h) “The data subject’s consent” shall mean any freely given specific and informed indication of his wishes by which the data subject gives his consent to his personal data being processed; i) “Combination of data” shall mean a form of processing which consists of the possibility of correlating data in a filing system or systems kept by another or other controllers or kept by the same controller for other purposes. 2. In circumstances referred to in 1 a), a person is considered identifiable a person who may be directly or indirectly identified by means of an identification number or by means of one or more specific elements of his physical, physiological, psychological, economic, cultural or social characteristics. 3. In circumstances referred to in 1 d), whenever the purposes or processing means are determined by legislative provisions or regulations, the controller of the processing must be indicated in the law of the organisation and operations or in the statutes of the legal entity or statutorily competent for processing the personal data in question. CHAPTER II Processing of personal data Section I Data quality and lawfulness of their processing Article 6 Data quality 1. Personal data must be: a) processed lawfully and with respect for the principle of good faith; b) collected for specific, explicit and legitimate purposes and not further processed in a way incompatible with those purposes; c) adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed; d) accurate and, where necessary, kept up to date and adequate measures must be taken to ensure that data which are inaccurate or incomplete are erased or rectified having regard to the purposes for which they were collected or for which they are further processed; e) to be kept in a form that permits identification of their subjects for no longer than is necessary for the purposes for which they were collected or for which they are further processed. 2. Further processing of data for historical, statistical or scientific purposes as well as their being stored for the same purposes for a period longer than that referred to 1 e) above may be authorised by the CNPD at the request of the controller in instances of legitimate interest for long as it does compromise the rights, freedoms and guarantees of the data subject. 3. It shall be the responsibility of the controller to ensure that the above numbers are complied with.