h) “The data subject’s consent” shall mean any freely given specific and informed
indication of his wishes by which the data subject gives his consent to his
personal data being processed;
i) “Combination of data” shall mean a form of processing which consists of the
possibility of correlating data in a filing system or systems kept by another or
other controllers or kept by the same controller for other purposes.
2. In circumstances referred to in 1 a), a person is considered identifiable a person
who may be directly or indirectly identified by means of an identification number or
by means of one or more specific elements of his physical, physiological,
psychological, economic, cultural or social characteristics.
3. In circumstances referred to in 1 d), whenever the purposes or processing means
are determined by legislative provisions or regulations, the controller of the
processing must be indicated in the law of the organisation and operations or in the
statutes of the legal entity or statutorily competent for processing the personal data
in question.
CHAPTER II
Processing of personal data
Section I
Data quality and lawfulness of their processing
Article 6
Data quality
1. Personal data must be:
a) processed lawfully and with respect for the principle of good faith;
b) collected for specific, explicit and legitimate purposes and not further
processed in a way incompatible with those purposes;
c) adequate, relevant and not excessive in relation to the purposes for which
they are collected and/or further processed;
d) accurate and, where necessary, kept up to date and adequate measures must
be taken to ensure that data which are inaccurate or incomplete are erased or
rectified having regard to the purposes for which they were collected or for
which they are further processed;
e) to be kept in a form that permits identification of their subjects for no longer
than is necessary for the purposes for which they were collected or for which
they are further processed.
2. Further processing of data for historical, statistical or scientific purposes as well
as their being stored for the same purposes for a period longer than that referred
to 1 e) above may be authorised by the CNPD at the request of the controller in
instances of legitimate interest for long as it does compromise the rights,
freedoms and guarantees of the data subject.
3. It shall be the responsibility of the controller to ensure that the above numbers
are complied with.