The EU data protection legislation means that your personal data can only be processed in certain situations and under certain conditions:
- If you have given your consent (you should be notified that your details are being collected).
- If the processing of the data is necessary for a contract, a job application or a request for a loan.
- If there is a legal obligation that your data is processed.
- If the processing of your details is of vital interest for you, for example, if a doctor needs to access your private medical history after an accident.
- If the processing is necessary to conduct proceedings in the public interest or for proceedings of the administration, the tax office, the police or other public bodies.
Personal data concerning your racial or ethnic origin, your sexual orientation, political opinions, religious or philosophical beliefs, membership of trade unions or your health cannot be processed except in certain cases. For example, when you have given your explicit consent or when the processing of the data is necessary for reasons of essential public interest in accordance with national or EU legislation.
These regulations apply to both public and private bodies.
The person or organism which handles your data is called "the data controller". This person must respect the EU regulations, in particular on handling and storing personal data:
- This data can only be collected for lawful and clearly defined purposes.
- The data requested must not be excessive.
- The data which identifies you personally (for example, your surnames or contact details) must not be stored longer than necessary.
- You must be able to correct, delete or block incorrect data about you.
- Your data must be protected against accidental or illegal destruction, loss or dissemination.
In the event of theft, loss or illegal access to sensitive personal information, known as a "personal data breach", the provider must notify the national data protection authority. The data controller must also notify you directly of, as a result of the personal data breach, your data or your privacy are at risk.