Last review date: 30 December 2024
Yes.
The following are potential legal bases for processing personal data:
☒ the data subject has provided consent to the processing for the identified purposes
☒ the personal data is necessary to perform a contract with the data subject
☒ the personal data is necessary to comply with a legal obligation
☒ the personal data is necessary to protect the vital interests of a natural person
☒ the personal data is necessary for a public interest
☒ the personal data is necessary to fulfil a legitimate interest of the controller or third party (provided that the interest is not overridden by the data subject's privacy interests and the data subject has not made use of his/her right to object)
☒ other
Additional requirements are in place for the processing of sensitive data (see upcoming section on Legal Bases for Processing of Sensitive Data), personal data in relation to information on criminal activities, social security numbers, data collected by electronic surveillance, financial information and information on credit.
Last review date: 30 December 2024
☒ Yes
The following are potential legal bases for processing sensitive personal data:
☒ the data subject has given consent to the processing, where consent is measured to a higher standard than for non-sensitive personal data (for example, additional requirement for consent to be "explicit")
☒ processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law
☒ processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent
☒ processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and further conditions
☒ processing relates to personal data which are manifestly made public by the data subject
☒ processing is necessary for the establishment, exercise or defense of legal claims
☒ processing is necessary for reasons of substantial public interest
☒ processing is necessary for the purposes of medicine, the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services
☒ processing is necessary for reasons of public interest in the area of public health
☒ processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
Last review date: 30 December 2024
Yes.
Special caution should be taken when processing personal data from minors. Information on the processing must be clear and comprehensive for the minor, with respect to their age and maturity.
As a general rule, minors are those under the age of 18 and they cannot give a valid consent for the processing of their personal data. However, they can validly enter into a contract for digital services which requires the processing of personal data, once they reach 13 years of age.
Last review date: 30 December 2024
☒ in the context of information society services only if processing is based on consent
Last review date: 30 December 2024
☒ consent must be given or authorized by the holder of parental responsibility over the child
☒ other
Given that children merit specific protection, any information and communication, where processing is addressed to a child, should be in such a clear and plain language that the child can easily understand.