### where the controller referred to in paragraph 1 has made the personal data public , it shall take all reasonable steps , including technical measures , in relation to data for the publication of which the controller is responsible , to inform third parties which are processing such data , that a data subject requests them to erase any links to , or copy or replication of that personal data . where the controller has authorised a third party publication of personal data , the controller shall be considered responsible for that publication . ### where the controller referred to in paragraph 1 has transferred or made the personal data public without a justification based on article 6 , it shall take all necessary steps to have the data erased , without prejudice to article 77 .


### in order to enhance transparency and compliance with this regulation , the establishment of certification mechanisms , data protection seals and marks should be encouraged , allowing data subjects to quickly assess the level of data protection of relevant products and services . ### in order to enhance transparency and compliance with this regulation , the establishment of certification mechanisms , data protection seals and marks should be encouraged , allowing data subjects to quickly , reliably and verifiably assess the level of data protection of relevant products and services .


### a delegated act adopted pursuant to article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 336 ) , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or the council . ### a delegated act adopted pursuant to article 7 , article 11 , article 12 , article 14 , article 17 , article 22 , article 31 , article 32 , article 33 , article 38 , article 39 , article 41 , article 41 , article 79 , article 81 and article 82 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of four months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or the council .


### the commission may adopt implementing acts for deciding that the codes of conduct and amendments or extensions to existing codes of conduct submitted to it pursuant to paragraph 3 have general validity within the union . those implementing acts shall be adopted in accordance with the examination procedure set out in article 87 . ### the commission shall be empowered to adopt , after requesting an opinion of the european data protection board , delegated acts in accordance with article 86 for deciding that the codes of conduct and amendments or extensions to existing codes of conduct submitted to it pursuant to paragraph 3 are in line with this regulation and have general validity within the union . this delegated act shall confer enforceable rights on data subjects .


### hear complaints lodged by any data subject , or by an association representing that data subject in accordance with article 73 , investigate , to the extent appropriate , the matter and inform the data subject or the association of the progress and the outcome of the complaint within a reasonable period , in particular if further investigation or coordination with another supervisory authority is necessary ; ### hear complaints lodged by any data subject , or by an association in accordance with article 73 , investigate , to the extent appropriate , the matter and inform the data subject or the association of the progress and the outcome of the complaint within a reasonable period , in particular if further investigation or coordination with another supervisory authority is necessary ;


### the commission may decide that a third country , or a territory or a processing sector within that third country , or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the commission shall be empowered to adopt delegated acts in accordance with article 86 to decide that a third country , or a territory within that third country , or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 .


### any body , organisation or association referred to in article 73 shall have the right to exercise the rights referred to in articles 74 and 75 on behalf of one or more data subjects . ### any body , organisation or association referred to in article 73 shall have the right to exercise the rights referred to in articles 74 , 75 and 77 on behalf of one or more data subjects .


### the controller shall implement mechanisms for ensuring that , by default , only those personal data are processed which are necessary for each specific purpose of the processing and are especially not collected or retained beyond the minimum necessary for those purposes , both in terms of the amount of the data and the time of their storage . in particular , those mechanisms shall ensure that by default personal data are not made accessible to an indefinite number of individuals . ### where the data subject is given a choice regarding the processing of personal data , the controller shall ensure that , by default , only those personal data are processed which are necessary for each specific purpose of the processing and are especially not collected or retained beyond the minimum necessary for those purposes , both in terms of the amount of the data and the time of their storage . in particular , those mechanisms shall ensure that by default personal data are not made accessible to an indefinite number of individuals and that data subjects are able to control the distribution of their personal data .


### in order for processing to be lawful , personal data should be processed on the basis of the consent of the person concerned or some other legitimate basis , laid down by law , either in this regulation or in other union or member state law as referred to in this regulation . ### in order for processing to be lawful , personal data should be processed on the basis of the specific , informed and explicit consent of the person concerned or some other legitimate basis , laid down by law , either in this regulation or in other union or member state law as referred to in this regulation .


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of updating the amounts of the administrative fines referred to in paragraphs 4 , 5 and 6 , taking into account the criteria referred to in paragraph 2 . ### the commission shall be empowered to adopt , after requesting an opinion of the european data protection board , delegated acts in accordance with article 86 for the purpose of updating the absolute amounts of the administrative fines referred to in paragraphs 4 , 5 and 6 , taking into account the criteria referred to in paragraph 2 and the development of standard costs of living .


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying the criteria , conditions and appropriate safeguards for the processing of the special categories of personal data referred to in paragraph 1 and the exemptions laid down in paragraph 2 . ### the european data protection board shall be entrusted with the task of further specifying the criteria , conditions and appropriate safeguards for the processing of special categories of personal data referred to in paragraph 1 and the exemptions laid down in paragraph 2 , in accordance with article 66 .


### supervisory authorities shall provide each other relevant information and mutual assistance in order to implement and apply this regulation in a consistent manner , and shall put in place measures for effective co - operation with one another . mutual assistance shall cover , in particular , information requests and supervisory measures , such as requests to carry out prior authorisations and consultations , inspections and prompt information on the opening of cases and ensuing developments where data subjects in several member states are likely to be affected by processing operations . ### supervisory authorities shall provide each other relevant information and mutual assistance in order to implement and apply this regulation in a consistent manner , and shall put in place measures for effective co - operation with one another . mutual assistance shall cover , in particular , information requests and supervisory measures , such as requests to carry out prior authorisations and consultations , inspections and prompt information on the opening of cases and ensuing developments where the controller or processor has establishments in several member states or where data subjects in several member states are likely to be affected by processing operations . the lead authority as defined in article 54a shall ensure the coordination with involved supervisory authorities and shall act as the single contact point for the controller or processor .


### for the purposes of this regulation , in relation to the offering of information society services directly to a child , the processing of personal data of a child below the age of 13 years shall only be lawful if and to the extent that consent is given or authorised by the child ' s parent or custodian . the controller shall make reasonable efforts to obtain verifiable consent , taking into consideration available technology . ### for the purposes of this regulation , in relation to the offering of goods or services directly to a child , the processing of personal data of a child below the age of 13 years shall only be lawful if and to the extent that consent is given or authorised by the child ' s parent or legal representative . the controller shall make reasonable efforts to obtain verifiable consent , taking into consideration available technology . the methods to obtain verifiable consent shall not lead to the further processing of personal data which would otherwise not be necessary .


### the data subject shall have the right to object , on grounds relating to their particular situation , at any time to the processing of personal data which is based on points , and of article 6 , unless the controller demonstrates compelling legitimate grounds for the processing which override the interests or fundamental rights and freedoms of the data subject . ### the data subject shall have the right to object at any time to the processing of personal data which is based on points and of article 6 .


### the examination procedure should be used for the adoption of specifying standard forms in relation to the consent of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access the right to data portability ; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation ; specific requirements for the security of processing ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; standards and procedures for a data protection impact assessment ; forms and procedures for prior authorisation and prior consultation ; technical standards and mechanisms for certification ; the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation ; disclosures not authorized by union law ; mutual assistance ; joint operations ; decisions under the consistency mechanism , given that those acts are of general scope . ### the examination procedure should be used for the adoption of specifying standard procedures and forms in relation to the consent of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; forms for prior authorisation and prior consultation ; standard form for notification of decision of third country requesting disclosure of the personal data ; format and procedures for the exchange of information by electronic means on binding corporate rules ; decisions under the consistency mechanism , given that those acts are of general scope .


### personal data must be : processed lawfully , fairly and in a transparent manner in relation to the data subject ; ### personal data shall be : processed lawfully , fairly and in a transparent manner in relation to the data subject ;


### the processing of personal data solely for journalistic purposes , or for the purposes of artistic or literary expression should qualify for exemption from the requirements of certain provisions of this regulation in order to reconcile the right to the protection of personal data with the right to freedom of expression , and notably the right to receive and impart information , as guaranteed in particular by article 11 of the charter of fundamental rights of the european union . this should apply in particular to processing of personal data in the audiovisual field and in news archives and press libraries . therefore , member states should adopt legislative measures , which should lay down exemptions and derogations which are necessary for the purpose of balancing these fundamental rights . such exemptions and derogations should be adopted by the member states on general principles , on the rights of the data subject , on controller and processor , on the transfer of data to third countries or international organisations , on the independent supervisory authorities and on co - operation and consistency . this should not , however , lead member states to lay down exemptions from the other provisions of this regulation . in order to take account of the importance of the right to freedom of expression in every democratic society , it is necessary to interpret notions relating to that freedom , such as journalism , broadly . therefore , member states should classify activities as ‘ journalistic’ for the purpose of the exemptions and derogations to be laid down under this regulation if the object of these activities is the disclosure to the public of information , opinions or ideas , irrespective of the medium which is used to transmit them . they should not be limited to media undertakings and may be undertaken for profit - making or for non - profit making purposes . ### exemptions or derogations from the requirements of certain provisions of this regulation for the processing of personal data should be provided for in order to reconcile the right to the protection of personal data with the right to freedom of expression , and notably the right to receive and impart information , as guaranteed in particular by article 11 of the charter of fundamental rights of the european union . this should apply to processing of personal data for purposes such as journalism and artistic and literary expression , in particular in the audiovisual field and in news archives and press libraries . therefore , member states should adopt legislative measures , which should lay down exemptions and derogations which are necessary for the purpose of balancing these fundamental rights . such exemptions and derogations should be adopted by the member states on general principles , on the rights of the data subject , on controller and processor , on the transfer of data to third countries or international organisations , on the independent supervisory authorities and on co - operation and consistency . this should not , however , lead member states to lay down exemptions from the other provisions of this regulation . in order to take account of the importance of the right to freedom of expression in every democratic society , it is necessary to interpret notions relating to that freedom , such as journalism , broadly .


### the delegation of power referred to in article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 336 ) , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation . ### the delegation of power referred to in article 7 , article 11 , article 12 , article 14 , article 17 , article 22 , article 31 , article 32 , article 33 , article 38 , article 39 , article 41 , article 41 , article 79 , article 81 and article 82 shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation .


### each supervisory authority should hear complaints lodged by any data subject and should investigate the matter . the investigation following a complaint should be carried out , subject to judicial review , to the extent that is appropriate in the specific case . the supervisory authority should inform the data subject of the progress and the outcome of the complaint within a reasonable period . if the case requires further investigation or coordination with another supervisory authority , intermediate information should be given to the data subject . ### each supervisory authority should hear complaints lodged by any data subject or by association acting in the public interest and should investigate the matter . the investigation following a complaint should be carried out , subject to judicial review , to the extent that is appropriate in the specific case . the supervisory authority should inform the data subject or the association of the progress and the outcome of the complaint within a reasonable period . if the case requires further investigation or coordination with another supervisory authority , intermediate information should be given to the data subject .


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying the criteria and requirements for the safeguards for the processing of personal data for the purposes referred to in paragraph 1 . ### the commission shall be empowered , after requesting an opinion from the european data protection board , to adopt delegated acts in accordance with article 86 for the purpose of further specifying the criteria and requirements for the safeguards for the processing of personal data for the purposes referred to in paragraph 1 .


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying the criteria and conditions for the technical and organisational measures referred to in paragraphs 1 and 2 , including the determinations of what constitutes the state of the art , for specific sectors and in specific data processing situations , in particular taking account of developments in technology and solutions for privacy by design and data protection by default , unless paragraph 4 applies . ### the european data protection board shall be entrusted with the task of further specifying the criteria and conditions for the technical and organisational measures referred to in paragraphs 1 and 2 , including the determinations of what constitutes the state of the art , for specific sectors and in specific data processing situations , in particular taking account of developments in technology and solutions for privacy by design and data protection by default , unless paragraph 4 applies , in accordance with article 66 .


### in particular , any legislative measure referred to in paragraph 1 shall contain specific provisions at least as to the objectives to be pursued by the processing and the determination of the controller . ### in particular , any legislative measure referred to in paragraph 1 must be necessary and proportionate in a democratic society and shall contain specific provisions at least as to : the objectives to be pursued by the processing ; the determination of the controller ; the specific purposes and means of processing ; the categories of persons authorised to process the data ; the procedure to be followed for the processing ; the safeguards to prevent abuse ; the right of data subjects to be informed about the restriction .


### the controller shall implement mechanisms to ensure the verification of the effectiveness of the measures referred to in paragraphs 1 and 2 . if proportionate , this verification shall be carried out by independent internal or external auditors . ### the controller shall be able to demonstrate the effectiveness of the measures referred to in paragraphs 1 and 2 . if proportionate , this shall be verified by independent internal or external auditors .


### where applicable , that the controller intends to transfer to a third country or international organisation and on the level of protection afforded by that third country or international organisation by reference to an adequacy decision by the commission ; ### where applicable , that the controller intends to transfer the data to a third country or international organisation and on the level of protection afforded by that third country or international organisation by reference to an adequacy decision by the commission , or in case of transfers referred to in article 42 , article 43 , or point of article 44 , by reference to the appropriate safeguards and the means to obtain a copy of them ;


### every natural person should have the right not to be subject to a measure which is based on profiling by means of automated processing . however , such measure should be allowed when expressly authorised by law , carried out in the course of entering or performance of a contract , or when the data subject has given his consent . in any case , such processing should be subject to suitable safeguards , including specific information of the data subject and the right to obtain human intervention and that such measure should not concern a child . ### every natural person should have the right not to be subject to profiling or measures based on profiling by means of automated processing . however , such measure should be allowed when expressly authorised by law , carried out in the course of entering or performance of a contract , or when the data subject has given his consent . in any case , such processing should be subject to suitable safeguards , including specific information of the data subject . such measures should not lead to discrimination , concern children , or produce legal or significant effects for the data subject without human intervention .


### the delegation of power referred to in article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 336 ) , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 may be revoked at any time by the european parliament or by the council . a decision of revocation shall put an end to the delegation of power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force . ### the delegation of power referred to in article 7 , article 11 , article 12 , article 14 , article 17 , article 22 , article 31 , article 32 , article 33 , article 38 , article 39 , article 41 , article 41 , article 79 , article 81 and article 82 may be revoked at any time by the european parliament or by the council . a decision of revocation shall put an end to the delegation of power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force .


### the european data protection board shall issue an opinion on the matter , if the european data protection board so decides by simple majority of its members or any supervisory authority or the commission so requests within one week after the relevant information has been provided according to paragraph 5 . the opinion shall be adopted within one month by simple majority of the members of the european data protection board . the chair of the european data protection board shall inform , without undue delay , the supervisory authority referred to , as the case may be , in paragraphs 1 and 3 , the commission and the supervisory authority competent under article 51 of the opinion and make it public . ### the european data protection board shall issue an opinion on the matter , if the european data protection board so decides by simple majority of its members or any supervisory authority or the commission so requests within two weeks after the relevant information has been provided according to paragraph 5 . the opinion shall be adopted within two months by simple majority of the members of the european data protection board . the chair of the european data protection board shall inform , without undue delay , the supervisory authority referred to , as the case may be , in paragraphs 1 and 3 , the commission and the supervisory authorities competent under article 51 of the opinion and make it public .


### is carried out in the course of the entering into , or performance of , a contract , where the request for the entering into or the performance of the contract , lodged by the data subject , has been satisfied or where suitable measures to safeguard the data subject ' s legitimate interests have been adduced , such as the right to obtain human intervention ; or ### is necessary for the entering into , or performance of , a contract , where the request for the entering into or the performance of the contract , lodged by the data subject , has been satisfied , or where suitable measures to safeguard the data subject ' s legitimate interests have been adduced , such as the right to obtain human intervention ; or


### the commission may specify the format and procedures for mutual assistance referred to in this article and the arrangements for the exchange of information by electronic means between supervisory authorities , and between supervisory authorities and the european data protection board , in particular the standardised format referred to in paragraph 6 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the european data protection board may specify the format and procedures for mutual assistance referred to in this article and the arrangements for the exchange of information by electronic means between supervisory authorities , and between supervisory authorities and the european data protection board , in particular the standardised format referred to in paragraph 6 .


### the controller or processor acting on the controller ' s behalf shall consult the supervisory authority prior to the processing of personal data in order to ensure the compliance of the intended processing with this regulation and in particular to mitigate the risks involved for the data subjects where : ### the controller or processor acting on the controller ' s behalf shall consult the data protection officer or the supervisory authority prior to the processing of personal data in order to ensure the compliance of the intended processing with this regulation and in particular to mitigate the risks involved for the data subjects where :


### consent shall not provide a legal basis for the processing , where there is a significant imbalance between the position of the data subject and the controller . ### as a rule , consent shall not provide a legal basis for the processing , where there is a significant imbalance between the position of the data subject and the controller .


### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted in respect of lawfulness of processing ; specifying the criteria and conditions in relation to the consent of a child ; processing of special categories of data ; specifying the criteria and conditions for manifestly excessive requests and fees for exercising the rights of the data subject ; criteria and requirements for the information to the data subject and in relation to the right of access ; the right to be forgotten and to erasure ; measures based on profiling ; criteria and requirements in relation to the responsibility of the controller and to data protection by design and by default ; a processor ; criteria and requirements for the documentation and the security of processing ; criteria and requirements for establishing a personal data breach and for its notification to the supervisory authority , and on the circumstances where a personal data breach is likely to adversely affect the data subject ; the criteria and conditions for processing operations requiring a data protection impact assessment ; the criteria and requirements for determining a high degree of specific risks which require prior consultation ; designation and tasks of the data protection officer ; codes of conduct ; criteria and requirements for certification mechanisms ; criteria and requirements for transfers by way of binding corporate rules ; transfer derogations ; administrative sanctions ; processing for health purposes ; processing in the employment context and processing for historical , statistical and scientific research purposes . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council . ### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted specifying the technical standars to give consent ; specifyng conditions of icon - based mode for provision of information ; specifying the criteria and conditions for fees for exercising the rights of the data subject ; criteria and requirements for the information to the data subject and in relation to the right of access ; the right to be forgotten and to erasure ; criteria and requirements for verification of the responsibility of the controller ; criteria and requirements for establishing a personal data breach and for its notification to the supervisory authority , and on the circumstances where a personal data breach is likely to adversely affect the data subject ; the criteria and conditions for processing operations requiring a data protection impact assessment ; the criteria and requirements for determining a high degree of specific risks which require prior consultation ; codes of conduct ; criteria and requirements for certification mechanisms ; the adequate level of protection afforded by a third country or an international organisation ; administrative sanctions ; processing for health purposes ; processing in the employment context and processing for historical , statistical and scientific research purposes . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level in particular with the european data protection board . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council .


### a delegated act adopted pursuant to article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 336 ) , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or the council . ### a delegated act adopted pursuant to article 7 , article 11 , article 12 , article 14 , article 17 , article 22 , article 31 , article 32 , article 33 , article 38 , article 39 , article 41 , article 41 , article 79 , article 81 and article 82 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of four months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or the council .


### the chair of the european data protection board shall immediately electronically inform the members of the european data protection board and the commission of any relevant information which has been communicated to it , using a standardised format . the chair of the european data protection board shall provide translations of relevant information , where necessary . ### the chair of the european data protection board shall without undue delay electronically inform the members of the european data protection board and the commission of any relevant information which has been communicated to it , using a standardised format . the chair of the european data protection board shall provide translations of relevant information , where necessary .


### the information and the actions taken on requests referred to in paragraph 1 shall be free of charge . where requests are manifestly excessive , in particular because of their repetitive character , the controller may charge a fee for providing the information or taking the action requested , or the controller may not take the action requested . in that case , the controller shall bear the burden of proving the manifestly excessive character of the request . ### the information and the actions taken on requests referred to in paragraph 1 shall be free of charge . where requests are manifestly excessive , in particular because of their repetitive character , the controller may charge a reasonable fee for providing the information or taking the action requested . in that case , the controller shall bear the burden of proving the manifestly excessive character of the request .


### where an objection is upheld pursuant to paragraphs 1 and 2 , the controller shall no longer use or otherwise process the personal data concerned . ### where an objection is upheld pursuant to paragraphs 1 and 2 , the controller shall erase the personal data concerned .


### the european data protection board shall elect a chair and two deputy chairpersons from amongst its members . one deputy chairperson shall be the european data protection supervisor , unless he or she has been elected chair . ### the european data protection board shall elect a chair and at least two deputy chairpersons from amongst its members .


### to further strengthen the control over their own data and their right of access , data subjects should have the right , where personal data are processed by electronic means and in a structured and commonly used format , to obtain a copy of the data concerning them also in commonly used electronic format . the data subject should also be allowed to transmit those data , which they have provided , from one automated application , such as a social network , into another one . this should apply where the data subject provided the data to the automated processing system , based on their consent or in the performance of a contract ### to further strengthen the control over their own data and their right of access , data subjects should have the right , to obtain free of charge the data concerning them also in commonly used , interoperable , and where possible open source electronic format . the data subject should also be allowed to transmit those data , which they have provided , from one automated application , such as a social network , into another one . providers of information society services should not make the transfer of those data mandatory for the provision of their services . social networks should be encouraged as much as possible to store data in a way which permits efficient data portability for data subjects .


### where the appropriate safeguards with respect to the protection of personal data are not provided for in a legally binding instrument , the controller or processor shall obtain prior authorisation for the transfer , or a set of transfers , or for provisions to be inserted into administrative arrangements providing the basis for such transfer . such authorisation by the supervisory authority shall be in accordance with point of article 34 . if the transfer is related to processing activities which concern data subjects in another member state or other member states , or substantially affect the free movement of personal data within the union , the supervisory authority shall apply the consistency mechanism referred to in article 57 . authorisations by a supervisory authority on the basis of article 26 of directive 95 / 46 / ec shall remain valid , until amended , replaced or repealed by that supervisory authority . ### authorisations by a supervisory authority on the basis of article 26 of directive 95 / 46 / ec shall remain valid for two years after the entry into force of this regulation , or until amended , replaced or repealed by that supervisory authority .


### the general conditions for the members of the supervisory authority should be laid down by law in each member state and should in particular provide that those members should be either appointed by the parliament or the government of the member state , and include rules on the personal qualification of the members and the position of those members . ### the general conditions for the members of the supervisory authority should be laid down by law in each member state and should in particular provide that those members should be appointed by the parliament or the government after consultation of the parliament of the member state concerned taking due care to minimise the possibility of political interference , and include rules on the personal qualification of the members , the avoidance of conflicts of interest and the position of those members .


### right to be forgotten and to erasure ### right to erasure


### by competent authorities for the purposes of prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties . ### by competent public authorities for the purposes of prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties .


### in order to maintain security and to prevent processing in breach of this regulation , the controller or processor should evaluate the risks inherent to the processing and implement measures to mitigate those risks . these measures should ensure an appropriate level of security , taking into account the state of the art and the costs of their implementation in relation to the risks and the nature of the personal data to be protected . when establishing technical standards and organisational measures to ensure security of processing , the commission should promote technological neutrality , interoperability and innovation , and , where appropriate , cooperate with third countries . ### in order to maintain security and to prevent processing in breach of this regulation , the controller or processor should evaluate the risks inherent to the processing and implement measures to mitigate those risks . these measures should ensure an appropriate level of security , taking into account the state of the art and the costs of their implementation in relation to the risks and the nature of the personal data to be protected . when establishing technical standards and organisational measures to ensure security of processing , technological neutrality , interoperability and innovation should be promoted , and , where appropriate , third countries should be encouraged .


### automated processing of personal data intended to evaluate certain personal aspects relating to a natural person shall not be based solely on the special categories of personal data referred to in article 9 . ### profiling activities relating to a natural person shall not include or generate any data that fall under the special categories of personal data referred to in article 9 , except when falling within the exceptions listed in article 9 .


### where personal data are processed for direct marketing purposes , the data subject shall have the right to object free of charge to the processing of their personal data for such marketing . this right shall be explicitly offered to the data subject in an intelligible manner and shall be clearly distinguishable from other information . ### where personal data are processed based on article 6 , the data subject shall have the right to object free of charge in all cases to the processing of their personal data . this right shall be explicitly offered to the data subject in an intelligible manner , using clear and plain language , adapted to the data subject , in particular for any information addressed specifically to a child , and shall be clearly distinguishable from other information .


### the delegation of power referred to in article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 336 ) , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 may be revoked at any time by the european parliament or by the council . a decision of revocation shall put an end to the delegation of power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force . ### the delegation of power referred to in article 7 , article 11 , article 12 , article 14 , article 17 , article 22 , article 31 , article 32 , article 33 , article 38 , article 39 , article 41 , article 41 , article 79 , article 81 and article 82 may be revoked at any time by the european parliament or by the council . a decision of revocation shall put an end to the delegation of power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force .


### for the purposes of this regulation , in relation to the offering of information society services directly to a child , the processing of personal data of a child below the age of 13 years shall only be lawful if and to the extent that consent is given or authorised by the child ' s parent or custodian . the controller shall make reasonable efforts to obtain verifiable consent , taking into consideration available technology . ### for the purposes of this regulation , in relation to the offering of goods or services directly to a child , the processing of personal data of a child below the age of 13 years shall only be lawful if and to the extent that consent is given or authorised by the child ' s parent or legal representative . the controller shall make reasonable efforts to obtain verifiable consent , taking into consideration available technology . the methods to obtain verifiable consent shall not lead to the further processing of personal data which would otherwise not be necessary .


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying the criteria and requirements for establishing the data breach referred to in paragraphs 1 and 2 and for the particular circumstances in which a controller and a processor is required to notify the personal data breach . ### the commission shall be empowered to adopt , after requesting an opinion of the european data protection board , delegated acts in accordance with article 86 for the purpose of further specifying the criteria and requirements for establishing the data breach referred to in paragraphs 1 and 2 and for the particular circumstances in which a controller and a processor is required to notify the personal data breach .


### the general data protection principles , in particular purpose limitation , data quality , legal basis for the processing , processing of sensitive personal data ; measures to ensure data security ; and the requirements for onward transfers to organisations which are not bound by the policies ; ### the general data protection principles , in particular purpose limitation , data minimisation , limited retention periods , data quality , privacy by design and by default , legal basis for the processing , processing of sensitive personal data ; measures to ensure data security ; and the requirements for onward transfers to organisations which are not bound by the policies ;


### having regard to the state of the art and the cost of implementation , the controller shall , both at the time of the determination of the means for processing and at the time of the processing itself , implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject . ### having regard to the state of the art and the cost of implementation , the controller shall , both at the time of the determination of the purposes and means for processing and at the time of the processing itself , implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject , in particular with regard to the principles laid out in article 5 . where the controller has carried out a data protection impact assessment pursuant to article 33 , the results shall be taken into account when developing those measures and procedures .


### within the limits of this regulation , member states may adopt by law specific rules regulating the processing of employees ' personal data in the employment context , in particular for the purposes of the recruitment , the performance of the contract of employment , including discharge of obligations laid down by law or by collective agreements , management , planning and organisation of work , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship . ### member states may , in accordance with the rules set out in this regulation , and taking into account the principle of proportionality , adopt by legal provisions specific rules regulating the processing of employees ' personal data in the employment context , in particular but not limited to the purposes of the recruitment and job applications within the group of undertakings , the performance of the contract of employment , including discharge of obligations laid down by law and by collective agreements , company agreements and collective agreements in accordance with national law and practice , management , planning and organisation of work , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship . the level of protection afforded by this regulation may not be undercut . notwithstanding the previous sentence , where arrangements are made by agreement between employee representatives and the management of the undertaking or of the controlling undertaking of a group of undertakings the level of protection afforded by this regulation may not be significantly undercut . the right of member states , or the social partners via collective agreements , to provide employees with more favourable protection provisions in respect of the processing of personal data in the employment context shall remain unaffected .


### the supervisory authority referred to in paragraph 1 and the supervisory authority competent under article 51 shall take account of the opinion of the european data protection board and shall within two weeks after the information on the opinion by the chair of the european data protection board , electronically communicate to the chair of the european data protection board and to the commission whether it maintains or amends its draft measure and , if any , the amended draft measure , using a standardised format . ### the supervisory authority referred to in paragraph 1 and the supervisory authorities competent under article 51 shall take the utmost account of the opinions of the european data protection board and shall within two weeks after the information on the opinion by the chair of the european data protection board , electronically communicate to the chair of the european data protection board and to the commission whether it maintains or amends its draft measure and , if any , the amended draft measure , using a standardised format .


### the processing of personal data , revealing race or ethnic origin , political opinions , religion or beliefs , trade - union membership , and the processing of genetic data or data concerning health or sex life or criminal convictions or related security measures shall be prohibited . ### the processing of personal data , revealing race or ethnic origin , political opinions , religion or philosophical beliefs , sexual orientation or gender identity , trade - union membership and activities , and the processing of genetic data or data concerning health or sex life or criminal convictions , or related security measures shall be prohibited .


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying the criteria and requirements for the data protection certification mechanisms referred to in paragraph 1 , including conditions for granting and withdrawal , and requirements for recognition within the union and in third countries . ### the commission shall be empowered to adopt , after requesting an opinion of the european data protection board , delegated acts in accordance with article 86 for the purpose of further specifying the criteria and requirements for the data protection certification mechanisms referred to in paragraph 1 , including conditions for granting and withdrawal , and requirements for recognition and promotion within the union and in third countries .


### to inform and advise the controller or the processor of their obligations pursuant to this regulation and to document this activity and the responses received ; ### to inform and advise the controller or the processor of their obligations pursuant to this regulation , in particular with regards to technical and organisational measures and procedures , and to document this activity and the responses received ;


### personal data which are , by their nature , particularly sensitive and vulnerable in relation to fundamental rights or privacy , deserve specific protection . such data should not be processed , unless the data subject gives his explicit consent . however , derogations from this prohibition should be explicitly provided for in respect of specific needs , in particular where the processing is carried out in the course of legitimate activities by certain associations or foundations the purpose of which is to permit the exercise of fundamental freedoms . ### personal data which are , by their nature , particularly sensitive and vulnerable in relation to fundamental rights or privacy , deserve specific protection . such data should not be processed , unless the data subject gives his explicit and informed consent . however , derogations from this prohibition should be explicitly provided for in respect of specific needs , in particular where the processing is carried out in the course of legitimate activities by certain associations or foundations the purpose of which is to permit the exercise of fundamental freedoms by the data subjects in question .


### in order to ensure free consent , it should be clarified that consent does not provide a valid legal ground where the individual has no genuine and free choice and is subsequently not able to refuse or withdraw consent without detriment . ### in order to ensure free consent , it should be clarified that consent does not provide a valid legal ground where the individual has no genuine and free choice and is subsequently not able to refuse or withdraw consent without detriment . the use of default options which the data subject is required to modify to object to the processing , such as pre - ticked boxes , does not express free consent .


### the commission may decide that a third country , or a territory or a processing sector within that third country , or an international organisation does not ensure an adequate level of protection within the meaning of paragraph 2 of this article , in particular in cases where the relevant legislation , both general and sectoral , in force in the third country or international organisation , does not guarantee effective and enforceable rights including effective administrative and judicial redress for data subjects , in particular for those data subjects residing in the union whose personal data are being transferred . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 , or , in cases of extreme urgency for individuals with respect to their right to personal data protection , in accordance with the procedure referred to in article 87 . ### the commission shall be empowered to adopt delegated acts in accordance with article 86 to decide that a third country , or a territory within that third country , or an international organisation does not ensure an adequate level of protection within the meaning of paragraph 2 of this article , in particular in cases where the relevant legislation in force in the third country or international organisation , does not guarantee effective and enforceable rights including effective administrative and judicial redress for data subjects , in particular for those data subjects residing in the union whose personal data are being transferred .


### the monitoring of their behaviour . ### the monitoring of such data subjects .


### each supervisory authority must draw up an annual report on its activities . the report shall be presented to the national parliament and shall be made be available to the public , the commission and the european data protection board . ### each supervisory authority must draw up a report on its activities at least every two years . the report shall be presented to the national parliament and shall be made be available to the public , the commission and the european data protection board .


### is carried out in the course of the entering into , or performance of , a contract , where the request for the entering into or the performance of the contract , lodged by the data subject , has been satisfied or where suitable measures to safeguard the data subject ' s legitimate interests have been adduced , such as the right to obtain human intervention ; or ### is necessary for the entering into , or performance of , a contract , where the request for the entering into or the performance of the contract , lodged by the data subject , has been satisfied , or where suitable measures to safeguard the data subject ' s legitimate interests have been adduced , such as the right to obtain human intervention ; or


### in particular , any legislative measure referred to in paragraph 1 shall contain specific provisions at least as to the objectives to be pursued by the processing and the determination of the controller . ### in particular , any legislative measure referred to in paragraph 1 must be necessary and proportionate in a democratic society and shall contain specific provisions at least as to : the objectives to be pursued by the processing ; the determination of the controller ; the specific purposes and means of processing ; the categories of persons authorised to process the data ; the procedure to be followed for the processing ; the safeguards to prevent abuse ; the right of data subjects to be informed about the restriction .


### at union level , a european data protection board should be set up . it should replace the working party on the protection of individuals with regard to the processing of personal data established by directive 95 / 46 / ec . it should consist of a head of a supervisory authority of each member state and of the european data protection supervisor . the commission should participate in its activities . the european data protection board should contribute to the consistent application of this regulation throughout the union , including by advising the commission and promoting cooperation of the supervisory authorities throughout the union . the european data protection board should act independently when exercising its tasks . ### at union level , a european data protection board should be set up . it should replace the working party on the protection of individuals with regard to the processing of personal data established by directive 95 / 46 / ec . it should consist of a head of a supervisory authority of each member state and of the european data protection supervisor . the commission should participate in its activities . the european data protection board should contribute to the consistent application of this regulation throughout the union , including by advising the institutions of the european union and promoting cooperation of the supervisory authorities throughout the union , including the coordination of joint operations . the european data protection board should act independently when exercising its tasks .


### the controller or the processor shall designate a data protection officer for a period of at least two years . the data protection officer may be reappointed for further terms . during their term of office , the data protection officer may only be dismissed , if the data protection officer no longer fulfils the conditions required for the performance of their duties . ### the controller or the processor shall designate a data protection officer for a period of at least four years . during their term of office , the data protection officer may only be dismissed if the data protection officer no longer fulfils the conditions required for the performance of their duties .


### the delegation of power referred to in article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 336 ) , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 may be revoked at any time by the european parliament or by the council . a decision of revocation shall put an end to the delegation of power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force . ### the delegation of power referred to in article 7 , article 11 , article 12 , article 14 , article 17 , article 22 , article 31 , article 32 , article 33 , article 38 , article 39 , article 41 , article 41 , article 79 , article 81 and article 82 may be revoked at any time by the european parliament or by the council . a decision of revocation shall put an end to the delegation of power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force .


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying : ### the commission shall be empowered to adopt , after requesting an opinion of the european data protection board , delegated acts in accordance with article 86 for the purpose of further specifying :


### the general principles on the protection of individuals with regard to the processing of personal data should also be applicable to the employment context . therefore , in order to regulate the processing of employees ' personal data in the employment context , member states should be able , within the limits of this regulation , to adopt by law specific rules for the processing of personal data in the employment sector . ### the general principles on the protection of individuals with regard to the processing of personal data should also be applicable to the employment and the social security context . therefore , in order to regulate the processing of employees ' personal data in the employment context , member states should be able , in accordance with this regulation , to adopt by law specific rules for the processing of personal data in the employment sector .


### when using online services , individuals may be associated with online identifiers provided by their devices , applications , tools and protocols , such as internet protocol addresses or cookie identifiers . this may leave traces which , combined with unique identifiers and other information received by the servers , may be used to create profiles of the individuals and identify them . it follows that identification numbers , location data , online identifiers or other specific factors as such need not necessarily be considered as personal data in all circumstances . ### when using online services , individuals may be associated with one or more online identifiers provided by their devices , applications , tools and protocols , such as internet protocol addresses , cookie identifiers and other unique identifiers . since such identifiers leave traces and can be used to single out natural persons , this regulation should be applicable to processing involving such data , unless those identifiers demonstrably do no relate to natural persons , such as for example the ip addresses used by companies , which cannot be considered as ' personal data ' as defined in this regulation .


### access to any of its premises , including to any data processing equipment and means , where there are reasonable grounds for presuming that an activity in violation of this regulation is being carried out there . ### access to any of its premises , including to any data processing equipment and means .


### the processing of personal data solely for journalistic purposes , or for the purposes of artistic or literary expression should qualify for exemption from the requirements of certain provisions of this regulation in order to reconcile the right to the protection of personal data with the right to freedom of expression , and notably the right to receive and impart information , as guaranteed in particular by article 11 of the charter of fundamental rights of the european union . this should apply in particular to processing of personal data in the audiovisual field and in news archives and press libraries . therefore , member states should adopt legislative measures , which should lay down exemptions and derogations which are necessary for the purpose of balancing these fundamental rights . such exemptions and derogations should be adopted by the member states on general principles , on the rights of the data subject , on controller and processor , on the transfer of data to third countries or international organisations , on the independent supervisory authorities and on co - operation and consistency . this should not , however , lead member states to lay down exemptions from the other provisions of this regulation . in order to take account of the importance of the right to freedom of expression in every democratic society , it is necessary to interpret notions relating to that freedom , such as journalism , broadly . therefore , member states should classify activities as ' journalistic ' for the purpose of the exemptions and derogations to be laid down under this regulation if the object of these activities is the disclosure to the public of information , opinions or ideas , irrespective of the medium which is used to transmit them . they should not be limited to media undertakings and may be undertaken for profit - making or for non - profit making purposes . ### whenever necessary , exemptions or derogations from the requirements of certain provisions of this regulation for the processing of personal data should be possible in order to reconcile the right to the protection of personal data with the right to freedom of expression , and notably the right to receive and impart information , as guaranteed in particular by article 11 of the charter of fundamental rights of the european union . this should apply in particular to processing of personal data in the audiovisual field and in news archives and press libraries . therefore , member states should adopt legislative measures , which should lay down exemptions and derogations which are necessary for the purpose of balancing these fundamental rights . such exemptions and derogations should be adopted by the member states on general principles , on the rights of the data subject , on controller and processor , on the transfer of data to third countries or international organisations , on the independent supervisory authorities and on co - operation and consistency . this should not , however , lead member states to lay down exemptions from the other provisions of this regulation . in order to take account of the importance of the right to freedom of expression in every democratic society , it is necessary to interpret notions relating to that freedom , such as journalism , broadly .


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying the criteria and requirements for the methods to obtain verifiable consent referred to in paragraph 1 . in doing so , the commission shall consider specific measures for micro , small and medium - sized enterprises . ### the european data protection board shall be entrusted with the task of further specifying the criteria and requirements for the methods to obtain verifiable consent referred to in paragraph 1 , in accordance with article 66 .


### the controller or the processor shall support the data protection officer in performing the tasks and shall provide staff , premises , equipment and any other resources necessary to carry out the duties and tasks referred to in article 37 . ### the controller or the processor shall support the data protection officer in performing the tasks and shall provide all means , including staff , premises , equipment and any other resources necessary to carry out the duties and tasks referred to in article 37 , and to maintain his or her professional knowledge .


### advise the commission on any issue related to the protection of personal data in the union , including on any proposed amendment of this regulation ; ### advise the european institutions on any issue related to the protection of personal data in the union , including on any proposed amendment of this regulation ;


### the examination procedure should be used for the adoption of specifying standard forms in relation to the consent of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access the right to data portability ; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation ; specific requirements for the security of processing ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; standards and procedures for a data protection impact assessment ; forms and procedures for prior authorisation and prior consultation ; technical standards and mechanisms for certification ; the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation ; disclosures not authorized by union law ; mutual assistance ; joint operations ; decisions under the consistency mechanism , given that those acts are of general scope . ### the examination procedure should be used for the adoption of specifying standard procedures and forms in relation to the consent of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; forms for prior authorisation and prior consultation ; standard form for notification of decision of third country requesting disclosure of the personal data ; format and procedures for the exchange of information by electronic means on binding corporate rules ; decisions under the consistency mechanism , given that those acts are of general scope .


### a delegated act adopted pursuant to article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 336 ) , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or the council . ### a delegated act adopted pursuant to article 7 , article 11 , article 12 , article 14 , article 17 , article 22 , article 31 , article 32 , article 33 , article 38 , article 39 , article 41 , article 41 , article 79 , article 81 and article 82 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of four months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or the council .


### the commission may specify the format and procedures for mutual assistance referred to in this article and the arrangements for the exchange of information by electronic means between supervisory authorities , and between supervisory authorities and the european data protection board , in particular the standardised format referred to in paragraph 6 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the european data protection board may specify the format and procedures for mutual assistance referred to in this article and the arrangements for the exchange of information by electronic means between supervisory authorities , and between supervisory authorities and the european data protection board , in particular the standardised format referred to in paragraph 6 .


### within the limits of this regulation , member states may adopt by law specific rules regulating the processing of employees ' personal data in the employment context , in particular for the purposes of the recruitment , the performance of the contract of employment , including discharge of obligations laid down by law or by collective agreements , management , planning and organisation of work , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship . ### member states may , in accordance with the rules set out in this regulation , and taking into account the principle of proportionality , adopt by legal provisions specific rules regulating the processing of employees ' personal data in the employment context , in particular but not limited to the purposes of the recruitment and job applications within the group of undertakings , the performance of the contract of employment , including discharge of obligations laid down by law and by collective agreements , company agreements and collective agreements in accordance with national law and practice , management , planning and organisation of work , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship . the level of protection afforded by this regulation may not be undercut . notwithstanding the previous sentence , where arrangements are made by agreement between employee representatives and the management of the undertaking or of the controlling undertaking of a group of undertakings the level of protection afforded by this regulation may not be significantly undercut . the right of member states , or the social partners via collective agreements , to provide employees with more favourable protection provisions in respect of the processing of personal data in the employment context shall remain unaffected .


### the commission may decide that a third country , or a territory or a processing sector within that third country , or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the commission shall be empowered to adopt delegated acts in accordance with article 86 to decide that a third country , or a territory within that third country , or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 .


### in particular , any legislative measure referred to in paragraph 1 shall contain specific provisions at least as to the objectives to be pursued by the processing and the determination of the controller . ### in particular , any legislative measure referred to in paragraph 1 must be necessary and proportionate in a democratic society and shall contain specific provisions at least as to : the objectives to be pursued by the processing ; the determination of the controller ; the specific purposes and means of processing ; the categories of persons authorised to process the data ; the procedure to be followed for the processing ; the safeguards to prevent abuse ; the right of data subjects to be informed about the restriction .


### the assessment shall contain at least a general description of the envisaged processing operations , an assessment of the risks to the rights and freedoms of data subjects , the measures envisaged to address the risks , safeguards , security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this regulation , taking into account the rights and legitimate interests of data subjects and other persons concerned . ### the assessment shall contain at least a systematic description of the envisaged processing operations and their necessity and proportionality in relation to the purpose , an assessment of the risks to the rights and freedoms of data subjects , the measures envisaged to address the risks and minimise the volume of personal data which is processed , safeguards , security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this regulation , taking into account the rights and legitimate interests of data subjects and other persons concerned .


### the commission may set out standard forms and procedures for prior authorisations and consultations referred to in paragraphs 1 and 2 , and standard forms and procedures for informing the supervisory authorities pursuant to paragraph 6 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the commission may set out standard forms for prior authorisations and consultations referred to in paragraphs 1 and 2 , and standard forms for informing the supervisory authorities pursuant to paragraph 6 . those implementing acts shall be adopted , after requesting an opinion of the european data protection board , in accordance with the examination procedure referred to in article 87 .


### where the commission has taken no decision pursuant to article 41 , a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has adduced appropriate safeguards with respect to the protection of personal data in a legally binding instrument . ### where the commission has taken no decision pursuant to article 41 , a controller or processor may not transfer personal data to a third country , territory or an international organisation unless the controller or processor has adduced appropriate safeguards with respect to the protection of personal data in a legally binding instrument .


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying other reasons of public interest in the area of public health as referred to in point of paragraph 1 , as well as criteria and requirements for the safeguards for the processing of personal data for the purposes referred to in paragraph 1 . ### the commission shall be empowered to adopt , after requesting an opinion of the european data protection board , delegated acts in accordance with article 86 for the purpose of further specifying other reasons of public interest in the area of public health as referred to in point of paragraph 1 , as well as criteria and requirements for the safeguards for the processing of personal data for the purposes referred to in paragraph 1 .


### the commission may decide that a third country , or a territory or a processing sector within that third country , or an international organisation does not ensure an adequate level of protection within the meaning of paragraph 2 of this article , in particular in cases where the relevant legislation , both general and sectoral , in force in the third country or international organisation , does not guarantee effective and enforceable rights including effective administrative and judicial redress for data subjects , in particular for those data subjects residing in the union whose personal data are being transferred . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 , or , in cases of extreme urgency for individuals with respect to their right to personal data protection , in accordance with the procedure referred to in article 87 . ### the commission shall be empowered to adopt delegated acts in accordance with article 86 to decide that a third country , or a territory within that third country , or an international organisation does not ensure an adequate level of protection within the meaning of paragraph 2 of this article , in particular in cases where the relevant legislation in force in the third country or international organisation , does not guarantee effective and enforceable rights including effective administrative and judicial redress for data subjects , in particular for those data subjects residing in the union whose personal data are being transferred .


### the supervisory authority referred to in paragraph 1 and the supervisory authority competent under article 51 shall take account of the opinion of the european data protection board and shall within two weeks after the information on the opinion by the chair of the european data protection board , electronically communicate to the chair of the european data protection board and to the commission whether it maintains or amends its draft measure and , if any , the amended draft measure , using a standardised format . ### the supervisory authority referred to in paragraph 1 and the supervisory authorities competent under article 51 shall take the utmost account of the opinions of the european data protection board and shall within two weeks after the information on the opinion by the chair of the european data protection board , electronically communicate to the chair of the european data protection board and to the commission whether it maintains or amends its draft measure and , if any , the amended draft measure , using a standardised format .


### within the limits of this regulation and in accordance with point of article 9 , processing of personal data concerning health must be on the basis of union law or member state law which shall provide for suitable and specific measures to safeguard the data subject ' s legitimate interests , and be necessary for : ### in accordance with the rules set out in this regulation , in particular with point of article 9 , processing of personal data concerning health must be on the basis of union law or member state law which shall provide for suitable and specific measures to safeguard the data subject ' s interests and fundamental rights , and be necessary for :


### processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller in the field of employment law in so far as it is authorised by union law or member state law providing for adequate safeguards ; or ### processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller in the field of employment law in so far as it is authorised by union law or member state law providing for adequate safeguards for the fundamental rights and the interests of the data subject ; or


### the data subject requests to transmit the personal data into another automated processing system in accordance with article 18 . ### the data subject requests to transmit the personal data into another automated processing system in accordance with article 15 and 2a .


### examine , on its own initiative or on request of one of its members or on request of the commission , any question covering the application of this regulation and issue guidelines , recommendations and best practices addressed to the supervisory authorities in order to encourage consistent application of this regulation ; ### examine , on its own initiative or on request of one of its members or on request of the european parliament , the council or the commission , any question covering the application of this regulation and issue guidelines , recommendations and best practices addressed to the supervisory authorities in order to encourage consistent application of this regulation , including on the use of enforcement powers ;


### personal data referred to in paragraph 4 may , with the exception of storage , only be processed for purposes of proof , or with the data subject ' s consent , or for the protection of the rights of another natural or legal person or for an objective of public interest . ### personal data referred to in paragraph 4 may , with the exception of storage , only be processed for purposes of proof , or with the data subject ' s consent , or for the protection of the rights of another natural or legal person or for compliance with a legal obligation to process the personal data by the union or national law to which the controller is subject .


### to further strengthen the control over their own data and their right of access , data subjects should have the right , where personal data are processed by electronic means and in a structured and commonly used format , to obtain a copy of the data concerning them also in commonly used electronic format . the data subject should also be allowed to transmit those data , which they have provided , from one automated application , such as a social network , into another one . this should apply where the data subject provided the data to the automated processing system , based on their consent or in the performance of a contract ### to further strengthen the control over their own data and their right of access , data subjects should have the right , to obtain free of charge the data concerning them also in commonly used , interoperable , and where possible open source electronic format . the data subject should also be allowed to transmit those data , which they have provided , from one automated application , such as a social network , into another one . providers of information society services should not make the transfer of those data mandatory for the provision of their services . social networks should be encouraged as much as possible to store data in a way which permits efficient data portability for data subjects .


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying ' important grounds of public interest ' within the meaning of point of paragraph 1 as well as the criteria and requirements for appropriate safeguards referred to in point of paragraph 1 . ### the european data protection board shall be entrusted with the task of further specifying the criteria and requirements for appropriate safeguards referred to in point of paragraph 1 , in accordance with article 66 .


### in order to ensure compliance with this regulation , the commission may adopt an opinion on this matter , or a decision , requiring the supervisory authority to suspend its draft measure . ### in order to ensure compliance with this regulation , the commission may adopt an opinion on matters raised . the commission may appeal to the court of justice of the european union . it may request the court to suspend the measure in the course of an urgency procedure , if necessary to avoid irreparable damage .


### the recipients or categories of recipients to whom the personal data are to be or have been disclosed , in particular to recipients in third countries ; ### the recipients to whom the personal data are to be or have been disclosed , including to recipients in third countries ;


### comprehensive responsibility and liability of the controller for any processing of personal data carried out by the controller or on the controller ' s behalf should be established . in particular , the controller should ensure and be obliged to demonstrate the compliance of each processing operation with this regulation . ### comprehensive responsibility and liability of the controller for any processing of personal data carried out by the controller or on the controller’s behalf should be established in order to ensure accountability . in particular , the controller should ensure and be able to demonstrate the compliance of each processing operation with this regulation .


### where processing is based on the data subject ' s consent , the controller should have the burden of proving that the data subject has given the consent to the processing operation . in particular in the context of a written declaration on another matter , safeguards should ensure that the data subject is aware that and to what extent consent is given . ### where processing is based on the data subject’s consent , the controller should have the burden of proving that the data subject has given the consent to the processing operation . in particular in the context of a written declaration on another matter , safeguards should ensure that the data subject is aware that and to what extent consent is given . to comply with the principle of data minimisation , the burden of proof should not be understood as requiring the positive identification of data subjects unless necessary .


### the implementing act shall specify its geographical and sectoral application , and , where applicable , identify the supervisory authority mentioned in point of paragraph 2 . ### the delegated act shall specify its territorial application , and identify the supervisory authority mentioned in point of paragraph 2 .


### the core activities of the controller or the processor consist of processing operations which , by virtue of their nature , their scope and / or their purposes , require regular and systematic monitoring of data subjects . ### the core activities of the controller or the processor consist of processing operations which , by virtue of their nature , their scope and / or their purposes , require regular and systematic monitoring or profiling of data subjects .


### decisions adopted by the commission on the basis of article 25 or article 26 of directive 95 / 46 / ec shall remain in force , until amended , replaced or repealed by the commission . ### decisions adopted by the commission on the basis of article 25 or article 26 of directive 95 / 46 / ec shall remain in force until two years after the entry into force of this regulation .


### the european data protection board shall issue an opinion on the matter , if the european data protection board so decides by simple majority of its members or any supervisory authority or the commission so requests within one week after the relevant information has been provided according to paragraph 5 . the opinion shall be adopted within one month by simple majority of the members of the european data protection board . the chair of the european data protection board shall inform , without undue delay , the supervisory authority referred to , as the case may be , in paragraphs 1 and 3 , the commission and the supervisory authority competent under article 51 of the opinion and make it public . ### the european data protection board shall issue an opinion on the matter , if the european data protection board so decides by simple majority of its members or any supervisory authority or the commission so requests within two weeks after the relevant information has been provided according to paragraph 5 . the opinion shall be adopted within two months by simple majority of the members of the european data protection board . the chair of the european data protection board shall inform , without undue delay , the supervisory authority referred to , as the case may be , in paragraphs 1 and 3 , the commission and the supervisory authorities competent under article 51 of the opinion and make it public .


### the protection of the rights and freedoms of data subjects with regard to the processing of personal data require that appropriate technical and organisational measures are taken , both at the time of the design of the processing and at the time of the processing itself , to ensure that the requirements of this regulation are met . in order to ensure and demonstrate compliance with this regulation , the controller should adopt internal policies and implement appropriate measures , which meet in particular the principles of data protection by design and data protection by default . ### the protection of the rights and freedoms of data subjects with regard to the processing of personal data require that appropriate technical and organizational measures are taken , both at the time of the design of the processing and at the time of the processing itself , to ensure that the requirements of this regulation are met . in order to ensure and demonstrate compliance with this regulation , the controller should adopt internal policies and implement appropriate measures , which meet in particular the principles of data protection by design and data protection by default . the principle of data protection by design require data protection to be embedded within the entire life cycle of the technology , from the very early design stage , right through to its ultimate deployment , use and final disposal . the principle of data protection by default requires privacy settings on services and products which should by default comply with the general principles of data protection , such as data minimisation and purpose limitation .


### the supervisory authority referred to in paragraph 1 and the supervisory authority competent under article 51 shall take account of the opinion of the european data protection board and shall within two weeks after the information on the opinion by the chair of the european data protection board , electronically communicate to the chair of the european data protection board and to the commission whether it maintains or amends its draft measure and , if any , the amended draft measure , using a standardised format . ### the supervisory authority referred to in paragraph 1 and the supervisory authorities competent under article 51 shall take the utmost account of the opinions of the european data protection board and shall within two weeks after the information on the opinion by the chair of the european data protection board , electronically communicate to the chair of the european data protection board and to the commission whether it maintains or amends its draft measure and , if any , the amended draft measure , using a standardised format .


### a delegated act adopted pursuant to article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 336 ) , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or the council . ### a delegated act adopted pursuant to article 7 , article 11 , article 12 , article 14 , article 17 , article 22 , article 31 , article 32 , article 33 , article 38 , article 39 , article 41 , article 41 , article 79 , article 81 and article 82 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of four months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or the council .