12/10/2019 CURIA - Documents ‘(1) The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the “Charter”) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of personal data concerning him or her. … (4) The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, … the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, … … (51) Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms. … (52) Derogating from the prohibition on processing special categories of personal data should also be allowed when provided for in Union or Member State law and subject to suitable safeguards, so as to protect personal data and other fundamental rights … … (65) A data subject should have … a “right to be forgotten” where the retention of such data infringes this Regulation or Union or Member State law to which the controller is subject. … However, the further retention of the personal data should be lawful where it is necessary, for exercising the right of freedom of expression and information …’ 15 Article 4(11) of Regulation 2016/679 defines ‘consent’ as ‘any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her’. 16 Article 5 of Regulation 2016/679, headed ‘Principles relating to processing of personal data’, provides in paragraph 1(c) to (e): ‘Personal data shall be: … 17 (c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”); (d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (“accuracy”); (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; … (“storage limitation”)’. Article 9 of Regulation 2016/679, headed ‘Processing of special categories of personal data’, provides: ‘1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited. curia.europa.eu/juris/document/document_print.jsf?docid=218106&text=&dir=&doclang=EN&part=1&occ=first&mode=DOC&pageIndex=0&cid=2571804 6/19