12/10/2019 CURIA - Documents (34) 5 Whereas Member States must also be authorised, when justified by grounds of important public interest, to derogate from the prohibition on processing sensitive categories of data …; whereas it is incumbent on them, however, to provide specific and suitable safeguards so as to protect the fundamental rights and the privacy of individuals;’ Article 2 of Directive 95/46 provides: ‘For the purposes of this Directive: (a) “personal data” shall mean any information relating to an identified or identifiable natural person (“data subject”); … (b) “processing of personal data” (“processing”) shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction; … (d) “controller” shall mean the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; … … (h) 6 7 “the data subject’s consent” shall mean any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed.’ In Chapter II, Section I of Directive 95/46, headed ‘Principles relating to data quality’, Article 6 reads as follows: ‘1. Member States shall provide that personal data must be: (a) processed fairly and lawfully; (b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes. … (c) adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed; (d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that data which are inaccurate or incomplete, having regard to the purposes for which they were collected or for which they are further processed, are erased or rectified; (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed. Member States shall lay down appropriate safeguards for personal data stored for longer periods for historical, statistical or scientific use. 2. It shall be for the controller to ensure that paragraph 1 is complied with.’ In Chapter II, Section II of Directive 95/46, headed ‘Criteria for making data processing legitimate’, Article 7 provides: ‘Member States shall provide that personal data may be processed only if: … curia.europa.eu/juris/document/document_print.jsf?docid=218106&text=&dir=&doclang=EN&part=1&occ=first&mode=DOC&pageIndex=0&cid=2571804 3/19