Article 6 - Reg. Eu 2016 / 679
(Text in PDF version downloadable by clicking here)
Lawfulness of the processing
- Treatment is lawful only if and to the extent that at least one of the following conditions occurs:
a) |
the interested party has given consent to the processing of their personal data for one or more specific purposes; |
b) |
the processing is necessary for the execution of a contract of which the interested party is a party or for the execution of pre-contractual measures adopted at the request of the same; |
c) |
the processing is necessary to fulfill a legal obligation to which the data controller is subject; |
d) |
the processing is necessary for the protection of the vital interests of the data subject or of another natural person; |
e) |
the processing is necessary for the performance of a task of public interest or connected to the exercise of public authority of which the data controller is invested; |
f) |
the processing is necessary for the pursuit of the legitimate interest of the data controller or third parties, provided that the interests or fundamental rights and freedoms of the data subject that require the protection of personal data do not prevail, in particular if the data subject is a minor. |
Letter f) of the first paragraph does not apply to the processing of data carried out by public authorities in the performance of their tasks.
- Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing, in accordance with points (c) and (e) of paragraph 1, by determining more precisely specific requirements for processing and other measures. able to guarantee a lawful and correct treatment also for the other specific treatment situations referred to in chapter IX.
- The basis on which the processing of the data referred to in paragraph 1, letters c) and e) is based must be established:
a) |
by Union law; or |
b) |
from the law of the Member State to which the controller is subject. |
The purpose of the processing is determined on this legal basis or, as regards the processing referred to in paragraph 1, letter e), it is necessary for the execution of a task carried out in the public interest or connected to the exercise of public authority referred to the data controller is invested. This legal basis could contain specific provisions to adapt the application of the rules of this regulation, including: the general conditions relating to the lawfulness of processing by the data controller; the types of data being processed; the interested parties; the subjects to whom the personal data may be disclosed and the purposes for which they are disclosed; the limitations of the purpose, the retention periods and the processing operations and procedures, including the measures to guarantee a lawful and correct treatment, such as those for other specific processing situations referred to in Chapter IX. Union or Member State law pursues an objective of public interest and is proportionate to the legitimate objective pursued.
- Where the processing for a purpose other than that for which the personal data were collected is not based on the consent of the data subject or on a legislative act of the Union or of the Member States which constitutes a necessary and proportionate measure in a democratic society to the safeguarding of the objectives referred to in Article 23, paragraph 1, in order to verify whether the processing for another purpose is compatible with the purpose for which the personal data were initially collected, the data controller takes into account, among the other:
a) |
of any connection between the purposes for which the personal data were collected and the purposes of the further processing envisaged; |
b) |
the context in which the personal data were collected, in particular in relation to the relationship between the data subject and the data controller; |
c) |
the nature of the personal data, especially if particular categories of personal data are processed pursuant to Article 9, or if data relating to criminal convictions and offenses pursuant to Article 10 are processed; |
d) |
the possible consequences of the further processing envisaged for the data subjects; |
e) |
the existence of adequate safeguards, which may include encryption or pseudonymisation. |