Premessa 50
Recital 50
(50) L-ipproċessar ta’ data personali għal finijiet oħra minbarra dawk li għalihom id-data personali tkun inġabret inizjalment għandu jkun permess biss fejn l-ipproċessar ikun kompatibbli mal-finijiet li għalihom id-data personali tkun inġabret inizjalment.
F’tali każ ma tkun meħtieġa l-ebda bażi għajr dik li tkun ippermettiet il-ġbir tad-data personali.
Jekk l-ipproċessar ikun meħtieġ għall-prestazzjoni ta’ kompitu mwettaq fl-interess pubbliku jew fl-eżerċizzju ta’ awtorità uffiċjali mogħtija lill-kontrollur, il-liġi tal-Unjoni jew tal-Istat Membru tista’ tiddetermina u tispeċifika l-kompiti u l-finijiet li għalihom l-ipproċessar ulterjuri għandu jitqies bħala kompatibbli u legali.
L-ipproċessar ulterjuri għal finijiet ta’ arkivjar fl-interess pubbliku, għal finijiet ta’ riċerka xjentifika jew storika jew għal finijiet ta’ statistika għandu jitqies bħala operazzjoni ta’ pproċessar legali kompatibbli.
Il-bażi legali pprovduta mil-liġi tal-Unjoni jew ta’ Stat Membru għall-ipproċessar ta’ data personali tista’ tipprovdi wkoll bażi legali għall-ipproċessar ulterjuri.
Sabiex jiġi ddeterminat jekk il-fini tal-ipproċessar ulterjuri jkunx kompatibbli mal-fini li għalih id-data personali tkun inġabret inizjalment, il-kontrollur, wara li jkun issodisfa r-rekwiżiti kollha għal-legalità tal-ipproċessar oriġinali, għandu jieħu kont fost oħrajn ta’ kwalunkwe rabta bejn dawk il-finijiet u l-finijiet tal-ipproċessar ulterjuri intenzjonat, il-kuntest li fih id-data personali tkun inġabret, b’mod partikolari l-aspettattivi raġonevoli tas-suġġetti tad-data abbażi tar-relazzjoni tagħhom mal-kontrollur rigward l-użu ulterjuri tagħha, in-natura tad-data personali, il-konsegwenzi tal-ipproċessar ulterjuri intenzjonat għas-suġġetti tad-data, u l-eżistenza ta’ salvagwardji adatti kemm fl-operazzjoni tal-ipproċessar oriġinali kif ukoll f’dik tal-ipproċessar ulterjuri intenzjonat.
(50) The processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected.
In such a case, no legal basis separate from that which allowed the collection of the personal data is required.
If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, Union or Member State law may determine and specify the tasks and purposes for which the further processing should be regarded as compatible and lawful.
Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations.
The legal basis provided by Union or Member State law for the processing of personal data may also provide a legal basis for further processing.
In order to ascertain whether a purpose of further processing is compatible with the purpose for which the personal data are initially collected, the controller, after having met all the requirements for the lawfulness of the original processing, should take into account, inter alia: any link between those purposes and the purposes of the intended further processing; the context in which the personal data have been collected, in particular the reasonable expectations of data subjects based on their relationship with the controller as to their further use; the nature of the personal data; the consequences of the intended further processing for data subjects; and the existence of appropriate safeguards in both the original and intended further processing operations.
Fejn is-suġġett tad-data jkun ta kunsens jew l-ipproċessar ikun bbażat fuq il-liġi tal-Unjoni jew ta’ Stat Membru li tikkostitwixxi miżura neċessarja u proporzjonata f’soċjetà demokratika biex jiġu salvagwardati, b’mod partikolari, objettivi importanti ta’ interess pubbliku ġenerali, il-kontrollur għandu jkun jista’ jwettaq ipproċessar ulterjuri tad-data personali irrispettivament mill-kompatibbiltà tal-għanijiet.
Fi kwalunkwe każ, l-applikazzjoni tal-prinċipji stabbiliti f’dan ir-Regolament u b’mod partikolari l-għoti ta’ informazzjoni lis-suġġett tad-data dwar dawk il-finijiet l-oħra u dwar id-drittijiet tiegħu jew tagħha, inkluż id-dritt li joġġezzjona, għandhom ikunu żgurati.
L-indikar tal-possibbiltà ta’ atti kriminali jew theddid għas-sigurtà pubblika mill-kontrollur u t-trażmissjoni tad-data personali rilevanti f’każijiet individwali jew f’diversi każijiet b’rabta mal-istess att kriminali jew theddid għas-sigurtà pubblika lil awtorità kompetenti għandhom jitqiesu bħala li huma fl-interess leġittimu mfittex mill-kontrollur.
Madankollu, tali trażmissjoni fl-interess leġittimu tal-kontrollur jew l-ipproċessar ulterjuri ta’ data personali għandhom ikunu projbiti jekk l-ipproċessar ma jkunx kompatibbli ma’ obbligu ta’ segretezza legali, professjonali jew obbligu vinkolanti ieħor ta’ segretezza.
Where the data subject has given consent or the processing is based on Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard, in particular, important objectives of general public interest, the controller should be allowed to further process the personal data irrespective of the compatibility of the purposes.
In any case, the application of the principles set out in this Regulation and in particular the information of the data subject on those other purposes and on his or her rights including the right to object, should be ensured.
Indicating possible criminal acts or threats to public security by the controller and transmitting the relevant personal data in individual cases or in several cases relating to the same criminal act or threats to public security to a competent authority should be regarded as being in the legitimate interest pursued by the controller.
However, such transmission in the legitimate interest of the controller or further processing of personal data should be prohibited if the processing is not compatible with a legal, professional or other binding obligation of secrecy.
The latest consolidated version of the Regulation with corrections by Corrigendum, OJ L 127, 23.5.2018, p. 2 ((EU) 2016/679). Source: EUR-lex.