### where undertakings are accepted , the investigation shall be terminated . the commission shall terminate the investigation in accordance with the procedure referred to in article 15 . ### where undertakings are accepted , the investigation shall be terminated . the commission shall terminate the investigation in accordance with the examination procedure referred to in article 15 . the chair may obtain the committee´s opinion by written procedure referred to in article 15 .


### reviews pursuant to articles 18 , 19 and 20 shall be initiated by the commission . ### reviews pursuant to articles 18 , 19 and 20 shall be initiated by the commission . before the initiation of proceedings the commission shall inform the member states and give them the opportunity to express their views .


### in the union interest , measures imposed pursuant to this regulation may be suspended by a decision of the commission for a period of nine months . the suspension may be extended for a further period , not exceeding one year , by the commission acting in accordance with the procedure referred to in article 25 . ### in the union interest , measures imposed pursuant to this regulation may be suspended by a decision of the commission for a period of nine months . the suspension may be extended for a further period , not exceeding one year , by the commission acting in accordance with the advisory procedure referred to in article 25 .


### where reference is made to this paragraph , article [ 5 ] of regulation no [ xxxx / 2011 ] shall apply . ### 2 where reference is made to this paragraph , article 5 of regulation no 182 / 2011 shall apply . the examination committee shall deliver its opinion within one month of the date of referral . amendments shall be suggested at the latest three days before the meeting of the committee .


### where reference is made to this paragraph , article [ 5 ] of regulation no [ xxxx / 2011 ] shall apply . ### where reference is made to this paragraph , article 5 of regulation no 182 / 2011 shall apply . the examination committee shall deliver its opinion within one month of the date of referral . amendments shall be suggested at the latest three days before the meeting of the committee .


### the decision to impose surveillance shall be taken by the commission according to the procedure laid down in article 16 . ### the decision to impose surveillance shall be taken by the commission by means of implementing acts according to the advisory procedure referred to in article 4 .


### where intervention by the commission has been requested by a member state , the commission , acting in accordance with the procedure referred to in article 4 shall take a decision within a maximum of five working days of receipt of such a request . in cases of urgency , article 4 shall apply . ### ' 6 . where intervention by the commission has been requested by a member state , the commission , acting in accordance with the procedure referred to in article 4 shall take a decision within a maximum of five working days of receipt of such a request .


### where intervention by the commission has been requested by a member state , the commission , acting in accordance with the procedure referred to in article 4 , shall take a decision within a maximum of five working days of receipt of such a request . in cases of urgency , article 4 shall apply . ### where intervention by the commission has been requested by a member state , the commission , acting in accordance with the procedure referred to in article 4 , shall take a decision within a maximum of five working days of receipt of such a request .


### where the interests of the union so require , the commission , acting in accordance with the procedure referred to in article 4 , may adopt appropriate measures to allow the rights and obligations of the union or of all its member states , in particular those relating to trade in commodities , to be exercised and fulfilled at international level . ### where the interests of the union so require , the commission , acting in accordance with the examination procedure referred to in article 4 , may adopt appropriate measures implementing legislative acts , which shall not entail any substantive changes , to allow the rights and obligations of the union or of all its member states , in particular those relating to trade in commodities , to be exercised and fulfilled at international level .


### where import of a product has not been made subject to prior union surveillance , the commission may introduce , in accordance with article 17 , surveillance confined to imports into one or more regions of the union . ### where import of a product has not been made subject to prior union surveillance , the commission may introduce , by means of implementing acts according to the advisory procedure referred to in article 4 and in accordance with article 17 , surveillance confined to imports into one or more regions of the union .


### the commission may , in particular in the situation referred to in article 15 , adopt appropriate measures acting in accordance with the procedure referred to in article 4 . ### the commission may , in particular in the situation referred to in article 15 , adopt appropriate safeguard measures acting in accordance with the examination procedure referred to in article 4 .


### the relevant provisions of this regulation with regard to procedures and the conduct of investigations , excluding those relating to time - limits , shall apply to any review carried out pursuant to paragraphs 2 , 3 and 4 . reviews carried out pursuant to paragraphs 2 and 3 shall be carried out expeditiously and shall normally be concluded within 12 months of the date of initiation of the review . in any event , reviews pursuant to paragraphs 2 and 3 shall be concluded within 15 months of initiation . in exceptional cases , having regard to the complexity of the investigation , the commission may decide , no later than 9 months after the initiation of the investigation , to extend this time limit , for a period up to , but in no case longer than , 18 months . reviews pursuant to paragraph 4 shall in all cases be concluded within nine months of the date of initiation . if a review carried out pursuant to paragraph 2 is initiated while a review under paragraph 3 in ongoing in the same proceeding , the review pursuant to paragraph 3 shall be concluded at the same time as the review pursuant to paragraph 2 ' ### the relevant provisions of this regulation with regard to procedures and the conduct of investigations , excluding those relating to time - limits , shall apply to any review carried out pursuant to paragraphs 2 , 3 and 4 . reviews carried out pursuant to paragraphs 2 and 3 shall be carried out expeditiously and shall normally be concluded within 12 months of the date of initiation of the review . in any event , reviews pursuant to paragraphs 2 and 3 shall be concluded within 14 months of initiation . no later than seven and a half months after the initiation of the investigation pursuant to article 6 the commission shall consult the member states on the bases of the findings of the investigation . the member states shall in this consultation indicate to the commission whether they expect an intense controversy in the decision making process pursuant to article 9 for definitive action with the need to submit the draft implementing act after the delivery of a negative opinion within the examination procedure pursuant to article 5 of the regulation no 182 / 2011 to the appeal body pursuant to article 6 of the same regulation . if so the commission may decide , no later than eight months after the initiation of the investigation , to extend the time limit for a period up to , but in no case longer than , 15 months . the commission shall make this decision public . reviews pursuant to paragraph 4 shall in all cases be concluded within nine months of the date of initiation . if a review carried out pursuant to paragraph 2 is initiated while a review under paragraph 3 in ongoing in the same proceeding , the review pursuant to paragraph 3 shall be concluded at the same time as the review pursuant to paragraph 2 .


### reviews pursuant to this article shall be initiated by the commission . where warranted by reviews , measures shall be repealed or maintained pursuant to paragraph 2 , or repealed , maintained or amended pursuant to paragraphs 3 and 4 . where measures are repealed for individual exporters , but not for the country as a whole , such exporters shall remain subject to the proceeding and may , automatically , be reinvestigated in any subsequent review carried out for that country pursuant to this article . ### reviews pursuant to this article shall be initiated by the commission . before the initiation of proceedings the commission shall inform the member states and give them the opportunity to express their views . where warranted by reviews , measures shall be repealed or maintained pursuant to paragraph 2 , or repealed , maintained or amended pursuant to paragraphs 3 and 4 . where measures are repealed for individual exporters , but not for the country as a whole , such exporters shall remain subject to the proceeding and may , automatically , be reinvestigated in any subsequent review carried out for that country pursuant to this article .


### in the union interest , measures imposed pursuant to this regulation may be suspended by a decision of the commission for a period of nine months . the suspension may be extended for a further period , not exceeding one year , by the commission acting in accordance with the procedure referred to in article 15 . measures may only be suspended where market conditions have temporarily changed to an extent that injury would be unlikely to resume as a result of the suspension , and provided that the union industry has been given an opportunity to comment and these comments have been taken into account . measures may , at any time be reinstated if the reason for suspension is no longer applicable . ### in the union interest , measures imposed pursuant to this regulation may be suspended by a decision of the commission for a period of nine months . the suspension may be extended for a further period , not exceeding one year , by the commission acting in accordance with the advisory procedure referred to in article 15 . measures may only be suspended where market conditions have temporarily changed to an extent that injury would be unlikely to resume as a result of the suspension , and provided that the union industry has been given an opportunity to comment and these comments have been taken into account . measures may , at any time be reinstated if the reason for suspension is no longer applicable .


### draft by the court of justice ### increased resources could provide an opportunity for reorganisation of proceedings in the ' other cases ' category by order of priority , in particular competition cases , where special care must be taken to adhere to a reasonable deadline .


### draft by the court of justice ### the following paragraph shall be added to article 35 : ‘ where a judge has declared , in the deliberations of the court of justice , that he disagrees with the judgment to be delivered or the reasons on which that judgment is based , he shall be entitled to deliver a dissenting opinion . that opinion shall be published together with the judgment . implementing rules relating to the admissibility , and the detailed procedure for the delivery , of such opinions shall be laid down in the rules of procedure of the court of justice . ’


### draft by the court of justice ### an increase in the number of judges is not enough to remedy delays . it is also necessary for some of the chambers to be run on more specialised lines , improving flexibility and output in the general court .


### draft by the court of justice ### as regards the internal organisation of the general court , the office of vice - president should , following the approach adopted for the court of justice , be established for the purpose of assisting the president .


### draft by the court of justice ### in proceedings before the court of justice , a judge should be permitted to announce , during the court’s deliberations , that he intends to deliver a dissenting opinion as to the judgment or the reasons on which it is based , to be published together with the judgment . that possibility exists in several national and international courts , and their reputation and authority have not been undermined as a result . on the contrary , this is a solution which helps to advance judicial practice , offers guarantees of greater transparency , and serves to strengthen the democratic legitimacy of the courts , as it is particularly important to do in this instance , given that the judicial system concerned is one with a strong case law component .


### draft by the court of justice ### the first paragraph of article 47 shall be replaced by the following : articles 9a , 14 , and 15 , article 17 , first , second , fourth , and fifth paragraphs , and article 18 shall apply to the general court and its members .


### draft by the court of justice 7 . in article 48 , the figure ‘ 27’ shall be replaced by the figure ‘ 39’ . ### article 48 shall be replaced by the following : ‘ the general court shall consist of 39 judges . when , every three years , the judges are partially replaced , 20 and 19 judges shall be replaced alternately . ’


### draft by the court of justice ### the following paragraph shall be added to article 48 : member states shall be represented by at least one judge but by no more than two judges of their nationality .


### draft by the court of justice consequently , the necessary measures should be taken to address this situation , and the possibility , provided for by the treaties , of increasing the number of judges of the general court is such as to enable both the volume of pending cases and the excessive duration of proceedings before the general court to be reduced within a short time . ### consequently , the necessary measures should be taken to address this situation , and the possibility , provided for by the treaties , of increasing the number of judges of the general court is such as to enable both the volume of pending cases and the excessive duration of proceedings before the general court to be reduced within a short time . similarly the more effective allocation of the general court ' s caseload to the appropriate chambers could significantly limit delays in proceedings .


### draft legislative resolution ### points out that the financial envelope specified in the legislative proposal constitutes only an indication to the legislative authority and cannot be fixed until agreement is reached on the proposal for a regulation laying down the multiannual financial framework for the years 2014 - 2020 ;


### draft legislative resolution ### recalls its resolution of 8 june 2011 on ' investing in the future : a new multiannual financial framework for a competitive , sustainable and inclusive europe ' 1 ; reiterates that sufficient additional resources are needed in the next mff in order to enable the union to fulfil its existing policy priorities and the new tasks provided for in the treaty of lisbon , as well as to respond to unforeseen events ; challenges the council , if it does not share this approach , to clearly identify which of its political priorities or projects could be dropped altogether , despite their proven european added value ; __________ 1 texts adopted , p7_ta0266 .


### draft legislative resolution ### emphasises that , in view of the tasks already identified and concluded by the union , the commission needs to reflect those policy priorities in a foresighted and adequate manner in the proposal ;


### draft legislative resolution ### reiterates that the lisbon treaty provides for delegated acts only as non - legislative acts of general application relating to non - essential elements of a legislative act ; therefore upholds its criticism of the widespread use of delegated acts and insists that any essential element must be laid down in the legislative act in question ;


### the global resources available under this regulation shall be implemented under shared management in accordance with [ point of article 55 of the new financial regulation ] 25 , with the exception of union actions referred to in article 21 , the emergency assistance referred to in article 22 , the european migration network referred to in article 23 , and technical assistance referred to in article 24 . 25 triennial revision of the financial regulation - commission proposal com0260 . ### the global resources available under this regulation shall be implemented under direct management or under shared management in accordance with [ point of article 55 of the new financial regulation ] 25 . 25 regulation on the financial rules applicable to the annual budget of the union 815 final of 22 . 12 . 2010 ) .


### it is necessary to lay down the procedures for applying certain provisions of the agreement which concern the bilateral safeguard clause and for applying the stabilisation mechanism for bananas that has been agreed with central america . ### it is necessary to lay down the most appropriate procedures to guarantee the effective application of certain provisions of the agreement which concern the bilateral safeguard clause and for applying the stabilisation mechanism for bananas that has been agreed with central america .


### there should be detailed provisions on the initiation of proceedings . the commission should receive information including available evidence from the member states of any trends in imports which might call for the application of safeguard measures . ### there should be detailed provisions on the initiation of proceedings . the commission should receive information including available evidence from the member states and the sectors involved of any trends in imports which might call for the application of safeguard measures .


### in the investigation the commission shall evaluate all relevant factors of an objective and quantifiable nature having a bearing on the situation of the union industry , in particular , the rate and amount of the increase in imports of the product concerned in absolute and relative terms , the share of the domestic market taken by increased imports and changes in the level of sales , production , productivity , capacity utilisation , profits and losses , and employment . this list is not exhaustive and other relevant factors may also be taken into consideration by the commission for its determination of the existence of serious injury or threat of serious injury , such as stocks , prices , return on capital employed , cash flow , and other factors which are causing or may have caused serious injury , or threaten to cause serious injury to the union industry . ### in the investigation the commission shall evaluate all relevant factors of an objective and quantifiable nature having a bearing on the situation of the union industry , in particular , the rate and amount of the increase in imports of the product concerned in absolute and relative terms , the share of the domestic market taken by increased imports and changes in the level of sales , production , productivity , capacity utilisation , profits and losses , and employment . this list is not exhaustive and other relevant factors may also be taken into consideration by the commission for its determination of the existence of serious injury or threat of serious injury , such as stocks , prices , return on capital employed , cash flow , and other factors which are causing or may have caused serious injury , or threaten to cause serious injury to the union industry , such as meeting the trigger volumes described within the framework of the stabilisation mechanism for bananas included in chapter ii of the current regulation .


### a cessation or relocation of a productive activity ; ### a cessation or complete or partial relocation of a productive activity ;


### to allow for the effective implementation of the provisions adopted pursuant to this directive , a body responsible for coordinating nis issues and acting as a focal point for cross - border cooperation at union level should be established or identified in each member state . these bodies should be given the adequate technical , financial and human resources to ensure that they can carry out in an effective and efficient manner the tasks assigned to them and thus achieve the objectives of this directive . ### to allow for the effective implementation of the provisions adopted pursuant to this directive , a national competent authority under civilian control with full democratic oversight and transparency in their operations being responsible for coordinating nis issues and acting as a focal point for cross - border cooperation at union level should be established or identified in each member state . the national competent authority and the national single point of contact should be given the adequate technical , financial and human resources to ensure that they can carry out in an effective and efficient manner the tasks assigned to them and thus achieve the objectives of this directive .


### as most network and information systems are privately operated , cooperation between the public and private sector is essential . market operators should be encouraged to pursue their own informal cooperation mechanisms to ensure nis . they should also cooperate with the public sector and share information and best practices in exchange of operational support in case of incidents . ### as most network and information systems are privately operated , cooperation between the public and private sector is essential . market operators should be encouraged to pursue their own informal cooperation mechanisms to ensure nis . they should also cooperate with the public sector and mutually share information and best practices as well as reciprocal operational support as needed in case of incidents .


### member states shall not be prevented from adopting or maintaining provisions ensuring a higher level of security , without prejudice to their obligations under union law . ### member states shall not be prevented from adopting or maintaining provisions ensuring a higher level of security , without prejudice to their obligations under union law . however , when transposing the provisions of chapter iv , member states shall not maintain or introduce national provisions diverging from or conflicting with those laid down in that chapter .


### member states shall not be prevented from adopting or maintaining provisions ensuring a higher level of security , without prejudice to their obligations under union law . ### member states shall not be prevented from adopting or maintaining provisions ensuring a higher level of security , without prejudice to their obligations under union law , but such provisions must comply with the common minimum expectations applicable in this case which are enshrined in this directive .


### operator of critical infrastructure that are essential for the maintenance of vital economic and societal activities in the fields of energy , transport , banking , stock exchanges and health , a non - exhaustive list of which is set out in annex ii . ### operator of critical infrastructure that are essential for the maintenance of vital economic and societal activities in the fields of energy , transport , banking , stock exchanges , health and agriculture , a non - exhaustive list of which is set out in annex ii .


### the national nis strategy and the national nis cooperation plan shall be communicated to the commission within one month from their adoption . ### each member state shall draft its national nis strategy within 12 months of the adoption and promulgation of this directive . the national nis strategy and the national nis cooperation plan shall be communicated to the commission within one month from their adoption .


### each member state shall set up a computer emergency response team responsible for handling incidents and risks according to a well - defined process , which shall comply with the requirements set out in point of annex i . a cert may be established within the competent authority . ### each member state shall set up at least one computer emergency response team responsible for handling incidents and risks according to a well - defined process , which shall comply with the requirements set out in point of annex i . a cert may be established within the competent authority .


### the cooperation network shall bring into permanent communication the commission and the competent authorities . when requested , the european network and information security agency shall assist the cooperation network by providing its expertise and advice . ### the cooperation network shall bring into permanent communication the commission and the competent authorities . when requested , the european network and information security agency shall assist the cooperation network by providing technology neutral guidance with suitable measures for both public and private sectors .


### the competent authorities shall work in close cooperation with personal data protection authorities when addressing incidents resulting in personal data breaches . ### without prejudice to applicable data protection law , and in full consultation with the relevant data controllers and processors , the competent authorities and the single points of contact shall work in close cooperation with personal data protection authorities when addressing incidents resulting in personal data breaches .


### in order to ensure consistent and high level of protection of individuals and to remove the obstacles to flows of personal data , the level of protection of the rights and freedoms of individuals with regard to the processing of such data should be equivalent in all member states . consistent and homogenous application of the rules for the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data should be ensured throughout the union . ### in order to ensure consistent and high level of protection of individuals and to remove the obstacles to flows of personal data , the level of protection of the rights and freedoms of individuals with regard to the processing of such data should be equivalent in all member states . consistent and homogenous application of the rules for the protection of the fundamental rights and freedoms of natural and legal persons with regard to the processing of personal data should be ensured throughout the union .


### article 16 of the treaty mandates the european parliament and the council to lay down the rules relating to the protection of individuals with regard to the processing of personal data and the rules relating to the free movement of personal data . ### article 16 of the treaty mandates the european parliament and the council to lay down the rules relating to the protection of individuals with regard to the processing of personal data by the union institutions , bodies , offices and agencies , and by member states when carrying out activities which fall within the scope of union law , and the rules relating to the free movement of personal data .


### the protection afforded by this regulation concerns natural persons , whatever their nationality or place of residence , in relation to the processing of personal data . with regard to the processing of data which concern legal persons and in particular undertakings established as legal persons , including the name and the form of the legal person and the contact details of the legal person , the protection of this regulation should not be claimed by any person . this should also apply where the name of the legal person contains the names of one or more natural persons . ### the protection afforded by this regulation concerns natural persons , whatever their nationality or place of residence , in relation to the processing of personal data . with regard to the processing of data which concern legal persons and in particular undertakings established as legal persons , including the name and the form of the legal person and the contact details of the legal person , the protection of this regulation should also be claimed by any person .


### the principles of protection should apply to any information concerning an identified or identifiable person . to determine whether a person is identifiable , account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the individual . the principles of data protection should not apply to data rendered anonymous in such a way that the data subject is no longer identifiable . ### the principles of protection should apply only to specific information concerning an identified or identifiable person . to determine whether a person is identifiable , account should be taken : only of those means likely reasonably to be used by the controller or by any other natural or legal person to identify the individual , and of the reasonable likeliness of a person being identified . the principles of data protection should not apply to data rendered anonymous in such a way that the data subject is no longer identifiable from the data .


### consent should be given explicitly by any appropriate method enabling a freely given specific and informed indication of the data subject ' s wishes , either by a statement or by a clear affirmative action by the data subject , ensuring that individuals are aware that they give their consent to the processing of personal data , including by ticking a box when visiting an internet website or by any other statement or conduct which clearly indicates in this context the data subject ' s acceptance of the proposed processing of their personal data . silence or inactivity should therefore not constitute consent . consent should cover all processing activities carried out for the same purpose or purposes . if the data subject ' s consent is to be given following an electronic request , the request must be clear , concise and not unnecessarily disruptive to the use of the service for which it is provided . ### consent should be given by any appropriate method enabling a freely given specific and informed indication of the data subject ' s wishes , either by a statement or by other affirmative action by the data subject , ensuring that individuals are aware that they give their consent to the processing of personal data , including by ticking a box when visiting an internet website or by any other statement or conduct , such as by means of appropriate browser settings , which clearly indicates in this context the data subject ' s acceptance of the proposed processing of their personal data . silence or inactivity can also constitute valid consent , if a data protection impact assessment does not consider that explicit consent is required . consent should cover all processing activities carried out for the same purpose or purposes . if the data subject ' s consent is to be given following an electronic request , the request must be clear , concise and not unnecessarily disruptive to the use of the service for which it is provided .


### consent should be given explicitly by any appropriate method enabling a freely given specific and informed indication of the data subject ' s wishes , either by a statement or by a clear affirmative action by the data subject , ensuring that individuals are aware that they give their consent to the processing of personal data , including by ticking a box when visiting an internet website or by any other statement or conduct which clearly indicates in this context the data subject ' s acceptance of the proposed processing of their personal data . silence or inactivity should therefore not constitute consent . consent should cover all processing activities carried out for the same purpose or purposes . if the data subject ' s consent is to be given following an electronic request , the request must be clear , concise and not unnecessarily disruptive to the use of the service for which it is provided . ### consent should be given unambiguously by any appropriate method within the context of the product or service being offered enabling a freely given specific and informed indication of the data subject ' s wishes , either by a statement or by a clear affirmative action by the data subject , ensuring that individuals are aware that they give their consent to the processing of personal data , including by ticking a box when visiting an internet website or by any other statement or conduct which clearly indicates in this context the data subject ' s acceptance of the proposed processing of their personal data . silence or inactivity should therefore not constitute consent . consent should cover all processing activities carried out for the same purpose or purposes . if the data subject ' s consent is to be given following an electronic request , the request must be clear , concise and not unnecessarily disruptive to the use of the service for which it is provided .


### personal data relating to health should include in particular all data pertaining to the health status of a data subject ; information about the registration of the individual for the provision of health services ; information about payments or eligibility for healthcare with respect to the individual ; a number , symbol or particular assigned to an individual to uniquely identify the individual for health purposes ; any information about the individual collected in the course of the provision of health services to the individual ; information derived from the testing or examination of a body part or bodily substance , including biological samples ; identification of a person as provider of healthcare to the individual ; or any information on e . g . a disease , disability , disease risk , medical history , clinical treatment , or the actual physiological or biomedical state of the data subject independent of its source , such as e . g . from a physician or other health professional , a hospital , a medical device , or an in vitro diagnostic test . ### personal data relating to health should include in particular all personal data pertaining to the health status of a data subject ; information about the registration of the individual for the provision of health services ; information about payments or eligibility for healthcare with respect to the individual ; a number , symbol or particular assigned to an individual to uniquely identify the individual for health purposes ; any information about the individual collected in the course of the provision of health services to the individual ; personal data derived from the testing or examination of a body part , bodily substance or biological sample ; identification of a person as provider of healthcare to the individual ; or any information on e . g . a disease , disability , disease risk , medical history , clinical treatment , or the actual physiological or biomedical state of the data subject independent of its source , such as e . g . from a physician or other health professional , a hospital , a medical device , or an in vitro diagnostic test .


### the main establishment of a controller in the union should be determined according to objective criteria and should imply the effective and real exercise of management activities determining the main decisions as to the purposes , conditions and means of processing through stable arrangements . this criterion should not depend whether the processing of personal data is actually carried out at that location ; the presence and use of technical means and technologies for processing personal data or processing activities do not , in themselves , constitute such main establishment and are therefore no determining criteria for a main establishment . the main establishment of the processor should be the place of its central administration in the union . ### where a controller or a processor has multiple establishments in the union , including but not limited to cases where the controller or the processor is a group of undertakings , the main establishment of a controller in the union for the purposes of this regulation should be determined according to objective criteria and should imply the effective and real exercise of management activities determining the main decisions as to the purposes , conditions and means of processing through stable arrangements . this criterion should not depend whether the processing of personal data is actually carried out at that location ; the presence and use of technical means and technologies for processing personal data or processing activities do not , in themselves , constitute such main establishment and are therefore no determining criteria for a main establishment .


### a group of undertakings should cover a controlling undertaking and its controlled undertakings , whereby the controlling undertaking should be the undertaking which can exercise a dominant influence over the other undertakings by virtue , for example , of ownership , financial participation or the rules which govern it or the power to have personal data protection rules implemented . ### a group of undertakings should cover a controlling undertaking and its controlled undertakings , whereby the controlling undertaking should be the undertaking which can exercise a dominant influence over the other undertakings by virtue , for example , of ownership , financial participation or the rules which govern it or the power to have personal data protection rules implemented . a group of undertakings may nominate a single main establishment in the union .


### children deserve specific protection of their personal data , as they may be less aware of risks , consequences , safeguards and their rights in relation to the processing of personal data . to determine when an individual is a child , this regulation should take over the definition laid down by the un convention on the rights of the child . ### children deserve specific protection of their personal data , as they may be less aware of risks , consequences , safeguards and their rights in relation to the processing of personal data . such protection is particularly important in the context of social networks , where children should be aware of the identities of those with whom they are communicating . to determine when an individual is a child , this regulation should take over the definition laid down by the un convention on the rights of the child .


### any processing of personal data should be lawful , fair and transparent in relation to the individuals concerned . in particular , the specific purposes for which the data are processed should be explicit and legitimate and determined at the time of the collection of the data . the data should be adequate , relevant and limited to the minimum necessary for the purposes for which the data are processed ; this requires in particular ensuring that the data collected are not excessive and that the period for which the data are stored is limited to a strict minimum . personal data should only be processed if the purpose of the processing could not be fulfilled by other means . every reasonable step should be taken to ensure that personal data which are inaccurate are rectified or deleted . in order to ensure that the data are not kept longer than necessary , time limits should be established by the controller for erasure or for a periodic review . ### any processing of personal data should be lawful , fair and transparent in relation to the individuals concerned . in particular , the specific purposes for which the data are processed should be explicit and legitimate and determined at the time of the collection of the data . the data should be adequate , relevant and not excessive in relation to the purposes for which the data are processed ; this requires in particular ensuring that the data collected are not excessive and that the period for which the data are stored is limited to a strict minimum . personal data should only be processed if the purpose of the processing could not be fulfilled by other means . every reasonable step should be taken to ensure that personal data which are inaccurate are rectified or deleted . in order to ensure that the data are not kept longer than necessary , time limits should be established by the controller for erasure or for a periodic review .


### in order for processing to be lawful , personal data should be processed on the basis of the consent of the person concerned or some other legitimate basis , laid down by law , either in this regulation or in other union or member state law as referred to in this regulation . ### in order for processing to be lawful , personal data should be processed on one of the legitimate bases laid down by law , either in this regulation or in other union or member state law as referred to in this regulation .


### the processing of personal data for other purposes should be only allowed where the processing is compatible with those purposes for which the data have been initially collected , in particular where the processing is necessary for historical , statistical or scientific research purposes . where the other purpose is not compatible with the initial one for which the data are collected , the controller should obtain the consent of the data subject for this other purpose or should base the processing on another legitimate ground for lawful processing , in particular where provided by union law or the law of the member state to which the controller is subject . in any case , the application of the principles set out by this regulation and in particular the information of the data subject on those other purposes should be ensured . ### the processing of personal data for other purposes should be only allowed where the processing is compatible with those purposes for which the data have been initially collected , such as where the processing is necessary for historical , statistical or scientific purposes . where the other purpose is not compatible with the initial one for which the data are collected , the controller should obtain the consent of the data subject for this other purpose or should base the processing on another legitimate ground for lawful processing , in particular where provided by union law or the law of the member state to which the controller is subject . in any case , the application of the principles set out by this regulation and in particular the information of the data subject on those other purposes should be ensured .


### the principles of fair and transparent processing require that the data subject should be informed in particular of the existence of the processing operation and its purposes , how long the data will be stored , on the existence of the right of access , rectification or erasure and on the right to lodge a complaint . where the data are collected from the data subject , the data subject should also be informed whether they are obliged to provide the data and of the consequences , in cases they do not provide such data . ### the principles of fair and transparent processing require that the data subject should be informed in particular of the existence of the processing operation and its purposes , how long the data will be stored and the criteria which may be used as the basis for determining how long the data will be stored , on the existence of the right of access , rectification or erasure and on the right to lodge a complaint . where the data are collected from the data subject , the data subject should also be informed whether they are obliged to provide the data and of the consequences , in cases they do not provide such data .


### the information in relation to the processing of personal data relating to the data subject should be given to them at the time of collection , or , where the data are not collected from the data subject , within a reasonable period , depending on the circumstances of the case . where data can be legitimately disclosed to another recipient , the data subject should be informed when the data are first disclosed to the recipient . ### the information in relation to the processing of personal data relating to the data subject should be given to them at the time of collection , or , where the data are not collected from the data subject , within a reasonable period , depending on the circumstances of the case . where data can be legitimately disclosed to another recipient without the data subject ' s consent or renewed consent , the data subject should be informed when the data are first disclosed to the recipient , should the data subject request to be provided with this information .


### any person should have the right of access to data which has been collected concerning them , and to exercise this right easily , in order to be aware and verify the lawfulness of the processing . every data subject should therefore have the right to know and obtain communication in particular for what purposes the data are processed , for what period , which recipients receive the data , what is the logic of the data that are undergoing the processing and what might be , at least when based on profiling , the consequences of such processing . this right should not adversely affect the rights and freedoms of others , including trade secrets or intellectual property and in particular the copyright protecting the software . however , the result of these considerations should not be that all information is refused to the data subject . ### any person should have the right of access to personal data which has been collected concerning them , and to exercise this right easily , in order to be aware and verify the lawfulness of the processing . every data subject should therefore have the right to know and obtain communication in particular for what purposes the personal data are processed , for what period , which recipients receive the personal data , what is the logic of the personal data that are undergoing the processing and what might be the consequences of such processing . this right should not adversely affect the rights and freedoms of others , including trade secrets or intellectual property and in particular the copyright protecting the software . however , the result of these considerations should not be that all information is refused to the data subject .


### the controller should use all reasonable measures to verify the identity of a data subject that requests access , in particular in the context of online services and online identifiers . a controller should not retain personal data for the unique purpose of being able to react to potential requests . ### the controller should use all reasonable measures within the context of the product or service being provided , or otherwise within the context of the relationship between the controller and the data subject , and the sensitivity of the personal data being processed to verify the identity of a data subject that requests access , in particular in the context of online services and online identifiers . a controller should not retain nor be forced to gather personal data for the unique purpose of being able to react to potential requests .


### comprehensive responsibility and liability of the controller for any processing of personal data carried out by the controller or on the controller ' s behalf should be established . in particular , the controller should ensure and be obliged to demonstrate the compliance of each processing operation with this regulation . ### overall responsibility and liability of the controller for any processing of personal data carried out by the controller or on the controller ' s behalf should be established . in particular , the controller should ensure and be obliged to demonstrate the compliance of each processing operation with this regulation .


### the protection of the rights and freedoms of data subjects with regard to the processing of personal data require that appropriate technical and organisational measures are taken , both at the time of the design of the processing and at the time of the processing itself , to ensure that the requirements of this regulation are met . in order to ensure and demonstrate compliance with this regulation , the controller should adopt internal policies and implement appropriate measures , which meet in particular the principles of data protection by design and data protection by default . ### to meet consumer and business expectations around the protection of the rights and freedoms of data subjects with regard to the processing of personal data , appropriate organisational measures may be taken , both at the time of the design of the processing and at the time of the processing itself , to ensure that the requirements of this regulation are met . measures having as an objective to increase consumer information and ease of choice shall be encouraged , based on industry cooperation and favouring innovative solutions , products and services .


### in order to demonstrate compliance with this regulation , the controller or processor should document each processing operation . each controller and processor should be obliged to co - operate with the supervisory authority and make this documentation , on request , available to it , so that it might serve for monitoring those processing operations . ### in order to demonstrate compliance with this regulation , the controller should document each processing operation . each controller should be obliged to cooperate with the supervisory authority and make this documentation , on request , available to it , so that it might serve for monitoring those processing operations .


### in order to maintain security and to prevent processing in breach of this regulation , the controller or processor should evaluate the risks inherent to the processing and implement measures to mitigate those risks . these measures should ensure an appropriate level of security , taking into account the state of the art and the costs of their implementation in relation to the risks and the nature of the personal data to be protected . when establishing technical standards and organisational measures to ensure security of processing , the commission should promote technological neutrality , interoperability and innovation , and , where appropriate , cooperate with third countries . ### in order to maintain security and to prevent processing in breach of this regulation , the controller or processor should evaluate the risks inherent to the processing and implement measures to mitigate those risks . in particular , the controller or processor shall duly take into account the greater risks arising from the processing of personal data of the data subject , due to the sensitive nature of the data . these measures should ensure an appropriate level of security , taking into account the state of the art and the costs of their implementation in relation to the risks and the nature of the personal data to be protected . when establishing technical standards and organisational measures to ensure security of processing , the commission should promote technological neutrality , interoperability and innovation , and , where appropriate , cooperate with third countries .


### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , as soon as the controller becomes aware that such a breach has occurred , the controller should notify the breach to the supervisory authority without undue delay and , where feasible , within 24 hours . where this cannot achieved within 24 hours , an explanation of the reasons for the delay should accompany the notification . the individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation or damage to reputation . the notification should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay . ### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , as soon as the controller becomes aware that such a breach has occurred , the controller should notify the breach to the supervisory authority without undue delay and , where feasible , within 24 hours . where this cannot achieved within 24 hours , an explanation of the reasons for the delay should accompany the notification . persons whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation or damage to reputation . the notification should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay .


### directive 95 / 46 / ec provided for a general obligation to notify processing of personal data to the supervisory authorities . while this obligation produces administrative and financial burdens , it did not in all cases contribute to improving the protection of personal data . therefore such indiscriminate general notification obligation should be abolished , and replaced by effective procedures and mechanism which focus instead on those processing operations which are likely to present specific risks to the rights and freedoms of data subjects by virtue of their nature , their scope or their purposes . in such cases , a data protection impact assessment should be carried out by the controller or processor prior to the processing , which should include in particular the envisaged measures , safeguards and mechanisms for ensuring the protection of personal data and for demonstrating the compliance with this regulation . ### directive 95 / 46 / ec provided for a general obligation to notify processing of personal data to the supervisory authorities . while this obligation produces administrative and financial burdens , it did not in all cases contribute to improving the protection of personal data . therefore such indiscriminate general notification obligation should be abolished , and replaced by effective procedures and mechanism which focus instead on those processing operations which are likely to present specific risks to the rights and freedoms of data subjects by virtue of their nature , their scope or their purposes . in such cases , a data protection impact assessment should be carried out by the controller prior to the processing , which should include in particular the envisaged measures , safeguards and mechanisms for ensuring the protection of personal data and for demonstrating the compliance with this regulation .


### the possibility for the controller or processor to use standard data protection clauses adopted by the commission or by a supervisory authority should neither prevent the possibility for controllers or processors to include the standard data protection clauses in a wider contract nor to add other clauses as long as they do not contradict , directly or indirectly , the standard contractual clauses adopted by the commission or by a supervisory authority or prejudice the fundamental rights or freedoms of the data subjects . ### the possibility for the controller or processor to use standard data protection clauses adopted by the commission or by a supervisory authority should neither prevent the possibility for controllers or processors to include the standard data protection clauses in a wider contract nor to add other clauses as long as they do not contradict , directly or indirectly , the standard contractual clauses adopted by the commission or by a supervisory authority or prejudice the fundamental rights or freedoms of the data subjects . in some scenarios , it may be appropriate to encourage controllers and processors to provide even more robust safeguards via additional contractual commitments that supplement standard data protection clauses .


### these derogations should in particular apply to data transfers required and necessary for the protection of important grounds of public interest , for example in cases of international data transfers between competition authorities , tax or customs administrations , financial supervisory authorities , between services competent for social security matters , or to competent authorities for the prevention , investigation , detection and prosecution of criminal offences . ### these derogations should in particular apply to data transfers required and necessary for the protection of important grounds of public interest , for example in cases of international data transfers between competition authorities , tax or customs administrations , financial supervisory authorities , between services competent for social security matters , between bodies responsible for fighting fraud in sports , or to competent authorities for the prevention , investigation , detection and prosecution of criminal offences .


### where the processing of personal data in the context of the activities of an establishment of a controller or a processor in the union takes place in more than one member state , one single supervisory authority should be competent for monitoring the activities of the controller or processor throughout the union and taking the related decisions , in order to increase the consistent application , provide legal certainty and reduce administrative burden for such controllers and processors . ### where the processing of personal data takes place in more than one member state , one single supervisory authority should be competent for monitoring the activities of the controller or processor throughout the union and taking the related decisions , in order to increase the consistent application , provide legal certainty and reduce administrative burden for such controllers and processors .


### in order to ensure the consistent application of this regulation throughout the union , a consistency mechanism for co - operation between the supervisory authorities themselves and the commission should be established . this mechanism should in particular apply where a supervisory authority intends to take a measure as regards processing operations that are related to the offering of goods or services to data subjects in several member states , , or to the monitoring such data subjects , or that might substantially affect the free flow of personal data . it should also apply where any supervisory authority or the commission requests that the matter should be dealt with in the consistency mechanism . this mechanism should be without prejudice to any measures that the commission may take in the exercise of its powers under the treaties . ### in order to ensure the consistent application of this regulation throughout the union , a consistency mechanism for co - operation between the supervisory authorities themselves and the commission should be established . this mechanism should in particular apply where the competent supervisory authority intends to take a measure as regards processing operations that are related to the offering of goods or services to data subjects in several member states , or to the monitoring such data subjects , or that might substantially affect the free flow of personal data . it should also apply where any supervisory authority or the commission requests that the matter should be dealt with in the consistency mechanism . this mechanism should be without prejudice to any measures that the commission may take in the exercise of its powers under the treaties .


### the processing of personal data solely for journalistic purposes , or for the purposes of artistic or literary expression should qualify for exemption from the requirements of certain provisions of this regulation in order to reconcile the right to the protection of personal data with the right to freedom of expression , and notably the right to receive and impart information , as guaranteed in particular by article 11 of the charter of fundamental rights of the european union . this should apply in particular to processing of personal data in the audiovisual field and in news archives and press libraries . therefore , member states should adopt legislative measures , which should lay down exemptions and derogations which are necessary for the purpose of balancing these fundamental rights . such exemptions and derogations should be adopted by the member states on general principles , on the rights of the data subject , on controller and processor , on the transfer of data to third countries or international organisations , on the independent supervisory authorities and on co - operation and consistency . this should not , however , lead member states to lay down exemptions from the other provisions of this regulation . in order to take account of the importance of the right to freedom of expression in every democratic society , it is necessary to interpret notions relating to that freedom , such as journalism , broadly . therefore , member states should classify activities as ' journalistic ' for the purpose of the exemptions and derogations to be laid down under this regulation if the object of these activities is the disclosure to the public of information , opinions or ideas , irrespective of the medium which is used to transmit them . they should not be limited to media undertakings and may be undertaken for profit - making or for non - profit making purposes . ### the processing of personal data for journalistic purposes , or for the purposes of artistic or literary expression should qualify for exemption from the requirements of certain provisions of this regulation in order to reconcile the right to the protection of personal data with the right to freedom of expression , and notably the right to receive and impart information , as guaranteed in particular by article 11 of the charter of fundamental rights of the european union . this should apply in particular to processing of personal data in the audiovisual field and in news archives and press libraries . therefore , member states should adopt legislative measures , which should lay down exemptions and derogations which are necessary for the purpose of balancing these fundamental rights . such exemptions and derogations should be adopted by the member states on general principles , on the rights of the data subject , on controller and processor , on the transfer of data to third countries or international organisations , on the independent supervisory authorities and on co - operation and consistency . this should not , however , lead member states to lay down exemptions from the other provisions of this regulation . in order to take account of the importance of the right to freedom of expression in every democratic society , it is necessary to interpret notions relating to that freedom , such as journalism , broadly . therefore , member states should classify activities as ' journalistic ' for the purpose of the exemptions and derogations to be laid down under this regulation if the object of these activities is the disclosure to the public of information , opinions or ideas , irrespective of the medium which is used to transmit them . they should not be limited to media undertakings and may be undertaken for profit - making or for non - profit making purposes .


### the processing of personal data solely for journalistic purposes , or for the purposes of artistic or literary expression should qualify for exemption from the requirements of certain provisions of this regulation in order to reconcile the right to the protection of personal data with the right to freedom of expression , and notably the right to receive and impart information , as guaranteed in particular by article 11 of the charter of fundamental rights of the european union . this should apply in particular to processing of personal data in the audiovisual field and in news archives and press libraries . therefore , member states should adopt legislative measures , which should lay down exemptions and derogations which are necessary for the purpose of balancing these fundamental rights . such exemptions and derogations should be adopted by the member states on general principles , on the rights of the data subject , on controller and processor , on the transfer of data to third countries or international organisations , on the independent supervisory authorities and on co - operation and consistency . this should not , however , lead member states to lay down exemptions from the other provisions of this regulation . in order to take account of the importance of the right to freedom of expression in every democratic society , it is necessary to interpret notions relating to that freedom , such as journalism , broadly . therefore , member states should classify activities as ‘ journalistic’ for the purpose of the exemptions and derogations to be laid down under this regulation if the object of these activities is the disclosure to the public of information , opinions or ideas , irrespective of the medium which is used to transmit them . they should not be limited to media undertakings and may be undertaken for profit - making or for non - profit making purposes . ### the processing of personal data solely for journalistic purposes , or for the purposes of artistic or literary expression should qualify for exemption from the requirements of certain provisions of this regulation in order to reconcile the right to the protection of personal data with the right to freedom of expression , and notably the right to receive and impart information , as guaranteed in particular by article 11 of the charter of fundamental rights of the european union . this should apply in particular to processing of personal data in the audiovisual field and in news archives and press libraries . in order to take account of the importance of the right to freedom of expression in every democratic society , it is necessary to interpret notions relating to that freedom , such as journalism , broadly and irrespective of the medium which is used to transmit them .


### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted in respect of lawfulness of processing ; specifying the criteria and conditions in relation to the consent of a child ; processing of special categories of data ; specifying the criteria and conditions for manifestly excessive requests and fees for exercising the rights of the data subject ; criteria and requirements for the information to the data subject and in relation to the right of access ; the right to be forgotten and to erasure ; measures based on profiling ; criteria and requirements in relation to the responsibility of the controller and to data protection by design and by default ; a processor ; criteria and requirements for the documentation and the security of processing ; criteria and requirements for establishing a personal data breach and for its notification to the supervisory authority , and on the circumstances where a personal data breach is likely to adversely affect the data subject ; the criteria and conditions for processing operations requiring a data protection impact assessment ; the criteria and requirements for determining a high degree of specific risks which require prior consultation ; designation and tasks of the data protection officer ; codes of conduct ; criteria and requirements for certification mechanisms ; criteria and requirements for transfers by way of binding corporate rules ; transfer derogations ; administrative sanctions ; processing for health purposes ; processing in the employment context and processing for historical , statistical and scientific research purposes . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council . ### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data , appropriate industry - led measures and policies shall take due account of the principles of technology , service and business model neutrality so as to favour the free movement of personal data within the union .


### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted in respect of lawfulness of processing ; specifying the criteria and conditions in relation to the consent of a child ; processing of special categories of data ; specifying the criteria and conditions for manifestly excessive requests and fees for exercising the rights of the data subject ; criteria and requirements for the information to the data subject and in relation to the right of access ; the right to be forgotten and to erasure ; measures based on profiling ; criteria and requirements in relation to the responsibility of the controller and to data protection by design and by default ; a processor ; criteria and requirements for the documentation and the security of processing ; criteria and requirements for establishing a personal data breach and for its notification to the supervisory authority , and on the circumstances where a personal data breach is likely to adversely affect the data subject ; the criteria and conditions for processing operations requiring a data protection impact assessment ; the criteria and requirements for determining a high degree of specific risks which require prior consultation ; designation and tasks of the data protection officer ; codes of conduct ; criteria and requirements for certification mechanisms ; criteria and requirements for transfers by way of binding corporate rules ; transfer derogations ; administrative sanctions ; processing for health purposes ; processing in the employment context and processing for historical , statistical and scientific research purposes . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council . ### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural and legal persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted in respect of lawfulness of processing ; specifying the criteria and conditions in relation to the consent of a child ; processing of special categories of data ; specifying the criteria and conditions for manifestly excessive requests and fees for exercising the rights of the data subject ; criteria and requirements for the information to the data subject and in relation to the right of access ; the right to be forgotten and to erasure ; measures based on profiling ; criteria and requirements in relation to the responsibility of the controller and to data protection by design and by default ; a processor ; criteria and requirements for the documentation and the security of processing ; criteria and requirements for establishing a personal data breach and for its notification to the supervisory authority , and on the circumstances where a personal data breach is likely to adversely affect the data subject ; the criteria and conditions for processing operations requiring a data protection impact assessment ; the criteria and requirements for determining a high degree of specific risks which require prior consultation ; designation and tasks of the data protection officer ; codes of conduct ; criteria and requirements for certification mechanisms ; criteria and requirements for transfers by way of binding corporate rules ; transfer derogations ; administrative sanctions ; processing for health purposes ; processing in the employment context and processing for historical , statistical and scientific research purposes . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council .


### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission for : specifying standard forms in relation to the processing of personal data of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; the right to data portability ; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation ; specific requirements for the security of processing ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; standards and procedures for a data protection impact assessment ; forms and procedures for prior authorisation and prior consultation ; technical standards and mechanisms for certification ; the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation ; disclosures not authorized by union law ; mutual assistance ; joint operations ; decisions under the consistency mechanism . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by the member states of the commission ' s exercise of implementing powers46 . in this context , the commission should consider specific measures for micro , small and medium - sized enterprises . ### in implementing the provisions of this regulation , it shall be ensured that no mandatory requirements for specific technical features are imposed on products and services , including terminal or other electronic communications equipment , which could impede the placing of equipment on the market and the free circulation of such equipment in and between member states .


### in view of the fact that , as underlined by the court of justice of the european union , the right to the protection of personal data is not an absolute right , but must be considered in relation to its function in society and be balanced with other fundamental rights , in accordance with the principle of proportionality , this regulation respects all fundamental rights and observes the principles recognised in the charter of fundamental rights of the european union as enshrined in the treaties , notably the right to respect for private and family life , home and communications , the right to the protection of personal data , the freedom of thought , conscience and religion , the freedom of expression and information , the freedom to conduct a business , the right to an effective remedy and to a fair trial as well as cultural , religious and linguistic diversity . ### in view of the fact that , as underlined by the court of justice of the european union , the right to the protection of personal data is not an absolute right , but must be considered in relation to its function in society and the actual and potential advances in science , health and technology and be balanced with other fundamental rights , in accordance with the principle of proportionality , this regulation respects all fundamental rights and observes the principles recognised in the charter of fundamental rights of the european union as enshrined in the treaties , notably the right to respect for private and family life , home and communications , the right to the protection of personal data , the freedom of thought , conscience and religion , the freedom of expression and information , the freedom to conduct a business , the right to property and in particular the protection of intellectual property the right to an effective remedy and to a fair trial as well as cultural , religious and linguistic diversity .


### this regulation lays down rules relating to the protection of individuals with regard to the processing of personal data and rules relating to the free movement of personal data . ### this regulation lays down rules relating to the protection of natural and legal persons with regard to the processing of personal data and rules relating to the free movement of personal data .


### this regulation protects the fundamental rights and freedoms of natural persons , and in particular their right to the protection of personal data . ### this regulation protects the fundamental rights and freedoms of natural and legal persons , and in particular their right to the protection of personal data .


### the free movement of personal data within the union shall neither be restricted nor prohibited for reasons connected with the protection of individuals with regard to the processing of personal data . ### the free movement of personal data within the union shall neither be restricted nor prohibited for reasons connected with the protection of natural and legal persons with regard to the processing of personal data .


### this regulation applies to the processing of personal data wholly or partly by automated means , and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system . ### this regulation applies to the processing of personal data wholly or partly by automated means , without discrimination between such processing means , and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system .


### this regulation applies to the processing of personal data of data subjects residing in the union by a controller not established in the union , where the processing activities are related to : ### this regulation applies to the processing of personal data of data subjects domiciled in the union by a controller not established in the union , where the processing activities are related to


### ' data subject ' means an identified natural person or a natural person who can be identified , directly or indirectly , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to an identification number , location data , online identifier or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural or social identity of that person ; ### ' data subject ' means an identified natural person or a natural person who can be identified , directly or indirectly , by means reasonably likely to be used by the controller , in particular by reference to an identification number , location data , online identifier or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural or social identity of that person and who is not acting in his / her professional capacity ;


### ' data subject ' means an identified natural person or a natural person who can be identified , directly or indirectly , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to an identification number , location data , online identifier or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural or social identity of that person ; ### ' data subject ' means an identified natural or legal person or a natural or legal person who can be identified , directly or indirectly , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to an identification number , location data , online identifier or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural or social identity of that person ;


### ‘ processor’ means a natural or legal person , public authority , agency or any other body which processes personal data on behalf of the controller ; ### ‘ processor’ means a natural or legal person , public authority , agency or any other body which processes personal data on behalf of the controller ; is able to access personal data in a technically feasible way , without disproportionate effort , and is reasonably likely to gain knowledge of its content ;


### ‘ genetic data’ means all data , of whatever type , concerning the characteristics of an individual which are inherited or acquired during early prenatal development ; ### ‘ genetic data’ means information on the hereditary characteristics , or alteration thereof , of an identified or identifiable person , obtained through nucleic acid analysis ;


### ‘ data concerning health’ means any information which relates to the physical or mental health of an individual , or to the provision of health services to the individual ; ### ‘ data concerning health’ means personal data which relates to the physical or mental health of an individual , or to the provision of health services to the individual ;


### ‘ representative’ means any natural or legal person established in the union who , explicitly designated by the controller , acts and may be addressed by any supervisory authority and other bodies in the union instead of the controller , with regard to the obligations of the controller under this regulation ; ### ‘ representative’ means any natural or legal person established in the union who , explicitly designated by the controller , acts and shall be addressed by the competent supervisory authority , with regard to the obligations of the controller under this regulation ;


### accurate and kept up to date ; every reasonable step must be taken to ensure that personal data that are inaccurate , having regard to the purposes for which they are processed , are erased or rectified without delay ; ### accurate and where necessary , kept up to date ; every reasonable step must be taken to ensure that personal data that are inaccurate , having regard to the purposes for which they are processed , are erased or rectified without undue delay ;


### kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ; personal data may be stored for longer periods insofar as the data will be processed solely for historical , statistical or scientific research purposes in accordance with the rules and conditions of article 83 and if a periodic review is carried out to assess the necessity to continue the storage ; ### kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ; personal data may be stored for longer periods insofar as the data will be processed solely for historical , statistical or scientific purposes in accordance with the rules and conditions of article 83 and if a periodic review is carried out to assess the necessity to continue the storage ;


### processed under the responsibility and liability of the controller , who shall ensure and demonstrate for each processing operation the compliance with the provisions of this regulation . ### processed under the responsibility and liability of the controller , who shall ensure and , if required to do so , demonstrate compliance of the controller ' s processing with the provisions of this regulation to the supervisory authority having competence under paragraph 2 of article 51 .


### processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract ; ### processing is necessary for the performance of a contract or of collective agreements and company - level agreements , to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract .


### processing is necessary for compliance with a legal obligation to which the controller is subject ; ### processing is necessary for compliance with a legal obligation , regulatory rule , guidance , industry code of practice , either domestically or internationally to which the controller is subject including the requirements of supervisory authorities ;


### processing of personal data which is necessary for the purposes of historical , statistical or scientific research shall be lawful subject to the conditions and safeguards referred to in article 83 . ### subsequent processing of personal data which is necessary for the purposes of historical , statistical or scientific research shall be lawful subject to the conditions and safeguards referred to in article 83 .


### the law of the member state must meet an objective of public interest or must be necessary to protect the rights and freedoms of others , respect the essence of the right to the protection of personal data and be proportionate to the legitimate aim pursued . ### the law of the member state must meet an objective of public interest or must be necessary to protect the rights and freedoms of others . the law of the member state must also respect the essence of the right to the protection of personal data this regulation and international treatises that the member state has decided to follow . finally the member state is obliged to evaluate and decide if national legislation is and be proportionate to the legitimate aim pursued or if a legitimate aim could be achieved using less privacy invasive solutions .


### the data subject shall have the right to withdraw his or her consent at any time . the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal . ### the data subject shall have the right to withdraw his or her consent vis à vis the controller who processes personal data on the basis of consent at any time . if the consent is part of a contractual or statutory relationship the withdrawal shall depend on the contractual or legal conditions . the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal . it is acknowledged that the withdrawal of consent may serve to terminate the relationship with the controller .


### the processing of personal data , revealing race or ethnic origin , political opinions , religion or beliefs , trade - union membership , and the processing of genetic data or data concerning health or sex life or criminal convictions or related security measures shall be prohibited . ### the processing of special categories of personal data shall be prohibited .


### processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation , association or any other non - profit - seeking body with a political , philosophical , religious or trade - union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the data are not disclosed outside that body without the consent of the data subjects ; or ### processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation , association , organizations on the labour market or any other non - profit - seeking body with a political , philosophical , religious or trade - union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the data are not disclosed outside that body without the consent of the data subjects ; or


### processing is necessary for the performance of a task carried out in the public interest , on the basis of union law , or member state law which shall provide for suitable measures to safeguard the data subject ' s legitimate interests ; or ### processing is necessary for the performance of a task carried out in the public interest , on the basis of union law , member state law , international conventions to which the union or a member state is a party , which shall provide for suitable measures to safeguard the data subject ' s legitimate interests ; or


### processing of data concerning health is necessary for health purposes and subject to the conditions and safeguards referred to in article 81 ; or ### processing of data concerning health is necessary for health purposes , including for historical , statistical or scientific research and subject to the conditions and safeguards referred to in article 81 ; or


### processing of data relating to criminal convictions or related security measures is carried out either under the control of official authority or when the processing is necessary for compliance with a legal or regulatory obligation to which a controller is subject , or for the performance of a task carried out for important public interest reasons , and in so far as authorised by union law or member state law providing for adequate safeguards . a complete register of criminal convictions shall be kept only under the control of official authority . ### processing of data relating to criminal convictions or related security measures is carried out either subject to the conditions and safeguards referred to in article 83a or under the supervision of a supervisory authority or when the processing is necessary for compliance with or to avoid a breach of a legal or regulatory obligation to which a controller is subject , or for the performance of a task carried out for important public interest reasons , and in so far as authorised by union law or member state law providing for adequate safeguards . a complete register of criminal convictions shall be kept only under the control of official authority


### if the data processed by a controller do not permit the controller to identify a natural person , the controller shall not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this regulation . ### data protection regulation should not apply to data rendered anonymous . if the data processed by a controller do not permit the controller to identify a natural person , the controller shall not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this regulation .


### if the data processed by a controller do not permit the controller to identify a natural person , the controller shall not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this regulation . ### if the data processed by a controller do not permit the controller to identify a natural person , in particular when rendered anonymous or pseudonymous , the controller shall not be obliged to acquire additional information in order to identify or to individualise the data subject for the sole purpose of complying with any provision of this regulation .


### if the data processed by a controller do not permit the controller to identify a natural person , the controller shall not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this regulation . ### if the data processed by a controller are anonymous , or the controller renders the data processed anonymous , the controller shall not be obliged to acquire additional information on consent in order to identify the data subject for the sole purpose of complying with any provision of this regulation .


### the controller shall establish procedures for providing the information referred to in article 14 and for the exercise of the rights of data subjects referred to in article 13 and articles 15 to 19 . the controller shall provide in particular mechanisms for facilitating the request for the actions referred to in article 13 and articles 15 to 19 . where personal data are processed by automated means , the controller shall also provide means for requests to be made electronically . ### the controller shall establish procedures for providing the information referred to in article 14 and for the exercise of the rights of data subjects referred to in article 13 and articles 15 to 19 . the controller shall provide in particular mechanisms for facilitating the request for the actions referred to in article 13 and articles 15 to 19 . where personal data are processed by automated means , the controller may also provide means for requests to be made electronically .


### the information and the actions taken on requests referred to in paragraph 1 shall be free of charge . where requests are manifestly excessive , in particular because of their repetitive character , the controller may charge a fee for providing the information or taking the action requested , or the controller may not take the action requested . in that case , the controller shall bear the burden of proving the manifestly excessive character of the request . ### the charges for taking action or providing information upon the request of data subject referred to in paragraph 1 shall not exceed actual costs of handling the requests born by the controller .


### the commission may lay down standard forms and specifying standard procedures for the communication referred to in paragraph 2 , including the electronic format . in doing so , the commission shall take the appropriate measures for micro , small and medium - sized enterprises . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the commission may specifying standard procedures for the communication referred to in paragraph 2 . in doing so , the commission shall take the appropriate measures for micro , small and medium - sized enterprises . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 .


### the purposes of the processing for which the personal data are intended , including the contract terms and general conditions where the processing is based on point of article 6 and the legitimate interests pursued by the controller where the processing is based on point of article 6 ; ### the purposes of the processing for which the personal data are intended , and the legitimate interests pursued by the controller where the processing is based on point of article 6 ;


### the period for which the personal data will be stored ; ### the maximum period for which the personal data will be stored .


### where the personal data are collected from the data subject , the controller shall inform the data subject , in addition to the information referred to in paragraph 1 , whether the provision of personal data is obligatory or voluntary , as well as the possible consequences of failure to provide such data . ### where the personal data are collected from the data subject , the controller shall inform the data subject , in addition to the information referred to in paragraph 1 , whether the provision of personal data is obligatory .