CURIA - Documents
13 of 58
http://curia.europa.eu/juris/document/document_print.jsf?docid=2320...
the public interest, scientific or historical research purposes or statistical purposes shall, in
accordance with Article 89(1), not be considered to be incompatible with the initial purposes
(“purpose limitation”);
(c)
adequate, relevant and limited to what is necessary in relation to the purposes for which they
are processed (“data minimisation”);
(d)
accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure
that personal data that are inaccurate, having regard to the purposes for which they are
processed, are erased or rectified without delay (“accuracy”);
(e)
kept in a form which permits identification of data subjects for no longer than is necessary
for the purposes for which the personal data are processed; personal data may be stored for
longer periods in so far as the personal data will be processed solely for archiving purposes in
the public interest, scientific or historical research purposes or statistical purposes in
accordance with Article 89(1) subject to implementation of the appropriate technical and
organisational measures required by this Regulation in order to safeguard the rights and
freedoms of the data subject (“storage limitation”);
(f)
processed in a manner that ensures appropriate security of the personal data, including
protection against unauthorised or unlawful processing and against accidental loss,
destruction or damage, using appropriate technical or organisational measures (“integrity and
confidentiality”).
…’
26
Article 6 of that regulation reads as follows:
‘1.
Processing shall be lawful only if and to the extent that at least one of the following applies:
…
(c)
processing is necessary for compliance with a legal obligation to which the controller is
subject;
…
3.
by:
The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down
(a)
Union law; or
(b)
Member State law to which the controller is subject.
The purpose of the processing shall be determined in that legal basis … That legal basis may
contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general
conditions governing the lawfulness of processing by the controller; the types of data which are
subject to the processing; the data subjects concerned; the entities to, and the purposes for which,
the personal data may be disclosed; the purpose limitation; storage periods; and processing
operations and processing procedures, including measures to ensure lawful and fair processing such
as those for other specific processing situations as provided for in Chapter IX. The Union or the
Member State law shall meet an objective of public interest and be proportionate to the legitimate
aim pursued.
…’
27
Article 23 of that regulation provides:
2/15/2021, 4:58 PM