Proposal for a regulation
Article 82 – paragraph 1 a (new)
1 a. Notwithstanding the other provisions of this Regulation, the legal provisions of Member States referred to in paragraph 1 shall reflect the following minimum standards: (a) Data should be processed fairly and lawfully and should only be obtained for specified and lawful purposes; only data which is necessary for the performance of a contract or the entering into a contract to which the data subject is a party, or for compliance with any legal obligation to which the data controller is subject, or where data is necessary in order to protect the vital interests of the data subject, or where it is necessary for the administration of justice, or where data is necessary for the purposes of legitimate interests pursued by the data controller provided such processing does not harm the rights and freedoms or legitimate interests of the data subject should be processed; data should be adequate, proportionate and should not be kept longer than is necessary for the purposes for which it is processed. (b) Where the data controller intends to process sensitive personal data, further conditions must apply: the privacy and private lives of the data subject shall be protected at all times; the processing is required for the purposes of complying with employment law or where it is necessary to establish, exercise or defend legal rights. (c) For the purpose of processing data subjects must be given information about the purposes of the processing and must include the following information: details of the data controller; the purposes for the processing, including details of any recipients of the personal data and their purposes; (d) Data controllers must put in place adequate technical and organisational measures to safeguard personal data which they are processing from destruction; adequate loss, unauthorised access or disclosure;