28
•
•
•
•
Collected for specified, explicit and legitimate purposes and not
further processed in a way incompatible with those purposes.
Further processing of data for historical, statistical or scientific
purposes shall not be considered as incompatible provide that
Member States provide adequate safeguards;
Adequate, relevant and not excessive in relation to the purposes for
which they are collected and/or further processed;
Accurate and, where necessary, kept up to date; every reasonable
step must be taken to ensure that data that are inaccurate or
incomplete, having regard to the purposes for which they were
collected or for which they are further processed, are erased or
rectified;
Kept in a form that permits identification of data subjects for no
longer than is necessary for the purposes for which the data were
collected or for which they are further processed. Member States
shall lay down safeguards for personal data stored for longer
periods for historical, statistical or scientific use.
4.3.6
Article 7 states that Member States shall provide that personal data may
be processed only if:
•
The data subject has unambiguously given his consent; or
•
Processing is necessary for the performance of a contract to which
the data subject is party or in order to take steps at the request of
the data subject prior to entering into a contract; or
•
Processing is necessary for compliance with a legal obligation to
which the controller is subject; or
•
Processing is necessary for the performance of a task carried out in
the public interest or in the exercise of official authority vested in
the controller [note: defined term] or in a third party to whom the
data are disclosed; or
•
Processing is necessary for the purposes of legitimate interests
pursued by the controller or by the third party of parties to whom
the data are disclosed, except where such interests are overridden
by the interests for fundamental rights and freedoms of the data
subject that require protection under Article 1(1) [Note; object of
the Directive relating to fundamental rights].
4.3.7
Additional provisions deal with special categories of processing (e.g.,
medical data); information to be given to the data subject; the data
subject’s right to access to data; exceptions and restrictions; data
subject’s right to object; confidentiality and security of processing;
judicial remedies, liabilities and sanctions. In addition, Chapter IV,
Transfer of Personal Data to Third Countries, sets out the provisions that