Principles and legal bases for processing

Every processing of personal data must respect seven principles and rest on at least one legal criterion. These two articles are the foundation of the whole law, and breaching them falls into the most serious category of penalties.

The seven principles (Article 6)

• Lawfulness, fairness and transparency towards the data subject.
• Purpose limitation: data is collected for a specific purpose and not used for another, incompatible one.
• Minimization: only the data needed for the purpose.
• Accuracy: data is kept accurate and up to date.
• Storage limitation: no longer than needed for the purpose.
• Integrity and confidentiality: appropriate security of the data.
• Accountability: the controller must be able to demonstrate compliance.

The six legal criteria (Article 7)

• The data subject's consent for one or more specific purposes.
• Performance of a contract with the data subject, or steps before entering into one at their request.
• Compliance with a legal obligation of the controller.
• Protection of the vital interests of the data subject or another person.
• Performance of a legal task in the public interest or the exercise of public powers.
• The legitimate interests of the controller or a third party, unless the data subject's interests or rights take precedence. This criterion is not available to public authorities performing their tasks.

Consent (Article 8)

• The controller must be able to prove that consent was given.
• The request for consent is clearly distinguishable from other matters and written in plain language.
• Consent can be withdrawn at any time, and withdrawing must be as easy as giving it.
• Consent is not free where there is pressure or an imbalance between the parties.
• For online services offered directly to minors, a minor's consent is valid only from the age of 16. Below that age, consent is given or authorized by the parent or legal guardian (Article 8(6)).

Sensitive data (Article 9)

Sensitive data is data revealing racial or ethnic origin, political opinions, religious belief or philosophical views, trade union membership, as well as genetic data, biometric data and data on a person's health, sex life or sexual orientation (Article 5(28)).

Processing it is prohibited as a rule and allowed only in the cases listed in Article 9, for example with the data subject's explicit consent, for obligations in employment and social security, or to protect vital interests, always with appropriate safeguards.