### the union shall provide , upon request , political and technical support to member states in their bilateral negotiations with non - union neighbouring countries including candidate and acceding countries , to resolve spectrum coordination issues that prevent member states from implementing their obligations under union law regarding spectrum policy and management . the union shall also support efforts by third countries to implement spectrum management that is compatible with that of the union , so as to safeguard union spectrum policy objectives . ### the union shall provide , upon request , political and technical support to member states in their bilateral negotiations with non - union neighbouring countries including candidate and acceding countries , to eliminate harmful interferences and disturbances and resolve spectrum coordination issues that prevent member states from implementing their obligations under union law regarding spectrum policy and management . the union shall also support efforts by third countries to implement spectrum management that is compatible with that of the union , so as to safeguard union spectrum policy objectives .


### member states , in cooperation with the commission , shall ensure that the provision of access to broadband content and services using the 790 - 862 mhz band is encouraged in sparsely populated areas , in particular through coverage obligations ; in doing so , they shall examine ways and , where necessary , take appropriate measures to ensure that the freeing of the 800 mhz band does not adversely affect programme making and special events users . ### member states , in cooperation with the commission , shall ensure that the provision of access to broadband services using the 790 - 862 mhz band is encouraged in sparsely populated areas , in particular through coverage obligations ; member - states in cooperation with the commission shall examine ways and , where appropriate , take technical and regulatory measures to ensure that sufficient spectrum is available for programme making and special events users . the commission should encourage member states to ensure the timely availability of sufficient funds to cover the direct migration costs and the direct costs associated with the protection of pmse and broadcasting services .


### if necessary , the commission shall ensure that sufficient spectrum is made available under harmonised conditions to support the development of safety services and the free circulation of related devices as well as the development of innovative interoperable solutions for public safety and protection , civil protection and disaster relief . ### in cooperation with the commission , member states shall ensure that sufficient spectrum is made available under harmonised conditions to support the development of safety services and the free circulation of related devices as well as the development of innovative interoperable solutions for public safety and protection , civil protection and disaster relief . the spectrum used for radio broadcasting shall not be affected .


### ensuring the optimal use of spectrum may require innovative authorisation solutions such as collective use of spectrum , general authorisations or infrastructure sharing . the application of such principles in the union might be facilitated by the definition of certain common or converging conditions for spectrum usage . general authorisations , which are the least onerous authorisation system , are of particular interest where interference does not risk hampering the development of other services . ### ensuring the optimal and productive use of spectrum may require innovative authorisation solutions such as collective use of spectrum , general authorisations , auctions or infrastructure sharing . the application of such principles in the union might be facilitated by identifying best practices and encouraging information sharing , as well as the definition of certain common or converging conditions for spectrum usage . general authorisations , which are the most appropriate and least onerous authorisation system , are of particular interest where interference does not risk hampering the development of other services .


### the first programme should specify guiding principles and objectives up to 2015 for member states and union institutions , and set out specific implementation initiatives . while spectrum management is still largely a national competence , it should be exercised in compliance with existing union law and allow for action to pursue union policies . ### the first programme should specify guiding principles and objectives up to 2015 for member states and union institutions , and set out specific implementation initiatives . spectrum management is a national competence and must be exercised in compliance with existing eu law and allow for measures to be adopted to pursue an union spectrum policy . pursuant to article 8a of the framework directive , member states are required to cooperate with one another and with the commission in connection with the strategic planning , coordination and harmonisation of spectrum use .


### member states shall maintain and promote effective competition and avoid distortions of competition in the internal market or in a substantial part of it . ### member states shall maintain and promote effective competition and avoid distortions of competition in both the internal market and specific national markets .


### member states shall , by 1 january 2013 make the 800 mhz band available for electronic communications services in line with the harmonised technical conditions laid down pursuant to the decision no 676 / 2002 / ec . in member states where exceptional national or local circumstances would prevent the availability of the band , the commission may authorise specific derogations until 2015 . in accordance with article 9 of directive 2002 / 21 / ec , the commission , in cooperation with the member states , shall keep under review the use of the spectrum below 1ghz and assess whether additional spectrum could be freed and made available for new applications . ### member states shall , by 17 june 2015 make the 800 mhz band available for electronic communications services in line with the harmonised technical conditions laid down pursuant to the decision no 676 / 2002 / ec . in member states where the digital switchover process is already well advanced or completed and where the migration of incumbent services can be managed on time , the commission recommends to make the band available by 1 january 2013 .


### the first programme should specify guiding principles and objectives up to 2015 for member states and union institutions , and set out specific implementation initiatives . while spectrum management is still largely a national competence , it should be exercised in compliance with existing union law and allow for action to pursue union policies . ### the first programme should specify guiding principles and objectives up to 2015 for member states and union institutions , and set out specific implementation initiatives . spectrum management is a national competence . it should be carried out in a manner consistent with existing union law and should allow for action to pursue a union spectrum policy . pursuant to article 8a of the framework directive , member states are required only to cooperate with one another and with the commission in connection with the strategic planning , coordination and harmonisation of spectrum use .


### guaranteeing the functioning of the internal market , in particular by ensuring effective competition . ### promoting the functioning of the internal market , in particular by fostering effective competition .


### where the appropriate safeguards with respect to the protection of personal data are not provided for in a legally binding instrument , the controller or processor shall obtain prior authorisation for the transfer , or a set of transfers , or for provisions to be inserted into administrative arrangements providing the basis for such transfer . such authorisation by the supervisory authority shall be in accordance with point of article 34 . if the transfer is related to processing activities which concern data subjects in another member state or other member states , or substantially affect the free movement of personal data within the union , the supervisory authority shall apply the consistency mechanism referred to in article 57 . authorisations by a supervisory authority on the basis of article 26 of directive 95 / 46 / ec shall remain valid , until amended , replaced or repealed by that supervisory authority . ### authorisations by a supervisory authority on the basis of article 26 of directive 95 / 46 / ec shall remain valid for two years after the entry into force of this regulation , or until amended , replaced or repealed by that supervisory authority .


### in cases where data subjects in several member states are likely to be affected by processing operations , a supervisory authority of each of those member states shall have the right to participate in the joint investigative tasks or joint operations , as appropriate . the competent supervisory authority shall invite the supervisory authority of each of those member states to take part in the respective joint investigative tasks or joint operations and respond to the request of a supervisory authority to participate in the operations without delay . ### in cases where the controller or processor has establishments in several member states or where data subjects in several member states are likely to be affected by processing operations , a supervisory authority of each of those member states shall have the right to participate in the joint investigative tasks or joint operations , as appropriate . the lead authority as defined in article 54a shall invite the supervisory authority of each of those member states to take part in the respective joint investigative tasks or joint operations and respond to the request of a supervisory authority to participate in the operations without delay . the lead authority shall act as the single contact point for the controller or processor .


### the controller or processor shall designate the data protection officer on the basis of professional qualities and , in particular , expert knowledge of data protection law and practices and ability to fulfil the tasks referred to in article 37 . the necessary level of expert knowledge shall be determined in particular according to the data processing carried out and the protection required for the personal data processed by the controller or the processor . ### the controller or processor shall , after obtaining the approval of the representatives of the business ' s employees , designate the data protection officer on the basis of professional qualities and , in particular , expert knowledge of data protection law and practices and ability to fulfil the tasks referred to in article 37 . the necessary level of expert knowledge shall be determined in particular according to the data processing carried out and the protection required for the personal data processed by the controller or the processor . the controller or processor shall ensure that the data protection officer has the opportunity for further training and in - service training at their expense .


### is expressly authorized by a union or member state law which also lays down suitable measures to safeguard the data subject ' s legitimate interests ; or ### is expressly authorized by a union or member state law and which protects the data subjects legitimate interests and protects against possible discrimination resulting from measures described in paragraph 1 ;


### points , and of paragraph 1 shall not apply to activities carried out by public authorities in the exercise of their public powers . ### points and of paragraph 1 shall not apply to activities carried out by public authorities in the exercise of their public powers .


### the commission may adopt implementing acts for deciding that the codes of conduct and amendments or extensions to existing codes of conduct submitted to it pursuant to paragraph 3 have general validity within the union . those implementing acts shall be adopted in accordance with the examination procedure set out in article 87 . ### the commission shall be empowered to adopt , after requesting an opinion of the european data protection board , delegated acts in accordance with article 86 for deciding that the codes of conduct and amendments or extensions to existing codes of conduct submitted to it pursuant to paragraph 3 are in line with this regulation and have general validity within the union . this delegated act shall confer enforceable rights on data subjects .


### the processing of personal data solely for journalistic purposes , or for the purposes of artistic or literary expression should qualify for exemption from the requirements of certain provisions of this regulation in order to reconcile the right to the protection of personal data with the right to freedom of expression , and notably the right to receive and impart information , as guaranteed in particular by article 11 of the charter of fundamental rights of the european union . this should apply in particular to processing of personal data in the audiovisual field and in news archives and press libraries . therefore , member states should adopt legislative measures , which should lay down exemptions and derogations which are necessary for the purpose of balancing these fundamental rights . such exemptions and derogations should be adopted by the member states on general principles , on the rights of the data subject , on controller and processor , on the transfer of data to third countries or international organisations , on the independent supervisory authorities and on co - operation and consistency . this should not , however , lead member states to lay down exemptions from the other provisions of this regulation . in order to take account of the importance of the right to freedom of expression in every democratic society , it is necessary to interpret notions relating to that freedom , such as journalism , broadly . therefore , member states should classify activities as ‘ journalistic’ for the purpose of the exemptions and derogations to be laid down under this regulation if the object of these activities is the disclosure to the public of information , opinions or ideas , irrespective of the medium which is used to transmit them . they should not be limited to media undertakings and may be undertaken for profit - making or for non - profit making purposes . ### whenever necessary , exemptions or derogations from the requirements of certain provisions of this regulation for the processing of personal data should be possible in order to reconcile the right to the protection of personal data with the right to freedom of expression , and notably the right to receive and impart information , as guaranteed in particular by article 11 of the charter of fundamental rights of the european union . this should apply in particular to processing of personal data in the audiovisual field and in news archives and press libraries . in accordance with the protocol on the system of public broadcasting in the member states annexed treaty on european union , the treaties establishing the european communities and certain related acts , the competence of member states to define and organize public service broadcasting shall also be respected in the field of data protection . therefore , member states should adopt legislative measures , which should lay down exemptions and derogations which are necessary for the purpose of balancing these fundamental rights . such exemptions and derogations should be adopted by the member states on general principles , on the rights of the data subject , on controller and processor , on the transfer of data to third countries or international organisations , on the independent supervisory authorities and on co - operation and consistency . this should not , however , lead member states to lay down exemptions from the other provisions of this regulation . in order to take account of the importance of the right to freedom of expression in every democratic society , it is necessary to interpret notions relating to that freedom , such as journalism , broadly .


### the controller shall implement mechanisms for ensuring that , by default , only those personal data are processed which are necessary for each specific purpose of the processing and are especially not collected or retained beyond the minimum necessary for those purposes , both in terms of the amount of the data and the time of their storage . in particular , those mechanisms shall ensure that by default personal data are not made accessible to an indefinite number of individuals . ### the controller shall ensure that , by default , only those personal data are processed which are necessary for each specific purpose of the processing and are especially not collected or retained beyond the minimum necessary for those purposes , both in terms of the amount of the data and the time of their storage . in particular , those mechanisms shall ensure that by default personal data are not made accessible to an indefinite number of individuals and that data subjects are able to control the distribution of their personal data ; pseudonymisation shall be used where possible .


### the criteria and requirements for the application of paragraph 1 for specific sectors and in specific data processing situations ; ### the conditions for deleting links , copies or applications of personal data from publicly available communication services as referred to in paragraph 2 ;


### member states shall provide for exemptions or derogations from the provisions on the general principles in chapter ii , the rights of the data subject in chapter iii , on controller and processor in chapter iv , on the transfer of personal data to third countries and international organisations in chapter v , the independent supervisory authorities in chapter vi and on co - operation and consistency in chapter vii for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression . ### member states shall provide for exemptions or derogations from the provisions on the general principles in chapter ii , the rights of the data subject in chapter iii , on controller and processor in chapter iv , on the transfer of personal data to third countries and international organisations in chapter v , the independent supervisory authorities in chapter vi and on co - operation and consistency in chapter vii whenever it is necessary in order to reconcile the right to the protection of personal data with the rules governing freedom of expression in accordance with the charter of fundamental rights of the european union .


### the recipients or categories of recipients to whom the personal data are to be or have been disclosed , in particular to recipients in third countries ; ### the recipients to whom the personal data are to be or have been disclosed , including to recipients in third countries ;


### the commission may lay down standard forms and specifying standard procedures for the communication referred to in paragraph 2 , including the electronic format . in doing so , the commission shall take the appropriate measures for micro , small and medium - sized enterprises . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the commission may lay down standard forms for the communication referred to in paragraph 2 , including the electronic format . in doing so , the commission shall take the appropriate measures for micro , small and medium - sized enterprises . those implementing acts shall be adopted after adopting an opinion of the european data protection board , in accordance with the examination procedure referred to in article 87 . if the commission invokes its prerogatives under article 10 of regulation 2012 / 1025 it shall ensure adequate representation of micro , small and medium sized enterprises , consumer groups and agreement of the european data protection board with the use of these industry standards for the purposes of this regulation .


### the data subject shall have the right to withdraw his or her consent at any time . the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal . ### the data subject shall have the right to withdraw his or her consent at any time . the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal . the option of withdrawing consent shall be made as easily accessible and shall involve the same level of practical difficulty attached to the granting of consent .


### to inform and advise the controller or the processor of their obligations pursuant to this regulation and to document this activity and the responses received ; ### to raise awareness , to inform and advise the controller or the processor of their obligations pursuant to this regulation and to document this activity and the responses received ;


### ' data subject ' means an identified natural person or a natural person who can be identified , directly or indirectly , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to an identification number , location data , online identifier or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural or social identity of that person ; ### ' data subject ' means an identified or identifiable natural person who can be identified , directly or indirectly , by technically available means reasonably likely to be used by the controller or by any other natural or legal person , where the use of such means does not entail excessive costs , is not overly time - consuming and does not require complex actions to be taken ;


### member states shall provide for exemptions or derogations from the provisions on the general principles in chapter ii , the rights of the data subject in chapter iii , on controller and processor in chapter iv , on the transfer of personal data to third countries and international organisations in chapter v , the independent supervisory authorities in chapter vi and on co - operation and consistency in chapter vii for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression . ### chapter ii , chapter iii , chapter iv , chapter v , chapter vi , , chapter vii as well as articles 73 , 74 , 76 and 79 of chapter viii shall not apply to the processing of personal data carried out for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression .


### where personal data are processed for direct marketing purposes , the data subject shall have the right to object free of charge to the processing of their personal data for such marketing . this right shall be explicitly offered to the data subject in an intelligible manner and shall be clearly distinguishable from other information . ### processing of personal data for direct marketing purposes shall require the explicit consent of the data subject . the data shall not be given to third parties . a withdrawal of consent shall be possible at all times and free of charge . this right shall be explicitly offered to the data subject in an intelligible manner and shall be clearly distinguishable from other information .


### is expressly authorized by a union or member state law which also lays down suitable measures to safeguard the data subject ' s legitimate interests ; or ### is expressly authorized by a union or member state law and which protects the data subjects legitimate interests and protects against possible discrimination resulting from measures described in paragraph 1 ; or


### the commission may decide that a third country , or a territory or a processing sector within that third country , or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the commission shall be empowered to adopt delegated acts in accordance with article 86 to decide that a third country , or a territory within that third country , or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 .


### the controller shall implement mechanisms for ensuring that , by default , only those personal data are processed which are necessary for each specific purpose of the processing and are especially not collected or retained beyond the minimum necessary for those purposes , both in terms of the amount of the data and the time of their storage . in particular , those mechanisms shall ensure that by default personal data are not made accessible to an indefinite number of individuals . ### where the data subject is given a choice regarding the processing of personal data , the controller shall ensure that , by default , only those personal data are processed which are necessary for each specific purpose of the processing and are especially not collected or retained beyond the minimum necessary for those purposes , both in terms of the amount of the data and the time of their storage . in particular , those mechanisms shall ensure that by default personal data are not made accessible to an indefinite number of individuals and that data subjects are able to control the distribution of their personal data .


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of updating the amounts of the administrative fines referred to in paragraphs 4 , 5 and 6 , taking into account the criteria referred to in paragraph 2 . ### the commission shall be empowered to adopt , after requesting an opinion of the european data protection board , delegated acts in accordance with article 86 for the purpose of updating the absolute amounts of the administrative fines referred to in paragraphs 4 , 5 and 6 , taking into account the criteria referred to in paragraph 2 and the development of standard costs of living .


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying the criteria , conditions and appropriate safeguards for the processing of the special categories of personal data referred to in paragraph 1 and the exemptions laid down in paragraph 2 . ### the european data protection board shall be entrusted with the task of further specifying the criteria , conditions and appropriate safeguards for the processing of special categories of personal data referred to in paragraph 1 and the exemptions laid down in paragraph 2 , in accordance with article 66 .


### the assessment shall contain at least a general description of the envisaged processing operations , an assessment of the risks to the rights and freedoms of data subjects , the measures envisaged to address the risks , safeguards , security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this regulation , taking into account the rights and legitimate interests of data subjects and other persons concerned . ### the assessment shall contain at least a description of the envisaged processing operations and their necessity and proportionality in relation to the purpose ; an assessment of the risks to the rights and freedoms of data subjects ; the measures envisaged to address the risks and minimise the volume of personal data which is processed ; safeguards , security measures and mechanisms to ensure the protection of personal data , such as pseydonymisation , and to demonstrate compliance with this regulation , taking into account the rights and legitimate interests of data subjects and other persons concerned .


### processing is necessary for the purposes of the legitimate interests pursued by a controller , except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data , in particular where the data subject is a child . this shall not apply to processing carried out by public authorities in the performance of their tasks . ### points to do not apply , but processing is necessary for the purposes of predominant legitimate interests pursued by a controller and these interests are overriding the interests or fundamental rights and freedoms of the data subject . this shall not apply to processing carried out by public authorities in the performance of their tasks .


### supervisory authorities shall provide each other relevant information and mutual assistance in order to implement and apply this regulation in a consistent manner , and shall put in place measures for effective co - operation with one another . mutual assistance shall cover , in particular , information requests and supervisory measures , such as requests to carry out prior authorisations and consultations , inspections and prompt information on the opening of cases and ensuing developments where data subjects in several member states are likely to be affected by processing operations . ### supervisory authorities shall provide each other relevant information and mutual assistance in order to implement and apply this regulation in a consistent manner , and shall put in place measures for effective co - operation with one another . mutual assistance shall cover , in particular , information requests and supervisory measures , such as requests to carry out prior authorisations and consultations , inspections and prompt information on the opening of cases and ensuing developments where the controller or processor has establishments in several member states or where data subjects in several member states are likely to be affected by processing operations . the lead authority as defined in article 54a shall ensure the coordination with involved supervisory authorities and shall act as the single contact point for the controller or processor .


### for the purposes of this regulation , in relation to the offering of information society services directly to a child , the processing of personal data of a child below the age of 13 years shall only be lawful if and to the extent that consent is given or authorised by the child ' s parent or custodian . the controller shall make reasonable efforts to obtain verifiable consent , taking into consideration available technology . ### for the purposes of this regulation , in relation to the offering of goods or services directly to a child , the processing of personal data of a child below the age of 13 years shall only be lawful if and to the extent that consent is given or authorised by the child ' s parent or legal representative . the controller shall make reasonable efforts to obtain verifiable consent , taking into consideration available technology . the methods to obtain verifiable consent shall not lead to the further processing of personal data which would otherwise not be necessary .


### the data subject shall have the right to object , on grounds relating to their particular situation , at any time to the processing of personal data which is based on points , and of article 6 , unless the controller demonstrates compelling legitimate grounds for the processing which override the interests or fundamental rights and freedoms of the data subject . ### the data subject shall have the right to object at any time to the processing of personal data which is based on points and of article 6 .


### personal data must be : processed lawfully , fairly and in a transparent manner in relation to the data subject ; ### personal data shall be : processed lawfully , fairly and in a transparent manner in relation to the data subject ;


### the member states and the commission shall encourage , in particular at european level , the establishment of data protection certification mechanisms and of data protection seals and marks , allowing data subjects to quickly assess the level of data protection provided by controllers and processors . the data protection certifications mechanisms shall contribute to the proper application of this regulation , taking account of the specific features of the various sectors and different processing operations . 2 . the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying the criteria and requirements for the data protection certification mechanisms referred to in paragraph 1 , including conditions for granting and withdrawal , and requirements for recognition within the union and in third countries . 3 . the commission may lay down technical standards for certification mechanisms and data protection seals and marks and mechanisms to promote and recognize certification mechanisms and data protection seals and marks . those implementing acts shall be adopted in accordance with the examination procedure set out in article 87 . ### the controller and the processor shall enrol in a certification system of an accredited control body in any case where : an enterprise processing personal data relating to fewer than 500 data subjects per year , or processing special categories of personal data as referred to in article 9 ; or the core activities of the controller or the processor consist of processing operations which , by virtue of their nature , their scope and / or their purposes , require regular and systematic monitoring of data subjects . other controllers and processors as well as products and services can equally undergo certification . 2 . the controller and the processor must undergo certification before the first processing of personal data , or when it first falls under paragraph 1 and must be subsequently recertified at least every year . they must inform data subjects about the certification . 3 . certificates must be acquired by an accredited control body at the main establishment of the controller , processor , producer or supplier , or in the member state in which the representative is situated . 3a . the control body shall have the investigative power to obtain from the enrolled controller or the processor : access to all personal data and to all information necessary for the performance of its duties ; full access to any of its premises , including to any data processing equipment and means . 3b . certificates must reasonably assure that the controller , processor , service or product is in compliance with all aspects of this regulation . a product , service or processor used by the controller or processor must not be taken into account in the certification process if it is itself holding a valid certificate . 3c . certificates may be found invalid by the competent authority or the control body if the controller , processor , product or service is found to be incompliant with this regulation . 3d . the control body must inform the competent supervisory authority about acquired and revoked certificates in an electronic form . it must also inform the supervisory authority about any potential violation of this regulation is has found during the certification procedure . 3e . the commission shall be empowered to adopt delegated acts after consulting the european data protection board and in accordance with article 86 , which define the exact frequency , control procedures and content of controls taking into account the different risks of processing operations , controllers , processors , products and services as well as the details of certificates .


### the controller or the processor shall designate a data protection officer for a period of at least two years . the data protection officer may be reappointed for further terms . during their term of office , the data protection officer may only be dismissed , if the data protection officer no longer fulfils the conditions required for the performance of their duties . ### the controller or the processor shall designate a data protection officer for a period of at least four years . the data protection officer may be reappointed for further terms . during their term of office , the data protection officer may only be dismissed if the data protection officer no longer fulfils the conditions required for the performance of their duties .


### the delegation of power referred to in article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 336 ) , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation . ### the delegation of power referred to in [ articles xxx ] shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation .


### the information and the actions taken on requests referred to in paragraph 1 shall be free of charge . where requests are manifestly excessive , in particular because of their repetitive character , the controller may charge a fee for providing the information or taking the action requested , or the controller may not take the action requested . in that case , the controller shall bear the burden of proving the manifestly excessive character of the request . ### the information and the actions taken on requests referred to in paragraph 1 shall be free of charge . where requests are manifestly excessive , in particular because of their repetitive character , the controller may charge a reasonable fee taking into account the administrative costs for providing the information or taking the action requested . in that case , the controller shall bear the burden of proving the manifestly excessive character of the request .


### the period for which the personal data will be stored ; ### the criteria and / or legal requirements for determining the period for which the personal data will be stored for each purpose ;


### kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ; personal data may be stored for longer periods insofar as the data will be processed solely for historical , statistical or scientific research purposes in accordance with the rules and conditions of article 83 and if a periodic review is carried out to assess the necessity to continue the storage ; ### kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ; personal data may be stored for longer periods insofar as the data will be processed solely for historical , statistical or scientific purposes in accordance with the rules and conditions of article 83 and if a periodic review is carried out to assess the necessity to continue the storage ;


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying the criteria and conditions for the technical and organisational measures referred to in paragraphs 1 and 2 , including the determinations of what constitutes the state of the art , for specific sectors and in specific data processing situations , in particular taking account of developments in technology and solutions for privacy by design and data protection by default , unless paragraph 4 applies . ### the european data protection board shall be entrusted with the task of further specifying the criteria and conditions for the technical and organisational measures referred to in paragraphs 1 and 2 , including the determinations of what constitutes the state of the art , for specific sectors and in specific data processing situations , in particular taking account of developments in technology and solutions for privacy by design and data protection by default , unless paragraph 4 applies , in accordance with article 66 .


### for the purposes of this regulation , in relation to the offering of information society services directly to a child , the processing of personal data of a child below the age of 13 years shall only be lawful if and to the extent that consent is given or authorised by the child ' s parent or custodian . the controller shall make reasonable efforts to obtain verifiable consent , taking into consideration available technology . ### for the purposes of this regulation , in relation to the offering of goods or services directly to a child , the processing of personal data of a child below the age of 13 years shall only be lawful if and to the extent that consent is given or authorised by the child ' s parent or legal guardian . the controller shall make reasonable efforts to obtain verifiable consent , taking into consideration available technology . the methods to obtain verifiable consent shall not lead to the further processing of personal data which would otherwise not be necessary .


### in particular , any legislative measure referred to in paragraph 1 shall contain specific provisions at least as to the objectives to be pursued by the processing and the determination of the controller . ### in particular , any legislative measure referred to in paragraph 1 must be necessary and proportionate in a democratic society and shall contain specific provisions at least as to : the objectives to be pursued by the processing ; the determination of the controller ; the specific purposes and means of processing ; the categories of persons authorised to process the data ; the procedure to be followed for the processing ; the safeguards to prevent abuse ; the right of data subjects to be informed about the restriction .


### is expressly authorized by a union or member state law which also lays down suitable measures to safeguard the data subject ' s legitimate interests ; or ### is authorized by a union or member state law which also lays down suitable measures to safeguard the data subject ' s legitimate interests and fundamental rights , including the right to non - discrimination ; or


### the controller shall implement mechanisms to ensure the verification of the effectiveness of the measures referred to in paragraphs 1 and 2 . if proportionate , this verification shall be carried out by independent internal or external auditors . ### the controller shall be able to demonstrate the effectiveness of the measures referred to in paragraphs 1 and 2 . if proportionate , this shall be verified by independent internal or external auditors .


### the supervisory authority shall impose a fine up to 500 000 eur , or in case of an enterprise up to 1 % of its annual worldwide turnover , to anyone who , intentionally or negligently : does not provide the information , or does provide incomplete information , or does not provide the information in a sufficiently transparent manner , to the data subject pursuant to article 11 , article 12 and article 14 ; does not provide access for the data subject or does not rectify personal data pursuant to articles 15 and 16 or does not communicate the relevant information to a recipient pursuant to article 13 ; does not comply with the right to be forgotten or to erasure , or fails to put mechanisms in place to ensure that the time limits are observed or does not take all necessary steps to inform third parties that a data subjects requests to erase any links to , or copy or replication of the personal data pursuant article 17 ; does not provide a copy of the personal data in electronic format or hinders the data subject to transmit the personal data to another application in violation of article 18 ; does not or not sufficiently determine the respective responsibilities with co - controllers pursuant to article 24 ; does not or not sufficiently maintain the documentation pursuant to article 28 , article 31 , and article 44 ; does not comply , in cases where special categories of data are not involved , pursuant to articles 80 , 82 and 83 with rules in relation to freedom of expression or with rules on the processing in the employment context or with the conditions for processing for historical , statistical and scientific research purposes . ### the supervisory authority shall impose a fine that shall not exceed 500 000 eur , or in case of an enterprise 2 % of its annual worldwide turnover to anyone who intentionally or negligently infringes articles 11 , 12 and , 13 , 14 , 15 , 16 , 17 , 18 , 24 , 28 , 31 , 44 , 80 , 82 , 83 .


### member states shall provide for exemptions or derogations from the provisions on the general principles in chapter ii , the rights of the data subject in chapter iii , on controller and processor in chapter iv , on the transfer of personal data to third countries and international organisations in chapter v , the independent supervisory authorities in chapter vi and on co - operation and consistency in chapter vii for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression . ### chapter ii , chapter iii , chapter iv , chapter v , chapter vi , , chapter vii as well as articles 73 , 74 , 76 and 79 of chapter viii shall not apply to the processing of personal data carried out for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression .


### the european data protection board shall issue an opinion on the matter , if the european data protection board so decides by simple majority of its members or any supervisory authority or the commission so requests within one week after the relevant information has been provided according to paragraph 5 . the opinion shall be adopted within one month by simple majority of the members of the european data protection board . the chair of the european data protection board shall inform , without undue delay , the supervisory authority referred to , as the case may be , in paragraphs 1 and 3 , the commission and the supervisory authority competent under article 51 of the opinion and make it public . ### the european data protection board shall issue an opinion on the matter , if the european data protection board so decides by simple majority of its members or any supervisory authority or the commission so requests within two weeks after the relevant information has been provided according to paragraph 5 . the opinion shall be adopted within two months by simple majority of the members of the european data protection board . the chair of the european data protection board shall inform , without undue delay , the supervisory authority referred to , as the case may be , in paragraphs 1 and 3 , the commission and the supervisory authorities competent under article 51 of the opinion and make it public .


### the commission may specify the format and procedures for mutual assistance referred to in this article and the arrangements for the exchange of information by electronic means between supervisory authorities , and between supervisory authorities and the european data protection board , in particular the standardised format referred to in paragraph 6 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the european data protection board may specify the format and procedures for mutual assistance referred to in this article and the arrangements for the exchange of information by electronic means between supervisory authorities , and between supervisory authorities and the european data protection board , in particular the standardised format referred to in paragraph 6 .


### the information and the actions taken on requests referred to in paragraph 1 shall be free of charge . where requests are manifestly excessive , in particular because of their repetitive character , the controller may charge a fee for providing the information or taking the action requested , or the controller may not take the action requested . in that case , the controller shall bear the burden of proving the manifestly excessive character of the request . ### the information and the actions taken on requests referred to in paragraph 1 shall be free of charge . where requests are manifestly excessive , in particular because of their repetitive character , the controller may charge a reasonable fee for providing the information or taking the action requested . in that case , the controller shall bear the burden of proving the manifestly excessive character of the request .


### any supervisory authority or the european data protection board may request that any matter shall be dealt with in the consistency mechanism , in particular where a supervisory authority does not submit a draft measure referred to in paragraph 2 or does not comply with the obligations for mutual assistance in accordance with article 55 or for joint operations in accordance with article 56 . ### any supervisory authority or the european data protection board may request that any matter shall be dealt with in the consistency mechanism , in particular where the competent authority does not submit a draft measure referred to in paragraph 2 or does not comply with the obligations for mutual assistance in accordance with article 55 or for joint operations in accordance with article 56 .


### the european data protection board shall elect a chair and two deputy chairpersons from amongst its members . one deputy chairperson shall be the european data protection supervisor , unless he or she has been elected chair . ### the european data protection board shall elect a chair and at least two deputy chairpersons from amongst its members .


### the law of the member state must meet an objective of public interest or must be necessary to protect the rights and freedoms of others , respect the essence of the right to the protection of personal data and be proportionate to the legitimate aim pursued . ### such laws shall provide for suitable measures to safeguard the data subject ' s legitimate interests , must meet an objective of public interest or must be necessary to protect the rights and freedoms of others , be proportionate to the legitimate aim pursued and necessary in a democratic society .


### where the appropriate safeguards with respect to the protection of personal data are not provided for in a legally binding instrument , the controller or processor shall obtain prior authorisation for the transfer , or a set of transfers , or for provisions to be inserted into administrative arrangements providing the basis for such transfer . such authorisation by the supervisory authority shall be in accordance with point of article 34 . if the transfer is related to processing activities which concern data subjects in another member state or other member states , or substantially affect the free movement of personal data within the union , the supervisory authority shall apply the consistency mechanism referred to in article 57 . authorisations by a supervisory authority on the basis of article 26 of directive 95 / 46 / ec shall remain valid , until amended , replaced or repealed by that supervisory authority . ### authorisations by a supervisory authority on the basis of article 26 of directive 95 / 46 / ec shall remain valid for two years after the entry into force of this regulation , or until amended , replaced or repealed by that supervisory authority .


### the member states and the commission shall encourage , in particular at european level , the establishment of data protection certification mechanisms and of data protection seals and marks , allowing data subjects to quickly assess the level of data protection provided by controllers and processors . the data protection certifications mechanisms shall contribute to the proper application of this regulation , taking account of the specific features of the various sectors and different processing operations . 2 . the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying the criteria and requirements for the data protection certification mechanisms referred to in paragraph 1 , including conditions for granting and withdrawal , and requirements for recognition within the union and in third countries . 3 . the commission may lay down technical standards for certification mechanisms and data protection seals and marks and mechanisms to promote and recognize certification mechanisms and data protection seals and marks . those implementing acts shall be adopted in accordance with the examination procedure set out in article 87 . ### the controller and the processor shall enrol in a certification system of an accredited control body in any case where : an enterprise processing personal data relating to fewer than 500 data subjects per year , or processing special categories of personal data as referred to in article 9 ; or the core activities of the controller or the processor consist of processing operations which , by virtue of their nature , their scope and / or their purposes , require regular and systematic monitoring of data subjects . other controllers and processors as well as products and services can equally undergo certification . 2 . the controller and the processor must undergo certification before the first processing of personal data , or when it first falls under paragraph 1 and must be subsequently recertified at least every year . they must inform data subjects about the certification . 3 . certificates must be acquired by an accredited control body at the main establishment of the controller , processor , producer or supplier , or in the member state in which the representative is situated . 3a . the control body shall have the investigative power to obtain from the enrolled controller or the processor : access to all personal data and to all information necessary for the performance of its duties ; full access to any of its premises , including to any data processing equipment and means . 3b . certificates must reasonably assure that the controller , processor , service or product is in compliance with all aspects of this regulation . a product , service or processor used by the controller or processor must not be taken into account in the certification process if it is itself holding a valid certificate . 3c . certificates may be found invalid by the competent authority or the control body if the controller , processor , product or service is found to be incompliant with this regulation . 3d . the control body must inform the competent supervisory authority about acquired and revoked certificates in an electronic form . it must also inform the supervisory authority about any potential violation of this regulation is has found during the certification procedure . 3e . the commission shall be empowered to adopt delegated acts after consulting the european data protection board and in accordance with article 86 , which define the exact frequency , control procedures and content of controls taking into account the different risks of processing operations , controllers , processors , products and services as well as the details of certificates .


### member states shall provide for exemptions or derogations from the provisions on the general principles in chapter ii , the rights of the data subject in chapter iii , on controller and processor in chapter iv , on the transfer of personal data to third countries and international organisations in chapter v , the independent supervisory authorities in chapter vi and on co - operation and consistency in chapter vii for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression . ### chapter ii , chapter iii , chapter iv , chapter v , chapter vi , chapter vii as well as articles 73 , 74 , 76 and 79 of chapter viii shall not apply to the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression .


### right to be forgotten and to erasure ### right to erasure


### by competent authorities for the purposes of prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties . ### by competent public authorities for the purposes of prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties .


### the supervisory authority shall impose a fine up to 500 000 eur , or in case of an enterprise up to 1 % of its annual worldwide turnover , to anyone who , intentionally or negligently : does not provide the information , or does provide incomplete information , or does not provide the information in a sufficiently transparent manner , to the data subject pursuant to article 11 , article 12 and article 14 ; does not provide access for the data subject or does not rectify personal data pursuant to articles 15 and 16 or does not communicate the relevant information to a recipient pursuant to article 13 ; does not comply with the right to be forgotten or to erasure , or fails to put mechanisms in place to ensure that the time limits are observed or does not take all necessary steps to inform third parties that a data subjects requests to erase any links to , or copy or replication of the personal data pursuant article 17 ; does not provide a copy of the personal data in electronic format or hinders the data subject to transmit the personal data to another application in violation of article 18 ; does not or not sufficiently determine the respective responsibilities with co - controllers pursuant to article 24 ; does not or not sufficiently maintain the documentation pursuant to article 28 , article 31 , and article 44 ; does not comply , in cases where special categories of data are not involved , pursuant to articles 80 , 82 and 83 with rules in relation to freedom of expression or with rules on the processing in the employment context or with the conditions for processing for historical , statistical and scientific research purposes . ### the supervisory authority shall impose a fine up to 500 000 eur , or in case of an enterprise up to 2 % of its annual worldwide turnover whatever is higher , , to anyone who , intentionally or negligently , infringes articles 11 , 12 and , 13 , 14 , 15 , 16 , 17 , 18 , 24 , 28 , 31 , 44 , 80 , 82 , 83 .


### the communication to the data subject referred to in paragraph 1 shall describe the nature of the personal data breach and contain at least the information and the recommendations provided for in points and of article 31 . ### the communication to the data subject referred to in paragraph 1 shall describe the nature of the personal data breach and contain at least the information and the recommendations provided for in points , and of article 31 .


### the data are not collected from the data subject and the provision of such information proves impossible or would involve a disproportionate effort ; or ### the data are not collected from the data subject and the provision of such information proves impossible or would involve a disproportionate effort and the controller has published the information for anyone to retrieve ; or


### where the commission has taken no decision pursuant to article 41 , a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has adduced appropriate safeguards with respect to the protection of personal data in a legally binding instrument . ### where the commission has taken no decision pursuant to article 41 , a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has adduced appropriate safeguards with respect to the protection of personal data in a legally binding instrument . these appropriate safeguards shall : guarantee the observance of the principles of personal data processing as established in article 5 ; guarantee data subject rights as established in chapter iii . a consultation of the responsible data protection authority in such cases is mandatory .


### for the purposes of this regulation , in relation to the offering of information society services directly to a child , the processing of personal data of a child below the age of 13 years shall only be lawful if and to the extent that consent is given or authorised by the child ' s parent or custodian . the controller shall make reasonable efforts to obtain verifiable consent , taking into consideration available technology . ### for the purposes of this regulation , in relation to the offering of goods or services directly to a child , the processing of personal data of a child below the age of 13 years shall only be lawful if and to the extent that consent is given or authorised by the child ' s parent or legal representative . the controller shall make reasonable efforts to obtain verifiable consent , taking into consideration available technology . the methods to obtain verifiable consent shall not lead to the further processing of personal data which would otherwise not be necessary .


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying the criteria and requirements for establishing the data breach referred to in paragraphs 1 and 2 and for the particular circumstances in which a controller and a processor is required to notify the personal data breach . ### the commission shall be empowered to adopt , after requesting an opinion of the european data protection board , delegated acts in accordance with article 86 for the purpose of further specifying the criteria and requirements for establishing the data breach referred to in paragraphs 1 and 2 and for the particular circumstances in which a controller and a processor is required to notify the personal data breach .


### within the limits of this regulation , member states may adopt by law specific rules regulating the processing of employees ' personal data in the employment context , in particular for the purposes of the recruitment , the performance of the contract of employment , including discharge of obligations laid down by law or by collective agreements , management , planning and organisation of work , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship . ### member states may , in accordance with the rules set out in this regulation , and taking into account the principle of proportionality , adopt by legal provisions specific rules regulating the processing of employees ' personal data in the employment context , in particular but not limited to the purposes of the recruitment and job applications within the group of undertakings , the performance of the contract of employment , including discharge of obligations laid down by law and by collective agreements , company agreements and collective agreements in accordance with national law and practice , management , planning and organisation of work , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship . the level of protection afforded by this regulation may not be undercut . notwithstanding the previous sentence , where arrangements are made by agreement between employee representatives and the management of the undertaking or of the controlling undertaking of a group of undertakings the level of protection afforded by this regulation may not be significantly undercut . the right of member states , or the social partners via collective agreements , to provide employees with more favourable protection provisions in respect of the processing of personal data in the employment context shall remain unaffected .


### the supervisory authority referred to in paragraph 1 and the supervisory authority competent under article 51 shall take account of the opinion of the european data protection board and shall within two weeks after the information on the opinion by the chair of the european data protection board , electronically communicate to the chair of the european data protection board and to the commission whether it maintains or amends its draft measure and , if any , the amended draft measure , using a standardised format . ### the supervisory authority referred to in paragraph 1 and the supervisory authorities competent under article 51 shall take the utmost account of the opinions of the european data protection board and shall within two weeks after the information on the opinion by the chair of the european data protection board , electronically communicate to the chair of the european data protection board and to the commission whether it maintains or amends its draft measure and , if any , the amended draft measure , using a standardised format .


### the processing of personal data , revealing race or ethnic origin , political opinions , religion or beliefs , trade - union membership , and the processing of genetic data or data concerning health or sex life or criminal convictions or related security measures shall be prohibited . ### the processing of personal data , revealing race or ethnic origin , political opinions , religion or philosophical beliefs , sexual orientation or gender identity , trade - union membership and activities , and the processing of genetic data or data concerning health or sex life or criminal convictions , or related security measures shall be prohibited .


### the assessment shall contain at least a general description of the envisaged processing operations , an assessment of the risks to the rights and freedoms of data subjects , the measures envisaged to address the risks , safeguards , security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this regulation , taking into account the rights and legitimate interests of data subjects and other persons concerned . ### the assessment shall contain at least a description of the envisaged processing operations and their necessity and proportionality in relation to the purpose ; an assessment of the risks to the rights and freedoms of data subjects ; the measures envisaged to address the risks and minimise the volume of personal data which is processed ; safeguards , security measures and mechanisms to ensure the protection of personal data , such as pseydonymisation , and to demonstrate compliance with this regulation , taking into account the rights and legitimate interests of data subjects and other persons concerned .


### the controller shall inform the data subject without delay and , at the latest within one month of receipt of the request , whether or not any action has been taken pursuant to article 13 and articles 15 to 19 and shall provide the requested information . this period may be prolonged for a further month , if several data subjects exercise their rights and their cooperation is necessary to a reasonable extent to prevent an unnecessary and disproportionate effort on the part of the controller . the information shall be given in writing . where the data subject makes the request in electronic form , the information shall be provided in electronic form , unless otherwise requested by the data subject . ### the controller shall inform the data subject without delay and , at the latest within one month of receipt of the request , whether or not any action has been taken pursuant to article 13 and articles 15 to 19 and shall provide the requested information . this period may be prolonged for a further month , if several data subjects exercise their rights and their cooperation is necessary to a reasonable extent to prevent an unnecessary and disproportionate effort on the part of the controller . the information shall be provided in writing or in electronic form , however requested by the data subject .


### the controller or processor shall designate the data protection officer on the basis of professional qualities and , in particular , expert knowledge of data protection law and practices and ability to fulfil the tasks referred to in article 37 . the necessary level of expert knowledge shall be determined in particular according to the data processing carried out and the protection required for the personal data processed by the controller or the processor . ### the controller or processor shall , after obtaining the approval of the representatives of the business ' s employees , designate the data protection officer on the basis of professional qualities and , in particular , expert knowledge of data protection law and practices and ability to fulfil the tasks referred to in article 37 . the necessary level of expert knowledge shall be determined in particular according to the data processing carried out and the protection required for the personal data processed by the controller or the processor . the controller or processor shall ensure that the data protection officer has the opportunity for further training and in - service training at their expense .


### the conditions for deleting links , copies or replications of personal data from publicly available communication services as referred to in paragraph 2 ; ### the criteria and conditions for restricting the processing of personal data referred to in paragraph 4 ;


### having regard to the state of the art and the cost of implementation , the controller shall , both at the time of the determination of the means for processing and at the time of the processing itself , implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject . ### having regard to the latest technological developments , the cost of their implementation and the current state of the art , the controller shall , both at the time of the determination of the means for processing and at the time of the processing itself , implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject .


### any person who has suffered damage as a result of an unlawful processing operation or of an action incompatible with this regulation shall have the right to receive compensation from the controller or the processor for the damage suffered . ### any person who has suffered material or immaterial damage as a result of an unlawful processing operation , including blacklisting , or of an action incompatible with this regulation shall have the right to receive compensation from the controller or the processor for the damage suffered and for any emotional injury .


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying the criteria and requirements for the methods to obtain verifiable consent referred to in paragraph 1 . in doing so , the commission shall consider specific measures for micro , small and medium - sized enterprises . ### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of laying down standard forms for specific methods to obtain verifiable consent referred to in paragraph 1 .


### adequate , relevant , and limited to the minimum necessary in relation to the purposes for which they are processed ; they shall only be processed if , and as long as , the purposes could not be fulfilled by processing information that does not involve personal data ; ### adequate , relevant , and not excessive in relation to the purposes for which they are processed ; they shall only be processed if , and as long as , the purposes could not be fulfilled by processing information that does not involve personal data ;


### the commission may decide that a third country , or a territory or a processing sector within that third country , or an international organisation does not ensure an adequate level of protection within the meaning of paragraph 2 of this article , in particular in cases where the relevant legislation , both general and sectoral , in force in the third country or international organisation , does not guarantee effective and enforceable rights including effective administrative and judicial redress for data subjects , in particular for those data subjects residing in the union whose personal data are being transferred . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 , or , in cases of extreme urgency for individuals with respect to their right to personal data protection , in accordance with the procedure referred to in article 87 . ### the commission shall be empowered to adopt delegated acts in accordance with article 86 to decide that a third country , or a territory within that third country , or an international organisation does not ensure an adequate level of protection within the meaning of paragraph 2 of this article , in particular in cases where the relevant legislation in force in the third country or international organisation , does not guarantee effective and enforceable rights including effective administrative and judicial redress for data subjects , in particular for those data subjects residing in the union whose personal data are being transferred .


### the controller or processor shall ensure that the data protection officer performs the duties and tasks independently and does not receive any instructions as regards the exercise of the function . the data protection officer shall directly report to the management of the controller or the processor . ### the data protection organisation or data protection officer shall perform his or her tasks independently and shall directly report to the executive management of the controller or the processor .


### each supervisory authority must draw up an annual report on its activities . the report shall be presented to the national parliament and shall be made be available to the public , the commission and the european data protection board . ### each supervisory authority must draw up a report on its activities at least every two years . the report shall be presented to the national parliament and shall be made be available to the public , the commission and the european data protection board .


### in particular , any legislative measure referred to in paragraph 1 shall contain specific provisions at least as to the objectives to be pursued by the processing and the determination of the controller . ### in particular , any legislative measure referred to in paragraph 1 must be necessary and proportionate in a democratic society and shall contain specific provisions at least as to : the objectives to be pursued by the processing ; the determination of the controller ; the specific purposes and means of processing ; the categories of persons authorised to process the data ; the procedure to be followed for the processing ; the safeguards to prevent abuse ; the right of data subjects to be informed about the restriction .


### the delegation of power referred to in article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 33 , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 may be revoked at any time by the european parliament or by the council . a decision of revocation shall put an end to the delegation of power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force . ### the delegation of power referred to in [ articles xxx ] may be revoked at any time by the european parliament or by the council . a decision of revocation shall put an end to the delegation of power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force .


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying : ### the commission shall be empowered to adopt , after requesting an opinion of the european data protection board , delegated acts in accordance with article 86 for the purpose of further specifying :


### the general principles on the protection of individuals with regard to the processing of personal data should also be applicable to the employment context . therefore , in order to regulate the processing of employees ' personal data in the employment context , member states should be able , within the limits of this regulation , to adopt by law specific rules for the processing of personal data in the employment sector . ### the general principles on the protection of individuals with regard to the processing of personal data should also be applicable to the employment and the social security context . therefore , in order to regulate the processing of employees ' personal data in the employment context , member states should be able , in accordance with this regulation , to adopt by law specific rules for the processing of personal data in the employment sector .


### access to any of its premises , including to any data processing equipment and means , where there are reasonable grounds for presuming that an activity in violation of this regulation is being carried out there . ### access to any of its premises , including to any data processing equipment and means .


### the processing of personal data solely for journalistic purposes , or for the purposes of artistic or literary expression should qualify for exemption from the requirements of certain provisions of this regulation in order to reconcile the right to the protection of personal data with the right to freedom of expression , and notably the right to receive and impart information , as guaranteed in particular by article 11 of the charter of fundamental rights of the european union . this should apply in particular to processing of personal data in the audiovisual field and in news archives and press libraries . therefore , member states should adopt legislative measures , which should lay down exemptions and derogations which are necessary for the purpose of balancing these fundamental rights . such exemptions and derogations should be adopted by the member states on general principles , on the rights of the data subject , on controller and processor , on the transfer of data to third countries or international organisations , on the independent supervisory authorities and on co - operation and consistency . this should not , however , lead member states to lay down exemptions from the other provisions of this regulation . in order to take account of the importance of the right to freedom of expression in every democratic society , it is necessary to interpret notions relating to that freedom , such as journalism , broadly . therefore , member states should classify activities as ' journalistic ' for the purpose of the exemptions and derogations to be laid down under this regulation if the object of these activities is the disclosure to the public of information , opinions or ideas , irrespective of the medium which is used to transmit them . they should not be limited to media undertakings and may be undertaken for profit - making or for non - profit making purposes . ### whenever necessary , exemptions or derogations from the requirements of certain provisions of this regulation for the processing of personal data should be possible in order to reconcile the right to the protection of personal data with the right to freedom of expression , and notably the right to receive and impart information , as guaranteed in particular by article 11 of the charter of fundamental rights of the european union . this should apply in particular to processing of personal data in the audiovisual field and in news archives and press libraries . therefore , member states should adopt legislative measures , which should lay down exemptions and derogations which are necessary for the purpose of balancing these fundamental rights . such exemptions and derogations should be adopted by the member states on general principles , on the rights of the data subject , on controller and processor , on the transfer of data to third countries or international organisations , on the independent supervisory authorities and on co - operation and consistency . this should not , however , lead member states to lay down exemptions from the other provisions of this regulation . in order to take account of the importance of the right to freedom of expression in every democratic society , it is necessary to interpret notions relating to that freedom , such as journalism , broadly .


### advise the commission on any issue related to the protection of personal data in the union , including on any proposed amendment of this regulation ; ### advise the european institutions on any issue related to the protection of personal data in the union , including on any proposed amendment of this regulation ;


### where personal data are processed for direct marketing purposes , the data subject shall have the right to object free of charge to the processing of their personal data for such marketing . this right shall be explicitly offered to the data subject in an intelligible manner and shall be clearly distinguishable from other information . ### where personal data are processed for direct marketing purposes , the data subject shall have the right to object free of charge to the processing of their personal data for such marketing . this right shall be explicitly offered in a manner intelligible to the data subject and shall be clearly distinguishable from other information .


### the data subject shall have the right to obtain from the controller communication of the personal data undergoing processing . where the data subject makes the request in electronic form , the information shall be provided in electronic form , unless otherwise requested by the data subject . ### the data subject shall have the right to obtain from the controller a full copy of all personal data undergoing processing and all relating data as it is kept by the controller . the information and all data shall be provided in writing or in electronic form , unless otherwise requested by the data subject .


### the member states and the commission shall encourage , in particular at european level , the establishment of data protection certification mechanisms and of data protection seals and marks , allowing data subjects to quickly assess the level of data protection provided by controllers and processors . the data protection certifications mechanisms shall contribute to the proper application of this regulation , taking account of the specific features of the various sectors and different processing operations . ### any controller or processor may request any supervisory authority in the union , for a fixed fee , to certify that the processing of personal data is performed in compliance with this regulation , taking account of the specific features of the various sectors as well as the contexts of and risks represented by the data processing operations .


### the commission may specify the format and procedures for mutual assistance referred to in this article and the arrangements for the exchange of information by electronic means between supervisory authorities , and between supervisory authorities and the european data protection board , in particular the standardised format referred to in paragraph 6 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the european data protection board may specify the format and procedures for mutual assistance referred to in this article and the arrangements for the exchange of information by electronic means between supervisory authorities , and between supervisory authorities and the european data protection board , in particular the standardised format referred to in paragraph 6 .


### the administrative sanction shall be in each individual case effective , proportionate and dissuasive . the amount of the administrative fine shall be fixed with due regard to the nature , gravity and duration of the breach , the intentional or negligent character of the infringement , the degree of responsibility of the natural or legal person and of previous breaches by this person , the technical and organisational measures and procedures implemented pursuant to article 23 and the degree of co - operation with the supervisory authority in order to remedy the breach . ### the administrative sanction shall be in each individual case effective , proportionate and dissuasive .


### within the limits of this regulation , member states may adopt by law specific rules regulating the processing of employees ' personal data in the employment context , in particular for the purposes of the recruitment , the performance of the contract of employment , including discharge of obligations laid down by law or by collective agreements , management , planning and organisation of work , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship . ### member states may , in accordance with the rules set out in this regulation , and taking into account the principle of proportionality , adopt by legal provisions specific rules regulating the processing of employees ' personal data in the employment context , in particular but not limited to the purposes of the recruitment and job applications within the group of undertakings , the performance of the contract of employment , including discharge of obligations laid down by law and by collective agreements , company agreements and collective agreements in accordance with national law and practice , management , planning and organisation of work , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship . the level of protection afforded by this regulation may not be undercut . notwithstanding the previous sentence , where arrangements are made by agreement between employee representatives and the management of the undertaking or of the controlling undertaking of a group of undertakings the level of protection afforded by this regulation may not be significantly undercut . the right of member states , or the social partners via collective agreements , to provide employees with more favourable protection provisions in respect of the processing of personal data in the employment context shall remain unaffected .


### where the personal data are not collected from the data subject , the controller shall inform the data subject , in addition to the information referred to in paragraph 1 , from which source the personal data originate . ### where the personal data are not collected from the data subject , the controller shall inform the data subject , in addition to the information referred to in paragraph 1 , from which source each category of personal data originate .


### the controller and the processor shall designate a data protection officer in any case where : ### the controller and the processor shall designate at least one data protection officer after obtaining the approval of the representatives of the business ' s employees in any case where :


### the assessment shall contain at least a general description of the envisaged processing operations , an assessment of the risks to the rights and freedoms of data subjects , the measures envisaged to address the risks , safeguards , security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this regulation , taking into account the rights and legitimate interests of data subjects and other persons concerned . ### the assessment shall contain at least a description of the envisaged processing operations and their necessity and proportionality in relation to the purpose ; an assessment of the risks to the rights and freedoms of data subjects ; the measures envisaged to address the risks and minimise the volume of personal data which is processed ; safeguards , security measures and mechanisms to ensure the protection of personal data , such as pseydonymisation , and to demonstrate compliance with this regulation , taking into account the rights and legitimate interests of data subjects and other persons concerned .


### the commission may set out standard forms and procedures for prior authorisations and consultations referred to in paragraphs 1 and 2 , and standard forms and procedures for informing the supervisory authorities pursuant to paragraph 6 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the commission may set out standard forms for prior authorisations and consultations referred to in paragraphs 1 and 2 , and standard forms for informing the supervisory authorities pursuant to paragraph 6 . those implementing acts shall be adopted , after requesting an opinion of the european data protection board , in accordance with the examination procedure referred to in article 87 .


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying other reasons of public interest in the area of public health as referred to in point of paragraph 1 , as well as criteria and requirements for the safeguards for the processing of personal data for the purposes referred to in paragraph 1 . ### the commission shall be empowered to adopt , after requesting an opinion of the european data protection board , delegated acts in accordance with article 86 for the purpose of further specifying other reasons of public interest in the area of public health as referred to in point of paragraph 1 , as well as criteria and requirements for the safeguards for the processing of personal data for the purposes referred to in paragraph 1 .


### the general principles on the protection of individuals with regard to the processing of personal data should also be applicable to the employment context . therefore , in order to regulate the processing of employees’ personal data in the employment context , member states should be able , within the limits of this regulation , to adopt by law specific rules for the processing of personal data in the employment sector . ### the general principles on the protection of individuals with regard to the processing of personal data should also be applicable to the employment and the social security context . therefore , in order to regulate the processing of employees’ personal data in the employment context , member states should be able , in accordance with this regulation , to adopt by law specific rules for the processing of personal data in the employment and the social security sector .


### ' data subject ' means an identified natural person or a natural person who can be identified , directly or indirectly , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to an identification number , location data , online identifier or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural or social identity of that person ; ### ' data subject ' means an identified or identifiable natural person who can be identified , directly or indirectly , by technically available means reasonably likely to be used by the controller or by any other natural or legal person , where the use of such means does not entail excessive costs , is not overly time - consuming and does not require complex actions to be taken ;


### bodies conducting historical , statistical or scientific research may publish or otherwise publicly disclose personal data only if : ### bodies using personal data for historical , statistical or scientific purposes may publish or otherwise publicly disclose personal data only if :


### other reasons of public interest in areas such as social protection , especially in order to ensure the quality and cost - effectiveness of the procedures used for settling claims for benefits and services in the health insurance system . ### other reasons of public interest in areas such as social protection , in order to ensure its mission as defined in member states ' national legislation , including the quality and cost - effectiveness of the procedures used for settling claims for benefits and services in the health insurance system .


### the representative shall be established in one of those member states where the data subjects whose personal data are processed in relation to the offering of goods or services to them , or whose behaviour is monitored , reside . ### the representative shall be established in one of those member states where the data subjects whose personal data are processed reside .


### the processing of personal data , revealing race or ethnic origin , political opinions , religion or beliefs , trade - union membership , and the processing of genetic data or data concerning health or sex life or criminal convictions or related security measures shall be prohibited . ### the processing of personal data , revealing race or ethnic origin , political opinions , religion or beliefs , sexual orientation or gender identity , trade - union membership and activities , and the processing of genetic or biometric data or data concerning health or sex life or criminal convictions or related security measures shall be prohibited .


### examine , on its own initiative or on request of one of its members or on request of the commission , any question covering the application of this regulation and issue guidelines , recommendations and best practices addressed to the supervisory authorities in order to encourage consistent application of this regulation ; ### examine , on its own initiative or on request of one of its members or on request of the european parliament , the council or the commission , any question covering the application of this regulation and issue guidelines , recommendations and best practices addressed to the supervisory authorities in order to encourage consistent application of this regulation , including on the use of enforcement powers ;


### processing is necessary for the purposes of the legitimate interests pursued by a controller , except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data , in particular where the data subject is a child . this shall not apply to processing carried out by public authorities in the performance of their tasks . ### points to do not apply , but processing is necessary for the purposes of predominant legitimate interests pursued by a controller and these interests are overriding the interests or fundamental rights and freedoms of the data subject . this shall not apply to processing carried out by public authorities in the performance of their tasks .


### member states shall provide for exemptions or derogations from the provisions on the general principles in chapter ii , the rights of the data subject in chapter iii , on controller and processor in chapter iv , on the transfer of personal data to third countries and international organisations in chapter v , the independent supervisory authorities in chapter vi and on co - operation and consistency in chapter vii for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression . ### chapter ii , chapter iii , chapter iv , chapter v , chapter vi , , chapter vii as well as articles 73 , 74 , 76 and 79 of chapter viii shall not apply to the processing of personal data carried out for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression .