gdpr-text.com Open in urlscan Pro
68.183.69.129  Public Scan

Form analysis
5 forms found in the DOM

<form id="custom_search">
  <label><span style="height: 0; width: 0; display: block; overflow: hidden;">*</span>
    <input required="" type="text" value="" placeholder="Zoeken">
  </label>
  <button data-help="" id="custom_search_submit" type="submit" class="hidden">
    <span style="height: 0; width: 0; display: block; overflow: hidden;">search</span>
    <i class="fa fa-search"></i>
  </button>
</form>

---

GET

<form id="select_form" class="filter_form" action="" method="get">
  <div class="lang_wrap">
    <div class="lang_block">
      <input id="one_col" type="radio" name="col" value="1" onchange="location.hash = ''; this.form.submit()">
      <label for="one_col">Één taal</label>
      <input id="two_col" checked="" type="radio" name="col" value="2" onchange="location.hash = ''; this.form.submit()">
      <label for="two_col">Twee talen</label>
      <input id="three_col" type="radio" name="col" value="3" onchange="location.hash = ''; this.form.submit()">
      <label for="three_col">Drie talen</label>
    </div>
    <div class="download_control download_control_js">
      <i class="fa fa-download"></i> Download PDF
    </div>
  </div>
  <div class="download_block download_block_js">
    <div>
      <div class="download_block_checkbox">
        <div>
          <input type="checkbox" id="text_checkbox" name="text_checkbox" checked="" disabled="">
          <label for="text_checkbox">(EN) Text</label>
        </div>
        <div>
          <input type="checkbox" id="recital_checkbox" name="recital_checkbox">
          <label for="recital_checkbox">Overwegingen</label>
        </div>
        <div>
          <input type="checkbox" id="links_checkbox" name="links_checkbox">
          <label for="links_checkbox">Richtlijnen &amp; Case Law</label>
        </div>
        <div>
          <input type="checkbox" id="comment_checkbox" name="comment_checkbox">
          <label for="comment_checkbox">Commentaar</label>
        </div>
      </div>
      <a href="#" class="lrm-login">Registreren | Aanmelden</a>
    </div>
  </div>
  <div class="select_block">
    <select class="custom_select select2-hidden-accessible" id="select1" name="lang1" onchange="location.hash = ''; this.form.submit()" data-select2-id="select1" tabindex="-1" aria-hidden="true">
      <option value="bg">български (bg)</option>
      <option value="cs">Čeština (cs)</option>
      <option value="da">Dansk (da)</option>
      <option value="de">Deutsch (de)</option>
      <option value="el">ελληνικά (el)</option>
      <option value="en">English (en)</option>
      <option value="es">Español (es)</option>
      <option value="et">Eesti keel (et)</option>
      <option value="fi">Suomi (fi)</option>
      <option value="fr">Français (fr)</option>
      <option value="ga">Gaeilge (ga)</option>
      <option value="hr">Hrvatski (hr)</option>
      <option value="hu">Magyar (hu)</option>
      <option value="it">Italiano (it)</option>
      <option value="ko">한국어 (ko)</option>
      <option value="lt">Lietuvių kalba (lt)</option>
      <option value="lv">Latviešu valoda (lv)</option>
      <option value="mt">Malti (mt)</option>
      <option selected="" value="nl" data-select2-id="5">Nederlands (nl)</option>
      <option value="no">Norsk (no)</option>
      <option value="pl">Polski (pl)</option>
      <option value="pt">Português (pt)</option>
      <option value="ro">Română (ro)</option>
      <option value="ru">Русский (ru)</option>
      <option value="sk">Slovenčina (sk)</option>
      <option value="sl">Slovenščina (sl)</option>
      <option value="sv">Svenska (sv)</option>
      <option value="uk">Українська (uk)</option>
      <option value="zh">漢語 (zh)</option>
    </select><span class="select2 select2-container select2-container--default" dir="ltr" data-select2-id="4" style="width: 355px;"><span class="selection"><span class="select2-selection select2-selection--single" role="combobox" aria-haspopup="true"
          aria-expanded="false" tabindex="0" aria-disabled="false" aria-labelledby="select2-select1-container"><span class="select2-selection__rendered" id="select2-select1-container" role="textbox" aria-readonly="true"
            title="Nederlands (nl)">Nederlands (nl)</span><span class="select2-selection__arrow" role="presentation"><b role="presentation"></b></span></span></span><span class="dropdown-wrapper" aria-hidden="true"></span></span>
    <div id="revert" class="revert"><i class="fas fa-exchange-alt"></i></div>
    <select class="custom_select select2-hidden-accessible" id="select2" name="lang2" onchange="location.hash = ''; this.form.submit()" data-select2-id="select2" tabindex="-1" aria-hidden="true">
      <option value="bg">български (bg)</option>
      <option value="cs">Čeština (cs)</option>
      <option value="da">Dansk (da)</option>
      <option value="de">Deutsch (de)</option>
      <option value="el">ελληνικά (el)</option>
      <option selected="" value="en" data-select2-id="7">English (en)</option>
      <option value="es">Español (es)</option>
      <option value="et">Eesti keel (et)</option>
      <option value="fi">Suomi (fi)</option>
      <option value="fr">Français (fr)</option>
      <option value="ga">Gaeilge (ga)</option>
      <option value="hr">Hrvatski (hr)</option>
      <option value="hu">Magyar (hu)</option>
      <option value="it">Italiano (it)</option>
      <option value="ko">한국어 (ko)</option>
      <option value="lt">Lietuvių kalba (lt)</option>
      <option value="lv">Latviešu valoda (lv)</option>
      <option value="mt">Malti (mt)</option>
      <option value="nl">Nederlands (nl)</option>
      <option value="no">Norsk (no)</option>
      <option value="pl">Polski (pl)</option>
      <option value="pt">Português (pt)</option>
      <option value="ro">Română (ro)</option>
      <option value="ru">Русский (ru)</option>
      <option value="sk">Slovenčina (sk)</option>
      <option value="sl">Slovenščina (sl)</option>
      <option value="sv">Svenska (sv)</option>
      <option value="uk">Українська (uk)</option>
      <option value="zh">漢語 (zh)</option>
    </select><span class="select2 select2-container select2-container--default" dir="ltr" data-select2-id="6" style="width: 356px;"><span class="selection"><span class="select2-selection select2-selection--single" role="combobox" aria-haspopup="true"
          aria-expanded="false" tabindex="0" aria-disabled="false" aria-labelledby="select2-select2-container"><span class="select2-selection__rendered" id="select2-select2-container" role="textbox" aria-readonly="true" title="English (en)">English
            (en)</span><span class="select2-selection__arrow" role="presentation"><b role="presentation"></b></span></span></span><span class="dropdown-wrapper" aria-hidden="true"></span></span>
    <div id="revert2" class="revert" style="display: none"><i class="fas fa-exchange-alt"></i></div>
    <select class="" id="select3" name="lang3" onchange="location.hash = ''; this.form.submit()" style="display: none">
      <option value="bg">български (bg)</option>
      <option value="cs">Čeština (cs)</option>
      <option value="da">Dansk (da)</option>
      <option selected="" value="de">Deutsch (de)</option>
      <option value="el">ελληνικά (el)</option>
      <option value="en">English (en)</option>
      <option value="es">Español (es)</option>
      <option value="et">Eesti keel (et)</option>
      <option value="fi">Suomi (fi)</option>
      <option value="fr">Français (fr)</option>
      <option value="ga">Gaeilge (ga)</option>
      <option value="hr">Hrvatski (hr)</option>
      <option value="hu">Magyar (hu)</option>
      <option value="it">Italiano (it)</option>
      <option value="ko">한국어 (ko)</option>
      <option value="lt">Lietuvių kalba (lt)</option>
      <option value="lv">Latviešu valoda (lv)</option>
      <option value="mt">Malti (mt)</option>
      <option value="nl">Nederlands (nl)</option>
      <option value="no">Norsk (no)</option>
      <option value="pl">Polski (pl)</option>
      <option value="pt">Português (pt)</option>
      <option value="ro">Română (ro)</option>
      <option value="ru">Русский (ru)</option>
      <option value="sk">Slovenčina (sk)</option>
      <option value="sl">Slovenščina (sl)</option>
      <option value="sv">Svenska (sv)</option>
      <option value="uk">Українська (uk)</option>
      <option value="zh">漢語 (zh)</option>
    </select>
  </div>
</form>

---

#0

<form class="lrm-form js-lrm-form" action="#0" data-action="login">
  <div class="lrm-fieldset-wrap">
    <div class="lrm-integrations lrm-integrations--login">
    </div>
    <p class="lrm-form-message lrm-form-message--init"></p>
    <div class="fieldset">
      <label class="image-replace lrm-email lrm-ficon-mail" title="Email or Username"></label>
      <input name="username" class="full-width has-padding has-border" type="text" aria-label="Email or Username" placeholder="Email or Username" required="" value="" autocomplete="username" data-autofocus="1">
      <span class="lrm-error-message"></span>
    </div>
    <div class="fieldset">
      <label class="image-replace lrm-password lrm-ficon-key" title="Password"></label>
      <input name="password" class="full-width has-padding has-border" type="password" aria-label="Password" placeholder="Password" required="" value="">
      <span class="lrm-error-message"></span>
      <span class="hide-password lrm-ficon-eye" data-show="Show" data-hide="Hide" aria-label="Show"></span>
    </div>
    <div class="fieldset">
      <label class="lrm-nice-checkbox__label lrm-remember-me-checkbox">Remember me <input type="checkbox" class="lrm-nice-checkbox lrm-remember-me" name="remember-me" checked="">
        <div class="lrm-nice-checkbox__indicator"></div>
      </label>
    </div>
    <div class="lrm-integrations lrm-integrations--login lrm-integrations-before-btn">
      <p style="display: none;"><label>Enter something special:</label><input name="aio_special_field" type="text" id="aio_special_field" class="aio_special_field" value=""></p>
      <div class="lrm-grecaptcha" data-sitekey="6Ldjx9cZAAAAAA117Ah1NbMHjbwel1U8-KHnHgM8"></div>
    </div>
    <div class="lrm-integrations-otp"></div>
  </div>
  <div class="fieldset fieldset--submit fieldset--default">
    <button class="full-width has-padding" type="submit"> Log in </button>
  </div>
  <div class="lrm-fieldset-wrap">
    <div class="lrm-integrations lrm-integrations--login">
    </div>
  </div>
  <input type="hidden" name="redirect_to" value="">
  <input type="hidden" name="lrm_action" value="login">
  <input type="hidden" name="wp-submit" value="1">
  <!-- Fix for Eduma WP theme-->
  <input type="hidden" name="lp-ajax" value="login">
  <input type="hidden" id="security-login" name="security-login" value="4cbb7610c6"><input type="hidden" name="_wp_http_referer" value="/nl/read/article-5/">
  <!-- For Invisible Recaptcha plugin -->
  <span class="wpcf7-submit" style="display: none;"></span>
</form>

---

#0

<form class="lrm-form js-lrm-form" action="#0" data-action="registration" data-lpignore="true">
  <div class="lrm-fieldset-wrap lrm-form-message-wrap">
    <p class="lrm-form-message lrm-form-message--init"></p>
  </div>
  <div class="lrm-fieldset-wrap">
    <div class="lrm-integrations lrm-integrations--register">
    </div>
    <div class="fieldset fieldset--login">
      <label class="image-replace lrm-username lrm-ficon-user" for="signup-login" title="Login"></label>
      <input name="login" class="full-width has-padding has-border" id="signup-login" type="text" autocomplete="off" data-lpignore="true">
    </div>
    <div class="clearfix lrm-row">
      <div class="lrm-col-half-width lrm-col-first fieldset--first-name lrm-col">
        <label class="image-replace lrm-username lrm-ficon-user" for="signup-first-name" title="First name*"></label>
        <input name="first-name" class="full-width has-padding has-border" id="signup-first-name" type="text" placeholder="First name*" required="" aria-label="First name*" autocomplete="off" data-lpignore="true">
        <span class="lrm-error-message"></span>
      </div>
      <div class="lrm-col-half-width lrm-col-last fieldset--last-name lrm-col">
        <label class="image-replace lrm-username lrm-ficon-user" for="signup-last-name" title="Last name"></label>
        <input name="last-name" class="full-width has-padding has-border" id="signup-last-name" type="text" placeholder="Last name" aria-label="Last name" autocomplete="off" data-lpignore="true">
        <span class="lrm-error-message"></span>
      </div>
    </div>
    <div class="fieldset fieldset--email">
      <label class="image-replace lrm-email lrm-ficon-mail" for="signup-email" title="Email*"></label>
      <input name="email" class="full-width has-padding has-border" id="signup-email" type="email" placeholder="Email*" required="" autocomplete="off" aria-label="Email*">
      <span class="lrm-error-message"></span>
    </div>
    <div class="fieldset">
      <div class="lrm-position-relative">
        <label class="image-replace lrm-password lrm-ficon-key" for="signup-password" title="Password"></label>
        <input name="password" class="full-width has-padding has-border" id="signup-password" type="password" placeholder="Password" required="" value="" autocomplete="new-password" aria-label="Password">
        <span class="lrm-error-message"></span>
        <span class="hide-password lrm-ficon-eye" data-show="Show" data-hide="Hide"></span>
      </div>
      <span class="lrm-pass-strength-result"></span>
    </div>
    <div class="lrm-integrations lrm-integrations--register">
      <!-- Mailchimp for WordPress v4.8.6 - https://www.mc4wp.com/ --><input type="hidden" name="_mc4wp_subscribe_wp-registration-form" value="0">
      <p class=" mc4wp-checkbox mc4wp-checkbox-wp-registration-form"><label><input type="checkbox" name="_mc4wp_subscribe_wp-registration-form" value="1"><span>(EN) Subscribe to updated texts, invitations to GDPR events and news by Data Privacy
            Office</span></label></p><!-- / Mailchimp for WordPress -->
    </div>
    <div class="lrm-integrations lrm-integrations--register lrm-info lrm-info--register">
      <div class="lrm-grecaptcha" data-sitekey="6Ldjx9cZAAAAAA117Ah1NbMHjbwel1U8-KHnHgM8"></div>
    </div>
  </div>
  <div class="fieldset fieldset--submit fieldset--default">
    <button class="full-width has-padding" type="submit"> Create account </button>
  </div>
  <div class="lrm-fieldset-wrap">
    <div class="lrm-integrations lrm-integrations--register">
    </div>
  </div>
  <input type="hidden" name="redirect_to" value="">
  <input type="hidden" name="lrm_action" value="signup">
  <input type="hidden" name="wp-submit" value="1">
  <!-- Fix for Eduma WP theme-->
  <input type="hidden" name="is_popup_register" value="1">
  <input type="hidden" id="security-signup" name="security-signup" value="eb27013b87"><input type="hidden" name="_wp_http_referer" value="/nl/read/article-5/"> <!-- For Invisible Recaptcha plugin -->
  <span class="wpcf7-submit" style="display: none;"></span>
</form>

---

#0

<form class="lrm-form js-lrm-form" action="#0" data-action="lost-password">
  <div class="lrm-fieldset-wrap">
    <p class="lrm-form-message">Lost your password? Please enter your email address. You will receive mail with link to set new password.</p>
    <div class="fieldset">
      <label class="image-replace lrm-email lrm-ficon-mail" title="Email or Username"></label>
      <input class="full-width has-padding has-border" name="user_login" type="text" required="" placeholder="Email or Username" data-autofocus="1" aria-label="Email or Username">
      <span class="lrm-error-message"></span>
    </div>
    <div class="lrm-integrations lrm-integrations--reset-pass">
      <div class="lrm-grecaptcha" data-sitekey="6Ldjx9cZAAAAAA117Ah1NbMHjbwel1U8-KHnHgM8"></div>
    </div>
    <input type="hidden" name="lrm_action" value="lostpassword">
    <input type="hidden" name="wp-submit" value="1">
    <input type="hidden" id="security-lostpassword" name="security-lostpassword" value="ae714268c5"><input type="hidden" name="_wp_http_referer" value="/nl/read/article-5/">
  </div>
  <div class="fieldset fieldset--submit fieldset--default">
    <button class="full-width has-padding" type="submit"> Reset password </button>
  </div>
  <!-- For Invisible Recaptcha plugin -->
  <span class="wpcf7-submit" style="display: none;"></span>
</form>

---

Text Content

logo
 * EN
 * RU
 * FR
 * DE
 * BG
 * CS
 * DA
 * ΕL
 * ES
 * ET
 * FI
 * GA
 * HR
 * HU
 * IT
 * KO
 * LT
 * LV
 * MT
 * NL
 * NО
 * PL
 * PT
 * RO
 * SK
 * SL
 * SV
 * UK
 * ZH


Meer
 * EN
 * RU
 * FR
 * DE
 * BG
 * CS
 * DA
 * ΕL
 * ES
 * ET
 * FI
 * GA
 * HR
 * HU
 * IT
 * KO
 * LT
 * LV
 * MT
 * NL
 * NО
 * PL
 * PT
 * RO
 * SK
 * SL
 * SV
 * UK
 * ZH


Registreren | Aanmelden
 * AVG (GDPR)
 * Richtsnoeren
 * Over het project
 * Nieuws
 * Privacybeleid

Navigatie
HOOFDSTUK I Algemene bepalingen (1-4)
Artikel 1. Onderwerp en doelstellingenArtikel 2. Materieel
toepassingsgebiedArtikel 3. Territoriaal toepassingsgebiedArtikel 4. Definities
HOOFDSTUK II Beginselen (5-11)
Artikel 5. Beginselen inzake verwerking van persoonsgegevens
Artikel 6. Rechtmatigheid van de verwerkingArtikel 7. Voorwaarden voor
toestemmingArtikel 8. Voorwaarden voor de toestemming van kinderen met
betrekking tot diensten van de informatiemaatschappijArtikel 9. Verwerking van
bijzondere categorieën van persoonsgegevensArtikel 10. Verwerking van
persoonsgegevens betreffende strafrechtelijke veroordelingen en strafbare
feitenArtikel 11. Verwerking waarvoor identificatie niet is vereist
HOOFDSTUK III Rechten van de betrokkene (12-23)
Artikel 12. Transparante informatie, communicatie en nadere regels voor de
uitoefening van de rechten van de betrokkeneArtikel 13. Te verstrekken
informatie wanneer persoonsgegevens bij de betrokkene worden verzameldArtikel
14. Te verstrekken informatie wanneer de persoonsgegevens niet van de betrokkene
zijn verkregenArtikel 15. Recht van inzage van de betrokkeneArtikel 16. Recht op
rectificatieArtikel 17. Recht op gegevenswissing („recht op
vergetelheid”)Artikel 18. Recht op beperking van de verwerkingArtikel 19.
Kennisgevingsplicht inzake rectificatie of wissing van persoonsgegevens of
verwerkingsbeperkingArtikel 20. Recht op overdraagbaarheid van gegevensArtikel
21. Recht van bezwaarArtikel 22. Geautomatiseerde individuele besluitvorming,
waaronder profileringArtikel 23. Beperkingen
HOOFDSTUK IV Verwerkingsverantwoordelijke en verwerker (24-43)
Artikel 24. Onderwerp en doelstellingenArtikel 25. Gegevensbescherming door
ontwerp en door standaardinstellingenArtikel 26. Gezamenlijke
verwerkingsverantwoordelijkenArtikel 27. Vertegenwoordigers van niet in de Unie
gevestigde verwerkingsverantwoordelijken of verwerkersArtikel 28.
VerwerkerArtikel 29. Verwerking onder gezag van de verwerkingsverantwoordelijke
of de verwerkerArtikel 30. Register van de verwerkingsactiviteitenArtikel 31.
Medewerking met de toezichthoudende autoriteitArtikel 32. Beveiliging van de
verwerkingArtikel 33. Melding van een inbreuk in verband met persoonsgegevens
aan de toezichthoudende autoriteitArtikel 34. Mededeling van een inbreuk in
verband met persoonsgegevens aan de betrokkeneArtikel 35.
GegevensbeschermingseffectbeoordelingArtikel 36. Voorafgaande raadplegingArtikel
37. Aanwijzing van de functionaris voor gegevensbeschermingArtikel 38. Positie
van de functionaris voor gegevensbeschermingArtikel 39. Taken van de
functionaris voor gegevensbeschermingArtikel 40. GedragscodesArtikel 41.
Toezicht op goedgekeurde gedragscodesArtikel 42. CertificeringArtikel 43.
Certificeringsorganen
HOOFDSTUK V Doorgiften van persoonsgegevens aan derde landen of internationale
organisaties (44-50)
Artikel 44. Algemeen beginsel inzake doorgiftenArtikel 45. Doorgiften op basis
van adequaatheidsbesluitenArtikel 46. Doorgiften op basis van passende
waarborgenArtikel 47. Bindende bedrijfsvoorschriftenArtikel 48. Niet bij
Unierecht toegestane doorgiften of verstrekkingenArtikel 49. Afwijkingen voor
specifieke situatiesArtikel 50. Internationale samenwerking voor de bescherming
van persoonsgegevens
HOOFDSTUK VI Onafhankelijke toezichthoudende autoriteiten (51-59)
Artikel 51. Toezichthoudende autoriteitArtikel 52. OnafhankelijkheidArtikel 53.
Algemene voorwaarden voor de leden van de toezichthoudende autoriteitArtikel 54.
Regels inzake de oprichting van de toezichthoudende autoriteitArtikel 55.
CompetentieArtikel 56. Competentie van de leidende toezichthoudende
autoriteitArtikel 57. TakenArtikel 58. BevoegdhedenArtikel 59.
Activiteitenverslagen
HOOFDSTUK VII Samenwerking en coherentie (60-70)
Artikel 60. Samenwerking tussen de leidende toezichthoudende autoriteit en de
andere betrokken toezichthoudende autoriteitenArtikel 61. Wederzijdse
bijstandArtikel 62. Gezamenlijke werkzaamheden van toezichthoudende
autoriteitenArtikel 63. CoherentiemechanismeArtikel 64. Advies van het
ComitéArtikel 65. Geschillenbeslechting door het ComitéArtikel 66.
SpoedprocedureArtikel 67. Uitwisseling van informatieArtikel 68. Europees Comité
voor gegevensbeschermingArtikel 69. OnafhankelijkheidArtikel 70. Taken van het
ComitéArtikel 71. RapportageArtikel 72. ProcedureArtikel 73. VoorzitterArtikel
74. Taken van de voorzitterArtikel 75. SecretariaatArtikel 76. Vertrouwelijkheid
HOOFDSTUK VIII Beroep, aansprakelijkheid en sancties (77-84)
Artikel 77. Recht om klacht in te dienen bij een toezichthoudende
autoriteitArtikel 78. Recht om een doeltreffende voorziening in rechte in te
stellen tegen een toezichthoudende autoriteitArtikel 79. Recht om een
doeltreffende voorziening in rechte in te stellen tegen een
verwerkingsverantwoordelijke of een verwerkerArtikel 80. Vertegenwoordiging van
betrokkenenArtikel 81. Schorsing van de procedureArtikel 82. Recht op
schadevergoeding en aansprakelijkheidArtikel 83. Algemene voorwaarden voor het
opleggen van administratieve geldboetenArtikel 84. Sancties
HOOFDSTUK IX Bepalingen in verband met specifieke situaties op het gebied van
gegevensverwerking (85-91)
Artikel 85. Verwerking en vrijheid van meningsuiting en van informatieArtikel
86. Verwerking en recht van toegang van het publiek tot officiële
documentenArtikel 87. Verwerking van het nationaal identificatienummerArtikel
88. Verwerking in het kader van de arbeidsverhoudingArtikel 89. Waarborgen en
afwijkingen in verband met verwerking met het oog op archivering in het algemeen
belang, wetenschappelijk of historisch onderzoek of statistische
doeleindenArtikel 90. GeheimhoudingsplichtArtikel 91. Bestaande
gegevensbeschermingsregels van kerken en religieuze verenigingen
HOOFDSTUK X Gedelegeerde handelingen en uitvoeringshandelingen (92-93)
Artikel 92. Uitoefening van de bevoegdheidsdelegatieArtikel 93. Comitéprocedure
HOOFDSTUK XI Slotbepalingen (94-95)
Artikel 94. Intrekking van Richtlijn 95/46/EGArtikel 95. Verhouding tot
Richtlijn 2002/58/EGArtikel 96. Verhouding tot eerder gesloten
overeenkomstenArtikel 97. CommissieverslagenArtikel 98. Toetsing van andere
Unierechtshandelingen inzake gegevensbeschermingArtikel 99. Inwerkingtreding en
toepassing
Artikel 1. Onderwerp en doelstellingenArtikel 2. Materieel
toepassingsgebiedArtikel 3. Territoriaal toepassingsgebiedArtikel 4.
DefinitiesArtikel 5. Beginselen inzake verwerking van persoonsgegevensArtikel 6.
Rechtmatigheid van de verwerkingArtikel 7. Voorwaarden voor toestemmingArtikel
8. Voorwaarden voor de toestemming van kinderen met betrekking tot diensten van
de informatiemaatschappijArtikel 9. Verwerking van bijzondere categorieën van
persoonsgegevensArtikel 10. Verwerking van persoonsgegevens betreffende
strafrechtelijke veroordelingen en strafbare feitenArtikel 11. Verwerking
waarvoor identificatie niet is vereistArtikel 12. Transparante informatie,
communicatie en nadere regels voor de uitoefening van de rechten van de
betrokkeneArtikel 13. Te verstrekken informatie wanneer persoonsgegevens bij de
betrokkene worden verzameldArtikel 14. Te verstrekken informatie wanneer de
persoonsgegevens niet van de betrokkene zijn verkregenArtikel 15. Recht van
inzage van de betrokkeneArtikel 16. Recht op rectificatieArtikel 17. Recht op
gegevenswissing („recht op vergetelheid”)Artikel 18. Recht op beperking van de
verwerkingArtikel 19. Kennisgevingsplicht inzake rectificatie of wissing van
persoonsgegevens of verwerkingsbeperkingArtikel 20. Recht op overdraagbaarheid
van gegevensArtikel 21. Recht van bezwaarArtikel 22. Geautomatiseerde
individuele besluitvorming, waaronder profileringArtikel 23. BeperkingenArtikel
24. Onderwerp en doelstellingenArtikel 25. Gegevensbescherming door ontwerp en
door standaardinstellingenArtikel 26. Gezamenlijke
verwerkingsverantwoordelijkenArtikel 27. Vertegenwoordigers van niet in de Unie
gevestigde verwerkingsverantwoordelijken of verwerkersArtikel 28.
VerwerkerArtikel 29. Verwerking onder gezag van de verwerkingsverantwoordelijke
of de verwerkerArtikel 30. Register van de verwerkingsactiviteitenArtikel 31.
Medewerking met de toezichthoudende autoriteitArtikel 32. Beveiliging van de
verwerkingArtikel 33. Melding van een inbreuk in verband met persoonsgegevens
aan de toezichthoudende autoriteitArtikel 34. Mededeling van een inbreuk in
verband met persoonsgegevens aan de betrokkeneArtikel 35.
GegevensbeschermingseffectbeoordelingArtikel 36. Voorafgaande raadplegingArtikel
37. Aanwijzing van de functionaris voor gegevensbeschermingArtikel 38. Positie
van de functionaris voor gegevensbeschermingArtikel 39. Taken van de
functionaris voor gegevensbeschermingArtikel 40. GedragscodesArtikel 41.
Toezicht op goedgekeurde gedragscodesArtikel 42. CertificeringArtikel 43.
CertificeringsorganenArtikel 44. Algemeen beginsel inzake doorgiftenArtikel 45.
Doorgiften op basis van adequaatheidsbesluitenArtikel 46. Doorgiften op basis
van passende waarborgenArtikel 47. Bindende bedrijfsvoorschriftenArtikel 48.
Niet bij Unierecht toegestane doorgiften of verstrekkingenArtikel 49.
Afwijkingen voor specifieke situatiesArtikel 50. Internationale samenwerking
voor de bescherming van persoonsgegevensArtikel 51. Toezichthoudende
autoriteitArtikel 52. OnafhankelijkheidArtikel 53. Algemene voorwaarden voor de
leden van de toezichthoudende autoriteitArtikel 54. Regels inzake de oprichting
van de toezichthoudende autoriteitArtikel 55. CompetentieArtikel 56. Competentie
van de leidende toezichthoudende autoriteitArtikel 57. TakenArtikel 58.
BevoegdhedenArtikel 59. ActiviteitenverslagenArtikel 60. Samenwerking tussen de
leidende toezichthoudende autoriteit en de andere betrokken toezichthoudende
autoriteitenArtikel 61. Wederzijdse bijstandArtikel 62. Gezamenlijke
werkzaamheden van toezichthoudende autoriteitenArtikel 63.
CoherentiemechanismeArtikel 64. Advies van het ComitéArtikel 65.
Geschillenbeslechting door het ComitéArtikel 66. SpoedprocedureArtikel 67.
Uitwisseling van informatieArtikel 68. Europees Comité voor
gegevensbeschermingArtikel 69. OnafhankelijkheidArtikel 70. Taken van het
ComitéArtikel 71. RapportageArtikel 72. ProcedureArtikel 73. VoorzitterArtikel
74. Taken van de voorzitterArtikel 75. SecretariaatArtikel 76.
VertrouwelijkheidArtikel 77. Recht om klacht in te dienen bij een
toezichthoudende autoriteitArtikel 78. Recht om een doeltreffende voorziening in
rechte in te stellen tegen een toezichthoudende autoriteitArtikel 79. Recht om
een doeltreffende voorziening in rechte in te stellen tegen een
verwerkingsverantwoordelijke of een verwerkerArtikel 80. Vertegenwoordiging van
betrokkenenArtikel 81. Schorsing van de procedureArtikel 82. Recht op
schadevergoeding en aansprakelijkheidArtikel 83. Algemene voorwaarden voor het
opleggen van administratieve geldboetenArtikel 84. SanctiesArtikel 85.
Verwerking en vrijheid van meningsuiting en van informatieArtikel 86. Verwerking
en recht van toegang van het publiek tot officiële documentenArtikel 87.
Verwerking van het nationaal identificatienummerArtikel 88. Verwerking in het
kader van de arbeidsverhoudingArtikel 89. Waarborgen en afwijkingen in verband
met verwerking met het oog op archivering in het algemeen belang,
wetenschappelijk of historisch onderzoek of statistische doeleindenArtikel 90.
GeheimhoudingsplichtArtikel 91. Bestaande gegevensbeschermingsregels van kerken
en religieuze verenigingenArtikel 92. Uitoefening van de
bevoegdheidsdelegatieArtikel 93. ComitéprocedureArtikel 94. Intrekking van
Richtlijn 95/46/EGArtikel 95. Verhouding tot Richtlijn 2002/58/EGArtikel 96.
Verhouding tot eerder gesloten overeenkomstenArtikel 97.
CommissieverslagenArtikel 98. Toetsing van andere Unierechtshandelingen inzake
gegevensbeschermingArtikel 99. Inwerkingtreding en toepassingOverweging
1Overweging 2Overweging 3Overweging 4Overweging 5Overweging 6Overweging
7Overweging 8Overweging 9Overweging 10Overweging 11Overweging 12Overweging
13Overweging 14Overweging 15Overweging 16Overweging 17Overweging 18Overweging
19Overweging 20Overweging 21Overweging 22Overweging 23Overweging 24Overweging
25Overweging 26Overweging 27Overweging 28Overweging 29Overweging 30Overweging
31Overweging 32Overweging 33Overweging 34Overweging 35Overweging 36Overweging
37Overweging 38Overweging 39Overweging 40Overweging 41Overweging 42Overweging
43Overweging 44Overweging 45Overweging 46Overweging 47Overweging 48Overweging
49Overweging 50Overweging 51Overweging 52Overweging 53Overweging 54Overweging
55Overweging 56Overweging 57Overweging 58Overweging 59Overweging 60Overweging
61Overweging 62Overweging 63Overweging 64Overweging 65Overweging 66Overweging
67Overweging 68Overweging 69Overweging 70Overweging 71Overweging 72Overweging
73Overweging 74Overweging 75Overweging 76Overweging 77Overweging 78Overweging
79Overweging 80Overweging 81Overweging 82Overweging 83Overweging 84Overweging
85Overweging 86Overweging 87Overweging 88Overweging 89Overweging 90Overweging
91Overweging 92Overweging 93Overweging 94Overweging 95Overweging 96Overweging
97Overweging 98Overweging 99Overweging 100Overweging 101Overweging 102Overweging
103Overweging 104Overweging 105Overweging 106Overweging 107Overweging
108Overweging 109Overweging 110Overweging 111Overweging 112Overweging
113Overweging 114Overweging 115Overweging 116Overweging 117Overweging
118Overweging 119Overweging 120Overweging 121Overweging 122Overweging
123Overweging 124Overweging 125Overweging 126Overweging 127Overweging
128Overweging 129Overweging 130Overweging 131Overweging 132Overweging
133Overweging 134Overweging 135Overweging 136Overweging 137Overweging
138Overweging 139Overweging 140Overweging 141Overweging 142Overweging
143Overweging 144Overweging 145Overweging 146Overweging 147Overweging
148Overweging 149Overweging 150Overweging 151Overweging 152Overweging
153Overweging 154Overweging 155Overweging 156Overweging 157Overweging
158Overweging 159Overweging 160Overweging 161Overweging 162Overweging
163Overweging 164Overweging 165Overweging 166Overweging 167Overweging
168Overweging 169Overweging 170Overweging 171Overweging 172Overweging 173
Artikel 5. Beginselen inzake verwerking van persoonsgegevens
* search
AVG (GDPR) > Artikel 5. Beginselen inzake verwerking van persoonsgegevens
Vorige
Volgende
Één taal Twee talen Drie talen
Download PDF
(EN) Text
Overwegingen
Richtlijnen & Case Law
Commentaar
Registreren | Aanmelden
български (bg)Čeština (cs)Dansk (da)Deutsch (de)ελληνικά (el)English (en)Español
(es)Eesti keel (et)Suomi (fi)Français (fr)Gaeilge (ga)Hrvatski (hr)Magyar
(hu)Italiano (it)한국어 (ko)Lietuvių kalba (lt)Latviešu valoda (lv)Malti
(mt)Nederlands (nl)Norsk (no)Polski (pl)Português (pt)Română (ro)Русский
(ru)Slovenčina (sk)Slovenščina (sl)Svenska (sv)Українська (uk)漢語 (zh) Nederlands
(nl)

български (bg)Čeština (cs)Dansk (da)Deutsch (de)ελληνικά (el)English (en)Español
(es)Eesti keel (et)Suomi (fi)Français (fr)Gaeilge (ga)Hrvatski (hr)Magyar
(hu)Italiano (it)한국어 (ko)Lietuvių kalba (lt)Latviešu valoda (lv)Malti
(mt)Nederlands (nl)Norsk (no)Polski (pl)Português (pt)Română (ro)Русский
(ru)Slovenčina (sk)Slovenščina (sl)Svenska (sv)Українська (uk)漢語 (zh) English
(en)

български (bg)Čeština (cs)Dansk (da)Deutsch (de)ελληνικά (el)English (en)Español
(es)Eesti keel (et)Suomi (fi)Français (fr)Gaeilge (ga)Hrvatski (hr)Magyar
(hu)Italiano (it)한국어 (ko)Lietuvių kalba (lt)Latviešu valoda (lv)Malti
(mt)Nederlands (nl)Norsk (no)Polski (pl)Português (pt)Română (ro)Русский
(ru)Slovenčina (sk)Slovenščina (sl)Svenska (sv)Українська (uk)漢語 (zh)


ARTIKEL 5 AVG (GDPR). BEGINSELEN INZAKE VERWERKING VAN PERSOONSGEGEVENS


ARTICLE 5 GDPR. PRINCIPLES RELATING TO PROCESSING OF PERSONAL DATA

1. Persoonsgegevens moeten:

1. Personal data shall be:



a) worden verwerkt op een wijze die ten aanzien van de betrokkene rechtmatig,
behoorlijk en transparant is („rechtmatigheid, behoorlijkheid en
transparantie”);

(a) processed lawfully, fairly and in a transparent manner in relation to the
data subject (‘lawfulness, fairness and transparency’);


Commentaar ISO 27701 Richtlijnen & Case Law Overwegingen Verbindingen

Commentaar

(EN) Example of lawful processing:

> Example A bank plans to offer a service to improve efficiency in the
> management of loan applications. The idea behind the service is that the bank,
> by requesting permission from the customer, can be able to retrieve data from
> public authorities about the customer. This may be, for example, tax data from
> the tax administration.
> 
> Initially, this personal data is necessary in order to take steps at the
> request of the data subject prior to entering into a contract. However, this
> specific way of processing the personal data is not necessary for entering
> into a contract, because a loan may be granted without obtaining data directly
> from public authorities. The customer is able to enter into a contract by
> providing the information from the tax administration herself.
> 
> When implementing the principle of lawfulness, the controller realizes that
> they cannot use the “necessary for contract-”basis for the part of the
> processing that involves gathering personal data directly from the tax
> authorities. The fact that this specific processing presents a risk of the
> data subject becoming less involved in the processing of their data is also a
> relevant factor in assessing the lawfulness of the processing itself. The bank
> concludes that this part of the processing must rely on consent.
> 
> The bank therefore presents information about the processing on the online
> application platform in such a manner that makes it easy for data subjects to
> understand what processing is mandatory and what is optional. The processing
> options, by default, do not allow retrieval of data directly from other
> sources than the data subject herself, and the option for direct information
> retrieval is presented in a manner that does not deter the data subject from
> abstaining. Any consent given to collect data directly from other controllers
> is a temporary right of access to a specific set of information.
> 
> Any given consent is processed electronically in a documentable manner, and
> data subjects are presented with an easy way of controlling what they have
> consented to and to withdraw their consent.
> 
> The controller has assessed these Data protection by design and default
> (DPbDD) requirements beforehand and includes all of these criteria in their
> requirements specification for the tender to procure the platform. The
> controller is aware that if they do not include the DPbDD requirements in the
> tender, it may either be too late or a very costly process to implement data
> protection afterwards.

Source: EDPB, Guidelines 4/2019 on Article 25 – Data Protection by Design and by
Default (Version for public consultation) (2019).

(EN) Example of transparency measures:

> A controller is designing a privacy policy in order to comply with the
> requirements of transparency. The privacy policy cannot contain a lengthy bulk
> of information that is difficult for the average data subject to penetrate and
> understand, it must be written in clear and concise language and make it easy
> for the user of the website to understand how their personal data is
> processed. The controller therefore provides information in a multi-layered
> manner, where the most important points are highlighted. Drop-down menus and
> links to other pages are provided to further explain the concepts in the
> policy. The controller also makes sure that the information is provided in a
> multi-channel manner, providing video clips to explain the most important
> points of the information.
> 
> The privacy policy cannot be difficult for data subjects to access. The
> privacy policy is thus made available and visible on all internal web-pages of
> the site in question, so that the data subject is always only one click away
> from accessing the information. The information provided is also designed in
> accordance with the best practices and standards of universal design to make
> it accessible to all.
> 
> Moreover, necessary information must also be provided in the right context, at
> the appropriate time. This means, that generally a privacy policy on the
> website alone is not sufficient for the controller to meet the requirements of
> transparency. The controller therefore designs an information flow, presenting
> the data subject with relevant information within the appropriate contexts
> using e.g. informational snippets or pop-ups. For example, when asking the
> data subject to enter personal data, the controller informs the data subject
> of how the personal data will be processed and why that personal data is
> necessary for the processing.

Source: EDPB, Guidelines 4/2019 on Article 25 – Data Protection by Design and by
Default (Version for public consultation) (2019).

(EN) Examples of fairness considerations:

Example 1

> A controller operates a search engine that processes mostly user-generated
> personal data. The controller benefits from having large amounts of personal
> data and being able to use that personal data for targeted advertisements. The
> controller therefore wishes to influence data subjects to allow extensive
> collection and use of their personal data.
> 
> When implementing the fairness principle, taking into account the nature,
> scope, context and purpose of the processing, the controller realizes that
> they cannot present the options in a way that nudges the data subject in the
> direction of allowing the controller to collect more personal data than if the
> options were presented in an equal and neutral way. This means that they
> cannot present the processing options in such a manner that makes it difficult
> for data subjects to abstain from sharing their data, or make it difficult for
> the data subjects to adjust their privacy settings and limit the processing.
> The default options for the processing must be the least invasive, and the
> choice for further processing must be presented in a manner that does not
> deter the data subject from abstaining.
> 
> Example 2
> 
> Another controller processes personal data for the provision of a streaming
> service where users may choose between a regular subscription of standard
> quality and a premium subscription with higher quality. As part of the premium
> subscription, subscribers get prioritized customer service. With regard to the
> fairness principle, the prioritized customer service granted to premium
> subscribers cannot discriminate other data subjects’ rights according to the
> GDPR Article 12. This means that although the premium subscribers get
> prioritized service, such prioritization cannot result in a lack of
> appropriate measures to respond to request from regular subscribers without
> undue delay and in any event within one month of receipt of the requests.
> 
> Prioritized customers may pay to get better service, but all data subjects
> shall have equal and indiscriminate access to enforce their rights and
> freedoms according to the GDPR.

Source: EDPB, Guidelines 4/2019 on Article 25 – Data Protection by Design and by
Default (Version for public consultation) (2019).

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for
PII controllers.

Here is the relevant paragraph to article 5(1)(a) GDPR:

7.2.2 Identify lawful basis

Control

The organization should determine, document and comply with the relevant lawful
basis for the processing of PII for the identified purposes.

Implementation guidance

Some jurisdictions require the organization to be able to demonstrate that the
lawfulness of processing was duly established before the processing.

(EN) […]

(EN) Sign in
to read the full text

Richtlijnen & Case Law

(EN) EDPB, Guidelines 8/2020 on the targeting of social media users (2020).

Overwegingen

(39) Elke verwerking van persoonsgegevens dient behoorlijk en rechtmatig te
geschieden. Voor natuurlijke personen dient het transparant te zijn dat hen
betreffende persoonsgegevens worden verzameld, gebruikt, geraadpleegd of
anderszins verwerkt en in hoeverre de persoonsgegevens worden verwerkt of zullen
worden verwerkt. Overeenkomstig het transparantiebeginsel moeten informatie en
communicatie in verband met de verwerking van die persoonsgegevens eenvoudig
toegankelijk en begrijpelijk zijn, en moet duidelijke en eenvoudige taal worden
gebruikt. Dat beginsel betreft met name het informeren van de betrokkenen over
de identiteit van de verwerkingsverantwoordelijke en de doeleinden van de
verwerking, alsook verdere informatie om te zorgen voor behoorlijke en
transparante verwerking met betrekking tot de natuurlijke personen in kwestie en
hun recht om bevestiging en mededeling te krijgen van hun persoonsgegevens die
worden verwerkt. Natuurlijke personen moeten bewust worden gemaakt van de
risico's, regels, waarborgen en rechten in verband met de verwerking van
persoonsgegevens, alsook van de wijze waarop zij hun rechten met betrekking tot
deze verwerking kunnen uitoefenen. Meer bepaald dienen de specifieke doeleinden
waarvoor de persoonsgegevens worden verwerkt, expliciet en gerechtvaardigd te
zijn en te zijn vastgesteld wanneer de persoonsgegevens worden verzameld. De
persoonsgegevens dienen toereikend en ter zake dienend te zijn en beperkt te
blijven tot wat noodzakelijk is voor de doeleinden waarvoor zij worden verwerkt.
Dit vereist met name dat ervoor wordt gezorgd dat de opslagperiode van de
persoonsgegevens tot een strikt minimum wordt beperkt. Persoonsgegevens mogen
alleen worden verwerkt indien het doel van de verwerking niet redelijkerwijs op
een andere wijze kan worden verwezenlijkt. Om ervoor te zorgen dat
persoonsgegevens niet langer worden bewaard dan noodzakelijk is, dient de
verwerkingsverantwoordelijke termijnen vast te stellen voor het wissen van
gegevens of voor een periodieke toetsing ervan. Alle redelijke maatregelen
moeten worden genomen om ervoor te zorgen dat onjuiste persoonsgegevens worden
gerectificeerd of gewist. Persoonsgegevens moeten worden verwerkt op een manier
die een passende beveiliging en vertrouwelijkheid van die gegevens waarborgt,
ook ter voorkoming van ongeoorloofde toegang tot of het ongeoorloofde gebruik
van persoonsgegevens en de apparatuur die voor de verwerking wordt gebruikt.

(39) Any processing of personal data should be lawful and fair. It should be
transparent to natural persons that personal data concerning them are collected,
used, consulted or otherwise processed and to what extent the personal data are
or will be processed. The principle of transparency requires that any
information and communication relating to the processing of those personal data
be easily accessible and easy to understand, and that clear and plain language
be used. That principle concerns, in particular, information to the data
subjects on the identity of the controller and the purposes of the processing
and further information to ensure fair and transparent processing in respect of
the natural persons concerned and their right to obtain confirmation and
communication of personal data concerning them which are being processed.
Natural persons should be made aware of risks, rules, safeguards and rights in
relation to the processing of personal data and how to exercise their rights in
relation to such processing. In particular, the specific purposes for which
personal data are processed should be explicit and legitimate and determined at
the time of the collection of the personal data. The personal data should be
adequate, relevant and limited to what is necessary for the purposes for which
they are processed. This requires, in particular, ensuring that the period for
which the personal data are stored is limited to a strict minimum. Personal data
should be processed only if the purpose of the processing could not reasonably
be fulfilled by other means. In order to ensure that the personal data are not
kept longer than necessary, time limits should be established by the controller
for erasure or for a periodic review. Every reasonable step should be taken to
ensure that personal data which are inaccurate are rectified or deleted.
Personal data should be processed in a manner that ensures appropriate security
and confidentiality of the personal data, including for preventing unauthorised
access to or use of personal data and the equipment used for the processing.

Verbindingen

Artikel 6 AVG (GDPR). Rechtmatigheid van de verwerking

Article 6 GDPR. Lawfulness of processing

1. De verwerking is alleen rechtmatig indien en voor zover aan ten minste een
van de onderstaande voorwaarden is voldaan:

1. Processing shall be lawful only if and to the extent that at least one of the
following applies:

a) de betrokkene heeft toestemming gegeven voor de verwerking van zijn
persoonsgegevens voor een of meer specifieke doeleinden;

(a) the data subject has given consent to the processing of his or her personal
data for one or more specific purposes;

b) de verwerking is noodzakelijk voor de uitvoering van een overeenkomst waarbij
de betrokkene partij is, of om op verzoek van de betrokkene vóór de sluiting van
een overeenkomst maatregelen te nemen;

(b) processing is necessary for the performance of a contract to which the data
subject is party or in order to take steps at the request of the data subject
prior to entering into a contract;

c) de verwerking is noodzakelijk om te voldoen aan een wettelijke verplichting
die op de verwerkingsverantwoordelijke rust;

(c) processing is necessary for compliance with a legal obligation to which the
controller is subject;

d) de verwerking is noodzakelijk om de vitale belangen van de betrokkene of van
een andere natuurlijke persoon te beschermen;

(d) processing is necessary in order to protect the vital interests of the data
subject or of another natural person;

e) de verwerking is noodzakelijk voor de vervulling van een taak van algemeen
belang of van een taak in het kader van de uitoefening van het openbaar gezag
dat aan de verwerkingsverantwoordelijke is opgedragen;

(e) processing is necessary for the performance of a task carried out in the
public interest or in the exercise of official authority vested in the
controller;

f) de verwerking is noodzakelijk voor de behartiging van de gerechtvaardigde
belangen van de verwerkingsverantwoordelijke of van een derde, behalve wanneer
de belangen of de grondrechten en de fundamentele vrijheden van de betrokkene
die tot bescherming van persoonsgegevens nopen, zwaarder wegen dan die belangen,
met name wanneer de betrokkene een kind is.

(f) processing is necessary for the purposes of the legitimate interests pursued
by the controller or by a third party, except where such interests are
overridden by the interests or fundamental rights and freedoms of the data
subject which require protection of personal data, in particular where the data
subject is a child.

[…]

[…]



Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version
2.0.



3.1 Transparency [24]



[24]Elaboration on how to understand the concept of transparency can be found in
Article 29 Working Party. “Guidelines on transparency under Regulation
2016/679”. WP 260 rev.01, 11 April 2018.
ec.europa.eu/newsroom/article29/document.cfm?action=display&doc_id=51025 –
endorsed by the EDPB



65. The controller must be clear and open with the data subject about how they
will collect, use and share personal data. Transparency is about enabling data
subjects to understand, and if necessary, make use of their rights in Articles
15 to 22. The principle is embedded in Articles 12, 13, 14 and 34. Measures and
safeguards put in place to support the principle of transparency should also
support the implementation of these Articles.



66. Key design and default elements for the principle of transparency may
include:



•Clarity – Information shall be in clear and plain language, concise and
intelligible.



•Semantics – Communication should have a clear meaning to the audience in
question.



•Accessibility – Information shall be easily accessible for the data subject.



•Contextual – Information should be provided at the relevant time and in the
appropriate form.



•Relevance – Information should be relevant and applicable to the specific data
subject.



•Universal design – Information shall be accessible to all data subjects,
include use of machine readable languages to facilitate and automate readability
and clarity.



•Comprehensible – Data subjects should have a fair understanding of what they
can expect with regards to the processing of their personal data, particularly
when the data subjects are children or other vulnerable groups.



• Multi-channel – Information should be provided in different channels and
media, not only the textual, to increase the probability for the information to
effectively reach the data subject.



• Layered – The information should be layered in a manner that resolves the
tension between completeness and understanding, while accounting for data
subjects’ reasonable expectations.



3.2 Lawfulness



67. The controller must identify a valid legal basis for the processing of
personal data. Measures and safeguards should support the requirement to make
sure that the whole processing lifecycle is in line with the relevant legal
grounds of processing.



68. Key design and default elements for lawfulness may include:



• Relevance – The correct legal basis shall be applied to the processing.



• Differentiation [26] – The legal basis used for each processing activity shall
be differentiated.



[26] EDPB. “Guidelines 2/2019 on the processing of personal data under Article
6(1)(b) GDPR in the context of the provision of online services to data
subjects”. Version 2.0, 8 October 2019.
edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines-art_6-1-b-
adopted_after_public_consultation_en.pdf



• Specified purpose – The appropriate legal basis must be clearly connected to
the specific purpose of processing.[27]



[27] See section on purpose limitation below.



• Necessity– Processing must be necessary and unconditional for the purpose to
be lawful.



• Autonomy – The data subject should be granted the highest degree of autonomy
as possible with respect to control over personal data within the frames of the
legal basis.



• Gaining consent – consent must be freely given, specific, informed and
unambiguous.[28] Particular consideration should be given to the capacity of
children and young people to provide informed consent.



[28] See Guidelines 05/2020 on consent under Regulation 2016/679.
https://edpb.europa.eu/our-work-
tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en



• Consent withdrawal – Where consent is the legal basis, the processing should
facilitate withdrawal of consent. Withdrawal shall be as easy as giving consent.
If not, then the consent mechanism of the controller does not comply with the
GDPR.[29]



[29] See Guidelines 05/2020 on consent under Regulation 2016/679, p. 24.
https://edpb.europa.eu/our-work-
tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en



• Balancing of interests – Where legitimate interests is the legal basis, the
controller must carry out a weighted balancing of interest, giving particular
consideration to the power imbalance, specifically children under the age of 18
and other vulnerable groups. There shall be measures and safeguards to mitigate
the negative impact on the data subjects.



• Predetermination – The legal basis shall be established before the processing
takes place.



• Cessation – If the legal basis ceases to apply, the processing shall cease
accordingly.



• Adjust – If there is a valid change of legal basis for the processing, the
actual processing must be adjusted in accordance with the new legal basis.[30]



[30] If the original legal basis is consent, see Guidelines 05/2020 on consent
under Regulation 2016/679.
https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-
regulation-2016679_en



• Allocation of responsibility – Whenever joint controllership is envisaged, the
parties must apportion in a clear and transparent way their respective
responsibilities vis-à-vis the data subject, and design the measures of the
processing in accordance with this allocation.



Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version
2.0.



3.3 Fairness



69. Fairness is an overarching principle which requires that personal data
should not be processed in a way that is unjustifiably detrimental, unlawfully
discriminatory, unexpected or misleading to the data subject. Measures and
safeguards implementing the principle of fairness also support the rights and
freedoms of data subjects, specifically the right to information (transparency),
the right to intervene (access, erasure, data portability, rectify) and the
right to limit the processing (right not to be subject to automated individual
decision-making and non-discrimination of data subjects in such processes).



70. Key design and default elements may include:



• Autonomy – Data subjects should be granted the highest degree of autonomy
possible to determine the use made of their personal data, as well as over the
scope and conditions of that use or processing.



• Interaction – Data subjects must be able to communicate and exercise their
rights in respect of the personal data processed by the controller.



• Expectation – Processing should correspond with data subjects’ reasonable
expectations.



• Non-discrimination – The controller shall not unfairly discriminate against
data subjects.



• Non-exploitation – The controller shall not exploit the needs or
vulnerabilities of data subjects.



• Consumer choice – The controller should not “lock in” their users in an unfair
manner. Whenever a service processing personal data is proprietary, it may
create a lock-in to the service, which may not be fair, if it impairs the data
subjects’ possibility to exercise their right of data portability in accordance
with Article 20.



• Power balance – Power balance should be a key objective of the controller-data
subject relationship. Power imbalances should be avoided. When this is not
possible, they should be recognised and accounted for with suitable
countermeasures.



• No risk transfer – Controllers should not transfer the risks of the enterprise
to the data subjects.



• No deception – Data processing information and options should be provided in
an objective and neutral way, avoiding any deceptive or manipulative language or
design.



• Respect rights – The controller must respect the fundamental rights of data
subjects and implement appropriate measures and safeguards and not impinge on
those rights unless expressly justified by law.



• Ethical – The controller should see the processing’s wider impact on
individuals’ rights and dignity.



• Truthful – The controller must make available information about how they
process personal data, they should act as they declare they will and not mislead
the data subjects.



• Human intervention – The controller must incorporate qualified human
intervention that is capable of uncovering biases that machines may create in
accordance with the right to not be subject to automated individual decision
making in Article 22.[32]



[32] See Guidelines on Automated individual decision-making and Profiling for
the purposes of Regulation 2016/679.
https://ec.europa.eu/newsroom/article29/document.cfm?action=display&doc_id=49826



• Fair algorithms – Regularly assess whether algorithms are functioning in line
with the purposes and adjust the algorithms to mitigate uncovered biases and
ensure fairness in the processing. Data subjects should be informed about the
functioning of the processing of personal data based on algorithms that analyse
or make predictions about them, such as work performance, economic situation,
health, personal preferences, reliability or behaviour, location or
movements.[33]

b) voor welbepaalde, uitdrukkelijk omschreven en gerechtvaardigde doeleinden
worden verzameld en mogen vervolgens niet verder op een met die doeleinden
onverenigbare wijze worden verwerkt; de verdere verwerking met het oog op
archivering in het algemeen belang, wetenschappelijk of historisch onderzoek of
statistische doeleinden wordt overeenkomstig artikel 89, lid 1, niet als
onverenigbaar met de oorspronkelijke doeleinden beschouwd („doelbinding”);

(b) collected for specified, explicit and legitimate purposes and not further
processed in a manner that is incompatible with those purposes; further
processing for archiving purposes in the public interest, scientific or
historical research purposes or statistical purposes shall, in accordance with
Article 89(1), not be considered to be incompatible with the initial purposes
(‘purpose limitation’);


Commentaar ISO 27701 Richtlijnen & Case Law Verbindingen

Commentaar

(EN) Examples of purpose limitation

> Example
> 
> The controller processes personal data about its customers. The purpose of the
> processing is to fulfil a contract, i.e. to be able to deliver goods to the
> correct address and obtain payment. The personal data stored is the purchase
> history, name, address, e-mail address and telephone number.
> 
> The controller is considering buying a Customer Relationship Management (CRM)
> product that gathers all the customer data such as sales, marketing and
> customer service in one place. The product gives the opportunity of storing
> all phone calls, activities, documents, emails and marketing campaigns to get
> a 360-degree view of the customer. Ultimately the CRM automatically analyses
> the customers’ purchasing power by using public information. The purpose of
> the analysis is to target the advertising better but is not a part of the
> original lawful purpose of the processing.
> 
> To be in line with the principle of purpose limitation, the controller
> requires the provider of the product to map the different processing
> activities using personal data with the purposes relevant for the controller.
> Another requirement is that the product shall be able to flag which kind of
> processing activities using personal data that is not in line with the
> legitimate purposes of the controller.
> 
> After receiving the results of the mapping, the controller assesses whether
> the new marketing purpose and the targeted advertisement purpose are within
> the contractual purposes or if they need another legal ground for this
> processing. Alternatively the controller could choose to not make use of this
> functionality in the product.

Source: EDPB, Guidelines 4/2019 on Article 25 – Data Protection by Design and by
Default (Version for public consultation) (2019).

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for
PII controllers.

Here is the relevant paragraphs to article 5(1)(b) GDPR:

7.2.1 Identify and document purpose

Control

The organization should identify and document the specific purposes for which
the PII will be processed.

Implementation guidance

The organization should ensure that PII principals understand the purpose for
which their PII is processed. It is the responsibility of the organization to
clearly document and communicate this to PII principals.

(EN) […]

(EN) Sign in
to read the full text

Richtlijnen & Case Law

(EN) WP29, Opinion 03/2013 on purpose limitation (2013).

EDPB, Guidelines on the use of location data and contact tracing tools in the
context of the COVID-19 outbreak (2020).

EDPB, Guidelines 8/2020 on the targeting of social media users (2020).

Verbindingen

Artikel 89 AVG (GDPR). Waarborgen en afwijkingen in verband met verwerking met
het oog op archivering in het algemeen belang, wetenschappelijk of historisch
onderzoek of statistische doeleinden

Article 89 GDPR. Safeguards and derogations relating to processing for archiving
purposes in the public interest, scientific or historical research purposes or
statistical purposes

Waarborgen en afwijkingen in verband met verwerking met het oog op archivering
in het algemeen belang, wetenschappelijk of historisch onderzoek of statistische
doeleinden

Safeguards and derogations relating to processing for archiving purposes in the
public interest, scientific or historical research purposes or statistical
purposes

1. De verwerking met het oog op archivering in het algemeen belang,
wetenschappelijk of historisch onderzoek of statistische doeleinden is
onderworpen aan passende waarborgen in overeenstemming met deze verordening voor
de rechten en vrijheden van de betrokkene. Die waarborgen zorgen ervoor dat er
technische en organisatorische maatregelen zijn getroffen om de inachtneming van
het beginsel van minimale gegevensverwerking te garanderen. Deze maatregelen
kunnen pseudonimisering omvatten, mits aldus die doeleinden in kwestie kunnen
worden verwezenlijkt. Wanneer die doeleinden kunnen worden verwezenlijkt door
verdere verwerking die de identificatie van betrokkenen niet of niet langer
toelaat, moeten zij aldus worden verwezenlijkt.

1. Processing for archiving purposes in the public interest, scientific or
historical research purposes or statistical purposes, shall be subject to
appropriate safeguards, in accordance with this Regulation, for the rights and
freedoms of the data subject. Those safeguards shall ensure that technical and
organisational measures are in place in particular in order to ensure respect
for the principle of data minimisation. Those measures may include
pseudonymisation provided that those purposes can be fulfilled in that manner.
Where those purposes can be fulfilled by further processing which does not
permit or no longer permits the identification of data subjects, those purposes
shall be fulfilled in that manner.

[…]

[…]



Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version
2.0.



3.4 Purpose Limitation [34]



[34] The Article 29 Working Party provided guidance for the understanding of the
principle of purpose limitation under Directive 95/46/EC. Although the Opinion
is not adopted by the EDBP, it may still be relevant as the wording of the
principle is the same under the GDPR. Article 29 Working Party. “Opinion 03/2013
on purpose limitation”. WP 203, 2 April 2013.
ec.europa.eu/justice/article-29/documentation/opinion-
recommendation/files/2013/wp203_en.pdf



71. The controller must collect data for specified, explicit, and legitimate
purposes, and not further process the data in a manner that is incompatible with
the purposes for which they were collected.[35] The design of the processing
should therefore be shaped by what is necessary to achieve the purposes. If any
further processing is to take place, the controller must first make sure that
this processing has purposes compatible with the original ones and design such
processing accordingly. Whether a new purpose is compatible or not, shall be
assessed according to the criteria in Article 6(4).



[35] Art. 5.1.b GDPR

c) toereikend zijn, ter zake dienend en beperkt tot wat noodzakelijk is voor de
doeleinden waarvoor zij worden verwerkt („minimale gegevensverwerking”);

(c) adequate, relevant and limited to what is necessary in relation to the
purposes for which they are processed (‘data minimisation’);


Commentaar ISO 27701 Richtlijnen & Case Law Verbindingen

Commentaar

(EN) Examples of data minimisation

> Example 1
> 
> A bookshop wants to add to their revenue by selling their books online. The
> bookshop owner wants to set up a standardised form for the ordering process.
> To prevent that customers don’t fill out all the necessary information the
> bookshop owner makes all of the fields in the form a required field (if you
> don’t fill out all the fields the customer can’t place the order) using a
> standard contact form. The webshop owner initially uses a standard contact
> form, which asks the customer’s date of birth, phone number and home address.
> However, not all the fields in the form are strictly necessary for the purpose
> of buying and delivering the books. The data subject’s date of birth and phone
> number are not necessary for the purchase of the product. This means that
> these cannot be required fields in the web form to order the product.
> Moreover, there are situations where an address will not be necessary. For
> example, when ordering an eBook the customer can download the product and his
> or her address does not need to be processed by the webshop.
> 
> The webshop owner therefore decides to make two web forms: one for ordering
> books, with a field for the customer’s address and one web form for ordering
> eBooks without a field for the customer’s address.
> 
> Example 2
> 
> A public transportation company wishes to gather statistical information based
> on travellers’ routes. This is useful for the purposes of making proper
> choices on changes in public transport schedules and proper routings of the
> trains. The passengers must pass their ticket through a reader every time they
> enter or exit a means of transport. Having carried out a risk assessment
> related to the rights and freedoms of passengers’ regarding the collection of
> passengers’ travel routes, the controller establishes that it is possible to
> identify the passengers based on the ticket identifier. Therefore, since it is
> not necessary for the purpose of optimizing the public transport schedules and
> routings of the trains, the controller does not store the ticket identifier.
> Once the trip is over, the controller only stores the individual travel routes
> so as to not be able to identify trips connected to a single ticket, but only
> retains information about separate travel routes.
> 
> In cases where there can be a risk of identifying a person solely by their
> travel route (this might be the case in remote areas) the controller
> implements measures to aggregate the travel route, such as cutting the
> beginning and the end of the route.
> 
> Example 3
> 
> A courier aims at assessing the effectiveness of its deliveries in terms of
> delivery times, workload scheduling and fuel consumption. In order to reach
> this goal, the courier has to process a number of personal data relating to
> both employees (drivers) and customers (addresses, items to be delivered,
> etc.). This processing operation entails risks of both monitoring employees,
> which requires specific legal safeguards, and tracking customers’ habits
> through the knowledge of the delivered items over time. These risks can be
> significantly reduced with appropriate pseudonymization of employees and
> customers. In particular if pseudonymization keys are frequently rotated and
> macro areas are considered instead of detailed addresses, an effective data
> minimization is pursued, and the controller can solely focus on the delivery
> process and on the purpose of resource optimization, without crossing the
> threshold of monitoring individuals’ (customers’ or employees’) behaviours.

Source: EDPB, Guidelines 4/2019 on Article 25 – Data Protection by Design and by
Default (Version for public consultation) (2019).

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for
PII controllers.

Here is the relevant paragraphs to article 5(1)(c) GDPR:

7.4.1 Limit collection

Control

The organization should limit the collection of PII to the minimum that is
relevant, proportional and necessary for the identified purposes.

Implementation guidance

The organization should limit the collection of PII to what is adequate,
relevant and necessary in relation to the identified purposes. This includes
limiting the amount of PII that the organization collects indirectly (e.g.
through web logs, system logs, etc.).

Privacy by default implies that, where any optionality in the collection and
processing of PII exists, each option should be disabled by default and only
enabled by explicit choice of the PII principal.

7.4.4 PII minimization objectives

Control

The organization should define and document data minimization objectives and
what mechanisms (such as de-identification) are used to meet those objectives.

(EN) […]

(EN) Sign in
to read the full text

Richtlijnen & Case Law

(EN) EDPB, Guidelines on the use of location data and contact tracing tools in
the context of the COVID-19 outbreak (2020).

European Commission, Guidance on Apps supporting the fight against COVID 19
pandemic in relation to data protection Brussels (2020).

Verbindingen

Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version
2.0.



3.5 Data Minimisation



73. Only personal data that is adequate, relevant and limited to what is
necessary for the purpose shall be processed. [36] As a result, the controller
has to predetermine which features and parameters of processing systems and
their supporting functions are permissible. Data minimisation substantiates and
operationalises the principle of necessity. In the further processing, the
controller should periodically consider whether processed personal data is still
adequate, relevant and necessary, or if the data shall be deleted or anonymized.



[36] Art. 5(1)(c) GDPR



74. Controllers should first of all determine whether they even need to process
personal data for their relevant purposes. The controller should verify whether
the relevant purposes can be achieved by processing less personal data, or
having less detailed or aggregated personal data or without having to process
personal data at all.[37] Such verification should take place before any
processing takes place, but could also be carried out at any point during the
processing lifecycle. This is also consistent with Article 11.



[37] Recital 39 GDPR so states: “…Personal data should be processed only if the
purpose of the processing could not reasonably be fulfilled by other means.”



75. Minimising can also refer to the degree of identification. If the purpose of
the processing does not require the final set of data to refer to an identified
or identifiable individual (such as in statistics), but the initial processing
does (e.g. before data aggregation), then the controller shall delete or
anonymize personal data as soon as identification is no longer needed. Or, if
continued identification is needed for other processing activities, personal
data should be pseudonymized to mitigate risks for the data subjects’ rights.



76. Key design and default data minimisation elements may include:



• Data avoidance – Avoid processing personal data altogether when this is
possible for the relevant purpose.



• Limitation – Limit the amount of personal data collected to what is necessary
for the purpose



• Access limitation – Shape the data processing in a way that a minimal number
of people need access to personal data to perform their duties, and limit access
accordingly.



• Relevance – Personal data should be relevant to the processing in question,
and the controller should be able to demonstrate this relevance.



• Necessity – Each personal data category shall be necessary for the specified
purposes and should only be processed if it is not possible to fulfil the
purpose by other means.



• Limitation – Limit the amount of personal data collected to what is necessary
for the purpose



• Aggregation – Use aggregated data when possible.



• Pseudonymization – Pseudonymize personal data as soon as it is no longer
necessary to have directly identifiable personal data, and store identification
keys separately.



• Anonymization and deletion – Where personal data is not, or no longer
necessary for the purpose, personal data shall be anonymized or deleted.



• Data flow – The data flow should be made efficient enough to not create more
copies than necessary.



• “State of the art” – The controller should apply up to date and appropriate
technologies for data avoidance and minimisation.

d) juist zijn en zo nodig worden geactualiseerd; alle redelijke maatregelen
moeten worden genomen om de persoonsgegevens die, gelet op de doeleinden
waarvoor zij worden verwerkt, onjuist zijn, onverwijld te wissen of te
rectificeren („juistheid”);

(d) accurate and, where necessary, kept up to date; every reasonable step must
be taken to ensure that personal data that are inaccurate, having regard to the
purposes for which they are processed, are erased or rectified without delay
(‘accuracy’);


Commentaar ISO 27701 Verbindingen

Commentaar

(EN) Examples of the measures ensuring data accuracy

> Example 1
> 
> A bank wishes to use artificial intelligence (AI) to profile customers
> applying for bank loans as a basis for their decision making. When determining
> how their AI solutions should be developed, they are determining the means of
> processing and must consider data protection by design when choosing an AI
> from a vendor and when deciding on how to train the AI.
> 
> When determining how to train the AI, the controller must have accurate data
> to achieve precise results. Therefore, the controller must ensure that the
> data used to train the AI is accurate.
> 
> Granted they have the legal basis to train the AI using personal data from a
> large pool of their existing customers, the controller chooses a pool of
> customers that is representative of the population to also avoid bias.
> 
> Customer data is gathered from their own systems, gathering data about the
> existing loan customers’ payment history, bank transactions, credit card debt,
> they conduct new credit checks, and they gather data from public registries
> that they have legal access to use.
> 
> To ensure that the data used for AI training is as accurate as possible, the
> controller only collects data from data sources with correct and up-to date
> information.
> 
> Finally, the bank tests whether the AI is reliable and provides
> non-discriminatory results. When the AI is fully trained and operative, the
> bank uses the results as a part of the loan assessments, and will never rely
> solely on the AI to decide whether to grant loans.
> 
> The bank will also review the reliability of the results from the AI at
> regular intervals.
> 
> Example 2
> 
> The controller is a health institution looking to find methods to ensure the
> integrity and accuracy of personal data in their client registers.
> 
> In situations where two persons arrive at the institution at the same time and
> receive the same treatment, there is a risk of mistaking them if the only
> parameter to separate them is by name. To ensure accuracy, the controller
> needs a unique identifier for each person, and therefore more information than
> just the name of the client.
> 
> The institution uses several systems containing personal information of
> clients, and need to ensure that the information related to the client is
> correct, accurate and consistent in all the systems at any point in time. The
> institution has identified several risks that may arise if information is
> changed in one system but not another.
> 
> The controller decides to mitigate the risk by using a hashing technique that
> can be used to ensure integrity of data in the treatment journal. Immutable
> hash signatures are created for treatment journal records and the employee
> associated with them so that any changes can be recognized, correlated and
> traced if required.

Source: EDPB, Guidelines 4/2019 on Article 25 – Data Protection by Design and by
Default (Version for public consultation) (2019).

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for
PII controllers.

Here is the relevant paragraphs to article 5(1)(d) GDPR:

7.3.6 Access, correction and/or erasure

Control

The organization should implement policies, procedures and/or mechanisms to meet
their obligations to PII principals to access, correct and/or erase their PII.

Implementation guidance

The organization should implement policies, procedures and/or mechanisms for
enabling PII principals to obtain access to, correct and erase of their PII, if
requested and without undue delay.

(EN) […]

(EN) Sign in
to read the full text

Verbindingen

Artikel 16 AVG (GDPR). Recht op rectificatie

Article 16 GDPR. Right to rectification

De betrokkene heeft het recht om van de verwerkingsverantwoordelijke onverwijld
rectificatie van hem betreffende onjuiste persoonsgegevens te verkrijgen. Met
inachtneming van de doeleinden van de verwerking heeft de betrokkene het recht
vervollediging van onvolledige persoonsgegevens te verkrijgen, onder meer door
een aanvullende verklaring te verstrekken.

The data subject shall have the right to obtain from the controller without
undue delay the rectification of inaccurate personal data concerning him or her.
Taking into account the purposes of the processing, the data subject shall have
the right to have incomplete personal data completed, including by means of
providing a supplementary statement.



Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version
2.0.



3.6 Accuracy



77. Personal data shall be accurate and kept up to date, and every reasonable
step shall be taken to ensure that personal data that is inaccurate, having
regard to the purposes for which they are processed, are erased or rectified
without delay. [38]



[38] Art. 5(1)(d) GDPR



78. The requirements should be seen in relation to the risks and consequences of
the concrete use of data. Inaccurate personal data could be a risk to the data
subjects’ rights and freedoms, for example when leading to a faulty diagnosis or
wrongful treatment of a health protocol, or an incorrect image of a person can
lead to decisions being made on the wrong basis either manually, using automated
decision-making, or through artificial intelligence.



79. Key design and default accuracy elements may include:



• Data source – Sources of personal data should be reliable in terms of data
accuracy.



• Degree of accuracy – Each personal data element should be as accurate as
necessary for the specified purposes.



• Measurably accurate – Reduce the number of false positives/negatives, for
example biases in automated decisions and artificial intelligence.



• Verification – Depending on the nature of the data, in relation to how often
it may change, the controller should verify the correctness of personal data
with the data subject before and at different stages of the processing (e.g. to
age requirements).



• Erasure/rectification – The controller shall erase or rectify inaccurate data
without delay. The controller shall in particular facilitate this where the data
subjects are or were children and later want to remove such personal data.[39]



[39] Cf. Recital 65.



• Error propagation avoidance – Controllers should mitigate the effect of an
accumulated error in the processing chain.



• Access – Data subjects should be given information about and effective access
to personal data in accordance with the GDPR articles 12 to 15 in order to
control accuracy and rectify as needed.



• Continued accuracy – Personal data should be accurate at all stages of the
processing, tests of accuracy should be carried out at critical steps.



• Up to date – Personal data shall be updated if necessary for the purpose.



• Data design – Use of technological and organisational design features to
decrease inaccuracy, for example present concise predetermined choices instead
of free text fields.

e) worden bewaard in een vorm die het mogelijk maakt de betrokkenen niet langer
te identificeren dan voor de doeleinden waarvoor de persoonsgegevens worden
verwerkt noodzakelijk is; persoonsgegevens mogen voor langere perioden worden
opgeslagen voor zover de persoonsgegevens louter met het oog op archivering in
het algemeen belang, wetenschappelijk of historisch onderzoek of statistische
doeleinden worden verwerkt overeenkomstig artikel 89, lid 1, mits de bij deze
verordening vereiste passende technische en organisatorische maatregelen worden
getroffen om de rechten en vrijheden van de betrokkene te beschermen
(„opslagbeperking”);

(e) kept in a form which permits identification of data subjects for no longer
than is necessary for the purposes for which the personal data are processed;
personal data may be stored for longer periods insofar as the personal data will
be processed solely for archiving purposes in the public interest, scientific or
historical research purposes or statistical purposes in accordance with
Article 89(1) subject to implementation of the appropriate technical and
organisational measures required by this Regulation in order to safeguard the
rights and freedoms of the data subject (‘storage limitation’);


Commentaar ISO 27701 Richtlijnen & Case Law Verbindingen

Commentaar

(EN) Example of storage limitation

> The controller collects personal data where the purpose of the processing is
> to administer a membership with the data subject, the personal data shall be
> deleted when the membership is terminated.
> 
> The controller makes an internal procedure for data retention and deletion.
> According to this, employees must manually delete personal data after the
> retention period ends. The employee follows the procedure to regularly delete
> and correct data from any devices, from backups, logs, e-mails and other
> relevant storage media.
> 
> To make deletion more effective, the controller instead implements an
> automatic system to delete data automatically and more regularly. The system
> is configured to follow the given procedure for data deletion which then
> occurs at a predefined regular interval to remove personal data from all of
> the company’s storage media. The controller reviews and tests the retention
> policy regularly.

Source: EDPB, Guidelines 4/2019 on Article 25 – Data Protection by Design and by
Default (Version for public consultation) (2019).

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for
PII controllers.

Here is the relevant paragraphs to article 5(1)(e) GDPR:

7.4.4 PII minimization objectives

Control

The organization should define and document data minimization objectives and
what mechanisms (such as de-identification) are used to meet those objectives.

Implementation guidance

Organizations should identify how the specific PII and amount of PII collected
and processed is limited relative to the identified purposes.

(EN) […]

(EN) Sign in
to read the full text

Richtlijnen & Case Law

(EN) Article 29 Working Party, Opinion 1/2008 on data protection issues related
to search engines (2008).

> In view of the initial explanations given by search engine providers on the
> possible purposes for collecting personal data, the Working Party does not see
> a basis for a retention period beyond 6 months.
> 
> In case search engine providers retain personal data longer than 6 months,
> they will have to demonstrate comprehensively that it is strictly necessary
> for the service.

European Commission, Guidance on Apps supporting the fight against COVID 19
pandemic in relation to data protection Brussels (2020).

Verbindingen

Artikel 89 AVG (GDPR). Waarborgen en afwijkingen in verband met verwerking met
het oog op archivering in het algemeen belang, wetenschappelijk of historisch
onderzoek of statistische doeleinden

Article 89 GDPR. Safeguards and derogations relating to processing for archiving
purposes in the public interest, scientific or historical research purposes or
statistical purposes

1. De verwerking met het oog op archivering in het algemeen belang,
wetenschappelijk of historisch onderzoek of statistische doeleinden is
onderworpen aan passende waarborgen in overeenstemming met deze verordening voor
de rechten en vrijheden van de betrokkene. Die waarborgen zorgen ervoor dat er
technische en organisatorische maatregelen zijn getroffen om de inachtneming van
het beginsel van minimale gegevensverwerking te garanderen. Deze maatregelen
kunnen pseudonimisering omvatten, mits aldus die doeleinden in kwestie kunnen
worden verwezenlijkt. Wanneer die doeleinden kunnen worden verwezenlijkt door
verdere verwerking die de identificatie van betrokkenen niet of niet langer
toelaat, moeten zij aldus worden verwezenlijkt.

1. Processing for archiving purposes in the public interest, scientific or
historical research purposes or statistical purposes, shall be subject to
appropriate safeguards, in accordance with this Regulation, for the rights and
freedoms of the data subject. Those safeguards shall ensure that technical and
organisational measures are in place in particular in order to ensure respect
for the principle of data minimisation. Those measures may include
pseudonymisation provided that those purposes can be fulfilled in that manner.
Where those purposes can be fulfilled by further processing which does not
permit or no longer permits the identification of data subjects, those purposes
shall be fulfilled in that manner.



Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version
2.0.



3.7 Storage limitation



80. The controller must ensure that personal data is kept in a form which
permits identification of data subjects for no longer than is necessary for the
purposes for which the personal data is processed.[40] It is vital that the
controller knows exactly what personal data the company processes and why. The
purpose of the processing shall be the main criterion to decide in how long
personal data shall be stored.



[40] Art. 5(1)(c) GDPR



81. Measures and safeguards that implement the principle of storage limitation
shall complement the rights and freedoms of the data subjects, specifically, the
right to erasure and the right to object.



82. Key design and default storage limitation elements may include:



• Deletion and anonymization – The controller should have clear internal
procedures and functionalities for deletion and/or anonymization.



• Automation – Deletion of certain personal data should be automated



• Storage criteria – The controller must determine what data and length of
storage is necessary for the purpose.



• Enforcement of retention policies – The controller must enforce internal
retention policies and conduct tests of whether the organization practices its
policies.



• Effectiveness of anonymization/deletion – The controller shall make sure that
it is not possible to re-identify anonymized data or recover deleted data, and
should test whether this is possible.



• Automation – Deletion of certain personal data should be automated.



• Storage criteria – The controller shall determine what data and length of
storage is necessary for the purpose.



• Justification – The controller shall be able to justify why the period of
storage is necessary for the purpose and the personal data in question, and be
able to disclose the rationale behind, and legal grounds for the retention
period.



• Enforcement of retention policies – The controller should enforce internal
retention policies and conduct tests of whether the organization practices its
policies.



• Backups/logs – Controllers shall determine what personal data and length of
storage is necessary for back-ups and logs.



• Data flow – Controllers should beware of the flow of personal data, and the
storage of any copies thereof, and seek to limit their “temporary” storage.



Guidelines on consent under Regulation 2016/679



Scientific research



153. Recital 33 seems to bring some flexibility to the degree of specification
and granularity of consent in the context of scientific research. Recital 33
states: “It is often not possible to fully identify the purpose of personal data
processing for scientific research purposes at the time of data collection.
Therefore, data subjects should be allowed to give their consent to certain
areas of scientific research when in keeping with recognised ethical standards
for scientific research. Data subjects should have the opportunity to give their
consent only to certain areas of research or parts of research projects to the
extent allowed by the intended purpose.”

f) door het nemen van passende technische of organisatorische maatregelen op een
dusdanige manier worden verwerkt dat een passende beveiliging ervan gewaarborgd
is, en dat zij onder meer beschermd zijn tegen ongeoorloofde of onrechtmatige
verwerking en tegen onopzettelijk verlies, vernietiging of beschadiging
(„integriteit en vertrouwelijkheid”).

(f) processed in a manner that ensures appropriate security of the personal
data, including protection against unauthorised or unlawful processing and
against accidental loss, destruction or damage, using appropriate technical or
organisational measures (‘integrity and confidentiality’).


Commentaar ISO 27701 Richtlijnen & Case Law Verbindingen

Commentaar

(EN) Example of integrity and confidentiality measures

> A controller wants to extract personal data from a medical database to a
> server in the company. The company has assessed the risk for routing the
> extracts to a server that is accessible to all of the company’s employees as
> likely to be high for data subjects’ rights and freedoms. There is only one
> department in the company who needs to process these patient data. The
> extracts will also have a high value to the company.
> 
> To regulate access and mitigate possible damage from malware, the company
> decides to segregate the network, and establish access controls to the server
> and the directory. In addition, they put up security monitoring and an
> intrusion detection and prevention system. The controller activates access
> control on the server and isolates it from routine use. An automated auditing
> system is put in place to monitor access and changes. Reporting and automated
> alerts are generated from this when certain events related to usage are
> configured. This security measure will ensure that all users have access on a
> need to know basis and with the appropriate access level. Inappropriate use
> can be quickly and easily recognised.
> 
> Some of the extracts have to be compared with new extracts, and must therefore
> be stored for three months. The controller decides to put them into separate
> directories and encrypt the stored extracts.
> 
> Handling the incident makes the system more robust, and reliable, both for the
> controller and the data subjects. The data controller understands that
> preventative and effective measures and safeguards should be built into all
> personal data processing undertakes now and in the future, and that doing so
> may help prevent future such data breach incidents.
> 
> The controller establishes these security measures both to ensure accuracy,
> integrity and confidentiality, but also to prevent malware spread by
> cyber-attacks to make the solution robust.

Source: EDPB, Guidelines 4/2019 on Article 25 – Data Protection by Design and by
Default (Version for public consultation) (2019).

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC
27002, section 6.2.1.

Here is the relevant paragraphs to article 5(1)(f) GDPR:

6.3.2.1 Mobile device policy

Implementation guidance

The organization should ensure that the use of mobile devices does not lead to a
compromise of PII.

(EN) […]

(EN) Sign in
to read the full text

Richtlijnen & Case Law

(EN) European Commission, Guidance on Apps supporting the fight against COVID 19
pandemic in relation to data protection Brussels (2020).

Verbindingen

Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version
2.0.



3.8 Integrity and confidentiality



83. The principle of integrity and confidentiality includes protection against
unauthorised or unlawful processing and against accidental loss, destruction or
damage, using appropriate technical or organisational measures. The security of
personal data requires appropriate measures designed to prevent and manage data
breach incidents; to guarantee the proper execution of data processing tasks,
and compliance with the other principles; and to facilitate the effective
exercise of individuals’ rights.

2. De verwerkingsverantwoordelijke is verantwoordelijk voor de naleving van lid
1 en kan deze aantonen („verantwoordingsplicht”).

2. The controller shall be responsible for, and be able to demonstrate
compliance with, paragraph 1 (‘accountability’).


ISO 27701 Richtlijnen & Case Law Overwegingen Verbindingen

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC
27002, section 18.1.3.

Here is the relevant paragraphs to article 5(2) GDPR:

6.15.1.3 Protection of records

Implementation guidance

Review of current and historical policies and procedures can be required (e.g.
in the cases of customer dispute resolution and investigation by a supervisory
authority).

(EN) […]

(EN) Sign in
to read the full text

Richtlijnen & Case Law

(EN) WP29, Opinion 3/2010 on the principle of accountability  (2010).

EDPB, Guidelines on the use of location data and contact tracing tools in the
context of the COVID-19 outbreak (2020).

Overwegingen

(82) Om de naleving van deze verordening aan te kunnen tonen, dient de
verwerkingsverantwoordelijke of de verwerker een register bij te houden van
verwerkingsactiviteiten die onder zijn verantwoordelijkheid hebben
plaatsgevonden. Elke verwerkingsverantwoordelijke en elke verwerker dient ertoe
te worden verplicht medewerking te verlenen aan de toezichthoudende autoriteit
en dit register desgevraagd te verstrekken met het oog op het gebruik daarvan
voor het toezicht op de verwerkingsactiviteiten.

(82) In order to demonstrate compliance with this Regulation, the controller or
processor should maintain records of processing activities under its
responsibility. Each controller and processor should be obliged to cooperate
with the supervisory authority and make those records, on request, available to
it, so that it might serve for monitoring those processing operations.

Verbindingen

Artikel 30 AVG (GDPR). Register van de verwerkingsactiviteiten

Article 30 GDPR. Records of processing activities

1. Elke verwerkingsverantwoordelijke en, in voorkomend geval, de
vertegenwoordiger van de verwerkingsverantwoordelijke houdt een register van de
verwerkingsactiviteiten die onder hun verantwoordelijkheid plaatsvinden. Dat
register bevat alle volgende gegevens:

1. Each controller and, where applicable, the controller’s representative, shall
maintain a record of processing activities under its responsibility. That record
shall contain all of the following information:

[…]

[…]

Artikel 7 AVG (GDPR). Voorwaarden voor toestemming

Article 7 GDPR. Conditions for consent

1. Wanneer de verwerking berust op toestemming, moet de
verwerkingsverantwoordelijke kunnen aantonen dat de betrokkene toestemming heeft
gegeven voor de verwerking van zijn persoonsgegevens.

1. Where processing is based on consent, the controller shall be able to
demonstrate that the data subject has consented to processing of his or her
personal data.

[…]

[…]

Artikel 28 AVG (GDPR). Verwerker

Article 28 GDPR. Processor

1. Wanneer een verwerking namens een verwerkingsverantwoordelijke wordt
verricht, doet de verwerkingsverantwoordelijke uitsluitend een beroep op
verwerkers die afdoende garanties met betrekking tot het toepassen van passende
technische en organisatorische maatregelen bieden opdat de verwerking aan de
vereisten van deze verordening voldoet en de bescherming van de rechten van de
betrokkene is gewaarborgd.

1. Where processing is to be carried out on behalf of a controller, the
controller shall use only processors providing sufficient guarantees to
implement appropriate technical and organisational measures in such a manner
that processing will meet the requirements of this Regulation and ensure the
protection of the rights of the data subject.

[…]

[…]

Artikel 82 AVG (GDPR). Recht op schadevergoeding en aansprakelijkheid

Article 82 GDPR. Right to compensation and liability

[…]

[…]

2. Elke verwerkingsverantwoordelijke die bij verwerking is betrokken, is
aansprakelijk voor de schade die wordt veroorzaakt door verwerking die inbreuk
maakt op deze verordening. Een verwerker is slechts aansprakelijk voor de schade
die door verwerking is veroorzaakt wanneer bij de verwerking niet is voldaan aan
de specifiek tot verwerkers gerichte verplichtingen van deze verordening of
buiten dan wel in strijd met de rechtmatige instructies van de
verwerkingsverantwoordelijke is gehandeld.

2. Any controller involved in processing shall be liable for the damage caused
by processing which infringes this Regulation. A processor shall be liable for
the damage caused by processing only where it has not complied with obligations
of this Regulation specifically directed to processors or where it has acted
outside or contrary to lawful instructions of the controller.

[…]

[…]

Artikel 83 AVG (GDPR). Algemene voorwaarden voor het opleggen van
administratieve geldboeten

Article 83 GDPR. General conditions for imposing administrative fines



Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version
2.0.



3.9 Accountability [41]



[41] See Recital 74, where controllers are required to demonstrate the
effectiveness of their measures.



86. The principle of accountability states that the controller shall be
responsible for, and be able to demonstrate compliance with all of the
abovementioned principles.



87. The controller needs to be able to demonstrate compliance with the
principles. In doing so, the controller may demonstrate the effects of the
measures taken to protect the data subjects’ rights, and why the measures are
considered to be appropriate and effective. For example, demonstrating why a
measure is appropriate to ensure the principle of storage limitation in an
effective manner.

Algemene verordening gegevensbescherming (AVG, GDPR)



General Data Protection Regulation (EU GDPR)

The latest consolidated version of the Regulation with corrections by
Corrigendum, OJ L 127, 23.5.2018, p. 2 ((EU) 2016/679). Source: EUR-lex.

Overwegingen Richtlijnen & Case Law laat een reactie achter
Overwegingen

(39) Elke verwerking van persoonsgegevens dient behoorlijk en rechtmatig te
geschieden. Voor natuurlijke personen dient het transparant te zijn dat hen
betreffende persoonsgegevens worden verzameld, gebruikt, geraadpleegd of
anderszins verwerkt en in hoeverre de persoonsgegevens worden verwerkt of zullen
worden verwerkt. Overeenkomstig het transparantiebeginsel moeten informatie en
communicatie in verband met de verwerking van die persoonsgegevens eenvoudig
toegankelijk en begrijpelijk zijn, en moet duidelijke en eenvoudige taal worden
gebruikt. Dat beginsel betreft met name het informeren van de betrokkenen over
de identiteit van de verwerkingsverantwoordelijke en de doeleinden van de
verwerking, alsook verdere informatie om te zorgen voor behoorlijke en
transparante verwerking met betrekking tot de natuurlijke personen in kwestie en
hun recht om bevestiging en mededeling te krijgen van hun persoonsgegevens die
worden verwerkt. Natuurlijke personen moeten bewust worden gemaakt van de
risico's, regels, waarborgen en rechten in verband met de verwerking van
persoonsgegevens, alsook van de wijze waarop zij hun rechten met betrekking tot
deze verwerking kunnen uitoefenen. Meer bepaald dienen de specifieke doeleinden
waarvoor de persoonsgegevens worden verwerkt, expliciet en gerechtvaardigd te
zijn en te zijn vastgesteld wanneer de persoonsgegevens worden verzameld. De
persoonsgegevens dienen toereikend en ter zake dienend te zijn en beperkt te
blijven tot wat noodzakelijk is voor de doeleinden waarvoor zij worden verwerkt.
Dit vereist met name dat ervoor wordt gezorgd dat de opslagperiode van de
persoonsgegevens tot een strikt minimum wordt beperkt. Persoonsgegevens mogen
alleen worden verwerkt indien het doel van de verwerking niet redelijkerwijs op
een andere wijze kan worden verwezenlijkt. Om ervoor te zorgen dat
persoonsgegevens niet langer worden bewaard dan noodzakelijk is, dient de
verwerkingsverantwoordelijke termijnen vast te stellen voor het wissen van
gegevens of voor een periodieke toetsing ervan. Alle redelijke maatregelen
moeten worden genomen om ervoor te zorgen dat onjuiste persoonsgegevens worden
gerectificeerd of gewist. Persoonsgegevens moeten worden verwerkt op een manier
die een passende beveiliging en vertrouwelijkheid van die gegevens waarborgt,
ook ter voorkoming van ongeoorloofde toegang tot of het ongeoorloofde gebruik
van persoonsgegevens en de apparatuur die voor de verwerking wordt gebruikt.

(39) Any processing of personal data should be lawful and fair. It should be
transparent to natural persons that personal data concerning them are collected,
used, consulted or otherwise processed and to what extent the personal data are
or will be processed. The principle of transparency requires that any
information and communication relating to the processing of those personal data
be easily accessible and easy to understand, and that clear and plain language
be used. That principle concerns, in particular, information to the data
subjects on the identity of the controller and the purposes of the processing
and further information to ensure fair and transparent processing in respect of
the natural persons concerned and their right to obtain confirmation and
communication of personal data concerning them which are being processed.
Natural persons should be made aware of risks, rules, safeguards and rights in
relation to the processing of personal data and how to exercise their rights in
relation to such processing. In particular, the specific purposes for which
personal data are processed should be explicit and legitimate and determined at
the time of the collection of the personal data. The personal data should be
adequate, relevant and limited to what is necessary for the purposes for which
they are processed. This requires, in particular, ensuring that the period for
which the personal data are stored is limited to a strict minimum. Personal data
should be processed only if the purpose of the processing could not reasonably
be fulfilled by other means. In order to ensure that the personal data are not
kept longer than necessary, time limits should be established by the controller
for erasure or for a periodic review. Every reasonable step should be taken to
ensure that personal data which are inaccurate are rectified or deleted.
Personal data should be processed in a manner that ensures appropriate security
and confidentiality of the personal data, including for preventing unauthorised
access to or use of personal data and the equipment used for the processing.

Richtlijnen & Case Law

(EN)

DOCUMENTS

ICO, Accountability Framework 

WP29, Opinion on data processing at work (2017).

EDPB, Guidelines 3/2019 on Processing of Personal Data through Video Devices
(2020).

DPC (Ireland), Guidance for Individuals who Accidentally Receive Personal data
(2020).

EDPB, Guidelines 02/2021 on Virtual Voice Assistants (2021).

CASE LAW

ECHR, López Ribalda v. Spain, nos 1874/13 and 8567/13 (2019).

Belgian DPA Fines Belgian Telecommunications Provider for Several Data
Protection Infringements, (2020) – brief description in English.

Norwegian DPA, Issues fine to Aquateknikk AS (2021).

Norwegian DPA, Intention to issue € 10 million fine to Grindr LLC (2021).

 

laat een reactie achter
[js-disqus]
Artikel 4. Definities
Artikel 6. Rechtmatigheid van de verwerking

 * Sign in
 * New account

Remember me


Enter something special:



Log in


Forgot your password?

(EN) Subscribe to updated texts, invitations to GDPR events and news by Data
Privacy Office


Create account


Lost your password? Please enter your email address. You will receive mail with
link to set new password.



Reset password

Back to login

*
 * AVG (GDPR)
 * Richtsnoeren
 * Over het project
 * Nieuws
 * Privacybeleid

© DPO Europe GmbH 2018-2022

(EN) Url-link to highlighted text was copied to the clipboard!
(EN) Preparing download...
 
×

THANK YOU!

We will contact you soon.