### ' data subject ' means an identified natural person or a natural person who can be identified , directly or indirectly , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to an identification number , location data , online identifier or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural or social identity of that person ; ### ' data subject ' means an identified natural person or a natural person who can be identified or singled out , directly or indirectly , alone or in combination with associated data , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to a unique identifier , location data , online identifier or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural , social or gender identity or sexual orientation of that person ;


### within the limits of this regulation , member states may adopt by law specific rules regulating the processing of employees ' personal data in the employment context , in particular for the purposes of the recruitment , the performance of the contract of employment , including discharge of obligations laid down by law or by collective agreements , management , planning and organisation of work , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship . ### member states may , in accordance with the rules set out in this regulation , and taking into account the principle of proportionality , adopt by legal provisions specific rules regulating the processing of employees ' personal data in the employment context , in particular but not limited to the purposes of the recruitment and job applications within the group of undertakings , the performance of the contract of employment , including discharge of obligations laid down by law and by collective agreements , company agreements and collective agreements in accordance with national law and practice , management , planning and organisation of work , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship . the level of protection afforded by this regulation may not be undercut . notwithstanding the previous sentence , where arrangements are made by agreement between employee representatives and the management of the undertaking or of the controlling undertaking of a group of undertakings the level of protection afforded by this regulation may not be significantly undercut . the right of member states , or the social partners via collective agreements , to provide employees with more favourable protection provisions in respect of the processing of personal data in the employment context shall remain unaffected .


### rights in relation to recipients the controller shall communicate any rectification or erasure carried out in accordance with articles 16 and 17 to each recipient to whom the data have been disclosed , unless this proves impossible or involves a disproportionate effort . ### rights in relation to recipients the controller shall communicate any rectification or erasure carried out in accordance with articles 16 and 17 to each recipient to whom the data have been transferred , unless this proves impossible or involves a disproportionate effort . the controller shall inform the data subject about those third parties .


### bodies conducting historical , statistical or scientific research may publish or otherwise publicly disclose personal data only if : the data subject has given consent , subject to the conditions laid down in article 7 ; ### bodies conducting historical , statistical or scientific research may publish or otherwise publicly disclose personal data only if : the data subject has given consent , subject to the conditions laid down in article 7 ; or


### processing in the employment context ### minimum standards for processing data in the employment context


### in cases where data subjects in several member states are likely to be affected by processing operations , a supervisory authority of each of those member states shall have the right to participate in the joint investigative tasks or joint operations , as appropriate . the competent supervisory authority shall invite the supervisory authority of each of those member states to take part in the respective joint investigative tasks or joint operations and respond to the request of a supervisory authority to participate in the operations without delay . ### in cases where the controller or processor has establishments in several member states or where data subjects in several member states are likely to be affected by processing operations , a supervisory authority of each of those member states shall have the right to participate in the joint investigative tasks or joint operations , as appropriate . the lead authority as defined in article 54a shall invite the supervisory authority of each of those member states to take part in the respective joint investigative tasks or joint operations and respond to the request of a supervisory authority to participate in the operations without delay . the lead authority shall act as the single contact point for the controller or processor .


### processing of personal data concerning health which is necessary for historical , statistical or scientific research purposes , such as patient registries set up for improving diagnoses and differentiating between similar types of diseases and preparing studies for therapies , is subject to the conditions and safeguards referred to in article 83 . ### processing of personal data concerning health which is necessary for historical , statistical or scientific research purposes , shall be permitted only with the consent of the data subject , and shall be subject to the conditions and safeguards referred to in article 83 .


### the data subject shall have the right to obtain from the controller at any time , on request , confirmation as to whether or not personal data relating to the data subject are being processed . where such personal data are being processed , the controller shall provide the following information : ### the data subject shall have the right to obtain from the controller at any time , on request , in clear and plain language , confirmation as to whether or not personal data relating to the data subject are being processed , and as to the existence of profiling and measures based on profiling in respect of the data subject the controller shall provide the following information :


### consent should not provide a valid legal ground for the processing of personal data , where there is a clear imbalance between the data subject and the controller . this is especially the case where the data subject is in a situation of dependence from the controller , among others , where personal data are processed by the employer of employees ' personal data in the employment context . where the controller is a public authority , there would be an imbalance only in the specific data processing operations where the public authority can impose an obligation by virtue of its relevant public powers and the consent cannot be deemed as freely given , taking into account the interest of the data subject . ### consent should not provide a valid legal ground for the processing of personal data , where there is a clear imbalance between the data subject and the controller . this is especially the case where the data subject is in a situation of dependence from the controller , among others , where personal data are processed by the employer of employees ' personal data in the employment context , where the processor or controller is in a dominant market position with respect to the products or services offered to the data subject or where a unilateral and non - essential change in terms of service gives a data subject no option other than to accept the change or abandon an online resource in which they have invested significant time . where the controller is a public authority , there would be an imbalance only in the specific data processing operations where the public authority can impose an obligation by virtue of its relevant public powers and the consent cannot be deemed as freely given , taking into account the interest of the data subject .


### other public interests of the union or of a member state , in particular an important economic or financial interest of the union or of a member state , including monetary , budgetary and taxation matters and the protection of market stability and integrity ; ### other public interests of the union or of a member state , in particular an important economic or financial interest of the union or of a member state , including monetary , budgetary and taxation matters ;


### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission for : specifying standard forms in relation to the processing of personal data of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; the right to data portability ; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation ; specific requirements for the security of processing ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; standards and procedures for a data protection impact assessment ; forms and procedures for prior authorisation and prior consultation ; technical standards and mechanisms for certification ; the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation ; disclosures not authorized by union law ; mutual assistance ; joint operations ; decisions under the consistency mechanism . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by the member states of the commission ' s exercise of implementing powers . in this context , the commission should consider specific measures for micro , small and medium - sized enterprises . ### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission for : specifying standard forms in relation to the processing of personal data of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; forms for prior authorisation and prior consultation ; standard form for notification of decision of third country requesting disclosure of the the personal date ; format and procedures for the exchange of information by electronic means on binding corporate rules ; decisions under the consistency mechanism . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level in particular with the european data protection board . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by the member states of the commission ' s exercise of implementing powers . in this context , the commission should consider specific measures for micro , small and medium - sized enterprises .


### in order to strengthen the judicial protection of the data subject in situations where the competent supervisory authority is established in another member state than the one where the data subject is residing , the data subject may request any body , organisation or association aiming to protect the rights and interests of data subjects in relation to the protection of their data to bring on the data subject ' s behalf proceedings against that supervisory authority to the competent court in the other member state . ### in order to strengthen the judicial protection of the data subject in situations where the competent supervisory authority is established in another member state than the one where the data subject is residing , the data subject may request any body , organisation or association acting in the public interest to bring on the data subject ' s behalf proceedings against that supervisory authority to the competent court in the other member state .


### the processing of personal data , revealing race or ethnic origin , political opinions , religion or beliefs , trade - union membership , and the processing of genetic data or data concerning health or sex life or criminal convictions or related security measures shall be prohibited . ### the processing of personal data , revealing race or ethnic origin , political opinions , religion or philosophical beliefs , sexual orientation or gender identity , trade - union membership and activities , and the processing of genetic data or data concerning health or sex life or criminal convictions , or related security measures shall be prohibited .


### when using online services , individuals may be associated with online identifiers provided by their devices , applications , tools and protocols , such as internet protocol addresses or cookie identifiers . this may leave traces which , combined with unique identifiers and other information received by the servers , may be used to create profiles of the individuals and identify them . it follows that identification numbers , location data , online identifiers or other specific factors as such need not necessarily be considered as personal data in all circumstances . ### when using online services , individuals may be associated with one or more online identifiers provided by their devices , applications , tools and protocols , such as internet protocol addresses , cookie identifiers and other unique identifiers . since such identifiers leave traces and can be used to single out natural persons , this regulation should be applicable to processing involving such data , unless those identifiers demonstrably do no relate to natural persons , such as for example the ip addresses used by companies , which cannot be considered as ' personal data ' as defined in this regulation .


### instead of erasure , the controller shall restrict processing of personal data where : ### instead of erasure , the controller shall restrict processing of personal data in such a way that it is not subject to the normal data access and processing operations of the controller and can not be changed anymore , where :


### to further strengthen the control over their own data and their right of access , data subjects should have the right , where personal data are processed by electronic means and in a structured and commonly used format , to obtain a copy of the data concerning them also in commonly used electronic format . the data subject should also be allowed to transmit those data , which they have provided , from one automated application , such as a social network , into another one . this should apply where the data subject provided the data to the automated processing system , based on their consent or in the performance of a contract ### to further strengthen the control over their own data and their right of access , data subjects should have the right , to obtain free of charge the data concerning them also in commonly used , interoperable , and where possible open source electronic format . the data subject should also be allowed to transmit those data , which they have provided , from one automated application , such as a social network , into another one . providers of information society services should not make the transfer of those data mandatory for the provision of their services . social networks should be encouraged as much as possible to store data in a way which permits efficient data portability for data subjects .


### each supervisory authority should hear complaints lodged by any data subject and should investigate the matter . the investigation following a complaint should be carried out , subject to judicial review , to the extent that is appropriate in the specific case . the supervisory authority should inform the data subject of the progress and the outcome of the complaint within a reasonable period . if the case requires further investigation or coordination with another supervisory authority , intermediate information should be given to the data subject . ### each supervisory authority should hear complaints lodged by any data subject or by association acting in the public interest and should investigate the matter . the investigation following a complaint should be carried out , subject to judicial review , to the extent that is appropriate in the specific case . the supervisory authority should inform the data subject or the association of the progress and the outcome of the complaint within a reasonable period . if the case requires further investigation or coordination with another supervisory authority , intermediate information should be given to the data subject .


### within the limits of this regulation and in accordance with point of article 9 , processing of personal data concerning health must be on the basis of union law or member state law which shall provide for suitable and specific measures to safeguard the data subject ' s legitimate interests , and be necessary for : ### in accordance with the rules set out in this regulation , in particular with point of article 9 , processing of personal data concerning health must be on the basis of union law or member state law which shall provide for suitable and specific measures to safeguard the data subject ' s interests and fundamental rights , and be necessary for :


### adequate , relevant , and limited to the minimum necessary in relation to the purposes for which they are processed ; they shall only be processed if , and as long as , the purposes could not be fulfilled by processing information that does not involve personal data ; ### adequate , relevant , and limited to the minimum necessary in relation to the purposes for which they are processed ; they shall only be processed if , and as long as , the purposes could not be fulfilled by processing anonymous information that does not involve personal data ;


### where a transfer is based on contractual clauses as referred to in point of paragraph 2 of this article the controller or processor shall obtain prior authorisation of the contractual clauses according to point of article 34 from the supervisory authority . if the transfer is related to processing activities which concern data subjects in another member state or other member states , or substantially affect the free movement of personal data within the union , the supervisory authority shall apply the consistency mechanism referred to in article 57 . ### the controller or processor shall obtain prior authorisation of the contractual clauses according to point of article 34 from the competent supervisory authority for transfers according to this article . if the transfer is related to processing activities which substantially affect the free movement of personal data within the union , the competent supervisory authority shall apply the consistency mechanism referred to in article 57 .


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying ' important grounds of public interest ' within the meaning of point of paragraph 1 as well as the criteria and requirements for appropriate safeguards referred to in point of paragraph 1 . ### the european data protection board shall be entrusted with the task of further specifying the criteria and requirements for appropriate safeguards referred to in point of paragraph 1 , in accordance with article 66 .


### the public interest referred to in point of paragraph 1 must be recognised in union law or in the law of the member state to which the controller is subject . ### the public interest referred to in point of paragraph 1 must be recognised in international conventions , in union law or in the law of the member state to which the controller is subject . this derogation shall only be used for occasional transfers . in each and every case , a careful assessment of all circumstances of the transfer needs to be carried out .


### kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ; personal data may be stored for longer periods insofar as the data will be processed solely for historical , statistical or scientific research purposes in accordance with the rules and conditions of article 83 and if a periodic review is carried out to assess the necessity to continue the storage ; ### kept in a form which permits identification or singling out of data subjects for no longer than is necessary for the purposes for which the personal data are processed ; personal data may be stored for longer periods insofar as the data will be processed solely for historical , statistical or scientific research purposes in accordance with the rules and conditions of article 83 and if a periodic review is carried out to assess the necessity to continue the storage ;


### data enabling the attribution of information to an identified or identifiable data subject is kept separately from the other information as long as these purposes can be fulfilled in this manner . ### data enabling the attribution of information to an identified or identifiable data subject is kept separately from the other information .


### processing is necessary for the performance of a task carried out in the public interest , on the basis of union law , or member state law which shall provide for suitable measures to safeguard the data subject ' s legitimate interests ; or ### processing is necessary for the performance of a task carried out in the public interest , on the basis of union law , or member state law which shall provide for suitable measures to safeguard the fundamental rights and the interests of the data subject ; or


### the controller shall communicate any rectification or erasure carried out in accordance with articles 16 and 17 to each recipient to whom the data have been disclosed , unless this proves impossible or involves a disproportionate effort . ### the controller shall communicate any rectification or any erasure carried out in accordance with articles 16 and 17 to each recipient to whom the data have been disclosed . the controller shall inform the person concerned of the existence of these third parties .


### the controller shall implement mechanisms for ensuring that , by default , only those personal data are processed which are necessary for each specific purpose of the processing and are especially not collected or retained beyond the minimum necessary for those purposes , both in terms of the amount of the data and the time of their storage . in particular , those mechanisms shall ensure that by default personal data are not made accessible to an indefinite number of individuals . ### where the data subject is given a choice regarding the processing of personal data , the controller shall ensure that , by default , only those personal data are processed which are necessary for each specific purpose of the processing and are especially not collected or retained beyond the minimum necessary for those purposes , both in terms of the amount of the data and the time of their storage . in particular , those mechanisms shall ensure that by default personal data are not made accessible to an indefinite number of individuals and that data subjects are able to control the distribution of their personal data .


### any person should have the right of access to data which has been collected concerning them , and to exercise this right easily , in order to be aware and verify the lawfulness of the processing . every data subject should therefore have the right to know and obtain communication in particular for what purposes the data are processed , for what period , which recipients receive the data , what is the logic of the data that are undergoing the processing and what might be , at least when based on profiling , the consequences of such processing . this right should not adversely affect the rights and freedoms of others , including trade secrets or intellectual property and in particular the copyright protecting the software . however , the result of these considerations should not be that all information is refused to the data subject . ### any person should have the right of access to data which has been collected concerning them , and to exercise this right easily , in order to be aware and verify the lawfulness of the processing . every data subject should therefore have the right to know and obtain communication in particular for what purposes the data are processed , for what period , which recipients receive the data , what is the logic of the data that are undergoing the processing and what might be , at least when based on profiling , the consequences of such processing . this right should not adversely affect the rights and freedoms of others , including trade secrets or intellectual property , such as in relation to the copyright protecting the software . however , the result of these considerations should not be that all information is refused to the data subject .


### within the limits of this regulation , member states may adopt specific rules to set out the investigative powers by the supervisory authorities laid down in article 53 in relation to controllers or processors that are subjects under national law or rules established by national competent bodies to an obligation of professional secrecy or other equivalent obligations of secrecy , where this is necessary and proportionate to reconcile the right of the protection of personal data with the obligation of secrecy . these rules shall only apply with regard to personal data which the controller or processor has received from or has obtained in an activity covered by this obligation of secrecy . ### in accordance with the rules set out in this regulation , member states , may adopt specific rules in relation to controllers or processors that are subjects under national law or rules established by national competent bodies to an obligation of professional secrecy or other equivalent obligations of secrecy , where this is necessary and proportionate to reconcile the right of the protection of personal data with the obligation of secrecy , to set out the rights of data subjects laid down in articles 11 to 20 , in line with article 21 ; the investigative powers by the supervisory authorities laid down in article 53 . the specific rules referred to in paragraph 1 shall only apply with regard to personal data which the controller or processor has received from or has obtained in an activity covered by this obligation of secrecy .


### the data subject shall have the right to object , on grounds relating to their particular situation , at any time to the processing of personal data which is based on points , and of article 6 , unless the controller demonstrates compelling legitimate grounds for the processing which override the interests or fundamental rights and freedoms of the data subject . ### the data subject shall have the right to object at any time to the processing of personal data which is based on points and of article 6 .


### the controller or the processor shall support the data protection officer in performing the tasks and shall provide staff , premises , equipment and any other resources necessary to carry out the duties and tasks referred to in article 37 . ### the controller or the processor shall support the data protection officer in performing the tasks and shall provide all necessary resources , including staff , premises , equipment , access to information and any other resources necessary to carry out the duties and tasks referred to in article 37 and update his or her professional knowledge .


### having regard to the state of the art and the cost of implementation , the controller shall , both at the time of the determination of the means for processing and at the time of the processing itself , implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject . ### having regard to the state of the art , the controller and the processor , if any , shall , both at the time of the determination of the purposes and means for processing and at the time of the processing itself , implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject , in particular with regard to the principles laid out in article 5 . where the controller has carried out a data protection impact assessment pursuant to article 33 , the results shall be taken into account when developing those measures and procedures .


### having regard to the state of the art and the cost of implementation , the controller shall , both at the time of the determination of the means for processing and at the time of the processing itself , implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject . ### having regard to the state of the art and the cost of implementation , the controller shall , both at the time of the determination of the purposes and means for processing and at the time of the processing itself , implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject , in particular with regard to the principles laid out in article 5 . where the controller has carried out a data protection impact assessment pursuant to article 33 , the results shall be taken into account when developing those measures and procedures .


### children deserve specific protection of their personal data , as they may be less aware of risks , consequences , safeguards and their rights in relation to the processing of personal data . to determine when an individual is a child , this regulation should take over the definition laid down by the un convention on the rights of the child . ### children deserve specific protection of their personal data , as they may be less aware of risks , consequences , safeguards and their rights in relation to the processing of personal data . such protection is particularly important in the context of social networks , where children should be aware of the identities of those with whom they are communicating . to determine when an individual is a child , this regulation should take over the definition laid down by the un convention on the rights of the child . no reference to child protection in this regulation should be understood as an implicit instruction that protection of personal data of adults should be treated with less care than would have been the case if the reference was not included .


### the commission may set out standard forms and procedures for prior authorisations and consultations referred to in paragraphs 1 and 2 , and standard forms and procedures for informing the supervisory authorities pursuant to paragraph 6 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the commission may set out standard forms for prior authorisations and consultations referred to in paragraphs 1 and 2 , and standard forms for informing the supervisory authorities pursuant to paragraph 6 . those implementing acts shall be adopted , after requesting an opinion of the european data protection board , in accordance with the examination procedure referred to in article 87 .


### within the limits of this regulation , member states may adopt by law specific rules regulating the processing of employees ' personal data in the employment context , in particular for the purposes of the recruitment , the performance of the contract of employment , including discharge of obligations laid down by law or by collective agreements , management , planning and organisation of work , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship . ### member states may , in accordance with the rules set out in this regulation , and taking into account the principle of proportionality , adopt by legal provisions specific rules regulating the processing of employees ' personal data in the employment context , in particular but not limited to the purposes of the recruitment and job applications within the group of undertakings , the performance of the contract of employment , including discharge of obligations laid down by law and by collective agreements , company agreements and collective agreements in accordance with national law and practice , management , planning and organisation of work , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship . the level of protection afforded by this regulation may not be undercut . notwithstanding the previous sentence , where arrangements are made by agreement between employee representatives and the management of the undertaking or of the controlling undertaking of a group of undertakings the level of protection afforded by this regulation may not be significantly undercut . the right of member states , or the social partners via collective agreements , to provide employees with more favourable protection provisions in respect of the processing of personal data in the employment context shall remain unaffected .


### to further strengthen the control over their own data and their right of access , data subjects should have the right , where personal data are processed by electronic means and in a structured and commonly used format , to obtain a copy of the data concerning them also in commonly used electronic format . the data subject should also be allowed to transmit those data , which they have provided , from one automated application , such as a social network , into another one . this should apply where the data subject provided the data to the automated processing system , based on their consent or in the performance of a contract ### to further strengthen the control over their own data and their right of access , data subjects should have the right , to obtain free of charge the data concerning them also in commonly used , interoperable , and where possible open source electronic format . the data subject should also be allowed to transmit those data , which they have provided , from one automated application , such as a social network , into another one . providers of information society services should not make the transfer of those data mandatory for the provision of their services . social networks should be encouraged as much as possible to store data in a way which permits efficient data portability for data subjects .


### where the commission requests advice from the european data protection board , it may lay out a time limit within which the european data protection board shall provide such advice , taking into account the urgency of the matter . ### where the european parliament , the council or the commission request advice from the european data protection board , it may lay out a time limit within which the european data protection board shall provide such advice , taking into account the urgency of the matter .


### each supervisory authority must draw up an annual report on its activities . the report shall be presented to the national parliament and shall be made be available to the public , the commission and the european data protection board . ### each supervisory authority must draw up a report on its activities at least every two years . the report shall be presented to the national parliament and shall be made be available to the public , the commission and the european data protection board .


### the commission may decide that a third country , or a territory or a processing sector within that third country , or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the commission shall be empowered to adopt delegated acts in accordance with article 86 to decide that a third country , or a territory within that third country , or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 .


### make available to the controller and the supervisory authority all information necessary to control compliance with the obligations laid down in this article . ### make available to the controller and the supervisory authority all information necessary to control compliance with the obligations laid down in this article and allow on - site inspections .


### personal data which are , by their nature , particularly sensitive and vulnerable in relation to fundamental rights or privacy , deserve specific protection . such data should not be processed , unless the data subject gives his explicit consent . however , derogations from this prohibition should be explicitly provided for in respect of specific needs , in particular where the processing is carried out in the course of legitimate activities by certain associations or foundations the purpose of which is to permit the exercise of fundamental freedoms . ### personal data which are , by their nature , particularly sensitive and vulnerable in relation to fundamental rights or privacy , deserve specific protection . such data should not be processed , unless the data subject gives his explicit and informed consent . however , derogations from this prohibition should be explicitly provided for in respect of specific needs , in particular where the processing is carried out in the course of legitimate activities by certain associations or foundations the purpose of which is to permit the exercise of fundamental freedoms by the data subjects in question .


### in order to ensure compliance with this regulation , the commission may adopt an opinion on this matter , or a decision , requiring the supervisory authority to suspend its draft measure . ### in order to ensure compliance with this regulation , the commission may adopt an opinion on matters raised . the commission may appeal to the court of justice of the european union . it may request the court to suspend the measure in the course of an urgency procedure , if necessary to avoid irreparable damage .


### the implementing act shall specify its geographical and sectoral application , and , where applicable , identify the supervisory authority mentioned in point of paragraph 2 . ### the delegated act shall specify its territorial application , and identify the supervisory authority mentioned in point of paragraph 2 .


### associations and other bodies representing categories of controllers or processors in one member state which intend to draw up codes of conduct or to amend or extend existing codes of conduct may submit them to an opinion of the supervisory authority in that member state . the supervisory authority may give an opinion whether the draft code of conduct or the amendment is in compliance with this regulation . the supervisory authority shall seek the views of data subjects or their representatives on these drafts . ### associations and other bodies representing categories of controllers or processors in one member state which intend to draw up codes of conduct or to amend or extend existing codes of conduct may submit them to an opinion of the supervisory authority in that member state . the supervisory authority shall give an opinion in due time whether the draft code of conduct or the amendment is in compliance with this regulation . the supervisory authority shall seek the views of data subjects or their representatives on these drafts .


### where applicable , that the controller intends to transfer to a third country or international organisation and on the level of protection afforded by that third country or international organisation by reference to an adequacy decision by the commission ; ### where applicable , that the controller intends to transfer the data to a third country or international organisation and on the level of protection afforded by that third country or international organisation by reference to an adequacy decision by the commission , or in case of transfers referred to in article 42 , article 43 , or point of article 44 , by reference to the appropriate safeguards and the means to obtain a copy of them ;


### in order to maintain security and to prevent processing in breach of this regulation , the controller or processor should evaluate the risks inherent to the processing and implement measures to mitigate those risks . these measures should ensure an appropriate level of security , taking into account the state of the art and the costs of their implementation in relation to the risks and the nature of the personal data to be protected . when establishing technical standards and organisational measures to ensure security of processing , the commission should promote technological neutrality , interoperability and innovation , and , where appropriate , cooperate with third countries . ### in order to maintain security and to prevent processing in breach of this regulation , the controller or processor should evaluate the risks inherent to the processing and implement measures to mitigate those risks . these measures should ensure an appropriate level of security , taking into account the state of the art and the costs of their implementation in relation to the risks and the nature of the personal data to be protected . when establishing technical standards and organisational measures to ensure security of processing , technological neutrality , interoperability and innovation should be promoted , and , where appropriate , third countries should be encouraged .


### conduct investigations either on its own initiative or on the basis of a complaint or on request of another supervisory authority , and inform the data subject concerned , if the data subject has addressed a complaint to this supervisory authority , of the outcome of the investigations within a reasonable period ; ### conduct investigations either on its own initiative or on the basis of a complaint or of specific and documented information received alleging unlawful processing or on request of another supervisory authority , and inform the data subject concerned , if the data subject has addressed a complaint to this supervisory authority , of the outcome of the investigations within a reasonable period ;


### in cases where data subjects in several member states are likely to be affected by processing operations , a supervisory authority of each of those member states shall have the right to participate in the joint investigative tasks or joint operations , as appropriate . the competent supervisory authority shall invite the supervisory authority of each of those member states to take part in the respective joint investigative tasks or joint operations and respond to the request of a supervisory authority to participate in the operations without delay . ### in cases where the controller or processor has establishments in several member states or where data subjects in several member states are likely to be affected by processing operations , a supervisory authority of each of those member states shall have the right to participate in the joint investigative tasks or joint operations , as appropriate . the lead authority as defined in article 54a shall invite the supervisory authority of each of those member states to take part in the respective joint investigative tasks or joint operations and respond to the request of a supervisory authority to participate in the operations without delay . the lead authority shall act as the single contact point for the controller or processor .


### where the commission has taken no decision pursuant to article 41 , a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has adduced appropriate safeguards with respect to the protection of personal data in a legally binding instrument . ### where the commission has taken no decision pursuant to article 41 , a controller or processor may not transfer personal data to a third country , territory or an international organisation unless the controller or processor has adduced appropriate safeguards with respect to the protection of personal data in a legally binding instrument .


### any body , organisation or association which aims to protect data subjects’ rights and interests concerning the protection of their personal data and has been properly constituted according to the law of a member state shall have the right to lodge a complaint with a supervisory authority in any member state on behalf of one or more data subjects if it considers that a data subject’s rights under this regulation have been infringed as a result of the processing of personal data . ### any body , organisation or association acting in the public interest which has been properly constituted according to the law of a member state shall have the right to lodge a complaint with a supervisory authority in any member state on behalf of one or more data subjects if it considers that a data subject’s rights under this regulation have been infringed as a result of the processing of personal data .


### the rule of law , relevant legislation in force , both general and sectoral , including concerning public security , defence , national security and criminal law , the professional rules and security measures which are complied with in that country or by that international organisation , as well as effective and enforceable rights including effective administrative and judicial redress for data subjects , in particular for those data subjects residing in the union whose personal data are being transferred ; ### the rule of law , relevant legislation in force , including concerning public security , defence , national security and criminal law , the professional rules and security measures which are complied with in that country or by that international organisation , as well as effective and enforceable rights including effective administrative and judicial redress for data subjects , in particular for those data subjects residing in the union whose personal data are being transferred ;


### the general principles on the protection of individuals with regard to the processing of personal data should also be applicable to the employment context . therefore , in order to regulate the processing of employees ' personal data in the employment context , member states should be able , within the limits of this regulation , to adopt by law specific rules for the processing of personal data in the employment sector . ### the general principles on the protection of individuals with regard to the processing of personal data should also be applicable to the employment and the social security context . therefore , in order to regulate the processing of employees ' personal data in the employment context , member states should be able , in accordance with this regulation , to adopt by law specific rules for the processing of personal data in the employment sector .


### algeria , andorra , antigua and barbuda , argentina , aruba , bahamas , bahrain , bangladesh , barbados , belize , benin , bhutan , bolivia , botswana , brazil , british virgin islands , brunei , cameroon , cape verde , chile , china , comoros islands , costa rica , djibouti , dominica , dominican republic , ecuador , egypt , el salvador , equatorial guinea , falkland islands , faroe islands , fiji , french guyana , french ot , gabon , gambia , gibraltar , greenland , grenada , guadeloupe , guam , guatemala , ghana , guinea bissau , guyana , honduras , hong kong special administrative region , iceland , india , indonesia , israel , jordan , kuwait , lesotho , liechtenstein , macau , madagascar , malawi , malaysia , maldives , mali , martinique , mauritius , mexico , monaco , montserrat , morocco , namibia , netherlands antilles , new caledonia , nicaragua , niger , nigeria , oman , panama , papua new guinea , peru , philippines , puerto rico , qatar , russia , samoa , san marino , sao tome e principe , saudi arabia , senegal , seychelles , singapore , solomon islands , south africa , south korea , sri lanka , st . helena , st . kitts and nevis , st . vincent , surinam , swaziland , taiwan , thailand , togo , trinidad and tobago , tunisia , turkey , turks and caicos islands , united arab emirates , uruguay , us virgin islands , vanuatu , venezuela . ### argentina , bosnia and herzegovina , brazil , chile , china , croatia , french overseas territories , hong kong special administrative region , iceland , kazakhstan , macedonia , macau , mexico , montenegro , morocco , russia , serbia , south africa , south korea , tunisia , turkey , ukraine , united arab emirates .


### algeria , andorra , antigua and barbuda , argentina , aruba , bahamas , bahrain , barbados , belize , benin , bhutan , bolivia , botswana , brazil , british virgin islands , brunei , cameroon , cape verde , chile , comoros islands , costa rica , croatia , djibouti , dominica , dominican republic , ecuador , egypt , el salvador , equatorial guinea , falkland islands , faroe islands , fiji , french guyana , french ot , gabon , gambia , gibraltar , greenland , grenada , guadeloupe , guam , guatemala , ghana , guinea bissau , guyana , honduras , hong kong sar , iceland , india , jordan , kuwait , lesotho , liechtenstein , madagascar , malawi , malaysia , maldives , mali , martinique , mauritius , mexico , moldova , monaco , mongolia , montserrat , morocco , namibia , netherlands antilles , new caledonia , nicaragua , niger , oman , panama , papua new guinea , peru , philippines , puerto rico , qatar , russia , samoa , san marino , sao tome e principe , saudi arabia , senegal , seychelles , singapore , solomon islands , south africa , south korea , st . helena , st . kitts and nevis , st . vincent , surinam , swaziland , togo , trinidad and tobago , tunisia , turkey , turks and caicos islands , uae , ukraine , uruguay , us virgin islands , vanuatu . ### argentina , bosnia and herzegovina , brazil , chile , china , croatia , hong kong sar , iceland , kazakhstan , french overseas territories , macedonia , macau , mexico , montenegro , morocco , russia , serbia , singapore , south africa , south korea , tunisia , turkey , ukraine , united arab emirates .


### for an essentially identical transaction where the initial authorisation has been revoked . ### when the initial authorisation has been annulled , suspended , modified or revoked .


### directive 2005 / 36 / ec already provides for clear obligations for professionals to have the necessary language skills . the review of that obligation has shown a need to clarify the role of competent authorities and employers notably in the interest of patients ' safety . language controls should however be reasonable and necessary for the jobs in question and should not constitute grounds for excluding professionals from the labour market in the host member state . ### directive 2005 / 36 / ec already provides for obligations for professionals to have the necessary language skills . the review of that obligation has shown a need to define these language requirements more precisely and to clarify the role of competent authorities and employers notably in the interest of patients ' safety . while language controls should not constitute grounds for refusal to recognise a professional qualification , in the case of occupations which have implications for patients , for example patient safety and treatment and the provision of services and information to patients , it is essential to test language knowledge before authorising a person to practise . knowledge of the official language of the language area where the professional wishes to work is a conditio sine qua non here . level c1 of the european framework of reference for languages should be taken as a minimum standard for this purpose . minimum standard for this purpose .


### any language control shall be limited to the knowledge of one of the official languages of the member state according to the choice of the person concerned , it shall be proportionate to the activity to be pursued and free of charge for the professional . the person concerned shall be allowed to appeal such controls before national courts . ' . ### any test of language knowledge shall test knowledge of the official language of the language area where the professional wishes to work , taking level c1 of the european framework of reference for languages as a minimum standard . the language test shall be free of charge to the professional .


### in case of professions with patient safety implications , member states may confer to the competent authorities the right to carry out language checking covering all professionals concerned if it is expressly requested by the national health care system , or in case of self - employed professionals not affiliated to the nationals health care system , by representative national patient organisations . ### in the case of professions with patient safety implications , member states shall confer on the competent authorities the right to carry out language checking of the professionals concerned .


### in case of professions with patient safety implications , member states may confer to the competent authorities the right to carry out language checking covering all professionals concerned if it is expressly requested by the national health care system , or in case of self - employed professionals not affiliated to the nationals health care system , by representative national patient organisations . ### in the case of professions with implications for patients , including for patient safety , and in the case of treatment of and the provision of services and information to patients , the language knowledge required in order to practise the profession of the language area where the professional wishes to work , in accordance with the institutional organisation of the receiving member state ) must be tested or supervised by the competent authorities for all professionals concerned . language checking must be separate from the recognition of professional qualifications , but must be carried out prior to admission to the profession . level c1 of the european framework of reference for languages shall be taken as a minimum standard for this purpose .


### basic medical training shall comprise a total of at least five years of study , which may also be expressed with the equivalent ects credits , and shall consist of at least 5500 hours of theoretical and practical training provided by , or under the supervision of , a university . ### basic medical training shall comprise a total of at least six years of study , and shall consist of at least 5500 hours of actual theoretical training at a university and practical training provided by a university or under the supervision of a university at a non - university hospital . at least 5500 hours of actual training shall not include any components such as private study , examinations or writing of a thesis .


### having the freedom to provide and to receive collective management services across national borders entails that rightholders are able to freely choose the collecting society for the management of their rights , such as public performance or broadcasting rights , or categories of rights , such as interactive communication to the public , provided the collecting society already manages such rights or categories of rights . this implies that rightholders can easily withdraw their rights or categories of rights from a collecting society and entrust or transfer all or part of them to another collecting society or another entity irrespective of the member state of residence or the nationality of either the collecting society or the rightholder . collecting societies managing different types of works and other subject matter , such as literary , musical or photographic works , should also allow this flexibility to rightholders as regards the management of different types of works and other subject matter . collecting societies should inform rightholders of this choice and allow them to exercise it as easily as possible . finally , this directive should not prejudice the possibilities of rightholders to manage their rights individually , including for non - commercial uses . ### having the freedom to provide and to receive services for collective management of copyright , related rights and other subject matter across national borders entails that rightholders are able to freely choose the collective management organisation for the management of their rights , such as public performance or broadcasting rights , or categories of rights , such as interactive communication to the public , provided the collective management organisation already manages such rights or categories of rights . this implies that rightholders can easily withdraw their rights or categories of rights from a collective management organisation and entrust or transfer all or part of them to another collective management organisation or another entity irrespective of the member state of residence or the nationality of either the collective management organisation or the rightholder . collective management organisations managing different types of works and other subject matter , such as literary , musical or photographic works , should also allow this flexibility to rightholders as regards the management of different types of works and other subject matter . collective management organisations should inform rightholders of this choice and allow them to exercise it as easily as possible . finally , this directive should not prejudice the possibilities of rightholders to manage their rights individually , including for non - commercial uses .


### in addition , a collecting society shall make available at the request of any rightholder or any collecting society , any information on works for which one or more rightholders have not been identified including , where available , the title of the work , the name of the author , the name of the publisher and any other relevant information available which could be necessary to identify the rightholders . ### in addition , a collective management organisation shall make publicly available any information on works for which one or more rightholders have not been identified including , where available , the title of the work , the name of the author , the name of the publisher and any other relevant information available which could be necessary to identify the rightholders . the rightholders shall have the right to ask their collective management organisation that their personal data and sensitive information remain confidential .


### member states shall ensure that the collecting society regularly and diligently distributes and pays amounts due to all rightholders it represents . the collecting society shall carry out such distribution and payments no later than 12 months from the end of the financial year in which the rights revenue was collected , unless objective reasons related in particular to reporting by users , the identification of rights , rightholders or to the matching of information on works and other subject matter with rightholders prevent the collecting society from respecting this deadline . the collecting society shall carry out such distribution and payments accurately , ensuring equal treatment of all categories of rightholders . ### member states shall ensure that the collective management organisation regularly and diligently distributes and pays amounts due to all rightholders it represents . the collective management organisation shall carry out such distribution and payments without undue delay as soon as the amount for a rightholder covers the collection costs and maintenance for the corresponding rights and administrative costs , after a period of three months and no later than six months from the collection of the relevant right revenues . the collective management organisation shall carry out such distribution and payments accurately , ensuring equal treatment of all categories of rightholders .


### information provided to rightholders , members , other collecting societies and users on request ### information provided to rightholders , members , other collective management organisations and users


### where the amounts due to rightholders cannot be distributed , after five years from the end of the financial year in which the collection of the rights revenue occurred , and provided that the collecting society has taken all necessary measures to identify and locate the rightholders , the collecting society shall decide on the use of the amounts concerned in accordance with article 7 , without prejudice to the right of the rightholder to claim such amounts from the collecting society . ### where the amounts due to rightholders cannot be distributed after three years from the end of the financial year in which the collection of the rights revenue occurred , and provided that the collecting society has taken all necessary measures to identify and locate the rightholders , and without prejudice to the right of the rightholder to claim such amounts from the collective management organisation , the amounts collected shall either be redistributed by the collective management organisation to its members , or attributed to cultural and social funds targeting artists and the promotion of young artists under the control of member states or under the control of members of collective management organisations making decision at the general meeting in accordance with article 7 .


### rightholders shall have the right to authorise a collecting society of their choice to manage the rights , categories of rights or types of works and other subject matter of their choice , for the member states of their choice , irrespective of the member state of residence or of establishment or the nationality of either the collecting society or the rightholder . ### rightholders shall have the right to authorise a collective management organisation of their choice to manage the rights , categories of rights , works or types of works and other subject matter of their choice , for the member states of their choice , irrespective of the member state of residence or of establishment or the nationality of either the collective management organisation or the rightholder .


### broadcasting organisations generally rely on a licence from a local collecting society , for their own broadcasts of television and radio programmes which include musical works . this licence is often limited to broadcasting activities . a licence for online rights in musical works would be required in order to allow such television or radio broadcasts to be also available online . to facilitate the licensing of online music rights for the purposes of simultaneous and delayed transmission online of television and radio broadcasts , it is necessary to provide for a derogation from the rules that would otherwise apply to the multi - territorial licensing of musical works for online uses . such derogation should be limited to what is necessary to allow access to television or radio programmes online and to material having a clear and subordinate relationship to the original broadcast produced for purposes such as supplementing , previewing or reviewing that television or radio programme . that derogation should not operate so as to distort competition with other services which give consumers access to individual musical or audiovisual works online , or lead to restrictive practices , such as market or customer sharing , in breach of articles 101 or 102 of the treaty on the functioning of the european union . ### broadcasting organisations generally rely on a licence from a local collective management organisation for their own broadcasts of television and radio programmes which include musical works . a licence for online rights in musical works would be required in order to allow such television or radio programmes to be also available online . to facilitate the licensing of online music rights for the purposes of making available online of television and radio programmes , it is necessary to clarify that the multi - territorial licensing of musical works does not apply to such online use by broadcasters . such clarification should allow collective management organisations to continue to grant ‘ blanket licences’ for the world repertoire to broadcasters for the music use in both their offline and online services in accordance with the national law of the member state concerned and thereby enhance citizens ' access to television or radio programmes online and to material supplementing , previewing or reviewing that television or radio programme . such blankets licences should not operate so as to distort competition with other services which give consumers access to individual musical or audiovisual works online , or lead to restrictive practices , such as market or customer sharing , in breach of articles 101 or 102 of the treaty on the functioning of the european union .


### members should be allowed to take part in monitoring the management of collecting societies . to this end , collecting societies should establish a supervisory function appropriate to their organisational structure and allow members to be represented in the body that exercises this function . to avoid imposing excessive burden on smaller collecting societies and to make the obligations arising from this directive proportionate , member states should be able to , if they consider this to be necessary , exclude the smallest collecting societies from having to organise such a supervisory function . ### members should be allowed to take part in monitoring the management of collective management organisations . to this end , collective management organisations should establish a supervisory function appropriate to their organisational structure and allow the different categories of members to be represented in the body that exercises this function .


### the dissemination of content which is protected by copyright and related rights and the linked services , including books , audiovisual productions and recorded music require the licensing of rights by different holders of copyright and related rights , such as authors , performers , producers and publishers . it is normally for the rightholders to choose between the individual or collective management of their rights . management of copyright and related rights includes the granting of licences to users , the auditing of licensees and monitoring of the use of rights , the enforcement of copyright and related rights , the collection of rights revenue derived from the exploitation of rights and the distribution of the amounts due to rightholders . collecting societies enable rightholders to be remunerated for uses which they would not be in a position to control or enforce themselves , including in non - domestic markets . moreover , they have an important social and cultural role as promoters of the diversity of cultural expressions by enabling the smallest and less popular repertoires to access the market . article 167 of the treaty on the functioning of the european union requires the union to take cultural aspects into account in its action , in particular in order to respect and to promote the diversity of its cultures . ### the dissemination of content which is protected by copyright and related rights and the linked services , including books , audiovisual productions and recorded music require the licensing of rights by different holders of copyright and related rights , such as authors , performers , producers and publishers . it is normally for the rightholders to choose between the individual or collective management of their rights . management of copyright and related rights includes the granting of licences to users , the auditing of licensees and monitoring of the use of rights , the enforcement of copyright and related rights , the collection of rights revenue derived from the exploitation of rights and the distribution of the amounts due to rightholders . collective management organisations enable rightholders to be remunerated for uses which they would not be in a position to control or enforce themselves , including in non - domestic markets . due account should be taken of their functions as trustees and their particular responsibility for cultural and social aspects and society as such . moreover , they have an important social and cultural role as promoters of the diversity of cultural expressions by enabling the smallest and less popular repertoires to access the market . article 167 of the treaty on the functioning of the european union requires the union to take cultural aspects into account in its action , in particular in order to respect and to promote the diversity of its cultures . in doing so , collective management organisations contribute significantly to the development of the cultural and artistic scene in europe as well as to the growth of cultural and creative industries .


### there are significant differences in the national rules governing the functioning of collecting societies , in particular as regards their transparency and accountability towards their members and rightholders . beyond the difficulties non - domestic rightholders face when exercising their rights and the too often poor financial management of the revenues collected , problems with the functioning of collecting societies lead to inefficiencies in the exploitation of copyright and related rights across the internal market to the detriment of the members of collecting societies , rightholders and users alike . these difficulties do not arise in the functioning of independent rights management service providers who act as agents for rightholders for the management of their rights on a commercial basis and in which rightholders do not exercise membership rights . ### there are significant differences in the national rules governing the functioning of collective management organisations due to historical , legal , economic and , above all , cultural diversity among member states , in particular as regards their transparency and accountability towards their members and rightholders . beyond the difficulties non - domestic rightholders face when exercising their rights and considering revenues collected may have been often poorly managed , problems with the functioning of collective management organisations lead to inefficiencies in the exploitation of copyright and related rights across the internal market to the detriment of the members of collective management organisations , rightholders and users alike .


### ‘ rights revenue’ means income collected by a collecting society on behalf of rightholders , whether from an exclusive right , a right to remuneration or a right to compensation ; ### ‘ rights revenue’ means income collected by a collective management organisation on behalf of rightholders , whether from an exclusive right , a right to remuneration or a right to compensation as well as any financial revenue , such as interest payments of amounts collected by a collective management organisation on behalf of rightholders ;


### member states shall ensure that the collecting society establishes a supervisory function responsible for continuously monitoring the activities and the performance of the duties of the persons entrusted with managerial responsibilities in the collecting society . there shall be fair and balanced representation of the members of the collecting society in the body exercising this function in order to ensure their effective participation . ### member states shall ensure that the collective management organisation establishes a supervisory function responsible for continuously monitoring the activities and the performance of the duties of the persons entrusted with managerial responsibilities in that organisation . there shall be fair and balanced representation of the different categories of members of the collective management organisation in the body exercising this function in order to ensure their effective participation .


### ' collecting society ' means any organisation which is authorised by law or by way of assignment , licence or any other contractual arrangement , by more than one rightholder , to manage copyright or rights related to copyright as its sole or main purpose and which is owned or controlled by its members ; ### ' collective management organisation ' means any organisation which is authorised by law or by way of assignment , licence or any other contractual arrangement by more than one rightholder , to manage copyright or rights related to copyright as its sole or main purpose and which is owned or controlled by its members ;


### member states shall ensure that the persons who effectively manage the business of a collecting society and its directors , with the exception of the directors exercising supervisory function , design procedures so as to avoid conflicts of interest . the collecting society shall have procedures to identify , manage , monitor and disclose conflicts of interest in order to prevent them from adversely affecting the interests of members of the society . ### member states shall ensure that the persons who effectively manage the business of a collective management organisation and its directors , with the exception of the directors exercising supervisory function , design procedures so as to avoid conflicts of interest . the collective management organisation shall have procedures to identify , manage , monitor and disclose conflicts of interest in order to prevent them from adversely affecting the interests of members of the organisation . such procedures shall also require that before taking up their duties and then once a year such persons and directors , make an individual statement on conflict of interests to the body entrusted with the supervisory function and to the members of the organisation , as well as make such a statement publicly accessible through the website of the collective management organisation .


### rightholders shall have the right to terminate the authorisation to manage rights , categories of rights or types of works and other subject matter granted to a collecting society or to withdraw from a collecting society any of the rights or categories of rights or types of works and other subject matter of their choice , for the member states of their choice , upon serving reasonable notice not exceeding six months . the collecting society may decide that such termination or withdrawal will take effect only at the middle and at the end of the financial year , whichever is sooner after the expiry of the notice period . ### rightholders shall have the right to terminate the authorisation to manage rights , categories of rights , works or types of works and other subject matter granted to a collective management organisation or to withdraw from a collective management organisation any of the rights or categories of rights , works or types of works and other subject matter of their choice , at any time during the term of the authorisation , for the member states of their choice , upon serving reasonable notice not exceeding six months . the collective management organisation shall have the right to decide if such termination or withdrawal will take effect only at the middle or at the end of the financial year , whichever is sooner after the expiry of the notice period .


### the amounts due to the rightholder per category of rights managed , and type of use , paid by the collecting society to the rightholder in the period concerned ; ### the amounts due to the rightholder per category of rights managed , per type of use , and per work paid by the collective management organisation to the rightholder in the period concerned ;


### members of collecting societies should be allowed to participate and vote in the general meeting ; the exercise of these rights may only be subject to fair and proportionate restrictions . the exercise of voting rights should be made easy . ### all members of collective management organisations should be allowed to participate and vote in the general meeting . the exercise of voting rights should be made easy , and whenever possible by electronic means .


### having the freedom to provide and to receive collective management services across national borders entails that rightholders are able to freely choose the collecting society for the management of their rights , such as public performance or broadcasting rights , or categories of rights , such as interactive communication to the public , provided the collecting society already manages such rights or categories of rights . this implies that rightholders can easily withdraw their rights or categories of rights from a collecting society and entrust or transfer all or part of them to another collecting society or another entity irrespective of the member state of residence or the nationality of either the collecting society or the rightholder . collecting societies managing different types of works and other subject matter , such as literary , musical or photographic works , should also allow this flexibility to rightholders as regards the management of different types of works and other subject matter . collecting societies should inform rightholders of this choice and allow them to exercise it as easily as possible . finally , this directive should not prejudice the possibilities of rightholders to manage their rights individually , including for non - commercial uses . ### having the freedom to provide and to receive services for collective management of copyright , related rights and other subject matter across national borders entails that rightholders are able to freely choose the collective management organisation for the management of their rights , such as public performance or broadcasting rights , or categories of rights , such as interactive communication to the public , provided the collective management organisation already manages such rights or categories of rights . this implies that rightholders can easily withdraw their rights or categories of rights from a collective management organisation and entrust or transfer all or part of them to another collective management organisation or another entity irrespective of the member state of residence or the nationality of either the collective management organisation or the rightholder . collective management organisations managing different types of works and other subject matter , such as literary , musical or photographic works , should also allow this flexibility to rightholders as regards the management of different types of works and other subject matter . collective management organisations should inform rightholders of this choice and allow them to exercise it as easily as possible . finally , this directive should not prejudice the possibilities of rightholders to manage their rights individually , including for non - commercial uses .


### having the freedom to provide and to receive collective management services across national borders entails that rightholders are able to freely choose the collecting society for the management of their rights , such as public performance or broadcasting rights , or categories of rights , such as interactive communication to the public , provided the collecting society already manages such rights or categories of rights . this implies that rightholders can easily withdraw their rights or categories of rights from a collecting society and entrust or transfer all or part of them to another collecting society or another entity irrespective of the member state of residence or the nationality of either the collecting society or the rightholder . collecting societies managing different types of works and other subject matter , such as literary , musical or photographic works , should also allow this flexibility to rightholders as regards the management of different types of works and other subject matter . collecting societies should inform rightholders of this choice and allow them to exercise it as easily as possible . finally , this directive should not prejudice the possibilities of rightholders to manage their rights individually , including for non - commercial uses . ### having the freedom to provide and to receive services for collective management of copyright , related rights and other subject matter across national borders entails that rightholders are able to freely choose the collective management organisation for the management of their rights , such as public performance or broadcasting rights , or categories of rights , such as interactive communication to the public , provided the collective management organisation already manages such rights or categories of rights . this implies that rightholders can easily withdraw their rights or categories of rights from a collective management organisation and entrust or transfer all or part of them to another collective management organisation or another entity irrespective of the member state of residence or the nationality of either the collective management organisation or the rightholder . collective management organisations managing different types of works and other subject matter , such as literary , musical or photographic works , should also allow this flexibility to rightholders as regards the management of different types of works and other subject matter . collective management organisations should inform rightholders of this choice and allow them to exercise it as easily as possible . finally , this directive should not prejudice the possibilities of rightholders to manage their rights for non - commercial uses . the difference between ‘ non - commercial’ and ‘ commercial’ should be defined as follows : if content , protected by authors ' rights , is being offered directly on an internet site , which acquires revenues to a non - negligible degree through donations , for example via membership contributions , through payments by clients or via advertisement through links to other homepages , such an activity shall be considered to be commercial .


### the repertoire and rights it manages and the member states covered ; ### the list of its members , the repertoire and the specific rights it manages on their behalf , and the member states covered , without revealing personal data and sensitive information about the rightholders ;


### member states shall ensure that collecting societies act in the best interest of their members and do not impose on rightholders whose rights they manage any obligations which are not objectively necessary for the protection of the rights and interests of these rightholders . ### member states shall ensure that collective management organisations act in the best interest of the rightholders whose rights they manage and do not impose on them any obligations which could undermine the protection of their rights and their interests .


### member states shall ensure that the collecting society regularly and diligently distributes and pays amounts due to all rightholders it represents . the collecting society shall carry out such distribution and payments no later than 12 months from the end of the financial year in which the rights revenue was collected , unless objective reasons related in particular to reporting by users , the identification of rights , rightholders or to the matching of information on works and other subject matter with rightholders prevent the collecting society from respecting this deadline . the collecting society shall carry out such distribution and payments accurately , ensuring equal treatment of all categories of rightholders . ### member states shall ensure that the collective management organisation regularly and diligently distributes and pays amounts due to all rightholders it represents . the collective management organisation shall carry out such distribution and payments without undue delay as soon as the amount for a rightholder covers the collection costs and maintenance for the corresponding rights and administrative costs , after a period of three months and no later than six months from the collection of the relevant right revenues . the collective management organisation shall carry out such distribution and payments accurately , ensuring equal treatment of all categories of rightholders .


### title iii and articles 36 and 40 of title iv shall only apply to those collecting societies managing authors ' rights in musical works for online use on a multi - territorial basis . ### title iii and articles 36 and 40 of title iv shall only apply to those collective management organisations and other rights management entities managing authors ' rights in musical works for online use on a multi - territorial basis .


### for reasons of sound management , a collecting society ' s senior management must be independent . managers and executive directors should be required to declare annually to the collecting society whether there are conflicts between their interests and those of the society . ### for reasons of sound management , a collective management organisation ' s management must be independent . managers and executive directors should be required to declare before taking up their duties in a collective management organisation whether there are conflicts between their interests and those of the organisation . moreover , they should also be required to make such declarations of conflict of interest every year after taking up their duties in a collective management organisation .


### members should be allowed to take part in monitoring the management of collecting societies . to this end , collecting societies should establish a supervisory function appropriate to their organisational structure and allow members to be represented in the body that exercises this function . to avoid imposing excessive burden on smaller collecting societies and to make the obligations arising from this directive proportionate , member states should be able to , if they consider this to be necessary , exclude the smallest collecting societies from having to organise such a supervisory function . ### members should be allowed to take part in monitoring the management of collective management organisations . to this end , collective management organisations should establish a supervisory function appropriate to their organisational structure and allow the different categories of members to be represented in the body that exercises this function .


### the management fee for the service provided by the requested collecting society to the requesting society shall not exceed the costs reasonably incurred by the requested collecting society in managing the repertoire of the requesting collecting society and a reasonable profit margin . ### the management fee for the service provided by the requested collective management organisation to the requesting organisation shall not exceed the costs reasonably incurred by the requested collective management organisation in managing the repertoire of the requesting collective management organisation and a reasonable profit margin economically viable for all parties involved .


### any restriction on the right of the members of the collecting society to participate and to exercise voting rights at the general meeting shall be fair and proportionate and be based on the following criteria : ### every member of a collective management organisation shall have the right to vote at the general meeting , including by electronic vote . any restriction on the right of a member of the collective management organisation to participate and to exercise its voting rights at the general meeting shall be fair and proportionate and be based on the following criteria :


### broadcasting organisations generally rely on a licence from a local collecting society , for their own broadcasts of television and radio programmes which include musical works . this licence is often limited to broadcasting activities . a licence for online rights in musical works would be required in order to allow such television or radio broadcasts to be also available online . to facilitate the licensing of online music rights for the purposes of simultaneous and delayed transmission online of television and radio broadcasts , it is necessary to provide for a derogation from the rules that would otherwise apply to the multi - territorial licensing of musical works for online uses . such derogation should be limited to what is necessary to allow access to television or radio programmes online and to material having a clear and subordinate relationship to the original broadcast produced for purposes such as supplementing , previewing or reviewing that television or radio programme . that derogation should not operate so as to distort competition with other services which give consumers access to individual musical or audiovisual works online , or lead to restrictive practices , such as market or customer sharing , in breach of articles 101 or 102 of the treaty on the functioning of the european union . ### broadcasting organisations generally rely on a licence from a local collective management organisation for their own broadcasts of television and radio programmes which include musical works . a licence for online rights in musical works would be required in order to allow such television or radio programmes to be also available online . to facilitate the licensing of online music rights for the purposes of making available online of television and radio programmes , it is necessary to clarify that the multi - territorial licensing of musical works does not apply to such online use by broadcasters . such clarification should allow collective management organisations to continue to grant ‘ blanket licences’ for the world repertoire to broadcasters for the music use in both their offline and online services in accordance with the national law of the member state concerned and thereby enhance citizens ' access to television or radio programmes online and to material supplementing , previewing or reviewing that television or radio programme . such blankets licences should not operate so as to distort competition with other services which give consumers access to individual musical or audiovisual works online , or lead to restrictive practices , such as market or customer sharing , in breach of articles 101 or 102 of the treaty on the functioning of the european union .


### member states shall ensure that the rightholder gives express consent specifically for each right or category of rights or type of works and other subject matter which that rightholder authorises the collecting society to manage and that any such consent is evidenced in documentary form . ### member states shall ensure that the rightholder gives express consent specifically for each right or category of rights , works or type of works and other subject matter which that rightholder authorises the collective management organisation to manage and that any such consent is evidenced in documentary form .


### in addition , a collecting society shall make available at the request of any rightholder or any collecting society , any information on works for which one or more rightholders have not been identified including , where available , the title of the work , the name of the author , the name of the publisher and any other relevant information available which could be necessary to identify the rightholders . ### in addition , a collective management organisation shall make publicly available any information on works for which one or more rightholders have not been identified including , where available , the title of the work , the name of the author , the name of the publisher and any other relevant information available which could be necessary to identify the rightholders . the rightholders shall have the right to ask their collective management organisation that their personal data and sensitive information remain confidential .


### the amounts due to rightholders per category of rights managed , and per type of use paid by the collecting society for the licensing of the rights it manages under the representation agreement ; ### the amounts due to rightholders per category of rights managed , per type of use and per work paid by the collective management organisation for the licensing of the rights it manages under the representation agreement ;


### commission recommendation 2005 / 737 / ec promoted a new regulatory environment better suited to the management , at union level , of copyright and related rights for the provision of legitimate online music services . it recognised that in an era of online exploitation of musical works , commercial users need a licensing policy that corresponds to the ubiquity of the online environment and which is multi - territorial . however , the recommendation , due to its voluntary nature , has not been sufficient to encourage the widespread multi - territorial licensing of online rights in musical works and to address the specific demands of multi - territorial licensing . ### commission recommendation 2005 / 737 / ec promoted a new regulatory environment better suited to the management , at union level , of copyright and related rights for the provision of legitimate online music services . it recognised that in an era of online exploitation of musical works , commercial users need a licensing policy that corresponds to the ubiquity of the online environment and which is multi - territorial . however , the recommendation has not been sufficient to encourage the widespread multi - territorial licensing of online rights in musical works and to address the specific demands of multi - territorial licensing .