Justice K.S.Puttaswamy(Retd) vs Union Of India on 26 September, 2018 (a) EUGDPR (European Union General Data Protection Regulation)69 69 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) EUGDPR which was enacted by the EU in 2016 came into force on May 25, 2018 replacing the Data Protection Directive of 1995. It is an exhaustive and comprehensive legal framework that is aimed at protection of natural persons from the processing of personal data and their right to informational privacy. It deals with all kinds of processing of personal data while delineating rights of data subjects and obligations of data processors in detail. The following fundamental principles of data collection, processing, storage and use reflect the proportionality principle underpinning the EUGDPR (i) the personal data shall be processed lawfully, fairly, and in a transparent manner in relation to the data subject (principle of lawfulness, fairness, and transparency); (ii) the personal data must be collected for specified, explicit, and legitimate purposes (principle of purpose limitation); (iii) processing must also be adequate, relevant, and limited to what is necessary (principle of data minimization) as well as accurate and, where necessary, kept up to date (principle of accuracy); (iv) data is to be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed (principle of storage limitation); (v) data processing must be secure (principle of integrity and confidentiality); and (vi) data controller is to be held responsible (principle of accountability). 167) The EUGDPR under Article 9 prohibits the collection of biometric data unless except in few circumstances which include (but are not limited to) (a) there is an explicit consent by the party whose data is being collected. The consent should be freely given, which is clearly distinguishable in an intelligible and easily accessible form, using clear and plain language. This consent can be withdrawn at any time without affecting the actions prior to the withdrawal; (b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law; (c) processing relates to personal data which is manifestly made public by the data subject; and (d) processing is necessary for reasons of substantial public interest, and it shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and Indian Kanoon - http://indiankanoon.org/doc/127517806/ 130