , where necessary .


### independently of a data subject ' s complaint , any body , organisation or association referred to in paragraph 2 shall have the right to lodge a complaint with a supervisory authority in any member state , if it considers that a personal data breach has occurred . ### independently of a data subject ' s complaint , any person shall have the right to lodge a complaint with a supervisory authority in any member state , if it considers that a personal data breach has occurred .


### where the supervisory authority is of the opinion that the intended processing does not comply with this regulation , in particular where risks are insufficiently identified or mitigated , it shall prohibit the intended processing and make appropriate proposals to remedy such incompliance . ### where the competent supervisory authority determines in accordance with its power that the intended processing does not comply with this regulation , in particular where risks are insufficiently identified or mitigated , it shall prohibit the intended processing and make appropriate proposals to remedy such incompliance . such a decision shall be subject to appeal in a competent court and it may not be enforceable while being appealed unless the processing results in immediate serious harm suffered by data subjects .


### each supervisory authority shall have the power to bring violations of this regulation to the attention of the judicial authorities and to engage in legal proceedings , in particular pursuant to article 74 and article 75 . ### the competent supervisory authority shall have the power to bring violations of this regulation to the attention of the judicial authorities and to engage in legal proceedings , in particular pursuant to article 74 and article 75 .


### processing is necessary for the establishment , exercise or defence of legal claims ; or ### processing is necessary for the establishment , exercise or defence of claims at issue in legal or administrative proceedings of any kind ; or