### trust service providers and supervisory bodies shall ensure fair and lawful processing in accordance with directive 95 / 46 / ec when processing personal data . ### trust service providers and supervisory bodies shall ensure fair and lawful processing in accordance with directive 95 / 46 / ec and applicable national law when processing personal data .


### trust service providers shall guarantee the confidentiality and integrity of data related to a person to whom the trust service is provided . ### trust service providers shall guarantee the confidentiality and integrity of data related to a person to whom the trust service is provided , in particular by ensuring that the data used for trust service generation cannot be derived .


### the electronic identification means are issued by , on behalf of or under the responsibility of the notifying member state ; ### the electronic identification means are either issued by the member state , or issued by another entity as mandated by the member state or issued independently but recognised by the notifying member state ;


### member states shall designate an appropriate body established in their territory or , upon mutual agreement , in another member state under the responsibility of the designating member state . supervisory bodies shall be given all supervisory and investigatory powers that are necessary for the exercise of their tasks . ### member states shall designate an appropriate body established in their territory or , upon mutual agreement a european supervisory body under the responsibility of the designating member state . supervisory bodies shall be given all supervisory and investigatory powers that are necessary for the exercise of their tasks .


### building trust in the online environment is key to economic development . lack of trust makes consumers , businesses and administrations hesitate to carry out transactions electronically and to adopt new services . ### building trust in the online environment is key to economic and social development . lack of trust makes consumers , businesses and administrations hesitate to carry out transactions electronically and to adopt new services .


### ‘ trust service’ means any electronic service consisting in the creation , verification , validation , handling and preservation of electronic signatures , electronic seals , electronic time stamps , electronic documents , electronic delivery services , website authentication , and electronic certificates , including certificates for electronic signature and for electronic seals ; ### ‘ trust service’ means an electronic service consisting in the creation , verification , validation or preservation of electronic signatures , electronic seals , electronic time stamps , electronic documents , electronic delivery services , website authentication , and electronic certificates , including certificates for electronic signature and for electronic seals ;


### the power to adopt delegated acts referred to in articles 8 , 13 , 15 , 16 , 18 , 20 , 21 , 23 , 25 , 27 , 28 , 29 , 30 , 31 , 35 and 37 shall be conferred on the commission for an indeterminate period of time from the entry into force of this regulation . ### the power to adopt delegated acts referred to in articles 8 , 15 , 18 , 20 , 21 , 23 , 25 , 27 , 28 , 29 , 30 , 31 , 35 and 37 shall be conferred on the commission for a period of five years beginning on date of the entry into force of this regulation . the commission shall draw up a report in respect of the delegation of power not later than six months before the end of the five - year period . the delegation of power shall be tacitly extended for periods of an identical duration , unless the european parliament or the council opposes such extension not later than three months before the end of each period .


### compliance with the request would be incompatible with this regulation . ### compliance with the request would be incompatible with this regulation and applicable legislation .


### trust service providers shall , without undue delay and where feasible not later than 24 hours after having become aware of it , notify the competent supervisory body , the competent national body for information security and other relevant third parties such as data protection authorities of any breach of security or loss of integrity that has a significant impact on the trust service provided and on the personal data maintained therein . ### trust service providers shall , without undue delay and where feasible not later than 24 hours after having become aware of it , notify the competent supervisory body , the competent national body for information security and other relevant third parties such as data protection authorities of any breach of security or loss of integrity that has a significant impact on the trust service provided and on the personal data maintained therein . where such notification cannot be made within 24 hours , an explanation of the reasons for the delay should accompany the notification .


### ‘ trust service’ means any electronic service consisting in the creation , verification , validation , handling and preservation of electronic signatures , electronic seals , electronic time stamps , electronic documents , electronic delivery services , website authentication , and electronic certificates , including certificates for electronic signature and for electronic seals ; ### ' trust service ' means an electronic service consisting in the creation , verification , validation or preservation of electronic signatures , electronic seals , electronic time stamps , electronic documents , electronic delivery services , website authentication , and electronic certificates , including certificates for electronic signature and for electronic seals ;


### in the waters up to 100 nautical miles from the baselines of the azores , madeira and the canary islands , the member states concerned may from 1 january 2013 to 31 december 2022 restrict fishing to vessels registered in the ports of those islands . such restrictions shall not apply to union vessels that traditionally fish in those waters , in so far as those vessels do not exceed the fishing effort traditionally exerted . member states shall inform the commission of the restrictions put in place under this paragraph . ### in the waters up to 100 nautical miles from the baselines of the azores , madeira and the canary islands and from the fishing grounds and seamounts thereof that are further than 100 nautical miles , the member states concerned may from 1 january 2013 to 31 december 2022 restrict fishing to those vessels registered in the ports of these islands . continued access for union vessels that traditionally fish in those waters is conditional on the sustainability of fisheries resources . member states shall inform the commission of the restrictions put in place under this paragraph .


### specific characteristics and socio - economic vulnerability of some small - scale fleets justify the limitation of the mandatory system of transferable fishing concessions to large vessels . the system of transferable fishing concessions should apply to stocks for which fishing opportunities are allocated . ### specific characteristics and socio - economic vulnerability of some small - scale fleets justify the voluntary nature of each member state’s application of the system of transferable fishing concessions . the system of transferable fishing concessions should apply to stocks for which fishing opportunities are allocated .


### measures are needed to reduce and eliminate the current high levels of unwanted catches and discards . indeed , unwanted catches and discards constitute a substantial waste and affect negatively the sustainable exploitation of marine biological resources and marine ecosystems as well as the financial viability of fisheries . an obligation to land all catches of managed stocks caught during fishing activities in union waters or by union fishing vessels should be established and gradually implemented . ### measures are needed to prevent and reduce the current high levels of unwanted catches and discards . indeed , unwanted catches and discards constitute a substantial waste and affect negatively the sustainable exploitation of marine biological resources and marine ecosystems as well as the financial viability of fisheries . an obligation to land all catches of managed stocks caught during fishing activities in union waters or by union fishing vessels should be established and gradually implemented in a planned manner .


### the common fisheries policy shall ensure that fishing and aquaculture activities provide long - term sustainable environmental , economic and social conditions and contribute to the availability of food supplies . ### the common fisheries policy shall ensure that fishing and aquaculture activities provide long - term sustainable environmental , economic and social conditions and contribute to the security of fishing communities in europe ' s various regions and of food supplies .


### provide conditions for efficient fishing activities within an economically viable and competitive fishing industry ; ### provide conditions for efficient fishing activities within an economically sustainable and competitive fishing industry , since it is crucial to guarantee the sector’s future ;


### a system of transferable fishing concessions for the majority of managed stocks under the common fisheries policy should be implemented no later than 31 december 2013 for all vessels of 12 metres ' length or over and all other vessels fishing with towed gears . member states may exclude vessels up to 12 metres ' length other than vessels using towed gear from transferable fishing concessions . such a system should contribute to industry - induced fleet reductions and improved economic performance while at the same time creating legally secure and exclusive transferable fishing concession of a member state ' s annual fishing opportunities . since marine biological resources are a common good , transferable fishing concessions should only establish user entitlements to a member state ' s part of annual fishing opportunities which may be recalled according to established rules . ### a system of transferable fishing concessions for the majority of managed stocks under the common fisheries policy should be implemented no later than 31 december 2013 for all vessels of 15 metres’ length or over and all other vessels fishing with towed gears . member states may exclude vessels up to 15 metres’ length other than vessels using towed gear from transferable fishing concessions . such a system should contribute to fleet capacity adjustment when a situation of overfishing is detected and improved economic performance while at the same time creating legally secure and exclusive transferable fishing concession of a member state’s annual fishing opportunities . since marine biological resources are a common good , transferable fishing concessions should only establish user entitlements to a member state’s part of annual fishing opportunities which may be recalled according to established rules .


### a system of transferable fishing concessions for the majority of managed stocks under the common fisheries policy should be implemented no later than 31 december 2013 for all vessels of 12 meters ' length or over and all other vessels fishing with towed gears . member states may exclude vessels up to 12 meters ' length other than vessels using towed gear from transferable fishing concessions . such a system should contribute to industry - induced fleet reductions and improved economic performance while at the same time creating legally secure and exclusive transferable fishing concession of a member state ' s annual fishing opportunities . since marine biological resources are a common good , transferable fishing concessions should only establish user entitlements to a member state ' s part of annual fishing opportunities which may be recalled according to established rules . ### a voluntary system of transferable fishing concessions for the majority of managed stocks under the common fisheries policy should be implemented at each member state’s discretion , no later than 31 december 2013 for all vessels of 12 meters’ length or over and all other vessels fishing with towed gears . member states may exclude vessels up to 12 meters’ length other than vessels using towed gear from transferable fishing concessions . such a system should contribute to industry - induced fleet reductions and improved economic performance while at the same time creating legally secure and exclusive transferable fishing concession of a member state’s annual fishing opportunities . since marine biological resources are a common good , transferable fishing concessions should only establish user entitlements to a member state’s part of annual fishing opportunities which may be recalled according to established rules .


### it is important that the management of the common fisheries policy is guided by principles of good governance . those principles include decision - making based on best available scientific advice , broad stakeholder involvement and a long - term perspective . the successful management of the common fisheries policy also depends on a clear definition of responsibilities at union , national , regional and local levels and on the mutual compatibility and consistency of the measures taken with other union policies . ### it is important that the management of the common fisheries policy is guided by principles of good governance . those principles include decision - making based on best available scientific advice , broad stakeholder involvement at national , regional and local levels , active participation in drawing up , implementing and evaluating this policy and the adoption of a long - term perspective . the successful management of the common fisheries policy also depends on a clear definition of responsibilities at union , national , regional and local levels and on the mutual compatibility and consistency of the measures taken with other union policies .


### fishing concessions should be transferable and leasable in order to decentralise management of fishing opportunities towards the fishing industry and ensuring that fishers leaving the industry will not need to rely on public financial assistance under the common fisheries policy . ### depending on the system established in each member state , fishing concessions should be transferable and leasable in order to decentralise management of fishing opportunities towards the fishing industry and ensuring that fishers leaving the industry will not need to rely on public financial assistance under the common fisheries policy .


### as regards the eur 10 000 000 000 transferred from the cohesion fund [ regulation xxx article xx ] to be spent in member states eligible for funding from the cohesion fund , specific calls shall be launched for projects implementing the core network exclusively in member states eligible for funding from the cohesion fund . ### as regards the eur xxx made available from the cohesion fund to be spent for projects implementing the core network exclusively in member states eligible for funding from the cohesion fund , the commission shall adopt a decision by implementing act after a prior agreement with the member state concerned , setting out the amount to be allocated and the transport infrastructure projects of european added value that will be carried out by each member state .


### accelerating the deployment of fast and ultrafast broadband networks networks and their uptake , including by small and medium sized enterprises , to be measured by the level of broadband and ultrafast broadband coverage and the number of households having subscribed for broadband connections for above 100 mbps ; ### accelerating the deployment of fast and ultrafast broadband networks and their uptake , including by small and medium sized enterprises and in rural areas , to be measured by the level of broadband and ultrafast broadband coverage and the number of households having subscribed for broadband connections for above 100 mbps ;


### vat shall not be an eligible cost . ### non - refundable vat shall be an eligible cost .


### applicable rules for the transport sector under this regulation shall apply to these specific calls . when implementing these calls , greatest possible priority shall be given to projects respecting the national allocations under the cohesion fund . ### applicable rules for the transport sector under this regulation shall apply to these specific calls . when implementing these calls , greatest possible priority shall be given to projects respecting the national allocations under the cohesion fund , with the goal of eliminating obstacles to mobility , including in remote , outlying or outermost regions .


### experience with the current financial framework shows that many member states , which are eligible to the cohesion fund , are facing significant obstacles in delivering on time complex cross - border transport infrastructure projects with a high union added value . therefore , in order to improve the delivery of transport projects , in particular cross - border ones , with a high union added value , part of the cohesion fund allocation should be transferred to finance transport projects on the transport core network in the member states eligible to the cohesion fund under the connecting europe facility . the commission should support member states eligible to the cohesion fund to develop an adequate pipeline of projects in order to give greatest possible priority to the national allocations under the cohesion fund . ### experience with the current financial framework shows that some member states , which are eligible to the cohesion fund , are facing significant obstacles in delivering on time complex cross - border transport infrastructure projects with a high union added value . therefore , in order to improve the delivery of transport projects , in particular cross - border ones , with a high union added value , part of the cohesion fund should be allocated , upon prior agreement between the commission and the member states concerned , to finance transport projects on the transport core network in the member states eligible to the cohesion fund under the connecting europe facility . the commission should support member states eligible to the cohesion fund to develop and implement agreed projects .


### vat shall not be an eligible cost . ### not recoverable vat shall be an eligible cost .


### transport : eur 31 694 000 000 , out of which eur 10 000 000 000 shall be transferred from the cohesion fund to be spent in line with this regulation in member states eligible for funding from the cohesion fund ; ### transport : eur xxx , out of which eur xxx shall be made available from the cohesion fund to be spent in line with this regulation , with regulation no [ . . . ] / 2012 [ cpr ] , and with regulation no [ . . . ] / 2012 [ cohesion fund ] , in member states eligible for funding from the cohesion fund ;


### the commission should equally be able to recognise that a third country , or a territory or a processing sector within a third country , or an international organisation , does not offer an adequate level of data protection . consequently the transfer of personal data to that third country should be prohibited except when they are based on an international agreement , appropriate safeguards or a derogation . provision should be made for procedures for consultations between the commission and such third countries or international organisations . however , such a commission decision shall be without prejudice to the possibility to undertake transfers on the basis of appropriate safeguards or on the basis of a derogation laid down in the directive . ### the commission should equally be able to recognise that a third country , or a territory or a processing sector within a third country , or an international organisation , does not offer an adequate level of data protection . consequently the transfer of personal data to that third country should be prohibited except when they are based on an international agreement , appropriate safeguards or a derogation . provision should be made for procedures for consultations between the commission and such third countries or international organisations . however , such a commission decision shall be without prejudice to the possibility to undertake transfers on the basis of appropriate safeguards by means of legally binding instruments or on the basis of a derogation laid down in this directive .


### member states shall provide that any transfer of personal data by competent authorities that is undergoing processing or is intended for processing after transfer to a third country , or to an international organisation , including further onward transfer to another third country or international organisation , may take place only if : the transfer is necessary for the prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties ; and the conditions laid down in this chapter are complied with by the controller and processor . ### member states shall provide that any transfer of personal data by competent authorities that is undergoing processing or is intended for processing after transfer to a third country , or to an international organisation , including further onward transfer to another third country or international organisation , may take place only if : the specific transfer is necessary for the prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties ; the data are transferred to a controller in a third country or international organisation that is an public authority competent for the purposes referred in article 1 ; the conditions laid down in articles 34 to 37 are complied with by the controller and the processor , including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation ; the other provisions adopted pursuant to this directive are complied with by the controller and processor ; and the level of protection of the personal data individuals guaranteed in the union by this directive is not undermined . 2 . member states shall provide that a transfer , subject to the conditions set out in paragraph 1 , may only take place : where the commission has decided under the conditions and procedure referred to in article 34 that the third country or international organisation in question ensures an adequate level of protection ; or where appropriate safeguards with respect to the protection of personal data have been adduced in a legally binding instrument as referred to in article 35 .


### each supervisory authority shall have the right to engage in legal proceedings and bring an action to court , in order to enforce the provisions adopted pursuant to this directive or to ensure consistency of the protection of personal data within the union . ### member states shall provide that each supervisory authority shall have the right to engage in legal proceedings and bring an action to court , in order to enforce the provisions adopted pursuant to this directive or to ensure consistency of the protection of personal data within the union .


### the principle of fair processing requires that the data subjects should be informed in particular of the existence of the processing operation and its purposes , how long the data will be stored , on the existence of the right of access , rectification or erasure and on the right to lodge a complaint . where the data are collected from the data subject , the data subject should also be informed whether they are obliged to provide the data and of the consequences , in cases they do not provide such data . ### the principle of fair and transparent processing requires that the data subjects should be informed in particular of the existence of the processing operation and its purposes , how long the data will be stored , on the existence of the right of access , rectification or erasure and on the right to lodge a complaint . where the data are collected from the data subject , the data subject should also be informed whether they are obliged to provide the data and of the consequences , in cases they do not provide such data .


### the implementing act shall specify its geographical and sectoral application , and , where applicable , identify the supervisory authority mentioned in point of paragraph 2 . ### the delegated act shall specify its geographical and sectoral application , and identify the supervisory authority mentioned in point of paragraph 2 .


### member states may adopt legislative measures restricting , wholly or partly , the data subject ' s right of access to the extent that such partial or complete restriction constitutes a necessary and proportionate measure in a democratic society with due regard for the legitimate interests of the person concerned : ### member states may adopt legislative measures restricting , wholly or partly , the data subject ' s right of access to the extent that such partial or complete restriction constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and the legitimate interests of the person concerned :


### in order to be lawful , the processing of personal data should be necessary for compliance with a legal obligation to which the controller is subject , for the performance of a task carried out in the public interest by a competent authority based on law or in order to protect the vital interests of the data subject or of another person , or for the prevention of an immediate and serious threat to public security . ### in order to be lawful , the processing of personal data should be only allowed when necessary for compliance with a legal obligation to which the controller is subject , for the performance of a task carried out in the public interest by a competent authority based on union or national law which should contain explicit and detailed provisions at least as to the objectives , the personal data , the specific purposes and means , designate or allow to designate the controller , the procedures to be followed , the use and limitations of the scope of any discretion conferred to the competent authorities in relation to the processing activities .


### kept in a form which permits identification of data subjects for no longer than it is necessary for the purposes for which the personal data are processed ; ### kept in a form which permits identification or singling out of data subjects for no longer than it is necessary for the purposes for which the personal data are processed ;


### any person should have the right to have inaccurate personal data concerning them rectified and the right of erasure where the processing of such data is not in compliance with the main principles laid down in this directive . where the personal data are processed in the course of a criminal investigation and proceedings , , rectification , the rights of information , access , erasure and restriction of processing may be carried out in accordance with national rules on judicial proceedings . ### any person should have the right to have inaccurate or unlawfully processed personal data concerning them rectified and the right of erasure where the processing of such data is not in compliance with the provisions laid down in this directive . where the personal data are processed in the course of a criminal investigation and proceedings , rectification , the rights of information , access , erasure and restriction of processing may be carried out in accordance with national rules on judicial proceedings .


### member states shall provide that the processing of personal data is lawful only if and to the extent that processing is necessary : for the performance of a task carried out by a competent authority , based on law for the purposes set out in article 1 ; or for compliance with a legal obligation to which the controller is subject ; or in order to protect the vital interests of the data subject or of another person ; or for the prevention of an immediate and serious threat to public security . ### member states shall provide that the processing of personal data is lawful only if and to the extent that processing is necessary for the performance of a task carried out by a competent authority , based on union or national law for the purposes set out in article 1 .


### every natural person should have the right not to be subject to a measure which is based solely on automated processing if it produces an adverse legal effect for that person , unless authorised by law and subject to suitable measures to safeguard the data subject’s legitimate interests . ### every natural person should have the right not to be subject to a measure which is based on profiling by means of automated processing . such processing which produces a legal effect for that person , or significantly affects them should be prohibited , unless authorised by law and subject to suitable measures to safeguard the data subject’s legitimate interests .


### member states shall provide that the controller takes all reasonable steps to have transparent and easily accessible policies with regard to the processing of personal data and for the exercise of the data subjects ' rights . ### member states shall provide that the controller has transparent and easily accessible policies with regard to the processing of personal data and for the exercise of the data subjects ' rights .


### automated processing of personal data intended to evaluate certain personal aspects relating to the data subject shall not be based solely on special categories of personal data referred to in article 8 . ### automated processing of personal data intended to evaluate certain personal aspects relating to the data subject shall not be based on special categories of personal data referred to in article 8 .


### member states shall ensure that records are kept of at least the following processing operations : collection , alteration , consultation , disclosure , combination or erasure . the records of consultation and disclosure shall show in particular the purpose , date and time of such operations and as far as possible the identification of the person who consulted or disclosed personal data . ### member states shall ensure that records are kept of at least the following processing operations : collection , alteration , consultation , disclosure , combination or erasure . the records of consultation and disclosure shall show in particular the purpose , date and time of such operations and the identification of the person who consulted or disclosed personal data , and the identity of the recipient of such data .


### in order to ensure effective protection of the rights and freedoms of data subjects by way of preventive actions , the controller or processor should consult with the supervisory authority in certain cases prior to the processing . ### in order to ensure effective protection of the rights and freedoms of data subjects by way of preventive actions , the controller or processor should consult with the supervisory authority in certain cases prior to the processing . moreover , where a data protection impact assessment indicates that processing operations are likely to present a high degree of specific risks to the rights and freedoms of data subjects , the supervisory authority should be in a position to prevent , prior to the start of operations , a risky processing which is not in compliance with this directive , and to make proposals to remedy such situation . such consultation may equally take place in the course of the preparation either of a measure of the national parliament or of a measure based on such legislative measure which defines the nature of the processing and lays down appropriate safeguards .


### the commission may decide within the scope of this directive that a third country or a territory or a processing sector within that third country or an international organisation does not ensure an adequate level of protection within the meaning of paragraph 2 , in particular in cases where the relevant legislation , both general and sectoral , in force in the third country or international organisation , does not guarantee effective and enforceable rights including effective administrative and judicial redress for data subjects , in particular for those data subjects whose personal data are being transferred . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 57 , or , in cases of extreme urgency for individuals with respect to their right to personal data protection , in accordance with the procedure referred to in article 57 . ### the commission shall be empowered to adopt , after requesting an opinion of the european data protection board , delegated acts in accordance with article 56 to decide within the scope of this directive that a third country or a territory or a processing sector within that third country or an international organisation does not ensure an adequate level of protection within the meaning of paragraph 2 , in particular in cases where the relevant legislation , both general and sectoral , in force in the third country or international organisation , does not guarantee effective and enforceable rights including effective administrative and judicial redress for data subjects , in particular for those data subjects whose personal data are being transferred .


### the existence and effective functioning of one or more independent supervisory authorities in the third country or international organisation in question responsible for ensuring compliance with the data protection rules , for assisting and advising the data subject in exercising their rights and for co - operation with the supervisory authorities of the union and of member states ; and ### the existence and effective functioning of one or more independent supervisory authorities in the third country or international organisation in question responsible for ensuring compliance with the data protection rules , including sufficient sanctioning powers , for assisting and advising the data subject in exercising their rights and for co - operation with the supervisory authorities of the union and of member states ; and


### member states shall provide that the controller takes all reasonable steps to establish procedures for providing the information referred to in article 11 and for the exercise of the rights of data subjects referred to in articles 12 to 17 . ### member states shall provide that the controller establishes procedures for providing the information referred to in article 11 and for the exercise of the rights of data subjects referred to in articles 12 to 17 . where personal data are processed by automated means , the controller shall provide also means for requests to be made electronically .


### the commission shall review within three years after the entry into force of this directive other acts adopted by the european union which regulate the processing of personal data by competent authorities for the purposes of prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties , in particular those acts adopted by the union referred to in article 59 , in order to assess the need to align them with this directive and make , where appropriate , the necessary proposals to amend these acts to ensure a consistent approach on the protection of personal data within the scope of this directive . ### the commission shall review within two years after the entry into force of this directive other acts adopted by the european union which regulate the processing of personal data by competent authorities for the purposes of prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties , in particular those acts adopted by the union referred to in article 59 , and shall make appropriate proposals with a view to ensuring consistent and homogeneous legal rules relating to the processing of personal data by competent authorities for the purposes of prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties within the scope of this directive .


### transfers not based on such an adequacy decision should only be allowed where appropriate safeguards have been adduced in a legally binding instrument , which ensure the protection of the personal data or where the controller or processor has assessed all the circumstances surrounding the data transfer operation or the set of data transfer operations and , based on this assessment , considers that appropriate safeguards with respect to the protection of personal data exist . in cases where no grounds for allowing a transfer exist , derogations should be allowed if necessary in order to protect the vital interests of the data subject or another person , or to safeguard legitimate interests of the data subject where the law of the member state transferring the personal data so provides , or where it is essential for the prevention of an immediate and serious threat to the public security of a member state or a third country , or in individual cases for the purposes of prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties , or in individual cases for the establishment , exercise or defence of legal claims . ### transfers not based on such an adequacy decision should only be allowed where appropriate safeguards have been adduced in a legally binding instrument , which ensure the protection of the personal data .


### hears complaints lodged by any data subject , or by an association representing and duly mandated by that data subject in accordance with article 50 , investigates , to the extent appropriate , the matter and informs the data subject the association of the progress and the outcome of the complaint within a reasonable period , in particular where further investigation or coordination with another supervisory authority is necessary ; ### hears complaints lodged by any data subject , or by an association in accordance with article 50 , investigates , to the extent appropriate , the matter and informs the data subject the association of the progress and the outcome of the complaint within a reasonable period , in particular where further investigation or coordination with another supervisory authority is necessary ;


### member states shall provide that measures which produce an adverse legal effect for the data subject or significantly affect them and which are based solely on automated processing of personal data intended to evaluate certain personal aspects relating to the data subject shall be prohibited unless authorised by a law which also lays down measures to safeguard the data subject ' s legitimate interests . ### member states shall provide that measures which produce a legal effect for the data subject or significantly affect them and which are based on automated processing of personal data intended to evaluate certain personal aspects relating to the data subject shall be prohibited unless authorised by a law which also lays down measures to safeguard the data subject ' s legitimate interests .


### member states shall provide that the carrying out of processing by a processor must be governed by a legal act binding the processor to the controller and stipulating in particular that the processor shall act only on instructions from the controller , in particular , where the transfer of the personal data used is prohibited . ### member states shall provide that the carrying out of processing by means of a processor must be governed by a contract or legal act binding the processor to the controller and stipulating in particular that the processor shall : act only on instructions from the controller ; employ only staff who have agreed to be bound by an obligation of confidentiality or are under a statutory obligation of confidentiality ; take all required measures pursuant to article 28 ; engage another processor only with the permission of the controller and therefore inform the controller of the intention to engage another processor in such a timely fashion that the controller has the possibility to object ; insofar as it is possible given the nature of the processing , adopt in agreement with the controller the necessary technical and organisational requirements for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights laid down in chapter iii ; assist the controller in ensuring compliance with the obligations pursuant to articles 28 to 32 ; hand all results over to the controller after the end of the processing and not otherwise process the personal data ; make available to the controller and the supervisory authority all the information necessary to verify compliance with the obligations laid down in this article ; take into account the principle of data protection by design and default .


### the controller shall implement mechanisms for ensuring that , by default , only those personal data which are necessary for the purposes of the processing are processed . ### the controller shall implement mechanisms for ensuring that , by default , only those personal data which are necessary for each specific purpose of the processing and are in particular not collected or retained beyond the minimum period necessary for those purposes , both in terms of the volume of the data and the time during which they are stored . in particular , those mechanisms shall ensure that by default personal data are not made accessible to an indefinite number of individuals .


### a delegated act adopted pursuant to article 28 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of 2 months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by 2 months at the initiative of the european parliament or the council . ### a delegated act adopted pursuant to article 25a , article 28 , article 34 and article 34 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of 2 months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by 2 months at the initiative of the european parliament or the council .


### member states may adopt legislative measures restricting , wholly or partly , the data subject ' s right of access to the extent that such partial or complete restriction constitutes a necessary and proportionate measure in a democratic society with due regard for the legitimate interests of the person concerned : ### member states may adopt legislative measures restricting , wholly or partly , depending on the individual case , the data subject ' s right of access to the extent and for the period that such partial or complete restriction constitutes a necessary and proportionate measure in a democratic society with due regard for the legitimate interests of the person concerned :


### instead of erasure , the controller shall mark the personal data where : ### instead of erasure , the controller shall restrict the processing of the personal data where :


### in order to exercise their rights , any information to the data subject should be easily accessible and easy to understand , including the use of clear and plain language . ### in order to exercise their rights , any information to the data subject should be easily accessible and easy to understand , including the use of clear and plain language . this information should be adapted to the needs of the data subject in particular when information is addressed specifically to a child .


### advise the commission on any issue related to the protection of personal data in the union , including on any proposed amendment of this directive ### advise the union institutions on any issue related to the protection of personal data in the union , including on any proposed amendment of this directive ;


### member states may determine by law categories of data processing which may wholly or partly fall under the exemptions of paragraph 1 . ### member states shall provide that the controller assesses , in each specific case by means of a concrete and individual examination whether a partial or complete restriction for one of the reasons referred to in paragraph 1 applies . member states may also determine by law categories of data processing which may wholly or partly fall under the exemptions under points to of paragraph 1 .


### accurate and , where necessary , kept up to date ; every reasonable step must be taken to ensure that personal data that are inaccurate , having regard to the purposes for which they are processed , are erased or rectified without delay ; ### accurate and kept up to date ; every reasonable step must be taken to ensure that personal data that are inaccurate , having regard to the purposes for which they are processed , are erased or rectified without delay ;


### member states shall ensure that , as far as possible , personal data based on facts are distinguished from personal data based on personal assessments . ### member states shall ensure that personal data based on facts are distinguished from personal data based on personal assessments .


### any body , organisation or association which aims to protects the rights and interests of data subjects in relation to the protection of their data and is constituted according to the law of a member state should have the right to lodge a complaint or exercise the right to a judicial remedy on behalf of data subjects if duly mandated by them , or to lodge , independently of a data subject ' s complaint , its own complaint where it considers that a personal data breach has occurred . ### any body , organisation or association acting in the public interest constituted according to the law of a member state should have the right to lodge a complaint or exercise the right to a judicial remedy on behalf of data subjects if duly mandated by them , or to lodge , independently of a data subject ' s complaint , its own complaint where it considers that a personal data breach has occurred .


### to inform and advise the controller or the processor of their obligations in accordance with the provisions adopted pursuant to this directive and to document this activity and the responses received ; ### to inform and advise the controller or the processor of their obligations in accordance with the provisions adopted pursuant to this directive , in particular with regards to technical and organisational measures and procedures and to document this activity and the responses received ;


### the examination procedure should be used for the adoption of measures as regards documentation by controllers and processors , security of processing , notification of a personal data breach to the supervisory authority , and the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation , given that those acts are of general scope . ### the examination procedure should be used for the adoption of measures as regards security of processing and notification of a personal data breach to the supervisory authority , given that those acts are of general scope .


### member states shall provide that the controller adopts policies and implements appropriate measures to ensure that the processing of personal data is performed in compliance with the provisions adopted pursuant to this directive . ### member states shall provide that the controller adopts policies and implements appropriate measures to ensure and demonstrate , for each processing operation , that the processing of personal data is performed in compliance with the provisions adopted pursuant to this directive .


### where requests are vexatious , in particular due to their repetitive character , the supervisory authority may charge a fee or not take the action required by the data subject . the supervisory authority shall bear the burden of proving of the vexatious character of the request . ### where requests are vexatious , in particular due to their repetitive character , the supervisory authority may charge a reasonable fee . the supervisory authority shall bear the burden of proving of the vexatious character of the request .


### member states shall provide for the right of any body , organisation or association which aims to protect data subjects’ rights and interests concerning the protection of their personal data and is being properly constituted according to the law of a member state to lodge a complaint with a supervisory authority in any member state on behalf of one or more data subjects , if it considers that a data subject’s rights under this directive have been infringed as a result of the processing of personal data . the organisation or association must be duly mandated by the data subject . ### member states shall provide for the right of any body , organisation or association acting in the public interest which has been properly constituted according to the law of a member state to lodge a complaint with a supervisory authority in any member state on behalf of one or more data subjects , if it considers that a data subject’s rights under this directive have been infringed as a result of the processing of personal data .


### adequate , relevant , and not excessive in relation to the purposes for which they are processed ; ### adequate , relevant , and limited to the minimum necessary in relation to the purposes for which they are processed ; they shall only be processed if , and as long as , the purposes could not be fulfilled by processing information that does not involve personal data ;


### member states shall ensure that where the commission decides pursuant to paragraph 5 , that any transfer of personal data to the third country or a territory or a processing sector within that third country , or the international organisation in question shall be prohibited , this decision shall be without prejudice to transfers under article 35 or in accordance with article 36 . at the appropriate time , the commission shall enter into consultations with the third country or international organisation with a view to remedying the situation resulting from the decision made pursuant to paragraph 5 of this article . ### member states shall ensure that where the commission decides pursuant to paragraph 5 , that any transfer of personal data to the third country or a territory or a processing sector within that third country , or the international organisation in question shall be prohibited . at the appropriate time , the commission shall enter into consultations with the third country or international organisation with a view to remedying the situation resulting from the decision made pursuant to paragraph 5 of this article .


### transfers of data to a third country or an international organisation , including the identification of that third country or international organisation . ### transfers of data to a third country or an international organisation , including the identification of that third country or international organisation and the legal grounds on which the data are transferred ; a substantive explanation shall be given when a transfer is based on articles 35 or 36 of this directive ; a general indication of the time limits for erasure of the different categories of data ; the results of the verifications of the measures referred to in article 20 ; an indication of the legal basis of the processing operation for which the data are intended .


### ' data subject ' means an identified natural person or a natural person who can be identified , directly or indirectly , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to an identification number , location data , online identifiers or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural or social identity of that person ; ### ' data subject ' means an identified natural person or a natural person who can be identified or singled out , directly or indirectly , alone or in combination with associated data , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to a unique identifier , location data , online identifiers or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural , social or gender identity or sexual orientation of that person ;


### transfers not based on such an adequacy decision should only be allowed where appropriate safeguards have been adduced in a legally binding instrument , which ensure the protection of the personal data or where the controller or processor has assessed all the circumstances surrounding the data transfer operation or the set of data transfer operations and , based on this assessment , considers that appropriate safeguards with respect to the protection of personal data exist . in cases where no grounds for allowing a transfer exist , derogations should be allowed if necessary in order to protect the vital interests of the data subject or another person , or to safeguard legitimate interests of the data subject where the law of the member state transferring the personal data so provides , or where it is essential for the prevention of an immediate and serious threat to the public security of a member state or a third country , or in individual cases for the purposes of prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties , or in individual cases for the establishment , exercise or defence of legal claims . ### transfers not based on such an adequacy decision should only be allowed where appropriate safeguards have been adduced in a legally binding instrument , which ensure the protection of the personal data .


### the commission shall be empowered to adopt delegated acts in accordance with article 56 for the purpose of specifying further the criteria and requirements for establishing the data breach referred to in paragraphs 1 and 2 and for the particular circumstances in which a controller and a processor is required to notify the personal data breach . ### the commission shall be empowered to adopt , after requesting an opinion of the european data protection board , delegated acts in accordance with article 56 for the purpose of specifying further the criteria and requirements for establishing the data breach referred to in paragraphs 1 and 2 and for the particular circumstances in which a controller and a processor is required to notify the personal data breach .


### the commission may decide , within the scope of this directive , that a third country or a territory or a processing sector within that third country or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 57 . ### the commission shall be empowered to adopt , after requesting an opinion of the european data protection board , delegated acts in accordance with article 56 to decide , within the scope of this directive , that a third country or a territory or a processing sector within that third country or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 .


### the delegation of power referred to in article 28 shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this directive . ### the delegation of power referred to in article 25a , article 28 , article 34 and article 34 shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this directive .


### ensuring a consistent and high level of protection of the personal data of individuals and facilitating the exchange of personal data between competent authorities of members states is crucial in order to ensure effective judicial co - operation in criminal matters and police cooperation . to that aim , the level of protection of the rights and freedoms of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties must be equivalent in all member states . effective protection of personal data throughout the union requires strengthening the rights of data subjects and the obligations of those who process personal data , but also equivalent powers for monitoring and ensuring compliance with the rules for the protection of personal data in the member states . ### ensuring a consistent and high level of protection of the personal data of individuals and thus facilitating the exchange of personal data between competent authorities of members states is crucial in order to ensure effective judicial co - operation in criminal matters and police cooperation . to that aim , the level of protection of the rights and freedoms of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties must be equivalent in all member states . consistent and homogenous application of the rules for the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data should be ensured throughout the union . effective protection of personal data throughout the union requires strengthening the rights of data subjects and the obligations of those who process personal data , but also equivalent powers for monitoring and ensuring compliance with the rules for the protection of personal data in the member states .


### any person should have the right to have inaccurate personal data concerning them rectified and the right of erasure where the processing of such data is not in compliance with the main principles laid down in this directive . where the personal data are processed in the course of a criminal investigation and proceedings , , rectification , the rights of information , access , erasure and restriction of processing may be carried out in accordance with national rules on judicial proceedings . ### any person should have the right to have inaccurate or unlawfully processed personal data concerning them rectified and the right of erasure where the processing of such data is not in compliance with the provisions laid down in this directive . where the personal data are processed in the course of a criminal investigation and proceedings , rectification , the rights of information , access , erasure and restriction of processing may be carried out in accordance with national rules on judicial proceedings .


### member states should ensure that a transfer to a third country only takes place if it is necessary for the prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties , and the controller in the third country or international organisation is an authority competent within the meaning of this directive . a transfer may take place in cases where the commission has decided that the third country or international organisation in question ensures an adequate level or protection , or when appropriate safeguards have been adduced . ### member states should ensure that a transfer to a third country only takes place if this specific transfer is necessary for the prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties , and the controller in the third country or international organisation is a public authority competent within the meaning of this directive . a transfer may take place in cases where the commission has decided that the third country or international organisation in question ensures an adequate level or protection , or when appropriate safeguards have been adduced , or where appropriate safeguards have been adduced by way of a legally binding instrument .


### the controller or the processor should designate a person who would assist the controller or processor to monitor compliance with the provisions adopted pursuant to this directive . a data protection officer may be appointed jointly by several entities of the competent authority . the data protection officers must be in a position to perform their duties and tasks independently and effectively . ### the controller or the processor should designate a person who would assist the controller or processor to monitor and demonstrate compliance with the provisions adopted pursuant to this directive . where several competent authorities are acting under the supervision of a central authority , at least this central authority should designate such data protection officer . the data protection officers must be in a position to perform their duties and tasks independently and effectively , in particular by establishing rules that avoid conflict of interest with other tasks performed by the data protection officer .


### member states shall provide for the right of the data subject to request , in particular in cases referred to in article 13 , that the supervisory authority checks the lawfulness of the processing . ### member states shall provide for the right of the data subject to request , at all times , in particular in cases referred to in article 13 , that the supervisory authority checks the lawfulness of the processing .


### the protection of individuals should be technological neutral and not depend on the techniques used ; otherwise this would create a serious risk of circumvention . the protection of individuals should apply to processing of personal data by automated means , as well as to manual processing if the data are contained or are intended to be contained in a filing system . files or sets of files as well as their cover pages , which are not structured according to specific criteria , should not fall within the scope of this directive . this directive should not apply to the processing of personal data in the course of an activity which falls outside the scope of union law , in particular concerning national security , or to data processed by the union institutions , bodies , offices and agencies , such as europol or eurojust . ### the protection of individuals should be technological neutral and not depend on the techniques used ; otherwise this would create a serious risk of circumvention . the protection of individuals should apply to processing of personal data by automated means , as well as to manual processing if the data are contained or are intended to be contained in a filing system . files or sets of files as well as their cover pages , which are not structured according to specific criteria , should not fall within the scope of this directive . this directive should not apply to the processing of personal data in the course of an activity which falls outside the scope of union law , in particular concerning national security , or to data processed by the union institutions , bodies , offices and agencies , which are subject to regulation no 45 / 2001 or other legal instruments such as council decision 2009 / 371 / jha establishing the european police office or council decision 2002 / 187 / jha setting up eurojust .


### member states shall provide that any information and any communication relating to the processing of personal data are to be provided by the controller to the data subject in an intelligible form , using clear and plain language . ### member states shall provide that any information and any communication relating to the processing of personal data are to be provided by the controller to the data subject in an intelligible form , using clear and plain language , adapted to the data subject , in particular where that information is addressed specifically to a child .


### in order to ensure consistent monitoring and enforcement of this directive throughout the union , the supervisory authorities should have the same duties and effective powers in each member state , including powers of investigation , legally binding intervention , decisions and sanctions , particularly in cases of complaints from individuals , and to engage in legal proceedings . ### in order to ensure consistent monitoring and enforcement of this directive throughout the union , the supervisory authorities should have the same duties and effective powers in each member state , including effective powers of investigation , power to access all personal data and all information necessary for the performance of each supervisory function , power to access any of the premises of the data controller or the processor including data processing requirements , and legally binding intervention , decisions and sanctions , particularly in cases of complaints from individuals , and to engage in legal proceedings .


### when the right referred to in paragraph 1 is exercised , the supervisory authority shall inform the data subject at least that all necessary verifications by the supervisory authority have taken place , and of the result as regards the lawfulness of the processing in question . ### when the right referred to in paragraph 1 is exercised , the supervisory authority shall inform the data subject at least that all necessary verifications by the supervisory authority have taken place , and of the result as regards the lawfulness of the processing in question . the supervisory authority shall also inform the data subject of his or her right to seek a judicial remedy .


### member states shall provide that the processing of personal data is lawful only if and to the extent that processing is necessary : for the performance of a task carried out by a competent authority , based on law for the purposes set out in article 1 ; or for compliance with a legal obligation to which the controller is subject ; or in order to protect the vital interests of the data subject or of another person ; or for the prevention of an immediate and serious threat to public security . ### member states shall provide that the processing of personal data is lawful only if and to the extent that processing is necessary for the performance of a task carried out by a competent authority , based on union or national law for the purposes set out in article 1 .


### member states shall provide that the controller and the processor shall co - operate , on request , with the supervisory authority in the performance of its duties , in particular by providing all information necessary for the supervisory authority to perform its duties . ### member states shall provide that the controller and the processor shall co - operate , on request , with the supervisory authority in the performance of its duties , in particular by providing the information referred to in article 46 and by granting access as provided in article 46 .


### member states shall ensure that , as far as possible , personal data based on facts are distinguished from personal data based on personal assessments . ### member states shall ensure that personal data based on facts are distinguished from personal data based on personal assessments .


### member states shall ensure that , as far as possible , the different categories of personal data undergoing processing are distinguished in accordance with their degree of accuracy and reliability . ### member states shall ensure that the different categories of personal data undergoing processing are distinguished in accordance with their degree of accuracy and reliability .


### where the commission has taken no decision pursuant to article 34 , member states shall provide that a transfer of personal data to a recipient in a third country or an international organisation may take place where : appropriate safeguards with respect to the protection of personal data have been adduced in a legally binding instrument ; or the controller or processor has assessed all the circumstances surrounding the transfer of personal data and concludes that appropriate safeguards exist with respect to the protection of personal data . 2 . the decision for transfers under paragraph 1 must be made by duly authorised staff . these transfers must be documented and the documentation must be made available to the supervisory authority on request . ### where the commission has taken no decision pursuant to article 34 , member states shall provide that a transfer of personal data to a recipient in a third country or an international organisation may take place where appropriate safeguards with respect to the protection of personal data have been adduced in a legally binding instrument . 2 . these transfers must be documented and the documentation must be made available to the supervisory authority on request .


### the examination procedure should be used for the adoption of measures as regards documentation by controllers and processors , security of processing , notification of a personal data breach to the supervisory authority , and the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation , given that those acts are of general scope . ### the examination procedure should be used for the adoption of measures as regards security of processing and notification of a personal data breach to the supervisory authority , given that those acts are of general scope .


### conducts investigations either on its own initiative or on the basis of a complaint , or on request of another supervisory authority , and informs the data subject concerned , if the data subject has addressed a complaint , of the outcome of the investigations within a reasonable period ; ### conducts investigations , inspections and audits , either on its own initiative or on the basis of a complaint , or on request of another supervisory authority , and informs the data subject concerned , if the data subject has addressed a complaint , of the outcome of the investigations within a reasonable period ;


### ' data subject ' means an identified natural person or a natural person who can be identified , directly or indirectly , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to an identification number , location data , online identifiers or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural or social identity of that person ; ### ' data subject ' means an identified natural person or a natural person who can be identified or singled out , directly or indirectly , alone or in combination with associated data , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to a unique identifier , location data , online identifiers or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural , social or gender identity or sexual orientation of that person ;


### member states shall provide that the controller and the processor implements appropriate technical and organisational measures to ensure a level of security appropriate to the risks represented by the processing and the nature of the data to be protected , having regard to the state of the art and the cost of their implementation . ### member states shall provide that the controller and the processor implements appropriate technical and organisational measures and procedures to ensure a level of security appropriate to the risks represented by the processing and the nature of the data to be protected , having regard to the state of the art and the cost of their implementation .


### member states shall provide that each supervisory authority must in particular be endowed with : investigative powers , such as powers of access to data forming the subject matter of processing operations and powers to collect all the information necessary for the performance of its supervisory duties ; effective powers of intervention , such as the delivering of opinions before processing is carried out , and ensuring appropriate publication of such opinions , ordering the restriction , erasure or destruction of data , imposing a temporary or definitive ban on processing , warning or admonishing the controller , or referring the matter to national parliaments or other political institutions ; the power to engage in legal proceedings where the provisions adopted pursuant to this directive have been infringed or to bring this infringement to the attention of the judicial authorities . ### member states shall provide that each supervisory authority has the power : to notify the controller or the processor of an alleged breach of the provisions governing the processing of personal data , and , where appropriate , order the controller or the processor to remedy that breach , in a specific manner , in order to improve the protection of the data subject ; to order the controller to comply with the data subject ' s requests to exercise his or her rights under this directive , including those provided by articles 12 to 17 where such requests have been refused in breach of those provisions ; to order the controller or the processor to provide information pursuant to article 10 and and articles 11 , 28 and 29 ; to ensure compliance with opinions on prior consultations referred to in article 26 ; to warn or admonish the controller or the processor ; to order the rectification , erasure or destruction of all data when they have been processed in breach of the provisions adopted pursuant to this directive and the notification of such actions to third parties to whom the data have been disclosed ; to impose a temporary or definitive ban on processing ; to suspend data flows to a recipient in a third country or to an international organisation ; to inform national parliaments , the government or other public institutions as well as the public on the matter . 2 . each supervisory authority shall have the investigative power to obtain from the controller or the processor : access to all personal data and to all information necessary for the performance of its supervisory duties , access to any of its premises , including to any data processing equipment and means , in accordance with national law , where there are reasonable grounds for presuming that an activity in violation of the provisions adopted pursuant to this directive is being carried out there , without prejudice to a judicial authorisation if required by national law . 3 . each supervisory authority shall have the power to bring violations of the provisions adopted pursuant to this directive to the attention of the judicial authorities and to engage in legal proceedings and bring an action to the competent court pursuant to article 53 . 4 . each supervisory authority shall have the power to impose penalties in respect of administrative offences .


### member states shall ensure that the controller documents the grounds for omitting the communication of the factual or legal reasons on which the decision is based . ### member states shall ensure that the controller documents the assessment referred to in paragraph 2 as well as the grounds for restricting the communication of the factual or legal reasons on which the decision is based .


### member states should be allowed to adopt legislative measures delaying , restricting or omitting the information of data subjects or the access to their personal data to the extent that and as long as such partial or complete restriction constitutes a necessary and proportionate measure in a democratic society with due regard for the legitimate interests of the person concerned , to avoid obstructing official or legal inquiries , investigations or procedures , to avoid prejudicing the prevention , detection , investigation and prosecution of criminal offences or for the execution of criminal penalties , to protect public security or national security , or , to protect the data subject or the rights and freedoms of others . ### member states should be allowed to adopt legislative measures delaying , restricting the information of data subjects or the access to their personal data to the extent that and as long as such partial or complete restriction constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and the legitimate interests of the person concerned , to avoid obstructing official or legal inquiries , investigations or procedures , to avoid prejudicing the prevention , detection , investigation and prosecution of criminal offences or for the execution of criminal penalties , to protect public security or national security , or , to protect the data subject or the rights and freedoms of others . the controller should assess by way of concrete and individual examination of each case if partial or complete restriction of the right of access should apply .


### the commission shall review within three years after the entry into force of this directive other acts adopted by the european union which regulate the processing of personal data by competent authorities for the purposes of prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties , in particular those acts adopted by the union referred to in article 59 , in order to assess the need to align them with this directive and make , where appropriate , the necessary proposals to amend these acts to ensure a consistent approach on the protection of personal data within the scope of this directive . ### the commission shall review within two years after the entry into force of this directive other acts adopted by the european union which regulate the processing of personal data by competent authorities for the purposes of prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties , in particular those acts adopted by the union referred to in article 59 , and shall make appropriate proposals with a view to ensuring consistent and homogeneous legal rules relating to the processing of personal data by competent authorities for the purposes of prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties within the scope of this directive .


### specific provisions with regard to the processing of personal data by competent authorities for the purposes of prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties in acts of the union which were adopted prior to the date of the adoption of this directive , regulating the processing of personal data between member states or the access of designated authorities of member states to information systems established pursuant to the treaties , should remain unaffected . the commission should evaluate the situation with regard to the relation between this directive and the acts adopted prior to the date of adoption of this directive regulating the processing of personal data between member states or the access of designated authorities of member states to information systems established pursuant to the treaties , in order to assess the need for alignment of these specific provisions with this directive . ### specific provisions with regard to the processing of personal data by competent authorities for the purposes of prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties in acts of the union which were adopted prior to the date of the adoption of this directive , regulating the processing of personal data between member states or the access of designated authorities of member states to information systems established pursuant to the treaties , should remain unaffected . moreover , this directive should not apply to the processing of personal data carried out by the union institutions , bodies , offices and agencies , which are governed by different legal instruments . as a result , this directive does not entirely remedy the existing lack of comprehensiveness of the data protection legal rules in the union and the uneven level of protection of the rights of data subjects . since article 8 of the charter of fundamental rights and article 16 tfeu imply that the fundamental right to the protection of personal data should be ensured in a consistent and homogeneous manner through the union , the commission should , within two years after the entry into force of this directive , evaluate the situation with regard to the relation between this directive and the acts adopted prior to the date of adoption of this directive regulating the processing of personal data between member states or the access of designated authorities of member states to information systems established pursuant to the treaties , and should present appropriate proposals with a view to ensuring consistent and homogeneous legal rules relating to the processing of personal data by competent authorities or the access of designated authorities of member states to information systems established pursuant to the treaties as well as the processing of personal data by union institutions , bodies , offices and agencies for the purposes of prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties within the scope of this directive .


### the controller or the processor should designate a person who would assist the controller or processor to monitor compliance with the provisions adopted pursuant to this directive . a data protection officer may be appointed jointly by several entities of the competent authority . the data protection officers must be in a position to perform their duties and tasks independently and effectively . ### the controller or the processor should designate a person who would assist the controller or processor to monitor and demonstrate compliance with the provisions adopted pursuant to this directive . where several competent authorities are acting under the supervision of a central authority , at least this central authority should designate such data protection officer . the data protection officers must be in a position to perform their duties and tasks independently and effectively , in particular by establishing rules that avoid conflict of interest with other tasks performed by the data protection officer .


### member states shall provide that any transfer of personal data by competent authorities that is undergoing processing or is intended for processing after transfer to a third country , or to an international organisation , including further onward transfer to another third country or international organisation , may take place only if : the transfer is necessary for the prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties ; and the conditions laid down in this chapter are complied with by the controller and processor . ### member states shall provide that any transfer of personal data by competent authorities that is undergoing processing or is intended for processing after transfer to a third country , or to an international organisation , including further onward transfer to another third country or international organisation , may take place only if : the specific transfer is necessary for the prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties ; the data are transferred to a controller in a third country or international organisation that is an public authority competent for the purposes referred in article 1 ; the conditions laid down in articles 34 to 37 are complied with by the controller and the processor , including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation ; the other provisions adopted pursuant to this directive are complied with by the controller and processor ; and the level of protection of the personal data individuals guaranteed in the union by this directive is not undermined . 2 . member states shall provide that a transfer , subject to the conditions set out in paragraph 1 , may only take place : where the commission has decided under the conditions and procedure referred to in article 34 that the third country or international organisation in question ensures an adequate level of protection ; or where appropriate safeguards with respect to the protection of personal data have been adduced in a legally binding instrument as referred to in article 35 .


### the general conditions for the members of the supervisory authority should be laid down by law in each member state and should in particular provide that those members should be either appointed by the parliament or the government of the member state , and include rules on the personal qualification of the members and the position of those members . ### the general conditions for the members of the supervisory authority should be laid down by law in each member state and should in particular provide that those members should be either appointed by the parliament or the government , on the basis of the consultation of the parliament , of the member state , and include rules on the personal qualification of the members and the position of those members .


### the protection of the rights and freedoms of data subjects as well as the responsibility and liability of controllers and processors requires a clear attribution of the responsibilities under this directive , including where a controller determines the purposes , conditions and means of the processing jointly with other controllers or where a processing operation is carried out on behalf of a controller . ### the protection of the rights and freedoms of data subjects as well as the responsibility and liability of controllers and processors requires a clear attribution of the responsibilities under this directive , including where a controller determines the purposes , conditions and means of the processing jointly with other controllers or where a processing operation is carried out on behalf of a controller . the data subject should have the right to exercise his or her rights under this directive in respect of and against each of the joint controllers .


### member states shall provide that the processing of personal data is lawful only if and to the extent that processing is necessary : for the performance of a task carried out by a competent authority , based on law for the purposes set out in article 1 ; or for compliance with a legal obligation to which the controller is subject ; or in order to protect the vital interests of the data subject or of another person ; or for the prevention of an immediate and serious threat to public security . ### member states shall provide that the processing of personal data is lawful only if and to the extent that processing is necessary for the performance of a task carried out by a competent authority , based on union or national law for the purposes set out in article 1 .


### in order to fulfil the objectives of this directive , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free exchange of personal data by competent authorities within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted in respect of notifications of a personal data breach to the supervisory authority . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council . ### in order to fulfil the objectives of this directive , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free exchange of personal data by competent authorities within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted in respect of notifications of a personal data breach to the supervisory authority and as regards the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level , in particular with the european data protection board . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council .


### member states may adopt legislative measures delaying , restricting or omitting the provision of the information to the data subject to the extent that , and as long as , such partial or complete restriction constitutes a necessary and proportionate measure in a democratic society with due regard for the legitimate interests of the person concerned : ### member states may adopt legislative measures delaying or restricting the provision of the information to the data subject to the extent that , and as long as , such partial or complete restriction constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and the legitimate interests of the person concerned :


### member states may determine categories of data processing which may wholly or partly fall under the exemptions of paragraph 4 . ### member states shall provide that the controller shall assess , in each specific case , by means of a concrete and individual examination , whether a partial or complete restriction for one of the reasons referred to in paragraph 4 applies . member states may also determine categories of data processing which may wholly or partly fall under the exemptions under points , , and of paragraph 4 .


### where personal data relating to a data subject are collected , member states shall ensure that the controller takes all appropriate measures to provide the data subject with at least the following information : ### where personal data relating to a data subject are collected , member states shall ensure that the controller provides the data subject with at least the following information :


### in order to ensure uniform conditions for the implementation of this directive as regards documentation by controllers and processors , security of processing , notably in relation to encryption standards , notification of a personal data breach to the supervisory authority , and the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation , implementing powers should be conferred on the commission . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by the member states of the commission ' s exercise of implementing powers . ### in order to ensure uniform conditions for the implementation of this directive as regards documentation by controllers and processors , security of processing , notably in relation to encryption standards , notification of a personal data breach to the supervisory authority , implementing powers should be conferred on the commission . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by the member states of the commission ' s exercise of implementing powers .


### the processing is authorised by a law providing appropriate safeguards ; or ### the processing is necessary for the performance of a task carried out in the public interest by the competent authorities for the purposes set out in article 1 , on the basis of union or national law which shall provide for specific and suitable measures to safeguard the data subject ' s legitimate interests , including specific authorisation from a judicial authority , if required national law ; or


### in order to ensure consistent monitoring and enforcement of this directive throughout the union , the supervisory authorities should have the same duties and effective powers in each member state , including powers of investigation , legally binding intervention , decisions and sanctions , particularly in cases of complaints from individuals , and to engage in legal proceedings . ### in order to ensure consistent monitoring and enforcement of this directive throughout the union , the supervisory authorities should have the same duties and effective powers in each member state , including effective powers of investigation , power to access all personal data and all information necessary for the performance of each supervisory function , power to access any of the premises of the data controller or the processor including data processing requirements , and legally binding intervention , decisions and sanctions , particularly in cases of complaints from individuals , and to engage in legal proceedings .


### personal data which are , by their nature , particularly sensitive in relation to fundamental rights or privacy , including genetic data , deserve specific protection . such data should not be processed , unless processing is specifically authorised by a law which provides for suitable measures to safeguard the data subject ' s legitimate interests ; or processing is necessary to protect the vital interests of the data subject or of another person ; or the processing relates to data which are manifestly made public by the data subject . ### personal data which are , by their nature , particularly sensitive and vulnerable in relation to fundamental rights or privacy , deserve specific protection . such data should not be processed , unless processing is specifically necessary for the performance of a task carried out in the public interest , on the basis of union or national law which provides for suitable measures to safeguard the data subject ' s legitimate interests ; or processing is necessary to protect the vital interests of the data subject or of another person ; or the processing relates to data which are manifestly made public by the data subject .