Help us make the FRA website better for you!

Take part in a one-to-one session and help us improve the FRA website. It will take about 30 minutes of your time.

YES, I AM INTERESTED NO, I AM NOT INTERESTED

eu-charter

EU Charter of Fundamental Rights

Article 8 - Protection of personal data

Article 8 - Protection of personal data

1. Everyone has the right to the protection of personal data concerning him or her.
2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.
3. Compliance with these rules shall be subject to control by an independent authority.

  • Text:

    This Article has been based on Article 286 of the Treaty establishing the European Community and Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31) as well as on Article 8 of the ECHR and on the Council of Europe Convention of 28 January 1981 for the Protection of Individuals with regard to Automatic Processing of Personal Data, which has been ratified by all the Member States. Article 286 of the EC Treaty is now replaced by Article 16 of the Treaty on the Functioning of the European Union and Article 39 of the Treaty on European Union. Reference is also made to Regulation (EC) No 45/2001 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1). The above-mentioned Directive and Regulation contain conditions and limitations for the exercise of the right to the protection of personal data.

    Source:
    Official Journal of the European Union C 303/17 - 14.12.2007
    Preamble - Explanations relating to the Charter of Fundamental Rights:
    These explanations were originally prepared under the authority of the Praesidium of the Convention which drafted the Charter of Fundamental Rights of the European Union. Although they do not as such have the status of law, they are a valuable tool of interpretation intended to clarify the provisions of the Charter.
  • Mr. … and Mrs …. v. Direct Tax Department (anonymised judgment)
    Decision date:
    Deciding body type:
    National Court/Tribunal
    Deciding body:
    Administrative Court of the Grand Duchy of Luxembourg
    Type:
    Decision
    Policy area:
    ECLI (European case law identifier):
  • Privacy International v Secretary of State for Foreign and Commonwealth Affairs and Others
    Decision date:
    Deciding body type:
    Court of Justice of the European Union
    Deciding body:
    Court (Grand Chamber)
    Type:
    Decision
    Policy area:
    Information society
    ECLI (European case law identifier):
    ECLI:EU:C:2020:790
  • État luxembourgeois v B and Others
    Decision date:
    Deciding body type:
    Court of Justice of the European Union
    Deciding body:
    Court (Grand Chamber)
    Type:
    Decision
    Policy area:
    Taxation
    ECLI (European case law identifier):
    ECLI:EU:C:2020:795
  • La Quadrature du Net and Others v Premier ministre and Others
    Decision date:
    Deciding body type:
    Court of Justice of the European Union
    Deciding body:
    Court (Grand Chamber)
    Type:
    Decision
    Policy area:
    Information society
    ECLI (European case law identifier):
    ECLI:EU:C:2020:791
  • Mr A vs the National Revenue Agency (NRA) (Национална агенция за приходите, НАП)
    Decision date:
    Deciding body type:
    National Court/Tribunal
    Deciding body:
    Supreme Administrative Court
    Type:
    Decision
    Policy area:
    ECLI (European case law identifier):
  • Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems
    Decision date:
    Deciding body type:
    Court of Justice of the European Union
    Deciding body:
    Court (Grand Chamber)
    Type:
    Decision
    Policy area:
    Information society
    ECLI (European case law identifier):
    ECLI:EU:C:2020:559
  • The commercial MIRACLIA TELECOMUNICACIONES, S.L. against the STATE ADMINISTRATION.
    Decision date:
    Deciding body type:
    National Court/Tribunal
    Deciding body:
    The Spanish Supreme Court
    Type:
    Decision
    Policy area:
    ECLI (European case law identifier):
  • European Commission v Hungary.
    Decision date:
    Deciding body type:
    Court of Justice of the European Union
    Deciding body:
    Court (Grand Chamber)
    Type:
    Decision
    Policy area:
    ECLI (European case law identifier):
    ECLI:EU:C:2020:476
  • CJ v Court of Justice of the European Union
    Decision date:
    Deciding body type:
    Court of Justice of the European Union
    Deciding body:
    Court (Seventh Chamber)
    Type:
    Decision
    Policy area:
    Information society
    ECLI (European case law identifier):
    ECLI:EU:C:2020:474
  • Mr T/France
    Decision date:
    Deciding body type:
    National Court/Tribunal
    Deciding body:
    Court of Cassation
    Type:
    Decision
    Policy area:
    ECLI (European case law identifier):
    ECLI:FR:CCASS:2020:CR00434

75 results found

  • Grondwet voor het Koninkrijk der Nederlanden
    Country:
    Netherlands

    Artikel 10 (...) 2. De wet stelt regels ter bescherming van de persoonlijke levenssfeer in verband met het vastleggen en verstrekken van persoonsgegevens. 3. De wet stelt regels inzake de aanspraken van personen op kennisneming van over hen vastgelegde gegevens en van het gebruik dat daarvan wordt gemaakt, alsmede op verbetering van zodanige gegevens. 

  • Wet bescherming persoonsgegevens
    Country:
    Netherlands

    Artikel 4 1. Deze wet is van toepassing op de verwerking van persoonsgegevens in het kader van activiteiten van een vestiging van een verantwoordelijke in Nederland. 2. Deze wet is van toepassing op de verwerking van persoonsgegevens door of ten behoeve van een verantwoordelijke die geen vestiging heeft in de Europese Unie, waarbij gebruik wordt gemaakt van al dan niet geautomatiseerde middelen die zich in Nederland bevinden, tenzij deze middelen slechts worden gebruikt voor de doorvoer van persoonsgegevens. 3. Het is een verantwoordelijke als bedoeld in het tweede lid, verboden persoonsgegevens te verwerken, tenzij hij in Nederland een persoon of instantie aanwijst die namens hem handelt overeenkomstig de bepalingen van deze wet. Voor de toepassing van deze wet en de daarop berustende bepalingen, wordt hij aangemerkt als de verantwoordelijke.

  • Charter of Fundamental Rights and Freedoms
    Country:
    Czechia

    Article 10 (3) Everyone has the right to be protected from the unauthorized gathering, public revelation,
    or other misuse of her personal data.

  • Listina základních práv a svobod
    Country:
    Czechia

    Článek 10 (3) Každý má právo na ochranu před neoprávněným shromažďováním, zveřejňováním nebo jiným zneužíváním údajů o své osobě. 

  • The Protection of Personal Data Act
    Country:
    Czechia
  • Zákon o ochraně osobních údajů
    Country:
    Czechia
  • Data Protection Act 1998
    Country:
    United Kingdom

    Part II Rights Of Data Subjects And Others
    Section 7 Right of access to personal data.
    (1) Subject to the following provisions of this section and to sections 8, 9 and 9A, an individual is entitled—
    (a) to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller,
    (b) if that is the case, to be given by the data controller a description of—
    (i) the personal data of which that individual is the data subject,
    (ii) the purposes for which they are being or are to be processed, and
    (iii) the recipients or classes of recipients to whom they are or may be disclosed,
    (c) to have communicated to him in an intelligible form—
    (i) the information constituting any personal data of which that individual is the data subject, and
    (ii) any information available to the data controller as to the source of those data, and
    (d) where the processing by automatic means of personal data of which that individual is the data subject for the purpose of evaluating matters relating to him such as, for example, his performance at work, his creditworthiness, his reliability or his conduct, has constituted or is likely to constitute the sole basis for any decision significantly affecting him, to be informed by the data controller of the logic involved in that decision-taking.
    (2) A data controller is not obliged to supply any information under subsection (1) unless he has received—
    (a) a request in writing, and
    (b) except in prescribed cases, such fee (not exceeding the prescribed maximum) as he may require.
    (3) Where a data controller—
    (a) reasonably requires further information in order to satisfy himself as to the identity of the person making a request under this section and to locate the information which that person seeks, and
    (b) has informed him of that requirement, the data controller is not obliged to comply with the request unless he is supplied with that further information.
    (4) Where a data controller cannot comply with the request without disclosing information relating to another individual who can be identified from that information, he is not obliged to comply with the request unless—
    (a) the other individual has consented to the disclosure of the information to the person making the request, or
    (b) it is reasonable in all the circumstances to comply with the request without the consent of the other individual.
    (5) In subsection (4) the reference to information relating to another individual includes a reference to information identifying that individual as the source of the information sought by the request; and that subsection is not to be construed as excusing a data controller from communicating so much of the information sought by the request as can be communicated without disclosing the identity of the other individual concerned, whether by the omission of names or other identifying particulars or otherwise.
    (6) In determining for the purposes of subsection (4)(b) whether it is reasonable in all the circumstances to comply with the request without the consent of the other individual concerned, regard shall be had, in particular, to—
    (a) any duty of confidentiality owed to the other individual,
    (b) any steps taken by the data controller with a view to seeking the consent of the other individual,
    (c) whether the other individual is capable of giving consent, and
    (d) any express refusal of consent by the other individual.
    (7) An individual making a request under this section may, in such cases as may be prescribed, specify that his request is limited to personal data of any prescribed description.
    (8) Subject to subsection (4), a data controller shall comply with a request under this section promptly and in any event before the end of the prescribed period beginning with the relevant day.
    (9) If a court is satisfied on the application of any person who has made a request under the foregoing provisions of this section that the data controller in question has failed to comply with the request in contravention of those provisions, the court may order him to comply with the request.
    (10) In this section—
    • “prescribed” means prescribed by the Secretary of State by regulations;
    • “the prescribed maximum” means such amount as may be prescribed;
    • “the prescribed period” means forty days or such other period as may be prescribed;
    • “the relevant day”, in relation to a request under this section, means the day on which the data controller receives the request or, if later, the first day on which the data controller has both the required fee and the information referred to in subsection (3).
    (11)Different amounts or periods may be prescribed under this section in relation to different cases.
    Section 8 Provisions supplementary to section 7.
    (1) The Secretary of State may by regulations provide that, in such cases as may be prescribed, a request for information under any provision of subsection (1) of section 7 is to be treated as extending also to information under other provisions of that subsection.
    (2) The obligation imposed by section 7(1)(c)(i) must be complied with by supplying the data subject with a copy of the information in permanent form unless—
    (a) the supply of such a copy is not possible or would involve disproportionate effort, or
    (b) the data subject agrees otherwise; and where any of the information referred to in section 7(1)(c)(i) is expressed in terms which are not intelligible without explanation the copy must be accompanied by an explanation of those terms.
    (3) Where a data controller has previously complied with a request made under section 7 by an individual, the data controller is not obliged to comply with a subsequent identical or similar request under that section by that individual unless a reasonable interval has elapsed between compliance with the previous request and the making of the current request.
    (4) In determining for the purposes of subsection (3) whether requests under section 7 are made at reasonable intervals, regard shall be had to the nature of the data, the purpose for which the data are processed and the frequency with which the data are altered.
    (5) Section 7(1)(d) is not to be regarded as requiring the provision of information as to the logic involved in any decision-taking if, and to the extent that, the information constitutes a trade secret.
    (6) The information to be supplied pursuant to a request under section 7 must be supplied by reference to the data in question at the time when the request is received, except that it may take account of any amendment or deletion made between that time and the time when the information is supplied, being an amendment or deletion that would have been made regardless of the receipt of the request.
    (7) For the purposes of section 7(4) and (5) another individual can be identified from the information being disclosed if he can be identified from that information, or from that and any other information which, in the reasonable belief of the data controller, is likely to be in, or to come into, the possession of the data subject making the request.
    Section 9 Application of section 7 where data controller is credit reference agency.
    (1) Where the data controller is a credit reference agency, section 7 has effect subject to the provisions of this section.
    (2) An individual making a request under section 7 may limit his request to personal data relevant to his financial standing, and shall be taken to have so limited his request unless the request shows a contrary intention.
    (3) Where the data controller receives a request under section 7 in a case where personal data of which the individual making the request is the data subject are being processed by or on behalf of the data controller, the obligation to supply information under that section includes an obligation to give the individual making the request a statement, in such form as may be prescribed by the Secretary of State by regulations, of the individual’s rights—
    (a) under section 159 of the Consumer Credit Act 1974 , and
    (b) to the extent required by the prescribed form, under this Act.
    Section 9A Unstructured personal data held by public authorities.
    (1) In this section “unstructured personal data” means any personal data falling within paragraph (e) of the definition of “data” in section 1(1), other than information which is recorded as part of, or with the intention that it should form part of, any set of information relating to individuals to the extent that the set is structured by reference to individuals or by reference to criteria relating to individuals.
    (2) A public authority is not obliged to comply with subsection (1) of section 7 in relation to any unstructured personal data unless the request under that section contains a description of the data.
    (3) Even if the data are described by the data subject in his request, a public authority is not obliged to comply with subsection (1) of section 7 in relation to unstructured personal data if the authority estimates that the cost of complying with the request so far as relating to those data would exceed the appropriate limit.
    (4) Subsection (3) does not exempt the public authority from its obligation to comply with paragraph (a) of section 7(1) in relation to the unstructured personal data unless the estimated cost of complying with that paragraph alone in relation to those data would exceed the appropriate limit.
    (5) In subsections (3) and (4) “the appropriate limit” means such amount as may be prescribed by the Secretary of State by regulations, and different amounts may be prescribed in relation to different cases.
    (6) Any estimate for the purposes of this section must be made in accordance with regulations under section 12(5) of the Freedom of Information Act 2000.
    Section 10 Right to prevent processing likely to cause damage or distress.
    (1) Subject to subsection (2), an individual is entitled at any time by notice in writing to a data controller to require the data controller at the end of such period as is reasonable in the circumstances to cease, or not to begin, processing, or processing for a specified purpose or in a specified manner, any personal data in respect of which he is the data subject, on the ground that, for specified reasons—
    (a) the processing of those data or their processing for that purpose or in that manner is causing or is likely to cause substantial damage or substantial distress to him or to another, and
    (b) that damage or distress is or would be unwarranted.
    (2) Subsection (1) does not apply—
    (a) in a case where any of the conditions in paragraphs 1 to 4 of Schedule 2 is met, or
    (b) in such other cases as may be prescribed by the Secretary of State by order.
    (3) The data controller must within twenty-one days of receiving a notice under subsection (1) (“the data subject notice”) give the individual who gave it a written notice—
    (a) stating that he has complied or intends to comply with the data subject notice, or
    (b) stating his reasons for regarding the data subject notice as to any extent unjustified and the extent (if any) to which he has complied or intends to comply with it.
    (4) If a court is satisfied, on the application of any person who has given a notice under subsection (1) which appears to the court to be justified (or to be justified to any extent), that the data controller in question has failed to comply with the notice, the court may order him to take such steps for complying with the notice (or for complying with it to that extent) as the court thinks fit.
    (5) The failure by a data subject to exercise the right conferred by subsection (1) or section 11(1) does not affect any other right conferred on him by this Part.
    11 Right to prevent processing for purposes of direct marketing.
    (1) An individual is entitled at any time by notice in writing to a data controller to require the data controller at the end of such period as is reasonable in the circumstances to cease, or not to begin, processing for the purposes of direct marketing personal data in respect of which he is the data subject.
    (2) If the court is satisfied, on the application of any person who has given a notice under subsection (1), that the data controller has failed to comply with the notice, the court may order him to take such steps for complying with the notice as the court thinks fit.
    (2A) This section shall not apply in relation to the processing of such data as are mentioned in paragraph (1) of regulation 8 of the Telecommunications (Data Protection and Privacy) Regulations 1999 (processing of telecommunications billing data for certain marketing purposes) for the purposes mentioned in paragraph (2) of that regulation.
    (3)In this section “direct marketing” means the communication (by whatever means) of any advertising or marketing material which is directed to particular individuals.
    12 Rights in relation to automated decision-taking.
    (1) An individual is entitled at any time, by notice in writing to any data controller, to require the data controller to ensure that no decision taken by or on behalf of the data controller which significantly affects that individual is based solely on the processing by automatic means of personal data in respect of which that individual is the data subject for the purpose of evaluating matters relating to him such as, for example, his performance at work, his creditworthiness, his reliability or his conduct.
    (2) Where, in a case where no notice under subsection (1) has effect, a decision which significantly affects an individual is based solely on such processing as is mentioned in subsection (1)—
    (a) the data controller must as soon as reasonably practicable notify the individual that the decision was taken on that basis, and
    (b) the individual is entitled, within twenty-one days of receiving that notification from the data controller, by notice in writing to require the data controller to reconsider the decision or to take a new decision otherwise than on that basis.
    (3) The data controller must, within twenty-one days of receiving a notice under subsection (2)(b) (“the data subject notice”) give the individual a written notice specifying the steps that he intends to take to comply with the data subject notice.
    (4) A notice under subsection (1) does not have effect in relation to an exempt decision; and nothing in subsection (2) applies to an exempt decision.
    (5) In subsection (4) “exempt decision” means any decision—
    (a) in respect of which the condition in subsection (6) and the condition in subsection (7) are met, or
    (b) which is made in such other circumstances as may be prescribed by the Secretary of State by order.
    (6) The condition in this subsection is that the decision—
    (a) is taken in the course of steps taken—
    (i) for the purpose of considering whether to enter into a contract with the data subject,
    (ii) with a view to entering into such a contract, or
    (iii) in the course of performing such a contract, or
    (b) is authorised or required by or under any enactment.
    (7) The condition in this subsection is that either—
    (a) the effect of the decision is to grant a request of the data subject, or
    (b) steps have been taken to safeguard the legitimate interests of the data subject (for example, by allowing him to make representations).
    (8) If a court is satisfied on the application of a data subject that a person taking a decision in respect of him (“the responsible person”) has failed to comply with subsection (1) or (2)(b), the court may order the responsible person to reconsider the decision, or to take a new decision which is not based solely on such processing as is mentioned in subsection (1).
    (9) An order under subsection (8) shall not affect the rights of any person other than the data subject and the responsible person.
    Section 13 Compensation for failure to comply with certain requirements.
    (1) An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.
    (2) An individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress if—
    (a) the individual also suffers damage by reason of the contravention, or
    (b) the contravention relates to the processing of personal data for the special purposes.
    (3) In proceedings brought against a person by virtue of this section it is a defence to prove that he had taken such care as in all the circumstances was reasonably required to comply with the requirement concerned.
    Section 14 Rectification, blocking, erasure and destruction.
    (1) If a court is satisfied on the application of a data subject that personal data of which the applicant is the subject are inaccurate, the court may order the data controller to rectify, block, erase or destroy those data and any other personal data in respect of which he is the data controller and which contain an expression of opinion which appears to the court to be based on the inaccurate data.
    (2) Subsection (1) applies whether or not the data accurately record information received or obtained by the data controller from the data subject or a third party but where the data accurately record such information, then—
    (a) if the requirements mentioned in paragraph 7 of Part II of Schedule 1 have been complied with, the court may, instead of making an order under subsection (1), make an order requiring the data to be supplemented by such statement of the true facts relating to the matters dealt with by the data as the court may approve, and
    (b) if all or any of those requirements have not been complied with, the court may, instead of making an order under that subsection, make such order as it thinks fit for securing compliance with those requirements with or without a further order requiring the data to be supplemented by such a statement as is mentioned in paragraph (a).
    (3) Where the court—
    (a) makes an order under subsection (1), or
    (b) is satisfied on the application of a data subject that personal data of which he was the data subject and which have been rectified, blocked, erased or destroyed were inaccurate, it may, where it considers it reasonably practicable, order the data controller to notify third parties to whom the data have been disclosed of the rectification, blocking, erasure or destruction.
    (4) If a court is satisfied on the application of a data subject—
    (a) that he has suffered damage by reason of any contravention by a data controller of any of the requirements of this Act in respect of any personal data, in circumstances entitling him to compensation under section 13, and
    (b) that there is a substantial risk of further contravention in respect of those data in such circumstances, the court may order the rectification, blocking, erasure or destruction of any of those data.
    (5) Where the court makes an order under subsection (4) it may, where it considers it reasonably practicable, order the data controller to notify third parties to whom the data have been disclosed of the rectification, blocking, erasure or destruction.
    (6)In determining whether it is reasonably practicable to require such notification as is mentioned in subsection (3) or (5) the court shall have regard, in particular, to the number of persons who would have to be notified.
    Section 15 Jurisdiction and procedure.
    (1) The jurisdiction conferred by sections 7 to 14 is exercisable in England and Wales by the High Court or the county court or, in Northern Ireland, by the High Court or a county court or, in Scotland, by the Court of Session or the sheriff.
    (2) For the purpose of determining any question whether an applicant under subsection (9) of section 7 is entitled to the information which he seeks (including any question whether any relevant data are exempt from that section by virtue of Part IV) a court may require the information constituting any data processed by or on behalf of the data controller and any information as to the logic involved in any decision-taking as mentioned in section 7(1)(d) to be made available for its own inspection but shall not, pending the determination of that question in the applicant’s favour, require the information sought by the applicant to be disclosed to him or his representatives whether by discovery (or, in Scotland, recovery) or otherwise.

  • Police and Criminal Evidence Act 1984 (as ammended by The Protection of Freedoms Act 2012)
    Country:
    United Kingdom

    61Finger-printing.
    (1)Except as provided by this section no person’s fingerprints may be taken without the appropriate consent.
    (2)Consent to the taking of a person’s fingerprints must be in writing if it is given at a time when he is at a police station.
    3)The fingerprints of a person detained at a police station may be taken without the appropriate consent if—
    (a)he is detained in consequence of his arrest for a recordable offence; and
    (b)he has not had his fingerprints taken in the course of the investigation of the offence by the police.
    (3A)Where a person mentioned in paragraph (a) of subsection (3) or (4) has already had his fingerprints taken in the course of the investigation of the offence by the police, that fact shall be disregarded for the purposes of that subsection if—
    (a)the fingerprints taken on the previous occasion do not constitute a complete set of his fingerprints; or
    (b)some or all of the fingerprints taken on the previous occasion are not of sufficient quality to allow satisfactory analysis, comparison or matching (whether in the case in question or generally).
    (4)The fingerprints of a person detained at a police station may be taken without the appropriate consent if—
    (a)he has been charged with a recordable offence or informed that he will be reported for such an offence; and
    (b)he has not had his fingerprints taken in the course of the investigation of the offence by the police.
    (4A)The fingerprints of a person who has answered to bail at a court or police station may be taken without the appropriate consent at the court or station if—
    (a)the court, or
    (b)an officer of at least the rank of inspector,
    authorises them to be taken.
    (4B)A court or officer may only give an authorisation under subsection (4A) if—
    (a)the person who has answered to bail has answered to it for a person whose fingerprints were taken on a previous occasion and there are reasonable grounds for believing that he is not the same person; or
    (b)the person who has answered to bail claims to be a different person from a person whose fingerprints were taken on a previous occasion.
    (5)An officer may give an authorisation under subsection (4A) above orally or in writing but, if he gives it orally, he shall confirm it in writing as soon as is practicable.
    5A)The fingerprints of a person may be taken without the appropriate consent if (before or after the coming into force of this subsection) he has been arrested for a recordable offence and released and—
    (a) he has not had his fingerprints taken in the course of the investigation of the offence by the police; or
    (b) he has had his fingerprints taken in the course of that investigation but
    (i)subsection (3A)(a) or (b) above applies, or
    (ii)subsection (5C) below applies.
    (5B)The fingerprints of a person not detained at a police station may be taken without the appropriate consent if (before or after the coming into force of this subsection) he has been charged with a recordable offence or informed that he will be reported for such an offence and—
    (a)he has not had his fingerprints taken in the course of the investigation of the offence by the police; or
    (b)he has had his fingerprints taken in the course of that investigation but
    (i)subsection (3A)(a) or (b) above applies, or
    (ii)subsection (5C) below applies.
    (5C)This subsection applies where—
    (a)the investigation was discontinued but subsequently resumed, and
    (b)before the resumption of the investigation the fingerprints were destroyed pursuant to section 63D(3) below.
    (6)Subject to this section, the fingerprints of a person may be taken without the appropriate consent if (before or after the coming into force of this subsection)—
    (a)he has been convicted of a recordable offence, or
    (b)he has been given a caution in respect of a recordable offence which, at the time of the caution, he has admitted, and
    (c). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
    either of the conditions mentioned in subsection (6ZA) below is met.
    (6ZA)The conditions referred to in subsection (6) above are—
    (a)the person has not had his fingerprints taken since he was convicted, or cautioned;
    (b)he has had his fingerprints taken since then but subsection (3A)(a) or (b) above applies.
    (6ZB)Fingerprints may only be taken as specified in subsection (6) above with the authorisation of an officer of at least the rank of inspector.
    (6ZC)An officer may only give an authorisation under subsection (6ZB) above if the officer is satisfied that taking the fingerprints is necessary to assist in the prevention or detection of crime.
    (6A)A constable may take a person's fingerprints without the appropriate consent if—
    (a)the constable reasonably suspects that the person is committing or attempting to commit an offence, or has committed or attempted to commit an offence; and
    (b)either of the two conditions mentioned in subsection (6B) is met.
    (6B)The conditions are that—
    (a)the name of the person is unknown to, and cannot be readily ascertained by, the constable;
    (b)the constable has reasonable grounds for doubting whether a name furnished by the person as his name is his real name.
    (6C)The taking of fingerprints by virtue of subsection (6A) does not count for any of the purposes of this Act as taking them in the course of the investigation of an offence by the police.
    (6D)Subject to this section, the fingerprints of a person may be taken without the appropriate consent if—
    (a)under the law in force in a country or territory outside England and Wales the person has been convicted of an offence under that law (whether before or after the coming into force of this subsection and whether or not he has been punished for it);
    (b)the act constituting the offence would constitute a qualifying offence if done in England and Wales (whether or not it constituted such an offence when the person was convicted); and
    (c)either of the conditions mentioned in subsection (6E) below is met.
    (6E)The conditions referred to in subsection (6D)(c) above are—
    (a)the person has not had his fingerprints taken on a previous occasion under subsection (6D) above;
    (b)he has had his fingerprints taken on a previous occasion under that subsection but subsection (3A)(a) or (b) above applies.
    (6F)Fingerprints may only be taken as specified in subsection (6D) above with the authorisation of an officer of at least the rank of inspector.
    (6G)An officer may only give an authorisation under subsection (6F) above if the officer is satisfied that taking the fingerprints is necessary to assist in the prevention or detection of crime.
    7)Where a person's fingerprints are taken without the appropriate consent by virtue of any power conferred by this section—
    (a)before the fingerprints are taken, the person shall be informed of—
    (i)the reason for taking the fingerprints;
    (ii)the power by virtue of which they are taken; and
    (iii)in a case where the authorisation of the court or an officer is required for the exercise of the power, the fact that the authorisation has been given; and
    (b)those matters shall be recorded as soon as practicable after the fingerprints are taken.
    (7A)If a person’s fingerprints are taken at a police station, or by virtue of subsection (4A), (6A) at a place other than a police station, whether with or without the appropriate consent—
    (a)before the fingerprints are taken, an officer (or, where by virtue of subsection (4A), (6A) or (6BA) the fingerprints are taken at a place other than a police station, the constable taking the fingerprints) shall inform him that they may be the subject of a speculative search; and
    (b)the fact that the person has been informed of this possibility shall be recorded as soon as is practicable after the fingerprints have been taken.
    (8)If he is detained at a police station when the fingerprints are taken, the matters referred to in subsection (7)(a)(i) to (iii) above and, in the case falling within subsection (7A) above, the fact referred to in paragraph (b) of that subsection shall be recorded on his custody record.
    8A). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
    (8B)Any power under this section to take the fingerprints of a person without the appropriate consent, if not otherwise specified to be exercisable by a constable, shall be exercisable by a constable.
    (9)Nothing in this section—
    (a)affects any power conferred by paragraph 18(2) of Schedule 2 to the Immigration Act 1971; or
    (b)applies to a person arrested or detained under the terrorism provisions.
    (10)Nothing in this section applies to a person arrested under an extradition arrest power.

    Section 62 Intimate samples.
    Subject to section 63B below An intimate sample may be taken from a person in police detention only—
    (a)if a police officer of at least the rank of inspector authorises it to be taken; and
    (b)if the appropriate consent is given.
    1A)An intimate sample may be taken from a person who is not in police detention but from whom, in the course of the investigation of an offence, two or more non-intimate samples suitable for the same means of analysis have been taken which have proved insufficient—
    (a)if a police officer of at least the rank of inspector authorises it to be taken; and
    (b)if the appropriate consent is given.
    (2)An officer may only give an authorisation under subsection (1) or (1A) above if he has reasonable grounds—
    (a)for suspecting the involvement of the person from whom the sample is to be taken in a recordable offence; and
    (b)for believing that the sample will tend to confirm or disprove his involvement.
    (2A)An intimate sample may be taken from a person where—
    (a)two or more non-intimate samples suitable for the same means of analysis have been taken from the person under section 63(3E) below (persons convicted of offences outside England and Wales etc ) but have proved insufficient;
    (b)a police officer of at least the rank of inspector authorises it to be taken; and
    (c)the appropriate consent is given.
    (2B)An officer may only give an authorisation under subsection (2A) above if the officer is satisfied that taking the sample is necessary to assist in the prevention or detection of crime.
    (3)An officer may give an authorisation under subsection (1) or (1A) or (2A) above orally or in writing but, if he gives it orally, he shall confirm it in writing as soon as is practicable.
    (4)The appropriate consent must be given in writing.
    (5)Before an intimate sample is taken from a person, an officer shall inform him of the following—
    (a)the reason for taking the sample;
    (b)the fact that authorisation has been given and the provision of this section under which it has been given; and
    (c)if the sample was taken at a police station, the fact that the sample may be the subject of a speculative search.
    (6)The reason referred to in subsection (5)(a) above must include, except in a case where the sample is taken under subsection (2A) above, a statement of the nature of the offence in which it is suspected that the person has been involved.
    (7)After an intimate sample has been taken from a person, the following shall be recorded as soon as practicable—
    (a)the matters referred to in subsection (5)(a) and (b) above;
    (b)if the sample was taken at a police station, the fact that the person has been informed as specified in subsection (5)(c) above; and
    (c)the fact that the appropriate consent was given.
    (8)If an intimate sample is taken from a person detained at a police station, the matters required to be recorded by subsection (7) ... above shall be recorded in his custody record.
    (9)In the case of an intimate sample which is a dental impression, the sample may be taken from a person only by a registered dentist.
    (9A)In the case of any other form of intimate sample, except in the case of a sample of urine, the sample may be taken from a person only by—
    (a)a registered medical practitioner; or
    (b)a registered health care professional.
    (10)Where the appropriate consent to the taking of an intimate sample from person was refused without good cause, in any proceedings against that person for an offence—
    (a)the court, in determining—
    (i). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
    (ii)whether there is a case to answer; and ( aa )a judge, in deciding whether to grant an application made by the accused under paragraph 2 of Schedule 3 to the Crime and Disorder Act 1998 (applications for dismissal); and
    (b)the court or jury, in determining whether that person is guilty of the offence charged,
    may draw such inferences from the refusal as appear proper .
    (11)Nothing in this section applies to the taking of a specimen for the purposes of any of the provisions of sections 4 to 11 of the Road Traffic Act 1988 or of sections 26 to 38 of the Transport and Works Act 1992 .
    12)Nothing in this section applies to a person arrested or detained under the terrorism provisions; and subsection (1A) shall not apply where the non-intimate samples mentioned in that subsection were taken under paragraph 10 of Schedule 8 to the Terrorism Act 2000.

    Section 63AA Inclusion of DNA profiles on National DNA Database
    (1)This section applies to a DNA profile which is derived from a DNA sample and which is retained under any power conferred by any of sections 63E to 63L (including those sections as applied by section 63P).
    (2)A DNA profile to which this section applies must be recorded on the National DNA Database.
    Section 63AB National DNA Database Strategy Board
    (1)The Secretary of State must make arrangements for a National DNA Database Strategy Board to oversee the operation of the National DNA Database.
    (2)The National DNA Database Strategy Board must issue guidance about the destruction of DNA profiles which are, or may be, retained under this Part of this Act.
    (3)A chief officer of a police force in England and Wales must act in accordance with guidance issued under subsection (2).
    (4)The National DNA Database Strategy Board may issue guidance about the circumstances in which applications may be made to the Commissioner for the Retention and Use of Biometric Material under section 63G.
    (5)Before issuing any such guidance, the National DNA Database Strategy Board must consult the Commissioner for the Retention and Use of Biometric Material.
    (6)The Secretary of State must publish the governance rules of the National DNA Database Strategy Board and lay a copy of the rules before Parliament.
    (7)The National DNA Database Strategy Board must make an annual report to the Secretary of State about the exercise of its functions.
    (8)The Secretary of State must publish the report and lay a copy of the published report before Parliament.
    (9)The Secretary of State may exclude from publication any part of the report if, in the opinion of the Secretary of State, the publication of that part would be contrary to the public interest or prejudicial to national security.

    63D Destruction of fingerprints and DNA profiles
    (1)This section applies to—
    (a)fingerprints—
    (i)taken from a person under any power conferred by this Part of this Act, or
    (ii)taken by the police, with the consent of the person from whom they were taken, in connection with the investigation of an offence by the police, and
    (b)a DNA profile derived from a DNA sample taken as mentioned in paragraph (a)(i) or (ii).
    (2)Fingerprints and DNA profiles to which this section applies (“section 63D material”) must be destroyed if it appears to the responsible chief officer of police that—
    (a)the taking of the fingerprint or, in the case of a DNA profile, the taking of the sample from which the DNA profile was derived, was unlawful, or
    (b)the fingerprint was taken, or, in the case of a DNA profile, was derived from a sample taken, from a person in connection with that person's arrest and the arrest was unlawful or based on mistaken identity.
    (3)In any other case, section 63D material must be destroyed unless it is retained under any power conferred by sections 63E to 63O (including those sections as applied by section 63P).
    (4)Section 63D material which ceases to be retained under a power mentioned in subsection (3) may continue to be retained under any other such power which applies to it.
    (5)Nothing in this section prevents a speculative search, in relation to section 63D material, from being carried out within such time as may reasonably be required for the search if the responsible chief officer of police considers the search to be desirable.

    63Q Destruction of copies of section 63D material
    (1)If fingerprints are required by section 63D to be destroyed, any copies of the fingerprints held by the police must also be destroyed.
    (2)If a DNA profile is required by that section to be destroyed, no copy may be retained by the police except in a form which does not include information which identifies the person to whom the DNA profile relates.
    63R Destruction of samples
    (1)This section applies to samples—
    (a)taken from a person under any power conferred by this Part of this Act, or
    (b)taken by the police, with the consent of the person from whom they were taken, in connection with the investigation of an offence by the police.
    (2)Samples to which this section applies must be destroyed if it appears to the responsible chief officer of police that—
    (a)the taking of the samples was unlawful, or
    (b)the samples were taken from a person in connection with that person's arrest and the arrest was unlawful or based on mistaken identity.
    (3)Subject to this, the rule in subsection (4) or (as the case may be) (5) applies.
    (4)A DNA sample to which this section applies must be destroyed—
    (a)as soon as a DNA profile has been derived from the sample, or
    (b)if sooner, before the end of the period of 6 months beginning with the date on which the sample was taken.
    (5)Any other sample to which this section applies must be destroyed before the end of the period of 6 months beginning with the date on which it was taken.
    (6)The responsible chief officer of police may apply to a District Judge (Magistrates' Courts) for an order to retain a sample to which this section applies beyond the date on which the sample would otherwise be required to be destroyed by virtue of subsection (4) or (5) if—
    (a)the sample was taken from a person in connection with the investigation of a qualifying offence, and
    (b)the responsible chief officer of police considers that the condition in subsection (7) is met.
    (7)The condition is that, having regard to the nature and complexity of other material that is evidence in relation to the offence, the sample is likely to be needed in any proceedings for the offence for the purposes of—
    (a)disclosure to, or use by, a defendant, or
    (b)responding to any challenge by a defendant in respect of the admissibility of material that is evidence on which the prosecution proposes to rely.
    (8)An application under subsection (6) must be made before the date on which the sample would otherwise be required to be destroyed by virtue of subsection (4) or (5).
    (9)If, on an application made by the responsible chief officer of police under subsection (6), the District Judge (Magistrates' Courts) is satisfied that the condition in subsection (7) is met, the District Judge may make an order under this subsection which—
    (a)allows the sample to be retained for a period of 12 months beginning with the date on which the sample would otherwise be required to be destroyed by virtue of subsection (4) or (5), and
    (b)may be renewed (on one or more occasions) for a further period of not more than 12 months from the end of the period when the order would otherwise cease to have effect.
    (10)An application for an order under subsection (9) (other than an application for renewal)—
    (a)may be made without notice of the application having been given to the person from whom the sample was taken, and
    (b)may be heard and determined in private in the absence of that person.
    (11)A sample retained by virtue of an order under subsection (9) must not be used other than for the purposes of any proceedings for the offence in connection with which the sample was taken.
    (12)A sample that ceases to be retained by virtue of an order under subsection (9) must be destroyed.
    (13)Nothing in this section prevents a speculative search, in relation to samples to which this section applies, from being carried out within such time as may reasonably be required for the search if the responsible chief officer of police considers the search to be desirable.

    63T Use of retained material
    (1)Any material to which section 63D, 63R or 63S applies must not be used other than—
    (a)in the interests of national security,
    (b)for the purposes of a terrorist investigation,
    (c)for purposes related to the prevention or detection of crime, the investigation of an offence or the conduct of a prosecution, or
    (d)for purposes related to the identification of a deceased person or of the person to whom the material relates.
    (2)Material which is required by section 63D, 63R or 63S to be destroyed must not at any time after it is required to be destroyed be used—
    (a)in evidence against the person to whom the material relates, or
    (b)for the purposes of the investigation of any offence.
    (3)In this section—
    (a)the reference to using material includes a reference to allowing any check to be made against it and to disclosing it to any person,
    (b)the reference to crime includes a reference to any conduct which—
    (i)constitutes one or more criminal offences (whether under the law of England and Wales or of any country or territory outside England and Wales), or
    (ii)is, or corresponds to, any conduct which, if it all took place in England and Wales, would constitute one or more criminal offences, and
    (c)the references to an investigation and to a prosecution include references, respectively, to any investigation outside England and Wales of any crime or suspected crime and to a prosecution brought in respect of any crime in a country or territory outside England and Wales.
    63U Exclusions for certain regimes
    (1)Sections 63D to 63T do not apply to material to which paragraphs 20A to 20J of Schedule 8 to the Terrorism Act 2000 (destruction, retention and use of material taken from terrorist suspects) apply.
    (2)Any reference in those sections to a person being arrested for, or charged with, an offence does not include a reference to a person—
    (a)being arrested under section 41 of the Terrorism Act 2000, or
    (b)being charged with an offence following an arrest under that section.
    (3)Sections 63D to 63T do not apply to material to which paragraph 8 of Schedule 4 to the International Criminal Court Act 2001 (requirement to destroy material) applies.
    (4)Sections 63D to 63T do not apply to material to which paragraph 6 of Schedule 6 to the Terrorism Prevention and Investigation Measures Act 2011 (requirement to destroy material) applies.
    (5) Sections 63D to 63T do not apply to material which is, or may become, disclosable under—
    (a)the Criminal Procedure and Investigations Act 1996, or
    (b)a code of practice prepared under section 23 of that Act and in operation by virtue of an order under section 25 of that Act.
    5A)A sample that—
    (a)falls within subsection (5), and
    (b)but for that subsection would be required to be destroyed under section 63R,
    must not be used other than for the purposes of any proceedings for the offence in connection with which the sample was taken.
    (5B)A sample that once fell within subsection (5) but no longer does, and so becomes a sample to which section 63R applies, must be destroyed immediately if the time specified for its destruction under that section has already passed.
    (6)Sections 63D to 63T do not apply to material which—
    (a)is taken from a person, but
    (b)relates to another person.
    (7)Nothing in sections 63D to 63T affects any power conferred by—
    (a)paragraph 18(2) of Schedule 2 to the Immigration Act 1971 (power to take reasonable steps to identify a person detained), or
    (b)section 20 of the Immigration and Asylum Act 1999 (disclosure of police information to the Secretary of State for use for immigration purposes).

    64ZN Use of retained material
    (1)Any material to which section 64 applies which is retained after it has fulfilled the purpose for which it was taken or derived must not be used other than—
    (a)in the interests of national security,
    (b)for the purposes of a terrorist investigation,
    (c)for purposes related to the prevention or detection of crime, the investigation of an offence or the conduct of a prosecution, or
    (d)for purposes related to the identification of a deceased person or of the person to whom the material relates.
    (2)Material which is required to be destroyed by virtue of any of sections 64ZA to 64ZJ, or of section 64ZM, must not at any time after it is required to be destroyed be used—
    (a)in evidence against the person to whom the material relates, or
    (b)for the purposes of the investigation of any offence.
    (3)In this section—
    (a)the reference to using material includes a reference to allowing any check to be made against it and to disclosing it to any person,
    (b)the reference to crime includes a reference to any conduct which—
    (i)constitutes one or more criminal offences (whether under the law of a part of the United Kingdom or of a country or territory outside the United Kingdom), or
    (ii)is, or corresponds to, any conduct which, if it all took place in any one part of the United Kingdom, would constitute one or more criminal offences, and
    (c)the references to an investigation and to a prosecution include references, respectively, to any investigation outside the United Kingdom of any crime or suspected crime and to a prosecution brought in respect of any crime in a country or territory outside the United Kingdom.

  • Instrument of Government
    Country:
    Sweden

    Chapter 2 - Fundamental rights and freedoms: Article 3 No record in a public register concerning a Swedish citizen may be based without his or her consent solely on his or her political opinions; Article 6 Everyone shall likewise be protected against body searches, house searches and other such invasions of privacy, against examination of mail or other confidential correspondence, and against eavesdropping and the recording of telephone conversations or other confidential communications. In addition to what is laid down in paragraph one, everyone shall be protected in their relations with the public institutions against significant invasions of their personal privacy, if these occur without their consent and involve the surveillance or systematic monitoring of the individual’s personal circumstances.

  • Kungörelse (1974:152) om beslutad ny regeringsform
    Country:
    Sweden

    2 kapitlet - Grundläggande fri- och rättigheter: 3 § Ingen svensk medborgare får utan samtycke antecknas i ett allmänt register enbart på grund av sin politiska åskådning; 6 § (...) Var och en är dessutom skyddad mot kroppsvisitation, husrannsakan och liknande intrång samt mot undersökning av brev eller annan förtrolig försändelse och mot hemlig avlyssning eller upptagning av telefonsamtal eller annat förtroligt meddelande. Utöver vad som föreskrivs i första stycket är var och en gentemot det allmänna skyddad mot betydande intrång i den personliga integriteten, om det sker utan samtycke och innebär övervakning eller kartläggning av den enskildes personliga förhållanden.

  • Personal Data Act (1998:204)
    Country:
    Sweden

    Article 1 The purpose of this Act is to protect people against the violation of their personal integrity by processing of personal data.

  • Personuppgiftslag (1998:204)
    Country:
    Sweden

    1 § Syftet med denna lag är att skydda människor mot att deras personliga integritet kränks genom behandling av personuppgifter.

  • Constitutión Española
    Country:
    Spain

    Artículo 18(...) 4. La ley limitará el uso de la informática para garantizar el honor y la intimidad personal y familiar de los ciudadanos y el pleno ejercicio de sus derechos.

  • Constitution of the Kingdom of Spain
    Country:
    Spain

    Article 18(...) 4. The law shall restrict the use of data processing in order to guarantee the honour and personal and family privacy of citizens and the full exercise of their rights.

  • LEY ORGÁNICA 15/1999, de 13 de diciembre, de Protección de Datos de Carácter Personal
    Country:
    Spain

    Artículo 1La presente Ley Orgánica tiene por objeto garantizar y proteger, en lo que concierne al tratamiento de los datos personales, las libertades públicas y los derechos fundamentales de las personas físicas, y especialmente de su honor e intimidad personal y familiar.

  • Organic Law 15/1999 of 13 December on the Protection of Personal Data
    Country:
    Spain

    Article 1This Organic Law is intended to guarantee and protect the public liberties and fundamental rights of natural persons, and in particular their personal and family privacy, with regard to the processing of personal data

  • Constitution of the Republic of Slovenia
    Country:
    Slovenia

    Article 38 The protection of personal data shall be guaranteed. The use of personal data contrary to the purpose for which it was collected is prohibited. The collection, processing, designated use, supervision and protection of the confidentiality of personal data shall be provided by law. Everyone has the right of access to the collected personal data that relates to him and the right to judicial protection in the event of any abuse of such data.

  • Personal Data Protection Act 2007
    Country:
    Slovenia
  • Ustava Republike Slovenije
    Country:
    Slovenia

    38. člen Zagotovljeno je varstvo osebnih podatkov. Prepovedana je uporaba osebnih podatkov v nasprotju z namenom njihovega zbiranja. Zbiranje, obdelovanje, namen uporabe, nadzor in varstvo tajnosti osebnih podatkov določa zakon. Vsakdo ima pravico seznaniti se z zbranimi osebnimi podatki, ki se nanašajo nanj, in pravico do sodnega varstva ob njihovi zlorabi.

  • Zakon o varstvu osebnih podatkov
    Country:
    Slovenia

8 results found

  • Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union

    Article 2 - Processing of personal data
    ‘1. Processing of personal data pursuant to this Directive shall be carried out in accordance with Directive 95/46/EC.
    2. Processing of personal data by Union institutions and bodies pursuant to this Directive shall be carried out in accordance with Regulation (EC) No 45/2001.‘

  • Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detec...

    Article 1 - Subject-matter and objectives
    ‘1. This Directive lays down the rules relating to the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.
    2. In accordance with this Directive, Member States shall:
    (a) protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data‘
    Article 4
    ‘Principles relating to processing of personal data
    1. Member States shall provide for personal data to be:
    (a) processed lawfully and fairly;
    (b) collected for specified, explicit and legitimate purposes and not processed in a manner that is incompatible with those purposes;
    (c) adequate, relevant and not excessive in relation to the purposes for which they are processed;
    (d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
    (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which they are processed;
    (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
    2. Processing by the same or another controller for any of the purposes set out in Article 1(1) other than that for which the personal data are collected shall be permitted in so far as:
    (a) the controller is authorised to process such personal data for such a purpose in accordance with Union or Member State law; and
    (b) processing is necessary and proportionate to that other purpose in accordance with Union or Member State law.
    3. Processing by the same or another controller may include archiving in the public interest, scientific, statistical or historical use, for the purposes set out in Article 1(1), subject to appropriate safeguards for the rights and freedoms of data subjects.
    4. The controller shall be responsible for, and be able to demonstrate compliance with, paragraphs 1, 2 and 3.‘

  • Directive (EU) 2016/681 of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime

    Article 13 - Protection of personal data
    ‘1. Each Member State shall provide that, in respect of all processing of personal data pursuant to this Directive, every passenger shall have the same right to protection of their personal data, rights of access, rectification, erasure and restriction and rights to compensation and judicial redress as laid down in Union and national law and in implementation of Articles 17, 18, 19 and 20 of Framework Decision 2008/977/JHA. Those Articles shall therefore apply.‘

  • Directive 2013/40/EU of the European Parliament and of the Council of 12 August 2013 on attacks against information systems and replacing Council Framework Decision 2005/222/JHA

    Article 5 - Illegal data interference
    ‘Member States shall take the necessary measures to ensure that deleting, damaging, deteriorating, altering or suppressing computer data on an information system, or rendering such data inaccessible, intentionally and without right, is punishable as a criminal offence, at least for cases which are not minor.‘
    Article 6 - Illegal interception
    ‘Member States shall take the necessary measures to ensure that intercepting, by technical means, non-public transmissions of computer data to, from or within an information system, including electromagnetic emissions from an information system carrying such computer data, intentionally and without right, is punishable as a criminal offence, at least for cases which are not minor.‘

  • Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General...

    Article 1 - Subject-matter and objectives
    ‘1. This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.
    2. This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.
    3. The free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.‘

  • Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/93...

    Article 28 - General data protection principles
    ‘1. Personal data shall be:
    (a) processed fairly and lawfully;
    (b) collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes. Further processing of personal data for historical, statistical or scientific research purposes shall not be considered incompatible provided that Europol provides appropriate safeguards, in particular to ensure that data are not processed for any other purposes;
    (c) adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed;
    (d) accurate and kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
    (e) kept in a form which permits identification of data subjects for no longer than necessary for the purposes for which the personal data are processed; and
    (f) processed in a manner that ensures appropriate security of personal data.‘
    Article 31 - Time-limits for the storage and erasure of personal data
    ‘1. Personal data processed by Europol shall be stored by Europol only for as long as is necessary and proportionate for the purposes for which the data are processed.‘
    Article 36 - Right of access for the data subject
    ‘1. Any data subject shall have the right, at reasonable intervals, to obtain information on whether personal data relating to him or her are processed by Europol.‘

  • Regulation (EU) No 526/2013 of the European Parliament and of the Council of 21 May 2013 concerning the European Union Agency for Network and Information Security (ENISA) and repealing Regulation (EC) No 460/2004 Text with EEA relevance

    Article 29 - Protection of personal data
    ‘1. When processing data relating to individuals, in particular while performing its tasks, the Agency shall observe the principles of personal data protection in, and be subject to, the provisions of Regulation (EC) No 45/2001.
    2. The Management Board shall adopt implementing measures referred to in Article 24(8) of Regulation (EC) No 45/2001. The Management Board may adopt additional measures necessary for the application of Regulation (EC) No 45/2001 by the Agency.‘

  • Regulation (EU) No 603/2013 of the European Parliament and of the Council of 26 June 2013 on the establishment of 'Eurodac' for the comparison of fingerprints for the effective application of Regulation (EU) No 604/2013 establishing the criteria and me...

    Article 1- Purpose of "Eurodac"
    [...]
    ‘2. This Regulation also lays down the conditions under which Member States' designated authorities and the European Police Office (Europol) may request the comparison of fingerprint data with those stored in the Central System for law enforcement purposes.
    3. Without prejudice to the processing of data intended for Eurodac by the Member State of origin in databases set up under the latter's national law, fingerprint data and other personal data may be processed in Eurodac only for the purposes set out in this Regulation and Article 34(1) of Regulation (EU) No 604/2013.‘
    Article 23 - Responsibility for data processing
    [...]
    ‘2. In accordance with Article 34, the Member State of origin shall ensure the security of the data referred to in paragraph 1 before and during transmission to the Central System as well as the security of the data it receives from the Central System.‘
    Article 27 - Access to, and correction or erasure of, data recorded in Eurodac
    [...]
    ‘4. If a Member State or the Agency has evidence to suggest that data recorded in the Central System are factually inaccurate, it shall advise the Member State of origin as soon as possible.
    If a Member State has evidence to suggest that data were recorded in the Central System in breach of this Regulation, it shall advise the Agency, the Commission and the Member State of origin as soon as possible. The Member State of origin shall check the data concerned and, if necessary, amend or erase them without delay.‘
    Article 33 - Protection of personal data for law enforcement purposes
    [...]
    ‘3. The processing of personal data by Europol pursuant to this Regulation shall be in accordance with Decision 2009/371/JHA and shall be supervised by an independent external data protection supervisor. Articles 30, 31 and 32 of that Decision shall be applicable to the processing of personal data by Europol pursuant to this Regulation. The independent external data protection supervisor shall ensure that the rights of the individual are not violated.‘

3 results found

  • Council of Europe, Guidelines on the protection of individuals with regard to the processing of personal data in a world of big data

    ‘The present Guidelines recommend measures that Parties, controllers and processors should take to prevent the potential negative impact of the use of Big Data on human dignity, human rights, and fundamental individual and collective freedoms, in particular with regard to personal data protection.
    Given the nature of Big Data and its uses, the application of some of the traditional principles of data processing (e.g. the principle of data minimisation, purpose limitation, fairness and transparency, and free, specific and informed consent) may be challenging in this technological scenario. These Guidelines therefore suggest a specific application of the principles of Convention 108, to make them more effective in practice in the Big Data context.‘

  • OECD, Guidelines governing the Protection of Privacy and Transborder Flows of Personal Data

    ‘2. These Guidelines apply to personal data, whether in the public or private sectors, which, because of the manner in which they are processed, or because of their nature or the context in which they are used, pose a risk to privacy and individual liberties.‘
    ‘3. The principles in these Guidelines are complementary and should be read as a whole. They should not be interpreted:
    a) as preventing the application of different protective measures to different categories of personal data, depending upon their nature and the context in which they are collected, stored, processed or disseminated; or
    b) in a manner which unduly limits the freedom of expression‘
    ‘7. There should be limits to the collection of personal data and any such data should be obtained by lawful and fair means and, where appropriate, with the knowledge or consent of the data subject.‘
    ‘9. The purposes for which personal data are collected should be specified not later than at the time of data collection and the subsequent use limited to the fulfilment of those purposes or such others as are not incompatible with those purposes and as are specified on each occasion of change of purpose.‘

  • UN General Assembly Resolution 68/167 (2013) - The right to privacy in the digital age

    ‘1. Reaffirms the right to privacy, according to which no one shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, and the right to the protection of the law against such interference, as set out in article 12 of the Universal Declaration of Human Rights and article 17 of the International Covenant on Civil and Political Rights‘
    ‘4. Calls upon all States:
    (a) To respect and protect the right to privacy, including in the context of digital communication;
    (b) To take measures to put an end to violations of those rights and to create the conditions to prevent such violations, including by ensuring that relevant national legislation complies with their obligations under international human rights law;
    (c) To review their procedures, practices and legislation regarding the surveillance of communications, their interception and the collection of personal data, including mass surveillance, interception and collection, with a view to upholding the right to privacy by ensuring the full and effective implementation of all their obligations under international human rights law;
    (d) To establish or maintain existing independent, effective domestic oversight mechanisms capable of ensuring transparency, as appropriate, and accountability for State surveillance of communications, their interception and the collection of personal data;‘