### when using online services , individuals may be associated with online identifiers provided by their devices , applications , tools and protocols , such as internet protocol addresses or cookie identifiers . this may leave traces which , combined with unique identifiers and other information received by the servers , may be used to create profiles of the individuals and identify them . it follows that identification numbers , location data , online identifiers or other specific factors as such need not necessarily be considered as personal data in all circumstances . ### when using online services , individuals may be associated with one or more online identifiers provided by their devices , applications , tools and protocols , such as internet protocol addresses , cookie identifiers and other unique identifiers . since such identifiers leave traces and can be used to single out natural persons , this regulation should be applicable to processing involving such data , unless those identifiers demonstrably do no relate to natural persons , such as for example the ip addresses used by companies , which cannot be considered as ' personal data ' as defined in this regulation .


### where processing is based on the data subject ' s consent , the controller should have the burden of proving that the data subject has given the consent to the processing operation . in particular in the context of a written declaration on another matter , safeguards should ensure that the data subject is aware that and to what extent consent is given . ### where processing is based on the data subject’s consent , the controller should have the burden of proving that the data subject has given the consent to the processing operation . in particular in the context of a written declaration on another matter , safeguards should ensure that the data subject is aware that and to what extent consent is given . to comply with the principle of data minimisation , the burden of proof should not be understood as requiring the positive identification of data subjects unless necessary .


### where processing is carried out in compliance with a legal obligation to which the controller is subject or where processing is necessary for the performance of a task carried out in the public interest or in the exercise of an official authority , the processing should have a legal basis in union law , or in a member state law which meets the requirements of the charter of fundamental rights of the european union for any limitation of the rights and freedoms . it is also for union or national law to determine whether the controller performing a task carried out in the public interest or in the exercise of official authority should be a public administration or another natural or legal person governed by public law , or by private law such as a professional association . ### where processing is carried out in compliance with a legal obligation to which the controller is subject or in the exercise of an official authority , the processing should have a legal basis in union law , or in a member state law which meets the requirements of the charter of fundamental rights of the european union for any limitation of the rights and freedoms . it is also for union or national law to determine whether the controller performing a task carried out in the exercise of official authority should be a public administration or another natural or legal person governed by public law , or by private law such as a professional association .


### the legitimate interests of a controller may provide a legal basis for processing , provided that the interests or the fundamental rights and freedoms of the data subject are not overriding . this would need careful assessment in particular where the data subject is a child , given that children deserve specific protection . the data subject should have the right to object the processing , on grounds relating to their particular situation and free of charge . to ensure transparency , the controller should be obliged to explicitly inform the data subject on the legitimate interests pursued and on the right to object , and also be obliged to document these legitimate interests . given that it is for the legislator to provide by law the legal basis for public authorities to process data , this legal ground should not apply for the processing by public authorities in the performance of their tasks . ### in exceptional circumstances , the legitimate interests of a controller may provide a legal basis for processing , provided that the interests or the fundamental rights and freedoms of the data subject are not overriding . this would need careful assessment in particular where the data subject is a child , given that children deserve specific protection . the data subject should have the right to object the processing free of charge . to ensure transparency , the controller should be obliged to explicitly inform the data subject on the legitimate interests pursued and on the right to object , and also be obliged to document these legitimate interests . given that it is for the legislator to provide by law the legal basis for public authorities to process data , this legal ground should not apply for the processing by public authorities in the performance of their tasks .


### the processing of data to the extent strictly necessary for the purposes of ensuring network and information security , i . e . the ability of a network or an information system to resist , at a given level of confidence , accidental events or unlawful or malicious actions that compromise the availability , authenticity , integrity and confidentiality of stored or transmitted data , and the security of the related services offered by , or accessible via , these networks and systems , by public authorities , computer emergency response teams – certs , computer security incident response teams – csirts , providers of electronic communications networks and services and by providers of security technologies and services , constitutes a legitimate interest of the concerned data controller . this could , for example , include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘ denial of service’ attacks and damage to computer and electronic communication systems . ### the processing of data to the extent strictly necessary for the purposes of ensuring network and information security , i . e . the ability of a network or an information system to resist accidental events or malicious actions that compromise the availability , authenticity , integrity and confidentiality of stored or transmitted data , and the security of the related services offered by these networks and systems , by public authorities , computer emergency response teams – certs , computer security incident response teams – csirts , providers of electronic communications networks and services and by providers of security technologies and services , in specific incidents , constitutes a legitimate interest of the concerned data controller . this could , for example , include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘ denial of service’ attacks and damage to computer and electronic communication systems . the processing of personal data to restrict abusive access to and use of publicly available network or information systems , such as the blacklisting of media access control addresses or electronic mail addresses by the operator of the system , also constitutes a legitimate interest .


### derogating from the prohibition on processing sensitive categories of data should also be allowed if done by a law , and subject to suitable safeguards , so as to protect personal data and other fundamental rights , where grounds of public interest so justify and in particular for health purposes , including public health and social protection and the management of health - care services , especially in order to ensure the quality and cost - effectiveness of the procedures used for settling claims for benefits and services in the health insurance system , or for historical , statistical and scientific research purposes . ### derogating from the prohibition on processing sensitive categories of data should also be allowed if done by a law , and subject to suitable safeguards , so as to protect personal data and other fundamental rights , where grounds of public interest so justify and in particular for health purposes , including public health and social protection and the management of health - care services , especially in order to ensure the quality and cost - effectiveness of the procedures used for settling claims for benefits and services in the health insurance system .


### if the data processed by a controller do not permit the controller to identify a natural person , the data controller should not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this regulation . in case of a request for access , the controller should be entitled to ask the data subject for further information to enable the data controller to locate the personal data which that person seeks . ### if the data processed by a controller do not permit the controller to identify or single out a natural person , the data controller should not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this regulation . in case of a request for access , the controller should be entitled to ask the data subject for further information to enable the data controller to locate the personal data which that person seeks .


### modalities should be provided for facilitating the data subject’s exercise of their rights provided by this regulation , including mechanisms to request , free of charge , in particular access to data , rectification , erasure and to exercise the right to object . the controller should be obliged to respond to requests of the data subject within a fixed deadline and give reasons , in case he does not comply with the data subject ' s request . ### modalities should be provided for facilitating the data subject’s exercise of their rights provided by this regulation , including mechanisms to obtain free of charge , in particular access to data , rectification , erasure and to exercise the right to object . the controller should be obliged to respond to requests of the data subject within a fixed deadline and give reasons , in case he cannot comply with the data subject’s request .


### however , it is not necessary to impose this obligation where the data subject already disposes of this information , or where the recording or disclosure of the data is expressly laid down by law , or where the provision of information to the data subject proves impossible or would involve disproportionate efforts . the latter could be particularly the case where processing is for historical , statistical or scientific research purposes ; in this regard , the number of data subjects , the age of the data , and any compensatory measures adopted may be taken into consideration . ### however , it is not necessary to impose this obligation where the data subject already disposes of this information , or where the recording or disclosure of the data is expressly laid down by law , or where the provision of information to the data subject proves impossible or would involve disproportionate efforts .


### any person should have the right to have personal data concerning them rectified and a ' right to be forgotten ' where the retention of such data is not in compliance with this regulation . in particular , data subjects should have the right that their personal data are erased and no longer processed , where the data are no longer necessary in relation to the purposes for which the data are collected or otherwise processed , where data subjects have withdrawn their consent for processing or where they object to the processing of personal data concerning them or where the processing of their personal data otherwise does not comply with this regulation . this right is particularly relevant , when the data subject has given their consent as a child , when not being fully aware of the risks involved by the processing , and later wants to remove such personal data especially on the internet . however , the further retention of the data should be allowed where it is necessary for historical , statistical and scientific research purposes , for reasons of public interest in the area of public health , for exercising the right of freedom of expression , when required by law or where there is a reason to restrict the processing of the data instead of erasing them . ### any person should have the right to have personal data concerning them rectified and a ' right to erasure and to be forgotten ' where the retention of such data is not in compliance with this regulation . in particular , data subjects should have the right that their personal data are erased and no longer processed , where the data are no longer necessary in relation to the purposes for which the data are collected or otherwise processed , where data subjects have withdrawn their consent for processing or where they object to the processing of personal data concerning them or where the processing of their personal data otherwise does not comply with this regulation . however , the further retention of the data should be allowed where it is necessary for historical , statistical and scientific research purposes , for reasons of public interest in the area of public health , for exercising the right of freedom of expression , when required by law or where there is a reason to restrict the processing of the data instead of erasing them .


### to strengthen the ' right to be forgotten ' in the online environment , the right to erasure should also be extended in such a way that a controller who has made the personal data public should be obliged to inform third parties which are processing such data that a data subject requests them to erase any links to , or copies or replications of that personal data . to ensure this information , the controller should take all reasonable steps , including technical measures , in relation to data for the publication of which the controller is responsible . in relation to a third party publication of personal data , the controller should be considered responsible for the publication , where the controller has authorised the publication by the third party . ### to strengthen the ' right to erasure and to be forgotten ' in the online environment , the right to erasure should also be extended in such a way that a controller who has made the personal data public without legal justification should be obliged to take all necessary steps to have the data erased , but without prejudice to the right of the data subject to claim compensation .


### where personal data are processed for the purposes of direct marketing , the data subject should have the right to object to such processing free of charge and in a manner that can be easily and effectively invoked . ### where personal data are processed for one or more specific purposes , the data subject should have the right to object to such processing in advance , free of charge and in a manner that can be easily and effectively invoked .


### every natural person should have the right not to be subject to a measure which is based on profiling by means of automated processing . however , such measure should be allowed when expressly authorised by law , carried out in the course of entering or performance of a contract , or when the data subject has given his consent . in any case , such processing should be subject to suitable safeguards , including specific information of the data subject and the right to obtain human intervention and that such measure should not concern a child . ### every natural person should have the right not to be subject to profiling or measures based on profiling by means of automated processing . however , such measure should be allowed when expressly authorised by law , carried out in the course of entering or performance of a contract , or when the data subject has given his consent . in any case , such processing should be subject to suitable safeguards , including specific information of the data subject . such measures should not lead to discrimination , concern children , or produce legal or significant effects for the data subject without human intervention .


### restrictions on specific principles and on the rights of information , access , rectification and erasure or on the right to data portability , the right to object , measures based on profiling , as well as on the communication of a personal data breach to a data subject and on certain related obligations of the controllers may be imposed by union or member state law , as far as necessary and proportionate in a democratic society to safeguard public security , including the protection of human life especially in response to natural or man made disasters , the prevention , investigation and prosecution of criminal offences or of breaches of ethics for regulated professions , other public interests of the union or of a member state , in particular an important economic or financial interest of the union or of a member state , or the protection of the data subject or the rights and freedoms of others . those restrictions should be in compliance with requirements set out by the charter of fundamental rights of the european union and by the european convention for the protection of human rights and fundamental freedoms . ### restrictions on specific principles and on the rights of information , rectification and erasure or on the right of access and data portability , the right to object , profiling , as well as on the communication of a personal data breach to a data subject and on certain related obligations of the controllers may be imposed by union or member state law , as far as necessary and proportionate in a democratic society to safeguard public security , including the protection of human life especially in response to natural or man made disasters , the prevention , investigation and prosecution of criminal offences or of breaches of ethics for regulated professions , other public interests of the union or of a member state , in particular the protection of the data subject or the rights and freedoms of others . those restrictions should be in compliance with requirements set out by the charter of fundamental rights of the european union and by the european convention for the protection of human rights and fundamental freedoms .


### comprehensive responsibility and liability of the controller for any processing of personal data carried out by the controller or on the controller ' s behalf should be established . in particular , the controller should ensure and be obliged to demonstrate the compliance of each processing operation with this regulation . ### comprehensive responsibility and liability of the controller for any processing of personal data carried out by the controller or on the controller’s behalf should be established in order to ensure accountability . in particular , the controller should ensure and be able to demonstrate the compliance of each processing operation with this regulation .


### where a controller not established in the union is processing personal data of data subjects residing in the union whose processing activities are related to the offering of goods or services to such data subjects , or to the monitoring their behaviour , the controller should designate a representative , unless the controller is established in a third country ensuring an adequate level of protection , or the controller is a small or medium sized enterprise or a public authority or body or where the controller is only occasionally offering goods or services to such data subjects . the representative should act on behalf of the controller and may be addressed by any supervisory authority . ### where a controller not established in the union is processing personal data of data subjects residing in the union whose processing activities are related to the offering of goods or services to such data subjects , or to the monitoring of such data subjects , the controller should designate a representative , unless the controller is established in a third country ensuring an adequate level of protection , or the controller is an enterprise or a public authority or body or where the controller is only occasionally offering goods or services to such data subjects . the representative should act on behalf of the controller and may be addressed by any supervisory authority .


### in order to demonstrate compliance with this regulation , the controller or processor should document each processing operation . each controller and processor should be obliged to co - operate with the supervisory authority and make this documentation , on request , available to it , so that it might serve for monitoring those processing operations . ### in order to demonstrate compliance with this regulation , the controller or processor should document each processing operation in order to be able to provide sufficient information to the data subject . each controller and processor should be obliged to co - operate with the supervisory authority and make at least this information , on request , available to it , so that it might serve for monitoring those processing operations .


### in order to maintain security and to prevent processing in breach of this regulation , the controller or processor should evaluate the risks inherent to the processing and implement measures to mitigate those risks . these measures should ensure an appropriate level of security , taking into account the state of the art and the costs of their implementation in relation to the risks and the nature of the personal data to be protected . when establishing technical standards and organisational measures to ensure security of processing , the commission should promote technological neutrality , interoperability and innovation , and , where appropriate , cooperate with third countries . ### in order to maintain security and to prevent processing in breach of this regulation , the controller or processor should evaluate the risks inherent to the processing and implement measures to mitigate those risks . these measures should ensure an appropriate level of security , taking into account the state of the art and the costs of their implementation in relation to the risks and the nature of the personal data to be protected . when establishing technical standards and organisational measures to ensure security of processing , technological neutrality , interoperability and innovation should be promoted , and , where appropriate , third countries should be encouraged .


### where a data protection impact assessment indicates that processing operations involve a high degree of specific risks to the rights and freedoms of data subjects , such as excluding individuals from their right , or by the use of specific new technologies , the supervisory authority should be consulted , prior to the start of operations , on a risky processing which might not be in compliance with this regulation , and to make proposals to remedy such situation . such consultation should equally take place in the course of the preparation either of a measure by the national parliament or of a measure based on such legislative measure which defines the nature of the processing and lays down appropriate safeguards . ### where a data protection impact assessment indicates that processing operations involve a high degree of specific risks to the rights and freedoms of data subjects , such as excluding individuals from their right , or by the use of specific new technologies , the data protection officer or the supervisory authority should be consulted , prior to the start of operations , on a risky processing which might not be in compliance with this regulation , and to make proposals to remedy such situation . such consultation should equally take place in the course of the preparation either of a measure by the national parliament or of a measure based on such legislative measure which defines the nature of the processing and lays down appropriate safeguards .


### where the processing is carried out in the public sector or where , in the private sector , processing is carried out by a large enterprise , or where its core activities , regardless of the size of the enterprise , involve processing operations which require regular and systematic monitoring , a person should assist the controller or processor to monitor internal compliance with this regulation . such data protection officers , whether or not an employee of the controller , should be in a position to perform their duties and tasks independently . ### where the processing is carried out in the public sector or where , in the private sector , processing relates to more than 500 data subjects per year , or where its core activities , regardless of the size of the enterprise , involve processing operations which require regular and systematic monitoring , a person should assist the controller or processor to monitor internal compliance with this regulation . when establishing whether data about a large number of data subjects are processed , archived data that is restricted in such a way that they are not subject to the normal data access and processing operations of the controller and can no longer be changed should not be taken into account . such data protection officers , whether or not an employee of the controller and whether or not performing that task full time , should be in a position to perform their duties and tasks independently . the data protection officer should in particular be consulted prior to the design , procurement , development and setting - up of systems for the automated processing of personal data , in order to ensure the principles of privacy by design and privacy by default .


### associations or other bodies representing categories of controllers should be encouraged to draw up codes of conduct , within the limits of this regulation , so as to facilitate the effective application of this regulation , taking account of the specific characteristics of the processing carried out in certain sectors . ### associations or other bodies representing categories of controllers should be encouraged to draw up codes of conduct , within the limits of this regulation , so as to facilitate the effective application of this regulation , taking account of the specific characteristics of the processing carried out in certain sectors such codes should make the application of this regulation clearer for the respective business sectors .


### the commission may decide with effect for the entire union that certain third countries , or a territory or a processing sector within a third country , or an international organisation , offer an adequate level of data protection , thus providing legal certainty and uniformity throughout the union as regards the third countries or international organisations which are considered to provide such level of protection . in these cases , transfers of personal data to these countries may take place without needing to obtain any further authorisation . ### the commission may decide with effect for the entire union that certain third countries , or a territory within a third country , or an international organisation , offer an adequate level of data protection , thus providing legal certainty and uniformity throughout the union as regards the third countries or international organisations which are considered to provide such level of protection . in these cases , transfers of personal data to these countries may take place without needing to obtain any further authorisation .


### the commission may equally recognise that a third country , or a territory or a processing sector within a third country , or an international organisation offers no adequate level of data protection . consequently the transfer of personal data to that third country should be prohibited . in that case , provision should be made for consultations between the commission and such third countries or international organisations . ### the commission may equally recognise that a third country or a territory within a third country , or an international organisation offers no adequate level of data protection . consequently the transfer of personal data to that third country should be prohibited . in that case , provision should be made for consultations between the commission and such third countries or international organisations .


### in any case , where the commission has taken no decision on the adequate level of data protection in a third country , the controller or processor should make use of solutions that provide data subjects with a guarantee that they will continue to benefit from the fundamental rights and safeguards as regards processing of their data in the union once this data has been transferred . ### in any case , where the commission has taken no decision on the adequate level of data protection in a third country , the controller or processor should make use of solutions that provide data subjects with a legally binding guarantee that they will continue to benefit from the fundamental rights and safeguards as regards processing of their data in the union once this data has been transferred . that guarantee should include financial indemnification in cases of loss or unauthorised access or processing of the data and an obligation , regardless of national legislation , to provide full details of all access to the data by public authorities in the third country .


### the establishment of supervisory authorities in member states , exercising their functions with complete independence , is an essential component of the protection on individuals with regard to the processing of their personal data . member states may establish more than one supervisory authority , to reflect their constitutional , organisational and administrative structure . ### the establishment of supervisory authorities in member states , exercising their functions with complete independence , is an essential component of the protection on individuals with regard to the processing of their personal data . member states may establish more than one supervisory authority , to reflect their constitutional , organisational and administrative structure . an authority shall have adequate financial and personal resources to fully carry out its role , taking into account the size of the population and the amount of personal data processing .


### each supervisory authority should be provided with the adequate financial and human resources , premises and infrastructure , which is necessary for the effective performance of their tasks , including for the tasks related to mutual assistance and cooperation with other supervisory authorities throughout the union . ### each supervisory authority should be provided with the adequate financial and human resources , paying particular attention to ensuring adequate technical and legal skills of staff , premises and infrastructure , which are necessary for the effective performance of their tasks , including for the tasks related to mutual assistance and co - operation with other supervisory authorities throughout the union .


### the general conditions for the members of the supervisory authority should be laid down by law in each member state and should in particular provide that those members should be either appointed by the parliament or the government of the member state , and include rules on the personal qualification of the members and the position of those members . ### the general conditions for the members of the supervisory authority should be laid down by law in each member state and should in particular provide that those members should be appointed by the parliament or the government after consultation of the parliament of the member state concerned taking due care to minimise the possibility of political interference , and include rules on the personal qualification of the members , the avoidance of conflicts of interest and the position of those members .


### where the processing of personal data in the context of the activities of an establishment of a controller or a processor in the union takes place in more than one member state , one single supervisory authority should be competent for monitoring the activities of the controller or processor throughout the union , in order to increase the consistent application , provide legal certainty and reduce administrative burden for such controllers and processors . ### where the processing of personal data in the context of the activities of an establishment of a controller or a processor in the union takes place in more than one member state , one single supervisory authority should act as the single contact point for the controller or processor throughout the union and taking the related decisions , in order to increase the consistent application , provide legal certainty and reduce administrative burden for such controllers and processors .


### the competent authority , providing such one - stop shop , should be the supervisory authority of the member state in which the controller or processor has its main establishment . ### the lead authority , providing such one - stop shop , should be the supervisory authority of the member state in which the controller or processor has its main establishment . the european data protection board may designate the lead authority in certain cases on the request of a competent authority .


### for proceedings against a controller or processor , the plaintiff should have the choice to bring the action before the courts of the member states where the controller or processor has an establishment or where the data subject resides , unless the controller is a public authority acting in the exercise of its public powers . ### for proceedings against a controller or processor , the plaintiff should have the choice to bring the action before the courts of the member states where the controller or processor has an establishment or where the data subject resides , unless the controller is a public authority of a member state acting in the exercise of its public powers .


### the processing of personal data solely for journalistic purposes , or for the purposes of artistic or literary expression should qualify for exemption from the requirements of certain provisions of this regulation in order to reconcile the right to the protection of personal data with the right to freedom of expression , and notably the right to receive and impart information , as guaranteed in particular by article 11 of the charter of fundamental rights of the european union . this should apply in particular to processing of personal data in the audiovisual field and in news archives and press libraries . therefore , member states should adopt legislative measures , which should lay down exemptions and derogations which are necessary for the purpose of balancing these fundamental rights . such exemptions and derogations should be adopted by the member states on general principles , on the rights of the data subject , on controller and processor , on the transfer of data to third countries or international organisations , on the independent supervisory authorities and on co - operation and consistency . this should not , however , lead member states to lay down exemptions from the other provisions of this regulation . in order to take account of the importance of the right to freedom of expression in every democratic society , it is necessary to interpret notions relating to that freedom , such as journalism , broadly . therefore , member states should classify activities as ‘ journalistic’ for the purpose of the exemptions and derogations to be laid down under this regulation if the object of these activities is the disclosure to the public of information , opinions or ideas , irrespective of the medium which is used to transmit them . they should not be limited to media undertakings and may be undertaken for profit - making or for non - profit making purposes . ### exemptions or derogations from the requirements of certain provisions of this regulation for the processing of personal data should be provided for in order to reconcile the right to the protection of personal data with the right to freedom of expression , and notably the right to receive and impart information , as guaranteed in particular by article 11 of the charter of fundamental rights of the european union . this should apply to processing of personal data for purposes such as journalism and artistic and literary expression , in particular in the audiovisual field and in news archives and press libraries . therefore , member states should adopt legislative measures , which should lay down exemptions and derogations which are necessary for the purpose of balancing these fundamental rights . such exemptions and derogations should be adopted by the member states on general principles , on the rights of the data subject , on controller and processor , on the transfer of data to third countries or international organisations , on the independent supervisory authorities and on co - operation and consistency . this should not , however , lead member states to lay down exemptions from the other provisions of this regulation . in order to take account of the importance of the right to freedom of expression in every democratic society , it is necessary to interpret notions relating to that freedom , such as journalism , broadly .


### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted in respect of lawfulness of processing ; specifying the criteria and conditions in relation to the consent of a child ; processing of special categories of data ; specifying the criteria and conditions for manifestly excessive requests and fees for exercising the rights of the data subject ; criteria and requirements for the information to the data subject and in relation to the right of access ; the right to be forgotten and to erasure ; measures based on profiling ; criteria and requirements in relation to the responsibility of the controller and to data protection by design and by default ; a processor ; criteria and requirements for the documentation and the security of processing ; criteria and requirements for establishing a personal data breach and for its notification to the supervisory authority , and on the circumstances where a personal data breach is likely to adversely affect the data subject ; the criteria and conditions for processing operations requiring a data protection impact assessment ; the criteria and requirements for determining a high degree of specific risks which require prior consultation ; designation and tasks of the data protection officer ; codes of conduct ; criteria and requirements for certification mechanisms ; criteria and requirements for transfers by way of binding corporate rules ; transfer derogations ; administrative sanctions ; processing for health purposes ; processing in the employment context and processing for historical , statistical and scientific research purposes . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council . ### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted specifying the technical standars to give consent ; specifyng conditions of icon - based mode for provision of information ; specifying the criteria and conditions for fees for exercising the rights of the data subject ; criteria and requirements for the information to the data subject and in relation to the right of access ; the right to be forgotten and to erasure ; criteria and requirements for verification of the responsibility of the controller ; criteria and requirements for establishing a personal data breach and for its notification to the supervisory authority , and on the circumstances where a personal data breach is likely to adversely affect the data subject ; the criteria and conditions for processing operations requiring a data protection impact assessment ; the criteria and requirements for determining a high degree of specific risks which require prior consultation ; codes of conduct ; criteria and requirements for certification mechanisms ; the adequate level of protection afforded by a third country or an international organisation ; administrative sanctions ; processing for health purposes ; processing in the employment context and processing for historical , statistical and scientific research purposes . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level in particular with the european data protection board . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council .


### in the course of an activity which falls outside the scope of union law , in particular concerning national security ; ### in the course of an activity which falls outside the scope of union law ;


### ' personal data breach ' means a breach of security leading to the accidental or unlawful destruction , loss , alteration , unauthorised disclosure of , or access to , personal data transmitted , stored or otherwise processed ; ### ' personal data breach ' means the accidental or unlawful destruction , loss , alteration , unauthorised disclosure of , or access to , personal data transmitted , stored or otherwise processed ;


### processing is necessary for the performance of a task carried out in the public interest , on the basis of union law , or member state law which shall provide for suitable measures to safeguard the data subject ' s legitimate interests ; or ### processing is necessary for the performance of a task carried out in the public interest , on the basis of union law , or member state law which shall provide for suitable measures to safeguard the fundamental rights and the interests of the data subject ; or


### rights in relation to recipients the controller shall communicate any rectification or erasure carried out in accordance with articles 16 and 17 to each recipient to whom the data have been disclosed , unless this proves impossible or involves a disproportionate effort . ### rights in relation to recipients the controller shall communicate any rectification or erasure carried out in accordance with articles 16 and 17 to each recipient to whom the data have been transferred , unless this proves impossible or involves a disproportionate effort . the controller shall inform the data subject about those third parties .


### where a controller determines the purposes , conditions and means of the processing of personal data jointly with others , the joint controllers shall determine their respective responsibilities for compliance with the obligations under this regulation , in particular as regards the procedures and mechanisms for exercising the rights of the data subject , by means of an arrangement between them . ### where a controller determines the purposes , conditions and means of the processing of personal data jointly with others , the joint controllers shall determine their respective responsibilities for compliance with the obligations under this regulation , in particular as regards the procedures and mechanisms for exercising the rights of the data subject , by means of a written arrangement between them . where such determination is lacking or is not sufficiently clear , the data subject may exercise his or her rights against any one of the controllers , who shall be jointly and severally liable .


### act only on instructions from the controller , in particular , where the transfer of the personal data used is prohibited ; ### act only on instructions from the controller ;


### the communication to the data subject referred to in paragraph 1 shall describe the nature of the personal data breach and contain at least the information and the recommendations provided for in points and of article 31 . ### the communication to the data subject referred to in paragraph 1 shall describe the nature of the personal data breach and contain at least the information and the recommendations provided for in article 31 and information about the rights of the data subject , including redress .


### a transfer may take place where the commission has decided that the third country , or a territory or a processing sector within that third country , or the international organisation in question ensures an adequate level of protection . such transfer shall not require any further authorisation . ### a transfer may take place where the commission has decided that the third country , or a territory within that third country , or the international organisation in question ensures an adequate level of protection . such transfer shall not require any further authorisation .


### the existence and effective functioning of one or more independent supervisory authorities in the third country or international organisation in question responsible for ensuring compliance with the data protection rules , for assisting and advising the data subjects in exercising their rights and for co - operation with the supervisory authorities of the union and of member states ; and ### the existence and effective functioning of one or more independent supervisory authorities in the third country or international organisation in question responsible for enforcing compliance with the data protection rules including sufficient sanctioning powers , for assisting and advising the data subjects in exercising their rights and for co - operation with the supervisory authorities of the union and of member states ; and


### where the commission decides pursuant to paragraph 5 , any transfer of personal data to the third country , or a territory or a processing sector within that third country , or the international organisation in question shall be prohibited , without prejudice to articles 42 to 44 . at the appropriate time , the commission shall enter into consultations with the third country or international organisation with a view to remedying the situation resulting from the decision made pursuant to paragraph 5 of this article . ### where the commission decides pursuant to paragraph 5 , any transfer of personal data to the third country , or a territory within that third country , or the international organisation in question shall be prohibited , without prejudice to articles 42 to 44 . at the appropriate time , the commission shall enter into consultations with the third country or international organisation with a view to remedying the situation resulting from the decision made pursuant to paragraph 5 of this article .


### where the commission has taken no decision pursuant to article 41 , a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has adduced appropriate safeguards with respect to the protection of personal data in a legally binding instrument . ### where the commission has taken no decision pursuant to article 41 , a controller or processor may not transfer personal data to a third country , territory or an international organisation unless the controller or processor has adduced appropriate safeguards with respect to the protection of personal data in a legally binding instrument .


### the transfer is made from a register which according to union or member state law is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate legitimate interest , to the extent that the conditions laid down in union or member state law for consultation are fulfilled in the particular case ; or ### the transfer is made from a register which according to union or member state law is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate legitimate interest , to the extent that the conditions laid down in union or member state law for consultation are fulfilled in the particular case and the controller or processor as the case may be has obtained prior authorisation for the transfer or set of transfers by the supervisory authority in accordance with article 34 ; or


### each supervisory authority shall exercise , on the territory of its own member state , the powers conferred on it in accordance with this regulation . ### each supervisory authority shall exercise , on the territory of its own member state , the powers conferred on it in accordance with this regulation , without prejudice to article 74 .


### conduct investigations either on its own initiative or on the basis of a complaint or on request of another supervisory authority , and inform the data subject concerned , if the data subject has addressed a complaint to this supervisory authority , of the outcome of the investigations within a reasonable period ; ### conduct investigations , inspections , and audits , either on its own initiative or on the basis of a complaint or on request of another supervisory authority , and inform the data subject concerned , if the data subject has addressed a complaint to this supervisory authority , of the outcome of the investigations within a reasonable period ;


### each supervisory authority shall have the power to sanction administrative offences , in particular those referred to in article 79 , and . ### each supervisory authority shall have the power to sanction administrative offences , in accordance with article 79 .


### where requests are manifestly excessive , in particular due to their repetitive character , the supervisory authority may charge a fee or not take the action requested by the data subject . the supervisory authority shall bear the burden of proving the manifestly excessive character of the request . ### where complaints are manifestly excessive , in particular due to their repetitive character , the supervisory authority may charge a reasonable fee . the supervisory authority shall bear the burden of proving the manifestly excessive character of the complaint .


### the european data protection board shall ensure the consistent application of this regulation . to this effect , the european data protection board shall , on its own initiative or at the request of the commission , in particular : ### the european data protection board shall ensure the consistent application of this regulation . to this effect , the european data protection board shall , on its own initiative or at the request of the european parliament , council and the commission , in particular :


### promote the co - operation and the effective bilateral and multilateral exchange of information and practices between the supervisory authorities ; ### promote the co - operation and the effective bilateral and multilateral exchange of information and practices between the supervisory authorities , including the coordination of joint operations and other joint activities , where it so decides at the request of one or several supervisory authorities ;


### the european data protection board shall regularly and timely inform the commission about the outcome of its activities . it shall draw up an annual report on the situation regarding the protection of natural persons with regard to the processing of personal data in the union and in third countries . the report shall include the review of the practical application of the guidelines , recommendations and best practices referred to in point of article 66 . ### the european data protection board shall regularly and timely inform the commission about the outcome of its activities . it shall draw up a report at least every two years on the situation regarding the protection of natural persons with regard to the processing of personal data in the union and in third countries . the report shall include the review of the practical application of the guidelines , recommendations and best practices referred to in point of article 66 .


### the european data protection board shall elect a chair and two deputy chairpersons from amongst its members . one deputy chairperson shall be the european data protection supervisor , unless he or she has been elected chair . ### the european data protection board shall elect a chair and at least two deputy chairpersons from amongst its members .


### proceedings against a controller or a processor shall be brought before the courts of the member state where the controller or processor has an establishment . alternatively , such proceedings may be brought before the courts of the member state where the data subject has its habitual residence , unless the controller is a public authority acting in the exercise of its public powers . ### proceedings against a controller or a processor shall be brought before the courts of the member state where the controller or processor has an establishment . alternatively , such proceedings may be brought before the courts of the member state where the data subject has its habitual residence , unless the controller is a public authority of amember state acting in the exercise of its public powers .


### any person who has suffered damage as a result of an unlawful processing operation or of an action incompatible with this regulation shall have the right to receive compensation from the controller or the processor for the damage suffered . ### any person who has suffered damage , including non - pecuniary loss , as a result of an unlawful processing operation or of an action incompatible with this regulation shall have the right to receive compensation from the controller or the processor for the damage suffered .


### within the limits of this regulation , member states may adopt by law specific rules regulating the processing of employees ' personal data in the employment context , in particular for the purposes of the recruitment , the performance of the contract of employment , including discharge of obligations laid down by law or by collective agreements , management , planning and organisation of work , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship . ### member states may , in accordance with the rules set out in this regulation , and taking into account the principle of proportionality adopt by legal provisions specific rules regulating the processing of employees ' personal data in the employment context , in particular but not limited to the purposes of the recruitment and job applications within the group of undertakings , the performance of the contract of employment , including discharge of obligations laid down by law and by collective agreements , company agreements and collective agreements in accordance with national law and practice , management , planning and organisation of work , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship . the right of member states – or the social partners via collective agreements – to provide employees with more favourable protection provisions in respect of the processing of personal data in the employment context shall remain unaffected .


### within the limits of this regulation , member states may adopt specific rules to set out the investigative powers by the supervisory authorities laid down in article 53 in relation to controllers or processors that are subjects under national law or rules established by national competent bodies to an obligation of professional secrecy or other equivalent obligations of secrecy , where this is necessary and proportionate to reconcile the right of the protection of personal data with the obligation of secrecy . these rules shall only apply with regard to personal data which the controller or processor has received from or has obtained in an activity covered by this obligation of secrecy . ### in accordance with the rules set out in this regulation , member states , may adopt specific rules in relation to controllers or processors that are subjects under national law or rules established by national competent bodies to an obligation of professional secrecy or other equivalent obligations of secrecy , where this is necessary and proportionate to reconcile the right of the protection of personal data with the obligation of secrecy , to set out the rights of data subjects laid down in articles 11 to 20 , in line with article 21 ; the investigative powers by the supervisory authorities laid down in article 53 . the specific rules referred to in paragraph 1 shall only apply with regard to personal data which the controller or processor has received from or has obtained in an activity covered by this obligation of secrecy .


### information referred to in point of article 6 of decision no 406 / 2009 / ec and information on how their purchasing policy enhances the achievement of an international agreement on climate change . ### information referred to in point of article 6 of decision no 406 / 2009 / ec and information on how their purchasing policy enhances the achievement of an international agreement on climate change . in the case of hydroelectric power production project activities with a generating capacity exceeding 20mw , member states shall provide information on how they , when approving such project activities , have ensured that relevant international criteria and guidelines , in particular the hydropower sustainability assessment protocol 2010 , will be respected during the development of such project activities .


### for the implementation of horizon 2020 , account shall be taken of advice and inputs provided by : advisory groups of independent , high level experts set up by the commission ; dialogue structures created under international science and technology agreements ; forward looking activities ; targeted public consultations ; and transparent and interactive processes that ensure responsible research and innovation is supported . ### for the implementation of horizon 2020 , account shall be taken of advice and inputs provided by : advisory groups of independent , high level experts , from a wide variety of sectors and background , including academia and civil society representatives , set up by the commission ; dialogue structures created under international science and technology agreements ; forward looking activities ; targeted public consultations ; and transparent and interactive processes that ensure responsible research and innovation is implemented .


### disease and disability are not stopped by national borders . an appropriate european level research and innovation response can and should make a crucial contribution to addressing these challenges , deliver better health and wellbeing for all , and position europe as a leader in the rapidly expanding global markets for health and wellbeing innovations . ### disease and disability are not stopped by national borders . an appropriate european level research and innovation response in partnership with third countries can and should make a crucial contribution to addressing these global challenges , thereby working to achieve the millennium development goals , deliver better health and wellbeing for all , and position europe as a leader in the rapidly expanding global markets for health and wellbeing innovations .


### the aim is to foster the development of innovative societies and policies in europe through the engagement of citizens , enterprises and users in research and innovation and the promotion of coordinated research and innovation policies in the context of globalisation . particular support will be provided for the development of the era and the development of framework conditions for innovation . ### the aim is to foster the development of innovative societies and policies in europe through the engagement of citizens , civil society organisations , enterprises and users in research and innovation and the promotion of coordinated research and innovation policies in the context of globalisation . particular support will be provided for the development of the era and the development of framework conditions for innovation .


### annex “annex iib community general export authorisation no eu002 low value shipments ### annex iib is deleted


### algeria , andorra , antigua and barbuda , argentina , aruba , bahamas , bahrain , bangladesh , barbados , belize , benin , bhutan , bolivia , botswana , brazil , british virgin islands , brunei , cameroon , cape verde , chile , china , comoros islands , costa rica , djibouti , dominica , dominican republic , ecuador , egypt , el salvador , equatorial guinea , falkland islands , faroe islands , fiji , french guyana , french ot , gabon , gambia , gibraltar , greenland , grenada , guadeloupe , guam , guatemala , ghana , guinea bissau , guyana , honduras , hong kong special administrative region , iceland , india , indonesia , israel , jordan , kuwait , lesotho , liechtenstein , macau , madagascar , malawi , malaysia , maldives , mali , martinique , mauritius , mexico , monaco , montserrat , morocco , namibia , netherlands antilles , new caledonia , nicaragua , niger , nigeria , oman , panama , papua new guinea , peru , philippines , puerto rico , qatar , russia , samoa , san marino , sao tome e principe , saudi arabia , senegal , seychelles , singapore , solomon islands , south africa , south korea , sri lanka , st . helena , st . kitts and nevis , st . vincent , surinam , swaziland , taiwan , thailand , togo , trinidad and tobago , tunisia , turkey , turks and caicos islands , united arab emirates , uruguay , us virgin islands , vanuatu , venezuela . ### argentina , bosnia and herzegovina , brazil , chile , china , croatia , french overseas territories , hong kong special administrative region , iceland , kazakhstan , macedonia , macau , mexico , montenegro , morocco , russia , serbia , south africa , south korea , tunisia , turkey , ukraine , united arab emirates .


### algeria , andorra , antigua and barbuda , argentina , aruba , bahamas , bahrain , barbados , belize , benin , bhutan , bolivia , botswana , brazil , british virgin islands , brunei , cameroon , cape verde , chile , comoros islands , costa rica , croatia , djibouti , dominica , dominican republic , ecuador , egypt , el salvador , equatorial guinea , falkland islands , faroe islands , fiji , french guyana , french ot , gabon , gambia , gibraltar , greenland , grenada , guadeloupe , guam , guatemala , ghana , guinea bissau , guyana , honduras , hong kong sar , iceland , india , jordan , kuwait , lesotho , liechtenstein , madagascar , malawi , malaysia , maldives , mali , martinique , mauritius , mexico , moldova , monaco , mongolia , montserrat , morocco , namibia , netherlands antilles , new caledonia , nicaragua , niger , oman , panama , papua new guinea , peru , philippines , puerto rico , qatar , russia , samoa , san marino , sao tome e principe , saudi arabia , senegal , seychelles , singapore , solomon islands , south africa , south korea , st . helena , st . kitts and nevis , st . vincent , surinam , swaziland , togo , trinidad and tobago , tunisia , turkey , turks and caicos islands , uae , ukraine , uruguay , us virgin islands , vanuatu . ### argentina , bosnia and herzegovina , brazil , chile , china , croatia , hong kong sar , iceland , kazakhstan , french overseas territories , macedonia , macau , mexico , montenegro , morocco , russia , serbia , singapore , south africa , south korea , tunisia , turkey , ukraine , united arab emirates .


### for an essentially identical transaction where the initial authorisation has been revoked . ### when the initial authorisation has been annulled , suspended , modified or revoked .


### provide customs officers , if so requested , with documentary evidence of the date of importation of the goods into the european community , of any repairs to the goods carried out in the european community and of the fact that the items are being returned to the person and the country from which they were imported into the european community . ### provide customs officers , if so requested , with documentary evidence of the date of importation of the goods into the european community , of any repairs to the goods carried out in the european community and of the fact that the items are being returned to the end user and the country from which they were imported into the european community .


### any exporter who uses this authorisation must notify the competent authorities of the member state where he is established ) of first use of the authorisation no later than 30 days after the date when the first export takes place . ### any exporter who uses this general authorisation must notify the competent authorities of the member state where he is established ) and the commission of the first use of this authorisation prior to the date when the first export takes place . reporting requirements attached to the use of this authorisation and the additional information that the member state from which the export takes place shall require on items exported under this authorisation are defined by member states . a member state shall require the exporters established in that member state to register prior to the first use of this authorisation . registration shall be automatic and acknowledged by the competent authorities to the exporter without delay and in any case within 10 working days of receipt of the registration request . where applicable the requirements set out in the second and third subparagraphs of this paragraph shall be based on those defined for the use of national general export authorisations granted by those member states which provide for such authorisations . member states shall notify the commission of the notification mechanism chosen for this general export authorisation . the commission shall publish the information notified to it in the c series of the official journal of the european union .


### any exporter who uses this general authorisation must notify the competent authorities of the member state where he is established ) of the first use of this authorisation no later than 30 days after the date when the first export takes place . ### any exporter who uses this general authorisation must notify the competent authorities of the member state where he is established ) and the commission of the first use of this authorisation prior to the date when the first export takes place . reporting requirements attached to the use of this authorisation and the additional information that the member state from which the export takes place shall require on items exported under this authorisation are defined by member states . a member state shall require the exporters established in that member state to register prior to the first use of this authorisation . registration shall be automatic and acknowledged by the competent authorities to the exporter without delay and in any case within 10 working days of receipt of the registration request . . where applicable the requirements set out in the second and third subparagraphs of this paragraph shall be based on those defined for the use of national general export authorisations granted by those member states which provide for such authorisations .


### 1 inform the competent authorities of the member state where he is established ) of first use of the authorisation no later than 30 days after the date of first export ; ### notify the competent authorities of the member state where he is established ) and the commission of the first use of this authorisation prior to the date of first export . reporting requirements attached to the use of this authorisation and the additional information that the member state from which the export take place shall require on items exported under this authorisation are defined by member states . a member state shall require the exporters established in that member state to register prior to the first use of this authorisation . registration shall be automatic and acknowledged by the competent authorities to the exporter without delay and in any case within 10 working days of receipt of the registration request . . where applicable the requirements set out in the second and third subparagraphs of this paragraph shall be based on those defined for the use of national general export authorisations granted by those member states which provide for such authorisations . member states shall notify the commission of the notification mechanism chosen for this general export authorisation . the commission shall publish the information notified to it in the c series of the official journal of the european union .


### inform the competent authorities of the member state where he is established ) of first use of the authorisation no later than 30 days after the date of first export ; ### notify the competent authorities of the member state where he is established ) and the commission of the first use of this authorisation prior to the date of first export . reporting requirements attached to the use of this authorisation and the additional information that the member state from which the export takes place shall require on items exported under this authorisation are defined by member states . a member state shall require the exporters established in that member state to register prior to the first use of this authorisation . registration shall be automatic and acknowledged by the competent authorities to the exporter without delay and in any case within 10 working days of receipt of the registration request . . where applicable the requirements set out in the second and third subparagraphs of this paragraph shall be based on those defined for the use of national general export authorisations granted by those member states which provide for such authorisations . member states shall notify the commission of the notification mechanism chosen for this general export authorisation . the commission shall publish the information notified to it in the c series of the official journal of the european union .


### any exporter who uses this authorisation must notify the competent authorities of the member state where he is established ) of first use of the authorisation no later than 30 days after the date when the first export takes place . ### any exporter who uses this general authorisation must notify the competent authorities of the member state where he is established ) and the commission of the first use of this authorisation prior to the date when the first export takes place . reporting requirements attached to the use of this authorisation and the additional information that the member state from which the export is made shall require on items exported under this authorisation are defined by member states . a member state shall require the exporters established in that member state to register prior to the first use of this authorisation . registration shall be automatic and acknowledged by the competent authorities to the exporter without delay and in any case within 10 working days of receipt of the registration request . where applicable the requirements set out in the second and third subparagraphs of this paragraph shall be based on those defined for the use of national general export authorisations granted by those member states which provide for such authorisations . any exporter who uses this general authorisation shall every six months inform the relevant national authority of the member state where he is established and the commission of the quantity , value and destination of each item exported . this information shall include a description of the items exported along with the relevant control list reference as set out in annex 1 of this regulation . the commission shall publish the information notified to it in the c series of the official journal of the european union


### any exporter who uses this general authorisation must notify the competent authorities of the member state where he is established ) of the first use of this authorisation no later than 30 days after the date when the first export takes place . ### any exporter who uses this general authorisation must notify the competent authorities of the member state where he is established ) and the commission of the first use of this authorisation prior to the date when the first export takes place . reporting requirements attached to the use of this authorisation and the additional information that the member state from which the export is made shall require on items exported under this authorisation are defined by member states . a member state shall require the exporters established in that member state to register prior to the first use of this authorisation . registration shall be automatic and acknowledged by the competent authorities to the exporter without delay and in any case within 10 working days of receipt . where applicable the requirements set out in the second and third subparagraphs of this paragraph shall be based on those defined for the use of national general export authorisations granted by those member states which provide for such authorisations . any exporter who uses this general authorisation shall every six months inform the relevant national authority of the member state where he is established and the commission of the quantity , value and destination of each item exported . this information shall include a description of the items exported along with the relevant control list reference as set out in annex 1 of this regulation . the commission shall publish the information notified to it in the c series of the official journal of the european union .


### inform the competent authorities of the member state where he is established ) of first use of the authorisation no later than 30 days after the date of first export ; ### notify the competent authorities of the member state where he is established ) and the commission of the first use of this authorisation prior to the date of first export . reporting requirements attached to the use of this authorisation and the additional information that the member state from which the export is made shall require on items exported under this authorisation are defined by member states . a member state shall require the exporters established in that member state to register prior to the first use of this authorisation . registration shall be automatic and acknowledged by the competent authorities to the exporter without delay and in any case within 10 working days of receipt . where applicable the requirements set out in the second and third subparagraphs of this paragraph shall be based on those defined for the use of national general export authorisations granted by those member states which provide for such authorisations . any exporter who uses this general authorisation shall every six months inform the relevant national authority of the member state where he is established and the commission of the quantity , value and destination of each item exported . this information shall include a description of the items exported along with the relevant control list reference as set out in annex 1 of this regulation . the commission shall publish the information notified to it in the c series of the official journal of the european union .


### for the purpose of this authorisation , “exhibition” means any trade or industrial exhibition , fair or similar public show or display which is not organised for private purposes in shops or business premises with a view to the sale of foreign products , during which the products remain under customs control . ### for the purpose of this authorisation , “exhibition or fair” means any trade or industrial exhibition , fair or similar public show or display which is not organised for private purposes in shops or business premises with a view to the sale of foreign products , during which the products remain under customs control .


### argentina croatia russia south africa south korea turkey ukraine ### argentina china croatia russia south africa south korea turkey ukraine


### where the exporter is aware that the items in question are intended , in their entirety or in part , for any of the uses referred to in articles 4 and 4 . ### where the exporter is aware that the items in question are intended , in their entirety or in part , for any of the uses referred to in subparagraph 1 ;


### where the exporter is aware that the items in question are intended , in their entirety or in part , for any of the uses referred to in articles 4 and 4 . ### where the items in question are intended , in their entirety or in part , for any of the uses referred to in articles 4 and 4 .


### argentina ; bangladesh , belize , benin , bolivia , brazil ; cameroun , chile ; cook island , costa rica ; dominica , ecuador , el salvador , fiji , georgia , guatemala , guyana , india , lesotho , maldives , mauritius , mexico , namibia , nicaragua , oman , panama , paraguay , russia , st lucia , seychelles , peru , sri lanka , south africa ; swaziland , turkey ; uruguay , ukraine ; republic of korea . ### argentina croatia iceland south korea turkey ukraine .


### the nagoya protocol on access to genetic resources and the fair and equitable sharing of benefits arising from their utilization to the convention on biological diversity is an international treaty adopted on 29 october 2010 by the parties to the convention . the nagoya protocol significantly expands the general rules of the convention on access and benefit - sharing for the use of genetic resources and traditional knowledge associated with genetic resources . ### the nagoya protocol on access to genetic resources and the fair and equitable sharing of benefits arising from their utilization to the convention on biological diversity is an international treaty adopted on 29 october 2010 by the parties to the convention . the nagoya protocol significantly expands the general rules of the convention on access and benefit - sharing for the utilisation and subsequent commercialisation of genetic resources and traditional knowledge associated with genetic resources .


### in order to ensure legal certainty , it is important that the rules implementing the nagoya protocol should only apply to genetic resources and traditional knowledge associated with genetic resources that are accessed after the entry into force of the nagoya protocol for the union . ### in order to ensure legal certainty , it is important that the rules implementing the nagoya protocol should only apply to genetic resources and traditional knowledge associated with genetic resources that are accessed or utilised after the entry into force of the nagoya protocol for the union .


### with a view to ensuring an effective implementation of the nagoya protocol , all users of genetic resources and traditional knowledge associated with such resources should have to exercise due diligence to ascertain that the genetic resources and associated traditional knowledge used were accessed in accordance with applicable legal requirements and to ensure that , where relevant , benefits are shared . however , given the diversity of users within the union it is not appropriate to oblige all users to take the same measures for exercising due diligence . therefore , only minimum features of due diligence measures should be set out . the specific choices taken by users on the tools and measures applied for exercising due diligence should be supported through the recognition of best practices as well as complementary measures in support of sectoral codes of conduct , model contractual clauses , and guidelines with a view to increasing legal certainty and reducing costs . the obligation on users to keep information relevant for access and benefit - sharing should be limited in time , consistent with the time - span for an eventual innovation . ### with a view to ensuring an effective implementation of the nagoya protocol , all users of genetic resources and traditional knowledge associated with such resources should have to exercise due diligence to ascertain that the genetic resources and associated traditional knowledge used were accessed in accordance with applicable legal requirements and to ensure that , where relevant , benefits are shared . users however , given the diversity of users within the union it is not appropriate to oblige all users to take the same measures for exercising due diligence . therefore , only minimum features of due diligence measures should be set out . the specific choices taken by users on the tools and measures applied for exercising due diligence should be supported through the recognition of best practices as well as complementary measures in support of sectoral codes of conduct , model contractual clauses , and guidelines with a view to increasing legal certainty and reducing costs . the obligation on users to keep information relevant for access and benefit - sharing , in particular documented proof that benefit - sharing obligations have been fully and legally carried out , should be limited in time , consistent with the time - span for an eventual innovation .


### best practices developed by users should play an important role in identifying due diligence measures that are particularly suitable for achieving compliance with the system of implementation of the nagoya protocol with high legal certainty and at low costs . users should be enabled to build on existing access and benefit - sharing codes of conduct developed for the academic sector and different industries . associations of users should be able to request that the commission determines whether a specific combination of procedures , tools or mechanisms overseen by an association may be recognised as best practice . competent authorities of the member states should consider that the implementation of a recognised best practice by a user reduces that user ' s risk of non - compliance and justifies a reduction in compliance checks . the same should apply to best practices adopted by the collective of the parties to the nagoya protocol . ### best practices developed by users should play an important role in identifying due diligence measures that are particularly suitable for achieving compliance with the system of implementation of the nagoya protocol with high legal certainty and at low costs . users should be enabled to build on existing access and benefit - sharing codes of conduct developed for the academic sector and different industries . associations of users should be able to request that the commission determines whether a specific combination of goals , activities , procedures , tools or mechanisms overseen by an association may be recognised as best practice . competent authorities of the member states should consider that the implementation of a recognised best practice by a user reduces that user ' s risk of non - compliance and justifies a reduction in compliance checks . the same should apply to best practices adopted by the collective of the parties to the nagoya protocol .


### collections are major suppliers of genetic resources and traditional knowledge associated with genetic resources used in the union . a system of union trusted collections should be set in place . it would ensure that collections included in the register of union trusted collections effectively apply measures to only supply samples of genetic resources to third persons with documentation providing evidence of legal acquisition and the establishment of mutually agreed terms , where required . a system of union trusted collections should substantially lower the risk that illegally acquired genetic resources are used in the union . competent authorities of member states would verify if a collection meets the requirements for recognition as union trusted collection . users that acquire a genetic resource from a collection listed in the union register should be considered to have exercised due diligence as regards the seeking of all necessary information . this should prove particularly beneficial for academic researchers as well as small and medium sized enterprises . ### collections are the most accessible suppliers of genetic resources and traditional knowledge associated with genetic resources utilised in the union . a system of union trusted collections should be set in place . it would ensure that collections included in the register of union trusted collections effectively apply measures to only supply samples of genetic resources to third persons with documentation providing evidence of legal acquisition and the establishment of mutually agreed terms , where required . a system of union trusted collections should substantially lower the risk that illegally acquired genetic resources are utilised in the union . competent authorities of member states would verify if a collection meets the requirements for recognition as union trusted collection , including demonstrating the capacity to respect the broad objectives of the nagoya protocol in terms of achieving a fair and equitable sharing of the benefits arising from the utilisation of genetic resources and contributing to the conservation of biodiversity . users that acquire a genetic resource from a collection listed in the union register should be considered to have exercised due diligence as regards the seeking of all necessary information . this should prove particularly beneficial for academic researchers as well as small and medium sized enterprises .


### this regulation applies to genetic resources over which states exercise sovereign rights and to traditional knowledge associated with genetic resources that are accessed after the entry into force of the nagoya protocol for the union . it also applies to the benefits arising from the use of such genetic resources and to traditional knowledge associated with genetic resources . ### this regulation applies to genetic resources over which states exercise sovereign rights and to traditional knowledge associated with genetic resources that are accessed or utilised after the entry into force of the nagoya protocol for the union . it also applies to the benefits arising from the use of such genetic resources and to traditional knowledge associated with genetic resources .


### ' use of genetic resources ' means to conduct research and development on the genetic or biochemical composition of genetic resources ; ### ' utilisation of genetic resources ' means to conduct research and development on the genetic or biochemical composition of genetic resources including through the application of biotechnology ;


### users shall exercise due diligence to ascertain that genetic resources and traditional knowledge associated with genetic resources used were accessed in accordance with applicable access and benefit - sharing legislation or regulatory requirements and that , where relevant , benefits are fairly and equitably shared upon mutually agreed terms . users shall seek , keep , and transfer to subsequent users information relevant for access and benefit - sharing . ### users shall exercise due diligence to ascertain that genetic resources and traditional knowledge associated with genetic resources used were accessed with prior informed consent and based on mutually agreed terms as defined by applicable access and benefit - sharing legislation or regulatory requirements and that benefits are fairly and equitably shared upon mutually agreed terms . users shall seek , keep , and transfer to subsequent users all information and documents relevant for access and benefit - sharing and compliance with the provisions of this regulation , in particular all documented proof that benefit - sharing obligations have been fully and legally carried out .


### member states and the commission shall request all recipients of public research funding involving uses of genetic resources and traditional knowledge associated with genetic resources to declare that they will exercise due diligence in accordance with article 4 . ### deleted


### competent authorities shall transmit to the commission every two years the information received on the basis of paragraphs 1 and 2 . the commission shall summarise the information received and make it available to the access and benefit - sharing clearing house . ### competent authorities shall verify the information provided under points to and transmit to the commission within three months the information received pursuant to this article . the commission shall within three months summarise the information received and make the information required for the internationally recognised certificate available to the access and benefit - sharing clearing house as well as to the public in an easily accessible open format .


### any association of users may submit an application to the commission for recognising as best practice a combination of procedures , tools or mechanisms developed and overseen by it . the application shall be supported by evidence and information . ### any association of users or organisation with interest and expertise in the utilisation of genetic resources and access and benefit sharing may submit an application to the commission for recognising as best practice a combination of goals , activities , procedures , tools or mechanisms developed and overseen by it . the application shall be supported by evidence and information . in considering applications for recognition of best practice , the commission shall give priority to goals , activities , procedures , tools or mechanisms that contribute to : - the conservation of biological diversity and the sustainable use of its components ; - technology transfer ; - poverty eradication in developing countries .


### the information referred to in paragraph 1 shall be made available in accordance with directive 2003 / 4 / ec . ### the information referred to in paragraph 1 shall be made available in accordance with directive 2003 / 4 / ec in an easily accessible open format .


### measures taken for the purpose of a sea operation shall be conducted in a way that does not put at risk the safety of the persons intercepted or rescued and the safety of the participating units . ### measures taken for the purpose of a sea operation shall be in full compliance with the eu legislation applying to the equipment as well as the training of staff on - board a vessel in order to ensure the safety of the persons intercepted or rescued and the safety of the participating units .


### directive 2005 / 36 / ec already provides for clear obligations for professionals to have the necessary language skills . the review of that obligation has shown a need to clarify the role of competent authorities and employers notably in the interest of patients ' safety . language controls should however be reasonable and necessary for the jobs in question and should not constitute grounds for excluding professionals from the labour market in the host member state . ### directive 2005 / 36 / ec already provides for obligations for professionals to have the necessary language skills . the review of that obligation has shown a need to define these language requirements more precisely and to clarify the role of competent authorities and employers notably in the interest of patients ' safety . in the case of occupations which have implications for patients , for example patient safety and treatment and the provision of services and information to patients , it is essential to test language knowledge before authorising a person to practise . knowledge of the official language of the language area where the professional wishes to work is a conditio sine qua non here . level c1 of the european framework of reference for languages should be taken as a minimum standard for this purpose .


### basic medical training shall comprise a total of at least five years of study , which may also be expressed with the equivalent ects credits , and shall consist of at least 5500 hours of theoretical and practical training provided by , or under the supervision of , a university . ### basic medical training shall comprise a total of at least six years of study , and shall consist of at least 5500 hours of actual theoretical training at a university and practical training provided by a university or under the supervision of a university at a non - university hospital . at least 5500 hours of actual training shall not include any components such as private study , examinations or writing of a thesis .


### there are significant differences in the national rules governing the functioning of collecting societies , in particular as regards their transparency and accountability towards their members and rightholders . beyond the difficulties non - domestic rightholders face when exercising their rights and the too often poor financial management of the revenues collected , problems with the functioning of collecting societies lead to inefficiencies in the exploitation of copyright and related rights across the internal market to the detriment of the members of collecting societies , rightholders and users alike . these difficulties do not arise in the functioning of independent rights management service providers who act as agents for rightholders for the management of their rights on a commercial basis and in which rightholders do not exercise membership rights . ### there are significant differences in the national rules governing the functioning of collective management organisations due to historical , legal , economic and , above all , cultural diversity among member states , in particular as regards their transparency and accountability towards their members and rightholders . beyond the difficulties non - domestic rightholders face when exercising their rights and considering revenues collected may have been often poorly managed , problems with the functioning of collective management organisations lead to inefficiencies in the exploitation of copyright and related rights across the internal market to the detriment of the members of collective management organisations , rightholders and users alike .


### the need to improve the functioning of collecting societies has already been identified in the past . commission recommendation 2005 / 737 / ec of 18 may 2005 on collective cross - border management of copyright and related rights for legitimate online music services set out a number of principles , such as the freedom of rightholders to choose their collecting society , the equal treatment of categories of rightholders and the equitable distribution of royalties . it also called on collecting societies to provide users with sufficient information on tariffs and repertoire in advance of the negotiations . finally , it contained recommendations on accountability , rightholder representation in the decision - making bodies of collecting societies and dispute resolution . commission recommendation 2005 / 737 / ec was however a non - binding instrument limited in scope . consequently , it has been unevenly followed . ### the need to improve the functioning of collective management organisations has already been identified in the past . commission recommendation 2005 / 737 / ec of 18 may 2005 on collective cross - border management of copyright and related rights for legitimate online music services set out a number of principles , such as the freedom of rightholders to choose their collective management organisation , the equal treatment of categories of rightholders and the equitable distribution of royalties . it also called on collective management organisations to provide users with sufficient information on tariffs and repertoire in advance of the negotiations . finally , it contained recommendations on accountability , rightholder representation in the decision - making bodies of collecting societies and dispute resolution . commission recommendation 2005 / 737 / ec was however a non - binding instrument limited in scope . consequently , it has been unevenly followed .


### in order to ensure that holders of copyright and related rights can fully benefit from the internal market when their rights are being managed collectively and that their freedom to exercise their rights is not unduly affected , it is necessary to provide for the inclusion of appropriate safeguards in the constituting documents of collecting societies . moreover , in accordance with directive 2006 / 123 / ec collecting societies should not discriminate , directly or indirectly , between rightholders on the basis of their nationality , place of residence or place of establishment when providing their management services . ### in order to ensure that holders of copyright and related rights can fully benefit from the internal market when their rights are being managed collectively and that their freedom to exercise their rights is not unduly affected , it is necessary to provide for the inclusion of appropriate safeguards in the constituting documents of collective management organisations . moreover , collective management organisations should not discriminate , directly or indirectly , between rightholders on the basis of their nationality , place of residence or place of establishment when providing their management services .