### member states shall take all necessary steps to ensure that the vessels may be made available on the market and put into service only if they do not compromise the safety of persons , domestic animals or property when properly installed and maintained and used for the purposes for which they are intended . ### member states shall take all necessary steps to ensure that the vessels may be made available on the market and put into service only if they do not compromise the safety of persons , domestic animals or property when properly installed and maintained and used for the purposes for which they are intended or for purposes that can be reasonably foreseen .


### for vessels of which the product of ps x v exceeds 50 bar . l , manufacturers shall draw up the technical documentation referred to in points 2 and 3 of annex iii and carry out the relevant conformity assessment procedure referred to in article 13 or have it carried out . ### for vessels of which the product of ps x v exceeds 50 bar . l , manufacturers shall draw up the technical documentation and carry out the relevant conformity assessment procedure referred to in article 13 or have it carried out .


### manufacturers shall ensure that procedures are in place for series production to remain in conformity . changes in vessels design or characteristics and changes in the harmonised standards by reference to which conformity of a vessel is declared shall be adequately taken into account . ### manufacturers shall ensure that procedures are in place for series production to remain in conformity . changes in vessels design or characteristics and changes in the harmonised standards or in technical specifications by reference to which conformity of a vessel is declared shall be adequately taken into account .


### when deemed appropriate with regard to the risks presented by a vessel , manufacturers shall to protect the health and safety of users , carry out sample testing of vessels made available on the market , investigate , and , if necessary , keep a register of complaints , of non - conforming vessels and vessel recalls , and shall keep distributors informed of any such monitoring . ### when deemed appropriate with regard to the risks presented by a vessel , manufacturers shall to protect the health and safety of end - users , carry out sample testing of vessels made available on the market , investigate , and , if necessary , keep a register of complaints , of non - conforming vessels and vessel recalls , and shall keep distributors informed of any such monitoring .


### manufacturers shall indicate their name , registered trade name or registered trade mark and the address at which they can be contacted on the vessel . the address must indicate a single point at which the manufacturer can be contacted . ### manufacturers shall indicate their name , registered trade name or registered trade mark and the address at which they can be contacted on the vessel . where that is technically not feasible or disproportionately costly , those details shall be provided on the packaging or in a document accompanying the product . the address must indicate a single point at which the manufacturer can be contacted .


### manufacturers shall ensure that the vessel of which the product of ps x v exceeds 50 bar . l , is accompanied by the instructions and safety information referred to in point 2 of annex iii , in the official language or languages of the country member state of destination . ### manufacturers shall ensure that the vessel of which the product of ps x v exceeds 50 bar . l , is accompanied by the instructions and safety information referred to in point 2 of annex iii , in a language which can be easily understood by users , as determined by the member state concerned . such instructions and safety information as well as any labelling shall be clear , understandable and intelligible .


### importers shall ensure that the vessel of which the product of ps x v exceeds 50 bar . l , is accompanied by the instructions and safety information referred to in point 2 of annex iii , in the official language or languages of the member state of destination . ### importers shall ensure that the vessel of which the product of ps x v exceeds 50 bar . l , is accompanied by the instructions and safety information referred to in point 2 of annex iii , in a language which can be easily understood by users , as determined by the member state concerned .


### economic operators shall , on request , identify the following to the market surveillance authorities : ### economic operators shall , on request , specify the following to the market surveillance authorities :


### economic operators shall be able to present the information referred to in the first subparagraph for a period of 10 years after they have been supplied with the vessel and for a period of 10 years after they have supplied the vessel . ### economic operators shall present the information referred to in the first subparagraph for a period of 10 years after they have been supplied with the vessel and for a period of 10 years after they have supplied the vessel . economic operators shall not be required to update that information after supply is finalised .


### the eu declaration of conformity shall have the model structure set out in annex iii of decision no 768 / 2008 / ec , shall contain the elements specified in the relevant modules set out in annex ii of this directive and shall be continuously updated . it shall be translated into the language or languages required by the member state in which market the vessel is placed or made available . ### the eu declaration of conformity shall have the model structure set out in annex iii of decision no 768 / 2008 / ec , shall contain the elements specified in the relevant modules set out in annex ii of this directive and shall be continuously updated . it shall be translated into the language or languages required by the member state in which market the vessel is placed or made available . upon the request of the market surveillance authorities , the economic operator shall provide a copy of the eu declaration of conformity in paper form or by electronic means .


### by drawing up the eu declaration of conformity , the manufacturer shall assume responsibility for the compliance of the vessel . ### by drawing up the eu declaration of conformity , the manufacturer shall assume responsibility for the compliance of the vessel with the requirements laid down in this directive .


### member states shall designate a notifying authority that shall be responsible for setting up and carrying out the necessary procedures for the assessment and notification of conformity assessment bodies and the monitoring of notified bodies , including compliance with the provisions of article 23 . ### member states shall designate a single notifying authority that shall be responsible for setting up and carrying out the necessary procedures for the assessment and notification of conformity assessment bodies and the monitoring of notified bodies , including compliance with the provisions of article 23 .


### where the market surveillance authorities of one member state have taken action pursuant to article 20 of regulation no 765 / 2008 , or where they have sufficient reason to believe that a vessel covered by this directive presents a risk to the health or safety of persons or to other aspects of public interest protection covered by this directive , they shall carry out an evaluation in relation to the vessel concerned covering all the requirements laid down in this directive . the relevant economic operators shall cooperate as necessary with the market surveillance authorities . ### where the market surveillance authorities of one member state have taken action pursuant to article 20 of regulation no 765 / 2008 , or where they have sufficient reason to believe that a vessel covered by this directive presents a risk to the health or safety of persons or to other aspects of public interest protection covered by this directive , they shall carry out an evaluation in relation to the vessel concerned covering all the relevant requirements laid down in this directive . the relevant economic operators shall cooperate as necessary with the market surveillance authorities .


### failure of the vessel to meet requirements relating to the health or safety of persons or to other aspects of public interest protection laid down in this directive ; ### failure of the vessel to meet requirements relating to the health or safety of persons or to other aspects of public interest protection laid down in this directive ; or


### member states shall ensure that appropriate restrictive measures are taken in respect of the vessel concerned , without delay . ### member states shall ensure that appropriate restrictive measures are taken in respect of the vessel concerned , such as withdrawal of the vessel from the market , without delay .


### member states shall lay down rules on penalties applicable to infringements of the national provisions adopted pursuant to this directive and shall take all measures necessary to ensure that they are enforced . ### member states shall build upon existing mechanisms to ensure correct application of the regime governing the ce marking and shall take appropriate action in the event of improper use of the marking . member states shall lay down rules on penalties applicable to infringements by economic operators of the national provisions adopted pursuant to this directive and shall take all measures necessary to ensure that they are enforced . such rules may include criminal penalties for serious infringements .


### the penalties provided for shall be effective , proportionate and dissuasive . ### the penalties referred to in the first paragraph shall be effective , proportionate to the seriousness of the offence , and dissuasive .


### member states shall notify those provisions to the commission by [ the date set out in the second subparagraph of article 41 ] at the latest and shall notify it without delay of any subsequent amendment affecting them . ### member states shall notify those provisions to the commission by [ the date set out in the second subparagraph of article 41 ] and shall notify it without delay of any subsequent amendment affecting them . the commission shall make those provisions publicly available by publishing them on the internet


### member states shall communicate to the commission the text of the main provisions of national law which they adopt in the field covered by this directive . ### member states shall communicate to the commission the text of the main provisions of national law which they adopt in the field covered by this directive . the commission shall make those texts publicly available by publishing them on the internet .


### 3 . 1 . for each individual vessel manufactured one or more tests on one or more specific aspects of the vessel shall be carried out by the manufacturer or on his behalf , in order to verify conformity with the type described in the eu - type examination certificate and with the corresponding requirements of this directive . the tests shall be carried out under the responsibility of a notified body , chosen by the manufacturer . ### 3 . 1 . for each individual vessel manufactured one or more tests on one or more specific aspects of the vessel shall be carried out by the manufacturer or on his behalf , in order to verify conformity with the type described in the eu - type examination certificate and with the corresponding requirements of this directive . the tests shall be carried out under the responsibility of an accredited in - house body or of a notified body , chosen by the manufacturer .


### 3 . 2 . the notified body shall carry out the appropriate examinations and tests in order to check the conformity of the vessels with the requirements of this directive by examination and testing of vessels in accordance with the following paragraphs : ### 3 . 2 . the notified body shall carry out the appropriate examinations and tests in order to check the conformity of the vessels with the requirements of this directive by examination and testing of vessels in accordance with the following points :


### the manufacturer shall be able to supply on request the notified body ' s certificates of conformity referred to in the seventh subparagraph . ### the manufacturer shall be able to supply on request the notified body ' s certificates of conformity referred to in point .


### a notified body , chosen by the manufacturer , shall carry out vessel checks or have them carried out at appropriate intervals determined by the body , in order to verify the quality of the internal checks on the vessel , taking into account , inter alia , the technological complexity of the vessels and the quantity of production . an adequate sample of the final vessels , taken on site by the notified body before the placing on the market , shall be examined and appropriate tests as identified by the relevant parts of the harmonised standards or equivalent tests , shall be carried out to check the conformity of the vessel with the type described in the eu - type examination certificate and with the relevant requirements of this directive . ### an accredited in - house body or a notified body , chosen by the manufacturer , shall carry out vessel checks or have them carried out at appropriate intervals determined by the body , in order to verify the quality of the internal checks on the vessel , taking into account , inter alia , the technological complexity of the vessels and the quantity of production . an adequate sample of the final vessels , taken on site by the notified body before the placing on the market , shall be examined and appropriate tests as identified by the relevant parts of the harmonised standards or equivalent tests , shall be carried out to check the conformity of the vessel with the type described in the eu - type examination certificate and with the relevant requirements of this directive .


### this regulation lays down rules governing export authorisation , and import and transit measures for firearms , their parts and essential components and ammunition , for the purpose of implementing article 10 of the united nations protocol against the illicit manufacturing of and trafficking in firearms , their parts and components and ammunition , supplementing the united nations convention against transnational organised crime . ### this regulation lays down rules governing export authorisation , and import and transit measures for firearms , their essential parts and ammunition , for the purpose of implementing article 10 of the united nations protocol against the illicit manufacturing of and trafficking in firearms , their parts and components and ammunition , supplementing the united nations convention against transnational organised crime .


### ‘ parts and essential components’ means any element or replacement element specifically designed for a firearm and essential to its operation , including a barrel , frame or receiver , slide or cylinder , bolt or breech block , and any device designed or adapted to diminish the sound caused by firing a firearm . ‘ essential component’ means the breach - closing mechanism , the chamber and the barrel of a firearm which , being separate objects , are included in the category of the firearms on which they are or are intended to be mounted ; ### 2 . ‘ essential parts’ means any element or replacement element specifically designed for a firearm and essential to its operation , including a barrel , frame or receiver , slide or cylinder , bolt or breech block , and any device designed or adapted to diminish the sound caused by firing a firearm ;


### ‘ ammunition’ means the complete round or the components thereof , including cartridge cases , primers , propellant powder , bullets or projectiles that are used in a firearm , provided that those components are themselves subject to authorisation in the relevant member state ; ### ‘ ammunition’ means the complete round , as used in a firearm , comprising cartridge cases , primers , propellant powder , and projectiles ;


### ‘ multiple export authorisation’ means an authorisation granted to one specific exporter for multiple shipments to the same end user or consignee in a third country and covering one or more firearms , their parts and components and ammunition ; ### ‘ multiple export authorisation’ means an authorisation granted at his request to one specific exporter for multiple shipments to one or more end users or consignees and / or in one or more specific third countries and covering one or more firearms , their essential parts and ammunition ;


### the importing third country has issued the relevant import authorisation and , ### the importing third country has issued the relevant import authorisation if national legislation in force so provides and ,


### the member states shall process requests for exports authorization or multiple export authorization within a period of time to be determined by national law or practice , which in all cases shall not exceed ninety working days . ### the member states shall complete procedures for the issue of single or multiple export authorisations within a period of time which shall not exceed sixty calendar days .


### the period of validity of an export or a multiple export authorisation shall be decided by the member states , but shall not be less than twelve months . ### the period of validity of an export authorisation decided by the member states shall not be less than twelve months , whilst the period of validity of a multiple export authorisation shall not be less than twenty - four months .


### member states may decide to make use of electronic documents for the purpose of processing the requests for authorisation . ### member states shall endeavour to use modern communication technologies and electronic documents in order to facilitate export and communication procedures with third countries .


### a description and the quantity of the firearms , their parts and components and ammunition , including the marking applied to the firearms . ### a description and the quantity of the firearms , their essential parts and ammunition .


### the information referred to in paragraph 1 , if contained in the import authorisation , shall be provided by the exporter in advance to the third countries of transit , at the latest prior to the shipment . ### the information referred to in paragraph 1 , if contained in the import authorisation , shall be provided by the exporter to the third countries of transit prior to the shipment .


### when leaving the customs territory of the union through a point of crossing of the external border of the member state of their residence , for the temporary export of one or more firearms during a journey to a third country , hunters and sport shooters may produce the european firearms pass pursuant to articles 1 and 12 of directive 91 / 477 / eec , a national firearms licence , a national hunting permit , or other valid national document issued by the competent authority of the member state of their residence . ### when leaving or returning to the customs territory of the union through a point of crossing of the external border , for the temporary export of one or more firearms , their essential parts and ammunition , during a journey to a third country , hunters and sport shooters may produce the european firearms pass pursuant to articles 1 and 12 of directive 91 / 477 / eec , a national firearms licence , a national hunting permit , or other valid national document issued by the competent authority of the member state of their residence .


### considerations about intended end use , consignee and the risk of diversion . ### considerations about intended end use , consignee and the real risk of diversion .


### refuse to grant an export or a multiple export authorisation if the natural or legal person applying for such authorisation has any previous criminal records concerning illicit trafficking in firearms , their parts and essential components or ammunition , or to other serious crimes ; ### refuse to grant an export or a multiple export authorisation if the natural or legal person applying for such authorisation has any previous criminal records concerning illicit trafficking in firearms , their essential parts or ammunition , or for other violent intentional crimes ;


### council regulation no 515 / 97 of 13 march 1997 , and in particular the provisions in that regulation on the confidentiality of information , shall apply mutatis mutandis , without prejudice to article 18 of this regulation . ### .


### every five years the commission shall review the implementation of this regulation and present a report to the european parliament and the council on its application , which may include proposals for its amendment . member states shall provide the commission with all appropriate information for the preparation of the report . ### every ten years the commission shall review the implementation of this regulation and present a report to the european parliament and the council on its application , which may include proposals for its amendment . member states shall provide the commission with all appropriate information for the preparation of the report .


### a : firearms 9302 00 00 revolvers and pistols , other than those of heading 9303 or 9304 9303 other firearms including sporting shotguns and rifles . 9303 20 other sporting , hunting or target - shooting shotguns , including combination shotgun - rifles : 9303 20 10 - single - barrelled , smooth bore 9303 20 95 other 9303 30 00 other sporting , hunting or target - shooting rifles . 9303 90 00 other . 9304 00 00 other arms . ### a : firearms 9302 00 00 revolvers and pistols , other than those of heading 9303 9303 other firearms including sporting shotguns and rifles . 9303 20 00 other sporting , hunting or target - shooting shotguns , including combination shotgun - rifles : 9303 20 10 - single - barrelled , smooth bore firearms 9303 30 00 other sporting , hunting or target - shooting rifles .


### b : parts and essential components 9305 parts and accessories of articles of headings 9302 to 9304 : 9305 10 00 − of revolvers or pistols − of shotguns or rifles of heading 9303 : 9305 21 00 – – shotgun barrels 9305 29 00 – – other 9305 99 00 – other ### b : essential parts forming part of 9305 parts and accessories of articles of headings 9302 to 9303 : 9305 10 00 − of revolvers or pistols − of shotguns or rifles of heading 9303 : 9305 21 00 – – shotgun barrels


### c : ammunition 9306 cartridges and other ammunition and projectiles and parts thereof , including shots − shotgun cartridges and parts thereof : 9306 21 00 – – cartridges 9306 29 – – other : 9306 29 40 – – – cases 9306 29 70 – – – other 9306 30 other cartridges and parts thereof : 9306 30 10 – – for revolvers and pistols of heading 9302 – – – other : 9306 30 91– – – – centrefire cartridges 9306 30 93 – – – – rimfire cartridges 9306 30 97 – – – – other 9306 90 – other : 9306 90 90 – – other ### c : ammunition as defined in article 2 , classified under 9306 21 00 – – shotgun cartridges 9306 30 10 – – for revolvers and pistols of heading 9302 9306 30 91– – – – centrefire cartridges 9306 30 93 – – – – rimfire cartridges


### this regulation should not apply to processing of personal data by a natural person , which are exclusively personal or domestic , such as correspondence and the holding of addresses , and without any gainful interest and thus without any connection with a professional or commercial activity . the exemption should also not apply to controllers or processors which provide the means for processing personal data for such personal or domestic activities . ### this regulation should not apply to processing of personal data by a person , which are exclusively personal or domestic , such as correspondence and the holding of addresses , and without any gainful interest and thus without any connection with a professional or commercial activity , and which does not involve making such data accessible to an indefinite number of people . the exemption should also not apply to controllers or processors which provide the means for processing personal data for such personal or domestic activities .


### the principles of protection should apply to any information concerning an identified or identifiable person . to determine whether a person is identifiable , account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the individual . the principles of data protection should not apply to data rendered anonymous in such a way that the data subject is no longer identifiable . ### the principles of protection should apply to any information concerning an identified or identifiable person . to determine whether a person is identifiable , account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the individual . the principles of data protection should not apply to data rendered anonymous in such a way that the data subject is no longer directly identifiable , including , where possible , a separation of processed data from identity - revealing data . in the latter case , also pseudonymized data are useful if the key to link the pseudonymous with the identity is safe according to the state of the art .


### when using online services , individuals may be associated with online identifiers provided by their devices , applications , tools and protocols , such as internet protocol addresses or cookie identifiers . this may leave traces which , combined with unique identifiers and other information received by the servers , may be used to create profiles of the individuals and identify them . it follows that identification numbers , location data , online identifiers or other specific factors as such need not necessarily be considered as personal data in all circumstances . ### when using online services , individuals may be associated with online identifiers provided by their devices , applications , tools and protocols , such as internet protocol addresses or cookie identifiers . this may leave traces which , combined with unique identifiers and other information received by the servers , may be used to create profiles of the individuals and identify them . it follows that a study should be conducted , on a case - by - case basis and in accordance with technological developments , into whether identification numbers , location data , online identifiers or other specific factors as such must necessarily be considered as personal data .


### consent should be given explicitly by any appropriate method enabling a freely given specific and informed indication of the data subject ' s wishes , either by a statement or by a clear affirmative action by the data subject , ensuring that individuals are aware that they give their consent to the processing of personal data , including by ticking a box when visiting an internet website or by any other statement or conduct which clearly indicates in this context the data subject ' s acceptance of the proposed processing of their personal data . silence or inactivity should therefore not constitute consent . consent should cover all processing activities carried out for the same purpose or purposes . if the data subject ' s consent is to be given following an electronic request , the request must be clear , concise and not unnecessarily disruptive to the use of the service for which it is provided . ### consent should be given explicitly by any method appropriate to the media used enabling a freely given specific and informed indication of the data subject ' s wishes , either by a statement or by a clear affirmative action by the data subject , ensuring that individuals are aware that they give their consent to the processing of personal data , including by ticking a box when visiting an internet website or by any other statement or conduct which clearly indicates in this context the data subject ' s acceptance of the proposed processing of their personal data . silence or inactivity should therefore not constitute consent . consent should cover all processing activities carried out for the same purpose or purposes . if the data subject ' s consent is to be given following an electronic request , the request must be clear , concise and not unnecessarily disruptive to the use of the service for which it is provided .


### the main establishment of a controller in the union should be determined according to objective criteria and should imply the effective and real exercise of management activities determining the main decisions as to the purposes , conditions and means of processing through stable arrangements . this criterion should not depend whether the processing of personal data is actually carried out at that location ; the presence and use of technical means and technologies for processing personal data or processing activities do not , in themselves , constitute such main establishment and are therefore no determining criteria for a main establishment . the main establishment of the processor should be the place of its central administration in the union . ### the main establishment of a controller or a processor in the union should be determined according to objective criteria and should imply the effective and real exercise of management activities determining the main decisions as to the purposes , conditions and means of processing through stable arrangements . this criterion should not depend whether the processing of personal data is actually carried out at that location ; the presence and use of technical means and technologies for processing personal data or processing activities do not , in themselves , constitute such main establishment and are therefore no determining criteria for a main establishment .


### children deserve specific protection of their personal data , as they may be less aware of risks , consequences , safeguards and their rights in relation to the processing of personal data . to determine when an individual is a child , this regulation should take over the definition laid down by the un convention on the rights of the child . ### children deserve specific protection of their personal data , as they may be less aware of risks , consequences , safeguards and their rights in relation to the processing of personal data and they are vulnerable consumers . to determine when an individual is a child , this regulation should take over the definition laid down by the un convention on the rights of the child . in particular , child - friendly language has to be used to ensure the right of consent for children above the age of 13 .


### children deserve specific protection of their personal data , as they may be less aware of risks , consequences , safeguards and their rights in relation to the processing of personal data . to determine when an individual is a child , this regulation should take over the definition laid down by the un convention on the rights of the child . ### children deserve specific protection of their personal data , as they may be less aware of risks , consequences , safeguards and their rights in relation to the processing of personal data . at the same time , given the higher average technology - dependence of younger generations , a distinction shall be made between the definition laid down by the un convention on the rights of the child and the ' minor age ' criterion .


### consent should not provide a valid legal ground for the processing of personal data , where there is a clear imbalance between the data subject and the controller . this is especially the case where the data subject is in a situation of dependence from the controller , among others , where personal data are processed by the employer of employees ' personal data in the employment context . where the controller is a public authority , there would be an imbalance only in the specific data processing operations where the public authority can impose an obligation by virtue of its relevant public powers and the consent cannot be deemed as freely given , taking into account the interest of the data subject . ### consent shall be freely given and the data subject shall not be forced to consent for processing of its data , especially where there is a significant imbalance between data subject and controller . this may be the case where the data subject is in a situation of dependence from the controller , among others , where personal data are processed by the employer of employees ' personal data in the employment context . however , when the purpose of data processing is in the interest of the data subject and the data subject is subsequently able to withdraw consent without detriment , the consent should provide a valid legal ground for processing . where the controller is a public authority , there would be an imbalance only in the specific data processing operations where the public authority can impose an obligation by virtue of its relevant public powers and the consent cannot be deemed as freely given , taking into account the interest of the data subject .


### consent should not provide a valid legal ground for the processing of personal data , where there is a clear imbalance between the data subject and the controller . this is especially the case where the data subject is in a situation of dependence from the controller , among others , where personal data are processed by the employer of employees ‘ personal data in the employment context . where the controller is a public authority , there would be an imbalance only in the specific data processing operations where the public authority can impose an obligation by virtue of its relevant public powers and the consent cannot be deemed as freely given , taking into account the interest of the data subject . ### consent should not provide a valid legal ground for the processing of personal data , where there is a clear imbalance between the data subject and the controller . this is especially the case where the data subject is in a situation of dependence from the controller , among others , where personal data are processed by the employer of employees ‘ personal data in the employment context . where the controller is a public authority , there would be an imbalance only in the specific data processing operations where the public authority can impose a new and unjustified obligation by virtue of its relevant public powers and the consent cannot be deemed as freely given , taking into account the interest of the data subject .


### the legitimate interests of a controller may provide a legal basis for processing , provided that the interests or the fundamental rights and freedoms of the data subject are not overriding . this would need careful assessment in particular where the data subject is a child , given that children deserve specific protection . the data subject should have the right to object the processing , on grounds relating to their particular situation and free of charge . to ensure transparency , the controller should be obliged to explicitly inform the data subject on the legitimate interests pursued and on the right to object , and also be obliged to document these legitimate interests . given that it is for the legislator to provide by law the legal basis for public authorities to process data , this legal ground should not apply for the processing by public authorities in the performance of their tasks . ### the legitimate interests of a data subject may provide a legal basis for processing , provided that the interests or the fundamental rights and freedoms of the data subject are not overriding . this would need careful assessment in particular where the data subject is a child , given that children deserve specific protection . the data subject should have the right to object the processing , on grounds relating to their particular situation and free of charge . to ensure transparency , the controller or the third parties to whom the data are sent should be obliged to explicitly inform the data subject on the legitimate interests pursued and on the right to object , and also be obliged to document these legitimate interests . given that it is for the legislator to provide by law the legal basis for public authorities to process data , this legal ground should not apply for the processing by public authorities in the performance of their tasks .


### the legitimate interests of a controller may provide a legal basis for processing , provided that the interests or the fundamental rights and freedoms of the data subject are not overriding . this would need careful assessment in particular where the data subject is a child , given that children deserve specific protection . the data subject should have the right to object the processing , on grounds relating to their particular situation and free of charge . to ensure transparency , the controller should be obliged to explicitly inform the data subject on the legitimate interests pursued and on the right to object , and also be obliged to document these legitimate interests . given that it is for the legislator to provide by law the legal basis for public authorities to process data , this legal ground should not apply for the processing by public authorities in the performance of their tasks . ### the legitimate interests of a controller may provide a legal basis for processing , provided that the interests or the fundamental rights and freedoms of the data subject are not overriding . this would need careful assessment in particular where the data subject is a child , given that children deserve specific protection . the data subject should have the right to object the processing free of charge . a legitimate interests pursued by controller may include : direct marketing of controller ' s goods and services , enforcement of the controller ' s claims and ensuring the security of the system , network and information . when data subject withdraws his or her consent , the controller shall be also allowed to refuse further provision of services if the processing is necessary because of the nature of the service or the functioning of the filling system . to ensure transparency , the controller should be obliged to explicitly inform the data subject on the legitimate interests pursued and on the right to object , and also be obliged to document these legitimate interests . given that it is for the legislator to provide by law the legal basis for public authorities to process data , this legal ground should not apply for the processing by public authorities in the performance of their tasks .


### the principles of fair and transparent processing require that the data subject should be informed in particular of the existence of the processing operation and its purposes , how long the data will be stored , on the existence of the right of access , rectification or erasure and on the right to lodge a complaint . where the data are collected from the data subject , the data subject should also be informed whether they are obliged to provide the data and of the consequences , in cases they do not provide such data . ### the principles of fair and transparent processing require that the data subject should be informed in particular of the existence of the processing operation and its purposes , the criteria which may be used to determine how long the data will be stored for each purpose , on the existence of the right of access , rectification or erasure and on the right to lodge a complaint . where the data are collected from the data subject , the data subject should also be informed whether they are obliged to provide the data and of the consequences , in cases they do not provide such data .


### the information in relation to the processing of personal data relating to the data subject should be given to them at the time of collection , or , where the data are not collected from the data subject , within a reasonable period , depending on the circumstances of the case . where data can be legitimately disclosed to another recipient , the data subject should be informed when the data are first disclosed to the recipient . ### the information in relation to the processing of personal data relating to the data subject should be given to them at the time of collection , or , where the data are not collected from the data subject , within a reasonable period , depending on the circumstances of the case . where data can be legitimately disclosed to another recipient , the data subject should be informed when the data are first disclosed to the recipient . at the same time , no processing other than storing should be allowed before the data subject is fully aware of the information referred to here .


### any person should have the right of access to data which has been collected concerning them , and to exercise this right easily , in order to be aware and verify the lawfulness of the processing . every data subject should therefore have the right to know and obtain communication in particular for what purposes the data are processed , for what period , which recipients receive the data , what is the logic of the data that are undergoing the processing and what might be , at least when based on profiling , the consequences of such processing . this right should not adversely affect the rights and freedoms of others , including trade secrets or intellectual property and in particular the copyright protecting the software . however , the result of these considerations should not be that all information is refused to the data subject . ### any person should have the right of access to data which has been collected concerning them , and to exercise this right easily , in order to be aware and verify the lawfulness of the processing . every data subject should therefore have the right to know and obtain communication in particular for what purposes the data are processed , the criteria which may be used to determine for how long the data will be stored for each purpose , which recipients receive the data , what is the logic of the data that are undergoing the processing and what might be , at least when based on profiling , the consequences of such processing . this right should not adversely affect the rights and freedoms of others , including trade secrets or intellectual property and in particular the copyright protecting the software . however , the result of these considerations should not be that all information is refused to the data subject .


### any person should have the right to have personal data concerning them rectified and a ‘ right to be forgotten’ where the retention of such data is not in compliance with this regulation . in particular , data subjects should have the right that their personal data are erased and no longer processed , where the data are no longer necessary in relation to the purposes for which the data are collected or otherwise processed , where data subjects have withdrawn their consent for processing or where they object to the processing of personal data concerning them or where the processing of their personal data otherwise does not comply with this regulation . this right is particularly relevant , when the data subject has given their consent as a child , when not being fully aware of the risks involved by the processing , and later wants to remove such personal data especially on the internet . however , the further retention of the data should be allowed where it is necessary for historical , statistical and scientific research purposes , for reasons of public interest in the area of public health , for exercising the right of freedom of expression , when required by law or where there is a reason to restrict the processing of the data instead of erasing them . ### any person should have the right to have personal data concerning them rectified and the right to have such personal data erased where the retention of such data is not in compliance with this regulation . in particular , data subjects should have the right that their personal data are erased and no longer processed , where the data are no longer necessary in relation to the purposes for which the data are collected or otherwise processed , where data subjects have withdrawn their consent for processing or where they object to the processing of personal data concerning them or where the processing of their personal data otherwise does not comply with this regulation . this right is particularly relevant , when the data subject has given their consent as a child , when not being fully aware of the risks involved by the processing , and later wants to remove such personal data especially on the internet . however , the further retention of the data should be allowed where it is necessary for historical , statistical and scientific research purposes , for reasons of public interest in the area of public health , for exercising the right of freedom of expression , when required by law or where there is a reason to restrict the processing of the data instead of erasing them .


### to strengthen the ‘ right to be forgotten’ in the online environment , the right to erasure should also be extended in such a way that a controller who has made the personal data public should be obliged to inform third parties which are processing such data that a data subject requests them to erase any links to , or copies or replications of that personal data . to ensure this information , the controller should take all reasonable steps , including technical measures , in relation to data for the publication of which the controller is responsible . in relation to a third party publication of personal data , the controller should be considered responsible for the publication , where the controller has authorised the publication by the third party . ### to strengthen the right to erasure in the online environment , such right should also be extended in such a way that a controller who has transferred the personal data or made them public without being instructed to do so by the data subject should be obliged to inform third parties which are processing such data that a data subject requests them to erase any links to , or copies or replications of that personal data . to ensure this information , the controller should take all reasonable steps , including technical measures , in relation to data for the publication of which the controller is responsible . in relation to a third party publication of personal data , the controller should be considered responsible for the publication , where the controller has authorised the publication by the third party .


### comprehensive responsibility and liability of the controller for any processing of personal data carried out by the controller or on the controller ' s behalf should be established . in particular , the controller should ensure and be obliged to demonstrate the compliance of each processing operation with this regulation . ### overall responsibility and liability of the controller for any processing of personal data carried out by the controller or on the controller ' s behalf should be established . in particular , the controller should ensure and be obliged to demonstrate the compliance of each processing operation with this regulation .


### the protection of the rights and freedoms of data subjects as well as the responsibility and liability of controllers and processor , also in relation to the monitoring by and measures of supervisory authorities , requires a clear attribution of the responsibilities under this regulation , including where a controller determines the purposes , conditions and means of the processing jointly with other controllers or where a processing operation is carried out on behalf of a controller . ### the protection of the rights and freedoms of data subjects as well as the responsibility and liability of controllers and processor , also in relation to the monitoring by and measures of supervisory authorities , requires a clear attribution of the responsibilities under this regulation , including where a controller determines the purposes , conditions and means of the processing jointly with other controllers or where a processing operation is carried out on behalf of a controller . where joint and several liability applies , a processor which has made amends for damage done to the data subject concerned may bring an action against the controller for reimbursement if it has acted in conformity with the legal act binding it to the controller .


### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , as soon as the controller becomes aware that such a breach has occurred , the controller should notify the breach to the supervisory authority without undue delay and , where feasible , within 24 hours . where this cannot achieved within 24 hours , an explanation of the reasons for the delay should accompany the notification . the individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation or damage to reputation . the notification should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay . ### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , as soon as the controller becomes aware that a breach which would have a significant impact on the data subject has occurred , the controller should notify the breach to the supervisory authority without undue delay . the individuals whose personal data could be significantly adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as significantly adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation or damage to reputation . the notification should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay .


### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , as soon as the controller becomes aware that such a breach has occurred , the controller should notify the breach to the supervisory authority without undue delay and , where feasible , within 24 hours . where this cannot achieved within 24 hours , an explanation of the reasons for the delay should accompany the notification . the individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation or damage to reputation . the notification should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay . ### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , addressing such economic loss and social harm should be the first and utmost priority . after that , the controller should notify the breach to the supervisory authority without undue delay . the individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation , damage to reputation or money loss . the notification to the supervisory authority should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay .


### in setting detailed rules concerning the format and procedures applicable to the notification of personal data breaches , due consideration should be given to the circumstances of the breach , including whether or not personal data had been protected by appropriate technical protection measures , effectively limiting the likelihood of identity fraud or other forms of misuse . moreover , such rules and procedures should take into account the legitimate interests of law enforcement authorities in cases where early disclosure could unnecessarily hamper the investigation of the circumstances of a breach . ### in assessing the level of detail of the notification of personal data breaches , due consideration should be given to the circumstances of the breach , including whether or not personal data had been protected by appropriate technical protection measures , effectively limiting the likelihood of identity fraud or other forms of misuse . moreover , such rules and procedures should take into account the legitimate interests of law enforcement authorities in cases where early disclosure could unnecessarily hamper the investigation of the circumstances of a breach .


### where the processing of personal data in the context of the activities of an establishment of a controller or a processor in the union takes place in more than one member state , one single supervisory authority should be competent for monitoring the activities of the controller or processor throughout the union and taking the related decisions , in order to increase the consistent application , provide legal certainty and reduce administrative burden for such controllers and processors . ### where the processing of personal data in the context of the activities of an establishment of a controller or a processor in the union takes place in more than one member state , one single supervisory authority should be competent for monitoring the activities of the controller or processor throughout the union and taking the related decisions , in order to provide legal certainty and reduce administrative burden for such controllers and processors .


### in order to ensure the consistent application of this regulation throughout the union , a consistency mechanism for co - operation between the supervisory authorities themselves and the commission should be established . this mechanism should in particular apply where a supervisory authority intends to take a measure as regards processing operations that are related to the offering of goods or services to data subjects in several member states , , or to the monitoring such data subjects , or that might substantially affect the free flow of personal data . it should also apply where any supervisory authority or the commission requests that the matter should be dealt with in the consistency mechanism . this mechanism should be without prejudice to any measures that the commission may take in the exercise of its powers under the treaties . ### in order to ensure the consistent application of this regulation throughout the union , a consistency mechanism for co - operation between the supervisory authorities themselves and the commission should be established . this mechanism should in particular apply where a supervisory authority intends to take a measure as regards processing operations that are related to the offering of goods or services to data subjects in several member states , or to the monitoring of such data subjects , or that might substantially affect the free flow of personal data . it should also apply where any supervisory authority or the commission requests that the matter should be dealt with in the consistency mechanism . furthermore , the data subjects should have the right to obtain consistency , if they deem a measure by a data protection authority of a member state has not fulfilled this criterion . this mechanism should be without prejudice to any measures that the commission may take in the exercise of its powers under the treaties .


### every data subject should have the right to lodge a complaint with a supervisory authority in any member state and have the right to a judicial remedy if they consider that their rights under this regulation are infringed or where the supervisory authority does not react on a complaint or does not act where such action is necessary to protect the rights of the data subject . ### every data subject should have the right to lodge a complaint with a supervisory authority in any member state and have the right to a judicial remedy if they consider that their rights under this regulation are infringed or where the supervisory authority does not react on a complaint or does not act where such action is necessary to protect the rights of the data subject . if the data subject deems consistency is not fulfilled , a complaint to the european data protection board can be filed .


### each natural or legal person should have the right to a judicial remedy against decisions of a supervisory authority concerning them . proceedings against a supervisory authority should be brought before the courts of the member state , where the supervisory authority is established . ### each natural or legal person should have the right to a judicial remedy against decisions of a supervisory authority concerning them . proceedings against a supervisory authority should be brought before the courts of the member state , where the supervisory authority is established , or before the european data protection board on grounds of inconsistency with the application of the present regulation in other member states


### any damage which a person may suffer as a result of unlawful processing should be compensated by the controller or processor , who may be exempted from liability if they prove that they are not responsible for the damage , in particular where he establishes fault on the part of the data subject or in case of force majeure . ### any damage which a person may suffer as a result of unlawful processing should be compensated by the controller or processor , who may be exempted from liability if they prove that they are not responsible for the damage , in particular where he establishes fault on the part of the data subject or in case of force majeure . where joint and several liability applies , a processor which has made amends for damage done to the data subject concerned may bring an action against the controller for reimbursement if it has acted in conformity with the legal act binding it to the controller .


### in order to strengthen and harmonise administrative sanctions against infringements of this regulation , each supervisory authority should have the power to sanction administrative offences . this regulation should indicate these offences and the upper limit for the related administrative fines , which should be fixed in each individual case proportionate to the specific situation , with due regard in particular to the nature , gravity and duration of the breach . the consistency mechanism may also be used to cover divergences in the application of administrative sanctions . ### in order to strengthen and harmonise administrative sanctions against infringements of this regulation , each supervisory authority should have the power to sanction administrative offences . this regulation should indicate these offences and the upper limit for the related administrative fines , which should be fixed in each individual case proportionate to the specific situation , with due regard in particular to the nature , gravity and duration of the breach . in order to strengthen the internal market , the administrative sanctions should be consistent across member states . the consistency mechanism may also be used to cover divergences in the application of administrative sanctions .


### the processing of personal data concerning health , as a special category of data which deserves higher protection , may often be justified by a number of legitimate reasons for the benefit of individuals and society as a whole , in particular in the context of ensuring continuity of cross - border healthcare . therefore this regulation should provide for harmonised conditions for the processing of personal data concerning health , subject to specific and suitable safeguards so as to protect the fundamental rights and the personal data of individuals . this includes the right for individuals to have access to their personal data concerning their health , for example the data in their medical records containing such information as diagnosis , examination results , assessments by treating physicians and any treatment or interventions provided . ### the processing of personal data concerning health , as a special category of data which deserves higher protection , may often be justified by a number of legitimate reasons for the benefit of individuals and society as a whole , in particular in the context of ensuring continuity of cross - border healthcare . therefore this regulation should provide for harmonised conditions for the processing of personal data concerning health , subject to specific and suitable safeguards so as to protect the fundamental rights and the personal data of individuals . this includes the right for individuals to have access , directly or through previously delegated persons , to their personal data concerning their health , for example the data in their medical records containing such information as diagnosis , examination results , assessments by treating physicians and any treatment or interventions provided .


### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted in respect of lawfulness of processing ; specifying the criteria and conditions in relation to the consent of a child ; processing of special categories of data ; specifying the criteria and conditions for manifestly excessive requests and fees for exercising the rights of the data subject ; criteria and requirements for the information to the data subject and in relation to the right of access ; the right to be forgotten and to erasure ; measures based on profiling ; criteria and requirements in relation to the responsibility of the controller and to data protection by design and by default ; a processor ; criteria and requirements for the documentation and the security of processing ; criteria and requirements for establishing a personal data breach and for its notification to the supervisory authority , and on the circumstances where a personal data breach is likely to adversely affect the data subject ; the criteria and conditions for processing operations requiring a data protection impact assessment ; the criteria and requirements for determining a high degree of specific risks which require prior consultation ; designation and tasks of the data protection officer ; codes of conduct ; criteria and requirements for certification mechanisms ; criteria and requirements for transfers by way of binding corporate rules ; transfer derogations ; administrative sanctions ; processing for health purposes ; processing in the employment context and processing for historical , statistical and scientific research purposes . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council . ### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted in respect of lawfulness of processing ; specifying the criteria and conditions in relation to the consent of a child ; processing of special categories of data ; criteria and requirements for the information to the data subject and in relation to the right of access ; the right to be forgotten and to erasure ; measures based on profiling ; criteria and requirements in relation to the responsibility of the controller ; a processor ; criteria and requirements for the documentation ; criteria and requirements for establishing a personal data breach and for its notification to the supervisory authority , and on the circumstances where a personal data breach is likely to adversely affect the data subject ; the criteria and conditions for processing operations requiring a data protection impact assessment ; the criteria and requirements for determining a high degree of specific risks which require prior consultation ; designation and tasks of the data protection officer ; codes of conduct ; criteria and requirements for certification mechanisms ; criteria and requirements for transfers by way of binding corporate rules ; transfer derogations ; processing for health purposes ; processing in the employment context and processing for historical , statistical and scientific research purposes . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council .


### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission for : specifying standard forms in relation to the processing of personal data of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; the right to data portability ; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation ; specific requirements for the security of processing ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; standards and procedures for a data protection impact assessment ; forms and procedures for prior authorisation and prior consultation ; technical standards and mechanisms for certification ; the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation ; disclosures not authorized by union law ; mutual assistance ; joint operations ; decisions under the consistency mechanism . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by the member states of the commission ' s exercise of implementing powers46 . in this context , the commission should consider specific measures for micro , small and medium - sized enterprises . ### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission for : specifying standard forms in relation to the processing of personal data of a child ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; standard forms in relation to the responsibility of the controller in respect of the documentation ; specific requirements for the security of processing ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; standards and procedures for a data protection impact assessment ; forms and procedures for prior authorisation and prior consultation ; technical standards and mechanisms for certification ; the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation ; disclosures not authorized by union law ; mutual assistance ; joint operations ; decisions under the consistency mechanism . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by the member states of the commission ' s exercise of implementing powers46 . in this context , the commission should consider specific measures for micro , small and medium - sized enterprises .


### the examination procedure should be used for the adoption of specifying standard forms in relation to the consent of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; the right to data portability ; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation ; specific requirements for the security of processing ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; standards and procedures for a data protection impact assessment ; forms and procedures for prior authorisation and prior consultation ; technical standards and mechanisms for certification ; the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation ; disclosures not authorized by union law ; mutual assistance ; joint operations ; decisions under the consistency mechanism , given that those acts are of general scope . ### the examination procedure should be used for the adoption of specifying standard forms in relation to the consent of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; standard forms in relation to the responsibility of the controller in respect of the documentation ; specific requirements for the security of processing ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; standards and procedures for a data protection impact assessment ; forms and procedures for prior authorisation and prior consultation ; technical standards and mechanisms for certification ; disclosures not authorized by union law ; mutual assistance ; joint operations ; decisions under the consistency mechanism , given that those acts are of general scope .


### in view of the fact that , as underlined by the court of justice of the european union , the right to the protection of personal data is not an absolute right , but must be considered in relation to its function in society and be balanced with other fundamental rights , in accordance with the principle of proportionality , this regulation respects all fundamental rights and observes the principles recognised in the charter of fundamental rights of the european union as enshrined in the treaties , notably the right to respect for private and family life , home and communications , the right to the protection of personal data , the freedom of thought , conscience and religion , the freedom of expression and information , the freedom to conduct a business , the right to an effective remedy and to a fair trial as well as cultural , religious and linguistic diversity . ### in view of the fact that , as underlined by the court of justice of the european union , the right to the protection of personal data is not an absolute right , but must be considered in relation to its function in society and be balanced with other rights enshrined in the charter of fundamental rights of the european union , in accordance with the principle of proportionality , this regulation respects all fundamental rights and observes the principles recognised in the charter of fundamental rights of the european union as enshrined in the treaties , notably the right to respect for private and family life , home and communications , the right to the protection of personal data , the freedom of thought , conscience and religion , the freedom of expression and information , the freedom to conduct a business , the right to an effective remedy and to a fair trial as well as cultural , religious and linguistic diversity .


### by a natural person without any gainful interest in the course of its own exclusively personal or household activity ; ### by a natural person without any gainful interest in the course of its own exclusively personal or household activity and on condition that no personal data are made accessible to an indefinite number of people ;


### this regulation shall be without prejudice to the application of directive 2000 / 31 / ec , in particular of the liability rules of intermediary service providers in articles 12 to 15 of that directive . ### this regulation shall be without prejudice to the application of directive 2000 / 31 / ec , in particular of the liability rules of intermediary service providers in articles 12 to 15 of that directive , as well as to the specific provisions of union law or law of member states related to processing of data , especially with regard to legally protected interests , when they provide for a stricter protection than the provisions of this regulation ;


### the offering of goods or services to such data subjects in the union ; or ### the directing of goods or services to such data subjects in the union , irrespective of whether these are provided free of charge in relation to the data subject or not ; or


### the offering of goods or services to such data subjects in the union ; or ### the offering of goods and services to such data subjects in the union , including services provided without financial costs to the individual , or ;


### ' data subject ' means an identified natural person or a natural person who can be identified , directly or indirectly , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to an identification number , location data , online identifier or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural or social identity of that person ; ### ' data subject ' means an identified natural person or a natural person who can be identified , directly or indirectly , by means reasonably likely to be used by the controller or by any other natural or legal person to whom data have been disclosed by the controller , in particular by reference to an identification number , location data , online identifier or other unique identifiers or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural or social identity of that person ;


### ‘ controller’ means the natural or legal person , public authority , agency or any other body which alone or jointly with others determines the purposes , conditions and means of the processing of personal data ; where the purposes , conditions and means of processing are determined by union law or member state law , the controller or the specific criteria for his nomination may be designated by union law or by member state law ; ### ‘ controller’ means the natural or legal person , public authority , agency or any other body which alone or jointly with others determines the purposes of the processing of personal data ; where the purposes of processing are determined by union law or member state law , the controller or the specific criteria for his nomination may be designated by union law or by member state law ;


### ‘ the data subject ' s consent’ means any freely given specific , informed and explicit indication of his or her wishes by which the data subject , either by a statement or by a clear affirmative action , signifies agreement to personal data relating to them being processed ; ### ' the data subject ' s consent ' means any freely given specific , informed and explicit indication of his or her wishes by which the data subject , either by a statement or by a clear affirmative action , signifies agreement to personal data relating to them being processed ; by ' clear affirmative action ' is meant any unequivocal action that is the result of a choice and that implies , for its complete execution , a necessary data processing ;


### for the purposes of this regulation , in relation to the offering of information society services directly to a child , the processing of personal data of a child below the age of 13 years shall only be lawful if and to the extent that consent is given or authorised by the child ' s parent or custodian . the controller shall make reasonable efforts to obtain verifiable consent , taking into consideration available technology . ### for the purposes of this regulation , in relation to the offering of goods or services directly to a child , the processing of personal data of a child below the age of 13 years shall only be lawful if and to the extent that consent is given or authorised by the child ' s parent or legal representative . the controller shall make reasonable efforts to obtain verifiable consent , taking into consideration available technology .


### the processing relates to personal data which are manifestly made public by the data subject ; or ### the processing relates to personal data which are manifestly made public by the data subject or which are freely transferred to the controller on the initiative of data subject and which are processed for the specific purpose determined by data subject and in his interest ; or


### the controller shall provide any information and any communication relating to the processing of personal data to the data subject in an intelligible form , using clear and plain language , adapted to the data subject , in particular for any information addressed specifically to a child . ### the controller shall provide any information and any communication relating to the processing of personal data to the data subject in an intelligible form , using clear and plain language , in particular for any information addressed specifically to a child .


### the information and the actions taken on requests referred to in paragraph 1 shall be free of charge . where requests are manifestly excessive , in particular because of their repetitive character , the controller may charge a fee for providing the information or taking the action requested , or the controller may not take the action requested . in that case , the controller shall bear the burden of proving the manifestly excessive character of the request . ### the information and the actions taken on requests referred to in paragraph 1 shall be free of charge . where requests are vexatious or manifestly excessive , in particular because of their repetitive character , the controller may charge a fee for providing the information or taking the action requested , or the controller may not take the action requested . in that case , the controller shall bear the burden of proving the manifestly excessive character of the request .


### the controller shall communicate any rectification or erasure carried out in accordance with articles 16 and 17 to each recipient to whom the data have been disclosed , unless this proves impossible or involves a disproportionate effort . ### any rectification or erasure carried out in accordance with articles 16 and 17 is extended to each recipient to whom the data have been disclosed without the control of the data subject .


### where personal data relating to a data subject are collected , the controller shall provide the data subject with at least the following information : ### where personal data relating to a data subject are collected , the controller shall provide the data subject with the following information :


### the period for which the personal data will be stored ; ### the rules according to which the period for which data will be stored is determined ;


### any further information necessary to guarantee fair processing in respect of the data subject , having regard to the specific circumstances in which the personal data are collected . ### any further information which the controller considers necessary to guarantee fair processing in respect of the data subject , having regard to the specific circumstances in which the personal data are collected .


### the data subject shall have the right to obtain from the controller communication of the personal data undergoing processing . where the data subject makes the request in electronic form , the information shall be provided in electronic form , unless otherwise requested by the data subject . ### the data subject shall have the right to obtain from the controller communication of the personal data undergoing processing . where the data subject makes the request in electronic form , the information shall be provided in electronic form , if available in a structured and commonly used format , unless otherwise requested by the data subject . this is without prejudice to the right of the controller to determine other form of handling requests for information specified in point 1 if it is justified by the necessity of verifying the identity of subject requesting such information ;


### where an objection is upheld pursuant to paragraphs 1 and 2 , the controller shall no longer use or otherwise process the personal data concerned . ### where an objection is upheld pursuant to paragraphs 1 and 2 , the controller shall no longer use or otherwise process the personal data concerned for the purposes determined in the objection .


### where an objection is upheld pursuant to paragraphs 1 and 2 , the controller shall no longer use or otherwise process the personal data concerned . ### where an objection is upheld pursuant to paragraphs 1 and 2 , the controller shall no longer use , store or otherwise process the personal data concerned .


### in particular , any legislative measure referred to in paragraph 1 shall contain specific provisions at least as to the objectives to be pursued by the processing and the determination of the controller . ### in particular , any legislative measure referred to in paragraph 1 shall contain specific provisions at least as to the aim of the processing , the objectives to be pursued by the processing and the determination of the controller .


### responsibility of the controller ### overall principle of responsibility of the controller .


### where a controller determines the purposes , conditions and means of the processing of personal data jointly with others , the joint controllers shall determine their respective responsibilities for compliance with the obligations under this regulation , in particular as regards the procedures and mechanisms for exercising the rights of the data subject , by means of an arrangement between them . ### where a controller determines the purposes , conditions and means of the processing of personal data jointly with others , the joint controllers shall determine their respective responsibilities for compliance with the obligations under this regulation , in particular as regards the procedures and mechanisms for exercising the rights of the data subject , by means of an arrangement between them . where such determination is lacking or is not sufficiently clear , the data subject can exercise his rights with any of the controllers and they shall be equally liable .


### the documentation shall contain at least the following information : ### the documentation shall contain the following information :


### the controller and the processor and , if any , the controller ' s representative , shall make the documentation available , on request , to the supervisory authority . ### the controller and the processor and , if any , the controller ' s representative , shall make the documentation available , on request , to the supervisory authority and , in an electronic format , to the data subject .


### in the case of a personal data breach , the controller shall without undue delay and , where feasible , not later than 24 hours after having become aware of it , notify the personal data breach to the supervisory authority . the notification to the supervisory authority shall be accompanied by a reasoned justification in cases where it is not made within 24 hours . ### in the case of a significant personal data breach , the controller shall without undue delay notify the personal data breach to the supervisory authority . data breach shall be considered significant if it could adversely affect privacy of the data subject .


### in the case of a personal data breach , the controller shall without undue delay and , where feasible , not later than 24 hours after having become aware of it , notify the personal data breach to the supervisory authority . the notification to the supervisory authority shall be accompanied by a reasoned justification in cases where it is not made within 24 hours . ### in the case of a personal data breach which significantly affects the data subject , the controller shall , without undue delay after having become aware of it , notify the personal data breach to the supervisory authority .


### in the case of a personal data breach , the controller shall without undue delay and , where feasible , not later than 24 hours after having become aware of it , notify the personal data breach to the supervisory authority . the notification to the supervisory authority shall be accompanied by a reasoned justification in cases where it is not made within 24 hours . ### in the case of a personal data breach , the controller shall without undue delay notify the personal data breach to the supervisory authority .


### the notification referred to in paragraph 1 must at least : ### the notification referred to in paragraph 1 must if possible :


### the controller shall document any personal data breaches , comprising the facts surrounding the breach , its effects and the remedial action taken . this documentation must enable the supervisory authority to verify compliance with this article . the documentation shall only include the information necessary for that purpose . ### the controller shall document any personal data breaches , comprising the facts surrounding the breach , its effects and the remedial action taken . this documentation must enable the supervisory authority to verify compliance with this article and with article 30 . the documentation shall only include the information necessary for that purpose .


### when the personal data breach is likely to adversely affect the protection of the personal data or privacy of the data subject , the controller shall , after the notification referred to in article 31 , communicate the personal data breach to the data subject without undue delay . ### when the personal data breach is likely to adversely affect the protection of the personal data or privacy of the data subject , or when the intervention of the data subject can decisively mitigate the possible adverse effects of the personal data breach , the controller shall , together with the other urgent measures and before the notification referred to in article 31 , communicate the personal data breach to the data subject without undue delay .


### the following processing operations in particular present specific risks referred to in paragraph 1 : ### the following processing operations present specific risks referred to in paragraph 1 :


### data subjects shall have the right to contact the data protection officer on all issues related to the processing of the data subject ' s data and to request exercising the rights under this regulation . ### data subjects shall have the right to contact the data protection officer on all issues related to exercising the rights under this regulation .


### the rule of law , relevant legislation in force , both general and sectoral , including concerning public security , defence , national security and criminal law , the professional rules and security measures which are complied with in that country or by that international organisation , as well as effective and enforceable rights including effective administrative and judicial redress for data subjects , in particular for those data subjects residing in the union whose personal data are being transferred ; ### the rule of law , relevant legislation in force , both general and sectoral , including concerning public security , defence , national security and criminal law , the professional rules and security measures which are complied with in that country or by that international organisation , jurisprudential precedents as well as effective and enforceable rights including effective administrative and judicial redress for data subjects , in particular for those data subjects residing in the union whose personal data are being transferred ;


### the commission shall publish in the official journal of the european union a list of those third countries , territories and processing sectors within a third country and international organisations where it has decided that an adequate level of protection is or is not ensured . ### the commission shall publish in the official journal of the european union and on its website a list of those third countries , territories and processing sectors within a third country and international organisations where it has decided that an adequate level of protection is or is not ensured .


### issue opinions on draft decisions of supervisory authorities pursuant to the consistency mechanism referred to in article 57 ; ### issue opinions on draft decisions of supervisory authorities pursuant to the consistency mechanism referred to in article 57 and in article 63a ;


### each natural or legal person shall have the right to a judicial remedy against decisions of a supervisory authority concerning them . ### without prejudice to the procedure described in article 63a , each natural or legal person shall have the right to a judicial remedy against decisions of a supervisory authority concerning them .


### member states shall lay down the rules on penalties , applicable to infringements of the provisions of this regulation and shall take all measures necessary to ensure that they are implemented , including where the controller did not comply with the obligation to designate a representative . the penalties provided for must be effective , proportionate and dissuasive . ### member states shall lay down the rules on penalties , applicable to infringements of the provisions of this regulation and shall take all measures necessary to ensure that they are implemented , including where the controller did not comply with the obligation to designate a representative . the penalties provided for must be effective , consistent proportionate and dissuasive .


### each supervisory authority shall be empowered to impose administrative sanctions in accordance with this article . ### supervisory authority , competent in accordance with article 51 shall be empowered to impose administrative sanctions in accordance with this article .


### the administrative sanction shall be in each individual case effective , proportionate and dissuasive . the amount of the administrative fine shall be fixed with due regard to the nature , gravity and duration of the breach , the intentional or negligent character of the infringement , the degree of responsibility of the natural or legal person and of previous breaches by this person , the technical and organisational measures and procedures implemented pursuant to article 23 and the degree of co - operation with the supervisory authority in order to remedy the breach . ### the administrative sanction shall be in each individual case effective , consistent proportionate and dissuasive . the amount of the administrative fine shall be fixed with due regard to the nature , gravity and duration of the breach , the intentional or negligent character of the infringement , the degree of responsibility of the natural or legal person and of previous breaches by this person , the technical and organisational measures and procedures implemented pursuant to article 23 and the degree of co - operation with the supervisory authority in order to remedy the breach .


### the supervisory authority shall impose a fine up to 500 000 eur , or in case of an enterprise up to 1 % of its annual worldwide turnover , to anyone who , intentionally or negligently : ### the supervisory authority may impose a fine up to 500 000 eur , or in case of an enterprise up to 1 % of its annual worldwide turnover , to anyone who , intentionally or negligently :


### the supervisory authority shall impose a fine up to 1 000 000 eur or , in case of an enterprise up to 2 % of its annual worldwide turnover , to anyone who , intentionally or negligently : ### the supervisory authority may impose a fine up to 1 000 000 eur or , in case of an enterprise up to 2 % of its annual worldwide turnover , to anyone who , intentionally or negligently :


### within the limits of this regulation and in accordance with point of article 9 , processing of personal data concerning health must be on the basis of union law or member state law which shall provide for suitable and specific measures to safeguard the data subject ' s legitimate interests , and be necessary for : ### within the limits of this regulation and in accordance with point of article 9 , processing of personal data concerning health must be on the basis of union law or member state law which shall provide for suitable , consistent and specific measures to safeguard the data subject ' s legitimate interests , and be necessary for :


### the delegation of power referred to in article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 33 , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation . ### the power to adopt delegated acts referred to in article 8 , article 9 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 31 , article 32 , article 33 , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 81 , article 82 and article 83 shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation .