No L 281/40
Official Journal of the European Communities
23. 11, 95)
SECTION |
PRINCIPLES RELATING TO DATA QUALITY
Article 6
1. Member States shall provide that personal data must
be
la} provessed fairly and lawfully
(b) collected for specified, explicit and legitimate
purposes and not further processed ina way
incompatible with those purposes. Further processing
‘of data for historical, statistical oF svientific purposes
shall nor be considered as incomparible provided thar
Member States provide appropriate safeguards
. relevant and not excessive in relation to the
purposes for which they are collected and/or further
processed
(a) accurate and, whore necessary, kepe up to dates every
reasonable step must be taken co ensure that data
which are inaccurate or incomplete, having regard to
the pueposes for which they were collected or for
which they are further processed, ate erased or
restilid
[e} kept in a form which permits identification of data
subjects for no longer than is nevessary for the
purposes for which the data were collected or for
which they are further processed, Member States shall
lay clown appropriate safeguards for personal data
stored for longer periods far historical, statistical ar
scientific use
2. Te shall be for the eomtroller to ensure that paragraph
Vis complied with.
CRITERIA FOR MAKING DATA PROCESSING
LEGITIMATE
Article 7
Member States shall provide that personal data may be
processed only if
fa} the data subject has unambiguously given his consents
{bh processing is nevessary for the performance of a
Contract to which the data subject is party or in order
to take steps at the request of the data subject prior
to entering into a contract or
(c) processing is necessary for compliance with a legal
Ubligation ro shih the controller 9 subjects oF
(a) processing is necessary in order t0 protect the vital
Interests of the data subject; oF
(c) provessing 1s necessary for the performance of a task
carried out in the public interest or in the exercise of
official authority vested in the controller or in a third
party to whom the data are disclosed: oF
processing is necessary for the purposes of the
legitimate interests pursued by the controller or by the
third party or parties to whom the data are disclosed,
except where such interests are overridden bythe
interests for fundamental rights and freedoms of the
ddata subject which require protection under Anicle
V0).
SECTION ti
SPECIAL CATEGORIES OF PROC
Article 8
The processing of special categories of data
1. Member States shall prohibit the processing of
personal data revealing racial or ethme origin, political
opinions, religious or philosophical beliefs, trade-union
membership, and the processing of data concerning
hhoalth or nox ie
Parageaph 1 chall nat apply where
{a} the data subject has given hs explicit consent 10 the
provessing of those data, except where the laws of the
Member State provide that the prohibition referred to
in paragraph 1 may not be lifted by the data subjects
siving, his consent; or
{b) processing is necessary for the purposes of carrying
four the obligations and specific rights of the
controler inthe fickd of employment law in ae far 99
it is authorized by national law providing for
adequate safeguards; oF
processing is nevessary to protect the vital interests of
the data subject or of another person where che sata
subject is physically oF legally incapable of giving his
(4) processing is carried out in the course of its legitimate
activities with appropriate guarantees by a
foundation, association or any othe
on-profitsccking body with apolitical,
philosophical. religious or trade-union aim and on
Condition that the processing, relates. solely 10. the
smembers of the body or to persons who have regular2.198 CEN]
contact with it in connection with its purposes and!
that the data are not disclosed to a thied party
without the consent of the data subjeetss oF
(e} the processing relates to data which are manifestly
made public by the data subject oF 1s necessary for
the establishment, exercise or defence of legal
3. Paragraph 1 shall not apply where provessing of the
data is required for the purposes of preventive medicine,
medical diagnosis, the provision of care or treatment oF
mnt oF health-care serviees, and where thone
data are processed by a health professional subject under
national law oF rules established by national competent
bodies to the obligation of professional. secrecy or by
another person also subject to an equivalent obligation of
4. Subject to the provision of suitable safeguards,
Member Stares may, for reasons of substantial public
Interest, lay down exemptions in addition to those laid
down in paragraph 2 either by national law or by
decision of the supervisory authority
5. Processing of data relating to offences, criminal
convictions oF secuity: measures may be carried out only
under the control of official authority, or if suitable
specific safeguards are provided under national law.
subject t0 derogations which may be granted by the
Member State under national provisions providing,
Suitable specific safeguards, However, a complete register
of criminal convictions may be kept only under the
control of official authority
Member States. may provide that data relating 1
administranve sanctions or judgements in civil cases shall
fake he pracesed under the cantral of afficial authority
6. Derogations from paragraph 1 provided for in
parageaphs 4 and 5 shall be notified to the Com:
Member States shall determine the conditions under
which a national identification number or any other
idenifier of general applicadion may be provensed.
Article 9
Processing of personal data and freedom of expression
Member States shall provide for exemptions or